1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
|
/*
* lib/krb5/os/sendto_kdc.c
*
* Copyright 1990,1991 by the Massachusetts Institute of Technology.
* All Rights Reserved.
*
* Export of this software from the United States of America may
* require a specific license from the United States Government.
* It is the responsibility of any person or organization contemplating
* export to obtain such a license before exporting.
*
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
* notice appear in all copies and that both that copyright notice and
* this permission notice appear in supporting documentation, and that
* the name of M.I.T. not be used in advertising or publicity pertaining
* to distribution of the software without specific, written prior
* permission. M.I.T. makes no representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* or implied warranty.
*
*
* Send packet to KDC for realm; wait for response, retransmitting
* as necessary.
*/
#include <krb5/krb5.h>
#include <krb5/ext-proto.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <krb5/los-proto.h>
#include "os-proto.h"
#ifdef _AIX
#include <sys/select.h>
#endif
#ifndef AF_MAX
/* good enough -- only missing on old linux so far anyhow. */
#define AF_MAX 10
#endif
/*
* send the formatted request 'message' to a KDC for realm 'realm' and
* return the response (if any) in 'reply'.
*
* If the message is sent and a response is received, 0 is returned,
* otherwise an error code is returned.
*
* The storage for 'reply' is allocated and should be freed by the caller
* when finished.
*
*/
extern int krb5_max_dgram_size;
extern int krb5_max_skdc_timeout;
extern int krb5_skdc_timeout_shift;
extern int krb5_skdc_timeout_1;
krb5_error_code
krb5_sendto_kdc (DECLARG(const krb5_data *, message),
DECLARG(const krb5_data *, realm),
DECLARG(krb5_data *, reply))
OLDDECLARG(const krb5_data *, message)
OLDDECLARG(const krb5_data *, realm)
OLDDECLARG(krb5_data *, reply)
{
register int timeout, host, i;
struct sockaddr *addr;
int naddr;
int sent, nready;
krb5_error_code retval;
int socklist[AF_MAX]; /* one for each, if necessary! */
fd_set readable;
struct timeval waitlen;
int cc;
/*
* find KDC location(s) for realm
*/
if (retval = krb5_locate_kdc (realm, &addr, &naddr))
return retval;
if (naddr == 0)
return KRB5_REALM_UNKNOWN;
for (i = 0; i < AF_MAX; i++)
socklist[i] = -1;
if (!(reply->data = malloc(krb5_max_dgram_size))) {
krb5_xfree(addr);
return ENOMEM;
}
reply->length = krb5_max_dgram_size;
/*
* do exponential backoff.
*/
for (timeout = krb5_skdc_timeout_1; timeout < krb5_max_skdc_timeout;
timeout <<= krb5_skdc_timeout_shift) {
sent = 0;
for (host = 0; host < naddr; host++) {
/* send to the host, wait timeout seconds for a response,
then move on. */
/* cache some sockets for various address families in the
list */
if (socklist[addr[host].sa_family] == -1) {
/* XXX 4.2/4.3BSD has PF_xxx = AF_xxx, so the socket
creation here will work properly... */
socklist[addr[host].sa_family] = socket(addr[host].sa_family,
SOCK_DGRAM,
0); /* XXX always zero? */
if (socklist[addr[host].sa_family] == -1)
continue; /* try other hosts */
}
/* have a socket to send/recv from */
/* On BSD systems, a connected UDP socket will get connection
refused and net unreachable errors while an unconnected
socket will time out, so use connect, send, recv instead of
sendto, recvfrom. The connect here may return an error if
the destination host is known to be unreachable. */
if (connect(socklist[addr[host].sa_family],
&addr[host], sizeof(addr[host])) == -1)
continue;
if (send(socklist[addr[host].sa_family],
message->data, message->length, 0) != message->length)
continue;
retry:
waitlen.tv_usec = 0;
waitlen.tv_sec = timeout;
FD_ZERO(&readable);
FD_SET(socklist[addr[host].sa_family], &readable);
if (nready = select(1 + socklist[addr[host].sa_family],
&readable,
0,
0,
&waitlen)) {
if (nready == -1) {
if (errno == EINTR)
goto retry;
retval = errno;
goto out;
}
if ((cc = recv(socklist[addr[host].sa_family],
reply->data, reply->length, 0)) == -1)
{
/* man page says error could be:
EBADF: won't happen
ENOTSOCK: it's a socket.
EWOULDBLOCK: not marked non-blocking, and we selected.
EINTR: could happen
EFAULT: we allocated the reply packet.
In addition, net related errors like ECONNREFUSED
are possble (but undocumented). Assume anything
other than EINTR is a permanent error for the
server (i.e. don't set sent = 1).
*/
if (errno == EINTR)
sent = 1;
continue;
}
/* We might consider here verifying that the reply
came from one of the KDC's listed for that address type,
but that check can be fouled by some implementations of
some network types which might show a loopback return
address, for example, if the KDC is on the same host
as the client. */
reply->length = cc;
retval = 0;
goto out;
} else if (nready == 0) {
/* timeout */
sent = 1;
}
/* not ready, go on to next server */
}
if (!sent) {
/* never were able to send to any servers; give up */
retval = KRB5_KDC_UNREACH;
break;
}
}
retval = KRB5_KDC_UNREACH;
out:
for (i = 0; i < AF_MAX; i++)
if (socklist[i] != -1)
(void) close(socklist[i]);
krb5_xfree(addr);
if (retval) {
free(reply->data);
reply->data = 0;
reply->length = 0;
}
return retval;
}
|
