lib/krb5/get_in_tkt.c

   1 /*
   2  * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 krb5_error_code KRB5_LIB_FUNCTION
  39 krb5_init_etype (krb5_context context,
  40                  unsigned *len,
  41                  krb5_enctype **val,
  42                  const krb5_enctype *etypes)
  43 {
  44     int i;
  45     krb5_error_code ret;
  46     krb5_enctype *tmp = NULL;
  47
  48     ret = 0;
  49     if (etypes == NULL) {
  50         ret = krb5_get_default_in_tkt_etypes(context,
  51                                              &tmp);
  52         if (ret)
  53             return ret;
  54         etypes = tmp;
  55     }
  56
  57     for (i = 0; etypes[i]; ++i)
  58         ;
  59     *len = i;
  60     *val = malloc(i * sizeof(**val));
  61     if (i != 0 && *val == NULL) {
  62         ret = ENOMEM;
  63         krb5_set_error_string(context, "malloc: out of memory");
  64         goto cleanup;
  65     }
  66     memmove (*val,
  67              etypes,
  68              i * sizeof(*tmp));
  69 cleanup:
  70     if (tmp != NULL)
  71         free (tmp);
  72     return ret;
  73 }
  74
  75
  76 static krb5_error_code
  77 decrypt_tkt (krb5_context context,
  78              krb5_keyblock *key,
  79              krb5_key_usage usage,
  80              krb5_const_pointer decrypt_arg,
  81              krb5_kdc_rep *dec_rep)
  82 {
  83     krb5_error_code ret;
  84     krb5_data data;
  85     size_t size;
  86     krb5_crypto crypto;
  87
  88     ret = krb5_crypto_init(context, key, 0, &crypto);
  89     if (ret)
  90         return ret;
  91
  92     ret = krb5_decrypt_EncryptedData (context,
  93                                       crypto,
  94                                       usage,
  95                                       &dec_rep->kdc_rep.enc_part,
  96                                       &data);
  97     krb5_crypto_destroy(context, crypto);
  98
  99     if (ret)
 100         return ret;
 101
 102     ret = krb5_decode_EncASRepPart(context,
 103                                    data.data,
 104                                    data.length,
 105                                    &dec_rep->enc_part,
 106                                    &size);
 107     if (ret)
 108         ret = krb5_decode_EncTGSRepPart(context,
 109                                         data.data,
 110                                         data.length,
 111                                         &dec_rep->enc_part,
 112                                         &size);
 113     krb5_data_free (&data);
 114     if (ret)
 115         return ret;
 116     return 0;
 117 }
 118
 119 int
 120 _krb5_extract_ticket(krb5_context context,
 121                      krb5_kdc_rep *rep,
 122                      krb5_creds *creds,
 123                      krb5_keyblock *key,
 124                      krb5_const_pointer keyseed,
 125                      krb5_key_usage key_usage,
 126                      krb5_addresses *addrs,
 127                      unsigned nonce,
 128                      unsigned flags,
 129                      krb5_decrypt_proc decrypt_proc,
 130                      krb5_const_pointer decryptarg)
 131 {
 132     krb5_error_code ret;
 133     krb5_principal tmp_principal;
 134     int tmp;
 135     size_t len;
 136     time_t tmp_time;
 137     krb5_timestamp sec_now;
 138
 139     ret = _krb5_principalname2krb5_principal (context,
 140                                               &tmp_principal,
 141                                               rep->kdc_rep.cname,
 142                                               rep->kdc_rep.crealm);
 143     if (ret)
 144         goto out;
 145
 146     /* compare client */
 147
 148     if((flags & EXTRACT_TICKET_ALLOW_CNAME_MISMATCH) == 0){
 149         tmp = krb5_principal_compare (context, tmp_principal, creds->client);
 150         if (!tmp) {
 151             krb5_free_principal (context, tmp_principal);
 152             krb5_clear_error_string (context);
 153             ret = KRB5KRB_AP_ERR_MODIFIED;
 154             goto out;
 155         }
 156     }
 157
 158     krb5_free_principal (context, creds->client);
 159     creds->client = tmp_principal;
 160
 161     /* extract ticket */
 162     ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length,
 163                        &rep->kdc_rep.ticket, &len, ret);
 164     if(ret)
 165         goto out;
 166     if (creds->ticket.length != len)
 167         krb5_abortx(context, "internal error in ASN.1 encoder");
 168     creds->second_ticket.length = 0;
 169     creds->second_ticket.data   = NULL;
 170
 171     /* compare server */
 172
 173     ret = _krb5_principalname2krb5_principal (context,
 174                                               &tmp_principal,
 175                                               rep->kdc_rep.ticket.sname,
 176                                               rep->kdc_rep.ticket.realm);
 177     if (ret)
 178         goto out;
 179     if(flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH){
 180         krb5_free_principal(context, creds->server);
 181         creds->server = tmp_principal;
 182         tmp_principal = NULL;
 183     } else {
 184         tmp = krb5_principal_compare (context, tmp_principal,
 185                                       creds->server);
 186         krb5_free_principal (context, tmp_principal);
 187         if (!tmp) {
 188             ret = KRB5KRB_AP_ERR_MODIFIED;
 189             krb5_clear_error_string (context);
 190             goto out;
 191         }
 192     }
 193
 194     /* decrypt */
 195
 196     if (decrypt_proc == NULL)
 197         decrypt_proc = decrypt_tkt;
 198
 199     ret = (*decrypt_proc)(context, key, key_usage, decryptarg, rep);
 200     if (ret)
 201         goto out;
 202
 203     /* verify names */
 204     if(flags & EXTRACT_TICKET_MATCH_REALM){
 205         const char *srealm = krb5_principal_get_realm(context, creds->server);
 206         const char *crealm = krb5_principal_get_realm(context, creds->client);
 207
 208         if (strcmp(rep->enc_part.srealm, srealm) != 0 ||
 209             strcmp(rep->enc_part.srealm, crealm) != 0)
 210         {
 211             ret = KRB5KRB_AP_ERR_MODIFIED;
 212             krb5_clear_error_string(context);
 213             goto out;
 214         }
 215     }
 216
 217     /* compare nonces */
 218
 219     if (nonce != rep->enc_part.nonce) {
 220         ret = KRB5KRB_AP_ERR_MODIFIED;
 221         krb5_set_error_string(context, "malloc: out of memory");
 222         goto out;
 223     }
 224
 225     /* set kdc-offset */
 226
 227     krb5_timeofday (context, &sec_now);
 228     if (rep->enc_part.flags.initial
 229         && context->kdc_sec_offset == 0
 230         && krb5_config_get_bool (context, NULL,
 231                                  "libdefaults",
 232                                  "kdc_timesync",
 233                                  NULL)) {
 234         context->kdc_sec_offset = rep->enc_part.authtime - sec_now;
 235         krb5_timeofday (context, &sec_now);
 236     }
 237
 238     /* check all times */
 239
 240     if (rep->enc_part.starttime) {
 241         tmp_time = *rep->enc_part.starttime;
 242     } else
 243         tmp_time = rep->enc_part.authtime;
 244
 245     if (creds->times.starttime == 0
 246         && abs(tmp_time - sec_now) > context->max_skew) {
 247         ret = KRB5KRB_AP_ERR_SKEW;
 248         krb5_set_error_string (context,
 249                                "time skew (%d) larger than max (%d)",
 250                                abs(tmp_time - sec_now),
 251                                (int)context->max_skew);
 252         goto out;
 253     }
 254
 255     if (creds->times.starttime != 0
 256         && tmp_time != creds->times.starttime) {
 257         krb5_clear_error_string (context);
 258         ret = KRB5KRB_AP_ERR_MODIFIED;
 259         goto out;
 260     }
 261
 262     creds->times.starttime = tmp_time;
 263
 264     if (rep->enc_part.renew_till) {
 265         tmp_time = *rep->enc_part.renew_till;
 266     } else
 267         tmp_time = 0;
 268
 269     if (creds->times.renew_till != 0
 270         && tmp_time > creds->times.renew_till) {
 271         krb5_clear_error_string (context);
 272         ret = KRB5KRB_AP_ERR_MODIFIED;
 273         goto out;
 274     }
 275
 276     creds->times.renew_till = tmp_time;
 277
 278     creds->times.authtime = rep->enc_part.authtime;
 279
 280     if (creds->times.endtime != 0
 281         && rep->enc_part.endtime > creds->times.endtime) {
 282         krb5_clear_error_string (context);
 283         ret = KRB5KRB_AP_ERR_MODIFIED;
 284         goto out;
 285     }
 286
 287     creds->times.endtime  = rep->enc_part.endtime;
 288
 289     if(rep->enc_part.caddr)
 290         krb5_copy_addresses (context, rep->enc_part.caddr, &creds->addresses);
 291     else if(addrs)
 292         krb5_copy_addresses (context, addrs, &creds->addresses);
 293     else {
 294         creds->addresses.len = 0;
 295         creds->addresses.val = NULL;
 296     }
 297     creds->flags.b = rep->enc_part.flags;
 298
 299     creds->authdata.len = 0;
 300     creds->authdata.val = NULL;
 301     creds->session.keyvalue.length = 0;
 302     creds->session.keyvalue.data   = NULL;
 303     creds->session.keytype = rep->enc_part.key.keytype;
 304     ret = krb5_data_copy (&creds->session.keyvalue,
 305                           rep->enc_part.key.keyvalue.data,
 306                           rep->enc_part.key.keyvalue.length);
 307
 308 out:
 309     memset (rep->enc_part.key.keyvalue.data, 0,
 310             rep->enc_part.key.keyvalue.length);
 311     return ret;
 312 }
 313
 314
 315 static krb5_error_code
 316 make_pa_enc_timestamp(krb5_context context, PA_DATA *pa,
 317                       krb5_enctype etype, krb5_keyblock *key)
 318 {
 319     PA_ENC_TS_ENC p;
 320     unsigned char *buf;
 321     size_t buf_size;
 322     size_t len;
 323     EncryptedData encdata;
 324     krb5_error_code ret;
 325     int32_t usec;
 326     int usec2;
 327     krb5_crypto crypto;
 328
 329     krb5_us_timeofday (context, &p.patimestamp, &usec);
 330     usec2         = usec;
 331     p.pausec      = &usec2;
 332
 333     ASN1_MALLOC_ENCODE(PA_ENC_TS_ENC, buf, buf_size, &p, &len, ret);
 334     if (ret)
 335         return ret;
 336     if(buf_size != len)
 337         krb5_abortx(context, "internal error in ASN.1 encoder");
 338     ret = krb5_crypto_init(context, key, 0, &crypto);
 339     if (ret) {
 340         free(buf);
 341         return ret;
 342     }
 343     ret = krb5_encrypt_EncryptedData(context,
 344                                      crypto,
 345                                      KRB5_KU_PA_ENC_TIMESTAMP,
 346                                      buf,
 347                                      len,
 348                                      0,
 349                                      &encdata);
 350     free(buf);
 351     krb5_crypto_destroy(context, crypto);
 352     if (ret)
 353         return ret;
 354
 355     ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_size, &encdata, &len, ret);
 356     free_EncryptedData(&encdata);
 357     if (ret)
 358         return ret;
 359     if(buf_size != len)
 360         krb5_abortx(context, "internal error in ASN.1 encoder");
 361     pa->padata_type = KRB5_PADATA_ENC_TIMESTAMP;
 362     pa->padata_value.length = len;
 363     pa->padata_value.data = buf;
 364     return 0;
 365 }
 366
 367 static krb5_error_code
 368 add_padata(krb5_context context,
 369            METHOD_DATA *md,
 370            krb5_principal client,
 371            krb5_key_proc key_proc,
 372            krb5_const_pointer keyseed,
 373            krb5_enctype *enctypes,
 374            unsigned netypes,
 375            krb5_salt *salt)
 376 {
 377     krb5_error_code ret;
 378     PA_DATA *pa2;
 379     krb5_salt salt2;
 380     krb5_enctype *ep;
 381     int i;
 382
 383     if(salt == NULL) {
 384         /* default to standard salt */
 385         ret = krb5_get_pw_salt (context, client, &salt2);
 386         salt = &salt2;
 387     }
 388     if (!enctypes) {
 389         enctypes = context->etypes;
 390         netypes = 0;
 391         for (ep = enctypes; *ep != ETYPE_NULL; ep++)
 392             netypes++;
 393     }
 394     pa2 = realloc (md->val, (md->len + netypes) * sizeof(*md->val));
 395     if (pa2 == NULL) {
 396         krb5_set_error_string(context, "malloc: out of memory");
 397         return ENOMEM;
 398     }
 399     md->val = pa2;
 400
 401     for (i = 0; i < netypes; ++i) {
 402         krb5_keyblock *key;
 403
 404         ret = (*key_proc)(context, enctypes[i], *salt, keyseed, &key);
 405         if (ret)
 406             continue;
 407         ret = make_pa_enc_timestamp (context, &md->val[md->len],
 408                                      enctypes[i], key);
 409         krb5_free_keyblock (context, key);
 410         if (ret)
 411             return ret;
 412         ++md->len;
 413     }
 414     if(salt == &salt2)
 415         krb5_free_salt(context, salt2);
 416     return 0;
 417 }
 418
 419 static krb5_error_code
 420 init_as_req (krb5_context context,
 421              KDCOptions opts,
 422              krb5_creds *creds,
 423              const krb5_addresses *addrs,
 424              const krb5_enctype *etypes,
 425              const krb5_preauthtype *ptypes,
 426              const krb5_preauthdata *preauth,
 427              krb5_key_proc key_proc,
 428              krb5_const_pointer keyseed,
 429              unsigned nonce,
 430              AS_REQ *a)
 431 {
 432     krb5_error_code ret;
 433     krb5_salt salt;
 434
 435     memset(a, 0, sizeof(*a));
 436
 437     a->pvno = 5;
 438     a->msg_type = krb_as_req;
 439     a->req_body.kdc_options = opts;
 440     a->req_body.cname = malloc(sizeof(*a->req_body.cname));
 441     if (a->req_body.cname == NULL) {
 442         ret = ENOMEM;
 443         krb5_set_error_string(context, "malloc: out of memory");
 444         goto fail;
 445     }
 446     a->req_body.sname = malloc(sizeof(*a->req_body.sname));
 447     if (a->req_body.sname == NULL) {
 448         ret = ENOMEM;
 449         krb5_set_error_string(context, "malloc: out of memory");
 450         goto fail;
 451     }
 452     ret = _krb5_principal2principalname (a->req_body.cname, creds->client);
 453     if (ret)
 454         goto fail;
 455     ret = _krb5_principal2principalname (a->req_body.sname, creds->server);
 456     if (ret)
 457         goto fail;
 458     ret = copy_Realm(&creds->client->realm, &a->req_body.realm);
 459     if (ret)
 460         goto fail;
 461
 462     if(creds->times.starttime) {
 463         a->req_body.from = malloc(sizeof(*a->req_body.from));
 464         if (a->req_body.from == NULL) {
 465             ret = ENOMEM;
 466             krb5_set_error_string(context, "malloc: out of memory");
 467             goto fail;
 468         }
 469         *a->req_body.from = creds->times.starttime;
 470     }
 471     if(creds->times.endtime){
 472         ALLOC(a->req_body.till, 1);
 473         *a->req_body.till = creds->times.endtime;
 474     }
 475     if(creds->times.renew_till){
 476         a->req_body.rtime = malloc(sizeof(*a->req_body.rtime));
 477         if (a->req_body.rtime == NULL) {
 478             ret = ENOMEM;
 479             krb5_set_error_string(context, "malloc: out of memory");
 480             goto fail;
 481         }
 482         *a->req_body.rtime = creds->times.renew_till;
 483     }
 484     a->req_body.nonce = nonce;
 485     ret = krb5_init_etype (context,
 486                            &a->req_body.etype.len,
 487                            &a->req_body.etype.val,
 488                            etypes);
 489     if (ret)
 490         goto fail;
 491
 492     /*
 493      * This means no addresses
 494      */
 495
 496     if (addrs && addrs->len == 0) {
 497         a->req_body.addresses = NULL;
 498     } else {
 499         a->req_body.addresses = malloc(sizeof(*a->req_body.addresses));
 500         if (a->req_body.addresses == NULL) {
 501             ret = ENOMEM;
 502             krb5_set_error_string(context, "malloc: out of memory");
 503             goto fail;
 504         }
 505
 506         if (addrs)
 507             ret = krb5_copy_addresses(context, addrs, a->req_body.addresses);
 508         else {
 509             ret = krb5_get_all_client_addrs (context, a->req_body.addresses);
 510             if(ret == 0 && a->req_body.addresses->len == 0) {
 511                 free(a->req_body.addresses);
 512                 a->req_body.addresses = NULL;
 513             }
 514         }
 515         if (ret)
 516             return ret;
 517     }
 518
 519     a->req_body.enc_authorization_data = NULL;
 520     a->req_body.additional_tickets = NULL;
 521
 522     if(preauth != NULL) {
 523         int i;
 524         ALLOC(a->padata, 1);
 525         if(a->padata == NULL) {
 526             ret = ENOMEM;
 527             krb5_set_error_string(context, "malloc: out of memory");
 528             goto fail;
 529         }
 530         a->padata->val = NULL;
 531         a->padata->len = 0;
 532         for(i = 0; i < preauth->len; i++) {
 533             if(preauth->val[i].type == KRB5_PADATA_ENC_TIMESTAMP){
 534                 int j;
 535
 536                 for(j = 0; j < preauth->val[i].info.len; j++) {
 537                     krb5_salt *sp = &salt;
 538                     if(preauth->val[i].info.val[j].salttype)
 539                         salt.salttype = *preauth->val[i].info.val[j].salttype;
 540                     else
 541                         salt.salttype = KRB5_PW_SALT;
 542                     if(preauth->val[i].info.val[j].salt)
 543                         salt.saltvalue = *preauth->val[i].info.val[j].salt;
 544                     else
 545                         if(salt.salttype == KRB5_PW_SALT)
 546                             sp = NULL;
 547                         else
 548                             krb5_data_zero(&salt.saltvalue);
 549                     ret = add_padata(context, a->padata, creds->client,
 550                                      key_proc, keyseed,
 551                                      &preauth->val[i].info.val[j].etype, 1,
 552                                      sp);
 553                     if (ret == 0)
 554                         break;
 555                 }
 556             }
 557         }
 558     } else
 559     /* not sure this is the way to use `ptypes' */
 560     if (ptypes == NULL || *ptypes == KRB5_PADATA_NONE)
 561         a->padata = NULL;
 562     else if (*ptypes ==  KRB5_PADATA_ENC_TIMESTAMP) {
 563         ALLOC(a->padata, 1);
 564         if (a->padata == NULL) {
 565             ret = ENOMEM;
 566             krb5_set_error_string(context, "malloc: out of memory");
 567             goto fail;
 568         }
 569         a->padata->len = 0;
 570         a->padata->val = NULL;
 571
 572         /* make a v5 salted pa-data */
 573         add_padata(context, a->padata, creds->client,
 574                    key_proc, keyseed, a->req_body.etype.val,
 575                    a->req_body.etype.len, NULL);
 576
 577         /* make a v4 salted pa-data */
 578         salt.salttype = KRB5_PW_SALT;
 579         krb5_data_zero(&salt.saltvalue);
 580         add_padata(context, a->padata, creds->client,
 581                    key_proc, keyseed, a->req_body.etype.val,
 582                    a->req_body.etype.len, &salt);
 583     } else {
 584         krb5_set_error_string (context, "pre-auth type %d not supported",
 585                                *ptypes);
 586         ret = KRB5_PREAUTH_BAD_TYPE;
 587         goto fail;
 588     }
 589     return 0;
 590 fail:
 591     free_AS_REQ(a);
 592     return ret;
 593 }
 594
 595 static int
 596 set_ptypes(krb5_context context,
 597            KRB_ERROR *error,
 598            const krb5_preauthtype **ptypes,
 599            krb5_preauthdata **preauth)
 600 {
 601     static krb5_preauthdata preauth2;
 602     static krb5_preauthtype ptypes2[] = { KRB5_PADATA_ENC_TIMESTAMP, KRB5_PADATA_NONE };
 603
 604     if(error->e_data) {
 605         METHOD_DATA md;
 606         int i;
 607         decode_METHOD_DATA(error->e_data->data,
 608                            error->e_data->length,
 609                            &md,
 610                            NULL);
 611         for(i = 0; i < md.len; i++){
 612             switch(md.val[i].padata_type){
 613             case KRB5_PADATA_ENC_TIMESTAMP:
 614                 *ptypes = ptypes2;
 615                 break;
 616             case KRB5_PADATA_ETYPE_INFO:
 617                 *preauth = &preauth2;
 618                 ALLOC_SEQ(*preauth, 1);
 619                 (*preauth)->val[0].type = KRB5_PADATA_ENC_TIMESTAMP;
 620                 krb5_decode_ETYPE_INFO(context,
 621                                        md.val[i].padata_value.data,
 622                                        md.val[i].padata_value.length,
 623                                        &(*preauth)->val[0].info,
 624                                        NULL);
 625                 break;
 626             default:
 627                 break;
 628             }
 629         }
 630         free_METHOD_DATA(&md);
 631     } else {
 632         *ptypes = ptypes2;
 633     }
 634     return(1);
 635 }
 636
 637 krb5_error_code KRB5_LIB_FUNCTION
 638 krb5_get_in_cred(krb5_context context,
 639                  krb5_flags options,
 640                  const krb5_addresses *addrs,
 641                  const krb5_enctype *etypes,
 642                  const krb5_preauthtype *ptypes,
 643                  const krb5_preauthdata *preauth,
 644                  krb5_key_proc key_proc,
 645                  krb5_const_pointer keyseed,
 646                  krb5_decrypt_proc decrypt_proc,
 647                  krb5_const_pointer decryptarg,
 648                  krb5_creds *creds,
 649                  krb5_kdc_rep *ret_as_reply)
 650 {
 651     krb5_error_code ret;
 652     AS_REQ a;
 653     krb5_kdc_rep rep;
 654     krb5_data req, resp;
 655     size_t len;
 656     krb5_salt salt;
 657     krb5_keyblock *key;
 658     size_t size;
 659     KDCOptions opts;
 660     PA_DATA *pa;
 661     krb5_enctype etype;
 662     krb5_preauthdata *my_preauth = NULL;
 663     unsigned nonce;
 664     int done;
 665
 666     opts = int2KDCOptions(options);
 667
 668     krb5_generate_random_block (&nonce, sizeof(nonce));
 669     nonce &= 0xffffffff;
 670
 671     do {
 672         done = 1;
 673         ret = init_as_req (context,
 674                            opts,
 675                            creds,
 676                            addrs,
 677                            etypes,
 678                            ptypes,
 679                            preauth,
 680                            key_proc,
 681                            keyseed,
 682                            nonce,
 683                            &a);
 684         if (my_preauth) {
 685             free_ETYPE_INFO(&my_preauth->val[0].info);
 686             free (my_preauth->val);
 687             my_preauth = NULL;
 688         }
 689         if (ret)
 690             return ret;
 691
 692         ASN1_MALLOC_ENCODE(AS_REQ, req.data, req.length, &a, &len, ret);
 693         free_AS_REQ(&a);
 694         if (ret)
 695             return ret;
 696         if(len != req.length)
 697             krb5_abortx(context, "internal error in ASN.1 encoder");
 698
 699         ret = krb5_sendto_kdc (context, &req, &creds->client->realm, &resp);
 700         krb5_data_free(&req);
 701         if (ret)
 702             return ret;
 703
 704         memset (&rep, 0, sizeof(rep));
 705         ret = decode_AS_REP(resp.data, resp.length, &rep.kdc_rep, &size);
 706         if(ret) {
 707             /* let's try to parse it as a KRB-ERROR */
 708             KRB_ERROR error;
 709             int ret2;
 710
 711             ret2 = krb5_rd_error(context, &resp, &error);
 712             if(ret2 && resp.data && ((char*)resp.data)[0] == 4)
 713                 ret = KRB5KRB_AP_ERR_V4_REPLY;
 714             krb5_data_free(&resp);
 715             if (ret2 == 0) {
 716                 ret = krb5_error_from_rd_error(context, &error, creds);
 717                 /* if no preauth was set and KDC requires it, give it
 718                    one more try */
 719                 if (!ptypes && !preauth
 720                     && ret == KRB5KDC_ERR_PREAUTH_REQUIRED
 721 #if 0
 722                         || ret == KRB5KDC_ERR_BADOPTION
 723 #endif
 724                     && set_ptypes(context, &error, &ptypes, &my_preauth)) {
 725                     done = 0;
 726                     preauth = my_preauth;
 727                     krb5_free_error_contents(context, &error);
 728                     krb5_clear_error_string(context);
 729                     continue;
 730                 }
 731                 if(ret_as_reply)
 732                     ret_as_reply->error = error;
 733                 else
 734                     free_KRB_ERROR (&error);
 735                 return ret;
 736             }
 737             return ret;
 738         }
 739         krb5_data_free(&resp);
 740     } while(!done);
 741
 742     pa = NULL;
 743     etype = rep.kdc_rep.enc_part.etype;
 744     if(rep.kdc_rep.padata){
 745         int i = 0;
 746         pa = krb5_find_padata(rep.kdc_rep.padata->val, rep.kdc_rep.padata->len,
 747                               KRB5_PADATA_PW_SALT, &i);
 748         if(pa == NULL) {
 749             i = 0;
 750             pa = krb5_find_padata(rep.kdc_rep.padata->val,
 751                                   rep.kdc_rep.padata->len,
 752                                   KRB5_PADATA_AFS3_SALT, &i);
 753         }
 754     }
 755     if(pa) {
 756         salt.salttype = pa->padata_type;
 757         salt.saltvalue = pa->padata_value;
 758
 759         ret = (*key_proc)(context, etype, salt, keyseed, &key);
 760     } else {
 761         /* make a v5 salted pa-data */
 762         ret = krb5_get_pw_salt (context, creds->client, &salt);
 763
 764         if (ret)
 765             goto out;
 766         ret = (*key_proc)(context, etype, salt, keyseed, &key);
 767         krb5_free_salt(context, salt);
 768     }
 769     if (ret)
 770         goto out;
 771
 772     {
 773         unsigned flags = 0;
 774         if (opts.request_anonymous)
 775             flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
 776
 777         ret = _krb5_extract_ticket(context,
 778                                    &rep,
 779                                    creds,
 780                                    key,
 781                                    keyseed,
 782                                    KRB5_KU_AS_REP_ENC_PART,
 783                                    NULL,
 784                                    nonce,
 785                                    flags,
 786                                    decrypt_proc,
 787                                    decryptarg);
 788     }
 789     memset (key->keyvalue.data, 0, key->keyvalue.length);
 790     krb5_free_keyblock_contents (context, key);
 791     free (key);
 792
 793 out:
 794     if (ret == 0 && ret_as_reply)
 795         *ret_as_reply = rep;
 796     else
 797         krb5_free_kdc_rep (context, &rep);
 798     return ret;
 799 }
 800
 801 krb5_error_code KRB5_LIB_FUNCTION
 802 krb5_get_in_tkt(krb5_context context,
 803                 krb5_flags options,
 804                 const krb5_addresses *addrs,
 805                 const krb5_enctype *etypes,
 806                 const krb5_preauthtype *ptypes,
 807                 krb5_key_proc key_proc,
 808                 krb5_const_pointer keyseed,
 809                 krb5_decrypt_proc decrypt_proc,
 810                 krb5_const_pointer decryptarg,
 811                 krb5_creds *creds,
 812                 krb5_ccache ccache,
 813                 krb5_kdc_rep *ret_as_reply)
 814 {
 815     krb5_error_code ret;
 816
 817     ret = krb5_get_in_cred (context,
 818                             options,
 819                             addrs,
 820                             etypes,
 821                             ptypes,
 822                             NULL,
 823                             key_proc,
 824                             keyseed,
 825                             decrypt_proc,
 826                             decryptarg,
 827                             creds,
 828                             ret_as_reply);
 829     if(ret)
 830         return ret;
 831     if (ccache)
 832         ret = krb5_cc_store_cred (context, ccache, creds);
 833     return ret;
 834 }