| 1 | /*
|
|---|
| 2 | Unix SMB/CIFS implementation.
|
|---|
| 3 | simple kerberos5 routines for active directory
|
|---|
| 4 | Copyright (C) Andrew Tridgell 2001
|
|---|
| 5 | Copyright (C) Luke Howard 2002-2003
|
|---|
| 6 |
|
|---|
| 7 | This program is free software; you can redistribute it and/or modify
|
|---|
| 8 | it under the terms of the GNU General Public License as published by
|
|---|
| 9 | the Free Software Foundation; either version 3 of the License, or
|
|---|
| 10 | (at your option) any later version.
|
|---|
| 11 |
|
|---|
| 12 | This program is distributed in the hope that it will be useful,
|
|---|
| 13 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|---|
| 15 | GNU General Public License for more details.
|
|---|
| 16 |
|
|---|
| 17 | You should have received a copy of the GNU General Public License
|
|---|
| 18 | along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|---|
| 19 | */
|
|---|
| 20 |
|
|---|
| 21 | #if defined(HAVE_KRB5)
|
|---|
| 22 |
|
|---|
| 23 | #include "auth/kerberos/krb5_init_context.h"
|
|---|
| 24 | #include "librpc/gen_ndr/krb5pac.h"
|
|---|
| 25 |
|
|---|
| 26 | struct auth_user_info_dc;
|
|---|
| 27 | struct cli_credentials;
|
|---|
| 28 |
|
|---|
| 29 | struct ccache_container {
|
|---|
| 30 | struct smb_krb5_context *smb_krb5_context;
|
|---|
| 31 | krb5_ccache ccache;
|
|---|
| 32 | };
|
|---|
| 33 |
|
|---|
| 34 | struct keytab_container {
|
|---|
| 35 | struct smb_krb5_context *smb_krb5_context;
|
|---|
| 36 | krb5_keytab keytab;
|
|---|
| 37 | };
|
|---|
| 38 |
|
|---|
| 39 | /* not really ASN.1, but RFC 1964 */
|
|---|
| 40 | #define TOK_ID_KRB_AP_REQ ((const uint8_t *)"\x01\x00")
|
|---|
| 41 | #define TOK_ID_KRB_AP_REP ((const uint8_t *)"\x02\x00")
|
|---|
| 42 | #define TOK_ID_KRB_ERROR ((const uint8_t *)"\x03\x00")
|
|---|
| 43 | #define TOK_ID_GSS_GETMIC ((const uint8_t *)"\x01\x01")
|
|---|
| 44 | #define TOK_ID_GSS_WRAP ((const uint8_t *)"\x02\x01")
|
|---|
| 45 |
|
|---|
| 46 | #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
|
|---|
| 47 | #define KRB5_KEY_TYPE(k) ((k)->keytype)
|
|---|
| 48 | #define KRB5_KEY_LENGTH(k) ((k)->keyvalue.length)
|
|---|
| 49 | #define KRB5_KEY_DATA(k) ((k)->keyvalue.data)
|
|---|
| 50 | #else
|
|---|
| 51 | #define KRB5_KEY_TYPE(k) ((k)->enctype)
|
|---|
| 52 | #define KRB5_KEY_LENGTH(k) ((k)->length)
|
|---|
| 53 | #define KRB5_KEY_DATA(k) ((k)->contents)
|
|---|
| 54 | #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
|
|---|
| 55 |
|
|---|
| 56 | #define ENC_ALL_TYPES (ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 | \
|
|---|
| 57 | ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256)
|
|---|
| 58 |
|
|---|
| 59 | #ifndef HAVE_KRB5_SET_REAL_TIME
|
|---|
| 60 | krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds);
|
|---|
| 61 | #endif
|
|---|
| 62 |
|
|---|
| 63 | #ifndef HAVE_KRB5_SET_DEFAULT_TGS_KTYPES
|
|---|
| 64 | krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc);
|
|---|
| 65 | #endif
|
|---|
| 66 |
|
|---|
| 67 | #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
|
|---|
| 68 | krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context, krb5_auth_context auth_context, krb5_keyblock *keyblock);
|
|---|
| 69 | #endif
|
|---|
| 70 |
|
|---|
| 71 | #ifndef HAVE_KRB5_FREE_UNPARSED_NAME
|
|---|
| 72 | void krb5_free_unparsed_name(krb5_context ctx, char *val);
|
|---|
| 73 | #endif
|
|---|
| 74 |
|
|---|
| 75 | #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
|
|---|
| 76 | const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
|
|---|
| 77 | #endif
|
|---|
| 78 |
|
|---|
| 79 | /* Samba wrapper function for krb5 functionality. */
|
|---|
| 80 | void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr);
|
|---|
| 81 | int create_kerberos_key_from_string(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype);
|
|---|
| 82 | int create_kerberos_key_from_string_direct(krb5_context context, krb5_principal host_princ, krb5_data *password, krb5_keyblock *key, krb5_enctype enctype);
|
|---|
| 83 | krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt);
|
|---|
| 84 | krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes);
|
|---|
| 85 | void free_kerberos_etypes(krb5_context context, krb5_enctype *enctypes);
|
|---|
| 86 | bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote);
|
|---|
| 87 | krb5_error_code ads_krb5_mk_req(krb5_context context,
|
|---|
| 88 | krb5_auth_context *auth_context,
|
|---|
| 89 | const krb5_flags ap_req_options,
|
|---|
| 90 | const char *principal,
|
|---|
| 91 | krb5_ccache ccache,
|
|---|
| 92 | krb5_data *outbuf);
|
|---|
| 93 | bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt);
|
|---|
| 94 | krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
|
|---|
| 95 | krb5_principal principal, const char *password,
|
|---|
| 96 | krb5_principal impersonate_principal, const char *target_service,
|
|---|
| 97 | krb5_get_init_creds_opt *krb_options,
|
|---|
| 98 | time_t *expire_time, time_t *kdc_time);
|
|---|
| 99 | krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
|
|---|
| 100 | krb5_principal principal, krb5_keyblock *keyblock,
|
|---|
| 101 | const char *target_service,
|
|---|
| 102 | krb5_get_init_creds_opt *krb_options,
|
|---|
| 103 | time_t *expire_time, time_t *kdc_time);
|
|---|
| 104 | krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
|
|---|
| 105 | krb5_principal host_princ,
|
|---|
| 106 | int enctype);
|
|---|
| 107 | void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype);
|
|---|
| 108 | bool kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, krb5_enctype enctype2);
|
|---|
| 109 | void kerberos_free_data_contents(krb5_context context, krb5_data *pdata);
|
|---|
| 110 | krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
|
|---|
| 111 | char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx);
|
|---|
| 112 | NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
|
|---|
| 113 | struct PAC_DATA **pac_data_out,
|
|---|
| 114 | DATA_BLOB blob,
|
|---|
| 115 | krb5_context context,
|
|---|
| 116 | const krb5_keyblock *krbtgt_keyblock,
|
|---|
| 117 | const krb5_keyblock *service_keyblock,
|
|---|
| 118 | krb5_const_principal client_principal,
|
|---|
| 119 | time_t tgs_authtime,
|
|---|
| 120 | krb5_error_code *k5ret);
|
|---|
| 121 | NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
|
|---|
| 122 | struct PAC_LOGON_INFO **logon_info,
|
|---|
| 123 | DATA_BLOB blob,
|
|---|
| 124 | krb5_context context,
|
|---|
| 125 | const krb5_keyblock *krbtgt_keyblock,
|
|---|
| 126 | const krb5_keyblock *service_keyblock,
|
|---|
| 127 | krb5_const_principal client_principal,
|
|---|
| 128 | time_t tgs_authtime,
|
|---|
| 129 | krb5_error_code *k5ret);
|
|---|
| 130 | krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
|
|---|
| 131 | struct PAC_DATA *pac_data,
|
|---|
| 132 | krb5_context context,
|
|---|
| 133 | const krb5_keyblock *krbtgt_keyblock,
|
|---|
| 134 | const krb5_keyblock *service_keyblock,
|
|---|
| 135 | DATA_BLOB *pac);
|
|---|
| 136 | krb5_error_code kerberos_create_pac(TALLOC_CTX *mem_ctx,
|
|---|
| 137 | struct auth_user_info_dc *user_info_dc,
|
|---|
| 138 | krb5_context context,
|
|---|
| 139 | const krb5_keyblock *krbtgt_keyblock,
|
|---|
| 140 | const krb5_keyblock *service_keyblock,
|
|---|
| 141 | krb5_principal client_principal,
|
|---|
| 142 | time_t tgs_authtime,
|
|---|
| 143 | DATA_BLOB *pac);
|
|---|
| 144 | struct loadparm_context;
|
|---|
| 145 | struct ldb_message;
|
|---|
| 146 | struct ldb_context;
|
|---|
| 147 | uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum);
|
|---|
| 148 | /* Translate between the Microsoft msDS-SupportedEncryptionTypes values and the IETF encryption type values */
|
|---|
| 149 | krb5_enctype kerberos_enctype_bitmap_to_enctype(uint32_t enctype_bitmap);
|
|---|
| 150 | krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
|
|---|
| 151 | struct smb_krb5_context *smb_krb5_context,
|
|---|
| 152 | struct ldb_context *ldb,
|
|---|
| 153 | struct ldb_message *msg,
|
|---|
| 154 | bool delete_all_kvno,
|
|---|
| 155 | const char **error_string);
|
|---|
| 156 |
|
|---|
| 157 | #include "auth/kerberos/proto.h"
|
|---|
| 158 |
|
|---|
| 159 | #endif /* HAVE_KRB5 */
|
|---|
