aboutsummaryrefslogtreecommitdiff
path: root/src/krb5-auth-dialog.c
blob: 5dfaa23b2d90183ebfab1e330f119a25f94160c0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
/*
 * Copyright (C) 2004 Red Hat, Inc.
 * Authored by Christopher Aillon <caillon@redhat.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2, or (at your option)
 * any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 */

#include <gtk/gtk.h>
#include <glade/glade.h>
#include <gnome.h>
#include <stdlib.h>
#include <time.h>
#include <krb5.h>
#include <stdio.h>
#include <sys/wait.h>
#include <string.h>
#include "config.h"

#ifdef ENABLE_NETWORK_MANAGER
#include <libnm_glib.h>
#endif

#define CREDENTIAL_CHECK_INTERVAL 30000 /* milliseconds */
#define SECONDS_BEFORE_PROMPTING 1800

static GladeXML *xml = NULL;
static krb5_context kcontext;
static krb5_principal kprincipal;
static char* defname = NULL;
static gboolean invalid_password;
static gint creds_expiry;

static int renew_credentials ();


static gboolean
krb5_auth_dialog_wrong_label_update_expiry (gpointer data)
{
	GtkWidget *label = GTK_WIDGET(data);
	int minutes_left;
	gchar *expiry_text;
	gchar *expiry_markup;

	g_return_val_if_fail (label != NULL, FALSE);

	minutes_left = (creds_expiry - time(0)) / 60;

	if (minutes_left > 0)
		expiry_text = g_strdup_printf (_("Your credentials expire in %d minutes"), minutes_left);
	else
		expiry_text = g_strdup (_("Your credentials have expired"));

	expiry_markup = g_strdup_printf ("<span size=\"smaller\" style=\"italic\">%s</span>", expiry_text);
	gtk_label_set_markup (GTK_LABEL (label), expiry_markup);
	g_free (expiry_text);
	g_free (expiry_markup);

	return TRUE;
}

static void
krb5_auth_dialog_setup (GtkWidget *dialog,
                        const gchar *krb5prompt)
{
	GtkWidget *entry;
	GtkWidget *label;
	GtkWidget *wrong_label;
	gchar *wrong_text;
	gchar *wrong_markup;
	gchar *prompt;
	int pw4len;

	if (krb5prompt == NULL)
		prompt = g_strdup (_("Please enter your Kerberos password."));
	else
	{
		/* Kerberos's prompts are a mess, and basically impossible to
		 * translate.  There's basically no way short of doing a lot of
		 * string parsing to translate them.  The most common prompt is
		 * "Password for $uid:".  We special case that one at least.  We
		 * cannot do any of the fancier strings (like challenges),
		 * though. */
		pw4len = strlen ("Password for ");
		if (strncmp (krb5prompt, "Password for ", pw4len) == 0)
		{
			gchar *uid = (gchar *) (krb5prompt + pw4len);
			prompt = g_strdup_printf (_("Please enter the password for '%s'"), uid);
		}
		else
			prompt = g_strdup (krb5prompt);
	}

	/* Clear the password entry field */
	entry = glade_xml_get_widget (xml, "krb5_entry");
	gtk_entry_set_text (GTK_ENTRY (entry), "");

	/* Use the prompt label that krb5 provides us */
	label = glade_xml_get_widget (xml, "krb5_message_label");
	gtk_label_set_text (GTK_LABEL (label), prompt);

	/* Add our extra message hints, if any */
	wrong_label = glade_xml_get_widget (xml, "krb5_wrong_label");

	if (wrong_label)
	{
		if (invalid_password)
			wrong_text = g_strdup (_("The password you entered is invalid"));
		else
		{
			int minutes_left = (creds_expiry - time(0)) / 60;
			if (minutes_left > 0)
			{
				wrong_text = g_strdup_printf (_("Your credentials expire in %d minutes"), minutes_left);
			}
			else
				wrong_text = g_strdup (_("Your credentials have expired"));
		}
	}

	if (wrong_text)
	{
		wrong_markup = g_strdup_printf ("<span size=\"smaller\" style=\"italic\">%s</span>", wrong_text);
		gtk_label_set_markup (GTK_LABEL (wrong_label), wrong_markup);
		g_free(wrong_text);
		g_free(wrong_markup);
	}
	else
		gtk_label_set_text (GTK_LABEL (wrong_label), "");

	g_free (prompt);
}

static krb5_error_code
krb5_gtk_prompter (krb5_context ctx,
                   void *data,
                   const char *name,
                   const char *banner,
                   int num_prompts,
                   krb5_prompt prompts[])
{
	GtkWidget *dialog;
	GtkWidget *wrong_label;
	krb5_error_code errcode;
	int i;

	errcode = KRB5_LIBOS_CANTREADPWD;

	dialog = glade_xml_get_widget (xml, "krb5_dialog");

	for (i = 0; i < num_prompts; i++)
	{
		const gchar *password = NULL;
		int password_len = 0;
		int response;
		guint32 source_id = 0;

		GtkWidget *entry;

		errcode = KRB5_LIBOS_CANTREADPWD;

		entry = glade_xml_get_widget(xml, "krb5_entry");
		krb5_auth_dialog_setup (dialog, (gchar *) prompts[i].prompt);

		wrong_label = glade_xml_get_widget (xml, "krb5_wrong_label");
		source_id = g_timeout_add (5000, (GSourceFunc)krb5_auth_dialog_wrong_label_update_expiry,
		                           wrong_label);

		response = gtk_dialog_run (GTK_DIALOG (dialog));
		switch (response)
		{
			case GTK_RESPONSE_OK:
				password = gtk_entry_get_text (GTK_ENTRY (entry));
				password_len = strlen (password);
				errcode = 0;
				break;
			case GTK_RESPONSE_CANCEL:
			case GTK_RESPONSE_DELETE_EVENT:
				break;
			default:
				g_assert_not_reached ();
		}

		g_source_remove (source_id);

		prompts[i].reply->data = (char *) password;
		prompts[i].reply->length = password_len;
	}

	/* Reset this, so we know the next time we get a TRUE value, it is accurate. */
	gtk_widget_hide (dialog);
	invalid_password = FALSE;

	return errcode;
}

static gboolean is_online = TRUE;

#ifdef ENABLE_NETWORK_MANAGER
static void
network_state_cb (libnm_glib_ctx *context,
                  gpointer data)
{
	gboolean *online = (gboolean*) data;

	libnm_glib_state state;

	state = libnm_glib_get_network_state (context);

	switch (state)
	{
		case LIBNM_NO_DBUS:
		case LIBNM_NO_NETWORKMANAGER:
		case LIBNM_INVALID_CONTEXT:
			/* do nothing */
			break;
		case LIBNM_NO_NETWORK_CONNECTION:
			*online = FALSE;
			break;
		case LIBNM_ACTIVE_NETWORK_CONNECTION:
			*online = TRUE;
			break;
	}
}
#endif

static gboolean
credentials_expiring_real (void)
{
	krb5_ccache cache = NULL;
	krb5_cc_cursor cur;
	krb5_creds my_creds;
	krb5_principal princ;
	krb5_flags flags;
	krb5_error_code code;
	int exit_status = 0;
	int expiry;

	gboolean retval = FALSE;

	memset (&my_creds, 0, sizeof(my_creds));

	code = krb5_init_context (&kcontext);
	if (code)
		return FALSE;

	if ((code = krb5_cc_default(kcontext, &cache)))
		return FALSE;

	flags = 0;								/* turns off OPENCLOSE mode */
	if ((code = krb5_cc_set_flags(kcontext, cache, flags)))
	{
		if (code == KRB5_FCC_NOFILE)
		{
#ifdef KRB5_KRB4_COMPAT
			if (name == NULL)
				do_v4_ccache(0);
#endif
		}
		gtk_exit(1);
	}

	if ((code = krb5_cc_get_principal(kcontext, cache, &princ)))
		gtk_exit(1);

	if ((code = krb5_unparse_name(kcontext, princ, &defname)))
		gtk_exit(1);

	if ((code = krb5_cc_start_seq_get(kcontext, cache, &cur)))
		gtk_exit(1);

	while (!(code = krb5_cc_next_cred(kcontext, cache, &cur, &my_creds)))
	{
		if (my_creds.times.endtime - time(0) < SECONDS_BEFORE_PROMPTING)
		{
			retval = TRUE;
			creds_expiry = my_creds.times.endtime;
		}

		krb5_free_cred_contents(kcontext, &my_creds);
	}

	if (code == KRB5_CC_END)
	{
		if ((code = krb5_cc_end_seq_get(kcontext, cache, &cur)))
			exit(1);
#ifndef HEIMDAL
		flags = KRB5_TC_OPENCLOSE;	/* turns on OPENCLOSE mode, from klist.c */
#endif
		if ((code = krb5_cc_set_flags(kcontext, cache, flags)))
			gtk_exit(1);
#ifdef KRB5_KRB4_COMPAT
		if (name == NULL && !status_only)
			do_v4_ccache(0);
#endif
		if (exit_status)
		gtk_exit(exit_status);
	}
	else
	{
		gtk_exit(1);
	}

	return retval;
}

static gboolean
credentials_expiring (gpointer *data)
{
	if (credentials_expiring_real () && is_online)
		renew_credentials ();

	return TRUE;
}

static int
renew_credentials (void)
{
	krb5_error_code retval;
	krb5_get_init_creds_opt options;
	krb5_creds my_creds;
	krb5_ccache ccache;

	memset(&my_creds, 0, sizeof(my_creds));
	krb5_get_init_creds_opt_init(&options);

	retval = krb5_init_context(&kcontext);
	if (retval)
		return retval;

	retval = krb5_parse_name(kcontext, g_get_user_name (), &kprincipal);
	if (retval)
		return retval;

	retval = krb5_get_init_creds_password(kcontext, &my_creds, kprincipal,
                                              NULL, krb5_gtk_prompter, 0,
                                              0, NULL, &options);
	if (retval)
	{
		if (retval == KRB5KRB_AP_ERR_BAD_INTEGRITY)
		{
			/* Invalid password, try again. */
			invalid_password = TRUE;
			return renew_credentials();
		}
		return retval;
	}

	retval = krb5_cc_default(kcontext, &ccache);
	if (retval)
		return retval;

	retval = krb5_cc_initialize(kcontext, ccache, kprincipal);
	if (retval)
		return retval;

	retval = krb5_cc_store_cred(kcontext, ccache, &my_creds);
	if (retval)
		return retval;

	return 0;
}

gboolean
using_krb5()
{
	const gchar *krb5ccname;

	gboolean success;
	int exit_status;
	GError *error;

	/* See if we have a credential cache specified. */
	krb5ccname = g_getenv("KRB5CCNAME");
	if (krb5ccname != NULL)
		return TRUE;

	/* Nope, let's see if we have any prior tickets. */
	success = g_spawn_command_line_sync("klist -s",
                                            NULL, NULL,
                                            &exit_status,
                                            &error);

	if (success == TRUE && error == NULL &&
	    WIFEXITED(exit_status) && WEXITSTATUS(exit_status) == 0)
		return TRUE;

	return FALSE;
}

int
main (int argc, char *argv[])
{
	GtkWidget *dialog;
	GnomeClient *client;

#ifdef ENABLE_NETWORK_MANAGER
	libnm_glib_ctx *nm_context;
	guint32 nm_callback_id;	
#endif

	gnome_program_init (PACKAGE, VERSION, LIBGNOMEUI_MODULE,
	                    argc, argv, GNOME_PARAM_NONE);

	client = gnome_master_client ();
	gnome_client_set_restart_style (client, GNOME_RESTART_ANYWAY);

	if (using_krb5 ())
	{
		g_signal_connect (G_OBJECT (client), "die",
		                  G_CALLBACK (gtk_main_quit), NULL);

		g_set_application_name (_("Network Authentication"));

#ifdef ENABLE_NETWORK_MANAGER
		nm_context = libnm_glib_init ();
		if (!nm_context)
			g_warning ("Could not initialize libnm_glib");
		else
		{
			nm_callback_id = libnm_glib_register_callback (nm_context, network_state_cb, &is_online, NULL);
			if (nm_callback_id == 0)
			{
				libnm_glib_shutdown (nm_context);
				nm_context = NULL;

				g_warning ("Could not connect to NetworkManager, connection status will not be managed!\n");
			}
		}
#endif /* ENABLE_NETWORK_MANAGER */

		xml = glade_xml_new (GLADEDIR "krb5-auth-dialog.glade", NULL, NULL);
		dialog = glade_xml_get_widget (xml, "krb5_dialog");

		if (credentials_expiring (NULL))
			g_timeout_add (CREDENTIAL_CHECK_INTERVAL, (GSourceFunc)credentials_expiring, NULL);

		gtk_main ();
	}

	return 0;
}