2 Unix SMB/CIFS implementation.
3 simple kerberos5 routines for active directory
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Luke Howard 2002-2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 Copyright (C) Guenther Deschner 2005-2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/filesys.h"
25 #include "krb5_samba.h"
26 #include "lib/crypto/md4.h"
27 #include "../libds/common/flags.h"
31 #endif /* HAVE_COM_ERR_H */
33 #ifndef KRB5_AUTHDATA_WIN2K_PAC
34 #define KRB5_AUTHDATA_WIN2K_PAC 128
37 #ifndef KRB5_AUTHDATA_IF_RELEVANT
38 #define KRB5_AUTHDATA_IF_RELEVANT 1
43 #define GSSAPI_CHECKSUM 0x8003 /* Checksum type value for Kerberos */
44 #define GSSAPI_BNDLENGTH 16 /* Bind Length (rfc-1964 pg.3) */
45 #define GSSAPI_CHECKSUM_SIZE (4+GSSAPI_BNDLENGTH+4) /* Length of bind length,
46 bind field, flags field. */
47 #define GSS_C_DELEG_FLAG 1
49 /* MIT krb5 1.7beta3 (in Ubuntu Karmic) is missing the prototype,
50 but still has the symbol */
51 #if !HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE
52 krb5_error_code
krb5_auth_con_set_req_cksumtype(
54 krb5_auth_context auth_context
,
55 krb5_cksumtype cksumtype
);
58 #if !defined(SMB_MALLOC)
60 #define SMB_MALLOC(s) malloc((s))
64 #define SMB_STRDUP(s) strdup(s)
67 /**********************************************************
69 **********************************************************/
71 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
73 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
75 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
76 * to krb5_set_default_tgs_ktypes. See
77 * http://lists.samba.org/archive/samba-technical/2006-July/048271.html
79 * If the MIT libraries are not exporting internal symbols, we will end up in
80 * this branch, which is correct. Otherwise we will continue to use the
83 krb5_error_code
krb5_set_default_tgs_ktypes(krb5_context ctx
, const krb5_enctype
*enc
)
85 return krb5_set_default_tgs_enctypes(ctx
, enc
);
88 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
91 krb5_error_code
krb5_set_default_tgs_ktypes(krb5_context ctx
, const krb5_enctype
*enc
)
93 return krb5_set_default_in_tkt_etypes(ctx
, enc
);
96 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
98 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
101 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
102 krb5_error_code
krb5_auth_con_setuseruserkey(krb5_context context
,
103 krb5_auth_context auth_context
,
104 krb5_keyblock
*keyblock
)
106 return krb5_auth_con_setkey(context
, auth_context
, keyblock
);
110 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
111 void krb5_free_unparsed_name(krb5_context context
, char *val
)
117 #if !defined(HAVE_KRB5_FREE_ENCTYPES)
118 void krb5_free_enctypes(krb5_context context
, krb5_enctype
*val
) {
123 #if !defined(HAVE_KRB5_FREE_STRING)
124 void krb5_free_string(krb5_context context
, char *val
) {
129 krb5_error_code
smb_krb5_princ_component(krb5_context context
,
130 krb5_const_principal principal
,
133 krb5_error_code
smb_krb5_princ_component(krb5_context context
,
134 krb5_const_principal principal
,
138 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
139 const char *component
= NULL
;
145 component
= krb5_principal_get_comp_string(context
, principal
, i
);
146 if (component
== NULL
) {
150 *data
= smb_krb5_make_data(discard_const_p(char, component
), strlen(component
));
154 const krb5_data
*kdata
= NULL
;
160 kdata
= krb5_princ_component(context
, principal
, i
);
171 /**********************************************************
173 **********************************************************/
176 * @brief Stores the address of a 'struct sockaddr_storage' into a krb5_address
178 * @param[in] paddr A pointer to a 'struct sockaddr_storage to extract the
181 * @param[out] pkaddr A Kerberos address to store the address in.
183 * @return True on success, false if an error occurred.
185 bool smb_krb5_sockaddr_to_kaddr(struct sockaddr_storage
*paddr
,
186 krb5_address
*pkaddr
)
188 memset(pkaddr
, '\0', sizeof(krb5_address
));
189 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
192 if (paddr
->ss_family
== AF_INET6
) {
193 pkaddr
->addr_type
= KRB5_ADDRESS_INET6
;
194 pkaddr
->address
.length
= sizeof(((struct sockaddr_in6
*)paddr
)->sin6_addr
);
195 pkaddr
->address
.data
= (char *)&(((struct sockaddr_in6
*)paddr
)->sin6_addr
);
199 if (paddr
->ss_family
== AF_INET
) {
200 pkaddr
->addr_type
= KRB5_ADDRESS_INET
;
201 pkaddr
->address
.length
= sizeof(((struct sockaddr_in
*)paddr
)->sin_addr
);
202 pkaddr
->address
.data
= (char *)&(((struct sockaddr_in
*)paddr
)->sin_addr
);
205 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
208 if (paddr
->ss_family
== AF_INET6
) {
209 pkaddr
->addrtype
= ADDRTYPE_INET6
;
210 pkaddr
->length
= sizeof(((struct sockaddr_in6
*)paddr
)->sin6_addr
);
211 pkaddr
->contents
= (krb5_octet
*)&(((struct sockaddr_in6
*)paddr
)->sin6_addr
);
215 if (paddr
->ss_family
== AF_INET
) {
216 pkaddr
->addrtype
= ADDRTYPE_INET
;
217 pkaddr
->length
= sizeof(((struct sockaddr_in
*)paddr
)->sin_addr
);
218 pkaddr
->contents
= (krb5_octet
*)&(((struct sockaddr_in
*)paddr
)->sin_addr
);
222 #error UNKNOWN_ADDRTYPE
227 krb5_error_code
smb_krb5_mk_error(krb5_context context
,
228 krb5_error_code error_code
,
231 const krb5_principal client
,
232 const krb5_principal server
,
235 krb5_error_code code
= EINVAL
;
236 #ifdef SAMBA4_USES_HEIMDAL
237 code
= krb5_mk_error(context
,
243 NULL
, /* client_time */
244 NULL
, /* client_usec */
247 krb5_principal unspec_server
= NULL
;
253 code
= krb5_us_timeofday(context
,
260 errpkt
.error
= error_code
- ERROR_TABLE_BASE_krb5
;
262 errpkt
.text
.length
= 0;
263 if (e_text
!= NULL
) {
264 errpkt
.text
= smb_krb5_make_data(discard_const_p(char, e_text
), strlen(e_text
));
267 errpkt
.e_data
= smb_krb5_make_data(NULL
, 0);
268 if (e_data
!= NULL
) {
269 errpkt
.e_data
= *e_data
;
272 errpkt
.client
= client
;
274 if (server
!= NULL
) {
275 errpkt
.server
= server
;
277 code
= smb_krb5_make_principal(context
,
279 "<unspecified realm>",
284 errpkt
.server
= unspec_server
;
287 code
= krb5_mk_error(context
,
290 krb5_free_principal(context
, unspec_server
);
296 * @brief Create a keyblock based on input parameters
298 * @param context The krb5_context
299 * @param host_princ The krb5_principal to use
300 * @param salt The optional salt, if omitted, salt is calculated with
301 * the provided principal.
302 * @param password The krb5_data containing the password
303 * @param enctype The krb5_enctype to use for the keyblock generation
304 * @param key The returned krb5_keyblock, caller needs to free with
305 * krb5_free_keyblock().
307 * @return krb5_error_code
309 int smb_krb5_create_key_from_string(krb5_context context
,
310 krb5_const_principal host_princ
,
311 const krb5_data
*salt
,
312 const krb5_data
*password
,
313 krb5_enctype enctype
,
318 if (host_princ
== NULL
&& salt
== NULL
) {
322 if ((int)enctype
== (int)ENCTYPE_ARCFOUR_HMAC
) {
323 TALLOC_CTX
*frame
= talloc_stackframe();
324 uint8_t *utf16
= NULL
;
325 size_t utf16_size
= 0;
329 ok
= convert_string_talloc(frame
, CH_UNIX
, CH_UTF16LE
,
330 password
->data
, password
->length
,
331 &utf16
, &utf16_size
);
341 mdfour(nt_hash
, utf16
, utf16_size
);
342 BURN_PTR_SIZE(utf16
, utf16_size
);
343 ret
= smb_krb5_keyblock_init_contents(context
,
344 ENCTYPE_ARCFOUR_HMAC
,
348 ZERO_STRUCT(nt_hash
);
358 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_C_STRING_TO_KEY)
363 ret
= krb5_principal2salt(context
, host_princ
, &_salt
);
365 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret
)));
371 ret
= krb5_c_string_to_key(context
, enctype
, password
, &_salt
, key
);
373 SAFE_FREE(_salt
.data
);
376 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
381 ret
= krb5_get_pw_salt(context
, host_princ
, &_salt
);
383 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret
)));
387 _salt
.saltvalue
= *salt
;
388 _salt
.salttype
= KRB5_PW_SALT
;
391 ret
= krb5_string_to_key_salt(context
, enctype
, (const char *)password
->data
, _salt
, key
);
393 krb5_free_salt(context
, _salt
);
397 #error UNKNOWN_CREATE_KEY_FUNCTIONS
403 * @brief Create a salt for a given principal
405 * @param context The initialized krb5_context
406 * @param host_princ The krb5_principal to create the salt for
407 * @param psalt A pointer to a krb5_data struct
409 * caller has to free the contents of psalt with smb_krb5_free_data_contents
410 * when function has succeeded
412 * @return krb5_error_code, returns 0 on success, error code otherwise
415 int smb_krb5_get_pw_salt(krb5_context context
,
416 krb5_const_principal host_princ
,
418 #if defined(HAVE_KRB5_GET_PW_SALT)
424 ret
= krb5_get_pw_salt(context
, host_princ
, &salt
);
429 *psalt
= salt
.saltvalue
;
433 #elif defined(HAVE_KRB5_PRINCIPAL2SALT)
436 return krb5_principal2salt(context
, host_princ
, psalt
);
439 #error UNKNOWN_SALT_FUNCTIONS
443 * @brief This constructs the salt principal used by active directory
445 * Most Kerberos encryption types require a salt in order to
446 * calculate the long term private key for user/computer object
447 * based on a password.
449 * The returned _salt_principal is a string in forms like this:
450 * - host/somehost.example.com@EXAMPLE.COM
451 * - SomeAccount@EXAMPLE.COM
452 * - SomePrincipal@EXAMPLE.COM
454 * This is not the form that's used as salt, it's just
455 * the human readable form. It needs to be converted by
456 * smb_krb5_salt_principal2data().
458 * @param[in] realm The realm the user/computer is added too.
460 * @param[in] sAMAccountName The sAMAccountName attribute of the object.
462 * @param[in] userPrincipalName The userPrincipalName attribute of the object
463 * or NULL if not available.
465 * @param[in] uac_flags UF_ACCOUNT_TYPE_MASKed userAccountControl field
467 * @param[in] mem_ctx The TALLOC_CTX to allocate _salt_principal.
469 * @param[out] _salt_principal The resulting principal as string.
471 * @retval 0 Success; otherwise - Kerberos error codes
473 * @see smb_krb5_salt_principal2data
475 int smb_krb5_salt_principal(krb5_context krb5_ctx
,
477 const char *sAMAccountName
,
478 const char *userPrincipalName
,
480 krb5_principal
*salt_princ
)
482 TALLOC_CTX
*frame
= talloc_stackframe();
483 char *upper_realm
= NULL
;
484 const char *principal
= NULL
;
485 int principal_len
= 0;
486 krb5_error_code krb5_ret
;
490 if (sAMAccountName
== NULL
) {
500 if (uac_flags
& ~UF_ACCOUNT_TYPE_MASK
) {
502 * catch callers which still
508 if (uac_flags
== 0) {
510 * catch callers which still
517 upper_realm
= strupper_talloc(frame
, realm
);
518 if (upper_realm
== NULL
) {
523 /* Many, many thanks to lukeh@padl.com for this
524 * algorithm, described in his Nov 10 2004 mail to
525 * samba-technical@lists.samba.org */
528 * Determine a salting principal
530 if (uac_flags
& UF_TRUST_ACCOUNT_MASK
) {
531 int computer_len
= 0;
533 computer_len
= strlen(sAMAccountName
);
534 if (sAMAccountName
[computer_len
-1] == '$') {
538 if (uac_flags
& UF_INTERDOMAIN_TRUST_ACCOUNT
) {
539 const char *krbtgt
= "krbtgt";
540 krb5_ret
= krb5_build_principal_ext(krb5_ctx
,
554 const char *host
= "host";
556 char *tmp_lower
= NULL
;
558 tmp
= talloc_asprintf(frame
, "%*.*s.%s",
568 tmp_lower
= strlower_talloc(frame
, tmp
);
569 if (tmp_lower
== NULL
) {
574 krb5_ret
= krb5_build_principal_ext(krb5_ctx
,
589 } else if (userPrincipalName
!= NULL
) {
591 * We parse the name not only to allow an easy
592 * replacement of the realm (no matter the realm in
593 * the UPN, the salt comes from the upper-case real
594 * realm, but also to correctly provide a salt when
595 * the UPN is host/foo.bar
597 * This can fail for a UPN of the form foo@bar@REALM
598 * (which is accepted by windows) however.
600 krb5_ret
= krb5_parse_name(krb5_ctx
,
610 * No matter what realm (including none) in the UPN,
611 * the realm is replaced with our upper-case realm
613 krb5_ret
= smb_krb5_principal_set_realm(krb5_ctx
,
617 krb5_free_principal(krb5_ctx
, *salt_princ
);
622 principal
= sAMAccountName
;
623 principal_len
= strlen(principal
);
625 krb5_ret
= krb5_build_principal_ext(krb5_ctx
,
643 * @brief This constructs the salt principal used by active directory
645 * Most Kerberos encryption types require a salt in order to
646 * calculate the long term private key for user/computer object
647 * based on a password.
649 * The returned _salt_principal is a string in forms like this:
650 * - host/somehost.example.com@EXAMPLE.COM
651 * - SomeAccount@EXAMPLE.COM
652 * - SomePrincipal@EXAMPLE.COM
654 * This is not the form that's used as salt, it's just
655 * the human readable form. It needs to be converted by
656 * smb_krb5_salt_principal2data().
658 * @param[in] realm The realm the user/computer is added too.
660 * @param[in] sAMAccountName The sAMAccountName attribute of the object.
662 * @param[in] userPrincipalName The userPrincipalName attribute of the object
663 * or NULL if not available.
665 * @param[in] uac_flags UF_ACCOUNT_TYPE_MASKed userAccountControl field
667 * @param[in] mem_ctx The TALLOC_CTX to allocate _salt_principal.
669 * @param[out] _salt_principal The resulting principal as string.
671 * @retval 0 Success; otherwise - Kerberos error codes
673 * @see smb_krb5_salt_principal2data
675 int smb_krb5_salt_principal_str(const char *realm
,
676 const char *sAMAccountName
,
677 const char *userPrincipalName
,
680 char **_salt_principal_str
)
682 krb5_principal salt_principal
= NULL
;
683 char *salt_principal_malloc
;
684 krb5_context krb5_ctx
;
685 krb5_error_code krb5_ret
686 = smb_krb5_init_context_common(&krb5_ctx
);
688 DBG_ERR("kerberos init context failed (%s)\n",
689 error_message(krb5_ret
));
693 krb5_ret
= smb_krb5_salt_principal(krb5_ctx
,
700 DBG_ERR("unable to create salt principal:%s\n",
701 error_message(krb5_ret
));
705 krb5_ret
= krb5_unparse_name(krb5_ctx
, salt_principal
,
706 &salt_principal_malloc
);
708 krb5_free_principal(krb5_ctx
, salt_principal
);
709 DBG_ERR("kerberos unparse of salt principal failed (%s)\n",
710 error_message(krb5_ret
));
713 krb5_free_principal(krb5_ctx
, salt_principal
);
715 = talloc_strdup(mem_ctx
, salt_principal_malloc
);
716 krb5_free_unparsed_name(krb5_ctx
, salt_principal_malloc
);
718 if (*_salt_principal_str
== NULL
) {
725 * @brief Converts the salt principal string into the salt data blob
727 * This function takes a salt_principal as string in forms like this:
728 * - host/somehost.example.com@EXAMPLE.COM
729 * - SomeAccount@EXAMPLE.COM
730 * - SomePrincipal@EXAMPLE.COM
732 * It generates values like:
733 * - EXAMPLE.COMhost/somehost.example.com
734 * - EXAMPLE.COMSomeAccount
735 * - EXAMPLE.COMSomePrincipal
737 * @param[in] realm The realm the user/computer is added too.
739 * @param[in] sAMAccountName The sAMAccountName attribute of the object.
741 * @param[in] userPrincipalName The userPrincipalName attribute of the object
742 * or NULL if not available.
744 * @param[in] is_computer The indication of the object includes
745 * objectClass=computer.
747 * @param[in] mem_ctx The TALLOC_CTX to allocate _salt_principal.
749 * @param[out] _salt_principal The resulting principal as string.
751 * @retval 0 Success; otherwise - Kerberos error codes
753 * @see smb_krb5_salt_principal
755 int smb_krb5_salt_principal2data(krb5_context context
,
756 const char *salt_principal
,
761 krb5_principal salt_princ
= NULL
;
766 ret
= krb5_parse_name(context
, salt_principal
, &salt_princ
);
771 ret
= smb_krb5_get_pw_salt(context
, salt_princ
, &salt
);
772 krb5_free_principal(context
, salt_princ
);
777 *_salt_data
= talloc_strndup(mem_ctx
,
780 smb_krb5_free_data_contents(context
, &salt
);
781 if (*_salt_data
== NULL
) {
788 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
790 * @brief Get a list of encryption types allowed for session keys
792 * @param[in] context The library context
794 * @param[in] enctypes An allocated, zero-terminated list of encryption types
796 * This function returns an allocated list of encryption types allowed for
799 * Use krb5_free_enctypes() to free the enctypes when it is no longer needed.
801 * @retval 0 Success; otherwise - Kerberos error codes
803 krb5_error_code
smb_krb5_get_allowed_etypes(krb5_context context
,
804 krb5_enctype
**enctypes
)
806 return krb5_get_permitted_enctypes(context
, enctypes
);
808 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
809 krb5_error_code
smb_krb5_get_allowed_etypes(krb5_context context
,
810 krb5_enctype
**enctypes
)
812 #ifdef HAVE_KRB5_PDU_NONE_DECL
813 return krb5_get_default_in_tkt_etypes(context
, KRB5_PDU_NONE
, enctypes
);
815 return krb5_get_default_in_tkt_etypes(context
, enctypes
);
819 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
824 * @brief Convert a string principal name to a Kerberos principal.
826 * @param[in] context The library context
828 * @param[in] name The principal as a unix charset string.
830 * @param[out] principal The newly allocated principal.
832 * Use krb5_free_principal() to free a principal when it is no longer needed.
834 * @return 0 on success, a Kerberos error code otherwise.
836 krb5_error_code
smb_krb5_parse_name(krb5_context context
,
838 krb5_principal
*principal
)
842 size_t converted_size
;
843 TALLOC_CTX
*frame
= talloc_stackframe();
845 if (!push_utf8_talloc(frame
, &utf8_name
, name
, &converted_size
)) {
850 ret
= krb5_parse_name(context
, utf8_name
, principal
);
851 if (ret
== KRB5_PARSE_MALFORMED
) {
852 ret
= krb5_parse_name_flags(context
, utf8_name
,
853 KRB5_PRINCIPAL_PARSE_ENTERPRISE
,
861 * @brief Convert a Kerberos principal structure to a string representation.
863 * The resulting string representation will be a unix charset name and is
866 * @param[in] mem_ctx The talloc context to allocate memory on.
868 * @param[in] context The library context.
870 * @param[in] principal The principal.
872 * @param[out] unix_name A string representation of the principal name as with
875 * Use talloc_free() to free the string representation if it is no longer
878 * @return 0 on success, a Kerberos error code otherwise.
880 krb5_error_code
smb_krb5_unparse_name(TALLOC_CTX
*mem_ctx
,
881 krb5_context context
,
882 krb5_const_principal principal
,
887 size_t converted_size
;
890 ret
= krb5_unparse_name(context
, principal
, &utf8_name
);
895 if (!pull_utf8_talloc(mem_ctx
, unix_name
, utf8_name
, &converted_size
)) {
896 krb5_free_unparsed_name(context
, utf8_name
);
899 krb5_free_unparsed_name(context
, utf8_name
);
904 * @brief Free the contents of a krb5_data structure and zero the data field.
906 * @param[in] context The krb5 context
908 * @param[in] pdata The data structure to free contents of
910 * This function frees the contents, not the structure itself.
912 void smb_krb5_free_data_contents(krb5_context context
, krb5_data
*pdata
)
914 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
916 krb5_free_data_contents(context
, pdata
);
918 #elif defined(HAVE_KRB5_DATA_FREE)
919 krb5_data_free(context
, pdata
);
921 SAFE_FREE(pdata
->data
);
926 * @brief copy a buffer into a krb5_data struct
928 * @param[in] p The krb5_data
929 * @param[in] data The data to copy
930 * @param[in] length The length of the data to copy
931 * @return krb5_error_code
933 * Caller has to free krb5_data with smb_krb5_free_data_contents().
935 krb5_error_code
smb_krb5_copy_data_contents(krb5_data
*p
,
939 #if defined(HAVE_KRB5_DATA_COPY)
940 return krb5_data_copy(p
, data
, len
);
943 p
->data
= malloc(len
);
944 if (p
->data
== NULL
) {
947 memmove(p
->data
, data
, len
);
952 p
->magic
= KV5M_DATA
;
958 * @brief put a buffer reference into a krb5_data struct
960 * @param[in] data The data to reference
961 * @param[in] length The length of the data to reference
964 * Caller should not free krb5_data.
966 krb5_data
smb_krb5_make_data(void *data
,
971 #ifdef SAMBA4_USES_HEIMDAL
972 d
.data
= (uint8_t *)data
;
982 krb5_data
smb_krb5_data_from_blob(DATA_BLOB blob
)
984 return smb_krb5_make_data(blob
.data
, blob
.length
);
987 bool smb_krb5_get_smb_session_key(TALLOC_CTX
*mem_ctx
,
988 krb5_context context
,
989 krb5_auth_context auth_context
,
990 DATA_BLOB
*session_key
,
993 krb5_keyblock
*skey
= NULL
;
994 krb5_error_code err
= 0;
998 #ifdef HAVE_KRB5_AUTH_CON_GETRECVSUBKEY
999 err
= krb5_auth_con_getrecvsubkey(context
,
1002 #else /* HAVE_KRB5_AUTH_CON_GETRECVSUBKEY */
1003 err
= krb5_auth_con_getremotesubkey(context
,
1004 auth_context
, &skey
);
1005 #endif /* HAVE_KRB5_AUTH_CON_GETRECVSUBKEY */
1007 #ifdef HAVE_KRB5_AUTH_CON_GETSENDSUBKEY
1008 err
= krb5_auth_con_getsendsubkey(context
,
1011 #else /* HAVE_KRB5_AUTH_CON_GETSENDSUBKEY */
1012 err
= krb5_auth_con_getlocalsubkey(context
,
1013 auth_context
, &skey
);
1014 #endif /* HAVE_KRB5_AUTH_CON_GETSENDSUBKEY */
1017 if (err
|| skey
== NULL
) {
1018 DEBUG(10, ("KRB5 error getting session key %d\n", err
));
1022 DEBUG(10, ("Got KRB5 session key of length %d\n",
1023 (int)KRB5_KEY_LENGTH(skey
)));
1025 *session_key
= data_blob_talloc(mem_ctx
,
1026 KRB5_KEY_DATA(skey
),
1027 KRB5_KEY_LENGTH(skey
));
1028 dump_data_pw("KRB5 Session Key:\n",
1030 session_key
->length
);
1036 krb5_free_keyblock(context
, skey
);
1044 * @brief Get talloced string component of a principal
1046 * @param[in] mem_ctx The TALLOC_CTX
1047 * @param[in] context The krb5_context
1048 * @param[in] principal The principal
1049 * @param[in] component The component
1050 * @param[out] out The output string
1051 * @return krb5_error_code
1053 * Caller must talloc_free if the return value is not NULL.
1056 krb5_error_code
smb_krb5_principal_get_comp_string(TALLOC_CTX
*mem_ctx
,
1057 krb5_context context
,
1058 krb5_const_principal principal
,
1059 unsigned int component
,
1062 char *out_str
= NULL
;
1063 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING)
1064 const char *str
= NULL
;
1066 str
= krb5_principal_get_comp_string(context
, principal
, component
);
1071 out_str
= talloc_strdup(mem_ctx
, str
);
1072 if (out_str
== NULL
) {
1078 if (component
>= krb5_princ_size(context
, principal
)) {
1082 data
= krb5_princ_component(context
, principal
, component
);
1087 out_str
= talloc_strndup(mem_ctx
, data
->data
, data
->length
);
1088 if (out_str
== NULL
) {
1099 * @param[in] ccache_string A string pointing to the cache to renew the ticket
1100 * (e.g. FILE:/tmp/krb5cc_0) or NULL. If the principal
1101 * ccache has not been specified, the default ccache
1104 * @param[in] client_string The client principal string (e.g. user@SAMBA.SITE)
1105 * or NULL. If the principal string has not been
1106 * specified, the principal from the ccache will be
1109 * @param[in] service_string The service ticket string
1110 * (e.g. krbtgt/SAMBA.SITE@SAMBA.SITE) or NULL. If
1111 * the service ticket is specified, it is parsed
1112 * (with the realm part ignored) and used as the
1113 * server principal of the credential. Otherwise
1114 * the ticket-granting service is used.
1116 * @param[in] expire_time A pointer to store the credentials end time or
1119 * @return 0 on Success, a Kerberos error code otherwise.
1121 krb5_error_code
smb_krb5_renew_ticket(const char *ccache_string
,
1122 const char *client_string
,
1123 const char *service_string
,
1124 time_t *expire_time
)
1126 krb5_error_code ret
;
1127 krb5_context context
= NULL
;
1128 krb5_ccache ccache
= NULL
;
1129 krb5_principal client
= NULL
;
1130 krb5_creds creds
, creds_in
;
1133 ZERO_STRUCT(creds_in
);
1135 ret
= smb_krb5_init_context_common(&context
);
1137 DBG_ERR("kerberos init context failed (%s)\n",
1138 error_message(ret
));
1142 if (!ccache_string
) {
1143 ccache_string
= krb5_cc_default_name(context
);
1146 if (!ccache_string
) {
1151 DBG_DEBUG("Using %s as ccache for client '%s' and service '%s'\n",
1152 ccache_string
, client_string
, service_string
);
1154 /* FIXME: we should not fall back to defaults */
1155 ret
= krb5_cc_resolve(context
, discard_const_p(char, ccache_string
), &ccache
);
1160 if (client_string
) {
1161 ret
= smb_krb5_parse_name(context
, client_string
, &client
);
1166 ret
= krb5_cc_get_principal(context
, ccache
, &client
);
1172 ret
= krb5_get_renewed_creds(context
, &creds
, client
, ccache
, discard_const_p(char, service_string
));
1174 DBG_DEBUG("krb5_get_renewed_creds using ccache '%s' "
1175 "for client '%s' and service '%s' failed: %s\n",
1176 ccache_string
, client_string
, service_string
,
1177 error_message(ret
));
1181 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1182 ret
= krb5_cc_initialize(context
, ccache
, client
);
1187 ret
= krb5_cc_store_cred(context
, ccache
, &creds
);
1190 *expire_time
= (time_t) creds
.times
.endtime
;
1194 krb5_free_cred_contents(context
, &creds_in
);
1195 krb5_free_cred_contents(context
, &creds
);
1198 krb5_free_principal(context
, client
);
1201 krb5_cc_close(context
, ccache
);
1204 krb5_free_context(context
);
1211 * @brief Free the data stored in an smb_krb5_addresses structure.
1213 * @param[in] context The library context
1215 * @param[in] addr The address structure to free.
1217 * @return 0 on success, a Kerberos error code otherwise.
1219 krb5_error_code
smb_krb5_free_addresses(krb5_context context
,
1220 smb_krb5_addresses
*addr
)
1222 krb5_error_code ret
= 0;
1226 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1227 krb5_free_addresses(context
, addr
->addrs
);
1228 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1229 ret
= krb5_free_addresses(context
, addr
->addrs
);
1230 SAFE_FREE(addr
->addrs
);
1237 #define MAX_NETBIOSNAME_LEN 16
1240 * @brief Add a netbios name to the array of addresses
1242 * @param[in] kerb_addr A pointer to the smb_krb5_addresses to add the
1245 * @param[in] netbios_name The netbios name to add.
1247 * @return 0 on success, a Kerberos error code otherwise.
1249 krb5_error_code
smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses
**kerb_addr
,
1250 const char *netbios_name
)
1252 krb5_error_code ret
= 0;
1253 char buf
[MAX_NETBIOSNAME_LEN
];
1255 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1256 krb5_address
**addrs
= NULL
;
1257 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1258 krb5_addresses
*addrs
= NULL
;
1261 *kerb_addr
= (smb_krb5_addresses
*)SMB_MALLOC(sizeof(smb_krb5_addresses
));
1262 if (*kerb_addr
== NULL
) {
1266 /* temporarily duplicate put_name() code here to avoid dependency
1267 * issues for a 5 lines function */
1268 len
= strlen(netbios_name
);
1269 memcpy(buf
, netbios_name
,
1270 (len
< MAX_NETBIOSNAME_LEN
) ? len
: MAX_NETBIOSNAME_LEN
- 1);
1271 if (len
< MAX_NETBIOSNAME_LEN
- 1) {
1272 memset(buf
+ len
, ' ', MAX_NETBIOSNAME_LEN
- 1 - len
);
1274 buf
[MAX_NETBIOSNAME_LEN
- 1] = 0x20;
1276 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1280 addrs
= (krb5_address
**)SMB_MALLOC(sizeof(krb5_address
*) * num_addr
);
1281 if (addrs
== NULL
) {
1282 SAFE_FREE(*kerb_addr
);
1286 memset(addrs
, 0, sizeof(krb5_address
*) * num_addr
);
1288 addrs
[0] = (krb5_address
*)SMB_MALLOC(sizeof(krb5_address
));
1289 if (addrs
[0] == NULL
) {
1291 SAFE_FREE(*kerb_addr
);
1295 addrs
[0]->magic
= KV5M_ADDRESS
;
1296 addrs
[0]->addrtype
= KRB5_ADDR_NETBIOS
;
1297 addrs
[0]->length
= MAX_NETBIOSNAME_LEN
;
1298 addrs
[0]->contents
= (unsigned char *)SMB_MALLOC(addrs
[0]->length
);
1299 if (addrs
[0]->contents
== NULL
) {
1300 SAFE_FREE(addrs
[0]);
1302 SAFE_FREE(*kerb_addr
);
1306 memcpy(addrs
[0]->contents
, buf
, addrs
[0]->length
);
1310 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1312 addrs
= (krb5_addresses
*)SMB_MALLOC(sizeof(krb5_addresses
));
1313 if (addrs
== NULL
) {
1314 SAFE_FREE(*kerb_addr
);
1318 memset(addrs
, 0, sizeof(krb5_addresses
));
1321 addrs
->val
= (krb5_address
*)SMB_MALLOC(sizeof(krb5_address
));
1322 if (addrs
->val
== NULL
) {
1324 SAFE_FREE(*kerb_addr
);
1328 addrs
->val
[0].addr_type
= KRB5_ADDR_NETBIOS
;
1329 addrs
->val
[0].address
.length
= MAX_NETBIOSNAME_LEN
;
1330 addrs
->val
[0].address
.data
= (unsigned char *)SMB_MALLOC(addrs
->val
[0].address
.length
);
1331 if (addrs
->val
[0].address
.data
== NULL
) {
1332 SAFE_FREE(addrs
->val
);
1334 SAFE_FREE(*kerb_addr
);
1338 memcpy(addrs
->val
[0].address
.data
, buf
, addrs
->val
[0].address
.length
);
1341 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1343 (*kerb_addr
)->addrs
= addrs
;
1349 * @brief Get the enctype from a key table entry
1351 * @param[in] kt_entry Key table entry to get the enctype from.
1353 * @return The enctype from the entry.
1355 krb5_enctype
smb_krb5_kt_get_enctype_from_entry(krb5_keytab_entry
*kt_entry
)
1357 return KRB5_KEY_TYPE(KRB5_KT_KEY(kt_entry
));
1361 * @brief Free the contents of a key table entry.
1363 * @param[in] context The library context.
1365 * @param[in] kt_entry The key table entry to free the contents of.
1367 * @return 0 on success, a Kerberos error code otherwise.
1369 * The pointer itself is not freed.
1371 krb5_error_code
smb_krb5_kt_free_entry(krb5_context context
,
1372 krb5_keytab_entry
*kt_entry
)
1374 /* Try krb5_free_keytab_entry_contents first, since
1375 * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
1376 * krb5_kt_free_entry but only has a prototype for the first, while the
1377 * second is considered private.
1379 #if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
1380 return krb5_free_keytab_entry_contents(context
, kt_entry
);
1381 #elif defined(HAVE_KRB5_KT_FREE_ENTRY)
1382 return krb5_kt_free_entry(context
, kt_entry
);
1384 #error UNKNOWN_KT_FREE_FUNCTION
1390 * @brief Convert an encryption type to a string.
1392 * @param[in] context The library context.
1394 * @param[in] enctype The encryption type.
1396 * @param[in] etype_s A pointer to store the allocated encryption type as a
1399 * @return 0 on success, a Kerberos error code otherwise.
1401 * The caller needs to free the allocated string etype_s.
1403 krb5_error_code
smb_krb5_enctype_to_string(krb5_context context
,
1404 krb5_enctype enctype
,
1407 #ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1408 return krb5_enctype_to_string(context
, enctype
, etype_s
); /* Heimdal */
1409 #elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1411 krb5_error_code ret
= krb5_enctype_to_string(enctype
, buf
, 256); /* MIT */
1415 *etype_s
= SMB_STRDUP(buf
);
1421 #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1425 /* This MAX_NAME_LEN is a constant defined in krb5.h */
1426 #ifndef MAX_KEYTAB_NAME_LEN
1427 #define MAX_KEYTAB_NAME_LEN 1100
1431 * @brief Open a key table readonly or with readwrite access.
1433 * Allows one to use a different keytab than the default one using a relative
1434 * path to the keytab.
1436 * @param[in] context The library context
1438 * @param[in] keytab_name_req The path to the key table.
1440 * @param[in] write_access Open with readwrite access.
1442 * @param[in] keytab A pointer to the opened key table.
1444 * The keytab pointer should be freed using krb5_kt_close().
1446 * @return 0 on success, a Kerberos error code otherwise.
1448 krb5_error_code
smb_krb5_kt_open_relative(krb5_context context
,
1449 const char *keytab_name_req
,
1451 krb5_keytab
*keytab
)
1453 krb5_error_code ret
= 0;
1454 TALLOC_CTX
*mem_ctx
;
1455 char keytab_string
[MAX_KEYTAB_NAME_LEN
];
1456 char *kt_str
= NULL
;
1457 bool found_valid_name
= false;
1458 const char *pragma
= "FILE";
1459 const char *tmp
= NULL
;
1461 if (!write_access
&& !keytab_name_req
) {
1462 /* caller just wants to read the default keytab readonly, so be it */
1463 return krb5_kt_default(context
, keytab
);
1466 mem_ctx
= talloc_init("smb_krb5_kt_open_relative");
1471 #ifdef HAVE_WRFILE_KEYTAB
1477 if (keytab_name_req
) {
1479 if (strlen(keytab_name_req
) > MAX_KEYTAB_NAME_LEN
) {
1480 ret
= KRB5_CONFIG_NOTENUFSPACE
;
1484 if ((strncmp(keytab_name_req
, "WRFILE:", 7) == 0) ||
1485 (strncmp(keytab_name_req
, "FILE:", 5) == 0)) {
1486 tmp
= keytab_name_req
;
1490 tmp
= talloc_asprintf(mem_ctx
, "%s:%s", pragma
, keytab_name_req
);
1499 /* we need to handle more complex keytab_strings, like:
1500 * "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1502 ret
= krb5_kt_default_name(context
, &keytab_string
[0], MAX_KEYTAB_NAME_LEN
- 2);
1507 DBG_DEBUG("krb5_kt_default_name returned %s\n", keytab_string
);
1509 tmp
= talloc_strdup(mem_ctx
, keytab_string
);
1515 if (strncmp(tmp
, "ANY:", 4) == 0) {
1519 memset(&keytab_string
, '\0', sizeof(keytab_string
));
1521 while (next_token_talloc(mem_ctx
, &tmp
, &kt_str
, ",")) {
1522 if (strncmp(kt_str
, "WRFILE:", 7) == 0) {
1523 found_valid_name
= true;
1528 if (strncmp(kt_str
, "FILE:", 5) == 0) {
1529 found_valid_name
= true;
1534 if (tmp
[0] == '/') {
1535 /* Treat as a FILE: keytab definition. */
1536 found_valid_name
= true;
1539 if (found_valid_name
) {
1540 if (tmp
[0] != '/') {
1541 ret
= KRB5_KT_BADNAME
;
1545 tmp
= talloc_asprintf(mem_ctx
, "%s:%s", pragma
, tmp
);
1554 if (!found_valid_name
) {
1555 ret
= KRB5_KT_UNKNOWN_TYPE
;
1560 DBG_DEBUG("resolving: %s\n", tmp
);
1561 ret
= krb5_kt_resolve(context
, tmp
, keytab
);
1564 TALLOC_FREE(mem_ctx
);
1569 * @brief Open a key table readonly or with readwrite access.
1571 * Allows one to use a different keytab than the default one. The path needs to be
1572 * an absolute path or an error will be returned.
1574 * @param[in] context The library context
1576 * @param[in] keytab_name_req The path to the key table.
1578 * @param[in] write_access Open with readwrite access.
1580 * @param[in] keytab A pointer to the opened key table.
1582 * The keytab pointer should be freed using krb5_kt_close().
1584 * @return 0 on success, a Kerberos error code otherwise.
1586 krb5_error_code
smb_krb5_kt_open(krb5_context context
,
1587 const char *keytab_name_req
,
1589 krb5_keytab
*keytab
)
1593 if (keytab_name_req
== NULL
) {
1594 return KRB5_KT_BADNAME
;
1597 if (keytab_name_req
[0] == '/') {
1601 cmp
= strncmp(keytab_name_req
, "FILE:/", 6);
1606 cmp
= strncmp(keytab_name_req
, "WRFILE:/", 8);
1611 DBG_WARNING("ERROR: Invalid keytab name: %s\n", keytab_name_req
);
1613 return KRB5_KT_BADNAME
;
1616 return smb_krb5_kt_open_relative(context
,
1623 * @brief Get a key table name.
1625 * @param[in] mem_ctx The talloc context to use for allocation.
1627 * @param[in] context The library context.
1629 * @param[in] keytab The key table to get the name from.
1631 * @param[in] keytab_name A talloc'ed string of the key table name.
1633 * The talloc'ed name string needs to be freed with talloc_free().
1635 * @return 0 on success, a Kerberos error code otherwise.
1637 krb5_error_code
smb_krb5_kt_get_name(TALLOC_CTX
*mem_ctx
,
1638 krb5_context context
,
1640 const char **keytab_name
)
1642 char keytab_string
[MAX_KEYTAB_NAME_LEN
];
1643 krb5_error_code ret
= 0;
1645 ret
= krb5_kt_get_name(context
, keytab
,
1646 keytab_string
, MAX_KEYTAB_NAME_LEN
- 2);
1651 *keytab_name
= talloc_strdup(mem_ctx
, keytab_string
);
1652 if (!*keytab_name
) {
1660 * @brief Seek and delete old entries in a keytab based on the passed
1663 * @param[in] context The KRB5 context to use.
1665 * @param[in] keytab The keytab to operate on.
1667 * @param[in] keep_old_kvno Keep the entries with the previous kvno.
1669 * @param[in] kvno The kvno to use.
1671 * @param[in] enctype_only Only evaluate the enctype argument if true
1673 * @param[in] enctype Only search for entries with the specified enctype
1675 * @param[in] princ_s The principal as a string to search for.
1677 * @param[in] princ The principal as a krb5_principal to search for.
1679 * @param[in] flush Whether to flush the complete keytab.
1681 * @retval 0 on Success
1683 * @return An appropriate KRB5 error code.
1685 krb5_error_code
smb_krb5_kt_seek_and_delete_old_entries(krb5_context context
,
1690 krb5_enctype enctype
,
1691 const char *princ_s
,
1692 krb5_principal princ
,
1695 krb5_error_code ret
;
1696 krb5_kt_cursor cursor
;
1697 krb5_keytab_entry kt_entry
;
1698 char *ktprinc
= NULL
;
1699 krb5_kvno old_kvno
= kvno
- 1;
1700 TALLOC_CTX
*tmp_ctx
;
1703 SMB_ASSERT(!keep_old_kvno
);
1704 SMB_ASSERT(!enctype_only
);
1705 SMB_ASSERT(princ_s
== NULL
);
1706 SMB_ASSERT(princ
== NULL
);
1708 SMB_ASSERT(princ_s
!= NULL
);
1709 SMB_ASSERT(princ
!= NULL
);
1712 ZERO_STRUCT(cursor
);
1713 ZERO_STRUCT(kt_entry
);
1716 * Start with talloc_new() and only then call krb5_kt_start_seq_get().
1717 * If any of them fails, the cleanup code is simpler.
1719 tmp_ctx
= talloc_new(NULL
);
1720 if (tmp_ctx
== NULL
) {
1724 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
1725 if (ret
== KRB5_KT_END
|| ret
== ENOENT
) {
1727 talloc_free(tmp_ctx
);
1731 DEBUG(3, (__location__
": Will try to delete old keytab entries\n"));
1732 while (!krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
)) {
1733 bool name_ok
= false;
1734 krb5_enctype kt_entry_enctype
=
1735 smb_krb5_kt_get_enctype_from_entry(&kt_entry
);
1737 if (princ_s
!= NULL
) {
1738 ret
= smb_krb5_unparse_name(tmp_ctx
, context
,
1742 DEBUG(1, (__location__
1743 ": smb_krb5_unparse_name failed "
1744 "(%s)\n", error_message(ret
)));
1748 #ifdef HAVE_KRB5_KT_COMPARE
1749 name_ok
= krb5_kt_compare(context
, &kt_entry
,
1752 name_ok
= (strcmp(ktprinc
, princ_s
) == 0);
1756 DEBUG(10, (__location__
": ignoring keytab "
1757 "entry principal %s, kvno = %d\n",
1758 ktprinc
, kt_entry
.vno
));
1761 * just free this entry and continue. */
1762 ret
= smb_krb5_kt_free_entry(context
,
1764 ZERO_STRUCT(kt_entry
);
1766 DEBUG(1, (__location__
1767 ": smb_krb5_kt_free_entry "
1769 error_message(ret
)));
1773 TALLOC_FREE(ktprinc
);
1777 TALLOC_FREE(ktprinc
);
1780 /*------------------------------------------------------------
1781 * Save the entries with kvno - 1. This is what microsoft does
1782 * to allow people with existing sessions that have kvno - 1
1783 * to still work. Otherwise, when the password for the machine
1784 * changes, all kerberized sessions will 'break' until either
1785 * the client reboots or the client's session key expires and
1786 * they get a new session ticket with the new kvno.
1787 * Some keytab files only store the kvno in 8bits, limit
1788 * the compare accordingly.
1791 if (keep_old_kvno
&& ((kt_entry
.vno
& 0xff) == (old_kvno
& 0xff))) {
1792 DEBUG(5, (__location__
": Saving previous (kvno %d) "
1793 "entry for principal: %s.\n",
1795 princ_s
!= NULL
? princ_s
: "UNKNOWN"));
1800 ((kt_entry
.vno
& 0xff) == (kvno
& 0xff)) &&
1801 (kt_entry_enctype
!= enctype
))
1803 DEBUG(5, (__location__
": Saving entry with kvno [%d] "
1804 "enctype [%d] for principal: %s.\n",
1805 kvno
, kt_entry_enctype
,
1806 princ_s
!= NULL
? princ_s
: "UNKNOWN"));
1810 DEBUG(5, (__location__
": Found old entry for principal: %s "
1811 "(kvno %d) - trying to remove it.\n",
1812 princ_s
!= NULL
? princ_s
: "UNKNOWN",
1815 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
1816 ZERO_STRUCT(cursor
);
1818 DEBUG(1, (__location__
": krb5_kt_end_seq_get() "
1819 "failed (%s)\n", error_message(ret
)));
1822 ret
= krb5_kt_remove_entry(context
, keytab
, &kt_entry
);
1824 DEBUG(1, (__location__
": krb5_kt_remove_entry() "
1825 "failed (%s)\n", error_message(ret
)));
1829 DEBUG(5, (__location__
": removed old entry for principal: "
1831 princ_s
!= NULL
? princ_s
: "UNKNOWN",
1834 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
1836 DEBUG(1, (__location__
": krb5_kt_start_seq() failed "
1837 "(%s)\n", error_message(ret
)));
1840 ret
= smb_krb5_kt_free_entry(context
, &kt_entry
);
1841 ZERO_STRUCT(kt_entry
);
1843 DEBUG(1, (__location__
": krb5_kt_remove_entry() "
1844 "failed (%s)\n", error_message(ret
)));
1850 talloc_free(tmp_ctx
);
1851 if (!all_zero((uint8_t *)&kt_entry
, sizeof(kt_entry
))) {
1852 smb_krb5_kt_free_entry(context
, &kt_entry
);
1854 if (!all_zero((uint8_t *)&cursor
, sizeof(cursor
))) {
1855 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
1861 * @brief Add a keytab entry for the given principal
1863 * @param[in] context The krb5 context to use.
1865 * @param[in] keytab The keytab to add the entry to.
1867 * @param[in] kvno The kvno to use.
1869 * @param[in] princ_s The principal as a string.
1871 * @param[in] salt_principal The salt principal to salt the password with.
1872 * Only needed for keys which support salting.
1873 * If no salt is used set no_salt to false and
1876 * @param[in] enctype The encryption type of the keytab entry.
1878 * @param[in] password The password of the keytab entry.
1880 * @param[in] no_salt If the password should not be salted. Normally
1881 * this is only set to false for encryption types
1882 * which do not support salting like RC4.
1884 * @retval 0 on Success
1886 * @return A corresponding KRB5 error code.
1888 * @see smb_krb5_kt_open()
1890 krb5_error_code
smb_krb5_kt_add_entry(krb5_context context
,
1893 const char *princ_s
,
1894 const char *salt_principal
,
1895 krb5_enctype enctype
,
1896 krb5_data
*password
,
1899 krb5_error_code ret
;
1900 krb5_keytab_entry kt_entry
;
1901 krb5_principal princ
= NULL
;
1902 krb5_keyblock
*keyp
;
1904 ZERO_STRUCT(kt_entry
);
1906 ret
= smb_krb5_parse_name(context
, princ_s
, &princ
);
1908 DEBUG(1, (__location__
": smb_krb5_parse_name(%s) "
1909 "failed (%s)\n", princ_s
, error_message(ret
)));
1913 /* Seek and delete old keytab entries */
1914 ret
= smb_krb5_kt_seek_and_delete_old_entries(context
,
1916 true, /* keep_old_kvno */
1918 true, /* enctype_only */
1927 /* If we get here, we have deleted all the old entries with kvno's
1928 * not equal to the current kvno-1. */
1930 keyp
= KRB5_KT_KEY(&kt_entry
);
1933 KRB5_KEY_DATA(keyp
) = (KRB5_KEY_DATA_CAST
*)SMB_MALLOC(password
->length
);
1934 if (KRB5_KEY_DATA(keyp
) == NULL
) {
1938 memcpy(KRB5_KEY_DATA(keyp
), password
->data
, password
->length
);
1939 KRB5_KEY_LENGTH(keyp
) = password
->length
;
1940 KRB5_KEY_TYPE(keyp
) = enctype
;
1942 krb5_principal salt_princ
= NULL
;
1944 /* Now add keytab entries for all encryption types */
1945 ret
= smb_krb5_parse_name(context
, salt_principal
, &salt_princ
);
1947 DBG_WARNING("krb5_parse_name(%s) failed (%s)\n",
1948 salt_principal
, error_message(ret
));
1952 ret
= smb_krb5_create_key_from_string(context
,
1958 krb5_free_principal(context
, salt_princ
);
1964 kt_entry
.principal
= princ
;
1965 kt_entry
.vno
= kvno
;
1967 DEBUG(3, (__location__
": adding keytab entry for (%s) with "
1968 "encryption type (%d) and version (%d)\n",
1969 princ_s
, enctype
, kt_entry
.vno
));
1970 ret
= krb5_kt_add_entry(context
, keytab
, &kt_entry
);
1971 krb5_free_keyblock_contents(context
, keyp
);
1972 ZERO_STRUCT(kt_entry
);
1974 DEBUG(1, (__location__
": adding entry to keytab "
1975 "failed (%s)\n", error_message(ret
)));
1981 krb5_free_principal(context
, princ
);
1987 #if defined(HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE) && \
1988 defined(HAVE_KRB5_GET_CREDS_OPT_ALLOC) && \
1989 defined(HAVE_KRB5_GET_CREDS)
1990 static krb5_error_code
smb_krb5_get_credentials_for_user_opt(krb5_context context
,
1993 krb5_principal server
,
1994 krb5_principal impersonate_princ
,
1995 krb5_creds
**out_creds
)
1997 krb5_error_code ret
;
1998 krb5_get_creds_opt opt
;
2000 ret
= krb5_get_creds_opt_alloc(context
, &opt
);
2004 krb5_get_creds_opt_add_options(context
, opt
, KRB5_GC_FORWARDABLE
);
2006 if (impersonate_princ
) {
2007 ret
= krb5_get_creds_opt_set_impersonate(context
, opt
,
2014 ret
= krb5_get_creds(context
, opt
, ccache
, server
, out_creds
);
2021 krb5_get_creds_opt_free(context
, opt
);
2025 #endif /* HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE */
2027 #ifdef HAVE_KRB5_GET_CREDENTIALS_FOR_USER
2029 #if !HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER
2030 krb5_error_code KRB5_CALLCONV
2031 krb5_get_credentials_for_user(krb5_context context
, krb5_flags options
,
2032 krb5_ccache ccache
, krb5_creds
*in_creds
,
2033 krb5_data
*subject_cert
,
2034 krb5_creds
**out_creds
);
2035 #endif /* !HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER */
2037 static krb5_error_code
smb_krb5_get_credentials_for_user(krb5_context context
,
2040 krb5_principal server
,
2041 krb5_principal impersonate_princ
,
2042 krb5_creds
**out_creds
)
2044 krb5_error_code ret
;
2045 krb5_creds in_creds
;
2047 ZERO_STRUCT(in_creds
);
2049 if (impersonate_princ
) {
2051 in_creds
.server
= me
;
2052 in_creds
.client
= impersonate_princ
;
2054 ret
= krb5_get_credentials_for_user(context
,
2055 0, /* krb5_flags options */
2058 NULL
, /* krb5_data *subject_cert */
2061 in_creds
.client
= me
;
2062 in_creds
.server
= server
;
2064 ret
= krb5_get_credentials(context
, 0, ccache
,
2065 &in_creds
, out_creds
);
2070 #endif /* HAVE_KRB5_GET_CREDENTIALS_FOR_USER */
2073 * smb_krb5_get_credentials
2075 * @brief Get krb5 credentials for a server
2077 * @param[in] context An initialized krb5_context
2078 * @param[in] ccache An initialized krb5_ccache
2079 * @param[in] me The krb5_principal of the caller
2080 * @param[in] server The krb5_principal of the requested service
2081 * @param[in] impersonate_princ The krb5_principal of a user to impersonate as (optional)
2082 * @param[out] out_creds The returned krb5_creds structure
2083 * @return krb5_error_code
2086 krb5_error_code
smb_krb5_get_credentials(krb5_context context
,
2089 krb5_principal server
,
2090 krb5_principal impersonate_princ
,
2091 krb5_creds
**out_creds
)
2093 krb5_error_code ret
;
2094 krb5_creds
*creds
= NULL
;
2096 if (out_creds
!= NULL
) {
2100 if (impersonate_princ
) {
2101 #ifdef HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE /* Heimdal */
2102 ret
= smb_krb5_get_credentials_for_user_opt(context
, ccache
, me
, server
, impersonate_princ
, &creds
);
2103 #elif defined(HAVE_KRB5_GET_CREDENTIALS_FOR_USER) /* MIT */
2104 ret
= smb_krb5_get_credentials_for_user(context
, ccache
, me
, server
, impersonate_princ
, &creds
);
2109 krb5_creds in_creds
;
2111 ZERO_STRUCT(in_creds
);
2113 in_creds
.client
= me
;
2114 in_creds
.server
= server
;
2116 ret
= krb5_get_credentials(context
, 0, ccache
,
2129 krb5_free_creds(context
, creds
);
2136 * @brief Initialize a krb5_keyblock with the given data.
2138 * Initializes a new keyblock, allocates the contents for the key and
2139 * copies the data into the keyblock.
2141 * @param[in] context The library context
2143 * @param[in] enctype The encryption type.
2145 * @param[in] data The date to initialize the keyblock with.
2147 * @param[in] length The length of the keyblock.
2149 * @param[in] key Newly allocated keyblock structure.
2151 * The key date must be freed using krb5_free_keyblock_contents() when it is
2154 * @return 0 on success, a Kerberos error code otherwise.
2156 krb5_error_code
smb_krb5_keyblock_init_contents(krb5_context context
,
2157 krb5_enctype enctype
,
2162 #if defined(HAVE_KRB5_KEYBLOCK_INIT)
2163 return krb5_keyblock_init(context
, enctype
, data
, length
, key
);
2165 memset(key
, 0, sizeof(krb5_keyblock
));
2166 KRB5_KEY_DATA(key
) = SMB_MALLOC(length
);
2167 if (NULL
== KRB5_KEY_DATA(key
)) {
2170 memcpy(KRB5_KEY_DATA(key
), data
, length
);
2171 KRB5_KEY_LENGTH(key
) = length
;
2172 KRB5_KEY_TYPE(key
) = enctype
;
2178 * @brief Simulate a kinit by putting the tgt in the given credential cache.
2180 * This function uses a keyblock rather than needing the original password.
2182 * @param[in] ctx The library context
2184 * @param[in] cc The credential cache to put the tgt in.
2186 * @param[in] principal The client princial
2188 * @param[in] keyblock The keyblock to use.
2190 * @param[in] target_service The service name of the initial credentials (or NULL).
2192 * @param[in] krb_options Initial credential options.
2194 * @param[in] expire_time A pointer to store the expiration time of the
2195 * credentials (or NULL).
2197 * @param[in] kdc_time A pointer to store the time when the ticket becomes
2200 * @return 0 on success, a Kerberos error code otherwise.
2202 krb5_error_code
smb_krb5_kinit_keyblock_ccache(krb5_context ctx
,
2204 krb5_principal principal
,
2205 krb5_keyblock
*keyblock
,
2206 const char *target_service
,
2207 krb5_get_init_creds_opt
*krb_options
,
2208 time_t *expire_time
,
2211 krb5_error_code code
= 0;
2212 krb5_creds my_creds
;
2214 #if defined(HAVE_KRB5_GET_INIT_CREDS_KEYBLOCK)
2215 code
= krb5_get_init_creds_keyblock(ctx
, &my_creds
, principal
,
2216 keyblock
, 0, target_service
,
2218 #elif defined(HAVE_KRB5_GET_INIT_CREDS_KEYTAB)
2220 #define SMB_CREDS_KEYTAB "MEMORY:tmp_kinit_keyblock_ccache"
2221 char tmp_name
[64] = {0};
2222 krb5_keytab_entry entry
;
2226 memset(&entry
, 0, sizeof(entry
));
2227 entry
.principal
= principal
;
2228 *(KRB5_KT_KEY(&entry
)) = *keyblock
;
2230 rc
= snprintf(tmp_name
, sizeof(tmp_name
),
2235 return KRB5_KT_BADNAME
;
2237 code
= krb5_kt_resolve(ctx
, tmp_name
, &keytab
);
2242 code
= krb5_kt_add_entry(ctx
, keytab
, &entry
);
2244 (void)krb5_kt_close(ctx
, keytab
);
2248 code
= krb5_get_init_creds_keytab(ctx
, &my_creds
, principal
,
2249 keytab
, 0, target_service
,
2251 (void)krb5_kt_close(ctx
, keytab
);
2254 #error krb5_get_init_creds_keyblock not available!
2260 #ifndef SAMBA4_USES_HEIMDAL /* MIT */
2262 * We need to store the principal as returned from the KDC to the
2263 * credentials cache. If we don't do that the KRB5 library is not
2264 * able to find the tickets it is looking for
2266 principal
= my_creds
.client
;
2268 code
= krb5_cc_initialize(ctx
, cc
, principal
);
2273 code
= krb5_cc_store_cred(ctx
, cc
, &my_creds
);
2279 *expire_time
= (time_t) my_creds
.times
.endtime
;
2283 *kdc_time
= (time_t) my_creds
.times
.starttime
;
2288 krb5_free_cred_contents(ctx
, &my_creds
);
2293 * @brief Simulate a kinit by putting the tgt in the given credential cache.
2295 * @param[in] ctx The library context
2297 * @param[in] cc The credential cache to put the tgt in.
2299 * @param[in] principal The client princial
2301 * @param[in] password The password (or NULL).
2303 * @param[in] target_service The service name of the initial credentials (or NULL).
2305 * @param[in] krb_options Initial credential options.
2307 * @param[in] expire_time A pointer to store the expiration time of the
2308 * credentials (or NULL).
2310 * @param[in] kdc_time A pointer to store the time when the ticket becomes
2313 * @return 0 on success, a Kerberos error code otherwise.
2315 krb5_error_code
smb_krb5_kinit_password_ccache(krb5_context ctx
,
2317 krb5_principal principal
,
2318 const char *password
,
2319 const char *target_service
,
2320 krb5_get_init_creds_opt
*krb_options
,
2321 time_t *expire_time
,
2324 krb5_error_code code
= 0;
2325 krb5_creds my_creds
;
2327 code
= krb5_get_init_creds_password(ctx
, &my_creds
, principal
,
2328 password
, NULL
, NULL
, 0,
2329 target_service
, krb_options
);
2335 * We need to store the principal as returned from the KDC to the
2336 * credentials cache. If we don't do that the KRB5 library is not
2337 * able to find the tickets it is looking for
2339 principal
= my_creds
.client
;
2340 code
= krb5_cc_initialize(ctx
, cc
, principal
);
2345 code
= krb5_cc_store_cred(ctx
, cc
, &my_creds
);
2351 *expire_time
= (time_t) my_creds
.times
.endtime
;
2355 *kdc_time
= (time_t) my_creds
.times
.starttime
;
2360 krb5_free_cred_contents(ctx
, &my_creds
);
2364 #ifdef SAMBA4_USES_HEIMDAL
2366 * @brief Simulate a kinit by putting the tgt in the given credential cache.
2368 * @param[in] ctx The library context
2370 * @param[in] cc The credential cache to store the tgt in.
2372 * @param[in] principal The initial client princial.
2374 * @param[in] password The password (or NULL).
2376 * @param[in] impersonate_principal The impersonation principal (or NULL).
2378 * @param[in] self_service The local service for S4U2Self if
2379 * impersonate_principal is specified).
2381 * @param[in] target_service The service name of the initial credentials
2382 * (kpasswd/REALM or a remote service). It defaults
2383 * to the krbtgt if NULL.
2385 * @param[in] krb_options Initial credential options.
2387 * @param[in] expire_time A pointer to store the expiration time of the
2388 * credentials (or NULL).
2390 * @param[in] kdc_time A pointer to store the time when the ticket becomes
2393 * @return 0 on success, a Kerberos error code otherwise.
2395 krb5_error_code
smb_krb5_kinit_s4u2_ccache(krb5_context ctx
,
2396 krb5_ccache store_cc
,
2397 krb5_principal init_principal
,
2398 const char *init_password
,
2399 krb5_principal impersonate_principal
,
2400 const char *self_service
,
2401 const char *target_service
,
2402 krb5_get_init_creds_opt
*krb_options
,
2403 time_t *expire_time
,
2406 krb5_error_code code
= 0;
2407 krb5_get_creds_opt options
;
2408 krb5_principal store_principal
;
2409 krb5_creds store_creds
;
2410 krb5_creds
*s4u2self_creds
;
2411 Ticket s4u2self_ticket
;
2412 size_t s4u2self_ticketlen
;
2413 krb5_creds
*s4u2proxy_creds
;
2414 krb5_principal self_princ
;
2416 krb5_principal target_princ
;
2418 const char *self_realm
;
2419 const char *client_realm
= NULL
;
2420 krb5_principal blacklist_principal
= NULL
;
2421 krb5_principal whitelist_principal
= NULL
;
2423 code
= krb5_get_init_creds_password(ctx
, &store_creds
,
2434 store_principal
= init_principal
;
2437 * We are trying S4U2Self now:
2439 * As we do not want to expose our TGT in the
2440 * krb5_ccache, which is also holds the impersonated creds.
2442 * Some low level krb5/gssapi function might use the TGT
2443 * identity and let the client act as our machine account.
2445 * We need to avoid that and use a temporary krb5_ccache
2446 * in order to pass our TGT to the krb5_get_creds() function.
2448 code
= krb5_cc_new_unique(ctx
, NULL
, NULL
, &tmp_cc
);
2450 krb5_free_cred_contents(ctx
, &store_creds
);
2454 code
= krb5_cc_initialize(ctx
, tmp_cc
, store_creds
.client
);
2456 krb5_cc_destroy(ctx
, tmp_cc
);
2457 krb5_free_cred_contents(ctx
, &store_creds
);
2461 code
= krb5_cc_store_cred(ctx
, tmp_cc
, &store_creds
);
2463 krb5_free_cred_contents(ctx
, &store_creds
);
2464 krb5_cc_destroy(ctx
, tmp_cc
);
2469 * we need to remember the client principal of our
2470 * TGT and make sure the KDC does not return this
2471 * in the impersonated tickets. This can happen
2472 * if the KDC does not support S4U2Self and S4U2Proxy.
2474 blacklist_principal
= store_creds
.client
;
2475 store_creds
.client
= NULL
;
2476 krb5_free_cred_contents(ctx
, &store_creds
);
2479 * Check if we also need S4U2Proxy or if S4U2Self is
2480 * enough in order to get a ticket for the target.
2482 if (target_service
== NULL
) {
2484 } else if (strcmp(target_service
, self_service
) == 0) {
2491 * For S4U2Self we need our own service principal,
2492 * which belongs to our own realm (available on
2493 * our client principal).
2495 self_realm
= krb5_principal_get_realm(ctx
, init_principal
);
2497 code
= krb5_parse_name(ctx
, self_service
, &self_princ
);
2499 krb5_free_principal(ctx
, blacklist_principal
);
2500 krb5_cc_destroy(ctx
, tmp_cc
);
2504 code
= krb5_principal_set_realm(ctx
, self_princ
, self_realm
);
2506 krb5_free_principal(ctx
, blacklist_principal
);
2507 krb5_free_principal(ctx
, self_princ
);
2508 krb5_cc_destroy(ctx
, tmp_cc
);
2512 code
= krb5_get_creds_opt_alloc(ctx
, &options
);
2514 krb5_free_principal(ctx
, blacklist_principal
);
2515 krb5_free_principal(ctx
, self_princ
);
2516 krb5_cc_destroy(ctx
, tmp_cc
);
2522 * If we want S4U2Proxy, we need the forwardable flag
2523 * on the S4U2Self ticket.
2525 krb5_get_creds_opt_set_options(ctx
, options
, KRB5_GC_FORWARDABLE
);
2528 code
= krb5_get_creds_opt_set_impersonate(ctx
, options
,
2529 impersonate_principal
);
2531 krb5_get_creds_opt_free(ctx
, options
);
2532 krb5_free_principal(ctx
, blacklist_principal
);
2533 krb5_free_principal(ctx
, self_princ
);
2534 krb5_cc_destroy(ctx
, tmp_cc
);
2538 code
= krb5_get_creds(ctx
, options
, tmp_cc
,
2539 self_princ
, &s4u2self_creds
);
2540 krb5_get_creds_opt_free(ctx
, options
);
2541 krb5_free_principal(ctx
, self_princ
);
2543 krb5_free_principal(ctx
, blacklist_principal
);
2544 krb5_cc_destroy(ctx
, tmp_cc
);
2549 krb5_cc_destroy(ctx
, tmp_cc
);
2552 * Now make sure we store the impersonated principal
2553 * and creds instead of the TGT related stuff
2554 * in the krb5_ccache of the caller.
2556 code
= krb5_copy_creds_contents(ctx
, s4u2self_creds
,
2558 krb5_free_creds(ctx
, s4u2self_creds
);
2564 * It's important to store the principal the KDC
2565 * returned, as otherwise the caller would not find
2566 * the S4U2Self ticket in the krb5_ccache lookup.
2568 store_principal
= store_creds
.client
;
2573 * We are trying S4U2Proxy:
2575 * We need the ticket from the S4U2Self step
2576 * and our TGT in order to get the delegated ticket.
2578 code
= decode_Ticket((const uint8_t *)s4u2self_creds
->ticket
.data
,
2579 s4u2self_creds
->ticket
.length
,
2581 &s4u2self_ticketlen
);
2583 krb5_free_creds(ctx
, s4u2self_creds
);
2584 krb5_free_principal(ctx
, blacklist_principal
);
2585 krb5_cc_destroy(ctx
, tmp_cc
);
2590 * we need to remember the client principal of the
2591 * S4U2Self stage and as it needs to match the one we
2592 * will get for the S4U2Proxy stage. We need this
2593 * in order to detect KDCs which does not support S4U2Proxy.
2595 whitelist_principal
= s4u2self_creds
->client
;
2596 s4u2self_creds
->client
= NULL
;
2597 krb5_free_creds(ctx
, s4u2self_creds
);
2600 * For S4U2Proxy we also got a target service principal,
2601 * which also belongs to our own realm (available on
2602 * our client principal).
2604 code
= krb5_parse_name(ctx
, target_service
, &target_princ
);
2606 free_Ticket(&s4u2self_ticket
);
2607 krb5_free_principal(ctx
, whitelist_principal
);
2608 krb5_free_principal(ctx
, blacklist_principal
);
2609 krb5_cc_destroy(ctx
, tmp_cc
);
2613 code
= krb5_principal_set_realm(ctx
, target_princ
, self_realm
);
2615 free_Ticket(&s4u2self_ticket
);
2616 krb5_free_principal(ctx
, target_princ
);
2617 krb5_free_principal(ctx
, whitelist_principal
);
2618 krb5_free_principal(ctx
, blacklist_principal
);
2619 krb5_cc_destroy(ctx
, tmp_cc
);
2623 code
= krb5_get_creds_opt_alloc(ctx
, &options
);
2625 free_Ticket(&s4u2self_ticket
);
2626 krb5_free_principal(ctx
, target_princ
);
2627 krb5_free_principal(ctx
, whitelist_principal
);
2628 krb5_free_principal(ctx
, blacklist_principal
);
2629 krb5_cc_destroy(ctx
, tmp_cc
);
2633 krb5_get_creds_opt_set_options(ctx
, options
, KRB5_GC_FORWARDABLE
);
2634 krb5_get_creds_opt_set_options(ctx
, options
, KRB5_GC_CONSTRAINED_DELEGATION
);
2636 code
= krb5_get_creds_opt_set_ticket(ctx
, options
, &s4u2self_ticket
);
2637 free_Ticket(&s4u2self_ticket
);
2639 krb5_get_creds_opt_free(ctx
, options
);
2640 krb5_free_principal(ctx
, target_princ
);
2641 krb5_free_principal(ctx
, whitelist_principal
);
2642 krb5_free_principal(ctx
, blacklist_principal
);
2643 krb5_cc_destroy(ctx
, tmp_cc
);
2647 code
= krb5_get_creds(ctx
, options
, tmp_cc
,
2648 target_princ
, &s4u2proxy_creds
);
2649 krb5_get_creds_opt_free(ctx
, options
);
2650 krb5_free_principal(ctx
, target_princ
);
2651 krb5_cc_destroy(ctx
, tmp_cc
);
2653 krb5_free_principal(ctx
, whitelist_principal
);
2654 krb5_free_principal(ctx
, blacklist_principal
);
2659 * Now make sure we store the impersonated principal
2660 * and creds instead of the TGT related stuff
2661 * in the krb5_ccache of the caller.
2663 code
= krb5_copy_creds_contents(ctx
, s4u2proxy_creds
,
2665 krb5_free_creds(ctx
, s4u2proxy_creds
);
2667 krb5_free_principal(ctx
, whitelist_principal
);
2668 krb5_free_principal(ctx
, blacklist_principal
);
2673 * It's important to store the principal the KDC
2674 * returned, as otherwise the caller would not find
2675 * the S4U2Self ticket in the krb5_ccache lookup.
2677 store_principal
= store_creds
.client
;
2680 if (blacklist_principal
&&
2681 krb5_principal_compare(ctx
, store_creds
.client
, blacklist_principal
)) {
2685 code
= krb5_unparse_name(ctx
, blacklist_principal
, &sp
);
2689 code
= krb5_unparse_name(ctx
, impersonate_principal
, &ip
);
2693 DBG_WARNING("KDC returned self principal[%s] while impersonating [%s]\n",
2694 sp
?sp
:"<no memory>",
2695 ip
?ip
:"<no memory>");
2700 krb5_free_principal(ctx
, whitelist_principal
);
2701 krb5_free_principal(ctx
, blacklist_principal
);
2702 krb5_free_cred_contents(ctx
, &store_creds
);
2703 return KRB5_FWD_BAD_PRINCIPAL
;
2705 if (blacklist_principal
) {
2706 krb5_free_principal(ctx
, blacklist_principal
);
2709 if (whitelist_principal
&&
2710 !krb5_principal_compare(ctx
, store_creds
.client
, whitelist_principal
)) {
2714 code
= krb5_unparse_name(ctx
, store_creds
.client
, &sp
);
2718 code
= krb5_unparse_name(ctx
, whitelist_principal
, &ep
);
2722 DBG_WARNING("KDC returned wrong principal[%s] we expected [%s]\n",
2723 sp
?sp
:"<no memory>",
2724 ep
?ep
:"<no memory>");
2729 krb5_free_principal(ctx
, whitelist_principal
);
2730 krb5_free_cred_contents(ctx
, &store_creds
);
2731 return KRB5_FWD_BAD_PRINCIPAL
;
2733 if (whitelist_principal
) {
2734 krb5_free_principal(ctx
, whitelist_principal
);
2737 code
= krb5_cc_initialize(ctx
, store_cc
, store_principal
);
2739 krb5_free_cred_contents(ctx
, &store_creds
);
2743 code
= krb5_cc_store_cred(ctx
, store_cc
, &store_creds
);
2745 krb5_free_cred_contents(ctx
, &store_creds
);
2749 client_realm
= krb5_principal_get_realm(ctx
, store_creds
.client
);
2750 if (client_realm
!= NULL
) {
2752 * Because the CANON flag doesn't have any impact
2753 * on the impersonate_principal => store_creds.client
2754 * realm mapping. We need to store the credentials twice,
2755 * once with the returned realm and once with the
2756 * realm of impersonate_principal.
2758 code
= krb5_principal_set_realm(ctx
, store_creds
.server
,
2761 krb5_free_cred_contents(ctx
, &store_creds
);
2765 code
= krb5_cc_store_cred(ctx
, store_cc
, &store_creds
);
2767 krb5_free_cred_contents(ctx
, &store_creds
);
2773 *expire_time
= (time_t) store_creds
.times
.endtime
;
2777 *kdc_time
= (time_t) store_creds
.times
.starttime
;
2780 krb5_free_cred_contents(ctx
, &store_creds
);
2787 static bool princ_compare_no_dollar(krb5_context ctx
,
2791 krb5_principal mod
= NULL
;
2794 if (a
->length
== 1 && b
->length
== 1 &&
2795 a
->data
[0].length
!= 0 && b
->data
[0].length
!= 0 &&
2796 a
->data
[0].data
[a
->data
[0].length
- 1] !=
2797 b
->data
[0].data
[b
->data
[0].length
- 1]) {
2798 if (a
->data
[0].data
[a
->data
[0].length
- 1] == '$') {
2800 mod
->data
[0].length
--;
2801 } else if (b
->data
[0].data
[b
->data
[0].length
- 1] == '$') {
2803 mod
->data
[0].length
--;
2807 cmp
= krb5_principal_compare_flags(ctx
,
2810 KRB5_PRINCIPAL_COMPARE_CASEFOLD
);
2812 mod
->data
[0].length
++;
2818 krb5_error_code
smb_krb5_kinit_s4u2_ccache(krb5_context ctx
,
2819 krb5_ccache store_cc
,
2820 krb5_principal init_principal
,
2821 const char *init_password
,
2822 krb5_principal impersonate_principal
,
2823 const char *self_service
,
2824 const char *target_service
,
2825 krb5_get_init_creds_opt
*krb_options
,
2826 time_t *expire_time
,
2829 krb5_error_code code
;
2830 krb5_principal self_princ
= NULL
;
2831 krb5_principal target_princ
= NULL
;
2832 krb5_creds
*store_creds
= NULL
;
2833 krb5_creds
*s4u2self_creds
= NULL
;
2834 krb5_creds
*s4u2proxy_creds
= NULL
;
2835 krb5_creds init_creds
= {0};
2836 krb5_creds mcreds
= {0};
2837 krb5_flags options
= KRB5_GC_NO_STORE
;
2839 bool s4u2proxy
= false;
2842 code
= krb5_cc_new_unique(ctx
, "MEMORY", NULL
, &tmp_cc
);
2847 code
= krb5_get_init_creds_password(ctx
,
2860 code
= krb5_cc_initialize(ctx
, tmp_cc
, init_creds
.client
);
2865 code
= krb5_cc_store_cred(ctx
, tmp_cc
, &init_creds
);
2871 * Check if we also need S4U2Proxy or if S4U2Self is
2872 * enough in order to get a ticket for the target.
2874 if (target_service
== NULL
) {
2876 } else if (strcmp(target_service
, self_service
) == 0) {
2882 code
= krb5_parse_name(ctx
, self_service
, &self_princ
);
2888 * MIT lacks aliases support in S4U, for S4U2Self we require the tgt
2889 * client and the request server to be the same principal name.
2891 ok
= princ_compare_no_dollar(ctx
, init_creds
.client
, self_princ
);
2893 code
= KRB5KDC_ERR_PADATA_TYPE_NOSUPP
;
2897 mcreds
.client
= impersonate_principal
;
2898 mcreds
.server
= init_creds
.client
;
2900 code
= krb5_get_credentials_for_user(ctx
, options
, tmp_cc
, &mcreds
,
2901 NULL
, &s4u2self_creds
);
2907 code
= krb5_parse_name(ctx
, target_service
, &target_princ
);
2912 mcreds
.client
= init_creds
.client
;
2913 mcreds
.server
= target_princ
;
2914 mcreds
.second_ticket
= s4u2self_creds
->ticket
;
2916 code
= krb5_get_credentials(ctx
, options
|
2917 KRB5_GC_CONSTRAINED_DELEGATION
,
2918 tmp_cc
, &mcreds
, &s4u2proxy_creds
);
2923 /* Check KDC support of S4U2Proxy extension */
2924 if (!krb5_principal_compare(ctx
, s4u2self_creds
->client
,
2925 s4u2proxy_creds
->client
)) {
2926 code
= KRB5KDC_ERR_PADATA_TYPE_NOSUPP
;
2930 store_creds
= s4u2proxy_creds
;
2932 store_creds
= s4u2self_creds
;;
2934 /* We need to save the ticket with the requested server name
2935 * or the caller won't be able to find it in cache. */
2936 if (!krb5_principal_compare(ctx
, self_princ
,
2937 store_creds
->server
)) {
2938 krb5_free_principal(ctx
, store_creds
->server
);
2939 store_creds
->server
= NULL
;
2940 code
= krb5_copy_principal(ctx
, self_princ
,
2941 &store_creds
->server
);
2948 code
= krb5_cc_initialize(ctx
, store_cc
, store_creds
->client
);
2953 code
= krb5_cc_store_cred(ctx
, store_cc
, store_creds
);
2959 *expire_time
= (time_t) store_creds
->times
.endtime
;
2963 *kdc_time
= (time_t) store_creds
->times
.starttime
;
2967 krb5_cc_destroy(ctx
, tmp_cc
);
2968 krb5_free_cred_contents(ctx
, &init_creds
);
2969 krb5_free_creds(ctx
, s4u2self_creds
);
2970 krb5_free_creds(ctx
, s4u2proxy_creds
);
2971 krb5_free_principal(ctx
, self_princ
);
2972 krb5_free_principal(ctx
, target_princ
);
2978 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
2980 * @brief Create a principal name using a variable argument list.
2982 * @param[in] context The library context.
2984 * @param[inout] principal A pointer to the principal structure.
2986 * @param[in] _realm The realm to use. If NULL then the function will
2987 * get the default realm name.
2989 * @param[in] ... A list of 'char *' components, ending with NULL.
2991 * Use krb5_free_principal() to free the principal when it is no longer needed.
2993 * @return 0 on success, a Kerberos error code otherwise.
2995 krb5_error_code
smb_krb5_make_principal(krb5_context context
,
2996 krb5_principal
*principal
,
2997 const char *_realm
, ...)
2999 krb5_error_code code
;
3005 realm
= discard_const_p(char, _realm
);
3008 code
= krb5_get_default_realm(context
, &realm
);
3015 va_start(ap
, _realm
);
3016 code
= krb5_build_principal_alloc_va(context
, principal
,
3017 strlen(realm
), realm
,
3022 krb5_free_default_realm(context
, realm
);
3029 #if !defined(HAVE_KRB5_CC_GET_LIFETIME) && defined(HAVE_KRB5_CC_RETRIEVE_CRED)
3031 * @brief Get the lifetime of the initial ticket in the cache.
3033 * @param[in] context The kerberos context.
3035 * @param[in] id The credential cache to get the ticket lifetime.
3037 * @param[out] t A pointer to a time value to store the lifetime.
3039 * @return 0 on success, a krb5_error_code on error.
3041 krb5_error_code
smb_krb5_cc_get_lifetime(krb5_context context
,
3045 krb5_cc_cursor cursor
;
3046 krb5_error_code kerr
;
3052 kerr
= krb5_timeofday(context
, &now
);
3057 kerr
= krb5_cc_start_seq_get(context
, id
, &cursor
);
3062 while ((kerr
= krb5_cc_next_cred(context
, id
, &cursor
, &cred
)) == 0) {
3063 #ifndef HAVE_FLAGS_IN_KRB5_CREDS
3064 if (cred
.ticket_flags
& TKT_FLG_INITIAL
) {
3066 if (cred
.flags
.b
.initial
) {
3068 if (now
< cred
.times
.endtime
) {
3069 *t
= (time_t) (cred
.times
.endtime
- now
);
3071 krb5_free_cred_contents(context
, &cred
);
3074 krb5_free_cred_contents(context
, &cred
);
3077 krb5_cc_end_seq_get(context
, id
, &cursor
);
3081 #endif /* HAVE_KRB5_CC_GET_LIFETIME */
3083 #if !defined(HAVE_KRB5_FREE_CHECKSUM_CONTENTS) && defined(HAVE_FREE_CHECKSUM)
3084 void smb_krb5_free_checksum_contents(krb5_context ctx
, krb5_checksum
*cksum
)
3086 free_Checksum(cksum
);
3091 * @brief Compute a checksum operating on a keyblock.
3093 * This function computes a checksum over a PAC using the keyblock for a keyed
3096 * @param[in] mem_ctx A talloc context to allocate the signature on.
3098 * @param[in] pac_data The PAC as input.
3100 * @param[in] context The library context.
3102 * @param[in] keyblock Encryption key for a keyed checksum.
3104 * @param[out] sig_type The checksum type
3106 * @param[out] sig_blob The talloc'ed checksum
3108 * The caller must free the sig_blob with talloc_free() when it is not needed
3111 * @return 0 on success, a Kerberos error code otherwise.
3113 krb5_error_code
smb_krb5_make_pac_checksum(TALLOC_CTX
*mem_ctx
,
3114 DATA_BLOB
*pac_data
,
3115 krb5_context context
,
3116 const krb5_keyblock
*keyblock
,
3118 DATA_BLOB
*sig_blob
)
3120 krb5_error_code ret
;
3121 krb5_checksum cksum
;
3122 #if defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CREATE_CHECKSUM)
3126 ret
= krb5_crypto_init(context
,
3131 DEBUG(0,("krb5_crypto_init() failed: %s\n",
3132 smb_get_krb5_error_message(context
, ret
, mem_ctx
)));
3135 ret
= krb5_create_checksum(context
,
3137 KRB5_KU_OTHER_CKSUM
,
3143 DEBUG(2, ("PAC Verification failed: %s\n",
3144 smb_get_krb5_error_message(context
, ret
, mem_ctx
)));
3147 krb5_crypto_destroy(context
, crypto
);
3153 *sig_type
= cksum
.cksumtype
;
3154 *sig_blob
= data_blob_talloc(mem_ctx
,
3155 cksum
.checksum
.data
,
3156 cksum
.checksum
.length
);
3157 #elif defined(HAVE_KRB5_C_MAKE_CHECKSUM)
3160 input
.data
= (char *)pac_data
->data
;
3161 input
.length
= pac_data
->length
;
3163 ret
= krb5_c_make_checksum(context
,
3166 KRB5_KEYUSAGE_APP_DATA_CKSUM
,
3170 DEBUG(2, ("PAC Verification failed: %s\n",
3171 smb_get_krb5_error_message(context
, ret
, mem_ctx
)));
3175 *sig_type
= cksum
.checksum_type
;
3176 *sig_blob
= data_blob_talloc(mem_ctx
,
3181 #error krb5_create_checksum or krb5_c_make_checksum not available
3182 #endif /* HAVE_KRB5_C_MAKE_CHECKSUM */
3183 smb_krb5_free_checksum_contents(context
, &cksum
);
3190 * @brief Get realm of a principal
3192 * @param[in] mem_ctx The talloc ctx to put the result on
3194 * @param[in] context The library context
3196 * @param[in] principal The principal to get the realm from.
3198 * @return A talloced string with the realm or NULL if an error occurred.
3200 char *smb_krb5_principal_get_realm(TALLOC_CTX
*mem_ctx
,
3201 krb5_context context
,
3202 krb5_const_principal principal
)
3204 #ifdef HAVE_KRB5_PRINCIPAL_GET_REALM /* Heimdal */
3205 const char *realm
= NULL
;
3207 realm
= krb5_principal_get_realm(context
, principal
);
3208 if (realm
== NULL
) {
3212 return talloc_strdup(mem_ctx
, realm
);
3213 #elif defined(krb5_princ_realm) /* MIT */
3214 const krb5_data
*realm
= NULL
;
3216 realm
= krb5_princ_realm(context
, principal
);
3217 if (realm
== NULL
) {
3221 return talloc_strndup(mem_ctx
, realm
->data
, realm
->length
);
3223 #error UNKNOWN_GET_PRINC_REALM_FUNCTIONS
3228 * @brief Get realm of a principal
3230 * @param[in] context The library context
3232 * @param[in] principal The principal to set the realm
3234 * @param[in] realm The realm as a string to set.
3236 * @return 0 on success, a Kerberos error code otherwise.
3238 krb5_error_code
smb_krb5_principal_set_realm(krb5_context context
,
3239 krb5_principal principal
,
3242 #ifdef HAVE_KRB5_PRINCIPAL_SET_REALM /* Heimdal */
3243 return krb5_principal_set_realm(context
, principal
, realm
);
3244 #elif defined(krb5_princ_realm) && defined(krb5_princ_set_realm) /* MIT */
3245 krb5_error_code ret
;
3247 krb5_data
*old_data
;
3249 old_data
= krb5_princ_realm(context
, principal
);
3251 ret
= smb_krb5_copy_data_contents(&data
,
3258 /* free realm before setting */
3259 free(old_data
->data
);
3261 krb5_princ_set_realm(context
, principal
, &data
);
3265 #error UNKNOWN_PRINC_SET_REALM_FUNCTION
3271 * @brief Get the realm from the service hostname.
3273 * This function will look for a domain realm mapping in the [domain_realm]
3274 * section of the krb5.conf first and fallback to extract the realm from
3275 * the provided service hostname. As a last resort it will return the
3276 * provided client_realm.
3278 * @param[in] mem_ctx The talloc context
3280 * @param[in] hostname The service hostname
3282 * @param[in] client_realm If we can not find a mapping, fall back to
3285 * @return The realm to use for the service hostname, NULL if a fatal error
3288 char *smb_krb5_get_realm_from_hostname(TALLOC_CTX
*mem_ctx
,
3289 const char *hostname
,
3290 const char *client_realm
)
3292 #if defined(HAVE_KRB5_REALM_TYPE)
3294 krb5_realm
*realm_list
= NULL
;
3297 char **realm_list
= NULL
;
3300 krb5_error_code kerr
;
3301 krb5_context ctx
= NULL
;
3303 kerr
= smb_krb5_init_context_common(&ctx
);
3305 DBG_ERR("kerberos init context failed (%s)\n",
3306 error_message(kerr
));
3310 kerr
= krb5_get_host_realm(ctx
, hostname
, &realm_list
);
3311 if (kerr
== KRB5_ERR_HOST_REALM_UNKNOWN
) {
3316 DEBUG(3,("kerberos_get_realm_from_hostname %s: "
3318 hostname
? hostname
: "(NULL)",
3319 error_message(kerr
) ));
3323 if (realm_list
!= NULL
&&
3324 realm_list
[0] != NULL
&&
3325 realm_list
[0][0] != '\0') {
3326 realm
= talloc_strdup(mem_ctx
, realm_list
[0]);
3327 if (realm
== NULL
) {
3331 const char *p
= NULL
;
3334 * "dc6.samba2003.example.com"
3335 * returns a realm of "SAMBA2003.EXAMPLE.COM"
3337 * "dc6." returns realm as NULL
3339 p
= strchr_m(hostname
, '.');
3340 if (p
!= NULL
&& p
[1] != '\0') {
3341 realm
= talloc_strdup_upper(mem_ctx
, p
+ 1);
3342 if (realm
== NULL
) {
3348 if (realm
== NULL
) {
3349 realm
= talloc_strdup(mem_ctx
, client_realm
);
3356 krb5_free_host_realm(ctx
, realm_list
);
3359 krb5_free_context(ctx
);
3366 * @brief Get an error string from a Kerberos error code.
3368 * @param[in] context The library context.
3370 * @param[in] code The Kerberos error code.
3372 * @param[in] mem_ctx The talloc context to allocate the error string on.
3374 * @return A talloc'ed error string or NULL if an error occurred.
3376 * The caller must free the returned error string with talloc_free() if not
3379 char *smb_get_krb5_error_message(krb5_context context
,
3380 krb5_error_code code
,
3381 TALLOC_CTX
*mem_ctx
)
3385 #if defined(HAVE_KRB5_GET_ERROR_MESSAGE) && defined(HAVE_KRB5_FREE_ERROR_MESSAGE)
3386 const char *context_error
= krb5_get_error_message(context
, code
);
3387 if (context_error
) {
3388 ret
= talloc_asprintf(mem_ctx
, "%s: %s",
3389 error_message(code
), context_error
);
3390 krb5_free_error_message(context
, context_error
);
3394 ret
= talloc_strdup(mem_ctx
, error_message(code
));
3399 * @brief Return the type of a krb5_principal
3401 * @param[in] context The library context.
3403 * @param[in] principal The principal to get the type from.
3405 * @return The integer type of the principal.
3407 int smb_krb5_principal_get_type(krb5_context context
,
3408 krb5_const_principal principal
)
3410 #ifdef HAVE_KRB5_PRINCIPAL_GET_TYPE /* Heimdal */
3411 return krb5_principal_get_type(context
, principal
);
3412 #elif defined(krb5_princ_type) /* MIT */
3413 return krb5_princ_type(context
, principal
);
3415 #error UNKNOWN_PRINC_GET_TYPE_FUNCTION
3420 * @brief Set the type of a principal
3422 * @param[in] context The library context
3424 * @param[inout] principal The principal to set the type for.
3426 * @param[in] type The principal type to set.
3428 void smb_krb5_principal_set_type(krb5_context context
,
3429 krb5_principal principal
,
3432 #ifdef HAVE_KRB5_PRINCIPAL_SET_TYPE /* Heimdal */
3433 krb5_principal_set_type(context
, principal
, type
);
3434 #elif defined(krb5_princ_type) /* MIT */
3435 krb5_princ_type(context
, principal
) = type
;
3437 #error UNKNOWN_PRINC_SET_TYPE_FUNCTION
3442 * @brief Check if a principal is a TGS
3444 * @param[in] context The library context
3446 * @param[inout] principal The principal to check.
3448 * @returns 1 if equal, 0 if not and -1 on error.
3450 int smb_krb5_principal_is_tgs(krb5_context context
,
3451 krb5_const_principal principal
)
3455 krb5_error_code ret
= 0;
3457 if (krb5_princ_size(context
, principal
) > 2) {
3461 ret
= smb_krb5_principal_get_comp_string(NULL
, context
, principal
, 0, &p
);
3462 if (ret
== ENOENT
) {
3468 eq
= strcmp(p
, KRB5_TGS_NAME
) == 0;
3475 #if !defined(HAVE_KRB5_WARNX)
3477 * @brief Log a Kerberos message
3479 * It sends the message to com_err.
3481 * @param[in] context The library context
3483 * @param[in] fmt The message format
3485 * @param[in] ... The message arguments
3487 * @return 0 on success.
3489 krb5_error_code
krb5_warnx(krb5_context context
, const char *fmt
, ...)
3493 va_start(args
, fmt
);
3494 com_err_va("samba-kdc", errno
, fmt
, args
);
3502 * @brief Copy a credential cache.
3504 * @param[in] context The library context.
3506 * @param[in] incc Credential cache to be copied.
3508 * @param[inout] outcc Copy of credential cache to be filled in.
3510 * @return 0 on success, a Kerberos error code otherwise.
3512 krb5_error_code
smb_krb5_cc_copy_creds(krb5_context context
,
3513 krb5_ccache incc
, krb5_ccache outcc
)
3515 #ifdef HAVE_KRB5_CC_COPY_CACHE /* Heimdal */
3516 return krb5_cc_copy_cache(context
, incc
, outcc
);
3517 #elif defined(HAVE_KRB5_CC_COPY_CREDS)
3518 krb5_error_code ret
;
3519 krb5_principal princ
= NULL
;
3521 ret
= krb5_cc_get_principal(context
, incc
, &princ
);
3525 ret
= krb5_cc_initialize(context
, outcc
, princ
);
3526 krb5_free_principal(context
, princ
);
3530 return krb5_cc_copy_creds(context
, incc
, outcc
);
3532 #error UNKNOWN_KRB5_CC_COPY_CACHE_OR_CREDS_FUNCTION
3536 /**********************************************************
3538 **********************************************************/
3540 static bool ads_cleanup_expired_creds(krb5_context context
,
3544 krb5_error_code retval
;
3545 const char *cc_type
= krb5_cc_get_type(context
, ccache
);
3547 DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
3548 cc_type
, krb5_cc_get_name(context
, ccache
),
3549 http_timestring(talloc_tos(), credsp
->times
.endtime
)));
3551 /* we will probably need new tickets if the current ones
3552 will expire within 10 seconds.
3554 if (credsp
->times
.endtime
>= (time(NULL
) + 10))
3557 /* heimdal won't remove creds from a file ccache, and
3558 perhaps we shouldn't anyway, since internally we
3559 use memory ccaches, and a FILE one probably means that
3560 we're using creds obtained outside of our executable
3562 if (strequal(cc_type
, "FILE")) {
3563 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type
));
3567 retval
= krb5_cc_remove_cred(context
, ccache
, 0, credsp
);
3569 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
3570 error_message(retval
)));
3571 /* If we have an error in this, we want to display it,
3572 but continue as though we deleted it */
3577 /* Allocate and setup the auth context into the state we need. */
3579 static krb5_error_code
ads_setup_auth_context(krb5_context context
,
3580 krb5_auth_context
*auth_context
)
3582 krb5_error_code retval
;
3584 retval
= krb5_auth_con_init(context
, auth_context
);
3586 DEBUG(1,("krb5_auth_con_init failed (%s)\n",
3587 error_message(retval
)));
3591 /* Ensure this is an addressless ticket. */
3592 retval
= krb5_auth_con_setaddrs(context
, *auth_context
, NULL
, NULL
);
3594 DEBUG(1,("krb5_auth_con_setaddrs failed (%s)\n",
3595 error_message(retval
)));
3601 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
3602 static krb5_error_code
ads_create_gss_checksum(krb5_data
*in_data
, /* [inout] */
3605 unsigned int orig_length
= in_data
->length
;
3606 unsigned int base_cksum_size
= GSSAPI_CHECKSUM_SIZE
;
3607 char *gss_cksum
= NULL
;
3610 /* Extra length field for delegated ticket. */
3611 base_cksum_size
+= 4;
3614 if ((unsigned int)base_cksum_size
+ orig_length
<
3615 (unsigned int)base_cksum_size
) {
3619 gss_cksum
= (char *)SMB_MALLOC(base_cksum_size
+ orig_length
);
3620 if (gss_cksum
== NULL
) {
3624 memset(gss_cksum
, '\0', base_cksum_size
+ orig_length
);
3625 SIVAL(gss_cksum
, 0, GSSAPI_BNDLENGTH
);
3628 * GSS_C_NO_CHANNEL_BINDINGS means 16 zero bytes.
3629 * This matches the behavior of heimdal and mit.
3631 * And it is needed to work against some closed source
3636 memset(&gss_cksum
[4], 0x00, GSSAPI_BNDLENGTH
);
3638 SIVAL(gss_cksum
, 20, gss_flags
);
3640 if (orig_length
&& in_data
->data
!= NULL
) {
3641 SSVAL(gss_cksum
, 24, 1); /* The Delegation Option identifier */
3642 SSVAL(gss_cksum
, 26, orig_length
);
3643 /* Copy the kerberos KRB_CRED data */
3644 memcpy(gss_cksum
+ 28, in_data
->data
, orig_length
);
3645 free(in_data
->data
);
3646 in_data
->data
= NULL
;
3647 in_data
->length
= 0;
3649 in_data
->data
= gss_cksum
;
3650 in_data
->length
= base_cksum_size
+ orig_length
;
3656 * We can't use krb5_mk_req because w2k wants the service to be in a particular
3659 static krb5_error_code
ads_krb5_mk_req(krb5_context context
,
3660 krb5_auth_context
*auth_context
,
3661 const krb5_flags ap_req_options
,
3662 const char *principal
,
3665 time_t *expire_time
,
3666 const char *impersonate_princ_s
)
3668 krb5_error_code retval
;
3669 krb5_principal server
;
3670 krb5_principal impersonate_princ
= NULL
;
3674 bool creds_ready
= false;
3675 int i
= 0, maxtries
= 3;
3678 ZERO_STRUCT(in_data
);
3680 retval
= smb_krb5_parse_name(context
, principal
, &server
);
3682 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal
));
3686 if (impersonate_princ_s
) {
3687 retval
= smb_krb5_parse_name(context
, impersonate_princ_s
,
3688 &impersonate_princ
);
3690 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", impersonate_princ_s
));
3695 /* obtain ticket & session key */
3697 if ((retval
= krb5_copy_principal(context
, server
, &creds
.server
))) {
3698 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
3699 error_message(retval
)));
3703 retval
= krb5_cc_get_principal(context
, ccache
, &creds
.client
);
3705 /* This can commonly fail on smbd startup with no ticket in the cache.
3706 * Report at higher level than 1. */
3707 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
3708 error_message(retval
)));
3712 while (!creds_ready
&& (i
< maxtries
)) {
3714 retval
= smb_krb5_get_credentials(context
,
3721 DBG_WARNING("smb_krb5_get_credentials failed for %s "
3724 error_message(retval
));
3728 /* cope with ticket being in the future due to clock skew */
3729 if ((unsigned)credsp
->times
.starttime
> time(NULL
)) {
3730 time_t t
= time(NULL
);
3731 int time_offset
=(int)((unsigned)credsp
->times
.starttime
-t
);
3732 DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset
));
3733 krb5_set_real_time(context
, t
+ time_offset
+ 1, 0);
3736 ok
= ads_cleanup_expired_creds(context
, ccache
, credsp
);
3744 DBG_DEBUG("Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
3746 krb5_cc_get_type(context
, ccache
),
3747 krb5_cc_get_name(context
, ccache
),
3748 http_timestring(talloc_tos(),
3749 (unsigned)credsp
->times
.endtime
),
3750 (unsigned)credsp
->times
.endtime
);
3753 *expire_time
= (time_t)credsp
->times
.endtime
;
3756 /* Allocate the auth_context. */
3757 retval
= ads_setup_auth_context(context
, auth_context
);
3759 DBG_WARNING("ads_setup_auth_context failed (%s)\n",
3760 error_message(retval
));
3764 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
3766 uint32_t gss_flags
= 0;
3768 if (credsp
->ticket_flags
& TKT_FLG_OK_AS_DELEGATE
) {
3770 * Fetch a forwarded TGT from the KDC so that we can
3771 * hand off a 2nd ticket as part of the kerberos
3775 DBG_INFO("Server marked as OK to delegate to, building "
3776 "forwardable TGT\n");
3778 retval
= krb5_auth_con_setuseruserkey(context
,
3780 &credsp
->keyblock
);
3782 DBG_WARNING("krb5_auth_con_setuseruserkey "
3784 error_message(retval
));
3788 /* Must use a subkey for forwarded tickets. */
3789 retval
= krb5_auth_con_setflags(context
,
3791 KRB5_AUTH_CONTEXT_USE_SUBKEY
);
3793 DBG_WARNING("krb5_auth_con_setflags failed (%s)\n",
3794 error_message(retval
));
3798 retval
= krb5_fwd_tgt_creds(context
,/* Krb5 context [in] */
3799 *auth_context
, /* Authentication context [in] */
3800 discard_const_p(char, KRB5_TGS_NAME
), /* Ticket service name ("krbtgt") [in] */
3801 credsp
->client
, /* Client principal for the tgt [in] */
3802 credsp
->server
, /* Server principal for the tgt [in] */
3803 ccache
, /* Credential cache to use for storage [in] */
3804 1, /* Turn on for "Forwardable ticket" [in] */
3805 &in_data
); /* Resulting response [out] */
3808 DBG_INFO("krb5_fwd_tgt_creds failed (%s)\n",
3809 error_message(retval
));
3812 * This is not fatal. Delete the *auth_context and continue
3813 * with krb5_mk_req_extended to get a non-forwardable ticket.
3817 free( in_data
.data
);
3818 in_data
.data
= NULL
;
3821 krb5_auth_con_free(context
, *auth_context
);
3822 *auth_context
= NULL
;
3823 retval
= ads_setup_auth_context(context
, auth_context
);
3825 DBG_WARNING("ads_setup_auth_context failed (%s)\n",
3826 error_message(retval
));
3830 /* We got a delegated ticket. */
3831 gss_flags
|= GSS_C_DELEG_FLAG
;
3835 /* Frees and reallocates in_data into a GSS checksum blob. */
3836 retval
= ads_create_gss_checksum(&in_data
, gss_flags
);
3841 /* We always want GSS-checksum types. */
3842 retval
= krb5_auth_con_set_req_cksumtype(context
, *auth_context
, GSSAPI_CHECKSUM
);
3844 DEBUG(1,("krb5_auth_con_set_req_cksumtype failed (%s)\n",
3845 error_message(retval
)));
3851 retval
= krb5_mk_req_extended(context
, auth_context
, ap_req_options
,
3852 &in_data
, credsp
, outbuf
);
3854 DBG_WARNING("krb5_mk_req_extended failed (%s)\n",
3855 error_message(retval
));
3858 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
3863 free( in_data
.data
);
3867 krb5_free_creds(context
, credsp
);
3870 krb5_free_cred_contents(context
, &creds
);
3873 krb5_free_principal(context
, server
);
3874 if (impersonate_princ
) {
3875 krb5_free_principal(context
, impersonate_princ
);
3882 get a kerberos5 ticket for the given service
3884 int ads_krb5_cli_get_ticket(TALLOC_CTX
*mem_ctx
,
3885 const char *principal
,
3888 DATA_BLOB
*session_key_krb5
,
3889 uint32_t extra_ap_opts
, const char *ccname
,
3891 const char *impersonate_princ_s
)
3893 krb5_error_code retval
;
3895 krb5_context context
= NULL
;
3896 krb5_ccache ccdef
= NULL
;
3897 krb5_auth_context auth_context
= NULL
;
3898 krb5_enctype enc_types
[] = {
3899 ENCTYPE_AES256_CTS_HMAC_SHA1_96
,
3900 ENCTYPE_AES128_CTS_HMAC_SHA1_96
,
3901 ENCTYPE_ARCFOUR_HMAC
,
3905 DBG_DEBUG("Getting ticket for service [%s] using creds from [%s] "
3906 "and impersonating [%s]\n",
3907 principal
, ccname
, impersonate_princ_s
);
3909 retval
= smb_krb5_init_context_common(&context
);
3911 DBG_ERR("kerberos init context failed (%s)\n",
3912 error_message(retval
));
3916 if (time_offset
!= 0) {
3917 krb5_set_real_time(context
, time(NULL
) + time_offset
, 0);
3920 retval
= krb5_cc_resolve(context
,
3921 ccname
? ccname
: krb5_cc_default_name(context
),
3924 DBG_WARNING("krb5_cc_default failed (%s)\n",
3925 error_message(retval
));
3929 retval
= krb5_set_default_tgs_ktypes(context
, enc_types
);
3931 DBG_WARNING("krb5_set_default_tgs_ktypes failed (%s)\n",
3932 error_message(retval
));
3936 retval
= ads_krb5_mk_req(context
,
3938 AP_OPTS_USE_SUBKEY
| (krb5_flags
)extra_ap_opts
,
3943 impersonate_princ_s
);
3948 ok
= smb_krb5_get_smb_session_key(mem_ctx
,
3958 *ticket
= data_blob_talloc(mem_ctx
, packet
.data
, packet
.length
);
3960 smb_krb5_free_data_contents(context
, &packet
);
3966 krb5_cc_close(context
, ccdef
);
3969 krb5_auth_con_free(context
, auth_context
);
3971 krb5_free_context(context
);
3977 #ifndef SAMBA4_USES_HEIMDAL /* MITKRB5 tracing callback */
3978 static void smb_krb5_trace_cb(krb5_context ctx
,
3979 #ifdef HAVE_KRB5_TRACE_INFO
3980 const krb5_trace_info
*info
,
3981 #elif defined(HAVE_KRB5_TRACE_INFO_STRUCT)
3982 const struct krb5_trace_info
*info
,
3984 #error unknown krb5_trace_info
3989 DBGC_DEBUG(DBGC_KERBEROS
, "%s", info
->message
);
3994 krb5_error_code
smb_krb5_init_context_common(krb5_context
*_krb5_context
)
3996 krb5_error_code ret
;
3997 krb5_context krb5_ctx
;
3999 initialize_krb5_error_table();
4001 ret
= krb5_init_context(&krb5_ctx
);
4003 DBG_ERR("Krb5 context initialization failed (%s)\n",
4004 error_message(ret
));
4008 /* The MIT Kerberos build relies on using the system krb5.conf file.
4009 * If you really want to use another file please set KRB5_CONFIG
4011 #ifndef SAMBA4_USES_HEIMDAL
4012 ret
= krb5_set_trace_callback(krb5_ctx
, smb_krb5_trace_cb
, NULL
);
4014 DBG_ERR("Failed to set MIT kerberos trace callback! (%s)\n",
4015 error_message(ret
));
4019 #ifdef SAMBA4_USES_HEIMDAL
4020 /* Set options in kerberos */
4021 krb5_set_dns_canonicalize_hostname(krb5_ctx
, false);
4024 *_krb5_context
= krb5_ctx
;
4028 #else /* HAVE_KRB5 */
4029 /* This saves a few linking headaches */
4030 int ads_krb5_cli_get_ticket(TALLOC_CTX
*mem_ctx
,
4031 const char *principal
,
4034 DATA_BLOB
*session_key_krb5
,
4035 uint32_t extra_ap_opts
, const char *ccname
,
4037 const char *impersonate_princ_s
)
4039 DEBUG(0,("NO KERBEROS SUPPORT\n"));
4043 #endif /* HAVE_KRB5 */