1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
|
/*
* Copyright 1990,1991,1997 by the Massachusetts Institute of Technology.
* All Rights Reserved.
*
* Export of this software from the United States of America may
* require a specific license from the United States Government.
* It is the responsibility of any person or organization contemplating
* export to obtain such a license before exporting.
*
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
* notice appear in all copies and that both that copyright notice and
* this permission notice appear in supporting documentation, and that
* the name of M.I.T. not be used in advertising or publicity pertaining
* to distribution of the software without specific, written prior
* permission. M.I.T. makes no representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* or implied warranty.
*
* Send a packet to a service and await a reply, using an exponential
* backoff retry algorithm. This is based on krb5_sendto_kdc.
*/
/* Grab socket stuff. This might want to go away later. */
#define NEED_SOCKETS
#define NEED_LOWLEVEL_IO
#include "k5-int.h"
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/time.h>
#ifdef _AIX
#include <sys/select.h>
#endif
#include <krb.h>
#include "krb524.h"
/* For krb5_locate_kdc() */
#include <k5-int.h>
/*
* krb524_sendto_kdc:
*
* A slightly modified version of krb5_sendto_kdc.
*
* send the formatted request 'message' to a KDC for realm 'realm' and
* return the response (if any) in 'reply'.
*
* If the message is sent and a response is received, 0 is returned,
* otherwise an error code is returned.
*
* The storage for 'reply' is allocated and should be freed by the caller
* when finished.
*/
extern int krb5_max_dgram_size;
extern int krb5_max_skdc_timeout;
extern int krb5_skdc_timeout_shift;
extern int krb5_skdc_timeout_1;
krb5_error_code
krb524_sendto_kdc (context, message, realm, reply)
krb5_context context;
const krb5_data * message;
const krb5_data * realm;
krb5_data * reply;
{
register int timeout, host, i;
struct sockaddr *addr;
int naddr;
struct servent *serv;
int sent, nready;
krb5_error_code retval;
SOCKET *socklist;
fd_set readable;
struct timeval waitlen;
int cc;
/*
* find KDC location(s) for realm
*/
if ((retval = krb5_locate_kdc(context, realm, &addr, &naddr, NULL, NULL)))
return retval;
if (naddr == 0)
return KRB5_REALM_UNKNOWN;
socklist = (SOCKET *)malloc(naddr * sizeof(SOCKET));
if (socklist == NULL) {
free(addr);
return ENOMEM;
}
for (i = 0; i < naddr; i++)
socklist[i] = INVALID_SOCKET;
/*
* Bash the ports numbers.
*/
serv = getservbyname(KRB524_SERVICE, "udp");
for (i = 0; i < naddr; i++)
if (serv)
((struct sockaddr_in *)&addr[i])->sin_port = serv->s_port;
else
((struct sockaddr_in *)&addr[i])->sin_port = htons(KRB524_PORT);
if (!(reply->data = malloc(krb5_max_dgram_size))) {
free(addr);
free(socklist);
return ENOMEM;
}
reply->length = krb5_max_dgram_size;
#if 0
/*
* Not needed for Windows, since it's done by the DLL
* initialization. XXX What about for the Macintosh?
*
* See below for commented out SOCKET_CLEANUP()
*/
if (SOCKET_INITIALIZE()) { /* PC needs this for some tcp/ip stacks */
free(addr);
free(socklist);
free(reply->data);
return SOCKET_ERRNO;
}
#endif
/*
* do exponential backoff.
*/
for (timeout = krb5_skdc_timeout_1; timeout < krb5_max_skdc_timeout;
timeout <<= krb5_skdc_timeout_shift) {
sent = 0;
for (host = 0; host < naddr; host++) {
/* send to the host, wait timeout seconds for a response,
then move on. */
/* cache some sockets for each host */
if (socklist[host] == INVALID_SOCKET) {
/* XXX 4.2/4.3BSD has PF_xxx = AF_xxx, so the socket
creation here will work properly... */
/*
* From socket(2):
*
* The protocol specifies a particular protocol to be
* used with the socket. Normally only a single
* protocol exists to support a particular socket type
* within a given protocol family.
*/
socklist[host] = socket(addr[host].sa_family, SOCK_DGRAM, 0);
if (socklist[host] == INVALID_SOCKET)
continue; /* try other hosts */
/* have a socket to send/recv from */
/* On BSD systems, a connected UDP socket will get connection
refused and net unreachable errors while an unconnected
socket will time out, so use connect, send, recv instead of
sendto, recvfrom. The connect here may return an error if
the destination host is known to be unreachable. */
if (connect(socklist[host],
&addr[host], sizeof(addr[host])) == SOCKET_ERROR)
continue;
}
if (send(socklist[host],
message->data, message->length, 0) != message->length)
continue;
retry:
waitlen.tv_usec = 0;
waitlen.tv_sec = timeout;
FD_ZERO(&readable);
FD_SET(socklist[host], &readable);
if (nready = select(SOCKET_NFDS(socklist[host]),
&readable,
0,
0,
&waitlen)) {
if (nready == SOCKET_ERROR) {
if (SOCKET_ERRNO == SOCKET_EINTR)
goto retry;
retval = SOCKET_ERRNO;
goto out;
}
if ((cc = recv(socklist[host],
reply->data, reply->length, 0)) == SOCKET_ERROR)
{
/* man page says error could be:
EBADF: won't happen
ENOTSOCK: it's a socket.
EWOULDBLOCK: not marked non-blocking, and we selected.
EINTR: could happen
EFAULT: we allocated the reply packet.
In addition, net related errors like ECONNREFUSED
are possble (but undocumented). Assume anything
other than EINTR is a permanent error for the
server (i.e. don't set sent = 1).
*/
if (SOCKET_ERRNO == SOCKET_EINTR)
sent = 1;
continue;
}
/* We might consider here verifying that the reply
came from one of the KDC's listed for that address type,
but that check can be fouled by some implementations of
some network types which might show a loopback return
address, for example, if the KDC is on the same host
as the client. */
reply->length = cc;
retval = 0;
goto out;
} else if (nready == 0) {
/* timeout */
sent = 1;
}
/* not ready, go on to next server */
}
if (!sent) {
/* never were able to send to any servers; give up */
retval = KRB5_KDC_UNREACH;
break;
}
}
retval = KRB5_KDC_UNREACH;
out:
for (i = 0; i < naddr; i++)
if (socklist[i] != INVALID_SOCKET)
(void) closesocket (socklist[i]);
#if 0
SOCKET_CLEANUP(); /* Done with sockets for now */
#endif
free(addr);
free(socklist);
if (retval) {
free(reply->data);
reply->data = 0;
reply->length = 0;
}
return retval;
}
|
