Context Navigation

source: branches/samba-3.2.x/source/libsmb/clikrb5.c

Visit:

Last change on this file was 233, checked in by Herwig Bauernfeind, 16 years ago
Update 3.2 branch to 3.2.9
File size: 52.1 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	simple kerberos5 routines for active directory
4	Copyright (C) Andrew Tridgell 2001
5	Copyright (C) Luke Howard 2002-2003
6	Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7	Copyright (C) Guenther Deschner 2005-2007
8
9	This program is free software; you can redistribute it and/or modify
10	it under the terms of the GNU General Public License as published by
11	the Free Software Foundation; either version 3 of the License, or
12	(at your option) any later version.
13
14	This program is distributed in the hope that it will be useful,
15	but WITHOUT ANY WARRANTY; without even the implied warranty of
16	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	GNU General Public License for more details.
18
19	You should have received a copy of the GNU General Public License
20	along with this program. If not, see <http://www.gnu.org/licenses/>.
21	*/
22
23	#define KRB5_PRIVATE 1 /* this file uses PRIVATE interfaces! */
24	#define KRB5_DEPRECATED 1 /* this file uses DEPRECATED interfaces! */
25
26	#include "includes.h"
27
28	#ifdef HAVE_KRB5
29
30	#ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
31	#define KRB5_KEY_TYPE(k) ((k)->keytype)
32	#define KRB5_KEY_LENGTH(k) ((k)->keyvalue.length)
33	#define KRB5_KEY_DATA(k) ((k)->keyvalue.data)
34	#else /* MIT */
35	#define KRB5_KEY_TYPE(k) ((k)->enctype)
36	#define KRB5_KEY_LENGTH(k) ((k)->length)
37	#define KRB5_KEY_DATA(k) ((k)->contents)
38	#endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
39
40	#define GSSAPI_CHECKSUM 0x8003 /* Checksum type value for Kerberos */
41	#define GSSAPI_BNDLENGTH 16 /* Bind Length (rfc-1964 pg.3) */
42	#define GSSAPI_CHECKSUM_SIZE (12+GSSAPI_BNDLENGTH)
43
44	#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
45	static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
46	krb5_auth_context *auth_context,
47	krb5_creds *credsp,
48	krb5_ccache ccache,
49	krb5_data *authenticator);
50	#endif
51
52	/**************************************************************
53	Wrappers around kerberos string functions that convert from
54	utf8 -> unix charset and vica versa.
55	**************************************************************/
56
57	/**************************************************************
58	krb5_parse_name that takes a UNIX charset.
59	**************************************************************/
60
61	krb5_error_code smb_krb5_parse_name(krb5_context context,
62	const char name, / in unix charset */
63	krb5_principal *principal)
64	{
65	krb5_error_code ret;
66	char *utf8_name;
67
68	if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
69	return ENOMEM;
70	}
71
72	ret = krb5_parse_name(context, utf8_name, principal);
73	SAFE_FREE(utf8_name);
74	return ret;
75	}
76
77	#ifdef HAVE_KRB5_PARSE_NAME_NOREALM
78	/**************************************************************
79	krb5_parse_name_norealm that takes a UNIX charset.
80	**************************************************************/
81
82	static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
83	const char name, / in unix charset */
84	krb5_principal *principal)
85	{
86	krb5_error_code ret;
87	char *utf8_name;
88
89	*principal = NULL;
90	if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
91	return ENOMEM;
92	}
93
94	ret = krb5_parse_name_norealm(context, utf8_name, principal);
95	SAFE_FREE(utf8_name);
96	return ret;
97	}
98	#endif
99
100	/**************************************************************
101	krb5_parse_name that returns a UNIX charset name. Must
102	be freed with normal free() call.
103	**************************************************************/
104
105	krb5_error_code smb_krb5_unparse_name(krb5_context context,
106	krb5_const_principal principal,
107	char **unix_name)
108	{
109	krb5_error_code ret;
110	char *utf8_name;
111
112	*unix_name = NULL;
113	ret = krb5_unparse_name(context, principal, &utf8_name);
114	if (ret) {
115	return ret;
116	}
117
118	if (pull_utf8_allocate(unix_name, utf8_name)==-1) {
119	krb5_free_unparsed_name(context, utf8_name);
120	return ENOMEM;
121	}
122	krb5_free_unparsed_name(context, utf8_name);
123	return 0;
124	}
125
126	#ifndef HAVE_KRB5_SET_REAL_TIME
127	/*
128	* This function is not in the Heimdal mainline.
129	*/
130	krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
131	{
132	krb5_error_code ret;
133	int32_t sec, usec;
134
135	ret = krb5_us_timeofday(context, &sec, &usec);
136	if (ret)
137	return ret;
138
139	context->kdc_sec_offset = seconds - sec;
140	context->kdc_usec_offset = microseconds - usec;
141
142	return 0;
143	}
144	#endif
145
146	#if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
147
148	#if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
149
150	/* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
151	* to krb5_set_default_tgs_ktypes. See
152	* http://lists.samba.org/archive/samba-technical/2006-July/048271.html
153	*
154	* If the MIT libraries are not exporting internal symbols, we will end up in
155	* this branch, which is correct. Otherwise we will continue to use the
156	* internal symbol
157	*/
158	krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
159	{
160	return krb5_set_default_tgs_enctypes(ctx, enc);
161	}
162
163	#elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
164
165	/* Heimdal */
166	krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
167	{
168	return krb5_set_default_in_tkt_etypes(ctx, enc);
169	}
170
171	#endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
172
173	#endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
174
175	#if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
176	/* HEIMDAL */
177	bool setup_kaddr( krb5_address pkaddr, struct sockaddr_storage paddr)
178	{
179	memset(pkaddr, '\0', sizeof(krb5_address));
180	#if defined(HAVE_IPV6) && defined(KRB5_ADDRESS_INET6)
181	if (paddr->ss_family == AF_INET6) {
182	pkaddr->addr_type = KRB5_ADDRESS_INET6;
183	pkaddr->address.length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
184	pkaddr->address.data = (char )&(((struct sockaddr_in6 )paddr)->sin6_addr);
185	return true;
186	}
187	#endif
188	if (paddr->ss_family == AF_INET) {
189	pkaddr->addr_type = KRB5_ADDRESS_INET;
190	pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
191	pkaddr->address.data = (char )&(((struct sockaddr_in )paddr)->sin_addr);
192	return true;
193	}
194	return false;
195	}
196	#elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
197	/* MIT */
198	bool setup_kaddr( krb5_address pkaddr, struct sockaddr_storage paddr)
199	{
200	memset(pkaddr, '\0', sizeof(krb5_address));
201	#if defined(HAVE_IPV6) && defined(ADDRTYPE_INET6)
202	if (paddr->ss_family == AF_INET6) {
203	pkaddr->addrtype = ADDRTYPE_INET6;
204	pkaddr->length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
205	pkaddr->contents = (krb5_octet )&(((struct sockaddr_in6 )paddr)->sin6_addr);
206	return true;
207	}
208	#endif
209	if (paddr->ss_family == AF_INET) {
210	pkaddr->addrtype = ADDRTYPE_INET;
211	pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
212	pkaddr->contents = (krb5_octet )&(((struct sockaddr_in )paddr)->sin_addr);
213	return true;
214	}
215	return false;
216	}
217	#else
218	#error UNKNOWN_ADDRTYPE
219	#endif
220
221	#if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
222	int create_kerberos_key_from_string_direct(krb5_context context,
223	krb5_principal host_princ,
224	krb5_data *password,
225	krb5_keyblock *key,
226	krb5_enctype enctype)
227	{
228	int ret;
229	krb5_data salt;
230	krb5_encrypt_block eblock;
231
232	ret = krb5_principal2salt(context, host_princ, &salt);
233	if (ret) {
234	DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
235	return ret;
236	}
237	krb5_use_enctype(context, &eblock, enctype);
238	ret = krb5_string_to_key(context, &eblock, key, password, &salt);
239	SAFE_FREE(salt.data);
240	return ret;
241	}
242	#elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
243	int create_kerberos_key_from_string_direct(krb5_context context,
244	krb5_principal host_princ,
245	krb5_data *password,
246	krb5_keyblock *key,
247	krb5_enctype enctype)
248	{
249	int ret;
250	krb5_salt salt;
251
252	ret = krb5_get_pw_salt(context, host_princ, &salt);
253	if (ret) {
254	DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
255	return ret;
256	}
257
258	ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
259	krb5_free_salt(context, salt);
260	return ret;
261	}
262	#else
263	#error UNKNOWN_CREATE_KEY_FUNCTIONS
264	#endif
265
266	int create_kerberos_key_from_string(krb5_context context,
267	krb5_principal host_princ,
268	krb5_data *password,
269	krb5_keyblock *key,
270	krb5_enctype enctype)
271	{
272	krb5_principal salt_princ = NULL;
273	int ret;
274	/*
275	* Check if we've determined that the KDC is salting keys for this
276	* principal/enctype in a non-obvious way. If it is, try to match
277	* its behavior.
278	*/
279	salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
280	ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
281	if (salt_princ) {
282	krb5_free_principal(context, salt_princ);
283	}
284	return ret;
285	}
286
287	#if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
288	krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
289	krb5_enctype **enctypes)
290	{
291	return krb5_get_permitted_enctypes(context, enctypes);
292	}
293	#elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
294	krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
295	krb5_enctype **enctypes)
296	{
297	return krb5_get_default_in_tkt_etypes(context, enctypes);
298	}
299	#else
300	#error UNKNOWN_GET_ENCTYPES_FUNCTIONS
301	#endif
302
303	#if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
304	krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
305	krb5_auth_context auth_context,
306	krb5_keyblock *keyblock)
307	{
308	return krb5_auth_con_setkey(context, auth_context, keyblock);
309	}
310	#endif
311
312	bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
313	DATA_BLOB *edata,
314	DATA_BLOB *edata_out)
315	{
316	DATA_BLOB edata_contents;
317	ASN1_DATA data;
318	int edata_type;
319
320	if (!edata->length) {
321	return False;
322	}
323
324	asn1_load(&data, *edata);
325	asn1_start_tag(&data, ASN1_SEQUENCE(0));
326	asn1_start_tag(&data, ASN1_CONTEXT(1));
327	asn1_read_Integer(&data, &edata_type);
328
329	if (edata_type != KRB5_PADATA_PW_SALT) {
330	DEBUG(0,("edata is not of required type %d but of type %d\n",
331	KRB5_PADATA_PW_SALT, edata_type));
332	asn1_free(&data);
333	return False;
334	}
335
336	asn1_start_tag(&data, ASN1_CONTEXT(2));
337	asn1_read_OctetString(&data, &edata_contents);
338	asn1_end_tag(&data);
339	asn1_end_tag(&data);
340	asn1_end_tag(&data);
341	asn1_free(&data);
342
343	*edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
344
345	data_blob_free(&edata_contents);
346
347	return True;
348	}
349
350
351	bool unwrap_pac(TALLOC_CTX mem_ctx, DATA_BLOB auth_data, DATA_BLOB *unwrapped_pac_data)
352	{
353	DATA_BLOB pac_contents;
354	ASN1_DATA data;
355	int data_type;
356
357	if (!auth_data->length) {
358	return False;
359	}
360
361	asn1_load(&data, *auth_data);
362	asn1_start_tag(&data, ASN1_SEQUENCE(0));
363	asn1_start_tag(&data, ASN1_SEQUENCE(0));
364	asn1_start_tag(&data, ASN1_CONTEXT(0));
365	asn1_read_Integer(&data, &data_type);
366
367	if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
368	DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
369	asn1_free(&data);
370	return False;
371	}
372
373	asn1_end_tag(&data);
374	asn1_start_tag(&data, ASN1_CONTEXT(1));
375	asn1_read_OctetString(&data, &pac_contents);
376	asn1_end_tag(&data);
377	asn1_end_tag(&data);
378	asn1_end_tag(&data);
379	asn1_free(&data);
380
381	*unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
382
383	data_blob_free(&pac_contents);
384
385	return True;
386	}
387
388	bool get_auth_data_from_tkt(TALLOC_CTX mem_ctx, DATA_BLOB auth_data, krb5_ticket *tkt)
389	{
390	DATA_BLOB auth_data_wrapped;
391	bool got_auth_data_pac = False;
392	int i;
393
394	#if defined(HAVE_KRB5_TKT_ENC_PART2)
395	if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
396	tkt->enc_part2->authorization_data[0] &&
397	tkt->enc_part2->authorization_data[0]->length)
398	{
399	for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
400
401	if (tkt->enc_part2->authorization_data[i]->ad_type !=
402	KRB5_AUTHDATA_IF_RELEVANT) {
403	DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
404	tkt->enc_part2->authorization_data[i]->ad_type));
405	continue;
406	}
407
408	auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
409	tkt->enc_part2->authorization_data[i]->length);
410
411	/* check if it is a PAC */
412	got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
413	data_blob_free(&auth_data_wrapped);
414
415	if (got_auth_data_pac) {
416	return true;
417	}
418	}
419
420	return got_auth_data_pac;
421	}
422
423	#else
424	if (tkt->ticket.authorization_data &&
425	tkt->ticket.authorization_data->len)
426	{
427	for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
428
429	if (tkt->ticket.authorization_data->val[i].ad_type !=
430	KRB5_AUTHDATA_IF_RELEVANT) {
431	DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
432	tkt->ticket.authorization_data->val[i].ad_type));
433	continue;
434	}
435
436	auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
437	tkt->ticket.authorization_data->val[i].ad_data.length);
438
439	/* check if it is a PAC */
440	got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
441	data_blob_free(&auth_data_wrapped);
442
443	if (got_auth_data_pac) {
444	return true;
445	}
446	}
447
448	return got_auth_data_pac;
449	}
450	#endif
451	return False;
452	}
453
454	krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
455	{
456	#if defined(HAVE_KRB5_TKT_ENC_PART2)
457	return tkt->enc_part2->client;
458	#else
459	return tkt->client;
460	#endif
461	}
462
463	#if !defined(HAVE_KRB5_LOCATE_KDC)
464
465	/* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
466	* to a public interface for this functionality, so we have to be able to live
467	* without it if the MIT libraries are hiding their internal symbols.
468	*/
469
470	#if defined(KRB5_KRBHST_INIT)
471	/* Heimdal */
472	krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data realm, struct sockaddr addr_pp, int naddrs, int get_masters)
473	{
474	krb5_krbhst_handle hnd;
475	krb5_krbhst_info *hinfo;
476	krb5_error_code rc;
477	int num_kdcs, i;
478	struct sockaddr *sa;
479	struct addrinfo *ai;
480
481	*addr_pp = NULL;
482	*naddrs = 0;
483
484	rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
485	if (rc) {
486	DEBUG(0, ("smb_krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
487	return rc;
488	}
489
490	for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
491	;
492
493	krb5_krbhst_reset(ctx, hnd);
494
495	if (!num_kdcs) {
496	DEBUG(0, ("smb_krb5_locate_kdc: zero kdcs found !\n"));
497	krb5_krbhst_free(ctx, hnd);
498	return -1;
499	}
500
501	sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
502	if (!sa) {
503	DEBUG(0, ("smb_krb5_locate_kdc: malloc failed\n"));
504	krb5_krbhst_free(ctx, hnd);
505	naddrs = 0;
506	return -1;
507	}
508
509	memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
510
511	for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
512
513	#if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
514	rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
515	if (rc) {
516	DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
517	continue;
518	}
519	#endif
520	if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
521	memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
522	}
523
524	krb5_krbhst_free(ctx, hnd);
525
526	*naddrs = num_kdcs;
527	*addr_pp = sa;
528	return 0;
529	}
530
531	#else /* ! defined(KRB5_KRBHST_INIT) */
532
533	krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
534	struct sockaddr *addr_pp, int naddrs, int get_masters)
535	{
536	DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
537	return KRB5_KDC_UNREACH;
538	}
539
540	#endif /* KRB5_KRBHST_INIT */
541
542	#else /* ! HAVE_KRB5_LOCATE_KDC */
543
544	krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
545	struct sockaddr *addr_pp, int naddrs, int get_masters)
546	{
547	return krb5_locate_kdc(ctx, realm, addr_pp, naddrs, get_masters);
548	}
549
550	#endif /* HAVE_KRB5_LOCATE_KDC */
551
552	#if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
553	void krb5_free_unparsed_name(krb5_context context, char *val)
554	{
555	SAFE_FREE(val);
556	}
557	#endif
558
559	void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
560	{
561	#if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
562	if (pdata->data) {
563	krb5_free_data_contents(context, pdata);
564	}
565	#else
566	SAFE_FREE(pdata->data);
567	#endif
568	}
569
570	void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
571	{
572	#if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
573	KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
574	#elif defined(HAVE_KRB5_SESSION_IN_CREDS)
575	KRB5_KEY_TYPE((&pcreds->session)) = enctype;
576	#else
577	#error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
578	#endif
579	}
580
581	bool kerberos_compatible_enctypes(krb5_context context,
582	krb5_enctype enctype1,
583	krb5_enctype enctype2)
584	{
585	#if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
586	krb5_boolean similar = 0;
587
588	krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
589	return similar ? True : False;
590	#elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
591	return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
592	#endif
593	}
594
595	static bool ads_cleanup_expired_creds(krb5_context context,
596	krb5_ccache ccache,
597	krb5_creds *credsp)
598	{
599	krb5_error_code retval;
600	const char *cc_type = krb5_cc_get_type(context, ccache);
601
602	DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
603	cc_type, krb5_cc_get_name(context, ccache),
604	http_timestring(credsp->times.endtime)));
605
606	/* we will probably need new tickets if the current ones
607	will expire within 10 seconds.
608	*/
609	if (credsp->times.endtime >= (time(NULL) + 10))
610	return False;
611
612	/* heimdal won't remove creds from a file ccache, and
613	perhaps we shouldn't anyway, since internally we
614	use memory ccaches, and a FILE one probably means that
615	we're using creds obtained outside of our exectuable
616	*/
617	if (strequal(cc_type, "FILE")) {
618	DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
619	return False;
620	}
621
622	retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
623	if (retval) {
624	DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
625	error_message(retval)));
626	/* If we have an error in this, we want to display it,
627	but continue as though we deleted it */
628	}
629	return True;
630	}
631
632	/*
633	we can't use krb5_mk_req because w2k wants the service to be in a particular format
634	*/
635	static krb5_error_code ads_krb5_mk_req(krb5_context context,
636	krb5_auth_context *auth_context,
637	const krb5_flags ap_req_options,
638	const char *principal,
639	krb5_ccache ccache,
640	krb5_data *outbuf,
641	time_t *expire_time)
642	{
643	krb5_error_code retval;
644	krb5_principal server;
645	krb5_creds * credsp;
646	krb5_creds creds;
647	krb5_data in_data;
648	bool creds_ready = False;
649	int i = 0, maxtries = 3;
650
651	ZERO_STRUCT(in_data);
652
653	retval = smb_krb5_parse_name(context, principal, &server);
654	if (retval) {
655	DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
656	return retval;
657	}
658
659	/* obtain ticket & session key */
660	ZERO_STRUCT(creds);
661	if ((retval = krb5_copy_principal(context, server, &creds.server))) {
662	DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
663	error_message(retval)));
664	goto cleanup_princ;
665	}
666
667	if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
668	/* This can commonly fail on smbd startup with no ticket in the cache.
669	* Report at higher level than 1. */
670	DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
671	error_message(retval)));
672	goto cleanup_creds;
673	}
674
675	while (!creds_ready && (i < maxtries)) {
676
677	if ((retval = krb5_get_credentials(context, 0, ccache,
678	&creds, &credsp))) {
679	DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
680	principal, error_message(retval)));
681	goto cleanup_creds;
682	}
683
684	/* cope with ticket being in the future due to clock skew */
685	if ((unsigned)credsp->times.starttime > time(NULL)) {
686	time_t t = time(NULL);
687	int time_offset =(int)((unsigned)credsp->times.starttime-t);
688	DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
689	krb5_set_real_time(context, t + time_offset + 1, 0);
690	}
691
692	if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
693	creds_ready = True;
694	}
695
696	i++;
697	}
698
699	DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
700	principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
701	http_timestring((unsigned)credsp->times.endtime),
702	(unsigned)credsp->times.endtime));
703
704	if (expire_time) {
705	*expire_time = (time_t)credsp->times.endtime;
706	}
707
708	#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
709	if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
710	/* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
711	as part of the kerberos exchange. */
712
713	DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n") );
714
715	if( *auth_context == NULL ) {
716	/* Allocate if it has not yet been allocated. */
717	retval = krb5_auth_con_init( context, auth_context );
718	if (retval) {
719	DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_init failed (%s)\n",
720	error_message(retval)));
721	goto cleanup_creds;
722	}
723	}
724
725	retval = krb5_auth_con_setuseruserkey( context, *auth_context, &credsp->keyblock );
726	if (retval) {
727	DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setuseruserkey failed (%s)\n",
728	error_message(retval)));
729	goto cleanup_creds;
730	}
731
732	/* Must use a subkey for forwarded tickets. */
733	retval = krb5_auth_con_setflags( context, *auth_context, KRB5_AUTH_CONTEXT_USE_SUBKEY);
734	if (retval) {
735	DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setflags failed (%s)\n",
736	error_message(retval)));
737	goto cleanup_creds;
738	}
739
740	retval = ads_krb5_get_fwd_ticket( context,
741	auth_context,
742	credsp,
743	ccache,
744	&in_data );
745	if (retval) {
746	DEBUG( 3, ("ads_krb5_get_fwd_ticket failed (%s)\n", error_message( retval ) ) );
747
748	/*
749	* This is not fatal. Delete the *auth_context and continue
750	* with krb5_mk_req_extended to get a non-forwardable ticket.
751	*/
752
753	if (in_data.data) {
754	free( in_data.data );
755	in_data.data = NULL;
756	in_data.length = 0;
757	}
758	krb5_auth_con_free(context, *auth_context);
759	*auth_context = NULL;
760	}
761	}
762	#endif
763
764	retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
765	&in_data, credsp, outbuf);
766	if (retval) {
767	DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
768	error_message(retval)));
769	}
770
771	if (in_data.data) {
772	free( in_data.data );
773	in_data.length = 0;
774	}
775
776	krb5_free_creds(context, credsp);
777
778	cleanup_creds:
779	krb5_free_cred_contents(context, &creds);
780
781	cleanup_princ:
782	krb5_free_principal(context, server);
783
784	return retval;
785	}
786
787	/*
788	get a kerberos5 ticket for the given service
789	*/
790	int cli_krb5_get_ticket(const char *principal, time_t time_offset,
791	DATA_BLOB ticket, DATA_BLOB session_key_krb5,
792	uint32 extra_ap_opts, const char *ccname,
793	time_t *tgs_expire)
794
795	{
796	krb5_error_code retval;
797	krb5_data packet;
798	krb5_context context = NULL;
799	krb5_ccache ccdef = NULL;
800	krb5_auth_context auth_context = NULL;
801	krb5_enctype enc_types[] = {
802	#ifdef ENCTYPE_ARCFOUR_HMAC
803	ENCTYPE_ARCFOUR_HMAC,
804	#endif
805	ENCTYPE_DES_CBC_MD5,
806	ENCTYPE_DES_CBC_CRC,
807	ENCTYPE_NULL};
808
809	initialize_krb5_error_table();
810	retval = krb5_init_context(&context);
811	if (retval) {
812	DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
813	error_message(retval)));
814	goto failed;
815	}
816
817	if (time_offset != 0) {
818	krb5_set_real_time(context, time(NULL) + time_offset, 0);
819	}
820
821	if ((retval = krb5_cc_resolve(context, ccname ?
822	ccname : krb5_cc_default_name(context), &ccdef))) {
823	DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
824	error_message(retval)));
825	goto failed;
826	}
827
828	if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
829	DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
830	error_message(retval)));
831	goto failed;
832	}
833
834	if ((retval = ads_krb5_mk_req(context,
835	&auth_context,
836	AP_OPTS_USE_SUBKEY \| (krb5_flags)extra_ap_opts,
837	principal,
838	ccdef, &packet,
839	tgs_expire))) {
840	goto failed;
841	}
842
843	get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
844
845	*ticket = data_blob(packet.data, packet.length);
846
847	kerberos_free_data_contents(context, &packet);
848
849	failed:
850
851	if ( context ) {
852	if (ccdef)
853	krb5_cc_close(context, ccdef);
854	if (auth_context)
855	krb5_auth_con_free(context, auth_context);
856	krb5_free_context(context);
857	}
858
859	return retval;
860	}
861
862	bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
863	{
864	krb5_keyblock *skey = NULL;
865	krb5_error_code err = 0;
866	bool ret = false;
867
868	if (remote) {
869	err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
870	} else {
871	err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
872	}
873
874	if (err \|\| skey == NULL) {
875	DEBUG(10, ("KRB5 error getting session key %d\n", err));
876	goto done;
877	}
878
879	DEBUG(10, ("Got KRB5 session key of length %d\n", (int)KRB5_KEY_LENGTH(skey)));
880	*session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
881	dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
882
883	ret = true;
884
885	done:
886	if (skey) {
887	krb5_free_keyblock(context, skey);
888	}
889
890	return ret;
891	}
892
893
894	#if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
895	const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
896
897	const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
898	{
899	static krb5_data kdata;
900
901	kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
902	kdata.length = strlen((const char *)kdata.data);
903	return &kdata;
904	}
905	#endif
906
907	krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
908	{
909	#if defined(HAVE_KRB5_KT_FREE_ENTRY)
910	return krb5_kt_free_entry(context, kt_entry);
911	#elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
912	return krb5_free_keytab_entry_contents(context, kt_entry);
913	#else
914	#error UNKNOWN_KT_FREE_FUNCTION
915	#endif
916	}
917
918	void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
919	struct PAC_SIGNATURE_DATA *sig)
920	{
921	#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
922	cksum->cksumtype = (krb5_cksumtype)sig->type;
923	cksum->checksum.length = sig->signature.length;
924	cksum->checksum.data = sig->signature.data;
925	#else
926	cksum->checksum_type = (krb5_cksumtype)sig->type;
927	cksum->length = sig->signature.length;
928	cksum->contents = sig->signature.data;
929	#endif
930	}
931
932	krb5_error_code smb_krb5_verify_checksum(krb5_context context,
933	const krb5_keyblock *keyblock,
934	krb5_keyusage usage,
935	krb5_checksum *cksum,
936	uint8 *data,
937	size_t length)
938	{
939	krb5_error_code ret;
940
941	/* verify the checksum */
942
943	/* welcome to the wonderful world of samba's kerberos abstraction layer:
944	*
945	* function heimdal 0.6.1rc3 heimdal 0.7 MIT krb 1.4.2
946	* -----------------------------------------------------------------------------
947	* krb5_c_verify_checksum - works works
948	* krb5_verify_checksum works (6 args) works (6 args) broken (7 args)
949	*/
950
951	#if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
952	{
953	krb5_boolean checksum_valid = False;
954	krb5_data input;
955
956	input.data = (char *)data;
957	input.length = length;
958
959	ret = krb5_c_verify_checksum(context,
960	keyblock,
961	usage,
962	&input,
963	cksum,
964	&checksum_valid);
965	if (ret) {
966	DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
967	error_message(ret)));
968	return ret;
969	}
970
971	if (!checksum_valid)
972	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
973	}
974
975	#elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
976
977	/* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
978	* without enctype and it ignores any key_usage types - Guenther */
979
980	{
981
982	krb5_crypto crypto;
983	ret = krb5_crypto_init(context,
984	keyblock,
985	0,
986	&crypto);
987	if (ret) {
988	DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
989	error_message(ret)));
990	return ret;
991	}
992
993	ret = krb5_verify_checksum(context,
994	crypto,
995	usage,
996	data,
997	length,
998	cksum);
999
1000	krb5_crypto_destroy(context, crypto);
1001	}
1002
1003	#else
1004	#error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
1005	#endif
1006
1007	return ret;
1008	}
1009
1010	time_t get_authtime_from_tkt(krb5_ticket *tkt)
1011	{
1012	#if defined(HAVE_KRB5_TKT_ENC_PART2)
1013	return tkt->enc_part2->times.authtime;
1014	#else
1015	return tkt->ticket.authtime;
1016	#endif
1017	}
1018
1019	#ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1020	static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
1021	{
1022	#ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
1023	if (ap_req->ticket->enc_part.kvno)
1024	return ap_req->ticket->enc_part.kvno;
1025	#else /* Heimdal */
1026	if (ap_req->ticket.enc_part.kvno)
1027	return *ap_req->ticket.enc_part.kvno;
1028	#endif
1029	return 0;
1030	}
1031
1032	static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
1033	{
1034	#ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
1035	return ap_req->ticket.enc_part.etype;
1036	#else /* MIT */
1037	return ap_req->ticket->enc_part.enctype;
1038	#endif
1039	}
1040	#endif /* HAVE_KRB5_DECODE_AP_REQ */
1041
1042	static krb5_error_code
1043	get_key_from_keytab(krb5_context context,
1044	krb5_const_principal server,
1045	krb5_enctype enctype,
1046	krb5_kvno kvno,
1047	krb5_keyblock **out_key)
1048	{
1049	krb5_keytab_entry entry;
1050	krb5_error_code ret;
1051	krb5_keytab keytab;
1052	char *name = NULL;
1053
1054	/* We have to open a new keytab handle here, as MIT does
1055	an implicit open/getnext/close on krb5_kt_get_entry. We
1056	may be in the middle of a keytab enumeration when this is
1057	called. JRA. */
1058
1059	ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
1060	if (ret) {
1061	DEBUG(1,("get_key_from_keytab: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
1062	return ret;
1063	}
1064
1065	if ( DEBUGLEVEL >= 10 ) {
1066	if (smb_krb5_unparse_name(context, server, &name) == 0) {
1067	DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
1068	kvno, enctype, name));
1069	SAFE_FREE(name);
1070	}
1071	}
1072
1073	ret = krb5_kt_get_entry(context,
1074	keytab,
1075	server,
1076	kvno,
1077	enctype,
1078	&entry);
1079
1080	if (ret) {
1081	DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
1082	goto out;
1083	}
1084
1085	#ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
1086	ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
1087	#elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
1088	ret = krb5_copy_keyblock(context, &entry.key, out_key);
1089	#else
1090	#error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
1091	#endif
1092
1093	if (ret) {
1094	DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
1095	goto out;
1096	}
1097
1098	smb_krb5_kt_free_entry(context, &entry);
1099
1100	out:
1101	krb5_kt_close(context, keytab);
1102	return ret;
1103	}
1104
1105	/* Prototypes */
1106
1107	krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
1108	const krb5_data *inbuf,
1109	krb5_kvno *kvno,
1110	krb5_enctype *enctype)
1111	{
1112	#ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1113	{
1114	krb5_error_code ret;
1115	krb5_ap_req ap_req;
1116
1117	ret = krb5_decode_ap_req(context, inbuf, &ap_req);
1118	if (ret)
1119	return ret;
1120
1121	*kvno = get_kvno_from_ap_req(&ap_req);
1122	*enctype = get_enctype_from_ap_req(&ap_req);
1123
1124	free_AP_REQ(&ap_req);
1125	return 0;
1126	}
1127	#endif
1128
1129	/* Possibly not an appropriate error code. */
1130	return KRB5KDC_ERR_BADOPTION;
1131	}
1132
1133	krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
1134	krb5_auth_context *auth_context,
1135	const krb5_data *inbuf,
1136	krb5_const_principal server,
1137	krb5_keytab keytab,
1138	krb5_flags *ap_req_options,
1139	krb5_ticket **ticket,
1140	krb5_keyblock **keyblock)
1141	{
1142	krb5_error_code ret;
1143	krb5_kvno kvno;
1144	krb5_enctype enctype;
1145	krb5_keyblock *local_keyblock;
1146
1147	ret = krb5_rd_req(context,
1148	auth_context,
1149	inbuf,
1150	server,
1151	keytab,
1152	ap_req_options,
1153	ticket);
1154	if (ret) {
1155	return ret;
1156	}
1157
1158	#ifdef KRB5_TICKET_HAS_KEYINFO
1159	enctype = (*ticket)->enc_part.enctype;
1160	kvno = (*ticket)->enc_part.kvno;
1161	#else
1162	ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
1163	if (ret) {
1164	return ret;
1165	}
1166	#endif
1167
1168	ret = get_key_from_keytab(context,
1169	server,
1170	enctype,
1171	kvno,
1172	&local_keyblock);
1173	if (ret) {
1174	DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
1175	goto out;
1176	}
1177
1178	out:
1179	if (ret && local_keyblock != NULL) {
1180	krb5_free_keyblock(context, local_keyblock);
1181	} else {
1182	*keyblock = local_keyblock;
1183	}
1184
1185	return ret;
1186	}
1187
1188	krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
1189	const char *name,
1190	krb5_principal *principal)
1191	{
1192	#ifdef HAVE_KRB5_PARSE_NAME_NOREALM
1193	return smb_krb5_parse_name_norealm_conv(context, name, principal);
1194	#endif
1195
1196	/* we are cheating here because parse_name will in fact set the realm.
1197	* We don't care as the only caller of smb_krb5_parse_name_norealm
1198	* ignores the realm anyway when calling
1199	* smb_krb5_principal_compare_any_realm later - Guenther */
1200
1201	return smb_krb5_parse_name(context, name, principal);
1202	}
1203
1204	bool smb_krb5_principal_compare_any_realm(krb5_context context,
1205	krb5_const_principal princ1,
1206	krb5_const_principal princ2)
1207	{
1208	#ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1209
1210	return krb5_principal_compare_any_realm(context, princ1, princ2);
1211
1212	/* krb5_princ_size is a macro in MIT */
1213	#elif defined(HAVE_KRB5_PRINC_SIZE) \|\| defined(krb5_princ_size)
1214
1215	int i, len1, len2;
1216	const krb5_data p1, p2;
1217
1218	len1 = krb5_princ_size(context, princ1);
1219	len2 = krb5_princ_size(context, princ2);
1220
1221	if (len1 != len2)
1222	return False;
1223
1224	for (i = 0; i < len1; i++) {
1225
1226	p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1227	p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1228
1229	if (p1->length != p2->length \|\| memcmp(p1->data, p2->data, p1->length))
1230	return False;
1231	}
1232
1233	return True;
1234	#else
1235	#error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1236	#endif
1237	}
1238
1239	krb5_error_code smb_krb5_renew_ticket(const char ccache_string, / FILE:/tmp/krb5cc_0 */
1240	const char client_string, / gd@BER.SUSE.DE */
1241	const char service_string, / krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1242	time_t *expire_time)
1243	{
1244	krb5_error_code ret;
1245	krb5_context context = NULL;
1246	krb5_ccache ccache = NULL;
1247	krb5_principal client = NULL;
1248	krb5_creds creds, creds_in, *creds_out = NULL;
1249
1250	ZERO_STRUCT(creds);
1251	ZERO_STRUCT(creds_in);
1252
1253	initialize_krb5_error_table();
1254	ret = krb5_init_context(&context);
1255	if (ret) {
1256	goto done;
1257	}
1258
1259	if (!ccache_string) {
1260	ccache_string = krb5_cc_default_name(context);
1261	}
1262
1263	if (!ccache_string) {
1264	ret = EINVAL;
1265	goto done;
1266	}
1267
1268	DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1269
1270	/* FIXME: we should not fall back to defaults */
1271	ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1272	if (ret) {
1273	goto done;
1274	}
1275
1276	if (client_string) {
1277	ret = smb_krb5_parse_name(context, client_string, &client);
1278	if (ret) {
1279	goto done;
1280	}
1281	} else {
1282	ret = krb5_cc_get_principal(context, ccache, &client);
1283	if (ret) {
1284	goto done;
1285	}
1286	}
1287
1288	#ifdef HAVE_KRB5_GET_RENEWED_CREDS /* MIT */
1289	{
1290	ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1291	if (ret) {
1292	DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1293	goto done;
1294	}
1295	}
1296	#elif defined(HAVE_KRB5_GET_KDC_CRED) /* Heimdal */
1297	{
1298	krb5_kdc_flags flags;
1299	krb5_realm *client_realm = NULL;
1300
1301	ret = krb5_copy_principal(context, client, &creds_in.client);
1302	if (ret) {
1303	goto done;
1304	}
1305
1306	if (service_string) {
1307	ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1308	if (ret) {
1309	goto done;
1310	}
1311	} else {
1312	/* build tgt service by default */
1313	client_realm = krb5_princ_realm(context, creds_in.client);
1314	if (!client_realm) {
1315	ret = ENOMEM;
1316	goto done;
1317	}
1318	ret = krb5_make_principal(context, &creds_in.server, client_realm, KRB5_TGS_NAME, client_realm, NULL);
1319	if (ret) {
1320	goto done;
1321	}
1322	}
1323
1324	flags.i = 0;
1325	flags.b.renewable = flags.b.renew = True;
1326
1327	ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds_out);
1328	if (ret) {
1329	DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1330	goto done;
1331	}
1332
1333	creds = *creds_out;
1334	}
1335	#else
1336	#error NO_SUITABLE_KRB5_TICKET_RENEW_FUNCTION_AVAILABLE
1337	#endif
1338
1339	/* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1340	ret = krb5_cc_initialize(context, ccache, client);
1341	if (ret) {
1342	goto done;
1343	}
1344
1345	ret = krb5_cc_store_cred(context, ccache, &creds);
1346
1347	if (expire_time) {
1348	*expire_time = (time_t) creds.times.endtime;
1349	}
1350
1351	done:
1352	krb5_free_cred_contents(context, &creds_in);
1353
1354	if (creds_out) {
1355	krb5_free_creds(context, creds_out);
1356	} else {
1357	krb5_free_cred_contents(context, &creds);
1358	}
1359
1360	if (client) {
1361	krb5_free_principal(context, client);
1362	}
1363	if (ccache) {
1364	krb5_cc_close(context, ccache);
1365	}
1366	if (context) {
1367	krb5_free_context(context);
1368	}
1369
1370	return ret;
1371	}
1372
1373	krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1374	{
1375	krb5_error_code ret = 0;
1376	if (addr == NULL) {
1377	return ret;
1378	}
1379	#if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1380	krb5_free_addresses(context, addr->addrs);
1381	#elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1382	ret = krb5_free_addresses(context, addr->addrs);
1383	SAFE_FREE(addr->addrs);
1384	#endif
1385	SAFE_FREE(addr);
1386	addr = NULL;
1387	return ret;
1388	}
1389
1390	krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1391	{
1392	krb5_error_code ret = 0;
1393	nstring buf;
1394	#if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1395	krb5_address **addrs = NULL;
1396	#elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1397	krb5_addresses *addrs = NULL;
1398	#endif
1399
1400	kerb_addr = (smb_krb5_addresses )SMB_MALLOC(sizeof(smb_krb5_addresses));
1401	if (*kerb_addr == NULL) {
1402	return ENOMEM;
1403	}
1404
1405	put_name(buf, global_myname(), ' ', 0x20);
1406
1407	#if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1408	{
1409	int num_addr = 2;
1410
1411	addrs = (krb5_address *)SMB_MALLOC(sizeof(krb5_address ) * num_addr);
1412	if (addrs == NULL) {
1413	SAFE_FREE(kerb_addr);
1414	return ENOMEM;
1415	}
1416
1417	memset(addrs, 0, sizeof(krb5_address ) num_addr);
1418
1419	addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1420	if (addrs[0] == NULL) {
1421	SAFE_FREE(addrs);
1422	SAFE_FREE(kerb_addr);
1423	return ENOMEM;
1424	}
1425
1426	addrs[0]->magic = KV5M_ADDRESS;
1427	addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1428	addrs[0]->length = MAX_NETBIOSNAME_LEN;
1429	addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1430	if (addrs[0]->contents == NULL) {
1431	SAFE_FREE(addrs[0]);
1432	SAFE_FREE(addrs);
1433	SAFE_FREE(kerb_addr);
1434	return ENOMEM;
1435	}
1436
1437	memcpy(addrs[0]->contents, buf, addrs[0]->length);
1438
1439	addrs[1] = NULL;
1440	}
1441	#elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1442	{
1443	addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1444	if (addrs == NULL) {
1445	SAFE_FREE(kerb_addr);
1446	return ENOMEM;
1447	}
1448
1449	memset(addrs, 0, sizeof(krb5_addresses));
1450
1451	addrs->len = 1;
1452	addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1453	if (addrs->val == NULL) {
1454	SAFE_FREE(addrs);
1455	SAFE_FREE(kerb_addr);
1456	return ENOMEM;
1457	}
1458
1459	addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1460	addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1461	addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1462	if (addrs->val[0].address.data == NULL) {
1463	SAFE_FREE(addrs->val);
1464	SAFE_FREE(addrs);
1465	SAFE_FREE(kerb_addr);
1466	return ENOMEM;
1467	}
1468
1469	memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1470	}
1471	#else
1472	#error UNKNOWN_KRB5_ADDRESS_FORMAT
1473	#endif
1474	(*kerb_addr)->addrs = addrs;
1475
1476	return ret;
1477	}
1478
1479	void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1480	{
1481	#ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1482	krb5_free_error_contents(context, krberror);
1483	#else /* MIT */
1484	krb5_free_error(context, krberror);
1485	#endif
1486	}
1487
1488	krb5_error_code handle_krberror_packet(krb5_context context,
1489	krb5_data *packet)
1490	{
1491	krb5_error_code ret;
1492	bool got_error_code = False;
1493
1494	DEBUG(10,("handle_krberror_packet: got error packet\n"));
1495
1496	#ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1497	{
1498	krb5_error krberror;
1499
1500	if ((ret = krb5_rd_error(context, packet, &krberror))) {
1501	DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1502	error_message(ret)));
1503	return ret;
1504	}
1505
1506	if (krberror.e_data == NULL \|\| krberror.e_data->data == NULL) {
1507	ret = (krb5_error_code) krberror.error_code;
1508	got_error_code = True;
1509	}
1510
1511	smb_krb5_free_error(context, &krberror);
1512	}
1513	#else /* MIT */
1514	{
1515	krb5_error *krberror;
1516
1517	if ((ret = krb5_rd_error(context, packet, &krberror))) {
1518	DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1519	error_message(ret)));
1520	return ret;
1521	}
1522
1523	if (krberror->e_data.data == NULL) {
1524	ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1525	got_error_code = True;
1526	}
1527	smb_krb5_free_error(context, krberror);
1528	}
1529	#endif
1530	if (got_error_code) {
1531	DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1532	error_message(ret), ret));
1533	}
1534	return ret;
1535	}
1536
1537	krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1538	krb5_get_init_creds_opt **opt)
1539	{
1540	#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
1541	/* Heimdal or modern MIT version */
1542	return krb5_get_init_creds_opt_alloc(context, opt);
1543	#else
1544	/* Historical MIT version */
1545	krb5_get_init_creds_opt *my_opt;
1546
1547	*opt = NULL;
1548
1549	if ((my_opt = SMB_MALLOC_P(krb5_get_init_creds_opt)) == NULL) {
1550	return ENOMEM;
1551	}
1552
1553	krb5_get_init_creds_opt_init(my_opt);
1554
1555	*opt = my_opt;
1556	return 0;
1557	#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC */
1558	}
1559
1560	void smb_krb5_get_init_creds_opt_free(krb5_context context,
1561	krb5_get_init_creds_opt *opt)
1562	{
1563	#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
1564
1565	#ifdef KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT
1566	/* Modern MIT or Heimdal version */
1567	krb5_get_init_creds_opt_free(context, opt);
1568	#else
1569	/* Heimdal version */
1570	krb5_get_init_creds_opt_free(opt);
1571	#endif /* KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT */
1572
1573	#else /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1574	/* Historical MIT version */
1575	SAFE_FREE(opt);
1576	opt = NULL;
1577	#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1578	}
1579
1580	krb5_enctype smb_get_enctype_from_kt_entry(const krb5_keytab_entry *kt_entry)
1581	{
1582	#ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY /* MIT */
1583	return kt_entry->key.enctype;
1584	#elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK) /* Heimdal */
1585	return kt_entry->keyblock.keytype;
1586	#else
1587	#error UNKNOWN_KRB5_KEYTAB_ENTRY_KEYBLOCK_FORMAT
1588	#endif
1589	}
1590
1591
1592	/* caller needs to free etype_s */
1593	krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1594	krb5_enctype enctype,
1595	char **etype_s)
1596	{
1597	#ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1598	return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1599	#elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1600	char buf[256];
1601	krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1602	if (ret) {
1603	return ret;
1604	}
1605	*etype_s = SMB_STRDUP(buf);
1606	if (!*etype_s) {
1607	return ENOMEM;
1608	}
1609	return ret;
1610	#else
1611	#error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1612	#endif
1613	}
1614
1615	krb5_error_code smb_krb5_mk_error(krb5_context context,
1616	krb5_error_code error_code,
1617	const krb5_principal server,
1618	krb5_data *reply)
1619	{
1620	#ifdef HAVE_SHORT_KRB5_MK_ERROR_INTERFACE /* MIT */
1621	/*
1622	* The MIT interface is terrible.
1623	* We have to construct this ourselves...
1624	*/
1625	krb5_error e;
1626
1627	memset(&e, 0, sizeof(e));
1628	krb5_us_timeofday(context, &e.stime, &e.susec);
1629	e.server = server;
1630	#if defined(krb5_err_base)
1631	e.error = error_code - krb5_err_base;
1632	#elif defined(ERROR_TABLE_BASE_krb5)
1633	e.error = error_code - ERROR_TABLE_BASE_krb5;
1634	#else
1635	e.error = error_code; /* Almost certainly wrong, but what can we do... ? */
1636	#endif
1637
1638	return krb5_mk_error(context, &e, reply);
1639	#else /* Heimdal. */
1640	return krb5_mk_error(context,
1641	error_code,
1642	NULL,
1643	NULL, /* e_data */
1644	NULL,
1645	server,
1646	NULL,
1647	NULL,
1648	reply);
1649	#endif
1650	}
1651
1652	/**********************************************************************
1653	* Open a krb5 keytab with flags, handles readonly or readwrite access and
1654	* allows to process non-default keytab names.
1655	* @param context krb5_context
1656	* @param keytab_name_req string
1657	* @param write_access bool if writable keytab is required
1658	* @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1659	* @return krb5_error_code
1660	**********************************************************************/
1661
1662	/* This MAX_NAME_LEN is a constant defined in krb5.h */
1663	#ifndef MAX_KEYTAB_NAME_LEN
1664	#define MAX_KEYTAB_NAME_LEN 1100
1665	#endif
1666
1667	krb5_error_code smb_krb5_open_keytab(krb5_context context,
1668	const char *keytab_name_req,
1669	bool write_access,
1670	krb5_keytab *keytab)
1671	{
1672	krb5_error_code ret = 0;
1673	TALLOC_CTX *mem_ctx;
1674	char keytab_string[MAX_KEYTAB_NAME_LEN];
1675	char *kt_str = NULL;
1676	bool found_valid_name = False;
1677	const char *pragma = "FILE";
1678	const char *tmp = NULL;
1679
1680	if (!write_access && !keytab_name_req) {
1681	/* caller just wants to read the default keytab readonly, so be it */
1682	return krb5_kt_default(context, keytab);
1683	}
1684
1685	mem_ctx = talloc_init("smb_krb5_open_keytab");
1686	if (!mem_ctx) {
1687	return ENOMEM;
1688	}
1689
1690	#ifdef HAVE_WRFILE_KEYTAB
1691	if (write_access) {
1692	pragma = "WRFILE";
1693	}
1694	#endif
1695
1696	if (keytab_name_req) {
1697
1698	if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1699	ret = KRB5_CONFIG_NOTENUFSPACE;
1700	goto out;
1701	}
1702
1703	if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) \|\|
1704	(strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1705	tmp = keytab_name_req;
1706	goto resolve;
1707	}
1708
1709	if (keytab_name_req[0] != '/') {
1710	ret = KRB5_KT_BADNAME;
1711	goto out;
1712	}
1713
1714	tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1715	if (!tmp) {
1716	ret = ENOMEM;
1717	goto out;
1718	}
1719
1720	goto resolve;
1721	}
1722
1723	/* we need to handle more complex keytab_strings, like:
1724	* "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1725
1726	ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1727	if (ret) {
1728	goto out;
1729	}
1730
1731	DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1732
1733	tmp = talloc_strdup(mem_ctx, keytab_string);
1734	if (!tmp) {
1735	ret = ENOMEM;
1736	goto out;
1737	}
1738
1739	if (strncmp(tmp, "ANY:", 4) == 0) {
1740	tmp += 4;
1741	}
1742
1743	memset(&keytab_string, '\0', sizeof(keytab_string));
1744
1745	while (next_token_talloc(mem_ctx, &tmp, &kt_str, ",")) {
1746	if (strncmp(kt_str, "WRFILE:", 7) == 0) {
1747	found_valid_name = True;
1748	tmp = kt_str;
1749	tmp += 7;
1750	}
1751
1752	if (strncmp(kt_str, "FILE:", 5) == 0) {
1753	found_valid_name = True;
1754	tmp = kt_str;
1755	tmp += 5;
1756	}
1757
1758	if (tmp[0] == '/') {
1759	/* Treat as a FILE: keytab definition. */
1760	found_valid_name = true;
1761	}
1762
1763	if (found_valid_name) {
1764	if (tmp[0] != '/') {
1765	ret = KRB5_KT_BADNAME;
1766	goto out;
1767	}
1768
1769	tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1770	if (!tmp) {
1771	ret = ENOMEM;
1772	goto out;
1773	}
1774	break;
1775	}
1776	}
1777
1778	if (!found_valid_name) {
1779	ret = KRB5_KT_UNKNOWN_TYPE;
1780	goto out;
1781	}
1782
1783	resolve:
1784	DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1785	ret = krb5_kt_resolve(context, tmp, keytab);
1786
1787	out:
1788	TALLOC_FREE(mem_ctx);
1789	return ret;
1790	}
1791
1792	#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
1793	/**************************************************************
1794	Routine: ads_krb5_get_fwd_ticket
1795	Description:
1796	When a service ticket is flagged as trusted
1797	for delegation we should provide a forwardable
1798	ticket so that the remote host can act on our
1799	behalf. This is done by taking the 2nd forwardable
1800	TGT and storing it in the GSS-API authenticator
1801	"checksum". This routine will populate
1802	the krb5_data authenticator with this TGT.
1803	Parameters:
1804	krb5_context context: The kerberos context for this authentication.
1805	krb5_auth_context: The authentication context.
1806	krb5_creds *credsp: The ticket credentials (AS-REP).
1807	krb5_ccache ccache: The credentials cache.
1808	krb5_data &authenticator: The checksum field that will store the TGT, and
1809	authenticator.data must be freed by the caller.
1810
1811	Returns:
1812	krb5_error_code: 0 if no errors, otherwise set.
1813	**************************************************************/
1814
1815	static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
1816	krb5_auth_context *auth_context,
1817	krb5_creds *credsp,
1818	krb5_ccache ccache,
1819	krb5_data *authenticator)
1820	{
1821	krb5_data fwdData;
1822	krb5_error_code retval = 0;
1823	char *pChksum = NULL;
1824	char *p = NULL;
1825
1826	ZERO_STRUCT(fwdData);
1827	ZERO_STRUCTP(authenticator);
1828
1829	retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
1830	auth_context, / Authentication context [in] */
1831	CONST_DISCARD(char , KRB5_TGS_NAME), / Ticket service name ("krbtgt") [in] */
1832	credsp->client, /* Client principal for the tgt [in] */
1833	credsp->server, /* Server principal for the tgt [in] */
1834	ccache, /* Credential cache to use for storage [in] */
1835	1, /* Turn on for "Forwardable ticket" [in] */
1836	&fwdData ); /* Resulting response [out] */
1837
1838
1839	if (retval) {
1840	DEBUG(1,("ads_krb5_get_fwd_ticket: krb5_fwd_tgt_creds failed (%s)\n",
1841	error_message(retval)));
1842	goto out;
1843	}
1844
1845	if ((unsigned int)GSSAPI_CHECKSUM_SIZE + (unsigned int)fwdData.length <
1846	(unsigned int)GSSAPI_CHECKSUM_SIZE) {
1847	retval = EINVAL;
1848	goto out;
1849	}
1850
1851	/* We're going to allocate a gssChecksum structure with a little
1852	extra data the length of the kerberos credentials length
1853	(APPLICATION 22) so that we can pack it on the end of the structure.
1854	*/
1855
1856	pChksum = (char *)SMB_MALLOC(GSSAPI_CHECKSUM_SIZE + fwdData.length );
1857	if (!pChksum) {
1858	retval = ENOMEM;
1859	goto out;
1860	}
1861
1862	p = pChksum;
1863
1864	SIVAL(p, 0, GSSAPI_BNDLENGTH);
1865	p += 4;
1866
1867	/* Zero out the bindings fields */
1868	memset(p, '\0', GSSAPI_BNDLENGTH );
1869	p += GSSAPI_BNDLENGTH;
1870
1871	SIVAL(p, 0, GSS_C_DELEG_FLAG );
1872	p += 4;
1873	SSVAL(p, 0, 1 );
1874	p += 2;
1875	SSVAL(p, 0, fwdData.length );
1876	p += 2;
1877
1878	/* Migrate the kerberos KRB_CRED data to the checksum delegation */
1879	memcpy(p, fwdData.data, fwdData.length );
1880	p += fwdData.length;
1881
1882	/* We need to do this in order to allow our GSS-API */
1883	retval = krb5_auth_con_set_req_cksumtype( context, *auth_context, GSSAPI_CHECKSUM );
1884	if (retval) {
1885	goto out;
1886	}
1887
1888	/* We now have a service ticket, now turn it into an AP-REQ. */
1889	authenticator->length = fwdData.length + GSSAPI_CHECKSUM_SIZE;
1890
1891	/* Caller should call free() when they're done with this. */
1892	authenticator->data = (char *)pChksum;
1893
1894	out:
1895
1896	/* Remove that input data, we never needed it anyway. */
1897	if (fwdData.length > 0) {
1898	krb5_free_data_contents( context, &fwdData );
1899	}
1900
1901	return retval;
1902	}
1903	#endif
1904
1905	#else /* HAVE_KRB5 */
1906	/* this saves a few linking headaches */
1907	int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1908	DATA_BLOB ticket, DATA_BLOB session_key_krb5, uint32 extra_ap_opts,
1909	const char ccname, time_t tgs_expire)
1910	{
1911	DEBUG(0,("NO KERBEROS SUPPORT\n"));
1912	return 1;
1913	}
1914
1915	#endif

Note: See TracBrowser for help on using the repository browser.

Download in other formats: