source: branches/samba-3.5.x/source4/heimdal/kdc/krb5tgs.c

Last change on this file was 414, checked in by Herwig Bauernfeind, 16 years ago

Samba 3.5.0: Initial import
File size: 51.3 KB
Line 
1/*
2 * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "kdc_locl.h"
35
36RCSID("$Id$");
37
38/*
39 * return the realm of a krbtgt-ticket or NULL
40 */
41
42static Realm
43get_krbtgt_realm(const PrincipalName *p)
44{
45 if(p->name_string.len == 2
46 && strcmp(p->name_string.val[0], KRB5_TGS_NAME) == 0)
47 return p->name_string.val[1];
48 else
49 return NULL;
50}
51
52/*
53 * The KDC might add a signed path to the ticket authorization data
54 * field. This is to avoid server impersonating clients and the
55 * request constrained delegation.
56 *
57 * This is done by storing a KRB5_AUTHDATA_IF_RELEVANT with a single
58 * entry of type KRB5SignedPath.
59 */
60
61static krb5_error_code
62find_KRB5SignedPath(krb5_context context,
63 const AuthorizationData *ad,
64 krb5_data *data)
65{
66 AuthorizationData child;
67 krb5_error_code ret;
68 int pos;
69
70 if (ad == NULL || ad->len == 0)
71 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
72
73 pos = ad->len - 1;
74
75 if (ad->val[pos].ad_type != KRB5_AUTHDATA_IF_RELEVANT)
76 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
77
78 ret = decode_AuthorizationData(ad->val[pos].ad_data.data,
79 ad->val[pos].ad_data.length,
80 &child,
81 NULL);
82 if (ret) {
83 krb5_set_error_message(context, ret, "Failed to decode "
84 "IF_RELEVANT with %d", ret);
85 return ret;
86 }
87
88 if (child.len != 1) {
89 free_AuthorizationData(&child);
90 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
91 }
92
93 if (child.val[0].ad_type != KRB5_AUTHDATA_SIGNTICKET) {
94 free_AuthorizationData(&child);
95 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
96 }
97
98 if (data)
99 ret = der_copy_octet_string(&child.val[0].ad_data, data);
100 free_AuthorizationData(&child);
101 return ret;
102}
103
104krb5_error_code
105_kdc_add_KRB5SignedPath(krb5_context context,
106 krb5_kdc_configuration *config,
107 hdb_entry_ex *krbtgt,
108 krb5_enctype enctype,
109 krb5_const_principal server,
110 krb5_principals principals,
111 EncTicketPart *tkt)
112{
113 krb5_error_code ret;
114 KRB5SignedPath sp;
115 krb5_data data;
116 krb5_crypto crypto = NULL;
117 size_t size;
118
119 if (server && principals) {
120 ret = add_Principals(principals, server);
121 if (ret)
122 return ret;
123 }
124
125 {
126 KRB5SignedPathData spd;
127
128 spd.encticket = *tkt;
129 spd.delegated = principals;
130
131 ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length,
132 &spd, &size, ret);
133 if (ret)
134 return ret;
135 if (data.length != size)
136 krb5_abortx(context, "internal asn.1 encoder error");
137 }
138
139 {
140 Key *key;
141 ret = hdb_enctype2key(context, &krbtgt->entry, enctype, &key);
142 if (ret == 0)
143 ret = krb5_crypto_init(context, &key->key, 0, &crypto);
144 if (ret) {
145 free(data.data);
146 return ret;
147 }
148 }
149
150 /*
151 * Fill in KRB5SignedPath
152 */
153
154 sp.etype = enctype;
155 sp.delegated = principals;
156
157 ret = krb5_create_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH, 0,
158 data.data, data.length, &sp.cksum);
159 krb5_crypto_destroy(context, crypto);
160 free(data.data);
161 if (ret)
162 return ret;
163
164 ASN1_MALLOC_ENCODE(KRB5SignedPath, data.data, data.length, &sp, &size, ret);
165 free_Checksum(&sp.cksum);
166 if (ret)
167 return ret;
168 if (data.length != size)
169 krb5_abortx(context, "internal asn.1 encoder error");
170
171
172 /*
173 * Add IF-RELEVANT(KRB5SignedPath) to the last slot in
174 * authorization data field.
175 */
176
177 ret = _kdc_tkt_add_if_relevant_ad(context, tkt,
178 KRB5_AUTHDATA_SIGNTICKET, &data);
179 krb5_data_free(&data);
180
181 return ret;
182}
183
184static krb5_error_code
185check_KRB5SignedPath(krb5_context context,
186 krb5_kdc_configuration *config,
187 hdb_entry_ex *krbtgt,
188 EncTicketPart *tkt,
189 krb5_principals *delegated,
190 int *signedpath)
191{
192 krb5_error_code ret;
193 krb5_data data;
194 krb5_crypto crypto = NULL;
195
196 if (delegated)
197 *delegated = NULL;
198
199 ret = find_KRB5SignedPath(context, tkt->authorization_data, &data);
200 if (ret == 0) {
201 KRB5SignedPathData spd;
202 KRB5SignedPath sp;
203 AuthorizationData *ad;
204 size_t size;
205
206 ret = decode_KRB5SignedPath(data.data, data.length, &sp, NULL);
207 krb5_data_free(&data);
208 if (ret)
209 return ret;
210
211 spd.encticket = *tkt;
212 /* the KRB5SignedPath is the last entry */
213 ad = spd.encticket.authorization_data;
214 if (--ad->len == 0)
215 spd.encticket.authorization_data = NULL;
216 spd.delegated = sp.delegated;
217
218 ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length,
219 &spd, &size, ret);
220 ad->len++;
221 spd.encticket.authorization_data = ad;
222 if (ret) {
223 free_KRB5SignedPath(&sp);
224 return ret;
225 }
226 if (data.length != size)
227 krb5_abortx(context, "internal asn.1 encoder error");
228
229 {
230 Key *key;
231 ret = hdb_enctype2key(context, &krbtgt->entry, sp.etype, &key);
232 if (ret == 0)
233 ret = krb5_crypto_init(context, &key->key, 0, &crypto);
234 if (ret) {
235 free(data.data);
236 free_KRB5SignedPath(&sp);
237 return ret;
238 }
239 }
240 ret = krb5_verify_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH,
241 data.data, data.length,
242 &sp.cksum);
243 krb5_crypto_destroy(context, crypto);
244 free(data.data);
245 if (ret) {
246 free_KRB5SignedPath(&sp);
247 return ret;
248 }
249
250 if (delegated && sp.delegated) {
251
252 *delegated = malloc(sizeof(*sp.delegated));
253 if (*delegated == NULL) {
254 free_KRB5SignedPath(&sp);
255 return ENOMEM;
256 }
257
258 ret = copy_Principals(*delegated, sp.delegated);
259 if (ret) {
260 free_KRB5SignedPath(&sp);
261 free(*delegated);
262 *delegated = NULL;
263 return ret;
264 }
265 }
266 free_KRB5SignedPath(&sp);
267
268 *signedpath = 1;
269 }
270
271 return 0;
272}
273
274/*
275 *
276 */
277
278static krb5_error_code
279check_PAC(krb5_context context,
280 krb5_kdc_configuration *config,
281 const krb5_principal client_principal,
282 hdb_entry_ex *client,
283 hdb_entry_ex *server,
284 const EncryptionKey *server_key,
285 const EncryptionKey *krbtgt_key,
286 EncTicketPart *tkt,
287 krb5_data *rspac,
288 int *signedpath)
289{
290 AuthorizationData *ad = tkt->authorization_data;
291 unsigned i, j;
292 krb5_error_code ret;
293
294 if (ad == NULL || ad->len == 0)
295 return 0;
296
297 for (i = 0; i < ad->len; i++) {
298 AuthorizationData child;
299
300 if (ad->val[i].ad_type != KRB5_AUTHDATA_IF_RELEVANT)
301 continue;
302
303 ret = decode_AuthorizationData(ad->val[i].ad_data.data,
304 ad->val[i].ad_data.length,
305 &child,
306 NULL);
307 if (ret) {
308 krb5_set_error_message(context, ret, "Failed to decode "
309 "IF_RELEVANT with %d", ret);
310 return ret;
311 }
312 for (j = 0; j < child.len; j++) {
313
314 if (child.val[j].ad_type == KRB5_AUTHDATA_WIN2K_PAC) {
315 krb5_pac pac;
316
317 /* Found PAC */
318 ret = krb5_pac_parse(context,
319 child.val[j].ad_data.data,
320 child.val[j].ad_data.length,
321 &pac);
322 free_AuthorizationData(&child);
323 if (ret)
324 return ret;
325
326 ret = krb5_pac_verify(context, pac, tkt->authtime,
327 client_principal,
328 krbtgt_key, NULL);
329 if (ret) {
330 krb5_pac_free(context, pac);
331 return ret;
332 }
333
334 ret = _kdc_pac_verify(context, client_principal,
335 client, server, &pac);
336 if (ret) {
337 krb5_pac_free(context, pac);
338 return ret;
339 }
340 *signedpath = 1;
341
342 ret = _krb5_pac_sign(context, pac, tkt->authtime,
343 client_principal,
344 server_key, krbtgt_key, rspac);
345
346 krb5_pac_free(context, pac);
347
348 return ret;
349 }
350 }
351 free_AuthorizationData(&child);
352 }
353 return 0;
354}
355
356/*
357 *
358 */
359
360static krb5_error_code
361check_tgs_flags(krb5_context context,
362 krb5_kdc_configuration *config,
363 KDC_REQ_BODY *b, const EncTicketPart *tgt, EncTicketPart *et)
364{
365 KDCOptions f = b->kdc_options;
366
367 if(f.validate){
368 if(!tgt->flags.invalid || tgt->starttime == NULL){
369 kdc_log(context, config, 0,
370 "Bad request to validate ticket");
371 return KRB5KDC_ERR_BADOPTION;
372 }
373 if(*tgt->starttime > kdc_time){
374 kdc_log(context, config, 0,
375 "Early request to validate ticket");
376 return KRB5KRB_AP_ERR_TKT_NYV;
377 }
378 /* XXX tkt = tgt */
379 et->flags.invalid = 0;
380 }else if(tgt->flags.invalid){
381 kdc_log(context, config, 0,
382 "Ticket-granting ticket has INVALID flag set");
383 return KRB5KRB_AP_ERR_TKT_INVALID;
384 }
385
386 if(f.forwardable){
387 if(!tgt->flags.forwardable){
388 kdc_log(context, config, 0,
389 "Bad request for forwardable ticket");
390 return KRB5KDC_ERR_BADOPTION;
391 }
392 et->flags.forwardable = 1;
393 }
394 if(f.forwarded){
395 if(!tgt->flags.forwardable){
396 kdc_log(context, config, 0,
397 "Request to forward non-forwardable ticket");
398 return KRB5KDC_ERR_BADOPTION;
399 }
400 et->flags.forwarded = 1;
401 et->caddr = b->addresses;
402 }
403 if(tgt->flags.forwarded)
404 et->flags.forwarded = 1;
405
406 if(f.proxiable){
407 if(!tgt->flags.proxiable){
408 kdc_log(context, config, 0,
409 "Bad request for proxiable ticket");
410 return KRB5KDC_ERR_BADOPTION;
411 }
412 et->flags.proxiable = 1;
413 }
414 if(f.proxy){
415 if(!tgt->flags.proxiable){
416 kdc_log(context, config, 0,
417 "Request to proxy non-proxiable ticket");
418 return KRB5KDC_ERR_BADOPTION;
419 }
420 et->flags.proxy = 1;
421 et->caddr = b->addresses;
422 }
423 if(tgt->flags.proxy)
424 et->flags.proxy = 1;
425
426 if(f.allow_postdate){
427 if(!tgt->flags.may_postdate){
428 kdc_log(context, config, 0,
429 "Bad request for post-datable ticket");
430 return KRB5KDC_ERR_BADOPTION;
431 }
432 et->flags.may_postdate = 1;
433 }
434 if(f.postdated){
435 if(!tgt->flags.may_postdate){
436 kdc_log(context, config, 0,
437 "Bad request for postdated ticket");
438 return KRB5KDC_ERR_BADOPTION;
439 }
440 if(b->from)
441 *et->starttime = *b->from;
442 et->flags.postdated = 1;
443 et->flags.invalid = 1;
444 }else if(b->from && *b->from > kdc_time + context->max_skew){
445 kdc_log(context, config, 0, "Ticket cannot be postdated");
446 return KRB5KDC_ERR_CANNOT_POSTDATE;
447 }
448
449 if(f.renewable){
450 if(!tgt->flags.renewable){
451 kdc_log(context, config, 0,
452 "Bad request for renewable ticket");
453 return KRB5KDC_ERR_BADOPTION;
454 }
455 et->flags.renewable = 1;
456 ALLOC(et->renew_till);
457 _kdc_fix_time(&b->rtime);
458 *et->renew_till = *b->rtime;
459 }
460 if(f.renew){
461 time_t old_life;
462 if(!tgt->flags.renewable || tgt->renew_till == NULL){
463 kdc_log(context, config, 0,
464 "Request to renew non-renewable ticket");
465 return KRB5KDC_ERR_BADOPTION;
466 }
467 old_life = tgt->endtime;
468 if(tgt->starttime)
469 old_life -= *tgt->starttime;
470 else
471 old_life -= tgt->authtime;
472 et->endtime = *et->starttime + old_life;
473 if (et->renew_till != NULL)
474 et->endtime = min(*et->renew_till, et->endtime);
475 }
476
477#if 0
478 /* checks for excess flags */
479 if(f.request_anonymous && !config->allow_anonymous){
480 kdc_log(context, config, 0,
481 "Request for anonymous ticket");
482 return KRB5KDC_ERR_BADOPTION;
483 }
484#endif
485 return 0;
486}
487
488/*
489 *
490 */
491
492static krb5_error_code
493check_constrained_delegation(krb5_context context,
494 krb5_kdc_configuration *config,
495 HDB *clientdb,
496 hdb_entry_ex *client,
497 krb5_const_principal server)
498{
499 const HDB_Ext_Constrained_delegation_acl *acl;
500 krb5_error_code ret;
501 int i;
502
503 /* if client delegates to itself, that ok */
504 if (krb5_principal_compare(context, client->entry.principal, server) == TRUE)
505 return 0;
506
507 if (clientdb->hdb_check_constrained_delegation) {
508 ret = clientdb->hdb_check_constrained_delegation(context, clientdb, client, server);
509 if (ret == 0)
510 return 0;
511 } else {
512 ret = hdb_entry_get_ConstrainedDelegACL(&client->entry, &acl);
513 if (ret) {
514 krb5_clear_error_message(context);
515 return ret;
516 }
517
518 if (acl) {
519 for (i = 0; i < acl->len; i++) {
520 if (krb5_principal_compare(context, server, &acl->val[i]) == TRUE)
521 return 0;
522 }
523 }
524 ret = KRB5KDC_ERR_BADOPTION;
525 }
526 kdc_log(context, config, 0,
527 "Bad request for constrained delegation");
528 return ret;
529}
530
531/*
532 *
533 */
534
535static krb5_error_code
536verify_flags (krb5_context context,
537 krb5_kdc_configuration *config,
538 const EncTicketPart *et,
539 const char *pstr)
540{
541 if(et->endtime < kdc_time){
542 kdc_log(context, config, 0, "Ticket expired (%s)", pstr);
543 return KRB5KRB_AP_ERR_TKT_EXPIRED;
544 }
545 if(et->flags.invalid){
546 kdc_log(context, config, 0, "Ticket not valid (%s)", pstr);
547 return KRB5KRB_AP_ERR_TKT_NYV;
548 }
549 return 0;
550}
551
552/*
553 *
554 */
555
556static krb5_error_code
557fix_transited_encoding(krb5_context context,
558 krb5_kdc_configuration *config,
559 krb5_boolean check_policy,
560 const TransitedEncoding *tr,
561 EncTicketPart *et,
562 const char *client_realm,
563 const char *server_realm,
564 const char *tgt_realm)
565{
566 krb5_error_code ret = 0;
567 char **realms, **tmp;
568 unsigned int num_realms;
569 int i;
570
571 switch (tr->tr_type) {
572 case DOMAIN_X500_COMPRESS:
573 break;
574 case 0:
575 /*
576 * Allow empty content of type 0 because that is was Microsoft
577 * generates in their TGT.
578 */
579 if (tr->contents.length == 0)
580 break;
581 kdc_log(context, config, 0,
582 "Transited type 0 with non empty content");
583 return KRB5KDC_ERR_TRTYPE_NOSUPP;
584 default:
585 kdc_log(context, config, 0,
586 "Unknown transited type: %u", tr->tr_type);
587 return KRB5KDC_ERR_TRTYPE_NOSUPP;
588 }
589
590 ret = krb5_domain_x500_decode(context,
591 tr->contents,
592 &realms,
593 &num_realms,
594 client_realm,
595 server_realm);
596 if(ret){
597 krb5_warn(context, ret,
598 "Decoding transited encoding");
599 return ret;
600 }
601 if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) {
602 /* not us, so add the previous realm to transited set */
603 if (num_realms + 1 > UINT_MAX/sizeof(*realms)) {
604 ret = ERANGE;
605 goto free_realms;
606 }
607 tmp = realloc(realms, (num_realms + 1) * sizeof(*realms));
608 if(tmp == NULL){
609 ret = ENOMEM;
610 goto free_realms;
611 }
612 realms = tmp;
613 realms[num_realms] = strdup(tgt_realm);
614 if(realms[num_realms] == NULL){
615 ret = ENOMEM;
616 goto free_realms;
617 }
618 num_realms++;
619 }
620 if(num_realms == 0) {
621 if(strcmp(client_realm, server_realm))
622 kdc_log(context, config, 0,
623 "cross-realm %s -> %s", client_realm, server_realm);
624 } else {
625 size_t l = 0;
626 char *rs;
627 for(i = 0; i < num_realms; i++)
628 l += strlen(realms[i]) + 2;
629 rs = malloc(l);
630 if(rs != NULL) {
631 *rs = '\0';
632 for(i = 0; i < num_realms; i++) {
633 if(i > 0)
634 strlcat(rs, ", ", l);
635 strlcat(rs, realms[i], l);
636 }
637 kdc_log(context, config, 0,
638 "cross-realm %s -> %s via [%s]",
639 client_realm, server_realm, rs);
640 free(rs);
641 }
642 }
643 if(check_policy) {
644 ret = krb5_check_transited(context, client_realm,
645 server_realm,
646 realms, num_realms, NULL);
647 if(ret) {
648 krb5_warn(context, ret, "cross-realm %s -> %s",
649 client_realm, server_realm);
650 goto free_realms;
651 }
652 et->flags.transited_policy_checked = 1;
653 }
654 et->transited.tr_type = DOMAIN_X500_COMPRESS;
655 ret = krb5_domain_x500_encode(realms, num_realms, &et->transited.contents);
656 if(ret)
657 krb5_warn(context, ret, "Encoding transited encoding");
658 free_realms:
659 for(i = 0; i < num_realms; i++)
660 free(realms[i]);
661 free(realms);
662 return ret;
663}
664
665
666static krb5_error_code
667tgs_make_reply(krb5_context context,
668 krb5_kdc_configuration *config,
669 KDC_REQ_BODY *b,
670 krb5_const_principal tgt_name,
671 const EncTicketPart *tgt,
672 const EncryptionKey *serverkey,
673 const krb5_keyblock *sessionkey,
674 krb5_kvno kvno,
675 AuthorizationData *auth_data,
676 hdb_entry_ex *server,
677 krb5_principal server_principal,
678 const char *server_name,
679 hdb_entry_ex *client,
680 krb5_principal client_principal,
681 hdb_entry_ex *krbtgt,
682 krb5_enctype krbtgt_etype,
683 krb5_principals spp,
684 const krb5_data *rspac,
685 const METHOD_DATA *enc_pa_data,
686 const char **e_text,
687 krb5_data *reply)
688{
689 KDC_REP rep;
690 EncKDCRepPart ek;
691 EncTicketPart et;
692 KDCOptions f = b->kdc_options;
693 krb5_error_code ret;
694 int is_weak = 0;
695
696 memset(&rep, 0, sizeof(rep));
697 memset(&et, 0, sizeof(et));
698 memset(&ek, 0, sizeof(ek));
699
700 rep.pvno = 5;
701 rep.msg_type = krb_tgs_rep;
702
703 et.authtime = tgt->authtime;
704 _kdc_fix_time(&b->till);
705 et.endtime = min(tgt->endtime, *b->till);
706 ALLOC(et.starttime);
707 *et.starttime = kdc_time;
708
709 ret = check_tgs_flags(context, config, b, tgt, &et);
710 if(ret)
711 goto out;
712
713 /* We should check the transited encoding if:
714 1) the request doesn't ask not to be checked
715 2) globally enforcing a check
716 3) principal requires checking
717 4) we allow non-check per-principal, but principal isn't marked as allowing this
718 5) we don't globally allow this
719 */
720
721#define GLOBAL_FORCE_TRANSITED_CHECK \
722 (config->trpolicy == TRPOLICY_ALWAYS_CHECK)
723#define GLOBAL_ALLOW_PER_PRINCIPAL \
724 (config->trpolicy == TRPOLICY_ALLOW_PER_PRINCIPAL)
725#define GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK \
726 (config->trpolicy == TRPOLICY_ALWAYS_HONOUR_REQUEST)
727
728/* these will consult the database in future release */
729#define PRINCIPAL_FORCE_TRANSITED_CHECK(P) 0
730#define PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(P) 0
731
732 ret = fix_transited_encoding(context, config,
733 !f.disable_transited_check ||
734 GLOBAL_FORCE_TRANSITED_CHECK ||
735 PRINCIPAL_FORCE_TRANSITED_CHECK(server) ||
736 !((GLOBAL_ALLOW_PER_PRINCIPAL &&
737 PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(server)) ||
738 GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK),
739 &tgt->transited, &et,
740 krb5_principal_get_realm(context, client_principal),
741 krb5_principal_get_realm(context, server->entry.principal),
742 krb5_principal_get_realm(context, krbtgt->entry.principal));
743 if(ret)
744 goto out;
745
746 copy_Realm(&server_principal->realm, &rep.ticket.realm);
747 _krb5_principal2principalname(&rep.ticket.sname, server_principal);
748 copy_Realm(&tgt_name->realm, &rep.crealm);
749/*
750 if (f.request_anonymous)
751 _kdc_make_anonymous_principalname (&rep.cname);
752 else */
753
754 copy_PrincipalName(&tgt_name->name, &rep.cname);
755 rep.ticket.tkt_vno = 5;
756
757 ek.caddr = et.caddr;
758 if(et.caddr == NULL)
759 et.caddr = tgt->caddr;
760
761 {
762 time_t life;
763 life = et.endtime - *et.starttime;
764 if(client && client->entry.max_life)
765 life = min(life, *client->entry.max_life);
766 if(server->entry.max_life)
767 life = min(life, *server->entry.max_life);
768 et.endtime = *et.starttime + life;
769 }
770 if(f.renewable_ok && tgt->flags.renewable &&
771 et.renew_till == NULL && et.endtime < *b->till){
772 et.flags.renewable = 1;
773 ALLOC(et.renew_till);
774 *et.renew_till = *b->till;
775 }
776 if(et.renew_till){
777 time_t renew;
778 renew = *et.renew_till - et.authtime;
779 if(client && client->entry.max_renew)
780 renew = min(renew, *client->entry.max_renew);
781 if(server->entry.max_renew)
782 renew = min(renew, *server->entry.max_renew);
783 *et.renew_till = et.authtime + renew;
784 }
785
786 if(et.renew_till){
787 *et.renew_till = min(*et.renew_till, *tgt->renew_till);
788 *et.starttime = min(*et.starttime, *et.renew_till);
789 et.endtime = min(et.endtime, *et.renew_till);
790 }
791
792 *et.starttime = min(*et.starttime, et.endtime);
793
794 if(*et.starttime == et.endtime){
795 ret = KRB5KDC_ERR_NEVER_VALID;
796 goto out;
797 }
798 if(et.renew_till && et.endtime == *et.renew_till){
799 free(et.renew_till);
800 et.renew_till = NULL;
801 et.flags.renewable = 0;
802 }
803
804 et.flags.pre_authent = tgt->flags.pre_authent;
805 et.flags.hw_authent = tgt->flags.hw_authent;
806 et.flags.anonymous = tgt->flags.anonymous;
807 et.flags.ok_as_delegate = server->entry.flags.ok_as_delegate;
808
809 if(rspac->length) {
810 /*
811 * No not need to filter out the any PAC from the
812 * auth_data since it's signed by the KDC.
813 */
814 ret = _kdc_tkt_add_if_relevant_ad(context, &et,
815 KRB5_AUTHDATA_WIN2K_PAC, rspac);
816 if (ret)
817 goto out;
818 }
819
820 if (auth_data) {
821 unsigned int i = 0;
822
823 /* XXX check authdata */
824 if (et.authorization_data == NULL) {
825 ret = ENOMEM;
826 krb5_set_error_message(context, ret, "malloc: out of memory");
827 goto out;
828 }
829 for(i = 0; i < auth_data->len ; i++) {
830 ret = add_AuthorizationData(et.authorization_data, &auth_data->val[i]);
831 if (ret) {
832 krb5_set_error_message(context, ret, "malloc: out of memory");
833 goto out;
834 }
835 }
836
837 /* Filter out type KRB5SignedPath */
838 ret = find_KRB5SignedPath(context, et.authorization_data, NULL);
839 if (ret == 0) {
840 if (et.authorization_data->len == 1) {
841 free_AuthorizationData(et.authorization_data);
842 free(et.authorization_data);
843 et.authorization_data = NULL;
844 } else {
845 AuthorizationData *ad = et.authorization_data;
846 free_AuthorizationDataElement(&ad->val[ad->len - 1]);
847 ad->len--;
848 }
849 }
850 }
851
852 ret = krb5_copy_keyblock_contents(context, sessionkey, &et.key);
853 if (ret)
854 goto out;
855 et.crealm = tgt->crealm;
856 et.cname = tgt_name->name;
857
858 ek.key = et.key;
859 /* MIT must have at least one last_req */
860 ek.last_req.len = 1;
861 ek.last_req.val = calloc(1, sizeof(*ek.last_req.val));
862 if (ek.last_req.val == NULL) {
863 ret = ENOMEM;
864 goto out;
865 }
866 ek.nonce = b->nonce;
867 ek.flags = et.flags;
868 ek.authtime = et.authtime;
869 ek.starttime = et.starttime;
870 ek.endtime = et.endtime;
871 ek.renew_till = et.renew_till;
872 ek.srealm = rep.ticket.realm;
873 ek.sname = rep.ticket.sname;
874
875 _kdc_log_timestamp(context, config, "TGS-REQ", et.authtime, et.starttime,
876 et.endtime, et.renew_till);
877
878 /* Don't sign cross realm tickets, they can't be checked anyway */
879 {
880 char *r = get_krbtgt_realm(&ek.sname);
881
882 if (r == NULL || strcmp(r, ek.srealm) == 0) {
883 ret = _kdc_add_KRB5SignedPath(context,
884 config,
885 krbtgt,
886 krbtgt_etype,
887 NULL,
888 spp,
889 &et);
890 if (ret)
891 goto out;
892 }
893 }
894
895 if (enc_pa_data->len) {
896 rep.padata = calloc(1, sizeof(*rep.padata));
897 if (rep.padata == NULL) {
898 ret = ENOMEM;
899 goto out;
900 }
901 ret = copy_METHOD_DATA(enc_pa_data, rep.padata);
902 if (ret)
903 goto out;
904 }
905
906 if (krb5_enctype_valid(context, et.key.keytype) != 0
907 && _kdc_is_weak_exception(server->entry.principal, et.key.keytype))
908 {
909 krb5_enctype_enable(context, et.key.keytype);
910 is_weak = 1;
911 }
912
913
914 /* It is somewhat unclear where the etype in the following
915 encryption should come from. What we have is a session
916 key in the passed tgt, and a list of preferred etypes
917 *for the new ticket*. Should we pick the best possible
918 etype, given the keytype in the tgt, or should we look
919 at the etype list here as well? What if the tgt
920 session key is DES3 and we want a ticket with a (say)
921 CAST session key. Should the DES3 etype be added to the
922 etype list, even if we don't want a session key with
923 DES3? */
924 ret = _kdc_encode_reply(context, config,
925 &rep, &et, &ek, et.key.keytype,
926 kvno,
927 serverkey, 0, &tgt->key, e_text, reply);
928 if (is_weak)
929 krb5_enctype_disable(context, et.key.keytype);
930
931out:
932 free_TGS_REP(&rep);
933 free_TransitedEncoding(&et.transited);
934 if(et.starttime)
935 free(et.starttime);
936 if(et.renew_till)
937 free(et.renew_till);
938 if(et.authorization_data) {
939 free_AuthorizationData(et.authorization_data);
940 free(et.authorization_data);
941 }
942 free_LastReq(&ek.last_req);
943 memset(et.key.keyvalue.data, 0, et.key.keyvalue.length);
944 free_EncryptionKey(&et.key);
945 return ret;
946}
947
948static krb5_error_code
949tgs_check_authenticator(krb5_context context,
950 krb5_kdc_configuration *config,
951 krb5_auth_context ac,
952 KDC_REQ_BODY *b,
953 const char **e_text,
954 krb5_keyblock *key)
955{
956 krb5_authenticator auth;
957 size_t len;
958 unsigned char *buf;
959 size_t buf_size;
960 krb5_error_code ret;
961 krb5_crypto crypto;
962
963 krb5_auth_con_getauthenticator(context, ac, &auth);
964 if(auth->cksum == NULL){
965 kdc_log(context, config, 0, "No authenticator in request");
966 ret = KRB5KRB_AP_ERR_INAPP_CKSUM;
967 goto out;
968 }
969 /*
970 * according to RFC1510 it doesn't need to be keyed,
971 * but according to the latest draft it needs to.
972 */
973 if (
974#if 0
975!krb5_checksum_is_keyed(context, auth->cksum->cksumtype)
976 ||
977#endif
978 !krb5_checksum_is_collision_proof(context, auth->cksum->cksumtype)) {
979 kdc_log(context, config, 0, "Bad checksum type in authenticator: %d",
980 auth->cksum->cksumtype);
981 ret = KRB5KRB_AP_ERR_INAPP_CKSUM;
982 goto out;
983 }
984
985 /* XXX should not re-encode this */
986 ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, b, &len, ret);
987 if(ret){
988 kdc_log(context, config, 0, "Failed to encode KDC-REQ-BODY: %s",
989 krb5_get_err_text(context, ret));
990 goto out;
991 }
992 if(buf_size != len) {
993 free(buf);
994 kdc_log(context, config, 0, "Internal error in ASN.1 encoder");
995 *e_text = "KDC internal error";
996 ret = KRB5KRB_ERR_GENERIC;
997 goto out;
998 }
999 ret = krb5_crypto_init(context, key, 0, &crypto);
1000 if (ret) {
1001 free(buf);
1002 kdc_log(context, config, 0, "krb5_crypto_init failed: %s",
1003 krb5_get_err_text(context, ret));
1004 goto out;
1005 }
1006 ret = krb5_verify_checksum(context,
1007 crypto,
1008 KRB5_KU_TGS_REQ_AUTH_CKSUM,
1009 buf,
1010 len,
1011 auth->cksum);
1012 free(buf);
1013 krb5_crypto_destroy(context, crypto);
1014 if(ret){
1015 kdc_log(context, config, 0,
1016 "Failed to verify authenticator checksum: %s",
1017 krb5_get_err_text(context, ret));
1018 }
1019out:
1020 free_Authenticator(auth);
1021 free(auth);
1022 return ret;
1023}
1024
1025/*
1026 *
1027 */
1028
1029static const char *
1030find_rpath(krb5_context context, Realm crealm, Realm srealm)
1031{
1032 const char *new_realm = krb5_config_get_string(context,
1033 NULL,
1034 "capaths",
1035 crealm,
1036 srealm,
1037 NULL);
1038 return new_realm;
1039}
1040
1041
1042static krb5_boolean
1043need_referral(krb5_context context, krb5_kdc_configuration *config,
1044 const KDCOptions * const options, krb5_principal server,
1045 krb5_realm **realms)
1046{
1047 const char *name;
1048
1049 if(!options->canonicalize && server->name.name_type != KRB5_NT_SRV_INST)
1050 return FALSE;
1051
1052 if (server->name.name_string.len == 1)
1053 name = server->name.name_string.val[0];
1054 else if (server->name.name_string.len > 1)
1055 name = server->name.name_string.val[1];
1056 else
1057 return FALSE;
1058
1059 kdc_log(context, config, 0, "Searching referral for %s", name);
1060
1061 return _krb5_get_host_realm_int(context, name, FALSE, realms) == 0;
1062}
1063
1064static krb5_error_code
1065tgs_parse_request(krb5_context context,
1066 krb5_kdc_configuration *config,
1067 KDC_REQ_BODY *b,
1068 const PA_DATA *tgs_req,
1069 hdb_entry_ex **krbtgt,
1070 krb5_enctype *krbtgt_etype,
1071 krb5_ticket **ticket,
1072 const char **e_text,
1073 const char *from,
1074 const struct sockaddr *from_addr,
1075 time_t **csec,
1076 int **cusec,
1077 AuthorizationData **auth_data)
1078{
1079 krb5_ap_req ap_req;
1080 krb5_error_code ret;
1081 krb5_principal princ;
1082 krb5_auth_context ac = NULL;
1083 krb5_flags ap_req_options;
1084 krb5_flags verify_ap_req_flags;
1085 krb5_crypto crypto;
1086 Key *tkey;
1087
1088 *auth_data = NULL;
1089 *csec = NULL;
1090 *cusec = NULL;
1091
1092 memset(&ap_req, 0, sizeof(ap_req));
1093 ret = krb5_decode_ap_req(context, &tgs_req->padata_value, &ap_req);
1094 if(ret){
1095 kdc_log(context, config, 0, "Failed to decode AP-REQ: %s",
1096 krb5_get_err_text(context, ret));
1097 goto out;
1098 }
1099
1100 if(!get_krbtgt_realm(&ap_req.ticket.sname)){
1101 /* XXX check for ticket.sname == req.sname */
1102 kdc_log(context, config, 0, "PA-DATA is not a ticket-granting ticket");
1103 ret = KRB5KDC_ERR_POLICY; /* ? */
1104 goto out;
1105 }
1106
1107 _krb5_principalname2krb5_principal(context,
1108 &princ,
1109 ap_req.ticket.sname,
1110 ap_req.ticket.realm);
1111
1112 ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT, NULL, krbtgt);
1113
1114 if(ret) {
1115 char *p;
1116 ret = krb5_unparse_name(context, princ, &p);
1117 if (ret != 0)
1118 p = "<unparse_name failed>";
1119 krb5_free_principal(context, princ);
1120 kdc_log(context, config, 0,
1121 "Ticket-granting ticket not found in database: %s: %s",
1122 p, krb5_get_err_text(context, ret));
1123 if (ret == 0)
1124 free(p);
1125 ret = KRB5KRB_AP_ERR_NOT_US;
1126 goto out;
1127 }
1128
1129 if(ap_req.ticket.enc_part.kvno &&
1130 *ap_req.ticket.enc_part.kvno != (*krbtgt)->entry.kvno){
1131 char *p;
1132
1133 ret = krb5_unparse_name (context, princ, &p);
1134 krb5_free_principal(context, princ);
1135 if (ret != 0)
1136 p = "<unparse_name failed>";
1137 kdc_log(context, config, 0,
1138 "Ticket kvno = %d, DB kvno = %d (%s)",
1139 *ap_req.ticket.enc_part.kvno,
1140 (*krbtgt)->entry.kvno,
1141 p);
1142 if (ret == 0)
1143 free (p);
1144 ret = KRB5KRB_AP_ERR_BADKEYVER;
1145 goto out;
1146 }
1147
1148 *krbtgt_etype = ap_req.ticket.enc_part.etype;
1149
1150 ret = hdb_enctype2key(context, &(*krbtgt)->entry,
1151 ap_req.ticket.enc_part.etype, &tkey);
1152 if(ret){
1153 char *str = NULL, *p = NULL;
1154
1155 krb5_enctype_to_string(context, ap_req.ticket.enc_part.etype, &str);
1156 krb5_unparse_name(context, princ, &p);
1157 kdc_log(context, config, 0,
1158 "No server key with enctype %s found for %s",
1159 str ? str : "<unknown enctype>",
1160 p ? p : "<unparse_name failed>");
1161 free(str);
1162 free(p);
1163 ret = KRB5KRB_AP_ERR_BADKEYVER;
1164 goto out;
1165 }
1166
1167 if (b->kdc_options.validate)
1168 verify_ap_req_flags = KRB5_VERIFY_AP_REQ_IGNORE_INVALID;
1169 else
1170 verify_ap_req_flags = 0;
1171
1172 ret = krb5_verify_ap_req2(context,
1173 &ac,
1174 &ap_req,
1175 princ,
1176 &tkey->key,
1177 verify_ap_req_flags,
1178 &ap_req_options,
1179 ticket,
1180 KRB5_KU_TGS_REQ_AUTH);
1181
1182 krb5_free_principal(context, princ);
1183 if(ret) {
1184 kdc_log(context, config, 0, "Failed to verify AP-REQ: %s",
1185 krb5_get_err_text(context, ret));
1186 goto out;
1187 }
1188
1189 {
1190 krb5_authenticator auth;
1191
1192 ret = krb5_auth_con_getauthenticator(context, ac, &auth);
1193 if (ret == 0) {
1194 *csec = malloc(sizeof(**csec));
1195 if (*csec == NULL) {
1196 krb5_free_authenticator(context, &auth);
1197 kdc_log(context, config, 0, "malloc failed");
1198 goto out;
1199 }
1200 **csec = auth->ctime;
1201 *cusec = malloc(sizeof(**cusec));
1202 if (*cusec == NULL) {
1203 krb5_free_authenticator(context, &auth);
1204 kdc_log(context, config, 0, "malloc failed");
1205 goto out;
1206 }
1207 **cusec = auth->cusec;
1208 krb5_free_authenticator(context, &auth);
1209 }
1210 }
1211
1212 ret = tgs_check_authenticator(context, config,
1213 ac, b, e_text, &(*ticket)->ticket.key);
1214 if (ret) {
1215 krb5_auth_con_free(context, ac);
1216 goto out;
1217 }
1218
1219 if (b->enc_authorization_data) {
1220 unsigned usage = KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY;
1221 krb5_keyblock *subkey;
1222 krb5_data ad;
1223
1224 ret = krb5_auth_con_getremotesubkey(context, ac, &subkey);
1225 if(ret){
1226 krb5_auth_con_free(context, ac);
1227 kdc_log(context, config, 0, "Failed to get remote subkey: %s",
1228 krb5_get_err_text(context, ret));
1229 goto out;
1230 }
1231 if(subkey == NULL){
1232 usage = KRB5_KU_TGS_REQ_AUTH_DAT_SESSION;
1233 ret = krb5_auth_con_getkey(context, ac, &subkey);
1234 if(ret) {
1235 krb5_auth_con_free(context, ac);
1236 kdc_log(context, config, 0, "Failed to get session key: %s",
1237 krb5_get_err_text(context, ret));
1238 goto out;
1239 }
1240 }
1241 if(subkey == NULL){
1242 krb5_auth_con_free(context, ac);
1243 kdc_log(context, config, 0,
1244 "Failed to get key for enc-authorization-data");
1245 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1246 goto out;
1247 }
1248 ret = krb5_crypto_init(context, subkey, 0, &crypto);
1249 krb5_free_keyblock(context, subkey);
1250 if (ret) {
1251 krb5_auth_con_free(context, ac);
1252 kdc_log(context, config, 0, "krb5_crypto_init failed: %s",
1253 krb5_get_err_text(context, ret));
1254 goto out;
1255 }
1256 ret = krb5_decrypt_EncryptedData (context,
1257 crypto,
1258 usage,
1259 b->enc_authorization_data,
1260 &ad);
1261 krb5_crypto_destroy(context, crypto);
1262 if(ret){
1263 krb5_auth_con_free(context, ac);
1264 kdc_log(context, config, 0,
1265 "Failed to decrypt enc-authorization-data");
1266 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1267 goto out;
1268 }
1269 ALLOC(*auth_data);
1270 if (*auth_data == NULL) {
1271 krb5_auth_con_free(context, ac);
1272 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1273 goto out;
1274 }
1275 ret = decode_AuthorizationData(ad.data, ad.length, *auth_data, NULL);
1276 if(ret){
1277 krb5_auth_con_free(context, ac);
1278 free(*auth_data);
1279 *auth_data = NULL;
1280 kdc_log(context, config, 0, "Failed to decode authorization data");
1281 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1282 goto out;
1283 }
1284 }
1285
1286 krb5_auth_con_free(context, ac);
1287
1288out:
1289 free_AP_REQ(&ap_req);
1290
1291 return ret;
1292}
1293
1294static krb5_error_code
1295build_server_referral(krb5_context context,
1296 krb5_kdc_configuration *config,
1297 krb5_crypto session,
1298 krb5_const_realm referred_realm,
1299 const PrincipalName *true_principal_name,
1300 const PrincipalName *requested_principal,
1301 krb5_data *outdata)
1302{
1303 PA_ServerReferralData ref;
1304 krb5_error_code ret;
1305 EncryptedData ed;
1306 krb5_data data;
1307 size_t size;
1308
1309 memset(&ref, 0, sizeof(ref));
1310
1311 if (referred_realm) {
1312 ALLOC(ref.referred_realm);
1313 if (ref.referred_realm == NULL)
1314 goto eout;
1315 *ref.referred_realm = strdup(referred_realm);
1316 if (*ref.referred_realm == NULL)
1317 goto eout;
1318 }
1319 if (true_principal_name) {
1320 ALLOC(ref.true_principal_name);
1321 if (ref.true_principal_name == NULL)
1322 goto eout;
1323 ret = copy_PrincipalName(true_principal_name, ref.true_principal_name);
1324 if (ret)
1325 goto eout;
1326 }
1327 if (requested_principal) {
1328 ALLOC(ref.requested_principal_name);
1329 if (ref.requested_principal_name == NULL)
1330 goto eout;
1331 ret = copy_PrincipalName(requested_principal,
1332 ref.requested_principal_name);
1333 if (ret)
1334 goto eout;
1335 }
1336
1337 ASN1_MALLOC_ENCODE(PA_ServerReferralData,
1338 data.data, data.length,
1339 &ref, &size, ret);
1340 free_PA_ServerReferralData(&ref);
1341 if (ret)
1342 return ret;
1343 if (data.length != size)
1344 krb5_abortx(context, "internal asn.1 encoder error");
1345
1346 ret = krb5_encrypt_EncryptedData(context, session,
1347 KRB5_KU_PA_SERVER_REFERRAL,
1348 data.data, data.length,
1349 0 /* kvno */, &ed);
1350 free(data.data);
1351 if (ret)
1352 return ret;
1353
1354 ASN1_MALLOC_ENCODE(EncryptedData,
1355 outdata->data, outdata->length,
1356 &ed, &size, ret);
1357 free_EncryptedData(&ed);
1358 if (ret)
1359 return ret;
1360 if (outdata->length != size)
1361 krb5_abortx(context, "internal asn.1 encoder error");
1362
1363 return 0;
1364eout:
1365 free_PA_ServerReferralData(&ref);
1366 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1367 return ENOMEM;
1368}
1369
1370static krb5_error_code
1371tgs_build_reply(krb5_context context,
1372 krb5_kdc_configuration *config,
1373 KDC_REQ *req,
1374 KDC_REQ_BODY *b,
1375 hdb_entry_ex *krbtgt,
1376 krb5_enctype krbtgt_etype,
1377 krb5_ticket *ticket,
1378 krb5_data *reply,
1379 const char *from,
1380 const char **e_text,
1381 AuthorizationData **auth_data,
1382 const struct sockaddr *from_addr)
1383{
1384 krb5_error_code ret;
1385 krb5_principal cp = NULL, sp = NULL;
1386 krb5_principal client_principal = NULL;
1387 char *spn = NULL, *cpn = NULL;
1388 hdb_entry_ex *server = NULL, *client = NULL;
1389 HDB *clientdb;
1390 krb5_realm ref_realm = NULL;
1391 EncTicketPart *tgt = &ticket->ticket;
1392 krb5_principals spp = NULL;
1393 const EncryptionKey *ekey;
1394 krb5_keyblock sessionkey;
1395 krb5_kvno kvno;
1396 krb5_data rspac;
1397
1398 METHOD_DATA enc_pa_data;
1399
1400 PrincipalName *s;
1401 Realm r;
1402 int nloop = 0;
1403 EncTicketPart adtkt;
1404 char opt_str[128];
1405 int signedpath = 0;
1406
1407 Key *tkey;
1408
1409 memset(&sessionkey, 0, sizeof(sessionkey));
1410 memset(&adtkt, 0, sizeof(adtkt));
1411 krb5_data_zero(&rspac);
1412 memset(&enc_pa_data, 0, sizeof(enc_pa_data));
1413
1414 s = b->sname;
1415 r = b->realm;
1416
1417 if(b->kdc_options.enc_tkt_in_skey){
1418 Ticket *t;
1419 hdb_entry_ex *uu;
1420 krb5_principal p;
1421 Key *uukey;
1422
1423 if(b->additional_tickets == NULL ||
1424 b->additional_tickets->len == 0){
1425 ret = KRB5KDC_ERR_BADOPTION; /* ? */
1426 kdc_log(context, config, 0,
1427 "No second ticket present in request");
1428 goto out;
1429 }
1430 t = &b->additional_tickets->val[0];
1431 if(!get_krbtgt_realm(&t->sname)){
1432 kdc_log(context, config, 0,
1433 "Additional ticket is not a ticket-granting ticket");
1434 ret = KRB5KDC_ERR_POLICY;
1435 goto out;
1436 }
1437 _krb5_principalname2krb5_principal(context, &p, t->sname, t->realm);
1438 ret = _kdc_db_fetch(context, config, p,
1439 HDB_F_GET_CLIENT|HDB_F_GET_SERVER,
1440 NULL, &uu);
1441 krb5_free_principal(context, p);
1442 if(ret){
1443 if (ret == HDB_ERR_NOENTRY)
1444 ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1445 goto out;
1446 }
1447 ret = hdb_enctype2key(context, &uu->entry,
1448 t->enc_part.etype, &uukey);
1449 if(ret){
1450 _kdc_free_ent(context, uu);
1451 ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
1452 goto out;
1453 }
1454 ret = krb5_decrypt_ticket(context, t, &uukey->key, &adtkt, 0);
1455 _kdc_free_ent(context, uu);
1456 if(ret)
1457 goto out;
1458
1459 ret = verify_flags(context, config, &adtkt, spn);
1460 if (ret)
1461 goto out;
1462
1463 s = &adtkt.cname;
1464 r = adtkt.crealm;
1465 }
1466
1467 _krb5_principalname2krb5_principal(context, &sp, *s, r);
1468 ret = krb5_unparse_name(context, sp, &spn);
1469 if (ret)
1470 goto out;
1471 _krb5_principalname2krb5_principal(context, &cp, tgt->cname, tgt->crealm);
1472 ret = krb5_unparse_name(context, cp, &cpn);
1473 if (ret)
1474 goto out;
1475 unparse_flags (KDCOptions2int(b->kdc_options),
1476 asn1_KDCOptions_units(),
1477 opt_str, sizeof(opt_str));
1478 if(*opt_str)
1479 kdc_log(context, config, 0,
1480 "TGS-REQ %s from %s for %s [%s]",
1481 cpn, from, spn, opt_str);
1482 else
1483 kdc_log(context, config, 0,
1484 "TGS-REQ %s from %s for %s", cpn, from, spn);
1485
1486 /*
1487 * Fetch server
1488 */
1489
1490server_lookup:
1491 ret = _kdc_db_fetch(context, config, sp, HDB_F_GET_SERVER | HDB_F_CANON,
1492 NULL, &server);
1493
1494 if(ret){
1495 const char *new_rlm;
1496 Realm req_rlm;
1497 krb5_realm *realms;
1498
1499 if ((req_rlm = get_krbtgt_realm(&sp->name)) != NULL) {
1500 if(nloop++ < 2) {
1501 new_rlm = find_rpath(context, tgt->crealm, req_rlm);
1502 if(new_rlm) {
1503 kdc_log(context, config, 5, "krbtgt for realm %s "
1504 "not found, trying %s",
1505 req_rlm, new_rlm);
1506 krb5_free_principal(context, sp);
1507 free(spn);
1508 krb5_make_principal(context, &sp, r,
1509 KRB5_TGS_NAME, new_rlm, NULL);
1510 ret = krb5_unparse_name(context, sp, &spn);
1511 if (ret)
1512 goto out;
1513
1514 if (ref_realm)
1515 free(ref_realm);
1516 ref_realm = strdup(new_rlm);
1517 goto server_lookup;
1518 }
1519 }
1520 } else if(need_referral(context, config, &b->kdc_options, sp, &realms)) {
1521 if (strcmp(realms[0], sp->realm) != 0) {
1522 kdc_log(context, config, 5,
1523 "Returning a referral to realm %s for "
1524 "server %s that was not found",
1525 realms[0], spn);
1526 krb5_free_principal(context, sp);
1527 free(spn);
1528 krb5_make_principal(context, &sp, r, KRB5_TGS_NAME,
1529 realms[0], NULL);
1530 ret = krb5_unparse_name(context, sp, &spn);
1531 if (ret)
1532 goto out;
1533
1534 if (ref_realm)
1535 free(ref_realm);
1536 ref_realm = strdup(realms[0]);
1537
1538 krb5_free_host_realm(context, realms);
1539 goto server_lookup;
1540 }
1541 krb5_free_host_realm(context, realms);
1542 }
1543 kdc_log(context, config, 0,
1544 "Server not found in database: %s: %s", spn,
1545 krb5_get_err_text(context, ret));
1546 if (ret == HDB_ERR_NOENTRY)
1547 ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1548 goto out;
1549 }
1550
1551 ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT | HDB_F_CANON,
1552 &clientdb, &client);
1553 if(ret) {
1554 const char *krbtgt_realm;
1555
1556 /*
1557 * If the client belongs to the same realm as our krbtgt, it
1558 * should exist in the local database.
1559 *
1560 */
1561
1562 krbtgt_realm =
1563 krb5_principal_get_comp_string(context,
1564 krbtgt->entry.principal, 1);
1565
1566 if(strcmp(krb5_principal_get_realm(context, cp), krbtgt_realm) == 0) {
1567 if (ret == HDB_ERR_NOENTRY)
1568 ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
1569 kdc_log(context, config, 1, "Client no longer in database: %s",
1570 cpn);
1571 goto out;
1572 }
1573
1574 kdc_log(context, config, 1, "Client not found in database: %s: %s",
1575 cpn, krb5_get_err_text(context, ret));
1576 }
1577
1578 /*
1579 * Select enctype, return key and kvno.
1580 */
1581
1582 {
1583 krb5_enctype etype;
1584
1585 if(b->kdc_options.enc_tkt_in_skey) {
1586 int i;
1587 ekey = &adtkt.key;
1588 for(i = 0; i < b->etype.len; i++)
1589 if (b->etype.val[i] == adtkt.key.keytype)
1590 break;
1591 if(i == b->etype.len) {
1592 kdc_log(context, config, 0,
1593 "Addition ticket have not matching etypes");
1594 krb5_clear_error_message(context);
1595 ret = KRB5KDC_ERR_ETYPE_NOSUPP;
1596 goto out;
1597 }
1598 etype = b->etype.val[i];
1599 kvno = 0;
1600 } else {
1601 Key *skey;
1602
1603 ret = _kdc_find_etype(context, server, b->etype.val, b->etype.len,
1604 &skey, &etype);
1605 if(ret) {
1606 kdc_log(context, config, 0,
1607 "Server (%s) has no support for etypes", spn);
1608 goto out;
1609 }
1610 ekey = &skey->key;
1611 kvno = server->entry.kvno;
1612 }
1613
1614 ret = krb5_generate_random_keyblock(context, etype, &sessionkey);
1615 if (ret)
1616 goto out;
1617 }
1618
1619 /*
1620 * Check that service is in the same realm as the krbtgt. If it's
1621 * not the same, it's someone that is using a uni-directional trust
1622 * backward.
1623 */
1624
1625 if (strcmp(krb5_principal_get_realm(context, sp),
1626 krb5_principal_get_comp_string(context,
1627 krbtgt->entry.principal,
1628 1)) != 0) {
1629 char *tpn;
1630 ret = krb5_unparse_name(context, krbtgt->entry.principal, &tpn);
1631 kdc_log(context, config, 0,
1632 "Request with wrong krbtgt: %s",
1633 (ret == 0) ? tpn : "<unknown>");
1634 if(ret == 0)
1635 free(tpn);
1636 ret = KRB5KRB_AP_ERR_NOT_US;
1637 goto out;
1638 }
1639
1640 /*
1641 * Validate authoriation data
1642 */
1643
1644 ret = hdb_enctype2key(context, &krbtgt->entry,
1645 krbtgt_etype, &tkey);
1646 if(ret) {
1647 kdc_log(context, config, 0,
1648 "Failed to find key for krbtgt PAC check");
1649 goto out;
1650 }
1651
1652 ret = check_PAC(context, config, cp,
1653 client, server, ekey, &tkey->key,
1654 tgt, &rspac, &signedpath);
1655 if (ret) {
1656 kdc_log(context, config, 0,
1657 "Verify PAC failed for %s (%s) from %s with %s",
1658 spn, cpn, from, krb5_get_err_text(context, ret));
1659 goto out;
1660 }
1661
1662 /* also check the krbtgt for signature */
1663 ret = check_KRB5SignedPath(context,
1664 config,
1665 krbtgt,
1666 tgt,
1667 &spp,
1668 &signedpath);
1669 if (ret) {
1670 kdc_log(context, config, 0,
1671 "KRB5SignedPath check failed for %s (%s) from %s with %s",
1672 spn, cpn, from, krb5_get_err_text(context, ret));
1673 goto out;
1674 }
1675
1676 /*
1677 * Process request
1678 */
1679
1680 client_principal = cp;
1681
1682 if (client) {
1683 const PA_DATA *sdata;
1684 int i = 0;
1685
1686 sdata = _kdc_find_padata(req, &i, KRB5_PADATA_FOR_USER);
1687 if (sdata) {
1688 krb5_crypto crypto;
1689 krb5_data datack;
1690 PA_S4U2Self self;
1691 char *selfcpn = NULL;
1692 const char *str;
1693
1694 ret = decode_PA_S4U2Self(sdata->padata_value.data,
1695 sdata->padata_value.length,
1696 &self, NULL);
1697 if (ret) {
1698 kdc_log(context, config, 0, "Failed to decode PA-S4U2Self");
1699 goto out;
1700 }
1701
1702 ret = _krb5_s4u2self_to_checksumdata(context, &self, &datack);
1703 if (ret)
1704 goto out;
1705
1706 ret = krb5_crypto_init(context, &tgt->key, 0, &crypto);
1707 if (ret) {
1708 free_PA_S4U2Self(&self);
1709 krb5_data_free(&datack);
1710 kdc_log(context, config, 0, "krb5_crypto_init failed: %s",
1711 krb5_get_err_text(context, ret));
1712 goto out;
1713 }
1714
1715 ret = krb5_verify_checksum(context,
1716 crypto,
1717 KRB5_KU_OTHER_CKSUM,
1718 datack.data,
1719 datack.length,
1720 &self.cksum);
1721 krb5_data_free(&datack);
1722 krb5_crypto_destroy(context, crypto);
1723 if (ret) {
1724 free_PA_S4U2Self(&self);
1725 kdc_log(context, config, 0,
1726 "krb5_verify_checksum failed for S4U2Self: %s",
1727 krb5_get_err_text(context, ret));
1728 goto out;
1729 }
1730
1731 ret = _krb5_principalname2krb5_principal(context,
1732 &client_principal,
1733 self.name,
1734 self.realm);
1735 free_PA_S4U2Self(&self);
1736 if (ret)
1737 goto out;
1738
1739 ret = krb5_unparse_name(context, client_principal, &selfcpn);
1740 if (ret)
1741 goto out;
1742
1743 /*
1744 * Check that service doing the impersonating is
1745 * requesting a ticket to it-self.
1746 */
1747 if (krb5_principal_compare(context, cp, sp) != TRUE) {
1748 kdc_log(context, config, 0, "S4U2Self: %s is not allowed "
1749 "to impersonate some other user "
1750 "(tried for user %s to service %s)",
1751 cpn, selfcpn, spn);
1752 free(selfcpn);
1753 ret = KRB5KDC_ERR_BADOPTION; /* ? */
1754 goto out;
1755 }
1756
1757 /*
1758 * If the service isn't trusted for authentication to
1759 * delegation, remove the forward flag.
1760 */
1761
1762 if (client->entry.flags.trusted_for_delegation) {
1763 str = "[forwardable]";
1764 } else {
1765 b->kdc_options.forwardable = 0;
1766 str = "";
1767 }
1768 kdc_log(context, config, 0, "s4u2self %s impersonating %s to "
1769 "service %s %s", cpn, selfcpn, spn, str);
1770 free(selfcpn);
1771 }
1772 }
1773
1774 /*
1775 * Constrained delegation
1776 */
1777
1778 if (client != NULL
1779 && b->additional_tickets != NULL
1780 && b->additional_tickets->len != 0
1781 && b->kdc_options.enc_tkt_in_skey == 0)
1782 {
1783 int ad_signedpath = 0;
1784 Key *clientkey;
1785 Ticket *t;
1786 char *str;
1787
1788 /*
1789 * Require that the KDC have issued the service's krbtgt (not
1790 * self-issued ticket with kimpersonate(1).
1791 */
1792 if (!signedpath) {
1793 ret = KRB5KDC_ERR_BADOPTION;
1794 kdc_log(context, config, 0,
1795 "Constrained delegation done on service ticket %s/%s",
1796 cpn, spn);
1797 goto out;
1798 }
1799
1800 t = &b->additional_tickets->val[0];
1801
1802 ret = hdb_enctype2key(context, &client->entry,
1803 t->enc_part.etype, &clientkey);
1804 if(ret){
1805 ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
1806 goto out;
1807 }
1808
1809 ret = krb5_decrypt_ticket(context, t, &clientkey->key, &adtkt, 0);
1810 if (ret) {
1811 kdc_log(context, config, 0,
1812 "failed to decrypt ticket for "
1813 "constrained delegation from %s to %s ", cpn, spn);
1814 goto out;
1815 }
1816
1817 /* check that ticket is valid */
1818 if (adtkt.flags.forwardable == 0) {
1819 kdc_log(context, config, 0,
1820 "Missing forwardable flag on ticket for "
1821 "constrained delegation from %s to %s ", cpn, spn);
1822 ret = KRB5KDC_ERR_BADOPTION;
1823 goto out;
1824 }
1825
1826 ret = check_constrained_delegation(context, config, clientdb,
1827 client, sp);
1828 if (ret) {
1829 kdc_log(context, config, 0,
1830 "constrained delegation from %s to %s not allowed",
1831 cpn, spn);
1832 goto out;
1833 }
1834
1835 ret = _krb5_principalname2krb5_principal(context,
1836 &client_principal,
1837 adtkt.cname,
1838 adtkt.crealm);
1839 if (ret)
1840 goto out;
1841
1842 ret = krb5_unparse_name(context, client_principal, &str);
1843 if (ret)
1844 goto out;
1845
1846 ret = verify_flags(context, config, &adtkt, str);
1847 if (ret) {
1848 free(str);
1849 goto out;
1850 }
1851
1852 /*
1853 * Check that the KDC issued the user's ticket.
1854 */
1855 ret = check_KRB5SignedPath(context,
1856 config,
1857 krbtgt,
1858 &adtkt,
1859 NULL,
1860 &ad_signedpath);
1861 if (ret == 0 && !ad_signedpath)
1862 ret = KRB5KDC_ERR_BADOPTION;
1863 if (ret) {
1864 kdc_log(context, config, 0,
1865 "KRB5SignedPath check from service %s failed "
1866 "for delegation to %s for client %s "
1867 "from %s failed with %s",
1868 spn, str, cpn, from, krb5_get_err_text(context, ret));
1869 free(str);
1870 goto out;
1871 }
1872
1873 kdc_log(context, config, 0, "constrained delegation for %s "
1874 "from %s to %s", str, cpn, spn);
1875 free(str);
1876 }
1877
1878 /*
1879 * Check flags
1880 */
1881
1882 ret = kdc_check_flags(context, config,
1883 client, cpn,
1884 server, spn,
1885 FALSE);
1886 if(ret)
1887 goto out;
1888
1889 if((b->kdc_options.validate || b->kdc_options.renew) &&
1890 !krb5_principal_compare(context,
1891 krbtgt->entry.principal,
1892 server->entry.principal)){
1893 kdc_log(context, config, 0, "Inconsistent request.");
1894 ret = KRB5KDC_ERR_SERVER_NOMATCH;
1895 goto out;
1896 }
1897
1898 /* check for valid set of addresses */
1899 if(!_kdc_check_addresses(context, config, tgt->caddr, from_addr)) {
1900 ret = KRB5KRB_AP_ERR_BADADDR;
1901 kdc_log(context, config, 0, "Request from wrong address");
1902 goto out;
1903 }
1904
1905 /*
1906 * If this is an referral, add server referral data to the
1907 * auth_data reply .
1908 */
1909 if (ref_realm) {
1910 PA_DATA pa;
1911 krb5_crypto crypto;
1912
1913 kdc_log(context, config, 0,
1914 "Adding server referral to %s", ref_realm);
1915
1916 ret = krb5_crypto_init(context, &sessionkey, 0, &crypto);
1917 if (ret)
1918 goto out;
1919
1920 ret = build_server_referral(context, config, crypto, ref_realm,
1921 NULL, s, &pa.padata_value);
1922 krb5_crypto_destroy(context, crypto);
1923 if (ret) {
1924 kdc_log(context, config, 0,
1925 "Failed building server referral");
1926 goto out;
1927 }
1928 pa.padata_type = KRB5_PADATA_SERVER_REFERRAL;
1929
1930 ret = add_METHOD_DATA(&enc_pa_data, &pa);
1931 krb5_data_free(&pa.padata_value);
1932 if (ret) {
1933 kdc_log(context, config, 0,
1934 "Add server referral METHOD-DATA failed");
1935 goto out;
1936 }
1937 }
1938
1939 /*
1940 *
1941 */
1942
1943 ret = tgs_make_reply(context,
1944 config,
1945 b,
1946 client_principal,
1947 tgt,
1948 ekey,
1949 &sessionkey,
1950 kvno,
1951 *auth_data,
1952 server,
1953 sp,
1954 spn,
1955 client,
1956 cp,
1957 krbtgt,
1958 krbtgt_etype,
1959 spp,
1960 &rspac,
1961 &enc_pa_data,
1962 e_text,
1963 reply);
1964
1965out:
1966 free(spn);
1967 free(cpn);
1968
1969 krb5_data_free(&rspac);
1970 krb5_free_keyblock_contents(context, &sessionkey);
1971 if(server)
1972 _kdc_free_ent(context, server);
1973 if(client)
1974 _kdc_free_ent(context, client);
1975
1976 if (client_principal && client_principal != cp)
1977 krb5_free_principal(context, client_principal);
1978 if (cp)
1979 krb5_free_principal(context, cp);
1980 if (sp)
1981 krb5_free_principal(context, sp);
1982 if (ref_realm)
1983 free(ref_realm);
1984 free_METHOD_DATA(&enc_pa_data);
1985
1986 free_EncTicketPart(&adtkt);
1987
1988 return ret;
1989}
1990
1991/*
1992 *
1993 */
1994
1995krb5_error_code
1996_kdc_tgs_rep(krb5_context context,
1997 krb5_kdc_configuration *config,
1998 KDC_REQ *req,
1999 krb5_data *data,
2000 const char *from,
2001 struct sockaddr *from_addr,
2002 int datagram_reply)
2003{
2004 AuthorizationData *auth_data = NULL;
2005 krb5_error_code ret;
2006 int i = 0;
2007 const PA_DATA *tgs_req;
2008
2009 hdb_entry_ex *krbtgt = NULL;
2010 krb5_ticket *ticket = NULL;
2011 const char *e_text = NULL;
2012 krb5_enctype krbtgt_etype = ETYPE_NULL;
2013
2014 time_t *csec = NULL;
2015 int *cusec = NULL;
2016
2017 if(req->padata == NULL){
2018 ret = KRB5KDC_ERR_PREAUTH_REQUIRED; /* XXX ??? */
2019 kdc_log(context, config, 0,
2020 "TGS-REQ from %s without PA-DATA", from);
2021 goto out;
2022 }
2023
2024 tgs_req = _kdc_find_padata(req, &i, KRB5_PADATA_TGS_REQ);
2025
2026 if(tgs_req == NULL){
2027 ret = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
2028
2029 kdc_log(context, config, 0,
2030 "TGS-REQ from %s without PA-TGS-REQ", from);
2031 goto out;
2032 }
2033 ret = tgs_parse_request(context, config,
2034 &req->req_body, tgs_req,
2035 &krbtgt,
2036 &krbtgt_etype,
2037 &ticket,
2038 &e_text,
2039 from, from_addr,
2040 &csec, &cusec,
2041 &auth_data);
2042 if (ret) {
2043 kdc_log(context, config, 0,
2044 "Failed parsing TGS-REQ from %s", from);
2045 goto out;
2046 }
2047
2048 ret = tgs_build_reply(context,
2049 config,
2050 req,
2051 &req->req_body,
2052 krbtgt,
2053 krbtgt_etype,
2054 ticket,
2055 data,
2056 from,
2057 &e_text,
2058 &auth_data,
2059 from_addr);
2060 if (ret) {
2061 kdc_log(context, config, 0,
2062 "Failed building TGS-REP to %s", from);
2063 goto out;
2064 }
2065
2066 /* */
2067 if (datagram_reply && data->length > config->max_datagram_reply_length) {
2068 krb5_data_free(data);
2069 ret = KRB5KRB_ERR_RESPONSE_TOO_BIG;
2070 e_text = "Reply packet too large";
2071 }
2072
2073out:
2074 if(ret && data->data == NULL){
2075 krb5_mk_error(context,
2076 ret,
2077 NULL,
2078 NULL,
2079 NULL,
2080 NULL,
2081 csec,
2082 cusec,
2083 data);
2084 }
2085 free(csec);
2086 free(cusec);
2087 if (ticket)
2088 krb5_free_ticket(context, ticket);
2089 if(krbtgt)
2090 _kdc_free_ent(context, krbtgt);
2091
2092 if (auth_data) {
2093 free_AuthorizationData(auth_data);
2094 free(auth_data);
2095 }
2096
2097 return 0;
2098}
Note: See TracBrowser for help on using the repository browser.