lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "krb5_locl.h"
  37 #include <assert.h>
  38
  39 static krb5_error_code
  40 get_cred_kdc_capath(krb5_context, krb5_kdc_flags,
  41                     krb5_ccache, krb5_creds *, krb5_principal,
  42                     Ticket *, krb5_creds **, krb5_creds ***);
  43
  44 /*
  45  * Take the `body' and encode it into `padata' using the credentials
  46  * in `creds'.
  47  */
  48
  49 static krb5_error_code
  50 make_pa_tgs_req(krb5_context context,
  51                 krb5_auth_context ac,
  52                 KDC_REQ_BODY *body,
  53                 PA_DATA *padata,
  54                 krb5_creds *creds)
  55 {
  56     u_char *buf;
  57     size_t buf_size;
  58     size_t len = 0;
  59     krb5_data in_data;
  60     krb5_error_code ret;
  61
  62     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  63     if (ret)
  64         goto out;
  65     if(buf_size != len)
  66         krb5_abortx(context, "internal error in ASN.1 encoder");
  67
  68     in_data.length = len;
  69     in_data.data   = buf;
  70     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  71                                 &padata->padata_value,
  72                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  73                                 KRB5_KU_TGS_REQ_AUTH);
  74  out:
  75     free (buf);
  76     if(ret)
  77         return ret;
  78     padata->padata_type = KRB5_PADATA_TGS_REQ;
  79     return 0;
  80 }
  81
  82 /*
  83  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  84  */
  85
  86 static krb5_error_code
  87 set_auth_data (krb5_context context,
  88                KDC_REQ_BODY *req_body,
  89                krb5_authdata *authdata,
  90                krb5_keyblock *subkey)
  91 {
  92     if(authdata->len) {
  93         size_t len = 0, buf_size;
  94         unsigned char *buf;
  95         krb5_crypto crypto;
  96         krb5_error_code ret;
  97
  98         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  99                            &len, ret);
 100         if (ret)
 101             return ret;
 102         if (buf_size != len)
 103             krb5_abortx(context, "internal error in ASN.1 encoder");
 104
 105         ALLOC(req_body->enc_authorization_data, 1);
 106         if (req_body->enc_authorization_data == NULL) {
 107             free (buf);
 108             return krb5_enomem(context);
 109         }
 110         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 111         if (ret) {
 112             free (buf);
 113             free (req_body->enc_authorization_data);
 114             req_body->enc_authorization_data = NULL;
 115             return ret;
 116         }
 117         krb5_encrypt_EncryptedData(context,
 118                                    crypto,
 119                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 120                                    buf,
 121                                    len,
 122                                    0,
 123                                    req_body->enc_authorization_data);
 124         free (buf);
 125         krb5_crypto_destroy(context, crypto);
 126     } else {
 127         req_body->enc_authorization_data = NULL;
 128     }
 129     return 0;
 130 }
 131
 132 /*
 133  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 134  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 135  * subkey in `subkey'.
 136  */
 137
 138 static krb5_error_code
 139 init_tgs_req (krb5_context context,
 140               krb5_ccache ccache,
 141               krb5_addresses *addresses,
 142               krb5_kdc_flags flags,
 143               Ticket *second_ticket,
 144               krb5_creds *in_creds,
 145               krb5_creds *krbtgt,
 146               unsigned nonce,
 147               const METHOD_DATA *padata,
 148               krb5_keyblock **subkey,
 149               TGS_REQ *t)
 150 {
 151     krb5_auth_context ac = NULL;
 152     krb5_error_code ret = 0;
 153
 154     memset(t, 0, sizeof(*t));
 155     t->pvno = 5;
 156     t->msg_type = krb_tgs_req;
 157     if (in_creds->session.keytype) {
 158         ALLOC_SEQ(&t->req_body.etype, 1);
 159         if(t->req_body.etype.val == NULL) {
 160             ret = krb5_enomem(context);
 161             goto fail;
 162         }
 163         t->req_body.etype.val[0] = in_creds->session.keytype;
 164     } else {
 165         ret = _krb5_init_etype(context,
 166                                KRB5_PDU_TGS_REQUEST,
 167                                &t->req_body.etype.len,
 168                                &t->req_body.etype.val,
 169                                NULL);
 170     }
 171     if (ret)
 172         goto fail;
 173     t->req_body.addresses = addresses;
 174     t->req_body.kdc_options = flags.b;
 175     t->req_body.kdc_options.forwardable = krbtgt->flags.b.forwardable;
 176     t->req_body.kdc_options.renewable = krbtgt->flags.b.renewable;
 177     t->req_body.kdc_options.proxiable = krbtgt->flags.b.proxiable;
 178     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 179     if (ret)
 180         goto fail;
 181     ALLOC(t->req_body.sname, 1);
 182     if (t->req_body.sname == NULL) {
 183         ret = krb5_enomem(context);
 184         goto fail;
 185     }
 186
 187     /* some versions of some code might require that the client be
 188        present in TGS-REQs, but this is clearly against the spec */
 189
 190     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 191     if (ret)
 192         goto fail;
 193
 194     if (krbtgt->times.starttime) {
 195         ALLOC(t->req_body.from, 1);
 196         if(t->req_body.from == NULL){
 197             ret = krb5_enomem(context);
 198             goto fail;
 199         }
 200         *t->req_body.from = in_creds->times.starttime;
 201     }
 202
 203     /* req_body.till should be NULL if there is no endtime specified,
 204        but old MIT code (like DCE secd) doesn't like that */
 205     ALLOC(t->req_body.till, 1);
 206     if(t->req_body.till == NULL){
 207         ret = krb5_enomem(context);
 208         goto fail;
 209     }
 210     *t->req_body.till = in_creds->times.endtime;
 211
 212     if (t->req_body.kdc_options.renewable && krbtgt->times.renew_till) {
 213         ALLOC(t->req_body.rtime, 1);
 214         if(t->req_body.rtime == NULL){
 215             ret = krb5_enomem(context);
 216             goto fail;
 217         }
 218         *t->req_body.rtime = in_creds->times.renew_till;
 219     }
 220
 221     t->req_body.nonce = nonce;
 222     if(second_ticket){
 223         ALLOC(t->req_body.additional_tickets, 1);
 224         if (t->req_body.additional_tickets == NULL) {
 225             ret = krb5_enomem(context);
 226             goto fail;
 227         }
 228         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 229         if (t->req_body.additional_tickets->val == NULL) {
 230             ret = krb5_enomem(context);
 231             goto fail;
 232         }
 233         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 234         if (ret)
 235             goto fail;
 236     }
 237     ALLOC(t->padata, 1);
 238     if (t->padata == NULL) {
 239         ret = krb5_enomem(context);
 240         goto fail;
 241     }
 242     ALLOC_SEQ(t->padata, 1 + padata->len);
 243     if (t->padata->val == NULL) {
 244         ret = krb5_enomem(context);
 245         goto fail;
 246     }
 247     {
 248         size_t i;
 249         for (i = 0; i < padata->len; i++) {
 250             ret = copy_PA_DATA(&padata->val[i], &t->padata->val[i + 1]);
 251             if (ret) {
 252                 krb5_set_error_message(context, ret,
 253                                        N_("malloc: out of memory", ""));
 254                 goto fail;
 255             }
 256         }
 257     }
 258
 259     ret = krb5_auth_con_init(context, &ac);
 260     if(ret)
 261         goto fail;
 262
 263     ret = krb5_auth_con_generatelocalsubkey(context, ac, &krbtgt->session);
 264     if (ret)
 265         goto fail;
 266
 267     ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 268                          ac->local_subkey);
 269     if (ret)
 270         goto fail;
 271
 272     ret = make_pa_tgs_req(context,
 273                           ac,
 274                           &t->req_body,
 275                           &t->padata->val[0],
 276                           krbtgt);
 277     if(ret)
 278         goto fail;
 279
 280     ret = krb5_auth_con_getlocalsubkey(context, ac, subkey);
 281     if (ret)
 282         goto fail;
 283
 284 fail:
 285     if (ac)
 286         krb5_auth_con_free(context, ac);
 287     if (ret) {
 288         t->req_body.addresses = NULL;
 289         free_TGS_REQ (t);
 290     }
 291     return ret;
 292 }
 293
 294 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 295 _krb5_get_krbtgt(krb5_context context,
 296                  krb5_ccache  id,
 297                  krb5_realm realm,
 298                  krb5_creds **cred)
 299 {
 300     krb5_error_code ret;
 301     krb5_creds tmp_cred;
 302
 303     memset(&tmp_cred, 0, sizeof(tmp_cred));
 304
 305     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 306     if (ret)
 307         return ret;
 308
 309     ret = krb5_make_principal(context,
 310                               &tmp_cred.server,
 311                               realm,
 312                               KRB5_TGS_NAME,
 313                               realm,
 314                               NULL);
 315     if(ret) {
 316         krb5_free_principal(context, tmp_cred.client);
 317         return ret;
 318     }
 319     /*
 320      * The forwardable TGT might not be the start TGT, in which case, it is
 321      * generally, but not always already cached.  Just in case, get it again if
 322      * lost.
 323      */
 324     ret = krb5_get_credentials(context,
 325                                0,
 326                                id,
 327                                &tmp_cred,
 328                                cred);
 329     krb5_free_principal(context, tmp_cred.client);
 330     krb5_free_principal(context, tmp_cred.server);
 331     if(ret)
 332         return ret;
 333     return 0;
 334 }
 335
 336 /* DCE compatible decrypt proc */
 337 static krb5_error_code KRB5_CALLCONV
 338 decrypt_tkt_with_subkey (krb5_context context,
 339                          krb5_keyblock *key,
 340                          krb5_key_usage usage,
 341                          krb5_const_pointer skey,
 342                          krb5_kdc_rep *dec_rep)
 343 {
 344     const krb5_keyblock *subkey = skey;
 345     krb5_error_code ret = 0;
 346     krb5_data data;
 347     size_t size;
 348     krb5_crypto crypto;
 349
 350     assert(usage == 0);
 351
 352     krb5_data_zero(&data);
 353
 354     /*
 355      * start out with trying with subkey if we have one
 356      */
 357     if (subkey) {
 358         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 359         if (ret)
 360             return ret;
 361         ret = krb5_decrypt_EncryptedData (context,
 362                                           crypto,
 363                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 364                                           &dec_rep->kdc_rep.enc_part,
 365                                           &data);
 366         /*
 367          * If the is Windows 2000 DC, we need to retry with key usage
 368          * 8 when doing ARCFOUR.
 369          */
 370         if (ret && subkey->keytype == ETYPE_ARCFOUR_HMAC_MD5) {
 371             ret = krb5_decrypt_EncryptedData(context,
 372                                              crypto,
 373                                              8,
 374                                              &dec_rep->kdc_rep.enc_part,
 375                                              &data);
 376         }
 377         krb5_crypto_destroy(context, crypto);
 378     }
 379     if (subkey == NULL || ret) {
 380         ret = krb5_crypto_init(context, key, 0, &crypto);
 381         if (ret)
 382             return ret;
 383         ret = krb5_decrypt_EncryptedData (context,
 384                                           crypto,
 385                                           KRB5_KU_TGS_REP_ENC_PART_SESSION,
 386                                           &dec_rep->kdc_rep.enc_part,
 387                                           &data);
 388         krb5_crypto_destroy(context, crypto);
 389     }
 390     if (ret)
 391         return ret;
 392
 393     ret = decode_EncASRepPart(data.data,
 394                               data.length,
 395                               &dec_rep->enc_part,
 396                               &size);
 397     if (ret)
 398         ret = decode_EncTGSRepPart(data.data,
 399                                    data.length,
 400                                    &dec_rep->enc_part,
 401                                    &size);
 402     if (ret)
 403       krb5_set_error_message(context, ret,
 404                              N_("Failed to decode encpart in ticket", ""));
 405     krb5_data_free (&data);
 406     return ret;
 407 }
 408
 409 static krb5_error_code
 410 get_cred_kdc(krb5_context context,
 411              krb5_ccache id,
 412              krb5_kdc_flags flags,
 413              krb5_addresses *addresses,
 414              krb5_creds *in_creds,
 415              krb5_creds *krbtgt,
 416              krb5_principal impersonate_principal,
 417              Ticket *second_ticket,
 418              krb5_creds *out_creds)
 419 {
 420     TGS_REQ req;
 421     krb5_data enc;
 422     krb5_data resp;
 423     krb5_kdc_rep rep;
 424     KRB_ERROR error;
 425     krb5_error_code ret;
 426     unsigned nonce;
 427     krb5_keyblock *subkey = NULL;
 428     size_t len = 0;
 429     Ticket second_ticket_data;
 430     METHOD_DATA padata;
 431
 432     krb5_data_zero(&resp);
 433     krb5_data_zero(&enc);
 434     padata.val = NULL;
 435     padata.len = 0;
 436
 437     krb5_generate_random_block(&nonce, sizeof(nonce));
 438     nonce &= 0xffffffff;
 439
 440     if(flags.b.enc_tkt_in_skey && second_ticket == NULL){
 441         ret = decode_Ticket(in_creds->second_ticket.data,
 442                             in_creds->second_ticket.length,
 443                             &second_ticket_data, &len);
 444         if(ret)
 445             return ret;
 446         second_ticket = &second_ticket_data;
 447     }
 448
 449
 450     if (impersonate_principal) {
 451         krb5_crypto crypto;
 452         PA_S4U2Self self;
 453         krb5_data data;
 454         void *buf;
 455         size_t size = 0;
 456
 457         self.name = impersonate_principal->name;
 458         self.realm = impersonate_principal->realm;
 459         self.auth = estrdup("Kerberos");
 460
 461         ret = _krb5_s4u2self_to_checksumdata(context, &self, &data);
 462         if (ret) {
 463             free(self.auth);
 464             goto out;
 465         }
 466
 467         ret = krb5_crypto_init(context, &krbtgt->session, 0, &crypto);
 468         if (ret) {
 469             free(self.auth);
 470             krb5_data_free(&data);
 471             goto out;
 472         }
 473
 474         ret = krb5_create_checksum(context,
 475                                    crypto,
 476                                    KRB5_KU_OTHER_CKSUM,
 477                                    0,
 478                                    data.data,
 479                                    data.length,
 480                                    &self.cksum);
 481         krb5_crypto_destroy(context, crypto);
 482         krb5_data_free(&data);
 483         if (ret) {
 484             free(self.auth);
 485             goto out;
 486         }
 487
 488         ASN1_MALLOC_ENCODE(PA_S4U2Self, buf, len, &self, &size, ret);
 489         free(self.auth);
 490         free_Checksum(&self.cksum);
 491         if (ret)
 492             goto out;
 493         if (len != size)
 494             krb5_abortx(context, "internal asn1 error");
 495
 496         ret = krb5_padata_add(context, &padata, KRB5_PADATA_FOR_USER, buf, len);
 497         if (ret)
 498             goto out;
 499     }
 500
 501     ret = init_tgs_req (context,
 502                         id,
 503                         addresses,
 504                         flags,
 505                         second_ticket,
 506                         in_creds,
 507                         krbtgt,
 508                         nonce,
 509                         &padata,
 510                         &subkey,
 511                         &req);
 512     if (ret)
 513         goto out;
 514
 515     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 516     if (ret)
 517         goto out;
 518     if(enc.length != len)
 519         krb5_abortx(context, "internal error in ASN.1 encoder");
 520
 521     /* don't free addresses */
 522     req.req_body.addresses = NULL;
 523     free_TGS_REQ(&req);
 524
 525     /*
 526      * Send and receive
 527      */
 528     {
 529         krb5_sendto_ctx stctx;
 530         ret = krb5_sendto_ctx_alloc(context, &stctx);
 531         if (ret)
 532             return ret;
 533         krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
 534
 535         ret = krb5_sendto_context (context, stctx, &enc,
 536                                    krbtgt->server->name.name_string.val[1],
 537                                    &resp);
 538         krb5_sendto_ctx_free(context, stctx);
 539     }
 540     if(ret)
 541         goto out;
 542
 543     memset(&rep, 0, sizeof(rep));
 544     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
 545         unsigned eflags = 0;
 546
 547         ret = krb5_copy_principal(context,
 548                                   in_creds->client,
 549                                   &out_creds->client);
 550         if(ret)
 551             goto out2;
 552         ret = krb5_copy_principal(context,
 553                                   in_creds->server,
 554                                   &out_creds->server);
 555         if(ret)
 556             goto out2;
 557         /* this should go someplace else */
 558         out_creds->times.endtime = in_creds->times.endtime;
 559
 560         /* XXX should do better testing */
 561         if (flags.b.constrained_delegation || impersonate_principal)
 562             eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 563
 564         ret = _krb5_extract_ticket(context,
 565                                    &rep,
 566                                    out_creds,
 567                                    &krbtgt->session,
 568                                    NULL,
 569                                    0,
 570                                    &krbtgt->addresses,
 571                                    nonce,
 572                                    eflags,
 573                                    NULL,
 574                                    decrypt_tkt_with_subkey,
 575                                    subkey);
 576     out2:
 577         krb5_free_kdc_rep(context, &rep);
 578     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 579         ret = krb5_error_from_rd_error(context, &error, in_creds);
 580         krb5_free_error_contents(context, &error);
 581     } else if(resp.length > 0 && ((char*)resp.data)[0] == 4) {
 582         ret = KRB5KRB_AP_ERR_V4_REPLY;
 583         krb5_clear_error_message(context);
 584     } else {
 585         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 586         krb5_clear_error_message(context);
 587     }
 588
 589 out:
 590     if (second_ticket == &second_ticket_data)
 591         free_Ticket(&second_ticket_data);
 592     free_METHOD_DATA(&padata);
 593     krb5_data_free(&resp);
 594     krb5_data_free(&enc);
 595     if(subkey)
 596         krb5_free_keyblock(context, subkey);
 597     return ret;
 598
 599 }
 600
 601 /*
 602  * same as above, just get local addresses first if the krbtgt have
 603  * them and the realm is not addressless
 604  */
 605
 606 static krb5_error_code
 607 get_cred_kdc_address(krb5_context context,
 608                      krb5_ccache id,
 609                      krb5_kdc_flags flags,
 610                      krb5_addresses *addrs,
 611                      krb5_creds *in_creds,
 612                      krb5_creds *krbtgt,
 613                      krb5_principal impersonate_principal,
 614                      Ticket *second_ticket,
 615                      krb5_creds *out_creds)
 616 {
 617     krb5_error_code ret;
 618     krb5_addresses addresses = { 0, NULL };
 619
 620     /*
 621      * Inherit the address-ness of the krbtgt if the address is not
 622      * specified.
 623      */
 624
 625     if (addrs == NULL && krbtgt->addresses.len != 0) {
 626         krb5_boolean noaddr;
 627
 628         krb5_appdefault_boolean(context, NULL, krbtgt->server->realm,
 629                                 "no-addresses", FALSE, &noaddr);
 630
 631         if (!noaddr) {
 632             krb5_get_all_client_addrs(context, &addresses);
 633             /* XXX this sucks. */
 634             addrs = &addresses;
 635             if(addresses.len == 0)
 636                 addrs = NULL;
 637         }
 638     }
 639     ret = get_cred_kdc(context, id, flags, addrs, in_creds,
 640                        krbtgt, impersonate_principal,
 641                        second_ticket, out_creds);
 642     krb5_free_addresses(context, &addresses);
 643     return ret;
 644 }
 645
 646 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 647 krb5_get_kdc_cred(krb5_context context,
 648                   krb5_ccache id,
 649                   krb5_kdc_flags flags,
 650                   krb5_addresses *addresses,
 651                   Ticket  *second_ticket,
 652                   krb5_creds *in_creds,
 653                   krb5_creds **out_creds
 654                   )
 655 {
 656     krb5_error_code ret;
 657     krb5_creds *krbtgt;
 658
 659     *out_creds = calloc(1, sizeof(**out_creds));
 660     if(*out_creds == NULL)
 661         return krb5_enomem(context);
 662     ret = _krb5_get_krbtgt (context,
 663                             id,
 664                             in_creds->server->realm,
 665                             &krbtgt);
 666     if(ret) {
 667         free(*out_creds);
 668         *out_creds = NULL;
 669         return ret;
 670     }
 671     ret = get_cred_kdc(context, id, flags, addresses,
 672                        in_creds, krbtgt, NULL, NULL, *out_creds);
 673     krb5_free_creds (context, krbtgt);
 674     if(ret) {
 675         free(*out_creds);
 676         *out_creds = NULL;
 677     }
 678     return ret;
 679 }
 680
 681 static int
 682 not_found(krb5_context context, krb5_const_principal p, krb5_error_code code)
 683 {
 684     krb5_error_code ret;
 685     char *str;
 686
 687     ret = krb5_unparse_name(context, p, &str);
 688     if(ret) {
 689         krb5_clear_error_message(context);
 690         return code;
 691     }
 692     krb5_set_error_message(context, code,
 693                            N_("Matching credential (%s) not found", ""), str);
 694     free(str);
 695     return code;
 696 }
 697
 698 static krb5_error_code
 699 find_cred(krb5_context context,
 700           krb5_ccache id,
 701           krb5_principal server,
 702           krb5_creds **tgts,
 703           krb5_creds *out_creds)
 704 {
 705     krb5_error_code ret;
 706     krb5_creds mcreds;
 707
 708     krb5_cc_clear_mcred(&mcreds);
 709     mcreds.server = server;
 710     krb5_timeofday(context, &mcreds.times.endtime);
 711     ret = krb5_cc_retrieve_cred(context, id,
 712                                 KRB5_TC_DONT_MATCH_REALM |
 713                                 KRB5_TC_MATCH_TIMES,
 714                                 &mcreds, out_creds);
 715     if(ret == 0)
 716         return 0;
 717     while(tgts && *tgts){
 718         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 719                               &mcreds, *tgts)){
 720             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 721             return ret;
 722         }
 723         tgts++;
 724     }
 725     return not_found(context, server, KRB5_CC_NOTFOUND);
 726 }
 727
 728 static krb5_error_code
 729 add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 730 {
 731     int i;
 732     krb5_error_code ret;
 733     krb5_creds **tmp = *tgts;
 734
 735     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 736     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 737     if(tmp == NULL)
 738         return krb5_enomem(context);
 739     *tgts = tmp;
 740     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 741     tmp[i+1] = NULL;
 742     return ret;
 743 }
 744
 745 static krb5_error_code
 746 get_cred_kdc_capath_worker(krb5_context context,
 747                            krb5_kdc_flags flags,
 748                            krb5_ccache ccache,
 749                            krb5_creds *in_creds,
 750                            krb5_const_realm try_realm,
 751                            krb5_principal impersonate_principal,
 752                            Ticket *second_ticket,
 753                            krb5_creds **out_creds,
 754                            krb5_creds ***ret_tgts)
 755 {
 756     krb5_error_code ret;
 757     krb5_creds *tgt = NULL;
 758     krb5_creds tmp_creds;
 759     krb5_const_realm client_realm, server_realm;
 760     int ok_as_delegate = 1;
 761
 762     *out_creds = calloc(1, sizeof(**out_creds));
 763     if (*out_creds == NULL)
 764         return krb5_enomem(context);
 765
 766     memset(&tmp_creds, 0, sizeof(tmp_creds));
 767
 768     client_realm = krb5_principal_get_realm(context, in_creds->client);
 769     server_realm = krb5_principal_get_realm(context, in_creds->server);
 770     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 771     if (ret)
 772         goto out;
 773
 774     ret = krb5_make_principal(context,
 775                               &tmp_creds.server,
 776                               try_realm,
 777                               KRB5_TGS_NAME,
 778                               server_realm,
 779                               NULL);
 780     if (ret)
 781         goto out;
 782
 783     {
 784         krb5_creds tgts;
 785
 786         /*
 787          * If we have krbtgt/server_realm@try_realm cached, use it and we're
 788          * done.
 789          */
 790         ret = find_cred(context, ccache, tmp_creds.server,
 791                         *ret_tgts, &tgts);
 792         if (ret == 0) {
 793             /* only allow implicit ok_as_delegate if the realm is the clients realm */
 794             if (strcmp(try_realm, client_realm) != 0
 795                  || strcmp(try_realm, server_realm) != 0) {
 796                 ok_as_delegate = tgts.flags.b.ok_as_delegate;
 797             }
 798
 799             ret = get_cred_kdc_address(context, ccache, flags, NULL,
 800                                    in_creds, &tgts,
 801                                    impersonate_principal,
 802                                    second_ticket,
 803                                    *out_creds);
 804             krb5_free_cred_contents(context, &tgts);
 805             if (ret == 0 &&
 806                 !krb5_principal_compare(context, in_creds->server,
 807                                         (*out_creds)->server)) {
 808                 ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
 809             }
 810             if (ret == 0 && ok_as_delegate == 0)
 811                 (*out_creds)->flags.b.ok_as_delegate = 0;
 812
 813             goto out;
 814         }
 815     }
 816
 817     if (krb5_realm_compare(context, in_creds->client, in_creds->server)) {
 818         ret = not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 819         goto out;
 820     }
 821
 822     /*
 823      * XXX This can loop forever, plus we recurse, so we can't just keep a
 824      * count here.  The count would have to get passed around by reference.
 825      *
 826      * The KDCs check for transit loops for us, and capath data is finite, so
 827      * in fact we'll fall out of this loop at some point.  We should do our own
 828      * transit loop checking (like get_cred_kdc_referral()), and we should
 829      * impose a max number of iterations altogether.  But barring malicious or
 830      * broken KDCs, this is good enough.
 831      */
 832     while (1) {
 833         heim_general_string tgt_inst;
 834
 835         ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 836                                   NULL, NULL, &tgt, ret_tgts);
 837         if (ret)
 838             goto out;
 839
 840         /*
 841          * if either of the chain or the ok_as_delegate was stripped
 842          * by the kdc, make sure we strip it too.
 843          */
 844         if (ok_as_delegate == 0 || tgt->flags.b.ok_as_delegate == 0) {
 845             ok_as_delegate = 0;
 846             tgt->flags.b.ok_as_delegate = 0;
 847         }
 848
 849         ret = add_cred(context, tgt, ret_tgts);
 850         if (ret)
 851             goto out;
 852         tgt_inst = tgt->server->name.name_string.val[1];
 853         if (strcmp(tgt_inst, server_realm) == 0)
 854             break;
 855         krb5_free_principal(context, tmp_creds.server);
 856         tmp_creds.server = NULL;
 857         ret = krb5_make_principal(context, &tmp_creds.server,
 858                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 859         if (ret)
 860             goto out;
 861         ret = krb5_free_creds(context, tgt);
 862         tgt = NULL;
 863         if (ret)
 864             goto out;
 865     }
 866
 867     ret = get_cred_kdc_address(context, ccache, flags, NULL,
 868                                in_creds, tgt, impersonate_principal,
 869                                second_ticket, *out_creds);
 870     if (ret == 0 &&
 871         !krb5_principal_compare(context, in_creds->server,
 872                                     (*out_creds)->server)) {
 873         krb5_free_cred_contents(context, *out_creds);
 874         ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
 875     }
 876     if (ret == 0 && ok_as_delegate == 0)
 877         (*out_creds)->flags.b.ok_as_delegate = 0;
 878
 879 out:
 880     if (ret) {
 881         krb5_free_creds(context, *out_creds);
 882         *out_creds = NULL;
 883     }
 884     if (tmp_creds.server)
 885         krb5_free_principal(context, tmp_creds.server);
 886     if (tmp_creds.client)
 887         krb5_free_principal(context, tmp_creds.client);
 888     if (tgt)
 889         krb5_free_creds(context, tgt);
 890     return ret;
 891 }
 892
 893 /*
 894 get_cred(server)
 895         creds = cc_get_cred(server)
 896         if(creds) return creds
 897         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 898         if(tgt)
 899                 return get_cred_tgt(server, tgt)
 900         if(client_realm == server_realm)
 901                 return NULL
 902         tgt = get_cred(krbtgt/server_realm@client_realm)
 903         while(tgt_inst != server_realm)
 904                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 905         return get_cred_tgt(server, tgt)
 906         */
 907
 908 static krb5_error_code
 909 get_cred_kdc_capath(krb5_context context,
 910                     krb5_kdc_flags flags,
 911                     krb5_ccache ccache,
 912                     krb5_creds *in_creds,
 913                     krb5_principal impersonate_principal,
 914                     Ticket *second_ticket,
 915                     krb5_creds **out_creds,
 916                     krb5_creds ***ret_tgts)
 917 {
 918     krb5_error_code ret;
 919     krb5_const_realm client_realm, server_realm, try_realm;
 920
 921     client_realm = krb5_principal_get_realm(context, in_creds->client);
 922     server_realm = krb5_principal_get_realm(context, in_creds->server);
 923
 924     try_realm = client_realm;
 925     ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds, try_realm,
 926                                      impersonate_principal, second_ticket, out_creds,
 927                                      ret_tgts);
 928
 929     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
 930         try_realm = krb5_config_get_string(context, NULL, "capaths",
 931                                            client_realm, server_realm, NULL);
 932
 933         if (try_realm != NULL && strcmp(try_realm, client_realm)) {
 934             ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds,
 935                                              try_realm, impersonate_principal,
 936                                              second_ticket, out_creds, ret_tgts);
 937         }
 938     }
 939
 940     return ret;
 941 }
 942
 943 /*
 944  * Get a service ticket from a KDC by chasing referrals from a start realm.
 945  *
 946  * All referral TGTs produced in the process are thrown away when we're done.
 947  * We don't store them, and we don't allow other search mechanisms (capaths) to
 948  * use referral TGTs produced here.
 949  */
 950 static krb5_error_code
 951 get_cred_kdc_referral(krb5_context context,
 952                       krb5_kdc_flags flags,
 953                       krb5_ccache ccache,
 954                       krb5_creds *in_creds,
 955                       krb5_principal impersonate_principal,
 956                       Ticket *second_ticket,
 957                       krb5_creds **out_creds)
 958 {
 959     krb5_realm start_realm = NULL;
 960     krb5_data config_start_realm;
 961     krb5_error_code ret;
 962     krb5_creds tgt, referral, ticket;
 963     krb5_creds **referral_tgts = NULL;  /* used for loop detection */
 964     int loop = 0;
 965     int ok_as_delegate = 1;
 966     size_t i;
 967
 968     if (in_creds->server->name.name_string.len < 2 && !flags.b.canonicalize) {
 969         krb5_set_error_message(context, KRB5KDC_ERR_PATH_NOT_ACCEPTED,
 970                                N_("Name too short to do referals, skipping", ""));
 971         return KRB5KDC_ERR_PATH_NOT_ACCEPTED;
 972     }
 973
 974     memset(&tgt, 0, sizeof(tgt));
 975     memset(&ticket, 0, sizeof(ticket));
 976
 977     flags.b.canonicalize = 1;
 978
 979     *out_creds = NULL;
 980
 981
 982     ret = krb5_cc_get_config(context, ccache, NULL, "start_realm", &config_start_realm);
 983     if (ret == 0) {
 984         start_realm = strndup(config_start_realm.data, config_start_realm.length);
 985         krb5_data_free(&config_start_realm);
 986     } else {
 987         start_realm = strdup(krb5_principal_get_realm(context, in_creds->client));
 988     }
 989     if (start_realm == NULL)
 990         return krb5_enomem(context);
 991
 992     /* find tgt for the clients base realm */
 993     {
 994         krb5_principal tgtname;
 995
 996         ret = krb5_make_principal(context, &tgtname,
 997                                   start_realm,
 998                                   KRB5_TGS_NAME,
 999                                   start_realm,
1000                                   NULL);
1001         if (ret) {
1002             free(start_realm);
1003             return ret;
1004         }
1005
1006         ret = find_cred(context, ccache, tgtname, NULL, &tgt);
1007         krb5_free_principal(context, tgtname);
1008         if (ret) {
1009             free(start_realm);
1010             return ret;
1011         }
1012     }
1013
1014     referral = *in_creds;
1015     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
1016     if (ret) {
1017         krb5_free_cred_contents(context, &tgt);
1018         free(start_realm);
1019         return ret;
1020     }
1021     ret = krb5_principal_set_realm(context, referral.server, start_realm);
1022     free(start_realm);
1023     start_realm = NULL;
1024     if (ret) {
1025         krb5_free_cred_contents(context, &tgt);
1026         krb5_free_principal(context, referral.server);
1027         return ret;
1028     }
1029
1030     while (loop++ < 17) {
1031         krb5_creds **tickets;
1032         krb5_creds mcreds;
1033         char *referral_realm;
1034
1035         /* Use cache if we are not doing impersonation or contrained deleg */
1036         if (impersonate_principal == NULL || flags.b.constrained_delegation) {
1037             krb5_cc_clear_mcred(&mcreds);
1038             mcreds.server = referral.server;
1039             krb5_timeofday(context, &mcreds.times.endtime);
1040             ret = krb5_cc_retrieve_cred(context, ccache, KRB5_TC_MATCH_TIMES,
1041                                         &mcreds, &ticket);
1042         } else
1043             ret = EINVAL;
1044
1045         if (ret) {
1046             ret = get_cred_kdc_address(context, ccache, flags, NULL,
1047                                        &referral, &tgt, impersonate_principal,
1048                                        second_ticket, &ticket);
1049             if (ret)
1050                 goto out;
1051         }
1052
1053         /* Did we get the right ticket ? */
1054         if (krb5_principal_compare_any_realm(context,
1055                                              referral.server,
1056                                              ticket.server))
1057             break;
1058
1059         if (!krb5_principal_is_krbtgt(context, ticket.server)) {
1060             krb5_set_error_message(context, KRB5KRB_AP_ERR_NOT_US,
1061                                    N_("Got back an non krbtgt "
1062                                       "ticket referrals", ""));
1063             ret = KRB5KRB_AP_ERR_NOT_US;
1064             goto out;
1065         }
1066
1067         referral_realm = ticket.server->name.name_string.val[1];
1068
1069         /* check that there are no referrals loops */
1070         tickets = referral_tgts;
1071
1072         krb5_cc_clear_mcred(&mcreds);
1073         mcreds.server = ticket.server;
1074
1075         while (tickets && *tickets){
1076             if (krb5_compare_creds(context,
1077                                   KRB5_TC_DONT_MATCH_REALM,
1078                                   &mcreds,
1079                                   *tickets)) {
1080                 krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
1081                                        N_("Referral from %s "
1082                                           "loops back to realm %s", ""),
1083                                        tgt.server->realm,
1084                                        referral_realm);
1085                 ret = KRB5_GET_IN_TKT_LOOP;
1086                 goto out;
1087             }
1088             tickets++;
1089         }
1090
1091         /*
1092          * if either of the chain or the ok_as_delegate was stripped
1093          * by the kdc, make sure we strip it too.
1094          */
1095
1096         if (ok_as_delegate == 0 || ticket.flags.b.ok_as_delegate == 0) {
1097             ok_as_delegate = 0;
1098             ticket.flags.b.ok_as_delegate = 0;
1099         }
1100
1101         _krb5_debug(context, 6, "get_cred_kdc_referral: got referral "
1102                     "to %s from %s", referral_realm, referral.server->realm);
1103         ret = add_cred(context, &ticket, &referral_tgts);
1104         if (ret)
1105             goto out;
1106
1107         /* try realm in the referral */
1108         ret = krb5_principal_set_realm(context,
1109                                        referral.server,
1110                                        referral_realm);
1111         krb5_free_cred_contents(context, &tgt);
1112         tgt = ticket;
1113         memset(&ticket, 0, sizeof(ticket));
1114         if (ret)
1115             goto out;
1116     }
1117
1118     ret = krb5_copy_creds(context, &ticket, out_creds);
1119
1120 out:
1121     for (i = 0; referral_tgts && referral_tgts[i]; i++)
1122         krb5_free_creds(context, referral_tgts[i]);
1123     free(referral_tgts);
1124     krb5_free_principal(context, referral.server);
1125     krb5_free_cred_contents(context, &tgt);
1126     krb5_free_cred_contents(context, &ticket);
1127     return ret;
1128 }
1129
1130
1131 /*
1132  * Glue function between referrals version and old client chasing
1133  * codebase.
1134  */
1135
1136 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1137 _krb5_get_cred_kdc_any(krb5_context context,
1138                        krb5_kdc_flags flags,
1139                        krb5_ccache ccache,
1140                        krb5_creds *in_creds,
1141                        krb5_principal impersonate_principal,
1142                        Ticket *second_ticket,
1143                        krb5_creds **out_creds,
1144                        krb5_creds ***ret_tgts)
1145 {
1146     krb5_error_code ret;
1147     krb5_deltat offset;
1148
1149     ret = krb5_cc_get_kdc_offset(context, ccache, &offset);
1150     if (ret == 0) {
1151         context->kdc_sec_offset = offset;
1152         context->kdc_usec_offset = 0;
1153     }
1154
1155     if (strcmp(in_creds->server->realm, "") != 0) {
1156         /*
1157          * Non-empty realm?  Try capaths first.  We might have local
1158          * policy (capaths) to honor.
1159          */
1160         ret = get_cred_kdc_capath(context,
1161                                   flags,
1162                                   ccache,
1163                                   in_creds,
1164                                   impersonate_principal,
1165                                   second_ticket,
1166                                   out_creds,
1167                                   ret_tgts);
1168         if (ret == 0)
1169             return ret;
1170     }
1171
1172     /* Otherwise try referrals */
1173     return get_cred_kdc_referral(context,
1174                                  flags,
1175                                  ccache,
1176                                  in_creds,
1177                                  impersonate_principal,
1178                                  second_ticket,
1179                                  out_creds);
1180 }
1181
1182 static krb5_error_code
1183 check_cc(krb5_context context, krb5_flags options, krb5_ccache ccache,
1184          krb5_creds *in_creds, krb5_creds *out_creds)
1185 {
1186     krb5_error_code ret;
1187     krb5_timestamp now;
1188     krb5_times save_times = in_creds->times;
1189     NAME_TYPE save_type = in_creds->server->name.name_type;
1190
1191     krb5_timeofday(context, &now);
1192
1193     if (!(options & KRB5_GC_EXPIRED_OK) &&
1194         in_creds->times.endtime < now) {
1195         in_creds->times.renew_till = 0;
1196         krb5_timeofday(context, &in_creds->times.endtime);
1197         options |= KRB5_TC_MATCH_TIMES;
1198     }
1199
1200     if (save_type == KRB5_NT_SRV_HST_NEEDS_CANON) {
1201         /* Avoid name canonicalization in krb5_cc_retrieve_cred() */
1202         krb5_principal_set_type(context, in_creds->server, KRB5_NT_SRV_HST);
1203     }
1204
1205     ret = krb5_cc_retrieve_cred(context, ccache,
1206                                 (options &
1207                                  (KRB5_TC_DONT_MATCH_REALM |
1208                                   KRB5_TC_MATCH_KEYTYPE |
1209                                   KRB5_TC_MATCH_TIMES)),
1210                                 in_creds, out_creds);
1211
1212     in_creds->server->name.name_type = save_type;
1213     in_creds->times = save_times;
1214     return ret;
1215 }
1216
1217 static void
1218 store_cred(krb5_context context, krb5_ccache ccache,
1219            krb5_const_principal server_princ, krb5_creds *creds)
1220 {
1221     if (!krb5_principal_compare(context, creds->server, server_princ)) {
1222         krb5_principal tmp_princ = creds->server;
1223         /*
1224          * Store the cred with the pre-canon server princ first so it
1225          * can be found quickly in the future.
1226          */
1227         creds->server = (krb5_principal)server_princ;
1228         krb5_cc_store_cred(context, ccache, creds);
1229         creds->server = tmp_princ;
1230         /* Then store again with the canonicalized server princ */
1231     }
1232     krb5_cc_store_cred(context, ccache, creds);
1233 }
1234
1235
1236 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1237 krb5_get_credentials_with_flags(krb5_context context,
1238                                 krb5_flags options,
1239                                 krb5_kdc_flags flags,
1240                                 krb5_ccache ccache,
1241                                 krb5_creds *in_creds,
1242                                 krb5_creds **out_creds)
1243 {
1244     krb5_error_code ret;
1245     krb5_name_canon_iterator name_canon_iter = NULL;
1246     krb5_name_canon_rule_options rule_opts;
1247     krb5_const_principal try_princ = NULL;
1248     krb5_principal save_princ = in_creds->server;
1249     krb5_creds **tgts;
1250     krb5_creds *res_creds;
1251     int i;
1252
1253     if (_krb5_have_debug(context, 5)) {
1254         char *unparsed;
1255
1256         ret = krb5_unparse_name(context, in_creds->server, &unparsed);
1257         if (ret) {
1258             _krb5_debug(context, 5, "krb5_get_creds: unable to display "
1259                         "requested service principal");
1260         } else {
1261             _krb5_debug(context, 5, "krb5_get_creds: requesting a ticket "
1262                         "for %s", unparsed);
1263             free(unparsed);
1264         }
1265     }
1266
1267     if (in_creds->session.keytype) {
1268         ret = krb5_enctype_valid(context, in_creds->session.keytype);
1269         if (ret)
1270             return ret;
1271         options |= KRB5_TC_MATCH_KEYTYPE;
1272     }
1273
1274     *out_creds = NULL;
1275     res_creds = calloc(1, sizeof(*res_creds));
1276     if (res_creds == NULL)
1277         return krb5_enomem(context);
1278
1279     ret = krb5_name_canon_iterator_start(context, in_creds->server,
1280                                          &name_canon_iter);
1281     if (ret)
1282         return ret;
1283
1284 next_rule:
1285     krb5_free_cred_contents(context, res_creds);
1286     memset(res_creds, 0, sizeof (*res_creds));
1287     ret = krb5_name_canon_iterate(context, &name_canon_iter, &try_princ,
1288                                   &rule_opts);
1289     in_creds->server = rk_UNCONST(try_princ);
1290     if (ret)
1291         goto out;
1292
1293     if (name_canon_iter == NULL) {
1294         if (options & KRB5_GC_CACHED)
1295             ret = KRB5_CC_NOTFOUND;
1296         else
1297             ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1298         goto out;
1299     }
1300
1301     ret = check_cc(context, options, ccache, in_creds, res_creds);
1302     if (ret == 0) {
1303         *out_creds = res_creds;
1304         res_creds = NULL;
1305         goto out;
1306     } else if(ret != KRB5_CC_END) {
1307         goto out;
1308     }
1309     if (options & KRB5_GC_CACHED)
1310         goto next_rule;
1311
1312     if(options & KRB5_GC_USER_USER)
1313         flags.b.enc_tkt_in_skey = 1;
1314     if (flags.b.enc_tkt_in_skey)
1315         options |= KRB5_GC_NO_STORE;
1316
1317     tgts = NULL;
1318     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1319                                  in_creds, NULL, NULL, out_creds, &tgts);
1320     for (i = 0; tgts && tgts[i]; i++) {
1321         if ((options & KRB5_GC_NO_STORE) == 0)
1322             krb5_cc_store_cred(context, ccache, tgts[i]);
1323         krb5_free_creds(context, tgts[i]);
1324     }
1325     free(tgts);
1326
1327     /* We don't yet have TGS w/ FAST, so we can't protect KBR-ERRORs */
1328     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN &&
1329         !(rule_opts & KRB5_NCRO_USE_FAST))
1330         goto next_rule;
1331
1332     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1333         store_cred(context, ccache, in_creds->server, *out_creds);
1334
1335     if (ret == 0 && _krb5_have_debug(context, 5)) {
1336         char *unparsed;
1337
1338         ret = krb5_unparse_name(context, (*out_creds)->server, &unparsed);
1339         if (ret) {
1340             _krb5_debug(context, 5, "krb5_get_creds: unable to display "
1341                         "service principal");
1342         } else {
1343             _krb5_debug(context, 5, "krb5_get_creds: got a ticket for %s",
1344                         unparsed);
1345             free(unparsed);
1346         }
1347     }
1348
1349 out:
1350     in_creds->server = save_princ;
1351     krb5_free_creds(context, res_creds);
1352     krb5_free_name_canon_iterator(context, name_canon_iter);
1353     if (ret)
1354         return not_found(context, in_creds->server, ret);
1355     return 0;
1356 }
1357
1358 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1359 krb5_get_credentials(krb5_context context,
1360                      krb5_flags options,
1361                      krb5_ccache ccache,
1362                      krb5_creds *in_creds,
1363                      krb5_creds **out_creds)
1364 {
1365     krb5_kdc_flags flags;
1366     flags.i = 0;
1367     return krb5_get_credentials_with_flags(context, options, flags,
1368                                            ccache, in_creds, out_creds);
1369 }
1370
1371 struct krb5_get_creds_opt_data {
1372     krb5_principal self;
1373     krb5_flags options;
1374     krb5_enctype enctype;
1375     Ticket *ticket;
1376 };
1377
1378
1379 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1380 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
1381 {
1382     *opt = calloc(1, sizeof(**opt));
1383     if (*opt == NULL)
1384         return krb5_enomem(context);
1385     return 0;
1386 }
1387
1388 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1389 krb5_get_creds_opt_free(krb5_context context, krb5_get_creds_opt opt)
1390 {
1391     if (opt->self)
1392         krb5_free_principal(context, opt->self);
1393     if (opt->ticket) {
1394         free_Ticket(opt->ticket);
1395         free(opt->ticket);
1396     }
1397     memset(opt, 0, sizeof(*opt));
1398     free(opt);
1399 }
1400
1401 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1402 krb5_get_creds_opt_set_options(krb5_context context,
1403                                krb5_get_creds_opt opt,
1404                                krb5_flags options)
1405 {
1406     opt->options = options;
1407 }
1408
1409 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1410 krb5_get_creds_opt_add_options(krb5_context context,
1411                                krb5_get_creds_opt opt,
1412                                krb5_flags options)
1413 {
1414     opt->options |= options;
1415 }
1416
1417 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1418 krb5_get_creds_opt_set_enctype(krb5_context context,
1419                                krb5_get_creds_opt opt,
1420                                krb5_enctype enctype)
1421 {
1422     opt->enctype = enctype;
1423 }
1424
1425 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1426 krb5_get_creds_opt_set_impersonate(krb5_context context,
1427                                    krb5_get_creds_opt opt,
1428                                    krb5_const_principal self)
1429 {
1430     if (opt->self)
1431         krb5_free_principal(context, opt->self);
1432     return krb5_copy_principal(context, self, &opt->self);
1433 }
1434
1435 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1436 krb5_get_creds_opt_set_ticket(krb5_context context,
1437                               krb5_get_creds_opt opt,
1438                               const Ticket *ticket)
1439 {
1440     if (opt->ticket) {
1441         free_Ticket(opt->ticket);
1442         free(opt->ticket);
1443         opt->ticket = NULL;
1444     }
1445     if (ticket) {
1446         krb5_error_code ret;
1447
1448         opt->ticket = malloc(sizeof(*ticket));
1449         if (opt->ticket == NULL)
1450             return krb5_enomem(context);
1451         ret = copy_Ticket(ticket, opt->ticket);
1452         if (ret) {
1453             free(opt->ticket);
1454             opt->ticket = NULL;
1455             krb5_set_error_message(context, ret,
1456                                    N_("malloc: out of memory", ""));
1457             return ret;
1458         }
1459     }
1460     return 0;
1461 }
1462
1463
1464 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1465 krb5_get_creds(krb5_context context,
1466                krb5_get_creds_opt opt,
1467                krb5_ccache ccache,
1468                krb5_const_principal inprinc,
1469                krb5_creds **out_creds)
1470 {
1471     krb5_kdc_flags flags;
1472     krb5_flags options;
1473     krb5_creds in_creds;
1474     krb5_error_code ret;
1475     krb5_creds **tgts;
1476     krb5_creds *res_creds;
1477     krb5_const_principal try_princ = NULL;
1478     krb5_name_canon_iterator name_canon_iter = NULL;
1479     krb5_name_canon_rule_options rule_opts;
1480     int i;
1481
1482     memset(&in_creds, 0, sizeof(in_creds));
1483     in_creds.server = rk_UNCONST(inprinc);
1484
1485     if (_krb5_have_debug(context, 5)) {
1486         char *unparsed;
1487
1488         ret = krb5_unparse_name(context, in_creds.server, &unparsed);
1489         if (ret) {
1490             _krb5_debug(context, 5, "krb5_get_creds: unable to display "
1491                         "requested service principal");
1492         } else {
1493             _krb5_debug(context, 5, "krb5_get_creds: requesting a ticket "
1494                         "for %s", unparsed);
1495             free(unparsed);
1496         }
1497     }
1498
1499     if (opt && opt->enctype) {
1500         ret = krb5_enctype_valid(context, opt->enctype);
1501         if (ret)
1502             return ret;
1503     }
1504
1505     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
1506     if (ret)
1507         return ret;
1508
1509     if (opt)
1510         options = opt->options;
1511     else
1512         options = 0;
1513     flags.i = 0;
1514
1515     *out_creds = NULL;
1516     res_creds = calloc(1, sizeof(*res_creds));
1517     if (res_creds == NULL) {
1518         krb5_free_principal(context, in_creds.client);
1519         return krb5_enomem(context);
1520     }
1521
1522     if (opt && opt->enctype) {
1523         in_creds.session.keytype = opt->enctype;
1524         options |= KRB5_TC_MATCH_KEYTYPE;
1525     }
1526
1527     ret = krb5_name_canon_iterator_start(context, in_creds.server,
1528                                          &name_canon_iter);
1529     if (ret)
1530         goto out;
1531
1532 next_rule:
1533     ret = krb5_name_canon_iterate(context, &name_canon_iter, &try_princ,
1534                                   &rule_opts);
1535     in_creds.server = rk_UNCONST(try_princ);
1536     if (ret)
1537         goto out;
1538
1539     if (name_canon_iter == NULL) {
1540         if (options & KRB5_GC_CACHED)
1541             ret = KRB5_CC_NOTFOUND;
1542         else
1543             ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1544         goto out;
1545     }
1546
1547     ret = check_cc(context, options, ccache, &in_creds, res_creds);
1548     if (ret == 0) {
1549         *out_creds = res_creds;
1550         res_creds = NULL;
1551         goto out;
1552     } else if (ret != KRB5_CC_END) {
1553         goto out;
1554     }
1555     if (options & KRB5_GC_CACHED)
1556         goto next_rule;
1557
1558     if (try_princ->name.name_type == KRB5_NT_SRV_HST)
1559         flags.b.canonicalize = 1;
1560     if (rule_opts & KRB5_NCRO_NO_REFERRALS)
1561         flags.b.canonicalize = 0;
1562     else
1563         flags.b.canonicalize = (options & KRB5_GC_CANONICALIZE) ? 1 : 0;
1564     if (options & KRB5_GC_USER_USER) {
1565         flags.b.enc_tkt_in_skey = 1;
1566         options |= KRB5_GC_NO_STORE;
1567     }
1568     if (options & KRB5_GC_FORWARDABLE)
1569         flags.b.forwardable = 1;
1570     if (options & KRB5_GC_NO_TRANSIT_CHECK)
1571         flags.b.disable_transited_check = 1;
1572     if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
1573         flags.b.request_anonymous = 1; /* XXX ARGH confusion */
1574         flags.b.constrained_delegation = 1;
1575     }
1576
1577     tgts = NULL;
1578     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1579                                  &in_creds, opt ? opt->self : 0,
1580                                  opt ? opt->ticket : 0, out_creds,
1581                                  &tgts);
1582     for (i = 0; tgts && tgts[i]; i++) {
1583         if ((options & KRB5_GC_NO_STORE) == 0)
1584             krb5_cc_store_cred(context, ccache, tgts[i]);
1585         krb5_free_creds(context, tgts[i]);
1586     }
1587     free(tgts);
1588
1589     /* We don't yet have TGS w/ FAST, so we can't protect KBR-ERRORs */
1590     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN &&
1591         !(rule_opts & KRB5_NCRO_USE_FAST))
1592         goto next_rule;
1593
1594     if (ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1595         store_cred(context, ccache, inprinc, *out_creds);
1596
1597     if (ret == 0 && _krb5_have_debug(context, 5)) {
1598         char *unparsed;
1599
1600         ret = krb5_unparse_name(context, (*out_creds)->server, &unparsed);
1601         if (ret) {
1602             _krb5_debug(context, 5, "krb5_get_creds: unable to display "
1603                         "service principal");
1604         } else {
1605             _krb5_debug(context, 5, "krb5_get_creds: got a ticket for %s",
1606                         unparsed);
1607             free(unparsed);
1608         }
1609     }
1610
1611 out:
1612     krb5_free_creds(context, res_creds);
1613     krb5_free_principal(context, in_creds.client);
1614     krb5_free_name_canon_iterator(context, name_canon_iter);
1615     if (ret)
1616         return not_found(context, inprinc, ret);
1617     return ret;
1618 }
1619
1620 /*
1621  *
1622  */
1623
1624 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1625 krb5_get_renewed_creds(krb5_context context,
1626                        krb5_creds *creds,
1627                        krb5_const_principal client,
1628                        krb5_ccache ccache,
1629                        const char *in_tkt_service)
1630 {
1631     krb5_error_code ret;
1632     krb5_kdc_flags flags;
1633     krb5_creds in, *template, *out = NULL;
1634
1635     memset(&in, 0, sizeof(in));
1636     memset(creds, 0, sizeof(*creds));
1637
1638     ret = krb5_copy_principal(context, client, &in.client);
1639     if (ret)
1640         return ret;
1641
1642     if (in_tkt_service) {
1643         ret = krb5_parse_name(context, in_tkt_service, &in.server);
1644         if (ret) {
1645             krb5_free_principal(context, in.client);
1646             return ret;
1647         }
1648     } else {
1649         const char *realm = krb5_principal_get_realm(context, client);
1650
1651         ret = krb5_make_principal(context, &in.server, realm, KRB5_TGS_NAME,
1652                                   realm, NULL);
1653         if (ret) {
1654             krb5_free_principal(context, in.client);
1655             return ret;
1656         }
1657     }
1658
1659     flags.i = 0;
1660     flags.b.renewable = flags.b.renew = 1;
1661
1662     /*
1663      * Get template from old credential cache for the same entry, if
1664      * this failes, no worries.
1665      */
1666     ret = krb5_get_credentials(context, KRB5_GC_CACHED, ccache, &in, &template);
1667     if (ret == 0) {
1668         flags.b.forwardable = template->flags.b.forwardable;
1669         flags.b.proxiable = template->flags.b.proxiable;
1670         krb5_free_creds (context, template);
1671     }
1672
1673     ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out);
1674     krb5_free_principal(context, in.client);
1675     krb5_free_principal(context, in.server);
1676     if (ret)
1677         return ret;
1678
1679     ret = krb5_copy_creds_contents(context, out, creds);
1680     krb5_free_creds(context, out);
1681
1682     return ret;
1683 }