source4/heimdal/lib/krb5/verify_init.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
  37 krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options)
  38 {
  39     memset (options, 0, sizeof(*options));
  40 }
  41
  42 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
  43 krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options,
  44                                              int ap_req_nofail)
  45 {
  46     options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
  47     options->ap_req_nofail = ap_req_nofail;
  48 }
  49
  50 /*
  51  *
  52  */
  53
  54 static krb5_boolean
  55 fail_verify_is_ok (krb5_context context,
  56                    krb5_verify_init_creds_opt *options)
  57 {
  58
  59     if (options && (options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL)
  60         && options->ap_req_nofail != 0)
  61         return FALSE;
  62
  63     if (krb5_config_get_bool(context,
  64                              NULL,
  65                              "libdefaults",
  66                              "verify_ap_req_nofail",
  67                              NULL))
  68         return FALSE;
  69
  70     return TRUE;
  71 }
  72
  73 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
  74 krb5_verify_init_creds(krb5_context context,
  75                        krb5_creds *creds,
  76                        krb5_principal ap_req_server,
  77                        krb5_keytab ap_req_keytab,
  78                        krb5_ccache *ccache,
  79                        krb5_verify_init_creds_opt *options)
  80 {
  81     krb5_error_code ret;
  82     krb5_data req;
  83     krb5_ccache local_ccache = NULL;
  84     krb5_creds *new_creds = NULL;
  85     krb5_auth_context auth_context = NULL;
  86     krb5_principal server = NULL;
  87     krb5_keytab keytab = NULL;
  88
  89     krb5_data_zero (&req);
  90
  91     if (ap_req_server == NULL) {
  92         char local_hostname[MAXHOSTNAMELEN];
  93
  94         if (gethostname (local_hostname, sizeof(local_hostname)) < 0) {
  95             ret = errno;
  96             krb5_set_error_message (context, ret, "gethostname: %s",
  97                                     strerror(ret));
  98             return ret;
  99         }
 100
 101         ret = krb5_sname_to_principal (context,
 102                                        local_hostname,
 103                                        "host",
 104                                        KRB5_NT_SRV_HST,
 105                                        &server);
 106         if (ret)
 107             goto cleanup;
 108     } else
 109         server = ap_req_server;
 110
 111     if (ap_req_keytab == NULL) {
 112         ret = krb5_kt_default (context, &keytab);
 113         if (ret)
 114             goto cleanup;
 115     } else
 116         keytab = ap_req_keytab;
 117
 118     if (ccache && *ccache)
 119         local_ccache = *ccache;
 120     else {
 121         ret = krb5_cc_new_unique(context, krb5_cc_type_memory,
 122                                  NULL, &local_ccache);
 123         if (ret)
 124             goto cleanup;
 125         ret = krb5_cc_initialize (context,
 126                                   local_ccache,
 127                                   creds->client);
 128         if (ret)
 129             goto cleanup;
 130         ret = krb5_cc_store_cred (context,
 131                                   local_ccache,
 132                                   creds);
 133         if (ret)
 134             goto cleanup;
 135     }
 136
 137     if (!krb5_principal_compare (context, server, creds->server)) {
 138         krb5_creds match_cred;
 139
 140         memset (&match_cred, 0, sizeof(match_cred));
 141
 142         match_cred.client = creds->client;
 143         match_cred.server = server;
 144
 145         ret = krb5_get_credentials (context,
 146                                     0,
 147                                     local_ccache,
 148                                     &match_cred,
 149                                     &new_creds);
 150         if (ret) {
 151             if (fail_verify_is_ok (context, options))
 152                 ret = 0;
 153             goto cleanup;
 154         }
 155         creds = new_creds;
 156     }
 157
 158     ret = krb5_mk_req_extended (context,
 159                                 &auth_context,
 160                                 0,
 161                                 NULL,
 162                                 creds,
 163                                 &req);
 164
 165     krb5_auth_con_free (context, auth_context);
 166     auth_context = NULL;
 167
 168     if (ret)
 169         goto cleanup;
 170
 171     ret = krb5_rd_req (context,
 172                        &auth_context,
 173                        &req,
 174                        server,
 175                        keytab,
 176                        0,
 177                        NULL);
 178
 179     if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options))
 180         ret = 0;
 181 cleanup:
 182     if (auth_context)
 183         krb5_auth_con_free (context, auth_context);
 184     krb5_data_free (&req);
 185     if (new_creds != NULL)
 186         krb5_free_creds (context, new_creds);
 187     if (ap_req_server == NULL && server)
 188         krb5_free_principal (context, server);
 189     if (ap_req_keytab == NULL && keytab)
 190         krb5_kt_close (context, keytab);
 191     if (local_ccache != NULL
 192         &&
 193         (ccache == NULL
 194          || (ret != 0 && *ccache == NULL)))
 195         krb5_cc_destroy (context, local_ccache);
 196
 197     if (ret == 0 && ccache != NULL && *ccache == NULL)
 198         *ccache = local_ccache;
 199
 200     return ret;
 201 }
 202
 203 /**
 204  * Validate the newly fetch credential, see also krb5_verify_init_creds().
 205  *
 206  * @param context a Kerberos 5 context
 207  * @param creds the credentials to verify
 208  * @param client the client name to match up
 209  * @param ccache the credential cache to use
 210  * @param service a service name to use, used with
 211  *        krb5_sname_to_principal() to build a hostname to use to
 212  *        verify.
 213  *
 214  * @ingroup krb5_ccache
 215  */
 216
 217 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 218 krb5_get_validated_creds(krb5_context context,
 219                          krb5_creds *creds,
 220                          krb5_principal client,
 221                          krb5_ccache ccache,
 222                          char *service)
 223 {
 224     krb5_verify_init_creds_opt vopt;
 225     krb5_principal server;
 226     krb5_error_code ret;
 227
 228     if (krb5_principal_compare(context, creds->client, client) != TRUE) {
 229         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
 230                                N_("Validation credentials and client "
 231                                   "doesn't match", ""));
 232         return KRB5_PRINC_NOMATCH;
 233     }
 234
 235     ret = krb5_sname_to_principal (context, NULL, service,
 236                                    KRB5_NT_SRV_HST, &server);
 237     if(ret)
 238         return ret;
 239
 240     krb5_verify_init_creds_opt_init(&vopt);
 241
 242     ret = krb5_verify_init_creds(context, creds, server, NULL, NULL, &vopt);
 243     krb5_free_principal(context, server);
 244
 245     return ret;
 246 }