X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=src%2Fmod_auth_kerb.c;h=a404b1f6e92b574722733818f978c16ecaadead7;hb=172de5ebb610946ac8a30cd0fc9f2eb00d6437ee;hp=62b9853d51b0678f04023d573563839d5902a0b6;hpb=b495031a10c582e033136d19eb58b1b988f83305;p=mod_auth_kerb.git diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c index 62b9853..a404b1f 100644 --- a/src/mod_auth_kerb.c +++ b/src/mod_auth_kerb.c @@ -10,80 +10,85 @@ * Ludek Sulak */ -/* ==================================================================== - * The Apache Software License, Version 1.1 - * - * Copyright (c) 2000-2003 The Apache Software Foundation. All rights - * reserved. +/* + * Copyright (c) 2004-2006 Masarykova universita + * (Masaryk University, Brno, Czech Republic) + * All rights reserved. * * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: + * modification, are permitted provided that the following conditions are met: * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. The end-user documentation included with the redistribution, - * if any, must include the following acknowledgment: - * "This product includes software developed by the - * Apache Software Foundation (http://www.apache.org/)." - * Alternately, this acknowledgment may appear in the software itself, - * if and wherever such third-party acknowledgments normally appear. - * - * 4. The names "Apache" and "Apache Software Foundation" must - * not be used to endorse or promote products derived from this - * software without prior written permission. For written - * permission, please contact apache@apache.org. + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. * - * 5. Products derived from this software may not be called "Apache", - * nor may "Apache" appear in their name, without prior written - * permission of the Apache Software Foundation. + * 3. Neither the name of the University nor the names of its contributors may + * be used to endorse or promote products derived from this software + * without specific prior written permission. * - * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED - * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF - * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND - * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, - * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT - * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * ==================================================================== - * - * This software consists of voluntary contributions made by many - * individuals on behalf of the Apache Software Foundation. For more - * information on the Apache Software Foundation, please see - * . - * - * Portions of this software are based upon public domain software - * originally written at the National Center for Supercomputing Applications, - * University of Illinois, Urbana-Champaign. + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. */ #ident "$Id$" #include "config.h" -#define MODAUTHKERB_VERSION "5.0-rc4" +#include +#include +#include + +#define MODAUTHKERB_VERSION "5.0-rc7" + +#define MECH_NEGOTIATE "Negotiate" +#define SERVICE_NAME "HTTP" + +#include +#include +#include +#include +#include +#include + +#ifdef STANDARD20_MODULE_STUFF +#include +#include + +#define ap_null_cleanup NULL +#define ap_register_cleanup apr_pool_cleanup_register + +#define ap_pstrdup apr_pstrdup +#define ap_pstrcat apr_pstrcat +#define ap_pcalloc apr_pcalloc +#define ap_psprintf apr_psprintf + +#define ap_base64decode_len apr_base64_decode_len +#define ap_base64decode apr_base64_decode +#define ap_base64encode_len apr_base64_encode_len +#define ap_base64encode apr_base64_encode + +#define ap_table_setn apr_table_setn +#define ap_table_add apr_table_add +#else +#define ap_pstrchr_c strchr +#endif /* STANDARD20_MODULE_STUFF */ -#ifndef APXS1 -#include "ap_compat.h" -#include "apr_strings.h" +#ifdef _WIN32 +#define vsnprintf _vsnprintf +#define snprintf _snprintf #endif -#include "httpd.h" -#include "http_config.h" -#include "http_core.h" -#include "http_log.h" -#include "http_protocol.h" -#include "http_request.h" #ifdef KRB5 #include @@ -92,15 +97,18 @@ #else # include # include +# include # define GSS_C_NT_USER_NAME gss_nt_user_name # define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name # define krb5_get_err_text(context,code) error_message(code) #endif -#include "spnegokrb5.h" +#ifndef GSSAPI_SUPPORTS_SPNEGO +# include "spnegokrb5.h" +#endif #endif /* KRB5 */ #ifdef KRB4 -/*Prevent warning about closesocket redefinition (Apache's ap_config.h and +/* Prevent warning about closesocket redefinition (Apache's ap_config.h and * MIT Kerberos' port-sockets.h both define it as close) */ #ifdef closesocket # undef closesocket @@ -109,28 +117,32 @@ #include /* gethostbyname() */ #endif /* KRB4 */ -#ifdef APXS1 -module auth_kerb_module; -#else +#ifndef _WIN32 +/* should be HAVE_UNISTD_H instead */ +#include +#endif + +#ifdef STANDARD20_MODULE_STUFF module AP_MODULE_DECLARE_DATA auth_kerb_module; +#else +module auth_kerb_module; #endif /*************************************************************************** Macros To Ease Compatibility ***************************************************************************/ -#ifdef APXS1 +#ifdef STANDARD20_MODULE_STUFF +#define MK_POOL apr_pool_t +#define MK_TABLE_GET apr_table_get +#define MK_USER r->user +#define MK_AUTH_TYPE r->ap_auth_type +#else #define MK_POOL pool #define MK_TABLE_GET ap_table_get #define MK_USER r->connection->user #define MK_AUTH_TYPE r->connection->ap_auth_type #define PROXYREQ_PROXY STD_PROXY -#else -#define MK_POOL apr_pool_t -#define MK_TABLE_GET apr_table_get -#define MK_USER r->user -#define MK_AUTH_TYPE r->ap_auth_type -#endif /* APXS1 */ - +#endif /*************************************************************************** Auth Configuration Structure @@ -139,8 +151,12 @@ typedef struct { char *krb_auth_realms; int krb_save_credentials; int krb_verify_kdc; - char *krb_service_name; + const char *krb_service_name; int krb_authoritative; + int krb_delegate_basic; +#if 0 + int krb_ssl_preauthentication; +#endif #ifdef KRB5 char *krb_5_keytab; int krb_method_gssapi; @@ -152,19 +168,23 @@ typedef struct { #endif } kerb_auth_config; +static void +set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf, + int use_krb4, int use_krb5pwd, char *negotiate_ret_value); + static const char* -krb5_save_realms(cmd_parms *cmd, kerb_auth_config *sec, char *arg); +krb5_save_realms(cmd_parms *cmd, void *sec, const char *arg); -#ifdef APXS1 +#ifdef STANDARD20_MODULE_STUFF +#define command(name, func, var, type, usage) \ + AP_INIT_ ## type (name, (void*) func, \ + (void*)APR_OFFSETOF(kerb_auth_config, var), \ + OR_AUTHCFG | RSRC_CONF, usage) +#else #define command(name, func, var, type, usage) \ { name, func, \ (void*)XtOffsetOf(kerb_auth_config, var), \ - OR_AUTHCFG, type, usage } -#else -#define command(name, func, var, type, usage) \ - AP_INIT_ ## type (name, func, \ - (void*)APR_XtOffsetOf(kerb_auth_config, var), \ - OR_AUTHCFG, usage) + OR_AUTHCFG | RSRC_CONF, type, usage } #endif static const command_rec kerb_auth_cmds[] = { @@ -181,10 +201,18 @@ static const command_rec kerb_auth_cmds[] = { FLAG, "Verify tickets against keytab to prevent KDC spoofing attacks."), command("KrbServiceName", ap_set_string_slot, krb_service_name, - TAKE1, "Service name to be used by Apache for authentication."), + TAKE1, "Full or partial service name to be used by Apache for authentication."), command("KrbAuthoritative", ap_set_flag_slot, krb_authoritative, - FLAG, "Set to 'off' to allow access control to be passed along to lower modules if the UserID is not known to this module."), + FLAG, "Set to 'off' to allow access control to be passed along to lower modules iff the UserID is not known to this module."), + + command("KrbDelegateBasic", ap_set_flag_slot, krb_delegate_basic, + FLAG, "Always offer Basic authentication regardless of KrbMethodK5Pass and pass on authentication to lower modules if Basic headers arrive."), + +#if 0 + command("KrbEnableSSLPreauthentication", ap_set_flag_slot, krb_ssl_preauthentication, + FLAG, "Don't do Kerberos authentication if the user is already authenticated using SSL and her client certificate."), +#endif #ifdef KRB5 command("Krb5Keytab", ap_set_file_slot, krb_5_keytab, @@ -208,15 +236,67 @@ static const command_rec kerb_auth_cmds[] = { { NULL } }; -#ifdef KRB5 -typedef struct { - gss_ctx_id_t context; - gss_cred_id_t server_creds; -} gss_connection_t; +#ifdef _WIN32 +int +mkstemp(char *template) +{ + int start, i; + pid_t val; + val = getpid(); + start = strlen(template) - 1; + while(template[start] == 'X') { + template[start] = '0' + val % 10; + val /= 10; + start--; + } + + do{ + int fd; + fd = open(template, O_RDWR | O_CREAT | O_EXCL, 0600); + if(fd >= 0 || errno != EEXIST) + return fd; + i = start + 1; + do{ + if(template[i] == 0) + return -1; + template[i]++; + if(template[i] == '9' + 1) + template[i] = 'a'; + if(template[i] <= 'z') + break; + template[i] = 'a'; + i++; + }while(1); + }while(1); +} +#endif + +#if defined(KRB5) && !defined(HEIMDAL) +/* Needed to work around problems with replay caches */ +#include "mit-internals.h" -static gss_connection_t *gss_connection = NULL; +/* This is our replacement krb5_rc_store function */ +static krb5_error_code KRB5_LIB_FUNCTION +mod_auth_kerb_rc_store(krb5_context context, krb5_rcache rcache, + krb5_donot_replay_internal *donot_replay) +{ + return 0; +} -static const char *EMPTY_STRING = "\0"; +/* And this is the operations vector for our replay cache */ +const krb5_rc_ops_internal mod_auth_kerb_rc_ops = { + 0, + "dfl", + krb5_rc_dfl_init, + krb5_rc_dfl_recover, + krb5_rc_dfl_destroy, + krb5_rc_dfl_close, + mod_auth_kerb_rc_store, + krb5_rc_dfl_expunge, + krb5_rc_dfl_get_span, + krb5_rc_dfl_get_name, + krb5_rc_dfl_resolve +}; #endif @@ -229,8 +309,12 @@ static void *kerb_dir_create_config(MK_POOL *p, char *d) rec = (kerb_auth_config *) ap_pcalloc(p, sizeof(kerb_auth_config)); ((kerb_auth_config *)rec)->krb_verify_kdc = 1; - ((kerb_auth_config *)rec)->krb_service_name = "HTTP"; + ((kerb_auth_config *)rec)->krb_service_name = NULL; ((kerb_auth_config *)rec)->krb_authoritative = 1; + ((kerb_auth_config *)rec)->krb_delegate_basic = 0; +#if 0 + ((kerb_auth_config *)rec)->krb_ssl_preauthentication = 0; +#endif #ifdef KRB5 ((kerb_auth_config *)rec)->krb_method_k5pass = 1; ((kerb_auth_config *)rec)->krb_method_gssapi = 1; @@ -242,14 +326,16 @@ static void *kerb_dir_create_config(MK_POOL *p, char *d) } static const char* -krb5_save_realms(cmd_parms *cmd, kerb_auth_config *sec, char *arg) +krb5_save_realms(cmd_parms *cmd, void *vsec, const char *arg) { + kerb_auth_config *sec = (kerb_auth_config *) vsec; sec->krb_auth_realms= ap_pstrdup(cmd->pool, arg); return NULL; } -void log_rerror(const char *file, int line, int level, int status, - const request_rec *r, const char *fmt, ...) +static void +log_rerror(const char *file, int line, int level, int status, + const request_rec *r, const char *fmt, ...) { char errstr[1024]; va_list ap; @@ -259,10 +345,10 @@ void log_rerror(const char *file, int line, int level, int status, va_end(ap); -#ifdef APXS1 - ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr); -#else +#ifdef STANDARD20_MODULE_STUFF ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errstr); +#else + ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr); #endif } @@ -363,7 +449,7 @@ authenticate_user_krb4pwd(request_rec *r, sent_name = ap_getword (r->pool, &sent_pw, ':'); /* do not allow user to override realm setting of server */ - if (strchr(sent_name, '@')) { + if (ap_strchr_c(sent_name, '@')) { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "specifying realm in user name is prohibited"); return HTTP_UNAUTHORIZED; @@ -403,6 +489,7 @@ authenticate_user_krb4pwd(request_rec *r, realm = lrealm; } + /* XXX conf->krb_service_name */ ret = verify_krb4_user(r, (char *)sent_name, (sent_instance) ? sent_instance : "", (char *)realm, (char *)sent_pw, @@ -453,16 +540,137 @@ end: /*************************************************************************** Username/Password Validation for Krb5 ***************************************************************************/ + +/* MIT kerberos uses replay cache checks even during credential verification + * (i.e. in krb5_verify_init_creds()), which is obviosuly useless. In order to + * avoid problems with multiple apache processes accessing the same rcache file + * we had to use this call instead, which is only a bit modified version of + * krb5_verify_init_creds() */ +static krb5_error_code +verify_krb5_init_creds(request_rec *r, krb5_context context, krb5_creds *creds, + krb5_principal ap_req_server, krb5_keytab ap_req_keytab) +{ + krb5_error_code ret; + krb5_data req; + krb5_ccache local_ccache = NULL; + krb5_creds *new_creds = NULL; + krb5_auth_context auth_context = NULL; + krb5_keytab keytab = NULL; + char *server_name; + + memset(&req, 0, sizeof(req)); + + if (ap_req_keytab == NULL) { + ret = krb5_kt_default (context, &keytab); + if (ret) + return ret; + } else + keytab = ap_req_keytab; + + ret = krb5_cc_resolve(context, "MEMORY:", &local_ccache); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_cc_resolve() failed when verifying KDC"); + return ret; + } + + ret = krb5_cc_initialize(context, local_ccache, creds->client); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_cc_initialize() failed when verifying KDC"); + goto end; + } + + ret = krb5_cc_store_cred (context, local_ccache, creds); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_cc_initialize() failed when verifying KDC"); + goto end; + } + + ret = krb5_unparse_name(context, ap_req_server, &server_name); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_unparse_name() failed when verifying KDC"); + goto end; + } + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "Trying to verify authenticity of KDC using principal %s", server_name); + free(server_name); + + if (!krb5_principal_compare (context, ap_req_server, creds->server)) { + krb5_creds match_cred; + + memset (&match_cred, 0, sizeof(match_cred)); + + match_cred.client = creds->client; + match_cred.server = ap_req_server; + + ret = krb5_get_credentials (context, 0, local_ccache, + &match_cred, &new_creds); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_get_credentials() failed when verifying KDC"); + goto end; + } + creds = new_creds; + } + + ret = krb5_mk_req_extended (context, &auth_context, 0, NULL, creds, &req); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_mk_req_extended() failed when verifying KDC"); + goto end; + } + + krb5_auth_con_free (context, auth_context); + auth_context = NULL; + ret = krb5_auth_con_init(context, &auth_context); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_auth_con_init() failed when verifying KDC"); + goto end; + } + /* use KRB5_AUTH_CONTEXT_DO_SEQUENCE to skip replay cache checks */ + krb5_auth_con_setflags(context, auth_context, KRB5_AUTH_CONTEXT_DO_SEQUENCE); + + ret = krb5_rd_req (context, &auth_context, &req, ap_req_server, + keytab, 0, NULL); + if (ret) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "krb5_rd_req() failed when verifying KDC"); + goto end; + } + +end: +#ifdef HEIMDAL + /* XXX Do I ever want to support Heimdal 0.4 ??? */ + krb5_data_free(&req); +#else + krb5_free_data_contents(context, &req); +#endif + if (auth_context) + krb5_auth_con_free (context, auth_context); + if (new_creds) + krb5_free_creds (context, new_creds); + if (ap_req_keytab == NULL && keytab) + krb5_kt_close (context, keytab); + if (local_ccache) + krb5_cc_destroy (context, local_ccache); + + return ret; +} + /* Inspired by krb5_verify_user from Heimdal */ static krb5_error_code verify_krb5_user(request_rec *r, krb5_context context, krb5_principal principal, - krb5_ccache ccache, const char *password, const char *service, - krb5_keytab keytab, int krb_verify_kdc) + const char *password, krb5_principal server, + krb5_keytab keytab, int krb_verify_kdc, krb5_ccache *ccache) { krb5_creds creds; - krb5_principal server = NULL; krb5_error_code ret; - krb5_verify_init_creds_opt opt; + krb5_ccache ret_ccache = NULL; + char *name = NULL; /* XXX error messages shouldn't be logged here (and in the while() loop in * authenticate_user_krb5pwd() as weell), in order to avoid confusing log @@ -470,58 +678,73 @@ verify_krb5_user(request_rec *r, krb5_context context, krb5_principal principal, memset(&creds, 0, sizeof(creds)); + ret = krb5_unparse_name(context, principal, &name); + if (ret == 0) { + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "Trying to get TGT for user %s", name); + free(name); + } + ret = krb5_get_init_creds_password(context, &creds, principal, - (char *)password, krb5_prompter_posix, + (char *)password, NULL, NULL, 0, NULL, NULL); if (ret) { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "krb5_get_init_creds_password() failed: %s", krb5_get_err_text(context, ret)); - return ret; + goto end; } - ret = krb5_sname_to_principal(context, ap_get_server_name(r), service, - KRB5_NT_SRV_HST, &server); + /* XXX + { + char *realm; + + krb5_get_default_realm(context, &realm); + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "trying to verify password using key for %s/%s@%s", + service, ap_get_server_name(r), realm); + } + */ + + if (krb_verify_kdc && + (ret = verify_krb5_init_creds(r, context, &creds, server, keytab))) { + log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "failed to verify krb5 credentials: %s", + krb5_get_err_text(context, ret)); + goto end; + } + + ret = krb5_cc_resolve(context, "MEMORY:", &ret_ccache); if (ret) { - log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "krb5_sname_to_principal() failed: %s", - krb5_get_err_text(context, ret)); + log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "generating new memory ccache failed: %s", + krb5_get_err_text(context, ret)); goto end; } - krb5_verify_init_creds_opt_init(&opt); - krb5_verify_init_creds_opt_set_ap_req_nofail(&opt, krb_verify_kdc); - - ret = krb5_verify_init_creds(context, &creds, server, keytab, NULL, &opt); + ret = krb5_cc_initialize(context, ret_ccache, principal); if (ret) { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "krb5_verify_init_creds() failed: %s", + "krb5_cc_initialize() failed: %s", krb5_get_err_text(context, ret)); goto end; } - - if (ccache) { - ret = krb5_cc_initialize(context, ccache, principal); - if (ret) { - log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "krb5_cc_initialize() failed: %s", - krb5_get_err_text(context, ret)); - goto end; - } - ret = krb5_cc_store_cred(context, ccache, &creds); - if (ret) { - log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "krb5_cc_store_cred() failed: %s", - krb5_get_err_text(context, ret)); - goto end; - } + ret = krb5_cc_store_cred(context, ret_ccache, &creds); + if (ret) { + log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "krb5_cc_store_cred() failed: %s", + krb5_get_err_text(context, ret)); + goto end; } + *ccache = ret_ccache; + ret_ccache = NULL; end: krb5_free_cred_contents(context, &creds); - if (server) - krb5_free_principal(context, server); + if (ret_ccache) + krb5_cc_destroy(context, ret_ccache); + return ret; } @@ -653,23 +876,25 @@ store_krb5_creds(krb5_context kcontext, } -int authenticate_user_krb5pwd(request_rec *r, - kerb_auth_config *conf, - const char *auth_line) +static int +authenticate_user_krb5pwd(request_rec *r, + kerb_auth_config *conf, + const char *auth_line) { const char *sent_pw = NULL; const char *sent_name = NULL; const char *realms = NULL; + const char *realm = NULL; krb5_context kcontext = NULL; krb5_error_code code; krb5_principal client = NULL; + krb5_principal server = NULL; krb5_ccache ccache = NULL; krb5_keytab keytab = NULL; int ret; char *name = NULL; int all_principals_unkown; - char *ccname = NULL; - int fd; + char *p = NULL; code = krb5_init_context(&kcontext); if (code) { @@ -680,54 +905,69 @@ int authenticate_user_krb5pwd(request_rec *r, sent_pw = ap_pbase64decode(r->pool, auth_line); sent_name = ap_getword (r->pool, &sent_pw, ':'); - /* do not allow user to override realm setting of server */ - if (strchr(sent_name, '@')) { + + if (sent_pw == NULL || *sent_pw == '\0') { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "specifying realm in user name is prohibited"); + "empty passwords are not accepted"); ret = HTTP_UNAUTHORIZED; goto end; } - if (sent_pw == NULL || *sent_pw == '\0') { + if (conf->krb_5_keytab) + krb5_kt_resolve(kcontext, conf->krb_5_keytab, &keytab); + + if (conf->krb_service_name && strchr(conf->krb_service_name, '/') != NULL) + ret = krb5_parse_name (kcontext, conf->krb_service_name, &server); + else + ret = krb5_sname_to_principal(kcontext, ap_get_server_name(r), + (conf->krb_service_name) ? conf->krb_service_name : SERVICE_NAME, + KRB5_NT_SRV_HST, &server); + + if (ret) { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "empty passwords are not accepted"); + "Error parsing server name (%s): %s", + (conf->krb_service_name) ? conf->krb_service_name : SERVICE_NAME, + krb5_get_err_text(kcontext, ret)); ret = HTTP_UNAUTHORIZED; goto end; } -#ifdef HEIMDAL - code = krb5_cc_gen_new(kcontext, &krb5_mcc_ops, &ccache); -#else - code = krb5_cc_resolve(kcontext, "MEMORY:", &ccache); -#endif + code = krb5_unparse_name(kcontext, server, &name); if (code) { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "generating new memory ccache failed: %s", - krb5_get_err_text(kcontext, code)); - ret = HTTP_INTERNAL_SERVER_ERROR; - unlink(ccname); + "krb5_unparse_name() failed: %s", + krb5_get_err_text(kcontext, code)); + ret = HTTP_UNAUTHORIZED; goto end; } + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Using %s as server principal for password verification", name); + free(name); + name = NULL; - if (conf->krb_5_keytab) - krb5_kt_resolve(kcontext, conf->krb_5_keytab, &keytab); + p = strchr(sent_name, '@'); + if (p) { + *p++ = '\0'; + if (conf->krb_auth_realms && !ap_find_token(r->pool, conf->krb_auth_realms, p)) { + log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "Specified realm `%s' not allowed by configuration", p); + ret = HTTP_UNAUTHORIZED; + goto end; + } + } + realms = (p) ? p : conf->krb_auth_realms; all_principals_unkown = 1; - realms = conf->krb_auth_realms; do { - if (realms && (code = krb5_set_default_realm(kcontext, - ap_getword_white(r->pool, &realms)))){ - log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "krb5_set_default_realm() failed: %s", - krb5_get_err_text(kcontext, code)); - continue; - } + name = (char *) sent_name; + if (realms && (realm = ap_getword_white(r->pool, &realms))) + name = ap_psprintf(r->pool, "%s@%s", sent_name, realm); if (client) { krb5_free_principal(kcontext, client); client = NULL; } - code = krb5_parse_name(kcontext, sent_name, &client); + + code = krb5_parse_name(kcontext, name, &client); if (code) { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "krb5_parse_name() failed: %s", @@ -735,9 +975,8 @@ int authenticate_user_krb5pwd(request_rec *r, continue; } - code = verify_krb5_user(r, kcontext, client, ccache, sent_pw, - conf->krb_service_name, - keytab, conf->krb_verify_kdc); + code = verify_krb5_user(r, kcontext, client, sent_pw, + server, keytab, conf->krb_verify_kdc, &ccache); if (!conf->krb_authoritative && code) { /* if we're not authoritative, we allow authentication to pass on * to another modules if (and only if) the user is not known to us */ @@ -780,8 +1019,13 @@ int authenticate_user_krb5pwd(request_rec *r, ret = OK; end: + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "kerb_authenticate_user_krb5pwd ret=%d user=%s authtype=%s", + ret, (MK_USER)?MK_USER:"(NULL)", (MK_AUTH_TYPE)?MK_AUTH_TYPE:"(NULL)"); if (client) krb5_free_principal(kcontext, client); + if (server) + krb5_free_principal(kcontext, server); if (ccache) krb5_cc_destroy(kcontext, ccache); if (keytab) @@ -802,7 +1046,6 @@ get_gss_error(MK_POOL *p, OM_uint32 err_maj, OM_uint32 err_min, char *prefix) OM_uint32 msg_ctx = 0; gss_buffer_desc status_string; char *err_msg; - size_t len; err_msg = ap_pstrdup(p, prefix); do { @@ -834,25 +1077,6 @@ get_gss_error(MK_POOL *p, OM_uint32 err_maj, OM_uint32 err_min, char *prefix) } static int -cleanup_gss_connection(void *data) -{ - OM_uint32 minor_status; - gss_connection_t *gss_conn = (gss_connection_t *)data; - - if (data == NULL) - return OK; - if (gss_conn->context != GSS_C_NO_CONTEXT) - gss_delete_sec_context(&minor_status, &gss_conn->context, - GSS_C_NO_BUFFER); - if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL) - gss_release_cred(&minor_status, &gss_conn->server_creds); - - gss_connection = NULL; - - return OK; -} - -static int store_gss_creds(request_rec *r, kerb_auth_config *conf, char *princ_name, gss_cred_id_t delegated_cred) { @@ -909,34 +1133,54 @@ get_gss_creds(request_rec *r, kerb_auth_config *conf, gss_cred_id_t *server_creds) { - gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER; + gss_buffer_desc token = GSS_C_EMPTY_BUFFER; OM_uint32 major_status, minor_status, minor_status2; gss_name_t server_name = GSS_C_NO_NAME; char buf[1024]; + int have_server_princ; -#if 0 - /* Don't specify service name. This makes MIT 1.3 not to use replay caches, - * which causes large problems with the Microsoft krb5 implementation. MS - * obviously uses a format of the krb5 authenticator that is considered by - * the MIT as replay (Two valid MS authenticators may contain the same time - * and utime fields and only differ in the sequential numbers). - */ - snprintf(buf, sizeof(buf), "%s/%s", conf->krb_service_name, - ap_get_server_name(r)); +#ifndef HEIMDAL + /* Suppress the MIT replay cache. Requires MIT Kerberos 1.4.0 or later. + 1.3.x are covered by the hack overiding the replay calls */ + if (getenv("KRB5RCACHETYPE") == NULL) + putenv("KRB5RCACHETYPE=none"); +#endif - input_token.value = buf; - input_token.length = strlen(buf) + 1; + have_server_princ = conf->krb_service_name && strchr(conf->krb_service_name, '/') != NULL; + if (have_server_princ) + strncpy(buf, conf->krb_service_name, sizeof(buf)); + else + snprintf(buf, sizeof(buf), "%s@%s", + (conf->krb_service_name) ? conf->krb_service_name : SERVICE_NAME, + ap_get_server_name(r)); - major_status = gss_import_name(&minor_status, &input_token, - GSS_C_NT_USER_NAME, + token.value = buf; + token.length = strlen(buf) + 1; + + major_status = gss_import_name(&minor_status, &token, + (have_server_princ) ? GSS_KRB5_NT_PRINCIPAL_NAME : GSS_C_NT_HOSTBASED_SERVICE, &server_name); + memset(&token, 0, sizeof(token)); if (GSS_ERROR(major_status)) { log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "%s", get_gss_error(r->pool, major_status, minor_status, "gss_import_name() failed")); return HTTP_INTERNAL_SERVER_ERROR; } -#endif + + major_status = gss_display_name(&minor_status, server_name, &token, NULL); + if (GSS_ERROR(major_status)) { + /* Perhaps we could just ignore this error but it's safer to give up now, + I think */ + log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "%s", get_gss_error(r->pool, major_status, minor_status, + "gss_display_name() failed")); + return HTTP_INTERNAL_SERVER_ERROR; + } + + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Acquiring creds for %s", + token.value); + gss_release_buffer(&minor_status, &token); major_status = gss_acquire_cred(&minor_status, server_name, GSS_C_INDEFINITE, GSS_C_NO_OID_SET, GSS_C_ACCEPT, @@ -948,6 +1192,31 @@ get_gss_creds(request_rec *r, "gss_acquire_cred() failed")); return HTTP_INTERNAL_SERVER_ERROR; } + +#ifndef HEIMDAL + /* + * With MIT Kerberos 5 1.3.x the gss_cred_id_t is the same as + * krb5_gss_cred_id_t and krb5_gss_cred_id_rec contains a pointer to + * the replay cache. + * This allows us to override the replay cache function vector with + * our own one. + * Note that this is a dirty hack to get things working and there may + * well be unknown side-effects. + */ + { + krb5_gss_cred_id_t gss_creds = (krb5_gss_cred_id_t) *server_creds; + + /* First we try to verify we are linked with 1.3.x to prevent from + crashing when linked with 1.4.x */ + if (gss_creds && (gss_creds->usage == GSS_C_ACCEPT)) { + if (gss_creds->rcache && gss_creds->rcache->ops && + gss_creds->rcache->ops->type && + memcmp(gss_creds->rcache->ops->type, "dfl", 3) == 0) + /* Override the rcache operations */ + gss_creds->rcache->ops = &mod_auth_kerb_rc_ops; + } + } +#endif return 0; } @@ -990,26 +1259,20 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, int ret; gss_name_t client_name = GSS_C_NO_NAME; gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL; - OM_uint32 (*accept_sec_token)(); + OM_uint32 (KRB5_LIB_FUNCTION *accept_sec_token) + (OM_uint32 *, gss_ctx_id_t *, const gss_cred_id_t, + const gss_buffer_t, const gss_channel_bindings_t, + gss_name_t *, gss_OID *, gss_buffer_t, OM_uint32 *, + OM_uint32 *, gss_cred_id_t *); gss_OID_desc spnego_oid; + gss_ctx_id_t context = GSS_C_NO_CONTEXT; + gss_cred_id_t server_creds = GSS_C_NO_CREDENTIAL; - *negotiate_ret_value = (char *)EMPTY_STRING; + *negotiate_ret_value = "\0"; spnego_oid.length = 6; spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02"; - if (gss_connection == NULL) { - gss_connection = ap_pcalloc(r->connection->pool, sizeof(*gss_connection)); - if (gss_connection == NULL) { - log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "ap_pcalloc() failed (not enough memory)"); - ret = HTTP_INTERNAL_SERVER_ERROR; - goto end; - } - memset(gss_connection, 0, sizeof(*gss_connection)); - ap_register_cleanup(r->connection->pool, gss_connection, cleanup_gss_connection, ap_null_cleanup); - } - if (conf->krb_5_keytab) { char *ktname; /* we don't use the ap_* calls here, since the string passed to putenv() @@ -1023,13 +1286,15 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, } sprintf(ktname, "KRB5_KTNAME=%s", conf->krb_5_keytab); putenv(ktname); +#ifdef HEIMDAL + /* Seems to be also supported by latest MIT */ + gsskrb5_register_acceptor_identity(conf->krb_5_keytab); +#endif } - if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) { - ret = get_gss_creds(r, conf, &gss_connection->server_creds); - if (ret) - goto end; - } + ret = get_gss_creds(r, conf, &server_creds); + if (ret) + goto end; /* ap_getword() shifts parameter */ auth_param = ap_getword_white(r->pool, &auth_line); @@ -1050,12 +1315,21 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, } input_token.length = ap_base64decode(input_token.value, auth_param); +#ifdef GSSAPI_SUPPORTS_SPNEGO + accept_sec_token = gss_accept_sec_context; +#else accept_sec_token = (cmp_gss_type(&input_token, &spnego_oid) == 0) ? gss_accept_sec_context_spnego : gss_accept_sec_context; +#endif + + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Verifying client data using %s", + (accept_sec_token == gss_accept_sec_context) + ? "KRB5 GSS-API" + : "SPNEGO GSS-API"); major_status = accept_sec_token(&minor_status, - &gss_connection->context, - gss_connection->server_creds, + &context, + server_creds, &input_token, GSS_C_NO_CHANNEL_BINDINGS, &client_name, @@ -1064,6 +1338,8 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, NULL, NULL, &delegated_cred); + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "Verification returned code %d", major_status); if (output_token.length) { char *token = NULL; size_t len; @@ -1080,10 +1356,18 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, ap_base64encode(token, output_token.value, output_token.length); token[len] = '\0'; *negotiate_ret_value = token; + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "GSS-API token of length %d bytes will be sent back", + output_token.length); gss_release_buffer(&minor_status2, &output_token); + set_kerb_auth_headers(r, conf, 0, 0, *negotiate_ret_value); } if (GSS_ERROR(major_status)) { + if (input_token.length > 7 && memcmp(input_token.value, "NTLMSSP", 7) == 0) + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration."); + log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "%s", get_gss_error(r->pool, major_status, minor_status, "gss_accept_sec_context() failed")); @@ -1093,12 +1377,15 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, goto end; } +#if 0 + /* This is a _Kerberos_ module so multiple authentication rounds aren't + * supported. If we wanted a generic GSS authentication we would have to do + * some magic with exporting context etc. */ if (major_status & GSS_S_CONTINUE_NEEDED) { - /* Some GSSAPI mechanism (eg GSI from Globus) may require multiple - * iterations to establish authentication */ ret = HTTP_UNAUTHORIZED; goto end; } +#endif major_status = gss_display_name(&minor_status, client_name, &output_token, NULL); gss_release_name(&minor_status, &client_name); @@ -1110,7 +1397,7 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, goto end; } - MK_AUTH_TYPE = "Negotiate"; + MK_AUTH_TYPE = MECH_NEGOTIATE; MK_USER = ap_pstrdup(r->pool, output_token.value); if (conf->krb_save_credentials && delegated_cred != GSS_C_NO_CREDENTIAL) @@ -1130,7 +1417,11 @@ end: if (client_name != GSS_C_NO_NAME) gss_release_name(&minor_status, &client_name); - cleanup_gss_connection(gss_connection); + if (server_creds != GSS_C_NO_CREDENTIAL) + gss_release_cred(&minor_status, &server_creds); + + if (context != GSS_C_NO_CONTEXT) + gss_delete_sec_context(&minor_status, &context, GSS_C_NO_BUFFER); return ret; } @@ -1141,15 +1432,15 @@ already_succeeded(request_rec *r) { if (ap_is_initial_req(r) || MK_AUTH_TYPE == NULL) return 0; - if (strcmp(MK_AUTH_TYPE, "Negotiate") || + if (strcmp(MK_AUTH_TYPE, MECH_NEGOTIATE) || (strcmp(MK_AUTH_TYPE, "Basic") && strchr(MK_USER, '@'))) return 1; return 0; } static void -note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf, - int use_krb4, int use_krb5, char *negotiate_ret_value) +set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf, + int use_krb4, int use_krb5pwd, char *negotiate_ret_value) { const char *auth_name = NULL; int set_basic = 0; @@ -1160,14 +1451,15 @@ note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf, /* get the user realm specified in .htaccess */ auth_name = ap_auth_name(r); - /* XXX should the WWW-Authenticate header be cleared first? */ + /* XXX should the WWW-Authenticate header be cleared first? + * apache in the proxy mode should retain client's authN headers? */ #ifdef KRB5 - if (use_krb5 && conf->krb_method_gssapi && negotiate_ret_value != NULL) { - negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" : - ap_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL); + if (negotiate_ret_value != NULL && conf->krb_method_gssapi) { + negoauth_param = (*negotiate_ret_value == '\0') ? MECH_NEGOTIATE : + ap_pstrcat(r->pool, MECH_NEGOTIATE " ", negotiate_ret_value, NULL); ap_table_add(r->err_headers_out, header_name, negoauth_param); } - if (use_krb5 && conf->krb_method_k5pass) { + if ((use_krb5pwd && conf->krb_method_k5pass) || conf->krb_delegate_basic) { ap_table_add(r->err_headers_out, header_name, ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL)); set_basic = 1; @@ -1175,13 +1467,15 @@ note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf, #endif #ifdef KRB4 - if (use_krb4 && conf->krb_method_k4pass && !set_basic) + if (!set_basic && + ((use_krb4 && conf->krb_method_k4pass) || conf->krb_delegate_basic)) ap_table_add(r->err_headers_out, header_name, ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL)); #endif } -int kerb_authenticate_user(request_rec *r) +static int +kerb_authenticate_user(request_rec *r) { kerb_auth_config *conf = (kerb_auth_config *) ap_get_module_config(r->per_dir_config, @@ -1192,31 +1486,56 @@ int kerb_authenticate_user(request_rec *r) int use_krb5 = 0, use_krb4 = 0; int ret; static int last_return = HTTP_UNAUTHORIZED; - char *negotiate_ret_value; + char *negotiate_ret_value = NULL; /* get the type specified in .htaccess */ type = ap_auth_type(r); + log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, + "kerb_authenticate_user entered with user %s and auth_type %s", + (MK_USER)?MK_USER:"(NULL)",type?type:"(NULL)"); + if (type && strcasecmp(type, "Kerberos") == 0) use_krb5 = use_krb4 = 1; else if(type && strcasecmp(type, "KerberosV5") == 0) - use_krb4 = 0; + use_krb5 = 1; else if(type && strcasecmp(type, "KerberosV4") == 0) - use_krb5 = 0; + use_krb4 = 1; else return DECLINED; +#if 0 + if (conf->krb_ssl_preauthentication) { + const char *ssl_client_verify = ssl_var_lookup(r->pool, r->server, + r->connection, r, "SSL_CLIENT_VERIFY"); + + if (ssl_client_verify && strcmp(ssl_client_verify, "SUCCESS") == 0) + return OK; + } +#endif + /* get what the user sent us in the HTTP header */ - auth_line = MK_TABLE_GET(r->headers_in, "Authorization"); + auth_line = MK_TABLE_GET(r->headers_in, (r->proxyreq == PROXYREQ_PROXY) + ? "Proxy-Authorization" + : "Authorization"); if (!auth_line) { - auth_line = MK_TABLE_GET(r->headers_in, "Proxy-Authorization"); - if (!auth_line) { - note_kerb_auth_failure(r, conf, use_krb4, use_krb5, "\0"); - return HTTP_UNAUTHORIZED; - } + set_kerb_auth_headers(r, conf, use_krb4, use_krb5, + (use_krb5) ? "\0" : NULL); + return HTTP_UNAUTHORIZED; } auth_type = ap_getword_white(r->pool, &auth_line); + /* If we are delegating Basic to other modules, DECLINE the request */ + if (conf->krb_delegate_basic && +#ifdef KRB5 + !conf->krb_method_k5pass && +#endif +#ifdef KRB4 + !conf->krb_method_k4pass && +#endif + (strcasecmp(auth_type, "Basic") == 0)) + return DECLINED; + if (already_succeeded(r)) return last_return; @@ -1224,7 +1543,7 @@ int kerb_authenticate_user(request_rec *r) #ifdef KRB5 if (use_krb5 && conf->krb_method_gssapi && - strcasecmp(auth_type, "Negotiate") == 0) { + strcasecmp(auth_type, MECH_NEGOTIATE) == 0) { ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value); } else if (use_krb5 && conf->krb_method_k5pass && strcasecmp(auth_type, "Basic") == 0) { @@ -1239,7 +1558,9 @@ int kerb_authenticate_user(request_rec *r) #endif if (ret == HTTP_UNAUTHORIZED) - note_kerb_auth_failure(r, conf, use_krb4, use_krb5, negotiate_ret_value); + set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value); + + /* XXX log_debug: if ret==OK, log(user XY authenticated) */ last_return = ret; return ret; @@ -1249,7 +1570,7 @@ int kerb_authenticate_user(request_rec *r) /*************************************************************************** Module Setup/Configuration ***************************************************************************/ -#ifdef APXS1 +#ifndef STANDARD20_MODULE_STUFF module MODULE_VAR_EXPORT auth_kerb_module = { STANDARD_MODULE_STUFF, NULL, /* module initializer */ @@ -1270,6 +1591,12 @@ module MODULE_VAR_EXPORT auth_kerb_module = { NULL, /* process initialization */ NULL, /* process exit/cleanup */ NULL /* [ 1] post read_request handling */ +#ifdef EAPI + ,NULL, /* EAPI: add_module */ + NULL, /* EAPI: remove_module */ + NULL, /* EAPI: rewrite_command */ + NULL /* EAPI: new_connection */ +#endif }; #else static int @@ -1280,7 +1607,8 @@ kerb_init_handler(apr_pool_t *p, apr_pool_t *plog, return OK; } -void kerb_register_hooks(apr_pool_t *p) +static void +kerb_register_hooks(apr_pool_t *p) { ap_hook_post_config(kerb_init_handler, NULL, NULL, APR_HOOK_MIDDLE); ap_hook_check_user_id(kerb_authenticate_user, NULL, NULL, APR_HOOK_MIDDLE);