Context Navigation

source: branches/samba-3.3.x/source/libsmb/clikrb5.c@ 1075

Visit:

Last change on this file since 1075 was 370, checked in by Herwig Bauernfeind, 16 years ago
Update Samba 3.3 to 3.3.10 (source)
File size: 53.3 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	simple kerberos5 routines for active directory
4	Copyright (C) Andrew Tridgell 2001
5	Copyright (C) Luke Howard 2002-2003
6	Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7	Copyright (C) Guenther Deschner 2005-2007
8
9	This program is free software; you can redistribute it and/or modify
10	it under the terms of the GNU General Public License as published by
11	the Free Software Foundation; either version 3 of the License, or
12	(at your option) any later version.
13
14	This program is distributed in the hope that it will be useful,
15	but WITHOUT ANY WARRANTY; without even the implied warranty of
16	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	GNU General Public License for more details.
18
19	You should have received a copy of the GNU General Public License
20	along with this program. If not, see <http://www.gnu.org/licenses/>.
21	*/
22
23	#include "includes.h"
24	#include "smb_krb5.h"
25	#include "authdata.h"
26
27	#ifdef HAVE_KRB5
28
29	#define GSSAPI_CHECKSUM 0x8003 /* Checksum type value for Kerberos */
30	#define GSSAPI_BNDLENGTH 16 /* Bind Length (rfc-1964 pg.3) */
31	#define GSSAPI_CHECKSUM_SIZE (12+GSSAPI_BNDLENGTH)
32
33	#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
34	static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
35	krb5_auth_context *auth_context,
36	krb5_creds *credsp,
37	krb5_ccache ccache,
38	krb5_data *authenticator);
39	#endif
40
41	/**************************************************************
42	Wrappers around kerberos string functions that convert from
43	utf8 -> unix charset and vica versa.
44	**************************************************************/
45
46	/**************************************************************
47	krb5_parse_name that takes a UNIX charset.
48	**************************************************************/
49
50	krb5_error_code smb_krb5_parse_name(krb5_context context,
51	const char name, / in unix charset */
52	krb5_principal *principal)
53	{
54	krb5_error_code ret;
55	char *utf8_name;
56	size_t converted_size;
57
58	if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
59	return ENOMEM;
60	}
61
62	ret = krb5_parse_name(context, utf8_name, principal);
63	SAFE_FREE(utf8_name);
64	return ret;
65	}
66
67	#ifdef HAVE_KRB5_PARSE_NAME_NOREALM
68	/**************************************************************
69	krb5_parse_name_norealm that takes a UNIX charset.
70	**************************************************************/
71
72	static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
73	const char name, / in unix charset */
74	krb5_principal *principal)
75	{
76	krb5_error_code ret;
77	char *utf8_name;
78	size_t converted_size;
79
80	*principal = NULL;
81	if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
82	return ENOMEM;
83	}
84
85	ret = krb5_parse_name_norealm(context, utf8_name, principal);
86	SAFE_FREE(utf8_name);
87	return ret;
88	}
89	#endif
90
91	/**************************************************************
92	krb5_parse_name that returns a UNIX charset name. Must
93	be freed with normal free() call.
94	**************************************************************/
95
96	krb5_error_code smb_krb5_unparse_name(krb5_context context,
97	krb5_const_principal principal,
98	char **unix_name)
99	{
100	krb5_error_code ret;
101	char *utf8_name;
102	size_t converted_size;
103
104	*unix_name = NULL;
105	ret = krb5_unparse_name(context, principal, &utf8_name);
106	if (ret) {
107	return ret;
108	}
109
110	if (!pull_utf8_allocate(unix_name, utf8_name, &converted_size)) {
111	krb5_free_unparsed_name(context, utf8_name);
112	return ENOMEM;
113	}
114	krb5_free_unparsed_name(context, utf8_name);
115	return 0;
116	}
117
118	#ifndef HAVE_KRB5_SET_REAL_TIME
119	/*
120	* This function is not in the Heimdal mainline.
121	*/
122	krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
123	{
124	krb5_error_code ret;
125	int32_t sec, usec;
126
127	ret = krb5_us_timeofday(context, &sec, &usec);
128	if (ret)
129	return ret;
130
131	context->kdc_sec_offset = seconds - sec;
132	context->kdc_usec_offset = microseconds - usec;
133
134	return 0;
135	}
136	#endif
137
138	#if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
139
140	#if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
141
142	/* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
143	* to krb5_set_default_tgs_ktypes. See
144	* http://lists.samba.org/archive/samba-technical/2006-July/048271.html
145	*
146	* If the MIT libraries are not exporting internal symbols, we will end up in
147	* this branch, which is correct. Otherwise we will continue to use the
148	* internal symbol
149	*/
150	krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
151	{
152	return krb5_set_default_tgs_enctypes(ctx, enc);
153	}
154
155	#elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
156
157	/* Heimdal */
158	krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
159	{
160	return krb5_set_default_in_tkt_etypes(ctx, enc);
161	}
162
163	#endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
164
165	#endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
166
167	#if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
168	/* HEIMDAL */
169	bool setup_kaddr( krb5_address pkaddr, struct sockaddr_storage paddr)
170	{
171	memset(pkaddr, '\0', sizeof(krb5_address));
172	#if defined(HAVE_IPV6) && defined(KRB5_ADDRESS_INET6)
173	if (paddr->ss_family == AF_INET6) {
174	pkaddr->addr_type = KRB5_ADDRESS_INET6;
175	pkaddr->address.length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
176	pkaddr->address.data = (char )&(((struct sockaddr_in6 )paddr)->sin6_addr);
177	return true;
178	}
179	#endif
180	if (paddr->ss_family == AF_INET) {
181	pkaddr->addr_type = KRB5_ADDRESS_INET;
182	pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
183	pkaddr->address.data = (char )&(((struct sockaddr_in )paddr)->sin_addr);
184	return true;
185	}
186	return false;
187	}
188	#elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
189	/* MIT */
190	bool setup_kaddr( krb5_address pkaddr, struct sockaddr_storage paddr)
191	{
192	memset(pkaddr, '\0', sizeof(krb5_address));
193	#if defined(HAVE_IPV6) && defined(ADDRTYPE_INET6)
194	if (paddr->ss_family == AF_INET6) {
195	pkaddr->addrtype = ADDRTYPE_INET6;
196	pkaddr->length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
197	pkaddr->contents = (krb5_octet )&(((struct sockaddr_in6 )paddr)->sin6_addr);
198	return true;
199	}
200	#endif
201	if (paddr->ss_family == AF_INET) {
202	pkaddr->addrtype = ADDRTYPE_INET;
203	pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
204	pkaddr->contents = (krb5_octet )&(((struct sockaddr_in )paddr)->sin_addr);
205	return true;
206	}
207	return false;
208	}
209	#else
210	#error UNKNOWN_ADDRTYPE
211	#endif
212
213	#if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
214	static int create_kerberos_key_from_string_direct(krb5_context context,
215	krb5_principal host_princ,
216	krb5_data *password,
217	krb5_keyblock *key,
218	krb5_enctype enctype)
219	{
220	int ret = 0;
221	krb5_data salt;
222	krb5_encrypt_block eblock;
223
224	ret = krb5_principal2salt(context, host_princ, &salt);
225	if (ret) {
226	DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
227	return ret;
228	}
229	krb5_use_enctype(context, &eblock, enctype);
230	ret = krb5_string_to_key(context, &eblock, key, password, &salt);
231	SAFE_FREE(salt.data);
232
233	return ret;
234	}
235	#elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
236	static int create_kerberos_key_from_string_direct(krb5_context context,
237	krb5_principal host_princ,
238	krb5_data *password,
239	krb5_keyblock *key,
240	krb5_enctype enctype)
241	{
242	int ret;
243	krb5_salt salt;
244
245	ret = krb5_get_pw_salt(context, host_princ, &salt);
246	if (ret) {
247	DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
248	return ret;
249	}
250
251	ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
252	krb5_free_salt(context, salt);
253
254	return ret;
255	}
256	#else
257	#error UNKNOWN_CREATE_KEY_FUNCTIONS
258	#endif
259
260	int create_kerberos_key_from_string(krb5_context context,
261	krb5_principal host_princ,
262	krb5_data *password,
263	krb5_keyblock *key,
264	krb5_enctype enctype,
265	bool no_salt)
266	{
267	krb5_principal salt_princ = NULL;
268	int ret;
269	/*
270	* Check if we've determined that the KDC is salting keys for this
271	* principal/enctype in a non-obvious way. If it is, try to match
272	* its behavior.
273	*/
274	if (no_salt) {
275	KRB5_KEY_DATA(key) = (KRB5_KEY_DATA_CAST *)SMB_MALLOC(password->length);
276	if (!KRB5_KEY_DATA(key)) {
277	return ENOMEM;
278	}
279	memcpy(KRB5_KEY_DATA(key), password->data, password->length);
280	KRB5_KEY_LENGTH(key) = password->length;
281	KRB5_KEY_TYPE(key) = enctype;
282	return 0;
283	}
284	salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
285	ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
286	if (salt_princ) {
287	krb5_free_principal(context, salt_princ);
288	}
289	return ret;
290	}
291
292	#if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
293	krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
294	krb5_enctype **enctypes)
295	{
296	return krb5_get_permitted_enctypes(context, enctypes);
297	}
298	#elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
299	krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
300	krb5_enctype **enctypes)
301	{
302	return krb5_get_default_in_tkt_etypes(context, enctypes);
303	}
304	#else
305	#error UNKNOWN_GET_ENCTYPES_FUNCTIONS
306	#endif
307
308	#if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
309	krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
310	krb5_auth_context auth_context,
311	krb5_keyblock *keyblock)
312	{
313	return krb5_auth_con_setkey(context, auth_context, keyblock);
314	}
315	#endif
316
317	bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
318	DATA_BLOB *edata,
319	DATA_BLOB *edata_out)
320	{
321	DATA_BLOB edata_contents;
322	ASN1_DATA data;
323	int edata_type;
324
325	if (!edata->length) {
326	return False;
327	}
328
329	asn1_load(&data, *edata);
330	asn1_start_tag(&data, ASN1_SEQUENCE(0));
331	asn1_start_tag(&data, ASN1_CONTEXT(1));
332	asn1_read_Integer(&data, &edata_type);
333
334	if (edata_type != KRB5_PADATA_PW_SALT) {
335	DEBUG(0,("edata is not of required type %d but of type %d\n",
336	KRB5_PADATA_PW_SALT, edata_type));
337	asn1_free(&data);
338	return False;
339	}
340
341	asn1_start_tag(&data, ASN1_CONTEXT(2));
342	asn1_read_OctetString(&data, &edata_contents);
343	asn1_end_tag(&data);
344	asn1_end_tag(&data);
345	asn1_end_tag(&data);
346	asn1_free(&data);
347
348	*edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
349
350	data_blob_free(&edata_contents);
351
352	return True;
353	}
354
355
356	bool unwrap_pac(TALLOC_CTX mem_ctx, DATA_BLOB auth_data, DATA_BLOB *unwrapped_pac_data)
357	{
358	DATA_BLOB pac_contents;
359	ASN1_DATA data;
360	int data_type;
361
362	if (!auth_data->length) {
363	return False;
364	}
365
366	asn1_load(&data, *auth_data);
367	asn1_start_tag(&data, ASN1_SEQUENCE(0));
368	asn1_start_tag(&data, ASN1_SEQUENCE(0));
369	asn1_start_tag(&data, ASN1_CONTEXT(0));
370	asn1_read_Integer(&data, &data_type);
371
372	if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
373	DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
374	asn1_free(&data);
375	return False;
376	}
377
378	asn1_end_tag(&data);
379	asn1_start_tag(&data, ASN1_CONTEXT(1));
380	asn1_read_OctetString(&data, &pac_contents);
381	asn1_end_tag(&data);
382	asn1_end_tag(&data);
383	asn1_end_tag(&data);
384	asn1_free(&data);
385
386	*unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
387
388	data_blob_free(&pac_contents);
389
390	return True;
391	}
392
393	bool get_auth_data_from_tkt(TALLOC_CTX mem_ctx, DATA_BLOB auth_data, krb5_ticket *tkt)
394	{
395	DATA_BLOB auth_data_wrapped;
396	bool got_auth_data_pac = False;
397	int i;
398
399	#if defined(HAVE_KRB5_TKT_ENC_PART2)
400	if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
401	tkt->enc_part2->authorization_data[0] &&
402	tkt->enc_part2->authorization_data[0]->length)
403	{
404	for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
405
406	if (tkt->enc_part2->authorization_data[i]->ad_type !=
407	KRB5_AUTHDATA_IF_RELEVANT) {
408	DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
409	tkt->enc_part2->authorization_data[i]->ad_type));
410	continue;
411	}
412
413	auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
414	tkt->enc_part2->authorization_data[i]->length);
415
416	/* check if it is a PAC */
417	got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
418	data_blob_free(&auth_data_wrapped);
419
420	if (got_auth_data_pac) {
421	return true;
422	}
423	}
424
425	return got_auth_data_pac;
426	}
427
428	#else
429	if (tkt->ticket.authorization_data &&
430	tkt->ticket.authorization_data->len)
431	{
432	for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
433
434	if (tkt->ticket.authorization_data->val[i].ad_type !=
435	KRB5_AUTHDATA_IF_RELEVANT) {
436	DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
437	tkt->ticket.authorization_data->val[i].ad_type));
438	continue;
439	}
440
441	auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
442	tkt->ticket.authorization_data->val[i].ad_data.length);
443
444	/* check if it is a PAC */
445	got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
446	data_blob_free(&auth_data_wrapped);
447
448	if (got_auth_data_pac) {
449	return true;
450	}
451	}
452
453	return got_auth_data_pac;
454	}
455	#endif
456	return False;
457	}
458
459	krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
460	{
461	#if defined(HAVE_KRB5_TKT_ENC_PART2)
462	return tkt->enc_part2->client;
463	#else
464	return tkt->client;
465	#endif
466	}
467
468	#if !defined(HAVE_KRB5_LOCATE_KDC)
469
470	/* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
471	* to a public interface for this functionality, so we have to be able to live
472	* without it if the MIT libraries are hiding their internal symbols.
473	*/
474
475	#if defined(KRB5_KRBHST_INIT)
476	/* Heimdal */
477	krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data realm, struct sockaddr addr_pp, int naddrs, int get_masters)
478	{
479	krb5_krbhst_handle hnd;
480	krb5_krbhst_info *hinfo;
481	krb5_error_code rc;
482	int num_kdcs, i;
483	struct sockaddr *sa;
484	struct addrinfo *ai;
485
486	*addr_pp = NULL;
487	*naddrs = 0;
488
489	rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
490	if (rc) {
491	DEBUG(0, ("smb_krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
492	return rc;
493	}
494
495	for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
496	;
497
498	krb5_krbhst_reset(ctx, hnd);
499
500	if (!num_kdcs) {
501	DEBUG(0, ("smb_krb5_locate_kdc: zero kdcs found !\n"));
502	krb5_krbhst_free(ctx, hnd);
503	return -1;
504	}
505
506	sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
507	if (!sa) {
508	DEBUG(0, ("smb_krb5_locate_kdc: malloc failed\n"));
509	krb5_krbhst_free(ctx, hnd);
510	naddrs = 0;
511	return -1;
512	}
513
514	memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
515
516	for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
517
518	#if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
519	rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
520	if (rc) {
521	DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
522	continue;
523	}
524	#endif
525	if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
526	memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
527	}
528
529	krb5_krbhst_free(ctx, hnd);
530
531	*naddrs = num_kdcs;
532	*addr_pp = sa;
533	return 0;
534	}
535
536	#else /* ! defined(KRB5_KRBHST_INIT) */
537
538	krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
539	struct sockaddr *addr_pp, int naddrs, int get_masters)
540	{
541	DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
542	return KRB5_KDC_UNREACH;
543	}
544
545	#endif /* KRB5_KRBHST_INIT */
546
547	#else /* ! HAVE_KRB5_LOCATE_KDC */
548
549	krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
550	struct sockaddr *addr_pp, int naddrs, int get_masters)
551	{
552	return krb5_locate_kdc(ctx, realm, addr_pp, naddrs, get_masters);
553	}
554
555	#endif /* HAVE_KRB5_LOCATE_KDC */
556
557	#if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
558	void krb5_free_unparsed_name(krb5_context context, char *val)
559	{
560	SAFE_FREE(val);
561	}
562	#endif
563
564	void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
565	{
566	#if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
567	if (pdata->data) {
568	krb5_free_data_contents(context, pdata);
569	}
570	#else
571	SAFE_FREE(pdata->data);
572	#endif
573	}
574
575	void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
576	{
577	#if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
578	KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
579	#elif defined(HAVE_KRB5_SESSION_IN_CREDS)
580	KRB5_KEY_TYPE((&pcreds->session)) = enctype;
581	#else
582	#error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
583	#endif
584	}
585
586	bool kerberos_compatible_enctypes(krb5_context context,
587	krb5_enctype enctype1,
588	krb5_enctype enctype2)
589	{
590	#if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
591	krb5_boolean similar = 0;
592
593	krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
594	return similar ? True : False;
595	#elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
596	return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
597	#endif
598	}
599
600	static bool ads_cleanup_expired_creds(krb5_context context,
601	krb5_ccache ccache,
602	krb5_creds *credsp)
603	{
604	krb5_error_code retval;
605	const char *cc_type = krb5_cc_get_type(context, ccache);
606
607	DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
608	cc_type, krb5_cc_get_name(context, ccache),
609	http_timestring(credsp->times.endtime)));
610
611	/* we will probably need new tickets if the current ones
612	will expire within 10 seconds.
613	*/
614	if (credsp->times.endtime >= (time(NULL) + 10))
615	return False;
616
617	/* heimdal won't remove creds from a file ccache, and
618	perhaps we shouldn't anyway, since internally we
619	use memory ccaches, and a FILE one probably means that
620	we're using creds obtained outside of our exectuable
621	*/
622	if (strequal(cc_type, "FILE")) {
623	DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
624	return False;
625	}
626
627	retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
628	if (retval) {
629	DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
630	error_message(retval)));
631	/* If we have an error in this, we want to display it,
632	but continue as though we deleted it */
633	}
634	return True;
635	}
636
637	/*
638	we can't use krb5_mk_req because w2k wants the service to be in a particular format
639	*/
640	static krb5_error_code ads_krb5_mk_req(krb5_context context,
641	krb5_auth_context *auth_context,
642	const krb5_flags ap_req_options,
643	const char *principal,
644	krb5_ccache ccache,
645	krb5_data *outbuf,
646	time_t *expire_time)
647	{
648	krb5_error_code retval;
649	krb5_principal server;
650	krb5_creds * credsp;
651	krb5_creds creds;
652	krb5_data in_data;
653	bool creds_ready = False;
654	int i = 0, maxtries = 3;
655
656	ZERO_STRUCT(in_data);
657
658	retval = smb_krb5_parse_name(context, principal, &server);
659	if (retval) {
660	DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
661	return retval;
662	}
663
664	/* obtain ticket & session key */
665	ZERO_STRUCT(creds);
666	if ((retval = krb5_copy_principal(context, server, &creds.server))) {
667	DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
668	error_message(retval)));
669	goto cleanup_princ;
670	}
671
672	if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
673	/* This can commonly fail on smbd startup with no ticket in the cache.
674	* Report at higher level than 1. */
675	DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
676	error_message(retval)));
677	goto cleanup_creds;
678	}
679
680	while (!creds_ready && (i < maxtries)) {
681
682	if ((retval = krb5_get_credentials(context, 0, ccache,
683	&creds, &credsp))) {
684	DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
685	principal, error_message(retval)));
686	goto cleanup_creds;
687	}
688
689	/* cope with ticket being in the future due to clock skew */
690	if ((unsigned)credsp->times.starttime > time(NULL)) {
691	time_t t = time(NULL);
692	int time_offset =(int)((unsigned)credsp->times.starttime-t);
693	DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
694	krb5_set_real_time(context, t + time_offset + 1, 0);
695	}
696
697	if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
698	creds_ready = True;
699	}
700
701	i++;
702	}
703
704	DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
705	principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
706	http_timestring((unsigned)credsp->times.endtime),
707	(unsigned)credsp->times.endtime));
708
709	if (expire_time) {
710	*expire_time = (time_t)credsp->times.endtime;
711	}
712
713	#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
714	if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
715	/* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
716	as part of the kerberos exchange. */
717
718	DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n") );
719
720	if( *auth_context == NULL ) {
721	/* Allocate if it has not yet been allocated. */
722	retval = krb5_auth_con_init( context, auth_context );
723	if (retval) {
724	DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_init failed (%s)\n",
725	error_message(retval)));
726	goto cleanup_creds;
727	}
728	}
729
730	retval = krb5_auth_con_setuseruserkey( context, *auth_context, &credsp->keyblock );
731	if (retval) {
732	DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setuseruserkey failed (%s)\n",
733	error_message(retval)));
734	goto cleanup_creds;
735	}
736
737	/* Must use a subkey for forwarded tickets. */
738	retval = krb5_auth_con_setflags( context, *auth_context, KRB5_AUTH_CONTEXT_USE_SUBKEY);
739	if (retval) {
740	DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setflags failed (%s)\n",
741	error_message(retval)));
742	goto cleanup_creds;
743	}
744
745	retval = ads_krb5_get_fwd_ticket( context,
746	auth_context,
747	credsp,
748	ccache,
749	&in_data );
750	if (retval) {
751	DEBUG( 3, ("ads_krb5_get_fwd_ticket failed (%s)\n",
752	error_message( retval ) ) );
753
754	/*
755	* This is not fatal. Delete the *auth_context and continue
756	* with krb5_mk_req_extended to get a non-forwardable ticket.
757	*/
758
759	if (in_data.data) {
760	free( in_data.data );
761	in_data.data = NULL;
762	in_data.length = 0;
763	}
764	krb5_auth_con_free(context, *auth_context);
765	*auth_context = NULL;
766	}
767	}
768	#endif
769
770	retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
771	&in_data, credsp, outbuf);
772	if (retval) {
773	DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
774	error_message(retval)));
775	}
776
777	if (in_data.data) {
778	free( in_data.data );
779	in_data.length = 0;
780	}
781
782	krb5_free_creds(context, credsp);
783
784	cleanup_creds:
785	krb5_free_cred_contents(context, &creds);
786
787	cleanup_princ:
788	krb5_free_principal(context, server);
789
790	return retval;
791	}
792
793	/*
794	get a kerberos5 ticket for the given service
795	*/
796	int cli_krb5_get_ticket(const char *principal, time_t time_offset,
797	DATA_BLOB ticket, DATA_BLOB session_key_krb5,
798	uint32 extra_ap_opts, const char *ccname,
799	time_t *tgs_expire)
800
801	{
802	krb5_error_code retval;
803	krb5_data packet;
804	krb5_context context = NULL;
805	krb5_ccache ccdef = NULL;
806	krb5_auth_context auth_context = NULL;
807	krb5_enctype enc_types[] = {
808	#ifdef ENCTYPE_ARCFOUR_HMAC
809	ENCTYPE_ARCFOUR_HMAC,
810	#endif
811	ENCTYPE_DES_CBC_MD5,
812	ENCTYPE_DES_CBC_CRC,
813	ENCTYPE_NULL};
814
815	initialize_krb5_error_table();
816	retval = krb5_init_context(&context);
817	if (retval) {
818	DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
819	error_message(retval)));
820	goto failed;
821	}
822
823	if (time_offset != 0) {
824	krb5_set_real_time(context, time(NULL) + time_offset, 0);
825	}
826
827	if ((retval = krb5_cc_resolve(context, ccname ?
828	ccname : krb5_cc_default_name(context), &ccdef))) {
829	DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
830	error_message(retval)));
831	goto failed;
832	}
833
834	if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
835	DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
836	error_message(retval)));
837	goto failed;
838	}
839
840	if ((retval = ads_krb5_mk_req(context,
841	&auth_context,
842	AP_OPTS_USE_SUBKEY \| (krb5_flags)extra_ap_opts,
843	principal,
844	ccdef, &packet,
845	tgs_expire))) {
846	goto failed;
847	}
848
849	get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
850
851	*ticket = data_blob(packet.data, packet.length);
852
853	kerberos_free_data_contents(context, &packet);
854
855	failed:
856
857	if ( context ) {
858	if (ccdef)
859	krb5_cc_close(context, ccdef);
860	if (auth_context)
861	krb5_auth_con_free(context, auth_context);
862	krb5_free_context(context);
863	}
864
865	return retval;
866	}
867
868	bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
869	{
870	krb5_keyblock *skey = NULL;
871	krb5_error_code err = 0;
872	bool ret = false;
873
874	if (remote) {
875	err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
876	} else {
877	err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
878	}
879
880	if (err \|\| skey == NULL) {
881	DEBUG(10, ("KRB5 error getting session key %d\n", err));
882	goto done;
883	}
884
885	DEBUG(10, ("Got KRB5 session key of length %d\n", (int)KRB5_KEY_LENGTH(skey)));
886	*session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
887	dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
888
889	ret = true;
890
891	done:
892	if (skey) {
893	krb5_free_keyblock(context, skey);
894	}
895
896	return ret;
897	}
898
899
900	#if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
901	const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
902
903	const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
904	{
905	static krb5_data kdata;
906
907	kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
908	kdata.length = strlen((const char *)kdata.data);
909	return &kdata;
910	}
911	#endif
912
913	krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
914	{
915	/* Try krb5_free_keytab_entry_contents first, since
916	* MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
917	* krb5_kt_free_entry but only has a prototype for the first, while the
918	* second is considered private.
919	*/
920	#if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
921	return krb5_free_keytab_entry_contents(context, kt_entry);
922	#elif defined(HAVE_KRB5_KT_FREE_ENTRY)
923	return krb5_kt_free_entry(context, kt_entry);
924	#else
925	#error UNKNOWN_KT_FREE_FUNCTION
926	#endif
927	}
928
929	void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
930	struct PAC_SIGNATURE_DATA *sig)
931	{
932	#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
933	cksum->cksumtype = (krb5_cksumtype)sig->type;
934	cksum->checksum.length = sig->signature.length;
935	cksum->checksum.data = sig->signature.data;
936	#else
937	cksum->checksum_type = (krb5_cksumtype)sig->type;
938	cksum->length = sig->signature.length;
939	cksum->contents = sig->signature.data;
940	#endif
941	}
942
943	krb5_error_code smb_krb5_verify_checksum(krb5_context context,
944	const krb5_keyblock *keyblock,
945	krb5_keyusage usage,
946	krb5_checksum *cksum,
947	uint8 *data,
948	size_t length)
949	{
950	krb5_error_code ret;
951
952	/* verify the checksum */
953
954	/* welcome to the wonderful world of samba's kerberos abstraction layer:
955	*
956	* function heimdal 0.6.1rc3 heimdal 0.7 MIT krb 1.4.2
957	* -----------------------------------------------------------------------------
958	* krb5_c_verify_checksum - works works
959	* krb5_verify_checksum works (6 args) works (6 args) broken (7 args)
960	*/
961
962	#if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
963	{
964	krb5_boolean checksum_valid = False;
965	krb5_data input;
966
967	input.data = (char *)data;
968	input.length = length;
969
970	ret = krb5_c_verify_checksum(context,
971	keyblock,
972	usage,
973	&input,
974	cksum,
975	&checksum_valid);
976	if (ret) {
977	DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
978	error_message(ret)));
979	return ret;
980	}
981
982	if (!checksum_valid)
983	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
984	}
985
986	#elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
987
988	/* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
989	* without enctype and it ignores any key_usage types - Guenther */
990
991	{
992
993	krb5_crypto crypto;
994	ret = krb5_crypto_init(context,
995	keyblock,
996	0,
997	&crypto);
998	if (ret) {
999	DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
1000	error_message(ret)));
1001	return ret;
1002	}
1003
1004	ret = krb5_verify_checksum(context,
1005	crypto,
1006	usage,
1007	data,
1008	length,
1009	cksum);
1010
1011	krb5_crypto_destroy(context, crypto);
1012	}
1013
1014	#else
1015	#error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
1016	#endif
1017
1018	return ret;
1019	}
1020
1021	time_t get_authtime_from_tkt(krb5_ticket *tkt)
1022	{
1023	#if defined(HAVE_KRB5_TKT_ENC_PART2)
1024	return tkt->enc_part2->times.authtime;
1025	#else
1026	return tkt->ticket.authtime;
1027	#endif
1028	}
1029
1030	#ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1031	static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
1032	{
1033	#ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
1034	if (ap_req->ticket->enc_part.kvno)
1035	return ap_req->ticket->enc_part.kvno;
1036	#else /* Heimdal */
1037	if (ap_req->ticket.enc_part.kvno)
1038	return *ap_req->ticket.enc_part.kvno;
1039	#endif
1040	return 0;
1041	}
1042
1043	static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
1044	{
1045	#ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
1046	return ap_req->ticket.enc_part.etype;
1047	#else /* MIT */
1048	return ap_req->ticket->enc_part.enctype;
1049	#endif
1050	}
1051	#endif /* HAVE_KRB5_DECODE_AP_REQ */
1052
1053	static krb5_error_code
1054	get_key_from_keytab(krb5_context context,
1055	krb5_const_principal server,
1056	krb5_enctype enctype,
1057	krb5_kvno kvno,
1058	krb5_keyblock **out_key)
1059	{
1060	krb5_keytab_entry entry;
1061	krb5_error_code ret;
1062	krb5_keytab keytab;
1063	char *name = NULL;
1064	krb5_keyblock *keyp;
1065
1066	/* We have to open a new keytab handle here, as MIT does
1067	an implicit open/getnext/close on krb5_kt_get_entry. We
1068	may be in the middle of a keytab enumeration when this is
1069	called. JRA. */
1070
1071	ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
1072	if (ret) {
1073	DEBUG(1,("get_key_from_keytab: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
1074	return ret;
1075	}
1076
1077	if ( DEBUGLEVEL >= 10 ) {
1078	if (smb_krb5_unparse_name(context, server, &name) == 0) {
1079	DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
1080	kvno, enctype, name));
1081	SAFE_FREE(name);
1082	}
1083	}
1084
1085	ret = krb5_kt_get_entry(context,
1086	keytab,
1087	server,
1088	kvno,
1089	enctype,
1090	&entry);
1091
1092	if (ret) {
1093	DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
1094	goto out;
1095	}
1096
1097	keyp = KRB5_KT_KEY(&entry);
1098
1099	ret = krb5_copy_keyblock(context, keyp, out_key);
1100	if (ret) {
1101	DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
1102	goto out;
1103	}
1104
1105	smb_krb5_kt_free_entry(context, &entry);
1106
1107	out:
1108	krb5_kt_close(context, keytab);
1109	return ret;
1110	}
1111
1112	/* Prototypes */
1113
1114	krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
1115	const krb5_data *inbuf,
1116	krb5_kvno *kvno,
1117	krb5_enctype *enctype)
1118	{
1119	#ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1120	{
1121	krb5_error_code ret;
1122	krb5_ap_req ap_req;
1123
1124	ret = krb5_decode_ap_req(context, inbuf, &ap_req);
1125	if (ret)
1126	return ret;
1127
1128	*kvno = get_kvno_from_ap_req(&ap_req);
1129	*enctype = get_enctype_from_ap_req(&ap_req);
1130
1131	free_AP_REQ(&ap_req);
1132	return 0;
1133	}
1134	#endif
1135
1136	/* Possibly not an appropriate error code. */
1137	return KRB5KDC_ERR_BADOPTION;
1138	}
1139
1140	krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
1141	krb5_auth_context *auth_context,
1142	const krb5_data *inbuf,
1143	krb5_const_principal server,
1144	krb5_keytab keytab,
1145	krb5_flags *ap_req_options,
1146	krb5_ticket **ticket,
1147	krb5_keyblock **keyblock)
1148	{
1149	krb5_error_code ret;
1150	krb5_kvno kvno;
1151	krb5_enctype enctype;
1152	krb5_keyblock *local_keyblock;
1153
1154	ret = krb5_rd_req(context,
1155	auth_context,
1156	inbuf,
1157	server,
1158	keytab,
1159	ap_req_options,
1160	ticket);
1161	if (ret) {
1162	return ret;
1163	}
1164
1165	#ifdef KRB5_TICKET_HAS_KEYINFO
1166	enctype = (*ticket)->enc_part.enctype;
1167	kvno = (*ticket)->enc_part.kvno;
1168	#else
1169	ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
1170	if (ret) {
1171	return ret;
1172	}
1173	#endif
1174
1175	ret = get_key_from_keytab(context,
1176	server,
1177	enctype,
1178	kvno,
1179	&local_keyblock);
1180	if (ret) {
1181	DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
1182	goto out;
1183	}
1184
1185	out:
1186	if (ret && local_keyblock != NULL) {
1187	krb5_free_keyblock(context, local_keyblock);
1188	} else {
1189	*keyblock = local_keyblock;
1190	}
1191
1192	return ret;
1193	}
1194
1195	krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
1196	const char *name,
1197	krb5_principal *principal)
1198	{
1199	#ifdef HAVE_KRB5_PARSE_NAME_NOREALM
1200	return smb_krb5_parse_name_norealm_conv(context, name, principal);
1201	#endif
1202
1203	/* we are cheating here because parse_name will in fact set the realm.
1204	* We don't care as the only caller of smb_krb5_parse_name_norealm
1205	* ignores the realm anyway when calling
1206	* smb_krb5_principal_compare_any_realm later - Guenther */
1207
1208	return smb_krb5_parse_name(context, name, principal);
1209	}
1210
1211	bool smb_krb5_principal_compare_any_realm(krb5_context context,
1212	krb5_const_principal princ1,
1213	krb5_const_principal princ2)
1214	{
1215	#ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1216
1217	return krb5_principal_compare_any_realm(context, princ1, princ2);
1218
1219	/* krb5_princ_size is a macro in MIT */
1220	#elif defined(HAVE_KRB5_PRINC_SIZE) \|\| defined(krb5_princ_size)
1221
1222	int i, len1, len2;
1223	const krb5_data p1, p2;
1224
1225	len1 = krb5_princ_size(context, princ1);
1226	len2 = krb5_princ_size(context, princ2);
1227
1228	if (len1 != len2)
1229	return False;
1230
1231	for (i = 0; i < len1; i++) {
1232
1233	p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1234	p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1235
1236	if (p1->length != p2->length \|\| memcmp(p1->data, p2->data, p1->length))
1237	return False;
1238	}
1239
1240	return True;
1241	#else
1242	#error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1243	#endif
1244	}
1245
1246	krb5_error_code smb_krb5_renew_ticket(const char ccache_string, / FILE:/tmp/krb5cc_0 */
1247	const char client_string, / gd@BER.SUSE.DE */
1248	const char service_string, / krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1249	time_t *expire_time)
1250	{
1251	krb5_error_code ret;
1252	krb5_context context = NULL;
1253	krb5_ccache ccache = NULL;
1254	krb5_principal client = NULL;
1255	krb5_creds creds, creds_in, *creds_out = NULL;
1256
1257	ZERO_STRUCT(creds);
1258	ZERO_STRUCT(creds_in);
1259
1260	initialize_krb5_error_table();
1261	ret = krb5_init_context(&context);
1262	if (ret) {
1263	goto done;
1264	}
1265
1266	if (!ccache_string) {
1267	ccache_string = krb5_cc_default_name(context);
1268	}
1269
1270	if (!ccache_string) {
1271	ret = EINVAL;
1272	goto done;
1273	}
1274
1275	DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1276
1277	/* FIXME: we should not fall back to defaults */
1278	ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1279	if (ret) {
1280	goto done;
1281	}
1282
1283	if (client_string) {
1284	ret = smb_krb5_parse_name(context, client_string, &client);
1285	if (ret) {
1286	goto done;
1287	}
1288	} else {
1289	ret = krb5_cc_get_principal(context, ccache, &client);
1290	if (ret) {
1291	goto done;
1292	}
1293	}
1294
1295	#ifdef HAVE_KRB5_GET_RENEWED_CREDS /* MIT */
1296	{
1297	ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1298	if (ret) {
1299	DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1300	goto done;
1301	}
1302	}
1303	#elif defined(HAVE_KRB5_GET_KDC_CRED) /* Heimdal */
1304	{
1305	krb5_kdc_flags flags;
1306	krb5_realm *client_realm = NULL;
1307
1308	ret = krb5_copy_principal(context, client, &creds_in.client);
1309	if (ret) {
1310	goto done;
1311	}
1312
1313	if (service_string) {
1314	ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1315	if (ret) {
1316	goto done;
1317	}
1318	} else {
1319	/* build tgt service by default */
1320	client_realm = krb5_princ_realm(context, creds_in.client);
1321	if (!client_realm) {
1322	ret = ENOMEM;
1323	goto done;
1324	}
1325	ret = krb5_make_principal(context, &creds_in.server, client_realm, KRB5_TGS_NAME, client_realm, NULL);
1326	if (ret) {
1327	goto done;
1328	}
1329	}
1330
1331	flags.i = 0;
1332	flags.b.renewable = flags.b.renew = True;
1333
1334	ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds_out);
1335	if (ret) {
1336	DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1337	goto done;
1338	}
1339
1340	creds = *creds_out;
1341	}
1342	#else
1343	#error NO_SUITABLE_KRB5_TICKET_RENEW_FUNCTION_AVAILABLE
1344	#endif
1345
1346	/* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1347	ret = krb5_cc_initialize(context, ccache, client);
1348	if (ret) {
1349	goto done;
1350	}
1351
1352	ret = krb5_cc_store_cred(context, ccache, &creds);
1353
1354	if (expire_time) {
1355	*expire_time = (time_t) creds.times.endtime;
1356	}
1357
1358	done:
1359	krb5_free_cred_contents(context, &creds_in);
1360
1361	if (creds_out) {
1362	krb5_free_creds(context, creds_out);
1363	} else {
1364	krb5_free_cred_contents(context, &creds);
1365	}
1366
1367	if (client) {
1368	krb5_free_principal(context, client);
1369	}
1370	if (ccache) {
1371	krb5_cc_close(context, ccache);
1372	}
1373	if (context) {
1374	krb5_free_context(context);
1375	}
1376
1377	return ret;
1378	}
1379
1380	krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1381	{
1382	krb5_error_code ret = 0;
1383	if (addr == NULL) {
1384	return ret;
1385	}
1386	#if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1387	krb5_free_addresses(context, addr->addrs);
1388	#elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1389	ret = krb5_free_addresses(context, addr->addrs);
1390	SAFE_FREE(addr->addrs);
1391	#endif
1392	SAFE_FREE(addr);
1393	addr = NULL;
1394	return ret;
1395	}
1396
1397	krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1398	{
1399	krb5_error_code ret = 0;
1400	nstring buf;
1401	#if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1402	krb5_address **addrs = NULL;
1403	#elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1404	krb5_addresses *addrs = NULL;
1405	#endif
1406
1407	kerb_addr = (smb_krb5_addresses )SMB_MALLOC(sizeof(smb_krb5_addresses));
1408	if (*kerb_addr == NULL) {
1409	return ENOMEM;
1410	}
1411
1412	put_name(buf, global_myname(), ' ', 0x20);
1413
1414	#if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1415	{
1416	int num_addr = 2;
1417
1418	addrs = (krb5_address *)SMB_MALLOC(sizeof(krb5_address ) * num_addr);
1419	if (addrs == NULL) {
1420	SAFE_FREE(*kerb_addr);
1421	return ENOMEM;
1422	}
1423
1424	memset(addrs, 0, sizeof(krb5_address ) num_addr);
1425
1426	addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1427	if (addrs[0] == NULL) {
1428	SAFE_FREE(addrs);
1429	SAFE_FREE(*kerb_addr);
1430	return ENOMEM;
1431	}
1432
1433	addrs[0]->magic = KV5M_ADDRESS;
1434	addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1435	addrs[0]->length = MAX_NETBIOSNAME_LEN;
1436	addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1437	if (addrs[0]->contents == NULL) {
1438	SAFE_FREE(addrs[0]);
1439	SAFE_FREE(addrs);
1440	SAFE_FREE(*kerb_addr);
1441	return ENOMEM;
1442	}
1443
1444	memcpy(addrs[0]->contents, buf, addrs[0]->length);
1445
1446	addrs[1] = NULL;
1447	}
1448	#elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1449	{
1450	addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1451	if (addrs == NULL) {
1452	SAFE_FREE(*kerb_addr);
1453	return ENOMEM;
1454	}
1455
1456	memset(addrs, 0, sizeof(krb5_addresses));
1457
1458	addrs->len = 1;
1459	addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1460	if (addrs->val == NULL) {
1461	SAFE_FREE(addrs);
1462	SAFE_FREE(kerb_addr);
1463	return ENOMEM;
1464	}
1465
1466	addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1467	addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1468	addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1469	if (addrs->val[0].address.data == NULL) {
1470	SAFE_FREE(addrs->val);
1471	SAFE_FREE(addrs);
1472	SAFE_FREE(*kerb_addr);
1473	return ENOMEM;
1474	}
1475
1476	memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1477	}
1478	#else
1479	#error UNKNOWN_KRB5_ADDRESS_FORMAT
1480	#endif
1481	(*kerb_addr)->addrs = addrs;
1482
1483	return ret;
1484	}
1485
1486	void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1487	{
1488	#ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1489	krb5_free_error_contents(context, krberror);
1490	#else /* MIT */
1491	krb5_free_error(context, krberror);
1492	#endif
1493	}
1494
1495	krb5_error_code handle_krberror_packet(krb5_context context,
1496	krb5_data *packet)
1497	{
1498	krb5_error_code ret;
1499	bool got_error_code = False;
1500
1501	DEBUG(10,("handle_krberror_packet: got error packet\n"));
1502
1503	#ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1504	{
1505	krb5_error krberror;
1506
1507	if ((ret = krb5_rd_error(context, packet, &krberror))) {
1508	DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1509	error_message(ret)));
1510	return ret;
1511	}
1512
1513	if (krberror.e_data == NULL \|\| krberror.e_data->data == NULL) {
1514	ret = (krb5_error_code) krberror.error_code;
1515	got_error_code = True;
1516	}
1517
1518	smb_krb5_free_error(context, &krberror);
1519	}
1520	#else /* MIT */
1521	{
1522	krb5_error *krberror;
1523
1524	if ((ret = krb5_rd_error(context, packet, &krberror))) {
1525	DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1526	error_message(ret)));
1527	return ret;
1528	}
1529
1530	if (krberror->e_data.data == NULL) {
1531	ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1532	got_error_code = True;
1533	}
1534	smb_krb5_free_error(context, krberror);
1535	}
1536	#endif
1537	if (got_error_code) {
1538	DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1539	error_message(ret), ret));
1540	}
1541	return ret;
1542	}
1543
1544	krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1545	krb5_get_init_creds_opt **opt)
1546	{
1547	#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
1548	/* Heimdal or modern MIT version */
1549	return krb5_get_init_creds_opt_alloc(context, opt);
1550	#else
1551	/* Historical MIT version */
1552	krb5_get_init_creds_opt *my_opt;
1553
1554	*opt = NULL;
1555
1556	if ((my_opt = SMB_MALLOC_P(krb5_get_init_creds_opt)) == NULL) {
1557	return ENOMEM;
1558	}
1559
1560	krb5_get_init_creds_opt_init(my_opt);
1561
1562	*opt = my_opt;
1563	return 0;
1564	#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC */
1565	}
1566
1567	void smb_krb5_get_init_creds_opt_free(krb5_context context,
1568	krb5_get_init_creds_opt *opt)
1569	{
1570	#ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
1571
1572	#ifdef KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT
1573	/* Modern MIT or Heimdal version */
1574	krb5_get_init_creds_opt_free(context, opt);
1575	#else
1576	/* Heimdal version */
1577	krb5_get_init_creds_opt_free(opt);
1578	#endif /* KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT */
1579
1580	#else /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1581	/* Historical MIT version */
1582	SAFE_FREE(opt);
1583	opt = NULL;
1584	#endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1585	}
1586
1587	krb5_enctype smb_get_enctype_from_kt_entry(krb5_keytab_entry *kt_entry)
1588	{
1589	return KRB5_KEY_TYPE(KRB5_KT_KEY(kt_entry));
1590	}
1591
1592
1593	/* caller needs to free etype_s */
1594	krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1595	krb5_enctype enctype,
1596	char **etype_s)
1597	{
1598	#ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1599	return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1600	#elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1601	char buf[256];
1602	krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1603	if (ret) {
1604	return ret;
1605	}
1606	*etype_s = SMB_STRDUP(buf);
1607	if (!*etype_s) {
1608	return ENOMEM;
1609	}
1610	return ret;
1611	#else
1612	#error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1613	#endif
1614	}
1615
1616	krb5_error_code smb_krb5_mk_error(krb5_context context,
1617	krb5_error_code error_code,
1618	const krb5_principal server,
1619	krb5_data *reply)
1620	{
1621	#ifdef HAVE_SHORT_KRB5_MK_ERROR_INTERFACE /* MIT */
1622	/*
1623	* The MIT interface is terrible.
1624	* We have to construct this ourselves...
1625	*/
1626	krb5_error e;
1627
1628	memset(&e, 0, sizeof(e));
1629	krb5_us_timeofday(context, &e.stime, &e.susec);
1630	e.server = server;
1631	#if defined(krb5_err_base)
1632	e.error = error_code - krb5_err_base;
1633	#elif defined(ERROR_TABLE_BASE_krb5)
1634	e.error = error_code - ERROR_TABLE_BASE_krb5;
1635	#else
1636	e.error = error_code; /* Almost certainly wrong, but what can we do... ? */
1637	#endif
1638
1639	return krb5_mk_error(context, &e, reply);
1640	#else /* Heimdal. */
1641	return krb5_mk_error(context,
1642	error_code,
1643	NULL,
1644	NULL, /* e_data */
1645	NULL,
1646	server,
1647	NULL,
1648	NULL,
1649	reply);
1650	#endif
1651	}
1652
1653	/**********************************************************************
1654	* Open a krb5 keytab with flags, handles readonly or readwrite access and
1655	* allows to process non-default keytab names.
1656	* @param context krb5_context
1657	* @param keytab_name_req string
1658	* @param write_access bool if writable keytab is required
1659	* @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1660	* @return krb5_error_code
1661	**********************************************************************/
1662
1663	/* This MAX_NAME_LEN is a constant defined in krb5.h */
1664	#ifndef MAX_KEYTAB_NAME_LEN
1665	#define MAX_KEYTAB_NAME_LEN 1100
1666	#endif
1667
1668	krb5_error_code smb_krb5_open_keytab(krb5_context context,
1669	const char *keytab_name_req,
1670	bool write_access,
1671	krb5_keytab *keytab)
1672	{
1673	krb5_error_code ret = 0;
1674	TALLOC_CTX *mem_ctx;
1675	char keytab_string[MAX_KEYTAB_NAME_LEN];
1676	char *kt_str = NULL;
1677	bool found_valid_name = False;
1678	const char *pragma = "FILE";
1679	const char *tmp = NULL;
1680
1681	if (!write_access && !keytab_name_req) {
1682	/* caller just wants to read the default keytab readonly, so be it */
1683	return krb5_kt_default(context, keytab);
1684	}
1685
1686	mem_ctx = talloc_init("smb_krb5_open_keytab");
1687	if (!mem_ctx) {
1688	return ENOMEM;
1689	}
1690
1691	#ifdef HAVE_WRFILE_KEYTAB
1692	if (write_access) {
1693	pragma = "WRFILE";
1694	}
1695	#endif
1696
1697	if (keytab_name_req) {
1698
1699	if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1700	ret = KRB5_CONFIG_NOTENUFSPACE;
1701	goto out;
1702	}
1703
1704	if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) \|\|
1705	(strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1706	tmp = keytab_name_req;
1707	goto resolve;
1708	}
1709
1710	if (keytab_name_req[0] != '/') {
1711	ret = KRB5_KT_BADNAME;
1712	goto out;
1713	}
1714
1715	tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1716	if (!tmp) {
1717	ret = ENOMEM;
1718	goto out;
1719	}
1720
1721	goto resolve;
1722	}
1723
1724	/* we need to handle more complex keytab_strings, like:
1725	* "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1726
1727	ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1728	if (ret) {
1729	goto out;
1730	}
1731
1732	DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1733
1734	tmp = talloc_strdup(mem_ctx, keytab_string);
1735	if (!tmp) {
1736	ret = ENOMEM;
1737	goto out;
1738	}
1739
1740	if (strncmp(tmp, "ANY:", 4) == 0) {
1741	tmp += 4;
1742	}
1743
1744	memset(&keytab_string, '\0', sizeof(keytab_string));
1745
1746	while (next_token_talloc(mem_ctx, &tmp, &kt_str, ",")) {
1747	if (strncmp(kt_str, "WRFILE:", 7) == 0) {
1748	found_valid_name = True;
1749	tmp = kt_str;
1750	tmp += 7;
1751	}
1752
1753	if (strncmp(kt_str, "FILE:", 5) == 0) {
1754	found_valid_name = True;
1755	tmp = kt_str;
1756	tmp += 5;
1757	}
1758
1759	if (tmp[0] == '/') {
1760	/* Treat as a FILE: keytab definition. */
1761	found_valid_name = true;
1762	}
1763
1764	if (found_valid_name) {
1765	if (tmp[0] != '/') {
1766	ret = KRB5_KT_BADNAME;
1767	goto out;
1768	}
1769
1770	tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1771	if (!tmp) {
1772	ret = ENOMEM;
1773	goto out;
1774	}
1775	break;
1776	}
1777	}
1778
1779	if (!found_valid_name) {
1780	ret = KRB5_KT_UNKNOWN_TYPE;
1781	goto out;
1782	}
1783
1784	resolve:
1785	DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1786	ret = krb5_kt_resolve(context, tmp, keytab);
1787
1788	out:
1789	TALLOC_FREE(mem_ctx);
1790	return ret;
1791	}
1792
1793	krb5_error_code smb_krb5_keytab_name(TALLOC_CTX *mem_ctx,
1794	krb5_context context,
1795	krb5_keytab keytab,
1796	const char **keytab_name)
1797	{
1798	char keytab_string[MAX_KEYTAB_NAME_LEN];
1799	krb5_error_code ret = 0;
1800
1801	ret = krb5_kt_get_name(context, keytab,
1802	keytab_string, MAX_KEYTAB_NAME_LEN - 2);
1803	if (ret) {
1804	return ret;
1805	}
1806
1807	*keytab_name = talloc_strdup(mem_ctx, keytab_string);
1808	if (!*keytab_name) {
1809	return ENOMEM;
1810	}
1811
1812	return ret;
1813	}
1814
1815	#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
1816	/**************************************************************
1817	Routine: ads_krb5_get_fwd_ticket
1818	Description:
1819	When a service ticket is flagged as trusted
1820	for delegation we should provide a forwardable
1821	ticket so that the remote host can act on our
1822	behalf. This is done by taking the 2nd forwardable
1823	TGT and storing it in the GSS-API authenticator
1824	"checksum". This routine will populate
1825	the krb5_data authenticator with this TGT.
1826	Parameters:
1827	krb5_context context: The kerberos context for this authentication.
1828	krb5_auth_context: The authentication context.
1829	krb5_creds *credsp: The ticket credentials (AS-REP).
1830	krb5_ccache ccache: The credentials cache.
1831	krb5_data &authenticator: The checksum field that will store the TGT, and
1832	authenticator.data must be freed by the caller.
1833
1834	Returns:
1835	krb5_error_code: 0 if no errors, otherwise set.
1836	**************************************************************/
1837
1838	static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
1839	krb5_auth_context *auth_context,
1840	krb5_creds *credsp,
1841	krb5_ccache ccache,
1842	krb5_data *authenticator)
1843	{
1844	krb5_data fwdData;
1845	krb5_error_code retval = 0;
1846	char *pChksum = NULL;
1847	char *p = NULL;
1848
1849	/* MIT krb5 1.7beta3 (in Ubuntu Karmic) is missing the prototype,
1850	but still has the symbol */
1851	#if !HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE
1852	krb5_error_code krb5_auth_con_set_req_cksumtype(
1853	krb5_context context,
1854	krb5_auth_context auth_context,
1855	krb5_cksumtype cksumtype);
1856	#endif
1857
1858	ZERO_STRUCT(fwdData);
1859	ZERO_STRUCTP(authenticator);
1860
1861	retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
1862	auth_context, / Authentication context [in] */
1863	CONST_DISCARD(char , KRB5_TGS_NAME), / Ticket service name ("krbtgt") [in] */
1864	credsp->client, /* Client principal for the tgt [in] */
1865	credsp->server, /* Server principal for the tgt [in] */
1866	ccache, /* Credential cache to use for storage [in] */
1867	1, /* Turn on for "Forwardable ticket" [in] */
1868	&fwdData ); /* Resulting response [out] */
1869
1870
1871	if (retval) {
1872	DEBUG(1,("ads_krb5_get_fwd_ticket: krb5_fwd_tgt_creds failed (%s)\n",
1873	error_message(retval)));
1874	goto out;
1875	}
1876
1877	if ((unsigned int)GSSAPI_CHECKSUM_SIZE + (unsigned int)fwdData.length <
1878	(unsigned int)GSSAPI_CHECKSUM_SIZE) {
1879	retval = EINVAL;
1880	goto out;
1881	}
1882
1883	/* We're going to allocate a gssChecksum structure with a little
1884	extra data the length of the kerberos credentials length
1885	(APPLICATION 22) so that we can pack it on the end of the structure.
1886	*/
1887
1888	pChksum = (char *)SMB_MALLOC(GSSAPI_CHECKSUM_SIZE + fwdData.length );
1889	if (!pChksum) {
1890	retval = ENOMEM;
1891	goto out;
1892	}
1893
1894	p = pChksum;
1895
1896	SIVAL(p, 0, GSSAPI_BNDLENGTH);
1897	p += 4;
1898
1899	/* Zero out the bindings fields */
1900	memset(p, '\0', GSSAPI_BNDLENGTH );
1901	p += GSSAPI_BNDLENGTH;
1902
1903	SIVAL(p, 0, GSS_C_DELEG_FLAG );
1904	p += 4;
1905	SSVAL(p, 0, 1 );
1906	p += 2;
1907	SSVAL(p, 0, fwdData.length );
1908	p += 2;
1909
1910	/* Migrate the kerberos KRB_CRED data to the checksum delegation */
1911	memcpy(p, fwdData.data, fwdData.length );
1912	p += fwdData.length;
1913
1914	/* We need to do this in order to allow our GSS-API */
1915	retval = krb5_auth_con_set_req_cksumtype( context, *auth_context, GSSAPI_CHECKSUM );
1916	if (retval) {
1917	goto out;
1918	}
1919
1920	/* We now have a service ticket, now turn it into an AP-REQ. */
1921	authenticator->length = fwdData.length + GSSAPI_CHECKSUM_SIZE;
1922
1923	/* Caller should call free() when they're done with this. */
1924	authenticator->data = (char *)pChksum;
1925
1926	out:
1927
1928	/* Remove that input data, we never needed it anyway. */
1929	if (fwdData.length > 0) {
1930	krb5_free_data_contents( context, &fwdData );
1931	}
1932
1933	return retval;
1934	}
1935	#endif
1936
1937	/*
1938	* smb_krb5_principal_get_realm
1939	*
1940	* @brief Get realm of a principal
1941	*
1942	* @param[in] context The krb5_context
1943	* @param[in] principal The principal
1944	* @return pointer to the realm
1945	*
1946	*/
1947
1948	char *smb_krb5_principal_get_realm(krb5_context context,
1949	krb5_principal principal)
1950	{
1951	#ifdef HAVE_KRB5_PRINCIPAL_GET_REALM /* Heimdal */
1952	return krb5_principal_get_realm(context, principal);
1953	#elif defined(krb5_princ_realm) /* MIT */
1954	krb5_data *realm;
1955	realm = krb5_princ_realm(context, principal);
1956	return (char *)realm->data;
1957	#else
1958	return NULL;
1959	#endif
1960	}
1961
1962	#else /* HAVE_KRB5 */
1963	/* this saves a few linking headaches */
1964	int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1965	DATA_BLOB ticket, DATA_BLOB session_key_krb5, uint32 extra_ap_opts,
1966	const char ccname, time_t tgs_expire)
1967	{
1968	DEBUG(0,("NO KERBEROS SUPPORT\n"));
1969	return 1;
1970	}
1971
1972	#endif

Note: See TracBrowser for help on using the repository browser.

Download in other formats: