lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 RCSID("$Id$");
  37
  38 /*
  39  * Take the `body' and encode it into `padata' using the credentials
  40  * in `creds'.
  41  */
  42
  43 static krb5_error_code
  44 make_pa_tgs_req(krb5_context context,
  45                 krb5_auth_context ac,
  46                 KDC_REQ_BODY *body,
  47                 PA_DATA *padata,
  48                 krb5_creds *creds,
  49                 krb5_key_usage usage)
  50 {
  51     u_char *buf;
  52     size_t buf_size;
  53     size_t len;
  54     krb5_data in_data;
  55     krb5_error_code ret;
  56
  57     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  58     if (ret)
  59         goto out;
  60     if(buf_size != len)
  61         krb5_abortx(context, "internal error in ASN.1 encoder");
  62
  63     in_data.length = len;
  64     in_data.data   = buf;
  65     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  66                                 &padata->padata_value,
  67                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  68                                 usage
  69                                 /* KRB5_KU_TGS_REQ_AUTH */);
  70  out:
  71     free (buf);
  72     if(ret)
  73         return ret;
  74     padata->padata_type = KRB5_PADATA_TGS_REQ;
  75     return 0;
  76 }
  77
  78 /*
  79  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  80  */
  81
  82 static krb5_error_code
  83 set_auth_data (krb5_context context,
  84                KDC_REQ_BODY *req_body,
  85                krb5_authdata *authdata,
  86                krb5_keyblock *key)
  87 {
  88     if(authdata->len) {
  89         size_t len, buf_size;
  90         unsigned char *buf;
  91         krb5_crypto crypto;
  92         krb5_error_code ret;
  93
  94         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  95                            &len, ret);
  96         if (ret)
  97             return ret;
  98         if (buf_size != len)
  99             krb5_abortx(context, "internal error in ASN.1 encoder");
 100
 101         ALLOC(req_body->enc_authorization_data, 1);
 102         if (req_body->enc_authorization_data == NULL) {
 103             free (buf);
 104             krb5_set_error_string(context, "malloc: out of memory");
 105             return ENOMEM;
 106         }
 107         ret = krb5_crypto_init(context, key, 0, &crypto);
 108         if (ret) {
 109             free (buf);
 110             free (req_body->enc_authorization_data);
 111             req_body->enc_authorization_data = NULL;
 112             return ret;
 113         }
 114         krb5_encrypt_EncryptedData(context,
 115                                    crypto,
 116                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 117                                    /* KRB5_KU_TGS_REQ_AUTH_DAT_SESSION? */
 118                                    buf,
 119                                    len,
 120                                    0,
 121                                    req_body->enc_authorization_data);
 122         free (buf);
 123         krb5_crypto_destroy(context, crypto);
 124     } else {
 125         req_body->enc_authorization_data = NULL;
 126     }
 127     return 0;
 128 }
 129
 130 /*
 131  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 132  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 133  * subkey in `subkey'.
 134  */
 135
 136 static krb5_error_code
 137 init_tgs_req (krb5_context context,
 138               krb5_ccache ccache,
 139               krb5_addresses *addresses,
 140               krb5_kdc_flags flags,
 141               Ticket *second_ticket,
 142               krb5_creds *in_creds,
 143               krb5_creds *krbtgt,
 144               unsigned nonce,
 145               krb5_keyblock **subkey,
 146               TGS_REQ *t,
 147               krb5_key_usage usage)
 148 {
 149     krb5_error_code ret = 0;
 150
 151     memset(t, 0, sizeof(*t));
 152     t->pvno = 5;
 153     t->msg_type = krb_tgs_req;
 154     if (in_creds->session.keytype) {
 155         ALLOC_SEQ(&t->req_body.etype, 1);
 156         if(t->req_body.etype.val == NULL) {
 157             ret = ENOMEM;
 158             krb5_set_error_string(context, "malloc: out of memory");
 159             goto fail;
 160         }
 161         t->req_body.etype.val[0] = in_creds->session.keytype;
 162     } else {
 163         ret = krb5_init_etype(context,
 164                               &t->req_body.etype.len,
 165                               &t->req_body.etype.val,
 166                               NULL);
 167     }
 168     if (ret)
 169         goto fail;
 170     t->req_body.addresses = addresses;
 171     t->req_body.kdc_options = flags.b;
 172     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 173     if (ret)
 174         goto fail;
 175     ALLOC(t->req_body.sname, 1);
 176     if (t->req_body.sname == NULL) {
 177         ret = ENOMEM;
 178         krb5_set_error_string(context, "malloc: out of memory");
 179         goto fail;
 180     }
 181
 182     /* some versions of some code might require that the client be
 183        present in TGS-REQs, but this is clearly against the spec */
 184
 185     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 186     if (ret)
 187         goto fail;
 188
 189     /* req_body.till should be NULL if there is no endtime specified,
 190        but old MIT code (like DCE secd) doesn't like that */
 191     ALLOC(t->req_body.till, 1);
 192     if(t->req_body.till == NULL){
 193         ret = ENOMEM;
 194         krb5_set_error_string(context, "malloc: out of memory");
 195         goto fail;
 196     }
 197     *t->req_body.till = in_creds->times.endtime;
 198
 199     t->req_body.nonce = nonce;
 200     if(second_ticket){
 201         ALLOC(t->req_body.additional_tickets, 1);
 202         if (t->req_body.additional_tickets == NULL) {
 203             ret = ENOMEM;
 204             krb5_set_error_string(context, "malloc: out of memory");
 205             goto fail;
 206         }
 207         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 208         if (t->req_body.additional_tickets->val == NULL) {
 209             ret = ENOMEM;
 210             krb5_set_error_string(context, "malloc: out of memory");
 211             goto fail;
 212         }
 213         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 214         if (ret)
 215             goto fail;
 216     }
 217     ALLOC(t->padata, 1);
 218     if (t->padata == NULL) {
 219         ret = ENOMEM;
 220         krb5_set_error_string(context, "malloc: out of memory");
 221         goto fail;
 222     }
 223     ALLOC_SEQ(t->padata, 1);
 224     if (t->padata->val == NULL) {
 225         ret = ENOMEM;
 226         krb5_set_error_string(context, "malloc: out of memory");
 227         goto fail;
 228     }
 229
 230     {
 231         krb5_auth_context ac;
 232         krb5_keyblock *key = NULL;
 233
 234         ret = krb5_auth_con_init(context, &ac);
 235         if(ret)
 236             goto fail;
 237
 238         if (krb5_config_get_bool_default(context, NULL, FALSE,
 239                                          "realms",
 240                                          krbtgt->server->realm,
 241                                          "tgs_require_subkey",
 242                                          NULL))
 243         {
 244             ret = krb5_generate_subkey (context, &krbtgt->session, &key);
 245             if (ret) {
 246                 krb5_auth_con_free (context, ac);
 247                 goto fail;
 248             }
 249
 250             ret = krb5_auth_con_setlocalsubkey(context, ac, key);
 251             if (ret) {
 252                 if (key)
 253                     krb5_free_keyblock (context, key);
 254                 krb5_auth_con_free (context, ac);
 255                 goto fail;
 256             }
 257         }
 258
 259         ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 260                              key ? key : &krbtgt->session);
 261         if (ret) {
 262             if (key)
 263                 krb5_free_keyblock (context, key);
 264             krb5_auth_con_free (context, ac);
 265             goto fail;
 266         }
 267
 268         ret = make_pa_tgs_req(context,
 269                               ac,
 270                               &t->req_body,
 271                               t->padata->val,
 272                               krbtgt,
 273                               usage);
 274         if(ret) {
 275             if (key)
 276                 krb5_free_keyblock (context, key);
 277             krb5_auth_con_free(context, ac);
 278             goto fail;
 279         }
 280         *subkey = key;
 281
 282         krb5_auth_con_free(context, ac);
 283     }
 284 fail:
 285     if (ret) {
 286         t->req_body.addresses = NULL;
 287         free_TGS_REQ (t);
 288     }
 289     return ret;
 290 }
 291
 292 krb5_error_code
 293 _krb5_get_krbtgt(krb5_context context,
 294                  krb5_ccache  id,
 295                  krb5_realm realm,
 296                  krb5_creds **cred)
 297 {
 298     krb5_error_code ret;
 299     krb5_creds tmp_cred;
 300
 301     memset(&tmp_cred, 0, sizeof(tmp_cred));
 302
 303     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 304     if (ret)
 305         return ret;
 306
 307     ret = krb5_make_principal(context,
 308                               &tmp_cred.server,
 309                               realm,
 310                               KRB5_TGS_NAME,
 311                               realm,
 312                               NULL);
 313     if(ret) {
 314         krb5_free_principal(context, tmp_cred.client);
 315         return ret;
 316     }
 317     ret = krb5_get_credentials(context,
 318                                KRB5_GC_CACHED,
 319                                id,
 320                                &tmp_cred,
 321                                cred);
 322     krb5_free_principal(context, tmp_cred.client);
 323     krb5_free_principal(context, tmp_cred.server);
 324     if(ret)
 325         return ret;
 326     return 0;
 327 }
 328
 329 /* DCE compatible decrypt proc */
 330 static krb5_error_code
 331 decrypt_tkt_with_subkey (krb5_context context,
 332                          krb5_keyblock *key,
 333                          krb5_key_usage usage,
 334                          krb5_const_pointer subkey,
 335                          krb5_kdc_rep *dec_rep)
 336 {
 337     krb5_error_code ret;
 338     krb5_data data;
 339     size_t size;
 340     krb5_crypto crypto;
 341
 342     ret = krb5_crypto_init(context, key, 0, &crypto);
 343     if (ret)
 344         return ret;
 345     ret = krb5_decrypt_EncryptedData (context,
 346                                       crypto,
 347                                       usage,
 348                                       &dec_rep->kdc_rep.enc_part,
 349                                       &data);
 350     krb5_crypto_destroy(context, crypto);
 351     if(ret && subkey){
 352         /* DCE compat -- try to decrypt with subkey */
 353         ret = krb5_crypto_init(context, (krb5_keyblock*)subkey, 0, &crypto);
 354         if (ret)
 355             return ret;
 356         ret = krb5_decrypt_EncryptedData (context,
 357                                           crypto,
 358                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 359                                           &dec_rep->kdc_rep.enc_part,
 360                                           &data);
 361         krb5_crypto_destroy(context, crypto);
 362     }
 363     if (ret)
 364         return ret;
 365
 366     ret = krb5_decode_EncASRepPart(context,
 367                                    data.data,
 368                                    data.length,
 369                                    &dec_rep->enc_part,
 370                                    &size);
 371     if (ret)
 372         ret = krb5_decode_EncTGSRepPart(context,
 373                                         data.data,
 374                                         data.length,
 375                                         &dec_rep->enc_part,
 376                                         &size);
 377     krb5_data_free (&data);
 378     return ret;
 379 }
 380
 381 static krb5_error_code
 382 get_cred_kdc_usage(krb5_context context,
 383                    krb5_ccache id,
 384                    krb5_kdc_flags flags,
 385                    krb5_addresses *addresses,
 386                    krb5_creds *in_creds,
 387                    krb5_creds *krbtgt,
 388                    krb5_creds *out_creds,
 389                    krb5_key_usage usage)
 390 {
 391     TGS_REQ req;
 392     krb5_data enc;
 393     krb5_data resp;
 394     krb5_kdc_rep rep;
 395     KRB_ERROR error;
 396     krb5_error_code ret;
 397     unsigned nonce;
 398     krb5_keyblock *subkey = NULL;
 399     size_t len;
 400     Ticket second_ticket;
 401     int send_to_kdc_flags = 0;
 402
 403     krb5_data_zero(&resp);
 404     krb5_data_zero(&enc);
 405
 406     krb5_generate_random_block(&nonce, sizeof(nonce));
 407     nonce &= 0xffffffff;
 408
 409     if(flags.b.enc_tkt_in_skey){
 410         ret = decode_Ticket(in_creds->second_ticket.data,
 411                             in_creds->second_ticket.length,
 412                             &second_ticket, &len);
 413         if(ret)
 414             return ret;
 415     }
 416
 417     ret = init_tgs_req (context,
 418                         id,
 419                         addresses,
 420                         flags,
 421                         flags.b.enc_tkt_in_skey ? &second_ticket : NULL,
 422                         in_creds,
 423                         krbtgt,
 424                         nonce,
 425                         &subkey,
 426                         &req,
 427                         usage);
 428     if(flags.b.enc_tkt_in_skey)
 429         free_Ticket(&second_ticket);
 430     if (ret)
 431         goto out;
 432
 433     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 434     if (ret)
 435         goto out;
 436     if(enc.length != len)
 437         krb5_abortx(context, "internal error in ASN.1 encoder");
 438
 439     /* don't free addresses */
 440     req.req_body.addresses = NULL;
 441     free_TGS_REQ(&req);
 442
 443     /*
 444      * Send and receive
 445      */
 446 again:
 447     ret = krb5_sendto_kdc_flags (context, &enc,
 448                                  &krbtgt->server->name.name_string.val[1],
 449                                  &resp,
 450                                  send_to_kdc_flags);
 451     if(ret)
 452         goto out;
 453
 454     memset(&rep, 0, sizeof(rep));
 455     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0){
 456         ret = krb5_copy_principal(context,
 457                                   in_creds->client,
 458                                   &out_creds->client);
 459         if(ret)
 460             goto out;
 461         ret = krb5_copy_principal(context,
 462                                   in_creds->server,
 463                                   &out_creds->server);
 464         if(ret)
 465             goto out;
 466         /* this should go someplace else */
 467         out_creds->times.endtime = in_creds->times.endtime;
 468
 469         ret = _krb5_extract_ticket(context,
 470                                    &rep,
 471                                    out_creds,
 472                                    &krbtgt->session,
 473                                    NULL,
 474                                    KRB5_KU_TGS_REP_ENC_PART_SESSION,
 475                                    &krbtgt->addresses,
 476                                    nonce,
 477                                    TRUE,
 478                                    flags.b.request_anonymous,
 479                                    decrypt_tkt_with_subkey,
 480                                    subkey);
 481         krb5_free_kdc_rep(context, &rep);
 482     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 483         ret = krb5_error_from_rd_error(context, &error, in_creds);
 484         krb5_free_error_contents(context, &error);
 485
 486         if (ret == KRB5KRB_ERR_RESPONSE_TOO_BIG && !(send_to_kdc_flags & KRB5_KRBHST_FLAGS_LARGE_MSG)) {
 487             send_to_kdc_flags |= KRB5_KRBHST_FLAGS_LARGE_MSG;
 488             krb5_data_free(&resp);
 489             goto again;
 490         }
 491     } else if(resp.data && ((char*)resp.data)[0] == 4) {
 492         ret = KRB5KRB_AP_ERR_V4_REPLY;
 493         krb5_clear_error_string(context);
 494     } else {
 495         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 496         krb5_clear_error_string(context);
 497     }
 498
 499 out:
 500     krb5_data_free(&resp);
 501     krb5_data_free(&enc);
 502     if(subkey){
 503         krb5_free_keyblock_contents(context, subkey);
 504         free(subkey);
 505     }
 506     return ret;
 507
 508 }
 509
 510 static krb5_error_code
 511 get_cred_kdc(krb5_context context,
 512              krb5_ccache id,
 513              krb5_kdc_flags flags,
 514              krb5_addresses *addresses,
 515              krb5_creds *in_creds,
 516              krb5_creds *krbtgt,
 517              krb5_creds *out_creds)
 518 {
 519     krb5_error_code ret;
 520
 521     ret = get_cred_kdc_usage(context, id, flags, addresses, in_creds,
 522                              krbtgt, out_creds, KRB5_KU_TGS_REQ_AUTH);
 523     if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
 524         krb5_clear_error_string (context);
 525         ret = get_cred_kdc_usage(context, id, flags, addresses, in_creds,
 526                                  krbtgt, out_creds, KRB5_KU_AP_REQ_AUTH);
 527     }
 528     return ret;
 529 }
 530
 531 /* same as above, just get local addresses first */
 532
 533 static krb5_error_code
 534 get_cred_kdc_la(krb5_context context, krb5_ccache id, krb5_kdc_flags flags,
 535                 krb5_creds *in_creds, krb5_creds *krbtgt,
 536                 krb5_creds *out_creds)
 537 {
 538     krb5_error_code ret;
 539     krb5_addresses addresses, *addrs = &addresses;
 540
 541     krb5_get_all_client_addrs(context, &addresses);
 542     /* XXX this sucks. */
 543     if(addresses.len == 0)
 544         addrs = NULL;
 545     ret = get_cred_kdc(context, id, flags, addrs,
 546                        in_creds, krbtgt, out_creds);
 547     krb5_free_addresses(context, &addresses);
 548     return ret;
 549 }
 550
 551 krb5_error_code KRB5_LIB_FUNCTION
 552 krb5_get_kdc_cred(krb5_context context,
 553                   krb5_ccache id,
 554                   krb5_kdc_flags flags,
 555                   krb5_addresses *addresses,
 556                   Ticket  *second_ticket,
 557                   krb5_creds *in_creds,
 558                   krb5_creds **out_creds
 559                   )
 560 {
 561     krb5_error_code ret;
 562     krb5_creds *krbtgt;
 563
 564     *out_creds = calloc(1, sizeof(**out_creds));
 565     if(*out_creds == NULL) {
 566         krb5_set_error_string(context, "malloc: out of memory");
 567         return ENOMEM;
 568     }
 569     ret = _krb5_get_krbtgt (context,
 570                             id,
 571                             in_creds->server->realm,
 572                             &krbtgt);
 573     if(ret) {
 574         free(*out_creds);
 575         return ret;
 576     }
 577     ret = get_cred_kdc(context, id, flags, addresses,
 578                        in_creds, krbtgt, *out_creds);
 579     krb5_free_creds (context, krbtgt);
 580     if(ret)
 581         free(*out_creds);
 582     return ret;
 583 }
 584
 585
 586 static krb5_error_code
 587 find_cred(krb5_context context,
 588           krb5_ccache id,
 589           krb5_principal server,
 590           krb5_creds **tgts,
 591           krb5_creds *out_creds)
 592 {
 593     krb5_error_code ret;
 594     krb5_creds mcreds;
 595
 596     krb5_cc_clear_mcred(&mcreds);
 597     mcreds.server = server;
 598     ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
 599                                 &mcreds, out_creds);
 600     if(ret == 0)
 601         return 0;
 602     while(tgts && *tgts){
 603         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 604                               &mcreds, *tgts)){
 605             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 606             return ret;
 607         }
 608         tgts++;
 609     }
 610     krb5_clear_error_string(context);
 611     return KRB5_CC_NOTFOUND;
 612 }
 613
 614 static krb5_error_code
 615 add_cred(krb5_context context, krb5_creds ***tgts, krb5_creds *tkt)
 616 {
 617     int i;
 618     krb5_error_code ret;
 619     krb5_creds **tmp = *tgts;
 620
 621     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 622     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 623     if(tmp == NULL) {
 624         krb5_set_error_string(context, "malloc: out of memory");
 625         return ENOMEM;
 626     }
 627     *tgts = tmp;
 628     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 629     tmp[i+1] = NULL;
 630     return ret;
 631 }
 632
 633 /*
 634 get_cred(server)
 635         creds = cc_get_cred(server)
 636         if(creds) return creds
 637         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 638         if(tgt)
 639                 return get_cred_tgt(server, tgt)
 640         if(client_realm == server_realm)
 641                 return NULL
 642         tgt = get_cred(krbtgt/server_realm@client_realm)
 643         while(tgt_inst != server_realm)
 644                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 645         return get_cred_tgt(server, tgt)
 646         */
 647
 648 static krb5_error_code
 649 get_cred_from_kdc_flags(krb5_context context,
 650                         krb5_kdc_flags flags,
 651                         krb5_ccache ccache,
 652                         krb5_creds *in_creds,
 653                         krb5_creds **out_creds,
 654                         krb5_creds ***ret_tgts)
 655 {
 656     krb5_error_code ret;
 657     krb5_creds *tgt, tmp_creds;
 658     krb5_const_realm client_realm, server_realm, try_realm;
 659
 660     *out_creds = NULL;
 661
 662     client_realm = krb5_principal_get_realm(context, in_creds->client);
 663     server_realm = krb5_principal_get_realm(context, in_creds->server);
 664     memset(&tmp_creds, 0, sizeof(tmp_creds));
 665     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 666     if(ret)
 667         return ret;
 668
 669     try_realm = krb5_config_get_string(context, NULL, "capaths",
 670                                        client_realm, server_realm, NULL);
 671
 672 #if 1
 673     /* XXX remove in future release */
 674     if(try_realm == NULL)
 675         try_realm = krb5_config_get_string(context, NULL, "libdefaults",
 676                                            "capath", server_realm, NULL);
 677 #endif
 678
 679     if (try_realm == NULL)
 680         try_realm = client_realm;
 681
 682     ret = krb5_make_principal(context,
 683                               &tmp_creds.server,
 684                               try_realm,
 685                               KRB5_TGS_NAME,
 686                               server_realm,
 687                               NULL);
 688     if(ret){
 689         krb5_free_principal(context, tmp_creds.client);
 690         return ret;
 691     }
 692     {
 693         krb5_creds tgts;
 694         /* XXX try krb5_cc_retrieve_cred first? */
 695         ret = find_cred(context, ccache, tmp_creds.server,
 696                         *ret_tgts, &tgts);
 697         if(ret == 0){
 698             *out_creds = calloc(1, sizeof(**out_creds));
 699             if(*out_creds == NULL) {
 700                 krb5_set_error_string(context, "malloc: out of memory");
 701                 ret = ENOMEM;
 702             } else {
 703                 krb5_boolean noaddr;
 704
 705                 krb5_appdefault_boolean(context, NULL, tgts.server->realm,
 706                                         "no-addresses", FALSE, &noaddr);
 707
 708                 if (noaddr)
 709                     ret = get_cred_kdc(context, ccache, flags, NULL,
 710                                        in_creds, &tgts, *out_creds);
 711                 else
 712                     ret = get_cred_kdc_la(context, ccache, flags,
 713                                           in_creds, &tgts, *out_creds);
 714                 if (ret) {
 715                     free (*out_creds);
 716                     *out_creds = NULL;
 717                 }
 718             }
 719             krb5_free_cred_contents(context, &tgts);
 720             krb5_free_principal(context, tmp_creds.server);
 721             krb5_free_principal(context, tmp_creds.client);
 722             return ret;
 723         }
 724     }
 725     if(krb5_realm_compare(context, in_creds->client, in_creds->server)) {
 726         krb5_clear_error_string (context);
 727         return KRB5_CC_NOTFOUND;
 728     }
 729     /* XXX this can loop forever */
 730     while(1){
 731         heim_general_string tgt_inst;
 732
 733         ret = get_cred_from_kdc_flags(context, flags, ccache, &tmp_creds,
 734                                       &tgt, ret_tgts);
 735         if(ret) {
 736             krb5_free_principal(context, tmp_creds.server);
 737             krb5_free_principal(context, tmp_creds.client);
 738             return ret;
 739         }
 740         ret = add_cred(context, ret_tgts, tgt);
 741         if(ret) {
 742             krb5_free_principal(context, tmp_creds.server);
 743             krb5_free_principal(context, tmp_creds.client);
 744             return ret;
 745         }
 746         tgt_inst = tgt->server->name.name_string.val[1];
 747         if(strcmp(tgt_inst, server_realm) == 0)
 748             break;
 749         krb5_free_principal(context, tmp_creds.server);
 750         ret = krb5_make_principal(context, &tmp_creds.server,
 751                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 752         if(ret) {
 753             krb5_free_principal(context, tmp_creds.server);
 754             krb5_free_principal(context, tmp_creds.client);
 755             return ret;
 756         }
 757         ret = krb5_free_creds(context, tgt);
 758         if(ret) {
 759             krb5_free_principal(context, tmp_creds.server);
 760             krb5_free_principal(context, tmp_creds.client);
 761             return ret;
 762         }
 763     }
 764
 765     krb5_free_principal(context, tmp_creds.server);
 766     krb5_free_principal(context, tmp_creds.client);
 767     *out_creds = calloc(1, sizeof(**out_creds));
 768     if(*out_creds == NULL) {
 769         krb5_set_error_string(context, "malloc: out of memory");
 770         ret = ENOMEM;
 771     } else {
 772         krb5_boolean noaddr;
 773
 774         krb5_appdefault_boolean(context, NULL, tgt->server->realm,
 775                                 "no-addresses", FALSE, &noaddr);
 776         if (noaddr)
 777             ret = get_cred_kdc (context, ccache, flags, NULL,
 778                                 in_creds, tgt, *out_creds);
 779         else
 780             ret = get_cred_kdc_la(context, ccache, flags,
 781                                   in_creds, tgt, *out_creds);
 782         if (ret) {
 783             free (*out_creds);
 784             *out_creds = NULL;
 785         }
 786     }
 787     krb5_free_creds(context, tgt);
 788     return ret;
 789 }
 790
 791 krb5_error_code KRB5_LIB_FUNCTION
 792 krb5_get_cred_from_kdc_opt(krb5_context context,
 793                            krb5_ccache ccache,
 794                            krb5_creds *in_creds,
 795                            krb5_creds **out_creds,
 796                            krb5_creds ***ret_tgts,
 797                            krb5_flags flags)
 798 {
 799     krb5_kdc_flags f;
 800     f.i = flags;
 801     return get_cred_from_kdc_flags(context, f, ccache,
 802                                    in_creds, out_creds, ret_tgts);
 803 }
 804
 805 krb5_error_code KRB5_LIB_FUNCTION
 806 krb5_get_cred_from_kdc(krb5_context context,
 807                        krb5_ccache ccache,
 808                        krb5_creds *in_creds,
 809                        krb5_creds **out_creds,
 810                        krb5_creds ***ret_tgts)
 811 {
 812     return krb5_get_cred_from_kdc_opt(context, ccache,
 813                                       in_creds, out_creds, ret_tgts, 0);
 814 }
 815
 816
 817 krb5_error_code KRB5_LIB_FUNCTION
 818 krb5_get_credentials_with_flags(krb5_context context,
 819                                 krb5_flags options,
 820                                 krb5_kdc_flags flags,
 821                                 krb5_ccache ccache,
 822                                 krb5_creds *in_creds,
 823                                 krb5_creds **out_creds)
 824 {
 825     krb5_error_code ret;
 826     krb5_creds **tgts;
 827     krb5_creds *res_creds;
 828     int i;
 829
 830     *out_creds = NULL;
 831     res_creds = calloc(1, sizeof(*res_creds));
 832     if (res_creds == NULL) {
 833         krb5_set_error_string(context, "malloc: out of memory");
 834         return ENOMEM;
 835     }
 836
 837     if (in_creds->session.keytype)
 838         options |= KRB5_TC_MATCH_KEYTYPE;
 839
 840     /*
 841      * If we got a credential, check if credential is expired before
 842      * returning it.
 843      */
 844     ret = krb5_cc_retrieve_cred(context,
 845                                 ccache,
 846                                 in_creds->session.keytype ?
 847                                 KRB5_TC_MATCH_KEYTYPE : 0,
 848                                 in_creds, res_creds);
 849     /*
 850      * If we got a credential, check if credential is expired before
 851      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
 852      */
 853     if (ret == 0) {
 854         krb5_timestamp timeret;
 855
 856         /* If expired ok, don't bother checking */
 857         if(options & KRB5_GC_EXPIRED_OK) {
 858             *out_creds = res_creds;
 859             return 0;
 860         }
 861
 862         krb5_timeofday(context, &timeret);
 863         if(res_creds->times.endtime > timeret) {
 864             *out_creds = res_creds;
 865             return 0;
 866         }
 867         if(options & KRB5_GC_CACHED)
 868             krb5_cc_remove_cred(context, ccache, 0, res_creds);
 869
 870     } else if(ret != KRB5_CC_END) {
 871         free(res_creds);
 872         return ret;
 873     }
 874     free(res_creds);
 875     if(options & KRB5_GC_CACHED) {
 876         krb5_clear_error_string (context);
 877         return KRB5_CC_NOTFOUND;
 878     }
 879     if(options & KRB5_GC_USER_USER)
 880         flags.b.enc_tkt_in_skey = 1;
 881     tgts = NULL;
 882     ret = get_cred_from_kdc_flags(context, flags, ccache,
 883                                   in_creds, out_creds, &tgts);
 884     for(i = 0; tgts && tgts[i]; i++) {
 885         krb5_cc_store_cred(context, ccache, tgts[i]);
 886         krb5_free_creds(context, tgts[i]);
 887     }
 888     free(tgts);
 889     if(ret == 0 && flags.b.enc_tkt_in_skey == 0)
 890         krb5_cc_store_cred(context, ccache, *out_creds);
 891     return ret;
 892 }
 893
 894 krb5_error_code KRB5_LIB_FUNCTION
 895 krb5_get_credentials(krb5_context context,
 896                      krb5_flags options,
 897                      krb5_ccache ccache,
 898                      krb5_creds *in_creds,
 899                      krb5_creds **out_creds)
 900 {
 901     krb5_kdc_flags flags;
 902     flags.i = 0;
 903     return krb5_get_credentials_with_flags(context, options, flags,
 904                                            ccache, in_creds, out_creds);
 905 }