send_to_kdc.c revision 72445 
1/*
2 * Copyright (c) 1997 - 2000 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35
36RCSID("$Id: send_to_kdc.c,v 1.40 2000/11/15 01:48:23 assar Exp $");
37
38/*
39 * send the data in `req' on the socket `fd' (which is datagram iff udp)
40 * waiting `tmout' for a reply and returning the reply in `rep'.
41 * iff limit read up to this many bytes
42 * returns 0 and data in `rep' if succesful, otherwise -1
43 */
44
45static int
46recv_loop (int fd,
47	   time_t tmout,
48	   int udp,
49	   size_t limit,
50	   krb5_data *rep)
51{
52     fd_set fdset;
53     struct timeval timeout;
54     int ret;
55     int nbytes;
56
57     if (fd >= FD_SETSIZE) {
58	 return -1;
59     }
60
61     krb5_data_zero(rep);
62     do {
63	 FD_ZERO(&fdset);
64	 FD_SET(fd, &fdset);
65	 timeout.tv_sec  = tmout;
66	 timeout.tv_usec = 0;
67	 ret = select (fd + 1, &fdset, NULL, NULL, &timeout);
68	 if (ret < 0) {
69	     if (errno == EINTR)
70		 continue;
71	     return -1;
72	 } else if (ret == 0) {
73	     return 0;
74	 } else {
75	     void *tmp;
76
77	     if (ioctl (fd, FIONREAD, &nbytes) < 0) {
78		 krb5_data_free (rep);
79		 return -1;
80	     }
81	     if(nbytes == 0)
82		 return 0;
83
84	     if (limit)
85		 nbytes = min(nbytes, limit - rep->length);
86
87	     tmp = realloc (rep->data, rep->length + nbytes);
88	     if (tmp == NULL) {
89		 krb5_data_free (rep);
90		 return -1;
91	     }
92	     rep->data = tmp;
93	     ret = recv (fd, (char*)tmp + rep->length, nbytes, 0);
94	     if (ret < 0) {
95		 krb5_data_free (rep);
96		 return -1;
97	     }
98	     rep->length += ret;
99	 }
100     } while(!udp && (limit == 0 || rep->length < limit));
101     return 0;
102}
103
104/*
105 * Send kerberos requests and receive a reply on a udp or any other kind
106 * of a datagram socket.  See `recv_loop'.
107 */
108
109static int
110send_and_recv_udp(int fd,
111		  time_t tmout,
112		  const krb5_data *req,
113		  krb5_data *rep)
114{
115    if (send (fd, req->data, req->length, 0) < 0)
116	return -1;
117
118    return recv_loop(fd, tmout, 1, 0, rep);
119}
120
121/*
122 * `send_and_recv' for a TCP (or any other stream) socket.
123 * Since there are no record limits on a stream socket the protocol here
124 * is to prepend the request with 4 bytes of its length and the reply
125 * is similarly encoded.
126 */
127
128static int
129send_and_recv_tcp(int fd,
130		  time_t tmout,
131		  const krb5_data *req,
132		  krb5_data *rep)
133{
134    unsigned char len[4];
135    unsigned long rep_len;
136    krb5_data len_data;
137
138    _krb5_put_int(len, req->length, 4);
139    if(net_write(fd, len, sizeof(len)) < 0)
140	return -1;
141    if(net_write(fd, req->data, req->length) < 0)
142	return -1;
143    if (recv_loop (fd, tmout, 0, 4, &len_data) < 0)
144	return -1;
145    if (len_data.length != 4) {
146	krb5_data_free (&len_data);
147	return -1;
148    }
149    _krb5_get_int(len_data.data, &rep_len, 4);
150    krb5_data_free (&len_data);
151    if (recv_loop (fd, tmout, 0, rep_len, rep) < 0)
152	return -1;
153    if(rep->length != rep_len) {
154	krb5_data_free (rep);
155	return -1;
156    }
157    return 0;
158}
159
160/*
161 * `send_and_recv' tailored for the HTTP protocol.
162 */
163
164static int
165send_and_recv_http(int fd,
166		   time_t tmout,
167		   const char *prefix,
168		   const krb5_data *req,
169		   krb5_data *rep)
170{
171    char *request;
172    char *str;
173    int ret;
174    int len = base64_encode(req->data, req->length, &str);
175
176    if(len < 0)
177	return -1;
178    asprintf(&request, "GET %s%s HTTP/1.0\r\n\r\n", prefix, str);
179    free(str);
180    if (request == NULL)
181	return -1;
182    ret = net_write (fd, request, strlen(request));
183    free (request);
184    if (ret < 0)
185	return ret;
186    ret = recv_loop(fd, tmout, 0, 0, rep);
187    if(ret)
188	return ret;
189    {
190	unsigned long rep_len;
191	char *s, *p;
192
193	s = realloc(rep->data, rep->length + 1);
194	if (s == NULL) {
195	    krb5_data_free (rep);
196	    return -1;
197	}
198	s[rep->length] = 0;
199	p = strstr(s, "\r\n\r\n");
200	if(p == NULL) {
201	    free(s);
202	    return -1;
203	}
204	p += 4;
205	rep->data = s;
206	rep->length -= p - s;
207	if(rep->length < 4) { /* remove length */
208	    free(s);
209	    return -1;
210	}
211	rep->length -= 4;
212	_krb5_get_int(p, &rep_len, 4);
213	if (rep_len != rep->length) {
214	    free(s);
215	    return -1;
216	}
217	memmove(rep->data, p + 4, rep->length);
218    }
219    return 0;
220}
221
222static int
223init_port(const char *s, int fallback)
224{
225    if (s) {
226	int tmp;
227
228	sscanf (s, "%d", &tmp);
229	return htons(tmp);
230    } else
231	return fallback;
232}
233
234/*
235 * Return 0 if succesful, otherwise 1
236 */
237
238static int
239send_via_proxy (krb5_context context,
240		const char *hostname,
241		const krb5_data *send,
242		krb5_data *receive)
243{
244    char *proxy2 = strdup(context->http_proxy);
245    char *proxy  = proxy2;
246    char *prefix;
247    char *colon;
248    struct addrinfo hints;
249    struct addrinfo *ai, *a;
250    int ret;
251    int s;
252    char portstr[NI_MAXSERV];
253
254    if (proxy == NULL)
255	return ENOMEM;
256    if (strncmp (proxy, "http://", 7) == 0)
257	proxy += 7;
258
259    colon = strchr(proxy, ':');
260    if(colon != NULL)
261	*colon++ = '\0';
262    memset (&hints, 0, sizeof(hints));
263    hints.ai_family   = PF_UNSPEC;
264    hints.ai_socktype = SOCK_STREAM;
265    snprintf (portstr, sizeof(portstr), "%d",
266	      ntohs(init_port (colon, htons(80))));
267    ret = getaddrinfo (proxy, portstr, &hints, &ai);
268    free (proxy2);
269    if (ret)
270	return krb5_eai_to_heim_errno(ret);
271
272    for (a = ai; a != NULL; a = a->ai_next) {
273	s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
274	if (s < 0)
275	    continue;
276	if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
277	    close (s);
278	    continue;
279	}
280	break;
281    }
282    if (a == NULL) {
283	freeaddrinfo (ai);
284	return 1;
285    }
286    freeaddrinfo (ai);
287
288    asprintf(&prefix, "http://%s/", hostname);
289    if(prefix == NULL) {
290	close(s);
291	return 1;
292    }
293    ret = send_and_recv_http(s, context->kdc_timeout,
294			     prefix, send, receive);
295    close (s);
296    free(prefix);
297    if(ret == 0 && receive->length != 0)
298	return 0;
299    return 1;
300}
301
302/*
303 * Send the data `send' to one KDC in `realm' and get back the reply
304 * in `receive'.
305 */
306
307krb5_error_code
308krb5_sendto (krb5_context context,
309	     const krb5_data *send,
310	     char **hostlist,
311	     int port,
312	     krb5_data *receive)
313{
314     krb5_error_code ret = 0;
315     char **hp, *p;
316     int fd;
317     int i;
318
319     for (i = 0; i < context->max_retries; ++i)
320	 for (hp = hostlist; (p = *hp); ++hp) {
321	     char *colon;
322	     int http_flag = 0;
323	     int tcp_flag = 0;
324	     struct addrinfo *ai, *a;
325	     struct addrinfo hints;
326	     char portstr[NI_MAXSERV];
327
328	     if(strncmp(p, "http://", 7) == 0){
329		 p += 7;
330		 http_flag = 1;
331		 port = htons(80);
332	     } else if(strncmp(p, "http/", 5) == 0) {
333		 p += 5;
334		 http_flag = 1;
335		 port = htons(80);
336	     }else if(strncmp(p, "tcp/", 4) == 0){
337		 p += 4;
338		 tcp_flag = 1;
339	     } else if(strncmp(p, "udp/", 4) == 0) {
340		 p += 4;
341	     }
342	     if(http_flag && context->http_proxy) {
343		 if (send_via_proxy (context, p, send, receive))
344		     continue;
345		 else
346		     goto out;
347	     }
348	     colon = strchr (p, ':');
349	     if (colon)
350		 *colon++ = '\0';
351
352	     memset (&hints, 0, sizeof(hints));
353	     hints.ai_family = PF_UNSPEC;
354	     if (tcp_flag || http_flag)
355		 hints.ai_socktype = SOCK_STREAM;
356	     else
357		 hints.ai_socktype = SOCK_DGRAM;
358	     snprintf (portstr, sizeof(portstr), "%d",
359		       ntohs(init_port (colon, port)));
360	     ret = getaddrinfo (p, portstr, &hints, &ai);
361	     if (ret)
362		 continue;
363	     for (a = ai; a != NULL; a = a->ai_next) {
364		 fd = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
365		 if (fd < 0)
366		     continue;
367		 if (connect (fd, a->ai_addr, a->ai_addrlen) < 0) {
368		     close (fd);
369		     continue;
370		 }
371		 break;
372	     }
373	     if (a == NULL) {
374		 freeaddrinfo (ai);
375		 continue;
376	     }
377	     freeaddrinfo (ai);
378
379	     if(http_flag)
380		 ret = send_and_recv_http(fd, context->kdc_timeout,
381					  "", send, receive);
382	     else if(tcp_flag)
383		 ret = send_and_recv_tcp (fd, context->kdc_timeout,
384					  send, receive);
385	     else
386		 ret = send_and_recv_udp (fd, context->kdc_timeout,
387					  send, receive);
388	     close (fd);
389	     if(ret == 0 && receive->length != 0)
390		 goto out;
391	 }
392     ret = KRB5_KDC_UNREACH;
393out:
394     return ret;
395}
396
397krb5_error_code
398krb5_sendto_kdc2(krb5_context context,
399		 const krb5_data *send,
400		 const krb5_realm *realm,
401		 krb5_data *receive,
402		 krb5_boolean master)
403{
404    krb5_error_code ret;
405    char **hostlist;
406    int port;
407
408    port = krb5_getportbyname (context, "kerberos", "udp", 88);
409
410    if (master || context->use_admin_kdc)
411	ret = krb5_get_krb_admin_hst (context, realm, &hostlist);
412    else
413	ret = krb5_get_krbhst (context, realm, &hostlist);
414    if (ret)
415	return ret;
416    ret = krb5_sendto(context, send, hostlist, port, receive);
417    krb5_free_krbhst (context, hostlist);
418    return ret;
419}
420
421krb5_error_code
422krb5_sendto_kdc(krb5_context context,
423		const krb5_data *send,
424		const krb5_realm *realm,
425		krb5_data *receive)
426{
427    return krb5_sendto_kdc2(context, send, realm, receive, FALSE);
428}
429