2 Unix SMB/CIFS implementation.
3 kerberos authorization data (PAC) utility library
4 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Luke Howard 2002-2003
8 Copyright (C) Stefan Metzmacher 2004-2005
9 Copyright (C) Guenther Deschner 2005,2007,2008
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #include "librpc/gen_ndr/ndr_krb5pac.h"
29 #include "libcli/auth/krb5_wrap.h"
31 krb5_error_code
check_pac_checksum(TALLOC_CTX
*mem_ctx
,
33 struct PAC_SIGNATURE_DATA
*sig
,
35 const krb5_keyblock
*keyblock
)
39 krb5_keyusage usage
= 0;
41 smb_krb5_checksum_from_pac_sig(&cksum
, sig
);
43 #ifdef HAVE_KRB5_KU_OTHER_CKSUM /* Heimdal */
44 usage
= KRB5_KU_OTHER_CKSUM
;
45 #elif defined(HAVE_KRB5_KEYUSAGE_APP_DATA_CKSUM) /* MIT */
46 usage
= KRB5_KEYUSAGE_APP_DATA_CKSUM
;
48 #error UNKNOWN_KRB5_KEYUSAGE
51 ret
= smb_krb5_verify_checksum(context
,
59 DEBUG(2,("check_pac_checksum: PAC Verification failed: %s (%d)\n",
60 error_message(ret
), ret
));
68 * @brief Decode a blob containing a NDR envoded PAC structure
70 * @param mem_ctx - The memory context
71 * @param pac_data_blob - The data blob containing the NDR encoded data
72 * @param context - The Kerberos Context
73 * @param service_keyblock - The Service Key used to verify the checksum
74 * @param client_principal - The client principal
75 * @param tgs_authtime - The ticket timestamp
76 * @param pac_data_out - [out] The decoded PAC
78 * @return - A NTSTATUS error code
80 NTSTATUS
kerberos_decode_pac(TALLOC_CTX
*mem_ctx
,
81 DATA_BLOB pac_data_blob
,
83 const krb5_keyblock
*krbtgt_keyblock
,
84 const krb5_keyblock
*service_keyblock
,
85 krb5_const_principal client_principal
,
87 struct PAC_DATA
**pac_data_out
)
90 enum ndr_err_code ndr_err
;
92 DATA_BLOB modified_pac_blob
;
94 NTTIME tgs_authtime_nttime
;
95 krb5_principal client_principal_pac
= NULL
;
98 struct PAC_SIGNATURE_DATA
*srv_sig_ptr
= NULL
;
99 struct PAC_SIGNATURE_DATA
*kdc_sig_ptr
= NULL
;
100 struct PAC_SIGNATURE_DATA
*srv_sig_wipe
= NULL
;
101 struct PAC_SIGNATURE_DATA
*kdc_sig_wipe
= NULL
;
102 struct PAC_LOGON_NAME
*logon_name
= NULL
;
103 struct PAC_LOGON_INFO
*logon_info
= NULL
;
104 struct PAC_DATA
*pac_data
= NULL
;
105 struct PAC_DATA_RAW
*pac_data_raw
= NULL
;
107 DATA_BLOB
*srv_sig_blob
= NULL
;
108 DATA_BLOB
*kdc_sig_blob
= NULL
;
112 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
114 return NT_STATUS_NO_MEMORY
;
118 *pac_data_out
= NULL
;
121 pac_data
= talloc(tmp_ctx
, struct PAC_DATA
);
122 pac_data_raw
= talloc(tmp_ctx
, struct PAC_DATA_RAW
);
123 kdc_sig_wipe
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
124 srv_sig_wipe
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
125 if (!pac_data_raw
|| !pac_data
|| !kdc_sig_wipe
|| !srv_sig_wipe
) {
126 talloc_free(tmp_ctx
);
127 return NT_STATUS_NO_MEMORY
;
130 ndr_err
= ndr_pull_struct_blob(&pac_data_blob
, pac_data
, pac_data
,
131 (ndr_pull_flags_fn_t
)ndr_pull_PAC_DATA
);
132 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
133 status
= ndr_map_error2ntstatus(ndr_err
);
134 DEBUG(0,("can't parse the PAC: %s\n",
136 talloc_free(tmp_ctx
);
140 if (pac_data
->num_buffers
< 4) {
141 /* we need logon_ingo, service_key and kdc_key */
142 DEBUG(0,("less than 4 PAC buffers\n"));
143 talloc_free(tmp_ctx
);
144 return NT_STATUS_INVALID_PARAMETER
;
147 ndr_err
= ndr_pull_struct_blob(
148 &pac_data_blob
, pac_data_raw
, pac_data_raw
,
149 (ndr_pull_flags_fn_t
)ndr_pull_PAC_DATA_RAW
);
150 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
151 status
= ndr_map_error2ntstatus(ndr_err
);
152 DEBUG(0,("can't parse the PAC: %s\n",
154 talloc_free(tmp_ctx
);
158 if (pac_data_raw
->num_buffers
< 4) {
159 /* we need logon_ingo, service_key and kdc_key */
160 DEBUG(0,("less than 4 PAC buffers\n"));
161 talloc_free(tmp_ctx
);
162 return NT_STATUS_INVALID_PARAMETER
;
165 if (pac_data
->num_buffers
!= pac_data_raw
->num_buffers
) {
166 /* we need logon_ingo, service_key and kdc_key */
167 DEBUG(0, ("misparse! PAC_DATA has %d buffers while "
168 "PAC_DATA_RAW has %d\n", pac_data
->num_buffers
,
169 pac_data_raw
->num_buffers
));
170 talloc_free(tmp_ctx
);
171 return NT_STATUS_INVALID_PARAMETER
;
174 for (i
=0; i
< pac_data
->num_buffers
; i
++) {
175 struct PAC_BUFFER
*data_buf
= &pac_data
->buffers
[i
];
176 struct PAC_BUFFER_RAW
*raw_buf
= &pac_data_raw
->buffers
[i
];
178 if (data_buf
->type
!= raw_buf
->type
) {
179 DEBUG(0, ("misparse! PAC_DATA buffer %d has type "
180 "%d while PAC_DATA_RAW has %d\n", i
,
181 data_buf
->type
, raw_buf
->type
));
182 talloc_free(tmp_ctx
);
183 return NT_STATUS_INVALID_PARAMETER
;
185 switch (data_buf
->type
) {
186 case PAC_TYPE_LOGON_INFO
:
187 if (!data_buf
->info
) {
190 logon_info
= data_buf
->info
->logon_info
.info
;
192 case PAC_TYPE_SRV_CHECKSUM
:
193 if (!data_buf
->info
) {
196 srv_sig_ptr
= &data_buf
->info
->srv_cksum
;
197 srv_sig_blob
= &raw_buf
->info
->remaining
;
199 case PAC_TYPE_KDC_CHECKSUM
:
200 if (!data_buf
->info
) {
203 kdc_sig_ptr
= &data_buf
->info
->kdc_cksum
;
204 kdc_sig_blob
= &raw_buf
->info
->remaining
;
206 case PAC_TYPE_LOGON_NAME
:
207 logon_name
= &data_buf
->info
->logon_name
;
215 DEBUG(0,("PAC no logon_info\n"));
216 talloc_free(tmp_ctx
);
217 return NT_STATUS_INVALID_PARAMETER
;
221 DEBUG(0,("PAC no logon_name\n"));
222 talloc_free(tmp_ctx
);
223 return NT_STATUS_INVALID_PARAMETER
;
226 if (!srv_sig_ptr
|| !srv_sig_blob
) {
227 DEBUG(0,("PAC no srv_key\n"));
228 talloc_free(tmp_ctx
);
229 return NT_STATUS_INVALID_PARAMETER
;
232 if (!kdc_sig_ptr
|| !kdc_sig_blob
) {
233 DEBUG(0,("PAC no kdc_key\n"));
234 talloc_free(tmp_ctx
);
235 return NT_STATUS_INVALID_PARAMETER
;
238 /* Find and zero out the signatures,
239 * as required by the signing algorithm */
241 /* We find the data blobs above,
242 * now we parse them to get at the exact portion we should zero */
243 ndr_err
= ndr_pull_struct_blob(
244 kdc_sig_blob
, kdc_sig_wipe
, kdc_sig_wipe
,
245 (ndr_pull_flags_fn_t
)ndr_pull_PAC_SIGNATURE_DATA
);
246 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
247 status
= ndr_map_error2ntstatus(ndr_err
);
248 DEBUG(0,("can't parse the KDC signature: %s\n",
250 talloc_free(tmp_ctx
);
254 ndr_err
= ndr_pull_struct_blob(
255 srv_sig_blob
, srv_sig_wipe
, srv_sig_wipe
,
256 (ndr_pull_flags_fn_t
)ndr_pull_PAC_SIGNATURE_DATA
);
257 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
258 status
= ndr_map_error2ntstatus(ndr_err
);
259 DEBUG(0,("can't parse the SRV signature: %s\n",
261 talloc_free(tmp_ctx
);
265 /* Now zero the decoded structure */
266 memset(kdc_sig_wipe
->signature
.data
,
267 '\0', kdc_sig_wipe
->signature
.length
);
268 memset(srv_sig_wipe
->signature
.data
,
269 '\0', srv_sig_wipe
->signature
.length
);
271 /* and reencode, back into the same place it came from */
272 ndr_err
= ndr_push_struct_blob(
273 kdc_sig_blob
, pac_data_raw
, kdc_sig_wipe
,
274 (ndr_push_flags_fn_t
)ndr_push_PAC_SIGNATURE_DATA
);
275 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
276 status
= ndr_map_error2ntstatus(ndr_err
);
277 DEBUG(0,("can't repack the KDC signature: %s\n",
279 talloc_free(tmp_ctx
);
282 ndr_err
= ndr_push_struct_blob(
283 srv_sig_blob
, pac_data_raw
, srv_sig_wipe
,
284 (ndr_push_flags_fn_t
)ndr_push_PAC_SIGNATURE_DATA
);
285 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
286 status
= ndr_map_error2ntstatus(ndr_err
);
287 DEBUG(0,("can't repack the SRV signature: %s\n",
289 talloc_free(tmp_ctx
);
293 /* push out the whole structure, but now with zero'ed signatures */
294 ndr_err
= ndr_push_struct_blob(
295 &modified_pac_blob
, pac_data_raw
, pac_data_raw
,
296 (ndr_push_flags_fn_t
)ndr_push_PAC_DATA_RAW
);
297 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
298 status
= ndr_map_error2ntstatus(ndr_err
);
299 DEBUG(0,("can't repack the RAW PAC: %s\n",
301 talloc_free(tmp_ctx
);
305 if (service_keyblock
) {
306 /* verify by service_key */
307 ret
= check_pac_checksum(tmp_ctx
,
308 modified_pac_blob
, srv_sig_ptr
,
312 DEBUG(1, ("PAC Decode: Failed to verify the service "
313 "signature: %s\n", error_message(ret
)));
314 return NT_STATUS_ACCESS_DENIED
;
317 if (krbtgt_keyblock
) {
318 /* verify the service key checksum by krbtgt_key */
319 ret
= check_pac_checksum(tmp_ctx
,
320 srv_sig_ptr
->signature
, kdc_sig_ptr
,
321 context
, krbtgt_keyblock
);
323 DEBUG(1, ("PAC Decode: Failed to verify the KDC signature: %s\n",
324 smb_get_krb5_error_message(context
, ret
, tmp_ctx
)));
325 talloc_free(tmp_ctx
);
326 return NT_STATUS_ACCESS_DENIED
;
332 /* Convert to NT time, so as not to loose accuracy in comparison */
333 unix_to_nt_time(&tgs_authtime_nttime
, tgs_authtime
);
335 if (tgs_authtime_nttime
!= logon_name
->logon_time
) {
336 DEBUG(2, ("PAC Decode: "
337 "Logon time mismatch between ticket and PAC!\n"));
338 DEBUG(2, ("PAC Decode: PAC: %s\n",
339 nt_time_string(tmp_ctx
, logon_name
->logon_time
)));
340 DEBUG(2, ("PAC Decode: Ticket: %s\n",
341 nt_time_string(tmp_ctx
, tgs_authtime_nttime
)));
342 talloc_free(tmp_ctx
);
343 return NT_STATUS_ACCESS_DENIED
;
347 if (client_principal
) {
348 ret
= smb_krb5_parse_name_norealm(context
,
349 logon_name
->account_name
,
350 &client_principal_pac
);
352 DEBUG(2, ("Could not parse name from PAC: [%s]:%s\n",
353 logon_name
->account_name
, error_message(ret
)));
354 talloc_free(tmp_ctx
);
355 return NT_STATUS_INVALID_PARAMETER
;
358 bool_ret
= smb_krb5_principal_compare_any_realm(context
,
360 client_principal_pac
);
362 krb5_free_principal(context
, client_principal_pac
);
365 DEBUG(2, ("Name in PAC [%s] does not match principal name "
366 "in ticket\n", logon_name
->account_name
));
367 talloc_free(tmp_ctx
);
368 return NT_STATUS_ACCESS_DENIED
;
372 DEBUG(3,("Found account name from PAC: %s [%s]\n",
373 logon_info
->info3
.base
.account_name
.string
,
374 logon_info
->info3
.base
.full_name
.string
));
376 DEBUG(10,("Successfully validated Kerberos PAC\n"));
378 if (DEBUGLEVEL
>= 10) {
380 s
= NDR_PRINT_STRUCT_STRING(tmp_ctx
, PAC_DATA
, pac_data
);
382 DEBUGADD(10,("%s\n", s
));
387 *pac_data_out
= talloc_steal(mem_ctx
, pac_data
);