<commit_before>/***************************************************************
 *
 * Copyright (C) 1990-2007, Condor Team, Computer Sciences Department,
 * University of Wisconsin-Madison, WI.
 * 
 * Licensed under the Apache License, Version 2.0 (the "License"); you
 * may not use this file except in compliance with the License.  You may
 * obtain a copy of the License at
 * 
 *    http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 ***************************************************************/


#include "condor_common.h"

#if !defined(SKIP_AUTHENTICATION) && defined(HAVE_EXT_KRB5)

#include "condor_auth_kerberos.h"
#include "condor_config.h"
#include "condor_string.h"
#include "string_list.h"
#include "CondorError.h"
#include "condor_netdb.h"
#include "subsystem_info.h"
#include "ipv6_hostname.h"

#if defined(DLOPEN_SECURITY_LIBS)
#include <dlfcn.h>
#endif

const char STR_KERBEROS_SERVER_KEYTAB[]   = "KERBEROS_SERVER_KEYTAB";
const char STR_KERBEROS_SERVER_PRINCIPAL[]= "KERBEROS_SERVER_PRINCIPAL";
const char STR_KERBEROS_SERVER_USER[]     = "KERBEROS_SERVER_USER";
const char STR_KERBEROS_SERVER_SERVICE[]  = "KERBEROS_SERVER_SERVICE";
//const char STR_KERBEROS_CLIENT_KEYTAB[]   = "KERBEROS_CLIENT_KEYTAB";
//const char STR_KRB_FORMAT[]             = "FILE:%s/krb_condor_%s.stash";
const char STR_DEFAULT_CONDOR_SERVICE[] = "host";

#define KERBEROS_ABORT   -1
#define KERBEROS_DENY    0
#define KERBEROS_GRANT   1
#define KERBEROS_FORWARD 2
#define KERBEROS_MUTUAL  3
#define KERBEROS_PROCEED 4

HashTable<MyString, MyString> * Condor_Auth_Kerberos::RealmMap = 0;
//----------------------------------------------------------------------
// Kerberos Implementation
//----------------------------------------------------------------------

// Symbols from the kerberos libraries
static char const *(KRB5_CALLCONV *error_message_ptr)(long) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_free_ptr)(krb5_context, krb5_auth_context) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_genaddrs_ptr)(krb5_context, krb5_auth_context, int, int) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_getaddrs_ptr)(krb5_context, krb5_auth_context, krb5_address **, krb5_address **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_init_ptr)(krb5_context, krb5_auth_context *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_setflags_ptr)(krb5_context, krb5_auth_context, krb5_int32) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_block_size_ptr)(krb5_context, krb5_enctype, size_t *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_decrypt_ptr)(krb5_context, const krb5_keyblock *, krb5_keyusage, const krb5_data *, const krb5_enc_data *, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_encrypt_ptr)(krb5_context, const krb5_keyblock *, krb5_keyusage, const krb5_data *, const krb5_data *, krb5_enc_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_encrypt_length_ptr)(krb5_context, krb5_enctype, size_t, size_t *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_cc_close_ptr)(krb5_context, krb5_ccache) = NULL;
static const char *(KRB5_CALLCONV *krb5_cc_default_name_ptr)(krb5_context) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_cc_get_principal_ptr)(krb5_context, krb5_ccache, krb5_principal *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_cc_resolve_ptr)(krb5_context, const char *, krb5_ccache *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_copy_keyblock_ptr)(krb5_context, const krb5_keyblock *, krb5_keyblock **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_copy_principal_ptr)(krb5_context, krb5_const_principal, krb5_principal *) = NULL;
static void (KRB5_CALLCONV *krb5_free_addresses_ptr)(krb5_context, krb5_address **) = NULL;
static void (KRB5_CALLCONV *krb5_free_ap_rep_enc_part_ptr)(krb5_context, krb5_ap_rep_enc_part *) = NULL;
static void (KRB5_CALLCONV *krb5_free_context_ptr)(krb5_context) = NULL;
static void (KRB5_CALLCONV *krb5_free_cred_contents_ptr)(krb5_context, krb5_creds *) = NULL;
static void (KRB5_CALLCONV *krb5_free_creds_ptr)(krb5_context, krb5_creds *) = NULL;
static void (KRB5_CALLCONV *krb5_free_keyblock_ptr)(krb5_context, register krb5_keyblock *) = NULL;
static void (KRB5_CALLCONV *krb5_free_principal_ptr)(krb5_context, krb5_principal) = NULL;
static void (KRB5_CALLCONV *krb5_free_ticket_ptr)(krb5_context, krb5_ticket *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_fwd_tgt_creds_ptr)(krb5_context, krb5_auth_context, char *, krb5_principal, krb5_principal, krb5_ccache, int, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_get_credentials_ptr)(krb5_context, krb5_flags, krb5_ccache, krb5_creds *, krb5_creds **) = NULL;
// The presence of KRB5_RESPONDER_QUESTION_PASSWORD is a hacky substitute
// for detecting the version of Kerberos where the function signature
// of krb5_get_init_creds_keytab() changed.
#if defined(KRB5_RESPONDER_QUESTION_PASSWORD)
static krb5_error_code (KRB5_CALLCONV *krb5_get_init_creds_keytab_ptr)(krb5_context, krb5_creds *, krb5_principal, krb5_keytab, krb5_deltat, const char *, krb5_get_init_creds_opt *) = NULL;
#else
static krb5_error_code (KRB5_CALLCONV *krb5_get_init_creds_keytab_ptr)(krb5_context, krb5_creds *, krb5_principal, krb5_keytab, krb5_deltat, char *, krb5_get_init_creds_opt *) = NULL;
#endif
static krb5_error_code (KRB5_CALLCONV *krb5_init_context_ptr)(krb5_context *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_close_ptr)(krb5_context, krb5_keytab) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_default_ptr)(krb5_context, krb5_keytab *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_default_name_ptr)(krb5_context, char *, int) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_resolve_ptr)(krb5_context, const char *, krb5_keytab *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_mk_rep_ptr)(krb5_context, krb5_auth_context, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_mk_req_extended_ptr)(krb5_context, krb5_auth_context *, krb5_flags, krb5_data *, krb5_creds *, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_os_localaddr_ptr)(krb5_context, krb5_address ***) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_parse_name_ptr)(krb5_context, const char *, krb5_principal *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_rd_rep_ptr)(krb5_context, krb5_auth_context, const krb5_data *, krb5_ap_rep_enc_part **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_rd_req_ptr)(krb5_context, krb5_auth_context *, const krb5_data *, krb5_const_principal, krb5_keytab, krb5_flags *, krb5_ticket **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_sname_to_principal_ptr)(krb5_context, const char *, const char *, krb5_int32, krb5_principal *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_unparse_name_ptr)(krb5_context, krb5_const_principal, register char **) = NULL;

bool Condor_Auth_Kerberos::m_initTried = false;
bool Condor_Auth_Kerberos::m_initSuccess = false;

Condor_Auth_Kerberos :: Condor_Auth_Kerberos( ReliSock * sock )
    : Condor_Auth_Base ( sock, CAUTH_KERBEROS ),
      krb_context_     ( NULL ),
      auth_context_    ( NULL ),
      krb_principal_   ( NULL ),
      server_          ( NULL ),
      sessionKey_      ( NULL ),
      creds_           ( NULL ),
      ccname_          ( NULL ),
      defaultStash_    ( NULL ),
      keytabName_      ( NULL )
{
	ASSERT( Initialize() == true );
}

Condor_Auth_Kerberos :: ~Condor_Auth_Kerberos()
{<commit_msg>Fix unitialized variable compiler warning<commit_after>/***************************************************************
 *
 * Copyright (C) 1990-2007, Condor Team, Computer Sciences Department,
 * University of Wisconsin-Madison, WI.
 * 
 * Licensed under the Apache License, Version 2.0 (the "License"); you
 * may not use this file except in compliance with the License.  You may
 * obtain a copy of the License at
 * 
 *    http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 ***************************************************************/


#include "condor_common.h"

#if !defined(SKIP_AUTHENTICATION) && defined(HAVE_EXT_KRB5)

#include "condor_auth_kerberos.h"
#include "condor_config.h"
#include "condor_string.h"
#include "string_list.h"
#include "CondorError.h"
#include "condor_netdb.h"
#include "subsystem_info.h"
#include "ipv6_hostname.h"

#if defined(DLOPEN_SECURITY_LIBS)
#include <dlfcn.h>
#endif

const char STR_KERBEROS_SERVER_KEYTAB[]   = "KERBEROS_SERVER_KEYTAB";
const char STR_KERBEROS_SERVER_PRINCIPAL[]= "KERBEROS_SERVER_PRINCIPAL";
const char STR_KERBEROS_SERVER_USER[]     = "KERBEROS_SERVER_USER";
const char STR_KERBEROS_SERVER_SERVICE[]  = "KERBEROS_SERVER_SERVICE";
//const char STR_KERBEROS_CLIENT_KEYTAB[]   = "KERBEROS_CLIENT_KEYTAB";
//const char STR_KRB_FORMAT[]             = "FILE:%s/krb_condor_%s.stash";
const char STR_DEFAULT_CONDOR_SERVICE[] = "host";

#define KERBEROS_ABORT   -1
#define KERBEROS_DENY    0
#define KERBEROS_GRANT   1
#define KERBEROS_FORWARD 2
#define KERBEROS_MUTUAL  3
#define KERBEROS_PROCEED 4

HashTable<MyString, MyString> * Condor_Auth_Kerberos::RealmMap = 0;
//----------------------------------------------------------------------
// Kerberos Implementation
//----------------------------------------------------------------------

// Symbols from the kerberos libraries
static char const *(KRB5_CALLCONV *error_message_ptr)(long) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_free_ptr)(krb5_context, krb5_auth_context) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_genaddrs_ptr)(krb5_context, krb5_auth_context, int, int) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_getaddrs_ptr)(krb5_context, krb5_auth_context, krb5_address **, krb5_address **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_init_ptr)(krb5_context, krb5_auth_context *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_auth_con_setflags_ptr)(krb5_context, krb5_auth_context, krb5_int32) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_block_size_ptr)(krb5_context, krb5_enctype, size_t *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_decrypt_ptr)(krb5_context, const krb5_keyblock *, krb5_keyusage, const krb5_data *, const krb5_enc_data *, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_encrypt_ptr)(krb5_context, const krb5_keyblock *, krb5_keyusage, const krb5_data *, const krb5_data *, krb5_enc_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_c_encrypt_length_ptr)(krb5_context, krb5_enctype, size_t, size_t *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_cc_close_ptr)(krb5_context, krb5_ccache) = NULL;
static const char *(KRB5_CALLCONV *krb5_cc_default_name_ptr)(krb5_context) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_cc_get_principal_ptr)(krb5_context, krb5_ccache, krb5_principal *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_cc_resolve_ptr)(krb5_context, const char *, krb5_ccache *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_copy_keyblock_ptr)(krb5_context, const krb5_keyblock *, krb5_keyblock **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_copy_principal_ptr)(krb5_context, krb5_const_principal, krb5_principal *) = NULL;
static void (KRB5_CALLCONV *krb5_free_addresses_ptr)(krb5_context, krb5_address **) = NULL;
static void (KRB5_CALLCONV *krb5_free_ap_rep_enc_part_ptr)(krb5_context, krb5_ap_rep_enc_part *) = NULL;
static void (KRB5_CALLCONV *krb5_free_context_ptr)(krb5_context) = NULL;
static void (KRB5_CALLCONV *krb5_free_cred_contents_ptr)(krb5_context, krb5_creds *) = NULL;
static void (KRB5_CALLCONV *krb5_free_creds_ptr)(krb5_context, krb5_creds *) = NULL;
static void (KRB5_CALLCONV *krb5_free_keyblock_ptr)(krb5_context, register krb5_keyblock *) = NULL;
static void (KRB5_CALLCONV *krb5_free_principal_ptr)(krb5_context, krb5_principal) = NULL;
static void (KRB5_CALLCONV *krb5_free_ticket_ptr)(krb5_context, krb5_ticket *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_fwd_tgt_creds_ptr)(krb5_context, krb5_auth_context, char *, krb5_principal, krb5_principal, krb5_ccache, int, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_get_credentials_ptr)(krb5_context, krb5_flags, krb5_ccache, krb5_creds *, krb5_creds **) = NULL;
// The presence of KRB5_RESPONDER_QUESTION_PASSWORD is a hacky substitute
// for detecting the version of Kerberos where the function signature
// of krb5_get_init_creds_keytab() changed.
#if defined(KRB5_RESPONDER_QUESTION_PASSWORD)
static krb5_error_code (KRB5_CALLCONV *krb5_get_init_creds_keytab_ptr)(krb5_context, krb5_creds *, krb5_principal, krb5_keytab, krb5_deltat, const char *, krb5_get_init_creds_opt *) = NULL;
#else
static krb5_error_code (KRB5_CALLCONV *krb5_get_init_creds_keytab_ptr)(krb5_context, krb5_creds *, krb5_principal, krb5_keytab, krb5_deltat, char *, krb5_get_init_creds_opt *) = NULL;
#endif
static krb5_error_code (KRB5_CALLCONV *krb5_init_context_ptr)(krb5_context *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_close_ptr)(krb5_context, krb5_keytab) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_default_ptr)(krb5_context, krb5_keytab *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_default_name_ptr)(krb5_context, char *, int) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_kt_resolve_ptr)(krb5_context, const char *, krb5_keytab *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_mk_rep_ptr)(krb5_context, krb5_auth_context, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_mk_req_extended_ptr)(krb5_context, krb5_auth_context *, krb5_flags, krb5_data *, krb5_creds *, krb5_data *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_os_localaddr_ptr)(krb5_context, krb5_address ***) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_parse_name_ptr)(krb5_context, const char *, krb5_principal *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_rd_rep_ptr)(krb5_context, krb5_auth_context, const krb5_data *, krb5_ap_rep_enc_part **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_rd_req_ptr)(krb5_context, krb5_auth_context *, const krb5_data *, krb5_const_principal, krb5_keytab, krb5_flags *, krb5_ticket **) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_sname_to_principal_ptr)(krb5_context, const char *, const char *, krb5_int32, krb5_principal *) = NULL;
static krb5_error_code (KRB5_CALLCONV *krb5_unparse_name_ptr)(krb5_context, krb5_const_principal, register char **) = NULL;

bool Condor_Auth_Kerberos::m_initTried = false;
bool Condor_Auth_Kerberos::m_initSuccess = false;

Condor_Auth_Kerberos :: Condor_Auth_Kerberos( ReliSock * sock )
    : Condor_Auth_Base ( sock, CAUTH_KERBEROS ),
	  m_state		   ( ServerReceiveClientReadiness),
	  ticket_          ( NULL),
      krb_context_     ( NULL ),
      auth_context_    ( NULL ),
      krb_principal_   ( NULL ),
      server_          ( NULL ),
      sessionKey_      ( NULL ),
      creds_           ( NULL ),
      ccname_          ( NULL ),
      defaultStash_    ( NULL ),
      keytabName_      ( NULL )
{
	ASSERT( Initialize() == true );
}

Condor_Auth_Kerberos :: ~Condor_Auth_Kerberos()
{
{'fraction_non_alphanumeric': 0.12320536335462652, 'fraction_numerical': 0.03263550692555815, 'mean_word_length': 6.220091324200913, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4109617', 'n_tokens_mistral': 6330, 'n_tokens_neox': 6260, 'n_words': 1116}