kuser/kinit.c

   1 /*
   2  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kuser_locl.h"
  37
  38 #ifdef __APPLE__
  39 #include <Security/Security.h>
  40 #endif
  41
  42 #ifndef NO_NTLM
  43 #include "heimntlm.h"
  44 #endif
  45
  46 int forwardable_flag    = -1;
  47 int proxiable_flag      = -1;
  48 int renewable_flag      = -1;
  49 int renew_flag          = 0;
  50 int pac_flag            = -1;
  51 int validate_flag       = 0;
  52 int version_flag        = 0;
  53 int help_flag           = 0;
  54 int addrs_flag          = -1;
  55 struct getarg_strings extra_addresses;
  56 int anonymous_flag      = 0;
  57 char *lifetime          = NULL;
  58 char *renew_life        = NULL;
  59 char *server_str        = NULL;
  60 char *cred_cache        = NULL;
  61 char *start_str         = NULL;
  62 static int switch_cache_flags = 1;
  63 struct getarg_strings etype_str;
  64 int use_keytab          = 0;
  65 char *keytab_str        = NULL;
  66 static krb5_keytab kt   = NULL;
  67 int do_afslog           = -1;
  68 int fcache_version;
  69 char *password_file     = NULL;
  70 char *pk_user_id        = NULL;
  71 int pk_enterprise_flag = 0;
  72 struct hx509_certs_data *ent_user_id = NULL;
  73 char *pk_x509_anchors   = NULL;
  74 int pk_use_enckey       = 0;
  75 static int canonicalize_flag = 0;
  76 static int enterprise_flag = 0;
  77 static int ok_as_delegate_flag = 0;
  78 static char *fast_armor_cache_string = NULL;
  79 static int use_referrals_flag = 0;
  80 static int windows_flag = 0;
  81 #ifndef NO_NTLM
  82 static char *ntlm_domain;
  83 #endif
  84
  85
  86 static struct getargs args[] = {
  87     /*
  88      * used by MIT
  89      * a: ~A
  90      * V: verbose
  91      * F: ~f
  92      * P: ~p
  93      * C: v4 cache name?
  94      * 5:
  95      *
  96      * old flags
  97      * 4:
  98      * 9:
  99      */
 100     { "afslog",         0  , arg_flag, &do_afslog,
 101       NP_("obtain afs tokens", ""), NULL },
 102
 103     { "cache",          'c', arg_string, &cred_cache,
 104       NP_("credentials cache", ""), "cachename" },
 105
 106     { "forwardable",    'F', arg_negative_flag, &forwardable_flag,
 107       NP_("get tickets not forwardable", ""), NULL },
 108
 109     { NULL,             'f', arg_flag, &forwardable_flag,
 110       NP_("get forwardable tickets", ""), NULL },
 111
 112     { "keytab",         't', arg_string, &keytab_str,
 113       NP_("keytab to use", ""), "keytabname" },
 114
 115     { "lifetime",       'l', arg_string, &lifetime,
 116       NP_("lifetime of tickets", ""), "time" },
 117
 118     { "proxiable",      'p', arg_flag, &proxiable_flag,
 119       NP_("get proxiable tickets", ""), NULL },
 120
 121     { "renew",          'R', arg_flag, &renew_flag,
 122       NP_("renew TGT", ""), NULL },
 123
 124     { "renewable",      0,   arg_flag, &renewable_flag,
 125       NP_("get renewable tickets", ""), NULL },
 126
 127     { "renewable-life", 'r', arg_string, &renew_life,
 128       NP_("renewable lifetime of tickets", ""), "time" },
 129
 130     { "server",         'S', arg_string, &server_str,
 131       NP_("server to get ticket for", ""), "principal" },
 132
 133     { "start-time",     's', arg_string, &start_str,
 134       NP_("when ticket gets valid", ""), "time" },
 135
 136     { "use-keytab",     'k', arg_flag, &use_keytab,
 137       NP_("get key from keytab", ""), NULL },
 138
 139     { "validate",       'v', arg_flag, &validate_flag,
 140       NP_("validate TGT", ""), NULL },
 141
 142     { "enctypes",       'e', arg_strings, &etype_str,
 143       NP_("encryption types to use", ""), "enctypes" },
 144
 145     { "fcache-version", 0,   arg_integer, &fcache_version,
 146       NP_("file cache version to create", ""), NULL },
 147
 148     { "addresses",      'A',   arg_negative_flag,       &addrs_flag,
 149       NP_("request a ticket with no addresses", ""), NULL },
 150
 151     { "extra-addresses",'a', arg_strings,       &extra_addresses,
 152       NP_("include these extra addresses", ""), "addresses" },
 153
 154     { "anonymous",      0,   arg_flag,  &anonymous_flag,
 155       NP_("request an anonymous ticket", ""), NULL },
 156
 157     { "request-pac",    0,   arg_flag,  &pac_flag,
 158       NP_("request a Windows PAC", ""), NULL },
 159
 160     { "password-file",  0,   arg_string, &password_file,
 161       NP_("read the password from a file", ""), NULL },
 162
 163     { "canonicalize",0,   arg_flag, &canonicalize_flag,
 164       NP_("canonicalize client principal", ""), NULL },
 165
 166     { "enterprise",0,   arg_flag, &enterprise_flag,
 167       NP_("parse principal as a KRB5-NT-ENTERPRISE name", ""), NULL },
 168 #ifdef PKINIT
 169     { "pk-enterprise",  0,      arg_flag,       &pk_enterprise_flag,
 170       NP_("use enterprise name from certificate", ""), NULL },
 171
 172     { "pk-user",        'C',    arg_string,     &pk_user_id,
 173       NP_("principal's public/private/certificate identifier", ""), "id" },
 174
 175     { "x509-anchors",   'D',  arg_string, &pk_x509_anchors,
 176       NP_("directory with CA certificates", ""), "directory" },
 177
 178     { "pk-use-enckey",  0,  arg_flag, &pk_use_enckey,
 179       NP_("Use RSA encrypted reply (instead of DH)", ""), NULL },
 180 #endif
 181 #ifndef NO_NTLM
 182     { "ntlm-domain",    0,  arg_string, &ntlm_domain,
 183       NP_("NTLM domain", ""), "domain" },
 184 #endif
 185
 186     { "change-default",  0,  arg_negative_flag, &switch_cache_flags,
 187       NP_("switch the default cache to the new credentials cache", ""), NULL },
 188
 189     { "ok-as-delegate", 0,  arg_flag, &ok_as_delegate_flag,
 190       NP_("honor ok-as-delegate on tickets", ""), NULL },
 191
 192     { "fast-armor-cache",       0,  arg_string, &fast_armor_cache_string,
 193       NP_("use this credential cache as FAST armor cache", ""), "cache" },
 194
 195     { "use-referrals",  0,  arg_flag, &use_referrals_flag,
 196       NP_("only use referrals, no dns canalisation", ""), NULL },
 197
 198     { "windows",        0,  arg_flag, &windows_flag,
 199       NP_("get windows behavior", ""), NULL },
 200
 201     { "version",        0,   arg_flag, &version_flag, NULL, NULL },
 202     { "help",           0,   arg_flag, &help_flag, NULL, NULL }
 203 };
 204
 205 static void
 206 usage(int ret)
 207 {
 208     arg_printusage_i18n(args, sizeof(args)/sizeof(*args), N_("Usage: ", ""),
 209                         NULL, "[principal [command]]", getarg_i18n);
 210     exit(ret);
 211 }
 212
 213 static krb5_error_code
 214 get_server(krb5_context context,
 215            krb5_principal client,
 216            const char *server,
 217            krb5_principal *princ)
 218 {
 219     krb5_const_realm realm;
 220     if (server)
 221         return krb5_parse_name(context, server, princ);
 222
 223     realm = krb5_principal_get_realm(context, client);
 224     return krb5_make_principal(context, princ, realm,
 225                                KRB5_TGS_NAME, realm, NULL);
 226 }
 227
 228 static krb5_error_code
 229 copy_configs(krb5_context context,
 230              krb5_ccache dst,
 231              krb5_ccache src,
 232              krb5_principal start_ticket_server)
 233 {
 234     krb5_error_code ret;
 235     const char *cfg_names[] = {"realm-config", "FriendlyName", NULL};
 236     const char *cfg_names_w_pname[] = {"fast_avail", NULL};
 237     krb5_data cfg_data;
 238     size_t i;
 239
 240     for (i = 0; cfg_names[i]; i++) {
 241         ret = krb5_cc_get_config(context, src, NULL, cfg_names[i], &cfg_data);
 242         if (ret == KRB5_CC_NOTFOUND || ret == KRB5_CC_END) {
 243             continue;
 244         } else if (ret) {
 245             krb5_warn(context, ret, "krb5_cc_get_config");
 246             return ret;
 247         }
 248         ret = krb5_cc_set_config(context, dst, NULL, cfg_names[i], &cfg_data);
 249         if (ret)
 250             krb5_warn(context, ret, "krb5_cc_set_config");
 251     }
 252     for (i = 0; start_ticket_server && cfg_names_w_pname[i]; i++) {
 253         ret = krb5_cc_get_config(context, src, start_ticket_server,
 254                                  cfg_names_w_pname[i], &cfg_data);
 255         if (ret == KRB5_CC_NOTFOUND || ret == KRB5_CC_END) {
 256             continue;
 257         } else if (ret) {
 258             krb5_warn(context, ret, "krb5_cc_get_config");
 259             return ret;
 260         }
 261         ret = krb5_cc_set_config(context, dst, start_ticket_server,
 262                                  cfg_names_w_pname[i], &cfg_data);
 263         if (ret && ret != KRB5_CC_NOTFOUND)
 264             krb5_warn(context, ret, "krb5_cc_set_config");
 265     }
 266     /*
 267      * We don't copy cc configs for any other principals though (mostly
 268      * those are per-target time offsets and the like, so it's bad to
 269      * lose them, but hardly the end of the world, and as they may not
 270      * expire anyways, it's good to let them go).
 271      */
 272     return 0;
 273 }
 274
 275 static int
 276 renew_validate(krb5_context context,
 277                int renew,
 278                int validate,
 279                krb5_ccache cache,
 280                const char *server,
 281                krb5_deltat life)
 282 {
 283     krb5_error_code ret;
 284     krb5_ccache tempccache = NULL;
 285     krb5_creds in, *out = NULL;
 286     krb5_kdc_flags flags;
 287
 288     memset(&in, 0, sizeof(in));
 289
 290     ret = krb5_cc_get_principal(context, cache, &in.client);
 291     if (ret) {
 292         krb5_warn(context, ret, "krb5_cc_get_principal");
 293         return ret;
 294     }
 295     ret = get_server(context, in.client, server, &in.server);
 296     if (ret) {
 297         krb5_warn(context, ret, "get_server");
 298         goto out;
 299     }
 300
 301     if (renew) {
 302         /*
 303          * no need to check the error here, it's only to be
 304          * friendly to the user
 305          */
 306         krb5_get_credentials(context, KRB5_GC_CACHED, cache, &in, &out);
 307     }
 308
 309     flags.i = 0;
 310     flags.b.renewable         = flags.b.renew = renew;
 311     flags.b.validate          = validate;
 312
 313     if (forwardable_flag != -1)
 314         flags.b.forwardable       = forwardable_flag;
 315     else if (out)
 316         flags.b.forwardable       = out->flags.b.forwardable;
 317
 318     if (proxiable_flag != -1)
 319         flags.b.proxiable         = proxiable_flag;
 320     else if (out)
 321         flags.b.proxiable         = out->flags.b.proxiable;
 322
 323     if (anonymous_flag)
 324         flags.b.request_anonymous = anonymous_flag;
 325     if (life)
 326         in.times.endtime = time(NULL) + life;
 327
 328     if (out) {
 329         krb5_free_creds(context, out);
 330         out = NULL;
 331     }
 332
 333
 334     ret = krb5_get_kdc_cred(context,
 335                             cache,
 336                             flags,
 337                             NULL,
 338                             NULL,
 339                             &in,
 340                             &out);
 341     if (ret) {
 342         krb5_warn(context, ret, "krb5_get_kdc_cred");
 343         goto out;
 344     }
 345
 346     ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, cache),
 347                              NULL, &tempccache);
 348     if (ret) {
 349         krb5_warn(context, ret, "krb5_cc_new_unique");
 350         goto out;
 351     }
 352
 353     ret = krb5_cc_initialize(context, tempccache, in.client);
 354     if (ret) {
 355         krb5_warn(context, ret, "krb5_cc_initialize");
 356         goto out;
 357     }
 358
 359     ret = krb5_cc_store_cred(context, tempccache, out);
 360     if (ret) {
 361         krb5_warn(context, ret, "krb5_cc_store_cred");
 362         goto out;
 363     }
 364
 365     /*
 366      * We want to preserve cc configs as some are security-relevant, and
 367      * anyways it's the friendly thing to do.
 368      */
 369     ret = copy_configs(context, tempccache, cache, out->server);
 370     if (ret)
 371         goto out;
 372
 373     ret = krb5_cc_move(context, tempccache, cache);
 374     if (ret) {
 375         krb5_warn(context, ret, "krb5_cc_move");
 376         goto out;
 377     }
 378     tempccache = NULL;
 379
 380 #ifndef NO_AFS
 381     /* only do this if it's a general renew-my-tgt request */
 382     if (server == NULL && do_afslog && k_hasafs())
 383         krb5_afslog(context, cache, NULL, NULL);
 384 #endif
 385
 386 out:
 387     if (tempccache)
 388         krb5_cc_close(context, tempccache);
 389     if (out)
 390         krb5_free_creds(context, out);
 391     krb5_free_cred_contents(context, &in);
 392     return ret;
 393 }
 394
 395 #ifndef NO_NTLM
 396
 397 static krb5_error_code
 398 store_ntlmkey(krb5_context context, krb5_ccache id,
 399               const char *domain, struct ntlm_buf *buf)
 400 {
 401     krb5_error_code ret;
 402     krb5_data data;
 403     char *name;
 404     int aret;
 405
 406     aret = asprintf(&name, "ntlm-key-%s", domain);
 407     if (aret == -1 || name == NULL) {
 408         krb5_clear_error_message(context);
 409         return ENOMEM;
 410     }
 411
 412     data.length = buf->length;
 413     data.data = buf->data;
 414
 415     ret = krb5_cc_set_config(context, id, NULL, name, &data);
 416     free(name);
 417     return ret;
 418 }
 419 #endif
 420
 421 static krb5_error_code
 422 get_new_tickets(krb5_context context,
 423                 krb5_principal principal,
 424                 krb5_ccache ccache,
 425                 krb5_deltat ticket_life,
 426                 int interactive)
 427 {
 428     krb5_error_code ret;
 429     krb5_creds cred;
 430     char passwd[256];
 431     krb5_deltat start_time = 0;
 432     krb5_deltat renew = 0;
 433     const char *renewstr = NULL;
 434     krb5_enctype *enctype = NULL;
 435     krb5_ccache tempccache = NULL;
 436     krb5_init_creds_context ctx = NULL;
 437     krb5_get_init_creds_opt *opt = NULL;
 438     krb5_prompter_fct prompter = krb5_prompter_posix;
 439 #ifndef NO_NTLM
 440     struct ntlm_buf ntlmkey;
 441     memset(&ntlmkey, 0, sizeof(ntlmkey));
 442 #endif
 443     passwd[0] = '\0';
 444
 445     if (!interactive)
 446         prompter = NULL;
 447
 448     if (password_file) {
 449         FILE *f;
 450
 451         if (strcasecmp("STDIN", password_file) == 0)
 452             f = stdin;
 453         else
 454             f = fopen(password_file, "r");
 455         if (f == NULL) {
 456             krb5_warnx(context, "Failed to open the password file %s",
 457                        password_file);
 458             return errno;
 459         }
 460
 461         if (fgets(passwd, sizeof(passwd), f) == NULL) {
 462             krb5_warnx(context, N_("Failed to read password from file %s", ""),
 463                        password_file);
 464             fclose(f);
 465             return EINVAL; /* XXX Need a better error */
 466         }
 467         if (f != stdin)
 468             fclose(f);
 469         passwd[strcspn(passwd, "\n")] = '\0';
 470     }
 471
 472 #ifdef __APPLE__
 473     if (passwd[0] == '\0') {
 474         const char *realm;
 475         OSStatus osret;
 476         UInt32 length;
 477         void *buffer;
 478         char *name;
 479
 480         realm = krb5_principal_get_realm(context, principal);
 481
 482         ret = krb5_unparse_name_flags(context, principal,
 483                                       KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
 484         if (ret)
 485             goto nopassword;
 486
 487         osret = SecKeychainFindGenericPassword(NULL, strlen(realm), realm,
 488                                                strlen(name), name,
 489                                                &length, &buffer, NULL);
 490         free(name);
 491         if (osret == noErr && length < sizeof(passwd) - 1) {
 492             memcpy(passwd, buffer, length);
 493             passwd[length] = '\0';
 494         }
 495     nopassword:
 496         do { } while(0);
 497     }
 498 #endif
 499
 500     memset(&cred, 0, sizeof(cred));
 501
 502     ret = krb5_get_init_creds_opt_alloc(context, &opt);
 503     if (ret) {
 504         krb5_warn(context, ret, "krb5_get_init_creds_opt_alloc");
 505         goto out;
 506     }
 507
 508     krb5_get_init_creds_opt_set_default_flags(context, "kinit",
 509         krb5_principal_get_realm(context, principal), opt);
 510
 511     if (forwardable_flag != -1)
 512         krb5_get_init_creds_opt_set_forwardable(opt, forwardable_flag);
 513     if (proxiable_flag != -1)
 514         krb5_get_init_creds_opt_set_proxiable(opt, proxiable_flag);
 515     if (anonymous_flag)
 516         krb5_get_init_creds_opt_set_anonymous(opt, anonymous_flag);
 517     if (pac_flag != -1)
 518         krb5_get_init_creds_opt_set_pac_request(context, opt,
 519                                                 pac_flag ? TRUE : FALSE);
 520     if (canonicalize_flag)
 521         krb5_get_init_creds_opt_set_canonicalize(context, opt, TRUE);
 522     if (pk_enterprise_flag || enterprise_flag || canonicalize_flag || windows_flag)
 523         krb5_get_init_creds_opt_set_win2k(context, opt, TRUE);
 524     if (pk_user_id || ent_user_id || anonymous_flag) {
 525         ret = krb5_get_init_creds_opt_set_pkinit(context, opt,
 526                                                  principal,
 527                                                  pk_user_id,
 528                                                  pk_x509_anchors,
 529                                                  NULL,
 530                                                  NULL,
 531                                                  pk_use_enckey ? 2 : 0 |
 532                                                  anonymous_flag ? 4 : 0,
 533                                                  prompter,
 534                                                  NULL,
 535                                                  passwd);
 536         if (ret) {
 537             krb5_warn(context, ret, "krb5_get_init_creds_opt_set_pkinit");
 538             goto out;
 539         }
 540         if (ent_user_id)
 541             krb5_get_init_creds_opt_set_pkinit_user_certs(context, opt, ent_user_id);
 542     }
 543
 544     if (addrs_flag != -1)
 545         krb5_get_init_creds_opt_set_addressless(context, opt,
 546                                                 addrs_flag ? FALSE : TRUE);
 547
 548     if (renew_life == NULL && renewable_flag)
 549         renewstr = "1 month";
 550     if (renew_life)
 551         renewstr = renew_life;
 552     if (renewstr) {
 553         renew = parse_time(renewstr, "s");
 554         if (renew < 0)
 555             errx(1, "unparsable time: %s", renewstr);
 556
 557         krb5_get_init_creds_opt_set_renew_life(opt, renew);
 558     }
 559
 560     if (ticket_life != 0)
 561         krb5_get_init_creds_opt_set_tkt_life(opt, ticket_life);
 562
 563     if (start_str) {
 564         int tmp = parse_time(start_str, "s");
 565         if (tmp < 0)
 566             errx(1, N_("unparsable time: %s", ""), start_str);
 567
 568         start_time = tmp;
 569     }
 570
 571     if (etype_str.num_strings) {
 572         int i;
 573
 574         enctype = malloc(etype_str.num_strings * sizeof(*enctype));
 575         if (enctype == NULL)
 576             errx(1, "out of memory");
 577         for(i = 0; i < etype_str.num_strings; i++) {
 578             ret = krb5_string_to_enctype(context,
 579                                          etype_str.strings[i],
 580                                          &enctype[i]);
 581             if (ret)
 582                 errx(1, "unrecognized enctype: %s", etype_str.strings[i]);
 583         }
 584         krb5_get_init_creds_opt_set_etype_list(opt, enctype,
 585                                                etype_str.num_strings);
 586     }
 587
 588     ret = krb5_init_creds_init(context, principal, prompter, NULL, start_time, opt, &ctx);
 589     if (ret) {
 590         krb5_warn(context, ret, "krb5_init_creds_init");
 591         goto out;
 592     }
 593
 594     if (server_str) {
 595         ret = krb5_init_creds_set_service(context, ctx, server_str);
 596         if (ret) {
 597             krb5_warn(context, ret, "krb5_init_creds_set_service");
 598             goto out;
 599         }
 600     }
 601
 602     if (fast_armor_cache_string) {
 603         krb5_ccache fastid;
 604
 605         ret = krb5_cc_resolve(context, fast_armor_cache_string, &fastid);
 606         if (ret) {
 607             krb5_warn(context, ret, "krb5_cc_resolve(FAST cache)");
 608             goto out;
 609         }
 610
 611         ret = krb5_init_creds_set_fast_ccache(context, ctx, fastid);
 612         if (ret) {
 613             krb5_warn(context, ret, "krb5_init_creds_set_fast_ccache");
 614             goto out;
 615         }
 616     }
 617
 618     if (use_keytab || keytab_str) {
 619         ret = krb5_init_creds_set_keytab(context, ctx, kt);
 620         if (ret) {
 621             krb5_warn(context, ret, "krb5_init_creds_set_keytab");
 622             goto out;
 623         }
 624     } else if (pk_user_id || ent_user_id || anonymous_flag) {
 625
 626     } else if (!interactive && passwd[0] == '\0') {
 627         static int already_warned = 0;
 628
 629         if (!already_warned)
 630             krb5_warnx(context, "Not interactive, failed to get "
 631               "initial ticket");
 632         krb5_get_init_creds_opt_free(context, opt);
 633         already_warned = 1;
 634         return 0;
 635     } else {
 636
 637         if (passwd[0] == '\0') {
 638             char *p, *prompt;
 639             int aret = 0;
 640
 641             ret = krb5_unparse_name(context, principal, &p);
 642             if (!ret) {
 643                 aret = asprintf(&prompt, N_("%s's Password: ", ""), p);
 644                 free(p);
 645             }
 646             if (ret || aret == -1)
 647                 errx(1, "failed to generate passwd prompt: not enough memory");
 648
 649             if (UI_UTIL_read_pw_string(passwd, sizeof(passwd)-1, prompt, 0)){
 650                 memset(passwd, 0, sizeof(passwd));
 651                 errx(1, "failed to read password");
 652             }
 653             free(prompt);
 654         }
 655
 656         if (passwd[0]) {
 657             ret = krb5_init_creds_set_password(context, ctx, passwd);
 658             if (ret) {
 659                 krb5_warn(context, ret, "krb5_init_creds_set_password");
 660                 goto out;
 661             }
 662         }
 663     }
 664
 665     ret = krb5_init_creds_get(context, ctx);
 666
 667 #ifndef NO_NTLM
 668     if (ntlm_domain && passwd[0])
 669         heim_ntlm_nt_key(passwd, &ntlmkey);
 670 #endif
 671     memset(passwd, 0, sizeof(passwd));
 672
 673     switch(ret){
 674     case 0:
 675         break;
 676     case KRB5_LIBOS_PWDINTR: /* don't print anything if it was just C-c:ed */
 677         exit(1);
 678     case KRB5KRB_AP_ERR_BAD_INTEGRITY:
 679     case KRB5KRB_AP_ERR_MODIFIED:
 680     case KRB5KDC_ERR_PREAUTH_FAILED:
 681     case KRB5_GET_IN_TKT_LOOP:
 682         krb5_warnx(context, N_("Password incorrect", ""));
 683         goto out;
 684     case KRB5KRB_AP_ERR_V4_REPLY:
 685         krb5_warnx(context, N_("Looks like a Kerberos 4 reply", ""));
 686         goto out;
 687     default:
 688         krb5_warn(context, ret, "krb5_get_init_creds");
 689         goto out;
 690     }
 691
 692     krb5_process_last_request(context, opt, ctx);
 693
 694     ret = krb5_init_creds_get_creds(context, ctx, &cred);
 695     if (ret) {
 696         krb5_warn(context, ret, "krb5_init_creds_get_creds");
 697         goto out;
 698     }
 699
 700     if (ticket_life != 0) {
 701         if (abs(cred.times.endtime - cred.times.starttime - ticket_life) > 30) {
 702             char life[64];
 703             unparse_time_approx(cred.times.endtime - cred.times.starttime,
 704                                 life, sizeof(life));
 705             krb5_warnx(context, N_("NOTICE: ticket lifetime is %s", ""), life);
 706         }
 707     }
 708     if (renew_life) {
 709         if (abs(cred.times.renew_till - cred.times.starttime - renew) > 30) {
 710             char life[64];
 711             unparse_time_approx(cred.times.renew_till - cred.times.starttime,
 712                                 life, sizeof(life));
 713             krb5_warnx(context,
 714                        N_("NOTICE: ticket renewable lifetime is %s", ""),
 715                        life);
 716         }
 717     }
 718
 719     ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, ccache),
 720                              NULL, &tempccache);
 721     if (ret) {
 722         krb5_warn(context, ret, "krb5_cc_new_unique");
 723         goto out;
 724     }
 725
 726     ret = krb5_init_creds_store(context, ctx, tempccache);
 727     if (ret) {
 728         krb5_warn(context, ret, "krb5_init_creds_store");
 729         goto out;
 730     }
 731
 732     krb5_init_creds_free(context, ctx);
 733     ctx = NULL;
 734
 735     ret = krb5_cc_move(context, tempccache, ccache);
 736     if (ret) {
 737         krb5_warn(context, ret, "krb5_cc_move");
 738         goto out;
 739     }
 740     tempccache = NULL;
 741
 742     if (switch_cache_flags)
 743         krb5_cc_switch(context, ccache);
 744
 745 #ifndef NO_NTLM
 746     if (ntlm_domain && ntlmkey.data)
 747         store_ntlmkey(context, ccache, ntlm_domain, &ntlmkey);
 748 #endif
 749
 750     if (ok_as_delegate_flag || windows_flag || use_referrals_flag) {
 751         unsigned char d = 0;
 752         krb5_data data;
 753
 754         if (ok_as_delegate_flag || windows_flag)
 755             d |= 1;
 756         if (use_referrals_flag || windows_flag)
 757             d |= 2;
 758
 759         data.length = 1;
 760         data.data = &d;
 761
 762         krb5_cc_set_config(context, ccache, NULL, "realm-config", &data);
 763     }
 764
 765 out:
 766     krb5_get_init_creds_opt_free(context, opt);
 767     if (ctx)
 768         krb5_init_creds_free(context, ctx);
 769     if (tempccache)
 770         krb5_cc_close(context, tempccache);
 771
 772     if (enctype)
 773         free(enctype);
 774
 775     return ret;
 776 }
 777
 778 static time_t
 779 ticket_lifetime(krb5_context context, krb5_ccache cache, krb5_principal client,
 780                 const char *server, time_t *renew)
 781 {
 782     krb5_creds in_cred, *cred;
 783     krb5_error_code ret;
 784     time_t timeout;
 785     time_t curtime;
 786
 787     memset(&in_cred, 0, sizeof(in_cred));
 788
 789     ret = krb5_cc_get_principal(context, cache, &in_cred.client);
 790     if (ret) {
 791         krb5_warn(context, ret, "krb5_cc_get_principal");
 792         return 0;
 793     }
 794     ret = get_server(context, in_cred.client, server, &in_cred.server);
 795     if (ret) {
 796         krb5_free_principal(context, in_cred.client);
 797         krb5_warn(context, ret, "get_server");
 798         return 0;
 799     }
 800
 801     ret = krb5_get_credentials(context, KRB5_GC_CACHED,
 802                                cache, &in_cred, &cred);
 803     krb5_free_principal(context, in_cred.client);
 804     krb5_free_principal(context, in_cred.server);
 805     if (ret) {
 806         krb5_warn(context, ret, "krb5_get_credentials");
 807         return 0;
 808     }
 809     curtime = time(NULL);
 810     timeout = cred->times.endtime - curtime;
 811     if (timeout < 0)
 812         timeout = 0;
 813     if (renew) {
 814         *renew = cred->times.renew_till - curtime;
 815         if (*renew < 0)
 816             *renew = 0;
 817     }
 818     krb5_free_creds(context, cred);
 819     return timeout;
 820 }
 821
 822 struct renew_ctx {
 823     krb5_context context;
 824     krb5_ccache  ccache;
 825     krb5_principal principal;
 826     krb5_deltat ticket_life;
 827 };
 828
 829 static time_t
 830 renew_func(void *ptr)
 831 {
 832     struct renew_ctx *ctx = ptr;
 833     time_t expire;
 834     time_t renew_expire;
 835     static time_t exp_delay = 1;
 836
 837     expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
 838                              server_str, &renew_expire);
 839
 840     if (renew_expire > expire) {
 841         renew_validate(ctx->context, 1, validate_flag, ctx->ccache,
 842                        server_str, ctx->ticket_life);
 843         expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
 844                                  server_str, &renew_expire);
 845     }
 846
 847     if (expire < ctx->ticket_life / 2) {
 848         get_new_tickets(ctx->context, ctx->principal,
 849                         ctx->ccache, ctx->ticket_life, 0);
 850         expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
 851                                  server_str, &renew_expire);
 852     }
 853
 854 #ifndef NO_AFS
 855     if (do_afslog && k_hasafs())
 856         krb5_afslog(ctx->context, ctx->ccache, NULL, NULL);
 857 #endif
 858
 859     /*
 860      * If our tickets have expired and we been able to either renew them
 861      * or obtain new tickets, then we still call this function but we use
 862      * an exponential backoff.  This should take care of the case where
 863      * we are using stored credentials but the KDC has been unavailable
 864      * for some reason...
 865      */
 866
 867     if (expire < 1) {
 868         if (exp_delay < 7200)
 869             exp_delay *= 2;
 870         return exp_delay;
 871     }
 872     exp_delay = 1;
 873
 874     return expire / 2 + 1;
 875 }
 876
 877 static void
 878 set_princ_realm(krb5_context context,
 879                 krb5_principal principal,
 880                 const char *realm)
 881 {
 882     krb5_error_code ret;
 883
 884     if ((ret = krb5_principal_set_realm(context, principal, realm)) != 0)
 885         krb5_err(context, 1, ret, "krb5_principal_set_realm");
 886 }
 887
 888 static void
 889 parse_name_realm(krb5_context context,
 890                  const char *name,
 891                  int flags,
 892                  const char *realm,
 893                  krb5_principal *princ)
 894 {
 895     krb5_error_code ret;
 896
 897     if (realm)
 898         flags |= KRB5_PRINCIPAL_PARSE_NO_DEF_REALM;
 899     if ((ret = krb5_parse_name_flags(context, name, flags, princ)) != 0)
 900         krb5_err(context, 1, ret, "krb5_parse_name_flags");
 901     if (realm && krb5_principal_get_realm(context, *princ) == NULL)
 902         set_princ_realm(context, *princ, realm);
 903 }
 904
 905 static char *
 906 get_default_realm(krb5_context context)
 907 {
 908     char *realm;
 909     krb5_error_code ret;
 910
 911     if ((ret = krb5_get_default_realm(context, &realm)) != 0)
 912         krb5_err(context, 1, ret, "krb5_get_default_realm");
 913     return realm;
 914 }
 915
 916 static void
 917 get_default_principal(krb5_context context, krb5_principal *princ)
 918 {
 919     krb5_error_code ret;
 920
 921     if ((ret = krb5_get_default_principal(context, princ)) != 0)
 922         krb5_err(context, 1, ret, "krb5_get_default_principal");
 923 }
 924
 925 static char *
 926 get_user_realm(krb5_context context)
 927 {
 928     krb5_error_code ret;
 929     char *user_realm = NULL;
 930
 931     /*
 932      * If memory allocation fails, we don't try to use the wrong realm,
 933      * that will trigger misleading error messages complicate support.
 934      */
 935     krb5_appdefault_string(context, "kinit", NULL, "user_realm", "",
 936                            &user_realm);
 937     if (user_realm == NULL) {
 938         ret = krb5_enomem(context);
 939         krb5_err(context, 1, ret, "krb5_appdefault_string");
 940     }
 941
 942     if (*user_realm == 0) {
 943         free(user_realm);
 944         user_realm = NULL;
 945     }
 946
 947     return user_realm;
 948 }
 949
 950 static void
 951 get_princ(krb5_context context, krb5_principal *principal, const char *name)
 952 {
 953     krb5_error_code ret;
 954     krb5_principal tmp;
 955     int parseflags = 0;
 956     char *user_realm;
 957
 958     if (name == NULL) {
 959         krb5_ccache ccache;
 960
 961         /* If credential cache provides a client principal, use that. */
 962         if (krb5_cc_default(context, &ccache) == 0) {
 963             ret = krb5_cc_get_principal(context, ccache, principal);
 964             krb5_cc_close(context, ccache);
 965             if (ret == 0)
 966                 return;
 967         }
 968     }
 969
 970     user_realm = get_user_realm(context);
 971
 972     if (name) {
 973         if (canonicalize_flag || enterprise_flag)
 974             parseflags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
 975
 976         parse_name_realm(context, name, parseflags, user_realm, &tmp);
 977
 978         if (user_realm && krb5_principal_get_num_comp(context, tmp) > 1) {
 979             /* Principal is instance qualified, reparse with default realm. */
 980             krb5_free_principal(context, tmp);
 981             parse_name_realm(context, name, parseflags, NULL, principal);
 982         } else {
 983             *principal = tmp;
 984         }
 985     } else {
 986         get_default_principal(context, principal);
 987         if (user_realm)
 988             set_princ_realm(context, *principal, user_realm);
 989     }
 990
 991     if (user_realm)
 992         free(user_realm);
 993 }
 994
 995 static void
 996 get_princ_kt(krb5_context context,
 997              krb5_principal *principal,
 998              char *name)
 999 {
1000     krb5_error_code ret;
1001     krb5_principal tmp;
1002     krb5_ccache ccache;
1003     krb5_kt_cursor cursor;
1004     krb5_keytab_entry entry;
1005     int parseflags = 0;
1006     char *def_realm;
1007
1008     if (name == NULL) {
1009         /*
1010          * If the credential cache exists and specifies a client principal,
1011          * use that.
1012          */
1013         if (krb5_cc_default(context, &ccache) == 0) {
1014             ret = krb5_cc_get_principal(context, ccache, principal);
1015             krb5_cc_close(context, ccache);
1016             if (ret == 0)
1017                 return;
1018         }
1019     }
1020
1021     if (name) {
1022         /* If the principal specifies an explicit realm, just use that. */
1023         parseflags |= KRB5_PRINCIPAL_PARSE_NO_DEF_REALM;
1024         parse_name_realm(context, name, parseflags, NULL, &tmp);
1025         if (krb5_principal_get_realm(context, tmp) != NULL) {
1026             *principal = tmp;
1027             return;
1028         }
1029     } else {
1030         /* Otherwise, search keytab for bare name of the default principal. */
1031         get_default_principal(context, &tmp);
1032         set_princ_realm(context, tmp, NULL);
1033     }
1034
1035     def_realm = get_default_realm(context);
1036
1037     ret = krb5_kt_start_seq_get(context, kt, &cursor);
1038     if (ret)
1039         krb5_err(context, 1, ret, "krb5_kt_start_seq_get");
1040
1041     while (ret == 0 &&
1042            krb5_kt_next_entry(context, kt, &entry, &cursor) == 0) {
1043         const char *realm;
1044
1045         if (!krb5_principal_compare_any_realm(context, tmp, entry.principal))
1046             continue;
1047         if (*principal &&
1048             krb5_principal_compare(context, *principal, entry.principal))
1049             continue;
1050         /* The default realm takes precedence */
1051         realm = krb5_principal_get_realm(context, entry.principal);
1052         if (*principal && strcmp(def_realm, realm) == 0) {
1053             krb5_free_principal(context, *principal);
1054             ret = krb5_copy_principal(context, entry.principal, principal);
1055             break;
1056         }
1057         if (!*principal)
1058             ret = krb5_copy_principal(context, entry.principal, principal);
1059     }
1060     if (ret != 0 || (ret = krb5_kt_end_seq_get(context, kt, &cursor)) != 0)
1061         krb5_err(context, 1, ret, "get_princ_kt");
1062     if (!*principal)
1063         parse_name_realm(context, name, parseflags, NULL, principal);
1064
1065     krb5_free_principal(context, tmp);
1066     free(def_realm);
1067 }
1068
1069 int
1070 main(int argc, char **argv)
1071 {
1072     krb5_error_code ret;
1073     krb5_context context;
1074     krb5_ccache  ccache;
1075     krb5_principal principal = NULL;
1076     int optidx = 0;
1077     krb5_deltat ticket_life = 0;
1078
1079     setprogname(argv[0]);
1080
1081     setlocale(LC_ALL, "");
1082     bindtextdomain("heimdal_kuser", HEIMDAL_LOCALEDIR);
1083     textdomain("heimdal_kuser");
1084
1085     ret = krb5_init_context(&context);
1086     if (ret == KRB5_CONFIG_BADFORMAT)
1087         errx(1, "krb5_init_context failed to parse configuration file");
1088     else if (ret)
1089         errx(1, "krb5_init_context failed: %d", ret);
1090
1091     if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
1092         usage(1);
1093
1094     if (help_flag)
1095         usage(0);
1096
1097     if (version_flag) {
1098         print_version(NULL);
1099         exit(0);
1100     }
1101
1102     argc -= optidx;
1103     argv += optidx;
1104
1105     /*
1106      * Open the keytab now, we use the keytab to determine the principal's
1107      * realm when the requested principal has no realm.
1108      */
1109     if (use_keytab || keytab_str) {
1110         if (keytab_str)
1111             ret = krb5_kt_resolve(context, keytab_str, &kt);
1112         else
1113             ret = krb5_kt_default(context, &kt);
1114         if (ret)
1115             krb5_err(context, 1, ret, "resolving keytab");
1116     }
1117
1118     if (pk_enterprise_flag) {
1119         ret = krb5_pk_enterprise_cert(context, pk_user_id,
1120                                       argv[0], &principal,
1121                                       &ent_user_id);
1122         if (ret)
1123             krb5_err(context, 1, ret, "krb5_pk_enterprise_certs");
1124
1125         pk_user_id = NULL;
1126
1127     } else if (anonymous_flag) {
1128
1129         ret = krb5_make_principal(context, &principal, argv[0],
1130                                   KRB5_WELLKNOWN_NAME, KRB5_ANON_NAME,
1131                                   NULL);
1132         if (ret)
1133             krb5_err(context, 1, ret, "krb5_make_principal");
1134         krb5_principal_set_type(context, principal, KRB5_NT_WELLKNOWN);
1135
1136     } else if (use_keytab || keytab_str) {
1137         get_princ_kt(context, &principal, argv[0]);
1138     } else {
1139         get_princ(context, &principal, argv[0]);
1140     }
1141
1142     if (fcache_version)
1143         krb5_set_fcache_version(context, fcache_version);
1144
1145     if (renewable_flag == -1)
1146         /* this seems somewhat pointless, but whatever */
1147         krb5_appdefault_boolean(context, "kinit",
1148                                 krb5_principal_get_realm(context, principal),
1149                                 "renewable", FALSE, &renewable_flag);
1150     if (do_afslog == -1)
1151         krb5_appdefault_boolean(context, "kinit",
1152                                 krb5_principal_get_realm(context, principal),
1153                                 "afslog", TRUE, &do_afslog);
1154
1155     if (cred_cache)
1156         ret = krb5_cc_resolve(context, cred_cache, &ccache);
1157     else {
1158         if (argc > 1) {
1159             char s[1024];
1160             ret = krb5_cc_new_unique(context, NULL, NULL, &ccache);
1161             if (ret)
1162                 krb5_err(context, 1, ret, "creating cred cache");
1163             snprintf(s, sizeof(s), "%s:%s",
1164                      krb5_cc_get_type(context, ccache),
1165                      krb5_cc_get_name(context, ccache));
1166             setenv("KRB5CCNAME", s, 1);
1167         } else {
1168             ret = krb5_cc_cache_match(context, principal, &ccache);
1169             if (ret) {
1170                 const char *type;
1171                 ret = krb5_cc_default(context, &ccache);
1172                 if (ret)
1173                     krb5_err(context, 1, ret,
1174                              N_("resolving credentials cache", ""));
1175
1176                 /*
1177                  * Check if the type support switching, and we do,
1178                  * then do that instead over overwriting the current
1179                  * default credential
1180                  */
1181                 type = krb5_cc_get_type(context, ccache);
1182                 if (krb5_cc_support_switch(context, type)) {
1183                     krb5_cc_close(context, ccache);
1184                     ret = krb5_cc_new_unique(context, type, NULL, &ccache);
1185                 }
1186             }
1187         }
1188     }
1189     if (ret)
1190         krb5_err(context, 1, ret, N_("resolving credentials cache", ""));
1191
1192 #ifndef NO_AFS
1193     if (argc > 1 && k_hasafs())
1194         k_setpag();
1195 #endif
1196
1197     if (lifetime) {
1198         int tmp = parse_time(lifetime, "s");
1199         if (tmp < 0)
1200             errx(1, N_("unparsable time: %s", ""), lifetime);
1201
1202         ticket_life = tmp;
1203     }
1204
1205     if (addrs_flag == 0 && extra_addresses.num_strings > 0)
1206         krb5_errx(context, 1,
1207                   N_("specifying both extra addresses and "
1208                      "no addresses makes no sense", ""));
1209     {
1210         int i;
1211         krb5_addresses addresses;
1212         memset(&addresses, 0, sizeof(addresses));
1213         for(i = 0; i < extra_addresses.num_strings; i++) {
1214             ret = krb5_parse_address(context, extra_addresses.strings[i],
1215                                      &addresses);
1216             if (ret == 0) {
1217                 krb5_add_extra_addresses(context, &addresses);
1218                 krb5_free_addresses(context, &addresses);
1219             }
1220         }
1221         free_getarg_strings(&extra_addresses);
1222     }
1223
1224     if (renew_flag || validate_flag) {
1225         ret = renew_validate(context, renew_flag, validate_flag,
1226                              ccache, server_str, ticket_life);
1227         exit(ret != 0);
1228     }
1229
1230     ret = get_new_tickets(context, principal, ccache, ticket_life, 1);
1231     if (ret)
1232         exit(1);
1233
1234 #ifndef NO_AFS
1235     if (do_afslog && k_hasafs())
1236         krb5_afslog(context, ccache, NULL, NULL);
1237 #endif
1238     if (argc > 1) {
1239         struct renew_ctx ctx;
1240         time_t timeout;
1241
1242         timeout = ticket_lifetime(context, ccache, principal,
1243                                   server_str, NULL) / 2;
1244
1245         ctx.context = context;
1246         ctx.ccache = ccache;
1247         ctx.principal = principal;
1248         ctx.ticket_life = ticket_life;
1249
1250         ret = simple_execvp_timed(argv[1], argv+1,
1251                                   renew_func, &ctx, timeout);
1252 #define EX_NOEXEC       126
1253 #define EX_NOTFOUND     127
1254         if (ret == EX_NOEXEC)
1255             krb5_warnx(context, N_("permission denied: %s", ""), argv[1]);
1256         else if (ret == EX_NOTFOUND)
1257             krb5_warnx(context, N_("command not found: %s", ""), argv[1]);
1258
1259         krb5_cc_destroy(context, ccache);
1260 #ifndef NO_AFS
1261         if (k_hasafs())
1262             k_unlog();
1263 #endif
1264     } else {
1265         krb5_cc_close(context, ccache);
1266         ret = 0;
1267     }
1268     krb5_free_principal(context, principal);
1269     if (kt)
1270         krb5_kt_close(context, kt);
1271     krb5_free_context(context);
1272     return ret;
1273 }