lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 /*
  37  * Take the `body' and encode it into `padata' using the credentials
  38  * in `creds'.
  39  */
  40
  41 static krb5_error_code
  42 make_pa_tgs_req(krb5_context context,
  43                 krb5_auth_context ac,
  44                 KDC_REQ_BODY *body,
  45                 PA_DATA *padata,
  46                 krb5_creds *creds)
  47 {
  48     u_char *buf;
  49     size_t buf_size;
  50     size_t len;
  51     krb5_data in_data;
  52     krb5_error_code ret;
  53
  54     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  55     if (ret)
  56         goto out;
  57     if(buf_size != len)
  58         krb5_abortx(context, "internal error in ASN.1 encoder");
  59
  60     in_data.length = len;
  61     in_data.data   = buf;
  62     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  63                                 &padata->padata_value,
  64                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  65                                 KRB5_KU_TGS_REQ_AUTH);
  66  out:
  67     free (buf);
  68     if(ret)
  69         return ret;
  70     padata->padata_type = KRB5_PADATA_TGS_REQ;
  71     return 0;
  72 }
  73
  74 /*
  75  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  76  */
  77
  78 static krb5_error_code
  79 set_auth_data (krb5_context context,
  80                KDC_REQ_BODY *req_body,
  81                krb5_authdata *authdata,
  82                krb5_keyblock *key)
  83 {
  84     if(authdata->len) {
  85         size_t len, buf_size;
  86         unsigned char *buf;
  87         krb5_crypto crypto;
  88         krb5_error_code ret;
  89
  90         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  91                            &len, ret);
  92         if (ret)
  93             return ret;
  94         if (buf_size != len)
  95             krb5_abortx(context, "internal error in ASN.1 encoder");
  96
  97         ALLOC(req_body->enc_authorization_data, 1);
  98         if (req_body->enc_authorization_data == NULL) {
  99             free (buf);
 100             krb5_set_error_message(context, ENOMEM,
 101                                    N_("malloc: out of memory", ""));
 102             return ENOMEM;
 103         }
 104         ret = krb5_crypto_init(context, key, 0, &crypto);
 105         if (ret) {
 106             free (buf);
 107             free (req_body->enc_authorization_data);
 108             req_body->enc_authorization_data = NULL;
 109             return ret;
 110         }
 111         krb5_encrypt_EncryptedData(context,
 112                                    crypto,
 113                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 114                                    /* KRB5_KU_TGS_REQ_AUTH_DAT_SESSION? */
 115                                    buf,
 116                                    len,
 117                                    0,
 118                                    req_body->enc_authorization_data);
 119         free (buf);
 120         krb5_crypto_destroy(context, crypto);
 121     } else {
 122         req_body->enc_authorization_data = NULL;
 123     }
 124     return 0;
 125 }
 126
 127 /*
 128  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 129  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 130  * subkey in `subkey'.
 131  */
 132
 133 static krb5_error_code
 134 init_tgs_req (krb5_context context,
 135               krb5_ccache ccache,
 136               krb5_addresses *addresses,
 137               krb5_kdc_flags flags,
 138               Ticket *second_ticket,
 139               krb5_creds *in_creds,
 140               krb5_creds *krbtgt,
 141               unsigned nonce,
 142               const METHOD_DATA *padata,
 143               krb5_keyblock **subkey,
 144               TGS_REQ *t)
 145 {
 146     krb5_error_code ret = 0;
 147
 148     memset(t, 0, sizeof(*t));
 149     t->pvno = 5;
 150     t->msg_type = krb_tgs_req;
 151     if (in_creds->session.keytype) {
 152         ALLOC_SEQ(&t->req_body.etype, 1);
 153         if(t->req_body.etype.val == NULL) {
 154             ret = ENOMEM;
 155             krb5_set_error_message(context, ret,
 156                                    N_("malloc: out of memory", ""));
 157             goto fail;
 158         }
 159         t->req_body.etype.val[0] = in_creds->session.keytype;
 160     } else {
 161         ret = krb5_init_etype(context,
 162                               &t->req_body.etype.len,
 163                               &t->req_body.etype.val,
 164                               NULL);
 165     }
 166     if (ret)
 167         goto fail;
 168     t->req_body.addresses = addresses;
 169     t->req_body.kdc_options = flags.b;
 170     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 171     if (ret)
 172         goto fail;
 173     ALLOC(t->req_body.sname, 1);
 174     if (t->req_body.sname == NULL) {
 175         ret = ENOMEM;
 176         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 177         goto fail;
 178     }
 179
 180     /* some versions of some code might require that the client be
 181        present in TGS-REQs, but this is clearly against the spec */
 182
 183     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 184     if (ret)
 185         goto fail;
 186
 187     /* req_body.till should be NULL if there is no endtime specified,
 188        but old MIT code (like DCE secd) doesn't like that */
 189     ALLOC(t->req_body.till, 1);
 190     if(t->req_body.till == NULL){
 191         ret = ENOMEM;
 192         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 193         goto fail;
 194     }
 195     *t->req_body.till = in_creds->times.endtime;
 196
 197     t->req_body.nonce = nonce;
 198     if(second_ticket){
 199         ALLOC(t->req_body.additional_tickets, 1);
 200         if (t->req_body.additional_tickets == NULL) {
 201             ret = ENOMEM;
 202             krb5_set_error_message(context, ret,
 203                                    N_("malloc: out of memory", ""));
 204             goto fail;
 205         }
 206         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 207         if (t->req_body.additional_tickets->val == NULL) {
 208             ret = ENOMEM;
 209             krb5_set_error_message(context, ret,
 210                                    N_("malloc: out of memory", ""));
 211             goto fail;
 212         }
 213         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 214         if (ret)
 215             goto fail;
 216     }
 217     ALLOC(t->padata, 1);
 218     if (t->padata == NULL) {
 219         ret = ENOMEM;
 220         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 221         goto fail;
 222     }
 223     ALLOC_SEQ(t->padata, 1 + padata->len);
 224     if (t->padata->val == NULL) {
 225         ret = ENOMEM;
 226         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 227         goto fail;
 228     }
 229     {
 230         int i;
 231         for (i = 0; i < padata->len; i++) {
 232             ret = copy_PA_DATA(&padata->val[i], &t->padata->val[i + 1]);
 233             if (ret) {
 234                 krb5_set_error_message(context, ret,
 235                                        N_("malloc: out of memory", ""));
 236                 goto fail;
 237             }
 238         }
 239     }
 240
 241     {
 242         krb5_auth_context ac;
 243         krb5_keyblock *key = NULL;
 244
 245         ret = krb5_auth_con_init(context, &ac);
 246         if(ret)
 247             goto fail;
 248
 249         if (krb5_config_get_bool_default(context, NULL, FALSE,
 250                                          "realms",
 251                                          krbtgt->server->realm,
 252                                          "tgs_require_subkey",
 253                                          NULL))
 254         {
 255             ret = krb5_generate_subkey_extended(context, &krbtgt->session, ETYPE_NULL, &key);
 256             if (ret) {
 257                 krb5_auth_con_free (context, ac);
 258                 goto fail;
 259             }
 260
 261             ret = krb5_auth_con_setlocalsubkey(context, ac, key);
 262             if (ret) {
 263                 if (key)
 264                     krb5_free_keyblock (context, key);
 265                 krb5_auth_con_free (context, ac);
 266                 goto fail;
 267             }
 268         }
 269
 270         ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 271                              key ? key : &krbtgt->session);
 272         if (ret) {
 273             if (key)
 274                 krb5_free_keyblock (context, key);
 275             krb5_auth_con_free (context, ac);
 276             goto fail;
 277         }
 278
 279         ret = make_pa_tgs_req(context,
 280                               ac,
 281                               &t->req_body,
 282                               &t->padata->val[0],
 283                               krbtgt);
 284         if(ret) {
 285             if (key)
 286                 krb5_free_keyblock (context, key);
 287             krb5_auth_con_free(context, ac);
 288             goto fail;
 289         }
 290         *subkey = key;
 291
 292         krb5_auth_con_free(context, ac);
 293     }
 294 fail:
 295     if (ret) {
 296         t->req_body.addresses = NULL;
 297         free_TGS_REQ (t);
 298     }
 299     return ret;
 300 }
 301
 302 krb5_error_code
 303 _krb5_get_krbtgt(krb5_context context,
 304                  krb5_ccache  id,
 305                  krb5_realm realm,
 306                  krb5_creds **cred)
 307 {
 308     krb5_error_code ret;
 309     krb5_creds tmp_cred;
 310
 311     memset(&tmp_cred, 0, sizeof(tmp_cred));
 312
 313     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 314     if (ret)
 315         return ret;
 316
 317     ret = krb5_make_principal(context,
 318                               &tmp_cred.server,
 319                               realm,
 320                               KRB5_TGS_NAME,
 321                               realm,
 322                               NULL);
 323     if(ret) {
 324         krb5_free_principal(context, tmp_cred.client);
 325         return ret;
 326     }
 327     ret = krb5_get_credentials(context,
 328                                KRB5_GC_CACHED,
 329                                id,
 330                                &tmp_cred,
 331                                cred);
 332     krb5_free_principal(context, tmp_cred.client);
 333     krb5_free_principal(context, tmp_cred.server);
 334     if(ret)
 335         return ret;
 336     return 0;
 337 }
 338
 339 /* DCE compatible decrypt proc */
 340 static krb5_error_code
 341 decrypt_tkt_with_subkey (krb5_context context,
 342                          krb5_keyblock *key,
 343                          krb5_key_usage usage,
 344                          krb5_const_pointer subkey,
 345                          krb5_kdc_rep *dec_rep)
 346 {
 347     krb5_error_code ret;
 348     krb5_data data;
 349     size_t size;
 350     krb5_crypto crypto;
 351
 352     ret = krb5_crypto_init(context, key, 0, &crypto);
 353     if (ret)
 354         return ret;
 355     ret = krb5_decrypt_EncryptedData (context,
 356                                       crypto,
 357                                       usage,
 358                                       &dec_rep->kdc_rep.enc_part,
 359                                       &data);
 360     krb5_crypto_destroy(context, crypto);
 361     if(ret && subkey){
 362         /* DCE compat -- try to decrypt with subkey */
 363         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 364         if (ret)
 365             return ret;
 366         ret = krb5_decrypt_EncryptedData (context,
 367                                           crypto,
 368                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 369                                           &dec_rep->kdc_rep.enc_part,
 370                                           &data);
 371         krb5_crypto_destroy(context, crypto);
 372     }
 373     if (ret)
 374         return ret;
 375
 376     ret = decode_EncASRepPart(data.data,
 377                               data.length,
 378                               &dec_rep->enc_part,
 379                               &size);
 380     if (ret)
 381         ret = decode_EncTGSRepPart(data.data,
 382                                    data.length,
 383                                    &dec_rep->enc_part,
 384                                    &size);
 385     if (ret)
 386       krb5_set_error_message(context, ret,
 387                              N_("Failed to decode encpart in ticket", ""));
 388     krb5_data_free (&data);
 389     return ret;
 390 }
 391
 392 static krb5_error_code
 393 get_cred_kdc(krb5_context context,
 394              krb5_ccache id,
 395              krb5_kdc_flags flags,
 396              krb5_addresses *addresses,
 397              krb5_creds *in_creds,
 398              krb5_creds *krbtgt,
 399              krb5_principal impersonate_principal,
 400              Ticket *second_ticket,
 401              krb5_creds *out_creds)
 402 {
 403     TGS_REQ req;
 404     krb5_data enc;
 405     krb5_data resp;
 406     krb5_kdc_rep rep;
 407     KRB_ERROR error;
 408     krb5_error_code ret;
 409     unsigned nonce;
 410     krb5_keyblock *subkey = NULL;
 411     size_t len;
 412     Ticket second_ticket_data;
 413     METHOD_DATA padata;
 414
 415     krb5_data_zero(&resp);
 416     krb5_data_zero(&enc);
 417     padata.val = NULL;
 418     padata.len = 0;
 419
 420     krb5_generate_random_block(&nonce, sizeof(nonce));
 421     nonce &= 0xffffffff;
 422
 423     if(flags.b.enc_tkt_in_skey && second_ticket == NULL){
 424         ret = decode_Ticket(in_creds->second_ticket.data,
 425                             in_creds->second_ticket.length,
 426                             &second_ticket_data, &len);
 427         if(ret)
 428             return ret;
 429         second_ticket = &second_ticket_data;
 430     }
 431
 432
 433     if (impersonate_principal) {
 434         krb5_crypto crypto;
 435         PA_S4U2Self self;
 436         krb5_data data;
 437         void *buf;
 438         size_t size;
 439
 440         self.name = impersonate_principal->name;
 441         self.realm = impersonate_principal->realm;
 442         self.auth = estrdup("Kerberos");
 443
 444         ret = _krb5_s4u2self_to_checksumdata(context, &self, &data);
 445         if (ret) {
 446             free(self.auth);
 447             goto out;
 448         }
 449
 450         ret = krb5_crypto_init(context, &krbtgt->session, 0, &crypto);
 451         if (ret) {
 452             free(self.auth);
 453             krb5_data_free(&data);
 454             goto out;
 455         }
 456
 457         ret = krb5_create_checksum(context,
 458                                    crypto,
 459                                    KRB5_KU_OTHER_CKSUM,
 460                                    0,
 461                                    data.data,
 462                                    data.length,
 463                                    &self.cksum);
 464         krb5_crypto_destroy(context, crypto);
 465         krb5_data_free(&data);
 466         if (ret) {
 467             free(self.auth);
 468             goto out;
 469         }
 470
 471         ASN1_MALLOC_ENCODE(PA_S4U2Self, buf, len, &self, &size, ret);
 472         free(self.auth);
 473         free_Checksum(&self.cksum);
 474         if (ret)
 475             goto out;
 476         if (len != size)
 477             krb5_abortx(context, "internal asn1 error");
 478
 479         ret = krb5_padata_add(context, &padata, KRB5_PADATA_FOR_USER, buf, len);
 480         if (ret)
 481             goto out;
 482     }
 483
 484     ret = init_tgs_req (context,
 485                         id,
 486                         addresses,
 487                         flags,
 488                         second_ticket,
 489                         in_creds,
 490                         krbtgt,
 491                         nonce,
 492                         &padata,
 493                         &subkey,
 494                         &req);
 495     if (ret)
 496         goto out;
 497
 498     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 499     if (ret)
 500         goto out;
 501     if(enc.length != len)
 502         krb5_abortx(context, "internal error in ASN.1 encoder");
 503
 504     /* don't free addresses */
 505     req.req_body.addresses = NULL;
 506     free_TGS_REQ(&req);
 507
 508     /*
 509      * Send and receive
 510      */
 511     {
 512         krb5_sendto_ctx stctx;
 513         ret = krb5_sendto_ctx_alloc(context, &stctx);
 514         if (ret)
 515             return ret;
 516         krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
 517
 518         ret = krb5_sendto_context (context, stctx, &enc,
 519                                    krbtgt->server->name.name_string.val[1],
 520                                    &resp);
 521         krb5_sendto_ctx_free(context, stctx);
 522     }
 523     if(ret)
 524         goto out;
 525
 526     memset(&rep, 0, sizeof(rep));
 527     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
 528         unsigned eflags = 0;
 529
 530         ret = krb5_copy_principal(context,
 531                                   in_creds->client,
 532                                   &out_creds->client);
 533         if(ret)
 534             goto out2;
 535         ret = krb5_copy_principal(context,
 536                                   in_creds->server,
 537                                   &out_creds->server);
 538         if(ret)
 539             goto out2;
 540         /* this should go someplace else */
 541         out_creds->times.endtime = in_creds->times.endtime;
 542
 543         /* XXX should do better testing */
 544         if (flags.b.constrained_delegation || impersonate_principal)
 545             eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 546
 547         ret = _krb5_extract_ticket(context,
 548                                    &rep,
 549                                    out_creds,
 550                                    &krbtgt->session,
 551                                    NULL,
 552                                    KRB5_KU_TGS_REP_ENC_PART_SESSION,
 553                                    &krbtgt->addresses,
 554                                    nonce,
 555                                    eflags,
 556                                    decrypt_tkt_with_subkey,
 557                                    subkey);
 558     out2:
 559         krb5_free_kdc_rep(context, &rep);
 560     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 561         ret = krb5_error_from_rd_error(context, &error, in_creds);
 562         krb5_free_error_contents(context, &error);
 563     } else if(resp.length > 0 && ((char*)resp.data)[0] == 4) {
 564         ret = KRB5KRB_AP_ERR_V4_REPLY;
 565         krb5_clear_error_message(context);
 566     } else {
 567         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 568         krb5_clear_error_message(context);
 569     }
 570
 571 out:
 572     if (second_ticket == &second_ticket_data)
 573         free_Ticket(&second_ticket_data);
 574     free_METHOD_DATA(&padata);
 575     krb5_data_free(&resp);
 576     krb5_data_free(&enc);
 577     if(subkey){
 578         krb5_free_keyblock_contents(context, subkey);
 579         free(subkey);
 580     }
 581     return ret;
 582
 583 }
 584
 585 /*
 586  * same as above, just get local addresses first if the krbtgt have
 587  * them and the realm is not addressless
 588  */
 589
 590 static krb5_error_code
 591 get_cred_kdc_address(krb5_context context,
 592                      krb5_ccache id,
 593                      krb5_kdc_flags flags,
 594                      krb5_addresses *addrs,
 595                      krb5_creds *in_creds,
 596                      krb5_creds *krbtgt,
 597                      krb5_principal impersonate_principal,
 598                      Ticket *second_ticket,
 599                      krb5_creds *out_creds)
 600 {
 601     krb5_error_code ret;
 602     krb5_addresses addresses = { 0, NULL };
 603
 604     /*
 605      * Inherit the address-ness of the krbtgt if the address is not
 606      * specified.
 607      */
 608
 609     if (addrs == NULL && krbtgt->addresses.len != 0) {
 610         krb5_boolean noaddr;
 611
 612         krb5_appdefault_boolean(context, NULL, krbtgt->server->realm,
 613                                 "no-addresses", FALSE, &noaddr);
 614
 615         if (!noaddr) {
 616             krb5_get_all_client_addrs(context, &addresses);
 617             /* XXX this sucks. */
 618             addrs = &addresses;
 619             if(addresses.len == 0)
 620                 addrs = NULL;
 621         }
 622     }
 623     ret = get_cred_kdc(context, id, flags, addrs, in_creds,
 624                        krbtgt, impersonate_principal,
 625                        second_ticket, out_creds);
 626     krb5_free_addresses(context, &addresses);
 627     return ret;
 628 }
 629
 630 krb5_error_code KRB5_LIB_FUNCTION
 631 krb5_get_kdc_cred(krb5_context context,
 632                   krb5_ccache id,
 633                   krb5_kdc_flags flags,
 634                   krb5_addresses *addresses,
 635                   Ticket  *second_ticket,
 636                   krb5_creds *in_creds,
 637                   krb5_creds **out_creds
 638                   )
 639 {
 640     krb5_error_code ret;
 641     krb5_creds *krbtgt;
 642
 643     *out_creds = calloc(1, sizeof(**out_creds));
 644     if(*out_creds == NULL) {
 645         krb5_set_error_message(context, ENOMEM,
 646                                N_("malloc: out of memory", ""));
 647         return ENOMEM;
 648     }
 649     ret = _krb5_get_krbtgt (context,
 650                             id,
 651                             in_creds->server->realm,
 652                             &krbtgt);
 653     if(ret) {
 654         free(*out_creds);
 655         *out_creds = NULL;
 656         return ret;
 657     }
 658     ret = get_cred_kdc(context, id, flags, addresses,
 659                        in_creds, krbtgt, NULL, NULL, *out_creds);
 660     krb5_free_creds (context, krbtgt);
 661     if(ret) {
 662         free(*out_creds);
 663         *out_creds = NULL;
 664     }
 665     return ret;
 666 }
 667
 668 static int
 669 not_found(krb5_context context, krb5_const_principal p, krb5_error_code code)
 670 {
 671     krb5_error_code ret;
 672     char *str;
 673
 674     ret = krb5_unparse_name(context, p, &str);
 675     if(ret) {
 676         krb5_clear_error_message(context);
 677         return code;
 678     }
 679     krb5_set_error_message(context, code,
 680                            N_("Matching credential (%s) not found", ""), str);
 681     free(str);
 682     return code;
 683 }
 684
 685 static krb5_error_code
 686 find_cred(krb5_context context,
 687           krb5_ccache id,
 688           krb5_principal server,
 689           krb5_creds **tgts,
 690           krb5_creds *out_creds)
 691 {
 692     krb5_error_code ret;
 693     krb5_creds mcreds;
 694
 695     krb5_cc_clear_mcred(&mcreds);
 696     mcreds.server = server;
 697     ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
 698                                 &mcreds, out_creds);
 699     if(ret == 0)
 700         return 0;
 701     while(tgts && *tgts){
 702         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 703                               &mcreds, *tgts)){
 704             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 705             return ret;
 706         }
 707         tgts++;
 708     }
 709     return not_found(context, server, KRB5_CC_NOTFOUND);
 710 }
 711
 712 static krb5_error_code
 713 add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 714 {
 715     int i;
 716     krb5_error_code ret;
 717     krb5_creds **tmp = *tgts;
 718
 719     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 720     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 721     if(tmp == NULL) {
 722         krb5_set_error_message(context, ENOMEM,
 723                                N_("malloc: out of memory", ""));
 724         return ENOMEM;
 725     }
 726     *tgts = tmp;
 727     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 728     tmp[i+1] = NULL;
 729     return ret;
 730 }
 731
 732 /*
 733 get_cred(server)
 734         creds = cc_get_cred(server)
 735         if(creds) return creds
 736         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 737         if(tgt)
 738                 return get_cred_tgt(server, tgt)
 739         if(client_realm == server_realm)
 740                 return NULL
 741         tgt = get_cred(krbtgt/server_realm@client_realm)
 742         while(tgt_inst != server_realm)
 743                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 744         return get_cred_tgt(server, tgt)
 745         */
 746
 747 static krb5_error_code
 748 get_cred_kdc_capath(krb5_context context,
 749                     krb5_kdc_flags flags,
 750                     krb5_ccache ccache,
 751                     krb5_creds *in_creds,
 752                     krb5_principal impersonate_principal,
 753                     Ticket *second_ticket,
 754                     krb5_creds **out_creds,
 755                     krb5_creds ***ret_tgts)
 756 {
 757     krb5_error_code ret;
 758     krb5_creds *tgt, tmp_creds;
 759     krb5_const_realm client_realm, server_realm, try_realm;
 760     int ok_as_delegate = 1;
 761
 762     *out_creds = NULL;
 763
 764     client_realm = krb5_principal_get_realm(context, in_creds->client);
 765     server_realm = krb5_principal_get_realm(context, in_creds->server);
 766     memset(&tmp_creds, 0, sizeof(tmp_creds));
 767     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 768     if(ret)
 769         return ret;
 770
 771     try_realm = krb5_config_get_string(context, NULL, "capaths",
 772                                        client_realm, server_realm, NULL);
 773     if (try_realm == NULL)
 774         try_realm = client_realm;
 775
 776     ret = krb5_make_principal(context,
 777                               &tmp_creds.server,
 778                               try_realm,
 779                               KRB5_TGS_NAME,
 780                               server_realm,
 781                               NULL);
 782     if(ret){
 783         krb5_free_principal(context, tmp_creds.client);
 784         return ret;
 785     }
 786     {
 787         krb5_creds tgts;
 788
 789         ret = find_cred(context, ccache, tmp_creds.server,
 790                         *ret_tgts, &tgts);
 791         if(ret == 0){
 792             if (try_realm != client_realm)
 793                 ok_as_delegate = tgts.flags.b.ok_as_delegate;
 794
 795             *out_creds = calloc(1, sizeof(**out_creds));
 796             if(*out_creds == NULL) {
 797                 ret = ENOMEM;
 798                 krb5_set_error_message(context, ret,
 799                                        N_("malloc: out of memory", ""));
 800             } else {
 801                 ret = get_cred_kdc_address(context, ccache, flags, NULL,
 802                                            in_creds, &tgts,
 803                                            impersonate_principal,
 804                                            second_ticket,
 805                                            *out_creds);
 806                 if (ret) {
 807                     free (*out_creds);
 808                     *out_creds = NULL;
 809                 } else if (ok_as_delegate == 0)
 810                     (*out_creds)->flags.b.ok_as_delegate = 0;
 811             }
 812             krb5_free_cred_contents(context, &tgts);
 813             krb5_free_principal(context, tmp_creds.server);
 814             krb5_free_principal(context, tmp_creds.client);
 815             return ret;
 816         }
 817     }
 818     if(krb5_realm_compare(context, in_creds->client, in_creds->server))
 819         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 820
 821     /* XXX this can loop forever */
 822     while(1){
 823         heim_general_string tgt_inst;
 824
 825         ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 826                                   NULL, NULL, &tgt, ret_tgts);
 827         if(ret) {
 828             krb5_free_principal(context, tmp_creds.server);
 829             krb5_free_principal(context, tmp_creds.client);
 830             return ret;
 831         }
 832         /*
 833          * if either of the chain or the ok_as_delegate was stripped
 834          * by the kdc, make sure we strip it too.
 835          */
 836         if (ok_as_delegate == 0 || tgt->flags.b.ok_as_delegate == 0) {
 837             ok_as_delegate = 0;
 838             tgt->flags.b.ok_as_delegate = 0;
 839         }
 840
 841         ret = add_cred(context, tgt, ret_tgts);
 842         if(ret) {
 843             krb5_free_principal(context, tmp_creds.server);
 844             krb5_free_principal(context, tmp_creds.client);
 845             return ret;
 846         }
 847         tgt_inst = tgt->server->name.name_string.val[1];
 848         if(strcmp(tgt_inst, server_realm) == 0)
 849             break;
 850         krb5_free_principal(context, tmp_creds.server);
 851         ret = krb5_make_principal(context, &tmp_creds.server,
 852                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 853         if(ret) {
 854             krb5_free_principal(context, tmp_creds.server);
 855             krb5_free_principal(context, tmp_creds.client);
 856             return ret;
 857         }
 858         ret = krb5_free_creds(context, tgt);
 859         if(ret) {
 860             krb5_free_principal(context, tmp_creds.server);
 861             krb5_free_principal(context, tmp_creds.client);
 862             return ret;
 863         }
 864     }
 865
 866     krb5_free_principal(context, tmp_creds.server);
 867     krb5_free_principal(context, tmp_creds.client);
 868     *out_creds = calloc(1, sizeof(**out_creds));
 869     if(*out_creds == NULL) {
 870         ret = ENOMEM;
 871         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 872     } else {
 873         ret = get_cred_kdc_address (context, ccache, flags, NULL,
 874                                     in_creds, tgt, impersonate_principal,
 875                                     second_ticket, *out_creds);
 876         if (ret) {
 877             free (*out_creds);
 878             *out_creds = NULL;
 879         }
 880     }
 881     krb5_free_creds(context, tgt);
 882     return ret;
 883 }
 884
 885 static krb5_error_code
 886 get_cred_kdc_referral(krb5_context context,
 887                       krb5_kdc_flags flags,
 888                       krb5_ccache ccache,
 889                       krb5_creds *in_creds,
 890                       krb5_principal impersonate_principal,
 891                       Ticket *second_ticket,
 892                       krb5_creds **out_creds,
 893                       krb5_creds ***ret_tgts)
 894 {
 895     krb5_const_realm client_realm;
 896     krb5_error_code ret;
 897     krb5_creds tgt, referral, ticket;
 898     int loop = 0;
 899     int ok_as_delegate = 1;
 900
 901     if (in_creds->client->name.name_string.len < 2 && !flags.b.canonicalize) {
 902         krb5_set_error_message(context, KRB5KDC_ERR_PATH_NOT_ACCEPTED,
 903                                N_("Name too short to do referals, skipping", ""));
 904         return KRB5KDC_ERR_PATH_NOT_ACCEPTED;
 905     }
 906
 907     memset(&tgt, 0, sizeof(tgt));
 908     memset(&ticket, 0, sizeof(ticket));
 909
 910     flags.b.canonicalize = 1;
 911
 912     *out_creds = NULL;
 913
 914     client_realm = krb5_principal_get_realm(context, in_creds->client);
 915
 916     /* find tgt for the clients base realm */
 917     {
 918         krb5_principal tgtname;
 919
 920         ret = krb5_make_principal(context, &tgtname,
 921                                   client_realm,
 922                                   KRB5_TGS_NAME,
 923                                   client_realm,
 924                                   NULL);
 925         if(ret)
 926             return ret;
 927
 928         ret = find_cred(context, ccache, tgtname, *ret_tgts, &tgt);
 929         krb5_free_principal(context, tgtname);
 930         if (ret)
 931             return ret;
 932     }
 933
 934     referral = *in_creds;
 935     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
 936     if (ret) {
 937         krb5_free_cred_contents(context, &tgt);
 938         return ret;
 939     }
 940     ret = krb5_principal_set_realm(context, referral.server, client_realm);
 941     if (ret) {
 942         krb5_free_cred_contents(context, &tgt);
 943         krb5_free_principal(context, referral.server);
 944         return ret;
 945     }
 946
 947     while (loop++ < 17) {
 948         krb5_creds **tickets;
 949         krb5_creds mcreds;
 950         char *referral_realm;
 951
 952         /* Use cache if we are not doing impersonation or contrainte deleg */
 953         if (impersonate_principal == NULL || flags.b.constrained_delegation) {
 954             krb5_cc_clear_mcred(&mcreds);
 955             mcreds.server = referral.server;
 956             ret = krb5_cc_retrieve_cred(context, ccache, 0, &mcreds, &ticket);
 957         } else
 958             ret = EINVAL;
 959
 960         if (ret) {
 961             ret = get_cred_kdc_address (context, ccache, flags, NULL,
 962                                         &referral, &tgt, impersonate_principal,
 963                                         second_ticket, &ticket);
 964             if (ret)
 965                 goto out;
 966         }
 967
 968         /* Did we get the right ticket ? */
 969         if (krb5_principal_compare_any_realm(context,
 970                                              referral.server,
 971                                              ticket.server))
 972             break;
 973
 974         if (ticket.server->name.name_string.len != 2 &&
 975             strcmp(ticket.server->name.name_string.val[0], KRB5_TGS_NAME) != 0)
 976         {
 977             krb5_set_error_message(context, KRB5KRB_AP_ERR_NOT_US,
 978                                    N_("Got back an non krbtgt "
 979                                       "ticket referrals", ""));
 980             krb5_free_cred_contents(context, &ticket);
 981             return KRB5KRB_AP_ERR_NOT_US;
 982         }
 983
 984         referral_realm = ticket.server->name.name_string.val[1];
 985
 986         /* check that there are no referrals loops */
 987         tickets = *ret_tgts;
 988
 989         krb5_cc_clear_mcred(&mcreds);
 990         mcreds.server = ticket.server;
 991
 992         while(tickets && *tickets){
 993             if(krb5_compare_creds(context,
 994                                   KRB5_TC_DONT_MATCH_REALM,
 995                                   &mcreds,
 996                                   *tickets))
 997             {
 998                 krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
 999                                        N_("Referral from %s "
1000                                           "loops back to realm %s", ""),
1001                                        tgt.server->realm,
1002                                        referral_realm);
1003                 krb5_free_cred_contents(context, &ticket);
1004                 return KRB5_GET_IN_TKT_LOOP;
1005             }
1006             tickets++;
1007         }
1008
1009         /*
1010          * if either of the chain or the ok_as_delegate was stripped
1011          * by the kdc, make sure we strip it too.
1012          */
1013
1014         if (ok_as_delegate == 0 || ticket.flags.b.ok_as_delegate == 0) {
1015             ok_as_delegate = 0;
1016             ticket.flags.b.ok_as_delegate = 0;
1017         }
1018
1019         ret = add_cred(context, &ticket, ret_tgts);
1020         if (ret) {
1021             krb5_free_cred_contents(context, &ticket);
1022             goto out;
1023         }
1024
1025         /* try realm in the referral */
1026         ret = krb5_principal_set_realm(context,
1027                                        referral.server,
1028                                        referral_realm);
1029         krb5_free_cred_contents(context, &tgt);
1030         tgt = ticket;
1031         memset(&ticket, 0, sizeof(ticket));
1032         if (ret)
1033             goto out;
1034     }
1035
1036     ret = krb5_copy_creds(context, &ticket, out_creds);
1037
1038 out:
1039     krb5_free_principal(context, referral.server);
1040     krb5_free_cred_contents(context, &tgt);
1041     return ret;
1042 }
1043
1044
1045 /*
1046  * Glue function between referrals version and old client chasing
1047  * codebase.
1048  */
1049
1050 krb5_error_code
1051 _krb5_get_cred_kdc_any(krb5_context context,
1052                        krb5_kdc_flags flags,
1053                        krb5_ccache ccache,
1054                        krb5_creds *in_creds,
1055                        krb5_principal impersonate_principal,
1056                        Ticket *second_ticket,
1057                        krb5_creds **out_creds,
1058                        krb5_creds ***ret_tgts)
1059 {
1060     krb5_error_code ret;
1061
1062     ret = get_cred_kdc_referral(context,
1063                                 flags,
1064                                 ccache,
1065                                 in_creds,
1066                                 impersonate_principal,
1067                                 second_ticket,
1068                                 out_creds,
1069                                 ret_tgts);
1070     if (ret == 0 || flags.b.canonicalize)
1071         return ret;
1072     return get_cred_kdc_capath(context,
1073                                 flags,
1074                                 ccache,
1075                                 in_creds,
1076                                 impersonate_principal,
1077                                 second_ticket,
1078                                 out_creds,
1079                                 ret_tgts);
1080 }
1081
1082
1083 krb5_error_code KRB5_LIB_FUNCTION
1084 krb5_get_credentials_with_flags(krb5_context context,
1085                                 krb5_flags options,
1086                                 krb5_kdc_flags flags,
1087                                 krb5_ccache ccache,
1088                                 krb5_creds *in_creds,
1089                                 krb5_creds **out_creds)
1090 {
1091     krb5_error_code ret;
1092     krb5_creds **tgts;
1093     krb5_creds *res_creds;
1094     int i;
1095
1096     if (in_creds->session.keytype) {
1097         ret = krb5_enctype_valid(context, in_creds->session.keytype);
1098         if (ret)
1099             return ret;
1100     }
1101
1102     *out_creds = NULL;
1103     res_creds = calloc(1, sizeof(*res_creds));
1104     if (res_creds == NULL) {
1105         krb5_set_error_message(context, ENOMEM,
1106                                N_("malloc: out of memory", ""));
1107         return ENOMEM;
1108     }
1109
1110     if (in_creds->session.keytype)
1111         options |= KRB5_TC_MATCH_KEYTYPE;
1112
1113     /*
1114      * If we got a credential, check if credential is expired before
1115      * returning it.
1116      */
1117     ret = krb5_cc_retrieve_cred(context,
1118                                 ccache,
1119                                 in_creds->session.keytype ?
1120                                 KRB5_TC_MATCH_KEYTYPE : 0,
1121                                 in_creds, res_creds);
1122     /*
1123      * If we got a credential, check if credential is expired before
1124      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1125      */
1126     if (ret == 0) {
1127         krb5_timestamp timeret;
1128
1129         /* If expired ok, don't bother checking */
1130         if(options & KRB5_GC_EXPIRED_OK) {
1131             *out_creds = res_creds;
1132             return 0;
1133         }
1134
1135         krb5_timeofday(context, &timeret);
1136         if(res_creds->times.endtime > timeret) {
1137             *out_creds = res_creds;
1138             return 0;
1139         }
1140         if(options & KRB5_GC_CACHED)
1141             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1142
1143     } else if(ret != KRB5_CC_END) {
1144         free(res_creds);
1145         return ret;
1146     }
1147     free(res_creds);
1148     if(options & KRB5_GC_CACHED)
1149         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
1150
1151     if(options & KRB5_GC_USER_USER)
1152         flags.b.enc_tkt_in_skey = 1;
1153     if (flags.b.enc_tkt_in_skey)
1154         options |= KRB5_GC_NO_STORE;
1155
1156     tgts = NULL;
1157     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1158                                  in_creds, NULL, NULL, out_creds, &tgts);
1159     for(i = 0; tgts && tgts[i]; i++) {
1160         krb5_cc_store_cred(context, ccache, tgts[i]);
1161         krb5_free_creds(context, tgts[i]);
1162     }
1163     free(tgts);
1164     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1165         krb5_cc_store_cred(context, ccache, *out_creds);
1166     return ret;
1167 }
1168
1169 krb5_error_code KRB5_LIB_FUNCTION
1170 krb5_get_credentials(krb5_context context,
1171                      krb5_flags options,
1172                      krb5_ccache ccache,
1173                      krb5_creds *in_creds,
1174                      krb5_creds **out_creds)
1175 {
1176     krb5_kdc_flags flags;
1177     flags.i = 0;
1178     return krb5_get_credentials_with_flags(context, options, flags,
1179                                            ccache, in_creds, out_creds);
1180 }
1181
1182 struct krb5_get_creds_opt_data {
1183     krb5_principal self;
1184     krb5_flags options;
1185     krb5_enctype enctype;
1186     Ticket *ticket;
1187 };
1188
1189
1190 krb5_error_code KRB5_LIB_FUNCTION
1191 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
1192 {
1193     *opt = calloc(1, sizeof(**opt));
1194     if (*opt == NULL) {
1195         krb5_set_error_message(context, ENOMEM,
1196                                N_("malloc: out of memory", ""));
1197         return ENOMEM;
1198     }
1199     return 0;
1200 }
1201
1202 void KRB5_LIB_FUNCTION
1203 krb5_get_creds_opt_free(krb5_context context, krb5_get_creds_opt opt)
1204 {
1205     if (opt->self)
1206         krb5_free_principal(context, opt->self);
1207     if (opt->ticket) {
1208         free_Ticket(opt->ticket);
1209         free(opt->ticket);
1210     }
1211     memset(opt, 0, sizeof(*opt));
1212     free(opt);
1213 }
1214
1215 void KRB5_LIB_FUNCTION
1216 krb5_get_creds_opt_set_options(krb5_context context,
1217                                krb5_get_creds_opt opt,
1218                                krb5_flags options)
1219 {
1220     opt->options = options;
1221 }
1222
1223 void KRB5_LIB_FUNCTION
1224 krb5_get_creds_opt_add_options(krb5_context context,
1225                                krb5_get_creds_opt opt,
1226                                krb5_flags options)
1227 {
1228     opt->options |= options;
1229 }
1230
1231 void KRB5_LIB_FUNCTION
1232 krb5_get_creds_opt_set_enctype(krb5_context context,
1233                                krb5_get_creds_opt opt,
1234                                krb5_enctype enctype)
1235 {
1236     opt->enctype = enctype;
1237 }
1238
1239 krb5_error_code KRB5_LIB_FUNCTION
1240 krb5_get_creds_opt_set_impersonate(krb5_context context,
1241                                    krb5_get_creds_opt opt,
1242                                    krb5_const_principal self)
1243 {
1244     if (opt->self)
1245         krb5_free_principal(context, opt->self);
1246     return krb5_copy_principal(context, self, &opt->self);
1247 }
1248
1249 krb5_error_code KRB5_LIB_FUNCTION
1250 krb5_get_creds_opt_set_ticket(krb5_context context,
1251                               krb5_get_creds_opt opt,
1252                               const Ticket *ticket)
1253 {
1254     if (opt->ticket) {
1255         free_Ticket(opt->ticket);
1256         free(opt->ticket);
1257         opt->ticket = NULL;
1258     }
1259     if (ticket) {
1260         krb5_error_code ret;
1261
1262         opt->ticket = malloc(sizeof(*ticket));
1263         if (opt->ticket == NULL) {
1264             krb5_set_error_message(context, ENOMEM,
1265                                    N_("malloc: out of memory", ""));
1266             return ENOMEM;
1267         }
1268         ret = copy_Ticket(ticket, opt->ticket);
1269         if (ret) {
1270             free(opt->ticket);
1271             opt->ticket = NULL;
1272             krb5_set_error_message(context, ret,
1273                                    N_("malloc: out of memory", ""));
1274             return ret;
1275         }
1276     }
1277     return 0;
1278 }
1279
1280
1281
1282 krb5_error_code KRB5_LIB_FUNCTION
1283 krb5_get_creds(krb5_context context,
1284                krb5_get_creds_opt opt,
1285                krb5_ccache ccache,
1286                krb5_const_principal inprinc,
1287                krb5_creds **out_creds)
1288 {
1289     krb5_kdc_flags flags;
1290     krb5_flags options;
1291     krb5_creds in_creds;
1292     krb5_error_code ret;
1293     krb5_creds **tgts;
1294     krb5_creds *res_creds;
1295     int i;
1296
1297     if (opt && opt->enctype) {
1298         ret = krb5_enctype_valid(context, opt->enctype);
1299         if (ret)
1300             return ret;
1301     }
1302
1303     memset(&in_creds, 0, sizeof(in_creds));
1304     in_creds.server = rk_UNCONST(inprinc);
1305
1306     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
1307     if (ret)
1308         return ret;
1309
1310     if (opt)
1311         options = opt->options;
1312     else
1313         options = 0;
1314     flags.i = 0;
1315
1316     *out_creds = NULL;
1317     res_creds = calloc(1, sizeof(*res_creds));
1318     if (res_creds == NULL) {
1319         krb5_free_principal(context, in_creds.client);
1320         krb5_set_error_message(context, ENOMEM,
1321                                N_("malloc: out of memory", ""));
1322         return ENOMEM;
1323     }
1324
1325     if (opt && opt->enctype) {
1326         in_creds.session.keytype = opt->enctype;
1327         options |= KRB5_TC_MATCH_KEYTYPE;
1328     }
1329
1330     /*
1331      * If we got a credential, check if credential is expired before
1332      * returning it.
1333      */
1334     ret = krb5_cc_retrieve_cred(context,
1335                                 ccache,
1336                                 options & KRB5_TC_MATCH_KEYTYPE,
1337                                 &in_creds, res_creds);
1338     /*
1339      * If we got a credential, check if credential is expired before
1340      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1341      */
1342     if (ret == 0) {
1343         krb5_timestamp timeret;
1344
1345         /* If expired ok, don't bother checking */
1346         if(options & KRB5_GC_EXPIRED_OK) {
1347             *out_creds = res_creds;
1348             krb5_free_principal(context, in_creds.client);
1349             return 0;
1350         }
1351
1352         krb5_timeofday(context, &timeret);
1353         if(res_creds->times.endtime > timeret) {
1354             *out_creds = res_creds;
1355             krb5_free_principal(context, in_creds.client);
1356             return 0;
1357         }
1358         if(options & KRB5_GC_CACHED)
1359             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1360
1361     } else if(ret != KRB5_CC_END) {
1362         free(res_creds);
1363         krb5_free_principal(context, in_creds.client);
1364         return ret;
1365     }
1366     free(res_creds);
1367     if(options & KRB5_GC_CACHED) {
1368         krb5_free_principal(context, in_creds.client);
1369         return not_found(context, in_creds.server, KRB5_CC_NOTFOUND);
1370     }
1371     if(options & KRB5_GC_USER_USER) {
1372         flags.b.enc_tkt_in_skey = 1;
1373         options |= KRB5_GC_NO_STORE;
1374     }
1375     if (options & KRB5_GC_FORWARDABLE)
1376         flags.b.forwardable = 1;
1377     if (options & KRB5_GC_NO_TRANSIT_CHECK)
1378         flags.b.disable_transited_check = 1;
1379     if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
1380         flags.b.request_anonymous = 1; /* XXX ARGH confusion */
1381         flags.b.constrained_delegation = 1;
1382     }
1383     if (options & KRB5_GC_CANONICALIZE)
1384         flags.b.canonicalize = 1;
1385
1386     tgts = NULL;
1387     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1388                                  &in_creds, opt->self, opt->ticket,
1389                                  out_creds, &tgts);
1390     krb5_free_principal(context, in_creds.client);
1391     for(i = 0; tgts && tgts[i]; i++) {
1392         krb5_cc_store_cred(context, ccache, tgts[i]);
1393         krb5_free_creds(context, tgts[i]);
1394     }
1395     free(tgts);
1396     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1397         krb5_cc_store_cred(context, ccache, *out_creds);
1398     return ret;
1399 }
1400
1401 /*
1402  *
1403  */
1404
1405 krb5_error_code KRB5_LIB_FUNCTION
1406 krb5_get_renewed_creds(krb5_context context,
1407                        krb5_creds *creds,
1408                        krb5_const_principal client,
1409                        krb5_ccache ccache,
1410                        const char *in_tkt_service)
1411 {
1412     krb5_error_code ret;
1413     krb5_kdc_flags flags;
1414     krb5_creds in, *template, *out = NULL;
1415
1416     memset(&in, 0, sizeof(in));
1417     memset(creds, 0, sizeof(*creds));
1418
1419     ret = krb5_copy_principal(context, client, &in.client);
1420     if (ret)
1421         return ret;
1422
1423     if (in_tkt_service) {
1424         ret = krb5_parse_name(context, in_tkt_service, &in.server);
1425         if (ret) {
1426             krb5_free_principal(context, in.client);
1427             return ret;
1428         }
1429     } else {
1430         const char *realm = krb5_principal_get_realm(context, client);
1431
1432         ret = krb5_make_principal(context, &in.server, realm, KRB5_TGS_NAME,
1433                                   realm, NULL);
1434         if (ret) {
1435             krb5_free_principal(context, in.client);
1436             return ret;
1437         }
1438     }
1439
1440     flags.i = 0;
1441     flags.b.renewable = flags.b.renew = 1;
1442
1443     /*
1444      * Get template from old credential cache for the same entry, if
1445      * this failes, no worries.
1446      */
1447     ret = krb5_get_credentials(context, KRB5_GC_CACHED, ccache, &in, &template);
1448     if (ret == 0) {
1449         flags.b.forwardable = template->flags.b.forwardable;
1450         flags.b.proxiable = template->flags.b.proxiable;
1451         krb5_free_creds (context, template);
1452     }
1453
1454     ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out);
1455     krb5_free_principal(context, in.client);
1456     krb5_free_principal(context, in.server);
1457     if (ret)
1458         return ret;
1459
1460     ret = krb5_copy_creds_contents(context, out, creds);
1461     krb5_free_creds(context, out);
1462
1463     return ret;
1464 }