lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 RCSID("$Id$");
  37
  38 /*
  39  * Take the `body' and encode it into `padata' using the credentials
  40  * in `creds'.
  41  */
  42
  43 static krb5_error_code
  44 make_pa_tgs_req(krb5_context context,
  45                 krb5_auth_context ac,
  46                 KDC_REQ_BODY *body,
  47                 PA_DATA *padata,
  48                 krb5_creds *creds,
  49                 krb5_key_usage usage)
  50 {
  51     u_char *buf;
  52     size_t buf_size;
  53     size_t len;
  54     krb5_data in_data;
  55     krb5_error_code ret;
  56
  57     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  58     if (ret)
  59         goto out;
  60     if(buf_size != len)
  61         krb5_abortx(context, "internal error in ASN.1 encoder");
  62
  63     in_data.length = len;
  64     in_data.data   = buf;
  65     ret = krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  66                                &padata->padata_value,
  67                                KRB5_KU_TGS_REQ_AUTH_CKSUM,
  68                                usage
  69                                /* KRB5_KU_TGS_REQ_AUTH */);
  70 out:
  71     free (buf);
  72     if(ret)
  73         return ret;
  74     padata->padata_type = KRB5_PADATA_TGS_REQ;
  75     return 0;
  76 }
  77
  78 /*
  79  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  80  */
  81
  82 static krb5_error_code
  83 set_auth_data (krb5_context context,
  84                KDC_REQ_BODY *req_body,
  85                krb5_authdata *authdata,
  86                krb5_keyblock *key)
  87 {
  88     if(authdata->len) {
  89         size_t len;
  90         unsigned char *buf;
  91         krb5_crypto crypto;
  92         krb5_error_code ret;
  93
  94         ASN1_MALLOC_ENCODE(AuthorizationData, buf, len, authdata, &len, ret);
  95         if (ret)
  96             return ret;
  97
  98         ALLOC(req_body->enc_authorization_data, 1);
  99         if (req_body->enc_authorization_data == NULL) {
 100             free (buf);
 101             krb5_set_error_string(context, "malloc: out of memory");
 102             return ENOMEM;
 103         }
 104         ret = krb5_crypto_init(context, key, 0, &crypto);
 105         if (ret) {
 106             free (buf);
 107             free (req_body->enc_authorization_data);
 108             return ret;
 109         }
 110         krb5_encrypt_EncryptedData(context,
 111                                    crypto,
 112                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 113                                    /* KRB5_KU_TGS_REQ_AUTH_DAT_SESSION? */
 114                                    buf,
 115                                    len,
 116                                    0,
 117                                    req_body->enc_authorization_data);
 118         free (buf);
 119         krb5_crypto_destroy(context, crypto);
 120     } else {
 121         req_body->enc_authorization_data = NULL;
 122     }
 123     return 0;
 124 }
 125
 126 /*
 127  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 128  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 129  * subkey in `subkey'.
 130  */
 131
 132 static krb5_error_code
 133 init_tgs_req (krb5_context context,
 134               krb5_ccache ccache,
 135               krb5_addresses *addresses,
 136               krb5_kdc_flags flags,
 137               Ticket *second_ticket,
 138               krb5_creds *in_creds,
 139               krb5_creds *krbtgt,
 140               unsigned nonce,
 141               krb5_keyblock **subkey,
 142               TGS_REQ *t,
 143               krb5_key_usage usage)
 144 {
 145     krb5_error_code ret = 0;
 146
 147     memset(t, 0, sizeof(*t));
 148     t->pvno = 5;
 149     t->msg_type = krb_tgs_req;
 150     if (in_creds->session.keytype) {
 151         ALLOC_SEQ(&t->req_body.etype, 1);
 152         if(t->req_body.etype.val == NULL) {
 153             ret = ENOMEM;
 154             krb5_set_error_string(context, "malloc: out of memory");
 155             goto fail;
 156         }
 157         t->req_body.etype.val[0] = in_creds->session.keytype;
 158     } else {
 159         ret = krb5_init_etype(context,
 160                               &t->req_body.etype.len,
 161                               &t->req_body.etype.val,
 162                               NULL);
 163     }
 164     if (ret)
 165         goto fail;
 166     t->req_body.addresses = addresses;
 167     t->req_body.kdc_options = flags.b;
 168     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 169     if (ret)
 170         goto fail;
 171     ALLOC(t->req_body.sname, 1);
 172     if (t->req_body.sname == NULL) {
 173         ret = ENOMEM;
 174         krb5_set_error_string(context, "malloc: out of memory");
 175         goto fail;
 176     }
 177
 178     /* some versions of some code might require that the client be
 179        present in TGS-REQs, but this is clearly against the spec */
 180
 181     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 182     if (ret)
 183         goto fail;
 184
 185     /* req_body.till should be NULL if there is no endtime specified,
 186        but old MIT code (like DCE secd) doesn't like that */
 187     ALLOC(t->req_body.till, 1);
 188     if(t->req_body.till == NULL){
 189         ret = ENOMEM;
 190         krb5_set_error_string(context, "malloc: out of memory");
 191         goto fail;
 192     }
 193     *t->req_body.till = in_creds->times.endtime;
 194
 195     t->req_body.nonce = nonce;
 196     if(second_ticket){
 197         ALLOC(t->req_body.additional_tickets, 1);
 198         if (t->req_body.additional_tickets == NULL) {
 199             ret = ENOMEM;
 200             krb5_set_error_string(context, "malloc: out of memory");
 201             goto fail;
 202         }
 203         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 204         if (t->req_body.additional_tickets->val == NULL) {
 205             ret = ENOMEM;
 206             krb5_set_error_string(context, "malloc: out of memory");
 207             goto fail;
 208         }
 209         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 210         if (ret)
 211             goto fail;
 212     }
 213     ALLOC(t->padata, 1);
 214     if (t->padata == NULL) {
 215         ret = ENOMEM;
 216         krb5_set_error_string(context, "malloc: out of memory");
 217         goto fail;
 218     }
 219     ALLOC_SEQ(t->padata, 1);
 220     if (t->padata->val == NULL) {
 221         ret = ENOMEM;
 222         krb5_set_error_string(context, "malloc: out of memory");
 223         goto fail;
 224     }
 225
 226     {
 227         krb5_auth_context ac;
 228         krb5_keyblock *key = NULL;
 229
 230         ret = krb5_auth_con_init(context, &ac);
 231         if(ret)
 232             goto fail;
 233
 234         if (krb5_config_get_bool_default(context, NULL, FALSE,
 235                                          "realms",
 236                                          krbtgt->server->realm,
 237                                          "tgs_require_subkey",
 238                                          NULL))
 239         {
 240             ret = krb5_generate_subkey (context, &krbtgt->session, &key);
 241             if (ret) {
 242                 krb5_auth_con_free (context, ac);
 243                 goto fail;
 244             }
 245
 246             ret = krb5_auth_con_setlocalsubkey(context, ac, key);
 247             if (ret) {
 248                 if (key)
 249                     krb5_free_keyblock (context, key);
 250                 krb5_auth_con_free (context, ac);
 251                 goto fail;
 252             }
 253         }
 254
 255         ret = set_auth_data (context, &t->req_body, &in_creds->authdata, key);
 256         if (ret) {
 257             if (key)
 258                 krb5_free_keyblock (context, key);
 259             krb5_auth_con_free (context, ac);
 260             goto fail;
 261         }
 262
 263         ret = make_pa_tgs_req(context,
 264                               ac,
 265                               &t->req_body,
 266                               t->padata->val,
 267                               krbtgt,
 268                               usage);
 269         if(ret) {
 270             if (key)
 271                 krb5_free_keyblock (context, key);
 272             krb5_auth_con_free(context, ac);
 273             goto fail;
 274         }
 275         *subkey = key;
 276
 277         krb5_auth_con_free(context, ac);
 278     }
 279 fail:
 280     if (ret) {
 281         t->req_body.addresses = NULL;
 282         free_TGS_REQ (t);
 283     }
 284     return ret;
 285 }
 286
 287 krb5_error_code
 288 _krb5_get_krbtgt(krb5_context context,
 289                  krb5_ccache  id,
 290                  krb5_realm realm,
 291                  krb5_creds **cred)
 292 {
 293     krb5_error_code ret;
 294     krb5_creds tmp_cred;
 295
 296     memset(&tmp_cred, 0, sizeof(tmp_cred));
 297
 298     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 299     if (ret)
 300         return ret;
 301
 302     ret = krb5_make_principal(context,
 303                               &tmp_cred.server,
 304                               realm,
 305                               KRB5_TGS_NAME,
 306                               realm,
 307                               NULL);
 308     if(ret) {
 309         krb5_free_principal(context, tmp_cred.client);
 310         return ret;
 311     }
 312     ret = krb5_get_credentials(context,
 313                                KRB5_GC_CACHED,
 314                                id,
 315                                &tmp_cred,
 316                                cred);
 317     krb5_free_principal(context, tmp_cred.client);
 318     krb5_free_principal(context, tmp_cred.server);
 319     if(ret)
 320         return ret;
 321     return 0;
 322 }
 323
 324 /* DCE compatible decrypt proc */
 325 static krb5_error_code
 326 decrypt_tkt_with_subkey (krb5_context context,
 327                          krb5_keyblock *key,
 328                          krb5_key_usage usage,
 329                          krb5_const_pointer subkey,
 330                          krb5_kdc_rep *dec_rep)
 331 {
 332     krb5_error_code ret;
 333     krb5_data data;
 334     size_t size;
 335     krb5_crypto crypto;
 336
 337     ret = krb5_crypto_init(context, key, 0, &crypto);
 338     if (ret)
 339         return ret;
 340     ret = krb5_decrypt_EncryptedData (context,
 341                                       crypto,
 342                                       usage,
 343                                       &dec_rep->kdc_rep.enc_part,
 344                                       &data);
 345     krb5_crypto_destroy(context, crypto);
 346     if(ret && subkey){
 347         /* DCE compat -- try to decrypt with subkey */
 348         ret = krb5_crypto_init(context, (krb5_keyblock*)subkey, 0, &crypto);
 349         if (ret)
 350             return ret;
 351         ret = krb5_decrypt_EncryptedData (context,
 352                                           crypto,
 353                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 354                                           &dec_rep->kdc_rep.enc_part,
 355                                           &data);
 356         krb5_crypto_destroy(context, crypto);
 357     }
 358     if (ret)
 359         return ret;
 360
 361     ret = krb5_decode_EncASRepPart(context,
 362                                    data.data,
 363                                    data.length,
 364                                    &dec_rep->enc_part,
 365                                    &size);
 366     if (ret)
 367         ret = krb5_decode_EncTGSRepPart(context,
 368                                         data.data,
 369                                         data.length,
 370                                         &dec_rep->enc_part,
 371                                         &size);
 372     krb5_data_free (&data);
 373     return ret;
 374 }
 375
 376 static krb5_error_code
 377 get_cred_kdc_usage(krb5_context context,
 378                    krb5_ccache id,
 379                    krb5_kdc_flags flags,
 380                    krb5_addresses *addresses,
 381                    krb5_creds *in_creds,
 382                    krb5_creds *krbtgt,
 383                    krb5_creds *out_creds,
 384                    krb5_key_usage usage)
 385 {
 386     TGS_REQ req;
 387     krb5_data enc;
 388     krb5_data resp;
 389     krb5_kdc_rep rep;
 390     KRB_ERROR error;
 391     krb5_error_code ret;
 392     unsigned nonce;
 393     krb5_keyblock *subkey = NULL;
 394     size_t len;
 395     Ticket second_ticket;
 396     int send_to_kdc_flags = 0;
 397
 398     krb5_data_zero(&resp);
 399     krb5_data_zero(&enc);
 400
 401     krb5_generate_random_block(&nonce, sizeof(nonce));
 402     nonce &= 0xffffffff;
 403
 404     if(flags.b.enc_tkt_in_skey){
 405         ret = decode_Ticket(in_creds->second_ticket.data,
 406                             in_creds->second_ticket.length,
 407                             &second_ticket, &len);
 408         if(ret)
 409             return ret;
 410     }
 411
 412     ret = init_tgs_req (context,
 413                         id,
 414                         addresses,
 415                         flags,
 416                         flags.b.enc_tkt_in_skey ? &second_ticket : NULL,
 417                         in_creds,
 418                         krbtgt,
 419                         nonce,
 420                         &subkey,
 421                         &req,
 422                         usage);
 423     if(flags.b.enc_tkt_in_skey)
 424         free_Ticket(&second_ticket);
 425     if (ret)
 426         goto out;
 427
 428     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 429     if (ret)
 430         goto out;
 431     if(enc.length != len)
 432         krb5_abortx(context, "internal error in ASN.1 encoder");
 433
 434     /* don't free addresses */
 435     req.req_body.addresses = NULL;
 436     free_TGS_REQ(&req);
 437
 438     /*
 439      * Send and receive
 440      */
 441 again:
 442     ret = krb5_sendto_kdc_flags (context, &enc,
 443                                  &krbtgt->server->name.name_string.val[1],
 444                                  &resp,
 445                                  send_to_kdc_flags);
 446     if(ret)
 447         goto out;
 448
 449     memset(&rep, 0, sizeof(rep));
 450     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0){
 451         ret = krb5_copy_principal(context,
 452                                   in_creds->client,
 453                                   &out_creds->client);
 454         if(ret)
 455             goto out;
 456         ret = krb5_copy_principal(context,
 457                                   in_creds->server,
 458                                   &out_creds->server);
 459         if(ret)
 460             goto out;
 461         /* this should go someplace else */
 462         out_creds->times.endtime = in_creds->times.endtime;
 463
 464         ret = _krb5_extract_ticket(context,
 465                                    &rep,
 466                                    out_creds,
 467                                    &krbtgt->session,
 468                                    NULL,
 469                                    KRB5_KU_TGS_REP_ENC_PART_SESSION,
 470                                    &krbtgt->addresses,
 471                                    nonce,
 472                                    TRUE,
 473                                    flags.b.request_anonymous,
 474                                    decrypt_tkt_with_subkey,
 475                                    subkey);
 476         krb5_free_kdc_rep(context, &rep);
 477     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 478         ret = krb5_error_from_rd_error(context, &error, in_creds);
 479         krb5_free_error_contents(context, &error);
 480
 481         if (ret == KRB5KRB_ERR_RESPONSE_TOO_BIG && !(send_to_kdc_flags & KRB5_KRBHST_FLAGS_LARGE_MSG)) {
 482             send_to_kdc_flags |= KRB5_KRBHST_FLAGS_LARGE_MSG;
 483             krb5_data_free(&resp);
 484             goto again;
 485         }
 486     } else if(resp.data && ((char*)resp.data)[0] == 4) {
 487         ret = KRB5KRB_AP_ERR_V4_REPLY;
 488         krb5_clear_error_string(context);
 489     } else {
 490         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 491         krb5_clear_error_string(context);
 492     }
 493
 494 out:
 495     krb5_data_free(&resp);
 496     krb5_data_free(&enc);
 497     if(subkey){
 498         krb5_free_keyblock_contents(context, subkey);
 499         free(subkey);
 500     }
 501     return ret;
 502
 503 }
 504
 505 static krb5_error_code
 506 get_cred_kdc(krb5_context context,
 507              krb5_ccache id,
 508              krb5_kdc_flags flags,
 509              krb5_addresses *addresses,
 510              krb5_creds *in_creds,
 511              krb5_creds *krbtgt,
 512              krb5_creds *out_creds)
 513 {
 514     krb5_error_code ret;
 515
 516     ret = get_cred_kdc_usage(context, id, flags, addresses, in_creds,
 517                              krbtgt, out_creds, KRB5_KU_TGS_REQ_AUTH);
 518     if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
 519         krb5_clear_error_string (context);
 520         ret = get_cred_kdc_usage(context, id, flags, addresses, in_creds,
 521                                  krbtgt, out_creds, KRB5_KU_AP_REQ_AUTH);
 522     }
 523     return ret;
 524 }
 525
 526 /* same as above, just get local addresses first */
 527
 528 static krb5_error_code
 529 get_cred_kdc_la(krb5_context context, krb5_ccache id, krb5_kdc_flags flags,
 530                 krb5_creds *in_creds, krb5_creds *krbtgt,
 531                 krb5_creds *out_creds)
 532 {
 533     krb5_error_code ret;
 534     krb5_addresses addresses, *addrs = &addresses;
 535
 536     krb5_get_all_client_addrs(context, &addresses);
 537     /* XXX this sucks. */
 538     if(addresses.len == 0)
 539         addrs = NULL;
 540     ret = get_cred_kdc(context, id, flags, addrs,
 541                        in_creds, krbtgt, out_creds);
 542     krb5_free_addresses(context, &addresses);
 543     return ret;
 544 }
 545
 546 krb5_error_code
 547 krb5_get_kdc_cred(krb5_context context,
 548                   krb5_ccache id,
 549                   krb5_kdc_flags flags,
 550                   krb5_addresses *addresses,
 551                   Ticket  *second_ticket,
 552                   krb5_creds *in_creds,
 553                   krb5_creds **out_creds
 554                   )
 555 {
 556     krb5_error_code ret;
 557     krb5_creds *krbtgt;
 558
 559     *out_creds = calloc(1, sizeof(**out_creds));
 560     if(*out_creds == NULL) {
 561         krb5_set_error_string(context, "malloc: out of memory");
 562         return ENOMEM;
 563     }
 564     ret = _krb5_get_krbtgt (context,
 565                             id,
 566                             in_creds->server->realm,
 567                             &krbtgt);
 568     if(ret) {
 569         free(*out_creds);
 570         return ret;
 571     }
 572     ret = get_cred_kdc(context, id, flags, addresses,
 573                        in_creds, krbtgt, *out_creds);
 574     krb5_free_creds (context, krbtgt);
 575     if(ret)
 576         free(*out_creds);
 577     return ret;
 578 }
 579
 580
 581 static krb5_error_code
 582 find_cred(krb5_context context,
 583           krb5_ccache id,
 584           krb5_principal server,
 585           krb5_creds **tgts,
 586           krb5_creds *out_creds)
 587 {
 588     krb5_error_code ret;
 589     krb5_creds mcreds;
 590     mcreds.server = server;
 591     ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
 592                                 &mcreds, out_creds);
 593     if(ret == 0)
 594         return 0;
 595     while(tgts && *tgts){
 596         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 597                               &mcreds, *tgts)){
 598             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 599             return ret;
 600         }
 601         tgts++;
 602     }
 603     krb5_clear_error_string(context);
 604     return KRB5_CC_NOTFOUND;
 605 }
 606
 607 static krb5_error_code
 608 add_cred(krb5_context context, krb5_creds ***tgts, krb5_creds *tkt)
 609 {
 610     int i;
 611     krb5_error_code ret;
 612     krb5_creds **tmp = *tgts;
 613
 614     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 615     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 616     if(tmp == NULL) {
 617         krb5_set_error_string(context, "malloc: out of memory");
 618         return ENOMEM;
 619     }
 620     *tgts = tmp;
 621     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 622     tmp[i+1] = NULL;
 623     return ret;
 624 }
 625
 626 /*
 627 get_cred(server)
 628         creds = cc_get_cred(server)
 629         if(creds) return creds
 630         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 631         if(tgt)
 632                 return get_cred_tgt(server, tgt)
 633         if(client_realm == server_realm)
 634                 return NULL
 635         tgt = get_cred(krbtgt/server_realm@client_realm)
 636         while(tgt_inst != server_realm)
 637                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 638         return get_cred_tgt(server, tgt)
 639         */
 640
 641 static krb5_error_code
 642 get_cred_from_kdc_flags(krb5_context context,
 643                         krb5_kdc_flags flags,
 644                         krb5_ccache ccache,
 645                         krb5_creds *in_creds,
 646                         krb5_creds **out_creds,
 647                         krb5_creds ***ret_tgts)
 648 {
 649     krb5_error_code ret;
 650     krb5_creds *tgt, tmp_creds;
 651     krb5_const_realm client_realm, server_realm, try_realm;
 652
 653     *out_creds = NULL;
 654
 655     client_realm = *krb5_princ_realm(context, in_creds->client);
 656     server_realm = *krb5_princ_realm(context, in_creds->server);
 657     memset(&tmp_creds, 0, sizeof(tmp_creds));
 658     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 659     if(ret)
 660         return ret;
 661
 662     try_realm = krb5_config_get_string(context, NULL, "capaths",
 663                                        client_realm, server_realm, NULL);
 664
 665 #if 1
 666     /* XXX remove in future release */
 667     if(try_realm == NULL)
 668         try_realm = krb5_config_get_string(context, NULL, "libdefaults",
 669                                            "capath", server_realm, NULL);
 670 #endif
 671
 672     if (try_realm == NULL)
 673         try_realm = client_realm;
 674
 675     ret = krb5_make_principal(context,
 676                               &tmp_creds.server,
 677                               try_realm,
 678                               KRB5_TGS_NAME,
 679                               server_realm,
 680                               NULL);
 681     if(ret){
 682         krb5_free_principal(context, tmp_creds.client);
 683         return ret;
 684     }
 685     {
 686         krb5_creds tgts;
 687         /* XXX try krb5_cc_retrieve_cred first? */
 688         ret = find_cred(context, ccache, tmp_creds.server,
 689                         *ret_tgts, &tgts);
 690         if(ret == 0){
 691             *out_creds = calloc(1, sizeof(**out_creds));
 692             if(*out_creds == NULL) {
 693                 krb5_set_error_string(context, "malloc: out of memory");
 694                 ret = ENOMEM;
 695             } else {
 696                 krb5_boolean noaddr;
 697
 698                 krb5_appdefault_boolean(context, NULL, tgts.server->realm,
 699                                         "no-addresses", FALSE, &noaddr);
 700
 701                 if (noaddr)
 702                     ret = get_cred_kdc(context, ccache, flags, NULL,
 703                                        in_creds, &tgts, *out_creds);
 704                 else
 705                     ret = get_cred_kdc_la(context, ccache, flags,
 706                                           in_creds, &tgts, *out_creds);
 707                 if (ret) {
 708                     free (*out_creds);
 709                     *out_creds = NULL;
 710                 }
 711             }
 712             krb5_free_creds_contents(context, &tgts);
 713             krb5_free_principal(context, tmp_creds.server);
 714             krb5_free_principal(context, tmp_creds.client);
 715             return ret;
 716         }
 717     }
 718     if(krb5_realm_compare(context, in_creds->client, in_creds->server)) {
 719         krb5_clear_error_string (context);
 720         return KRB5_CC_NOTFOUND;
 721     }
 722     /* XXX this can loop forever */
 723     while(1){
 724         general_string tgt_inst;
 725
 726         ret = get_cred_from_kdc_flags(context, flags, ccache, &tmp_creds,
 727                                       &tgt, ret_tgts);
 728         if(ret) {
 729             krb5_free_principal(context, tmp_creds.server);
 730             krb5_free_principal(context, tmp_creds.client);
 731             return ret;
 732         }
 733         ret = add_cred(context, ret_tgts, tgt);
 734         if(ret) {
 735             krb5_free_principal(context, tmp_creds.server);
 736             krb5_free_principal(context, tmp_creds.client);
 737             return ret;
 738         }
 739         tgt_inst = tgt->server->name.name_string.val[1];
 740         if(strcmp(tgt_inst, server_realm) == 0)
 741             break;
 742         krb5_free_principal(context, tmp_creds.server);
 743         ret = krb5_make_principal(context, &tmp_creds.server,
 744                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 745         if(ret) {
 746             krb5_free_principal(context, tmp_creds.server);
 747             krb5_free_principal(context, tmp_creds.client);
 748             return ret;
 749         }
 750         ret = krb5_free_creds(context, tgt);
 751         if(ret) {
 752             krb5_free_principal(context, tmp_creds.server);
 753             krb5_free_principal(context, tmp_creds.client);
 754             return ret;
 755         }
 756     }
 757
 758     krb5_free_principal(context, tmp_creds.server);
 759     krb5_free_principal(context, tmp_creds.client);
 760     *out_creds = calloc(1, sizeof(**out_creds));
 761     if(*out_creds == NULL) {
 762         krb5_set_error_string(context, "malloc: out of memory");
 763         ret = ENOMEM;
 764     } else {
 765         krb5_boolean noaddr;
 766
 767         krb5_appdefault_boolean(context, NULL, tgt->server->realm,
 768                                 "no-addresses", FALSE, &noaddr);
 769         if (noaddr)
 770             ret = get_cred_kdc (context, ccache, flags, NULL,
 771                                 in_creds, tgt, *out_creds);
 772         else
 773             ret = get_cred_kdc_la(context, ccache, flags,
 774                                   in_creds, tgt, *out_creds);
 775         if (ret) {
 776             free (*out_creds);
 777             *out_creds = NULL;
 778         }
 779     }
 780     krb5_free_creds(context, tgt);
 781     return ret;
 782 }
 783
 784 krb5_error_code
 785 krb5_get_cred_from_kdc_opt(krb5_context context,
 786                            krb5_ccache ccache,
 787                            krb5_creds *in_creds,
 788                            krb5_creds **out_creds,
 789                            krb5_creds ***ret_tgts,
 790                            krb5_flags flags)
 791 {
 792     krb5_kdc_flags f;
 793     f.i = flags;
 794     return get_cred_from_kdc_flags(context, f, ccache,
 795                                    in_creds, out_creds, ret_tgts);
 796 }
 797
 798 krb5_error_code
 799 krb5_get_cred_from_kdc(krb5_context context,
 800                        krb5_ccache ccache,
 801                        krb5_creds *in_creds,
 802                        krb5_creds **out_creds,
 803                        krb5_creds ***ret_tgts)
 804 {
 805     return krb5_get_cred_from_kdc_opt(context, ccache,
 806                                       in_creds, out_creds, ret_tgts, 0);
 807 }
 808
 809
 810 krb5_error_code
 811 krb5_get_credentials_with_flags(krb5_context context,
 812                                 krb5_flags options,
 813                                 krb5_kdc_flags flags,
 814                                 krb5_ccache ccache,
 815                                 krb5_creds *in_creds,
 816                                 krb5_creds **out_creds)
 817 {
 818     krb5_error_code ret;
 819     krb5_creds **tgts;
 820     krb5_creds *res_creds;
 821     int i;
 822
 823     *out_creds = NULL;
 824     res_creds = calloc(1, sizeof(*res_creds));
 825     if (res_creds == NULL) {
 826         krb5_set_error_string(context, "malloc: out of memory");
 827         return ENOMEM;
 828     }
 829
 830     ret = krb5_cc_retrieve_cred(context,
 831                                 ccache,
 832                                 in_creds->session.keytype ?
 833                                 KRB5_TC_MATCH_KEYTYPE : 0,
 834                                 in_creds, res_creds);
 835     if(ret == 0) {
 836         *out_creds = res_creds;
 837         return 0;
 838     }
 839     free(res_creds);
 840     if(ret != KRB5_CC_END)
 841         return ret;
 842     if(options & KRB5_GC_CACHED) {
 843         krb5_clear_error_string (context);
 844         return KRB5_CC_NOTFOUND;
 845     }
 846     if(options & KRB5_GC_USER_USER)
 847         flags.b.enc_tkt_in_skey = 1;
 848     tgts = NULL;
 849     ret = get_cred_from_kdc_flags(context, flags, ccache,
 850                                   in_creds, out_creds, &tgts);
 851     for(i = 0; tgts && tgts[i]; i++) {
 852         krb5_cc_store_cred(context, ccache, tgts[i]);
 853         krb5_free_creds(context, tgts[i]);
 854     }
 855     free(tgts);
 856     if(ret == 0 && flags.b.enc_tkt_in_skey == 0)
 857         krb5_cc_store_cred(context, ccache, *out_creds);
 858     return ret;
 859 }
 860
 861 krb5_error_code
 862 krb5_get_credentials(krb5_context context,
 863                      krb5_flags options,
 864                      krb5_ccache ccache,
 865                      krb5_creds *in_creds,
 866                      krb5_creds **out_creds)
 867 {
 868     krb5_kdc_flags flags;
 869     flags.i = 0;
 870     return krb5_get_credentials_with_flags(context, options, flags,
 871                                            ccache, in_creds, out_creds);
 872 }