source/libads/kerberos_verify.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Luke Howard 2003
   7    Copyright (C) Guenther Deschner 2003
   8    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26
  27 #ifdef HAVE_KRB5
  28
  29 #if !defined(HAVE_KRB5_PRINC_COMPONENT)
  30 const krb5_data *krb5_princ_component(krb5_context, krb5_principal, int );
  31 #endif
  32
  33 /**********************************************************************************
  34  Try to verify a ticket using the system keytab... the system keytab has kvno -1 entries, so
  35  it's more like what microsoft does... see comment in utils/net_ads.c in the
  36  ads_keytab_add_entry function for details.
  37 ***********************************************************************************/
  38
  39 static BOOL ads_keytab_verify_ticket(krb5_context context, krb5_auth_context auth_context,
  40                         const DATA_BLOB *ticket, krb5_data *p_packet, krb5_ticket **pp_tkt)
  41 {
  42         krb5_error_code ret = 0;
  43         BOOL auth_ok = False;
  44         krb5_keytab keytab = NULL;
  45         fstring my_fqdn, my_name;
  46         fstring my_Fqdn, my_NAME;
  47         char *p_fqdn;
  48         char *host_princ_s[18];
  49         krb5_principal host_princ;
  50         int i;
  51
  52         ret = krb5_kt_default(context, &keytab);
  53         if (ret) {
  54                 DEBUG(1, ("ads_keytab_verify_ticket: krb5_kt_default failed (%s)\n", error_message(ret)));
  55                 goto out;
  56         }
  57
  58         /* Generate the list of principal names which we expect clients might
  59          * want to use for authenticating to the file service. */
  60
  61         fstrcpy(my_name, global_myname());
  62         strlower_m(my_name);
  63
  64         fstrcpy(my_NAME, global_myname());
  65         strupper_m(my_NAME);
  66
  67         my_fqdn[0] = '\0';
  68         name_to_fqdn(my_fqdn, global_myname());
  69         strlower_m(my_fqdn);
  70
  71         p_fqdn = strchr_m(my_fqdn, '.');
  72         fstrcpy(my_Fqdn, my_NAME);
  73         if (p_fqdn) {
  74                 fstrcat(my_Fqdn, p_fqdn);
  75         }
  76
  77         asprintf(&host_princ_s[0], "%s$@%s", my_name, lp_realm());
  78         asprintf(&host_princ_s[1], "%s$@%s", my_NAME, lp_realm());
  79         asprintf(&host_princ_s[2], "host/%s@%s", my_name, lp_realm());
  80         asprintf(&host_princ_s[3], "host/%s@%s", my_NAME, lp_realm());
  81         asprintf(&host_princ_s[4], "host/%s@%s", my_fqdn, lp_realm());
  82         asprintf(&host_princ_s[5], "host/%s@%s", my_Fqdn, lp_realm());
  83         asprintf(&host_princ_s[6], "HOST/%s@%s", my_name, lp_realm());
  84         asprintf(&host_princ_s[7], "HOST/%s@%s", my_NAME, lp_realm());
  85         asprintf(&host_princ_s[8], "HOST/%s@%s", my_fqdn, lp_realm());
  86         asprintf(&host_princ_s[9], "HOST/%s@%s", my_Fqdn, lp_realm());
  87         asprintf(&host_princ_s[10], "cifs/%s@%s", my_name, lp_realm());
  88         asprintf(&host_princ_s[11], "cifs/%s@%s", my_NAME, lp_realm());
  89         asprintf(&host_princ_s[12], "cifs/%s@%s", my_fqdn, lp_realm());
  90         asprintf(&host_princ_s[13], "cifs/%s@%s", my_Fqdn, lp_realm());
  91         asprintf(&host_princ_s[14], "CIFS/%s@%s", my_name, lp_realm());
  92         asprintf(&host_princ_s[15], "CIFS/%s@%s", my_NAME, lp_realm());
  93         asprintf(&host_princ_s[16], "CIFS/%s@%s", my_fqdn, lp_realm());
  94         asprintf(&host_princ_s[17], "CIFS/%s@%s", my_Fqdn, lp_realm());
  95
  96         /* Now try to verify the ticket using the key associated with each of
  97          * the principals which we think clients will expect us to be
  98          * participating as. */
  99         for (i = 0; i < sizeof(host_princ_s) / sizeof(host_princ_s[0]); i++) {
 100                 host_princ = NULL;
 101                 ret = krb5_parse_name(context, host_princ_s[i], &host_princ);
 102                 if (ret) {
 103                         DEBUG(1, ("ads_keytab_verify_ticket: krb5_parse_name(%s) failed (%s)\n",
 104                                 host_princ_s[i], error_message(ret)));
 105                         goto out;
 106                 }
 107                 p_packet->length = ticket->length;
 108                 p_packet->data = (krb5_pointer)ticket->data;
 109                 *pp_tkt = NULL;
 110                 ret = krb5_rd_req(context, &auth_context, p_packet, host_princ, keytab, NULL, pp_tkt);
 111                 krb5_free_principal(context, host_princ);
 112                 if (ret) {
 113                         DEBUG(0, ("krb5_rd_req(%s) failed: %s\n", host_princ_s[i], error_message(ret)));
 114                 } else {
 115                         DEBUG(10,("krb5_rd_req succeeded for principal %s\n", host_princ_s[i]));
 116                         auth_ok = True;
 117                         break;
 118                 }
 119         }
 120
 121         for (i = 0; i < sizeof(host_princ_s) / sizeof(host_princ_s[0]); i++) {
 122                 SAFE_FREE(host_princ_s[i]);
 123         }
 124
 125   out:
 126
 127         if (keytab) {
 128                 krb5_kt_close(context, keytab);
 129         }
 130         return auth_ok;
 131 }
 132
 133 /**********************************************************************************
 134  Try to verify a ticket using the secrets.tdb.
 135 ***********************************************************************************/
 136
 137 static BOOL ads_secrets_verify_ticket(krb5_context context, krb5_auth_context auth_context,
 138                         krb5_principal host_princ,
 139                         const DATA_BLOB *ticket, krb5_data *p_packet, krb5_ticket **pp_tkt)
 140 {
 141         krb5_error_code ret = 0;
 142         BOOL auth_ok = False;
 143         char *password_s = NULL;
 144         krb5_data password;
 145         krb5_enctype *enctypes = NULL;
 146         int i;
 147
 148         if (!secrets_init()) {
 149                 DEBUG(1,("ads_secrets_verify_ticket: secrets_init failed\n"));
 150                 return False;
 151         }
 152
 153         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 154         if (!password_s) {
 155                 DEBUG(1,("ads_secrets_verify_ticket: failed to fetch machine password\n"));
 156                 return False;
 157         }
 158
 159         password.data = password_s;
 160         password.length = strlen(password_s);
 161
 162         /* CIFS doesn't use addresses in tickets. This would break NAT. JRA */
 163
 164         if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) {
 165                 DEBUG(1,("ads_secrets_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n",
 166                          error_message(ret)));
 167                 goto out;
 168         }
 169
 170         p_packet->length = ticket->length;
 171         p_packet->data = (krb5_pointer)ticket->data;
 172
 173         /* We need to setup a auth context with each possible encoding type in turn. */
 174         for (i=0;enctypes[i];i++) {
 175                 krb5_keyblock *key = NULL;
 176
 177                 if (!(key = SMB_MALLOC_P(krb5_keyblock))) {
 178                         goto out;
 179                 }
 180
 181                 if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) {
 182                         SAFE_FREE(key);
 183                         continue;
 184                 }
 185
 186                 krb5_auth_con_setuseruserkey(context, auth_context, key);
 187
 188                 krb5_free_keyblock(context, key);
 189
 190                 if (!(ret = krb5_rd_req(context, &auth_context, p_packet,
 191                                         NULL,
 192                                         NULL, NULL, pp_tkt))) {
 193                         DEBUG(10,("ads_secrets_verify_ticket: enc type [%u] decrypted message !\n",
 194                                 (unsigned int)enctypes[i] ));
 195                         auth_ok = True;
 196                         break;
 197                 }
 198
 199                 DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
 200                                 ("ads_secrets_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
 201                                 (unsigned int)enctypes[i], error_message(ret)));
 202         }
 203
 204  out:
 205
 206         free_kerberos_etypes(context, enctypes);
 207         SAFE_FREE(password_s);
 208
 209         return auth_ok;
 210 }
 211
 212 /**********************************************************************************
 213  Verify an incoming ticket and parse out the principal name and
 214  authorization_data if available.
 215 ***********************************************************************************/
 216
 217 NTSTATUS ads_verify_ticket(const char *realm, const DATA_BLOB *ticket,
 218                            char **principal, DATA_BLOB *auth_data,
 219                            DATA_BLOB *ap_rep,
 220                            DATA_BLOB *session_key)
 221 {
 222         NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
 223         krb5_context context = NULL;
 224         krb5_auth_context auth_context = NULL;
 225         krb5_data packet;
 226         krb5_ticket *tkt = NULL;
 227         krb5_rcache rcache = NULL;
 228         int ret;
 229
 230         krb5_principal host_princ = NULL;
 231         char *host_princ_s = NULL;
 232         BOOL got_replay_mutex = False;
 233
 234         BOOL auth_ok = False;
 235
 236         ZERO_STRUCT(packet);
 237         ZERO_STRUCTP(auth_data);
 238         ZERO_STRUCTP(ap_rep);
 239         ZERO_STRUCTP(session_key);
 240
 241         initialize_krb5_error_table();
 242         ret = krb5_init_context(&context);
 243         if (ret) {
 244                 DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
 245                 return NT_STATUS_LOGON_FAILURE;
 246         }
 247
 248         ret = krb5_set_default_realm(context, realm);
 249         if (ret) {
 250                 DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
 251                 goto out;
 252         }
 253
 254         /* This whole process is far more complex than I would
 255            like. We have to go through all this to allow us to store
 256            the secret internally, instead of using /etc/krb5.keytab */
 257
 258         ret = krb5_auth_con_init(context, &auth_context);
 259         if (ret) {
 260                 DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
 261                 goto out;
 262         }
 263
 264         asprintf(&host_princ_s, "%s$", global_myname());
 265         strlower_m(host_princ_s);
 266         ret = krb5_parse_name(context, host_princ_s, &host_princ);
 267         if (ret) {
 268                 DEBUG(1,("ads_verify_ticket: krb5_parse_name(%s) failed (%s)\n",
 269                                         host_princ_s, error_message(ret)));
 270                 goto out;
 271         }
 272
 273
 274         /* Lock a mutex surrounding the replay as there is no locking in the MIT krb5
 275          * code surrounding the replay cache... */
 276
 277         if (!grab_server_mutex("replay cache mutex")) {
 278                 DEBUG(1,("ads_verify_ticket: unable to protect replay cache with mutex.\n"));
 279                 goto out;
 280         }
 281
 282         got_replay_mutex = True;
 283
 284         /*
 285          * JRA. We must set the rcache here. This will prevent replay attacks.
 286          */
 287
 288         ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache);
 289         if (ret) {
 290                 DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache failed (%s)\n", error_message(ret)));
 291                 goto out;
 292         }
 293
 294         ret = krb5_auth_con_setrcache(context, auth_context, rcache);
 295         if (ret) {
 296                 DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache failed (%s)\n", error_message(ret)));
 297                 goto out;
 298         }
 299
 300         if (lp_use_kerberos_keytab()) {
 301                 auth_ok = ads_keytab_verify_ticket(context, auth_context, ticket, &packet, &tkt);
 302         }
 303         if (!auth_ok) {
 304                 auth_ok = ads_secrets_verify_ticket(context, auth_context, host_princ,
 305                                                         ticket, &packet, &tkt);
 306         }
 307
 308         release_server_mutex();
 309         got_replay_mutex = False;
 310
 311         if (!auth_ok) {
 312                 DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n",
 313                          error_message(ret)));
 314                 goto out;
 315         }
 316
 317         ret = krb5_mk_rep(context, auth_context, &packet);
 318         if (ret) {
 319                 DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
 320                         error_message(ret)));
 321                 goto out;
 322         }
 323
 324         *ap_rep = data_blob(packet.data, packet.length);
 325         SAFE_FREE(packet.data);
 326         packet.length = 0;
 327
 328         get_krb5_smb_session_key(context, auth_context, session_key, True);
 329         dump_data_pw("SMB session key (from ticket)\n", session_key->data, session_key->length);
 330
 331 #if 0
 332         file_save("/tmp/ticket.dat", ticket->data, ticket->length);
 333 #endif
 334
 335         get_auth_data_from_tkt(auth_data, tkt);
 336
 337         {
 338                 TALLOC_CTX *ctx = talloc_init("pac data");
 339                 decode_pac_data(auth_data, ctx);
 340                 talloc_destroy(ctx);
 341         }
 342
 343 #if 0
 344         if (tkt->enc_part2) {
 345                 file_save("/tmp/authdata.dat",
 346                           tkt->enc_part2->authorization_data[0]->contents,
 347                           tkt->enc_part2->authorization_data[0]->length);
 348         }
 349 #endif
 350
 351         if ((ret = krb5_unparse_name(context, get_principal_from_tkt(tkt),
 352                                      principal))) {
 353                 DEBUG(3,("ads_verify_ticket: krb5_unparse_name failed (%s)\n",
 354                          error_message(ret)));
 355                 sret = NT_STATUS_LOGON_FAILURE;
 356                 goto out;
 357         }
 358
 359         sret = NT_STATUS_OK;
 360
 361  out:
 362
 363         if (got_replay_mutex) {
 364                 release_server_mutex();
 365         }
 366
 367         if (!NT_STATUS_IS_OK(sret)) {
 368                 data_blob_free(auth_data);
 369         }
 370
 371         if (!NT_STATUS_IS_OK(sret)) {
 372                 data_blob_free(ap_rep);
 373         }
 374
 375         if (host_princ) {
 376                 krb5_free_principal(context, host_princ);
 377         }
 378
 379         if (tkt != NULL) {
 380                 krb5_free_ticket(context, tkt);
 381         }
 382
 383         SAFE_FREE(host_princ_s);
 384
 385         if (auth_context) {
 386                 krb5_auth_con_free(context, auth_context);
 387         }
 388
 389         if (context) {
 390                 krb5_free_context(context);
 391         }
 392
 393         return sret;
 394 }
 395
 396 #endif /* HAVE_KRB5 */