source/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 #ifdef HAVE_KRB5
  25
  26 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
  27 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  28 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  29 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  30 #else
  31 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  32 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  33 #define KRB5_KEY_DATA(k)        ((k)->contents)
  34 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  35
  36 #ifndef HAVE_KRB5_SET_REAL_TIME
  37 /*
  38  * This function is not in the Heimdal mainline.
  39  */
  40  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
  41 {
  42         krb5_error_code ret;
  43         int32_t sec, usec;
  44
  45         ret = krb5_us_timeofday(context, &sec, &usec);
  46         if (ret)
  47                 return ret;
  48
  49         context->kdc_sec_offset = seconds - sec;
  50         context->kdc_usec_offset = microseconds - usec;
  51
  52         return 0;
  53 }
  54 #endif
  55
  56 #if defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES) && !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
  57  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
  58 {
  59         return krb5_set_default_in_tkt_etypes(ctx, enc);
  60 }
  61 #endif
  62
  63 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
  64 /* HEIMDAL */
  65  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
  66 {
  67         pkaddr->addr_type = KRB5_ADDRESS_INET;
  68         pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
  69         pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
  70 }
  71 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
  72 /* MIT */
  73  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
  74 {
  75         pkaddr->addrtype = ADDRTYPE_INET;
  76         pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
  77         pkaddr->contents = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
  78 }
  79 #else
  80  __ERROR__XX__UNKNOWN_ADDRTYPE
  81 #endif
  82
  83 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY)
  84  int create_kerberos_key_from_string(krb5_context context,
  85                                         krb5_principal host_princ,
  86                                         krb5_data *password,
  87                                         krb5_keyblock *key,
  88                                         krb5_enctype enctype)
  89 {
  90         int ret;
  91         krb5_data salt;
  92         krb5_encrypt_block eblock;
  93
  94         ret = krb5_principal2salt(context, host_princ, &salt);
  95         if (ret) {
  96                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
  97                 return ret;
  98         }
  99         krb5_use_enctype(context, &eblock, enctype);
 100         return krb5_string_to_key(context, &eblock, key, password, &salt);
 101 }
 102 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 103  int create_kerberos_key_from_string(krb5_context context,
 104                                         krb5_principal host_princ,
 105                                         krb5_data *password,
 106                                         krb5_keyblock *key,
 107                                         krb5_enctype enctype)
 108 {
 109         int ret;
 110         krb5_salt salt;
 111
 112         ret = krb5_get_pw_salt(context, host_princ, &salt);
 113         if (ret) {
 114                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 115                 return ret;
 116         }
 117         return krb5_string_to_key_salt(context, enctype, password->data,
 118                 salt, key);
 119 }
 120 #else
 121  __ERROR_XX_UNKNOWN_CREATE_KEY_FUNCTIONS
 122 #endif
 123
 124 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 125 krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 126                                             krb5_enctype **enctypes)
 127 {
 128         return krb5_get_permitted_enctypes(context, enctypes);
 129 }
 130 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 131 krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 132                                             krb5_enctype **enctypes)
 133 {
 134         return krb5_get_default_in_tkt_etypes(context, enctypes);
 135 }
 136 #else
 137 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 138 #endif
 139
 140  void free_kerberos_etypes(krb5_context context,
 141                            krb5_enctype *enctypes)
 142 {
 143 #if defined(HAVE_KRB5_FREE_KTYPES)
 144         krb5_free_ktypes(context, enctypes);
 145         return;
 146 #else
 147         SAFE_FREE(enctypes);
 148         return;
 149 #endif
 150 }
 151
 152 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 153  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 154                                         krb5_auth_context auth_context,
 155                                         krb5_keyblock *keyblock)
 156 {
 157         return krb5_auth_con_setkey(context, auth_context, keyblock);
 158 }
 159 #endif
 160
 161  void get_auth_data_from_tkt(DATA_BLOB *auth_data, krb5_ticket *tkt)
 162 {
 163 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 164         if (tkt->enc_part2)
 165                 *auth_data = data_blob(tkt->enc_part2->authorization_data[0]->contents,
 166                         tkt->enc_part2->authorization_data[0]->length);
 167 #else
 168         if (tkt->ticket.authorization_data && tkt->ticket.authorization_data->len)
 169                 *auth_data = data_blob(tkt->ticket.authorization_data->val->ad_data.data,
 170                         tkt->ticket.authorization_data->val->ad_data.length);
 171 #endif
 172 }
 173
 174  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 175 {
 176 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 177         return tkt->enc_part2->client;
 178 #else
 179         return tkt->client;
 180 #endif
 181 }
 182
 183 #if !defined(HAVE_KRB5_LOCATE_KDC)
 184  krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 185 {
 186         krb5_krbhst_handle hnd;
 187         krb5_krbhst_info *hinfo;
 188         krb5_error_code rc;
 189         int num_kdcs, i;
 190         struct sockaddr *sa;
 191
 192         *addr_pp = NULL;
 193         *naddrs = 0;
 194
 195         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 196         if (rc) {
 197                 DEBUG(0, ("krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 198                 return rc;
 199         }
 200
 201         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 202                 ;
 203
 204         krb5_krbhst_reset(ctx, hnd);
 205
 206         if (!num_kdcs) {
 207                 DEBUG(0, ("krb5_locate_kdc: zero kdcs found !\n"));
 208                 krb5_krbhst_free(ctx, hnd);
 209                 return -1;
 210         }
 211
 212         sa = malloc( sizeof(struct sockaddr) * num_kdcs );
 213         if (!sa) {
 214                 DEBUG(0, ("krb5_locate_kdc: malloc failed\n"));
 215                 krb5_krbhst_free(ctx, hnd);
 216                 naddrs = 0;
 217                 return -1;
 218         }
 219
 220         memset(*addr_pp, '\0', sizeof(struct sockaddr) * num_kdcs );
 221
 222         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 223                 if (hinfo->ai->ai_family == AF_INET)
 224                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 225         }
 226
 227         krb5_krbhst_free(ctx, hnd);
 228
 229         *naddrs = num_kdcs;
 230         *addr_pp = sa;
 231         return 0;
 232 }
 233 #endif
 234
 235 /*
 236   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 237 */
 238 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 239                                        krb5_auth_context *auth_context,
 240                                        const krb5_flags ap_req_options,
 241                                        const char *principal,
 242                                        krb5_ccache ccache,
 243                                        krb5_data *outbuf)
 244 {
 245         krb5_error_code           retval;
 246         krb5_principal    server;
 247         krb5_creds              * credsp;
 248         krb5_creds                creds;
 249         krb5_data in_data;
 250
 251         retval = krb5_parse_name(context, principal, &server);
 252         if (retval) {
 253                 DEBUG(1,("Failed to parse principal %s\n", principal));
 254                 return retval;
 255         }
 256
 257         /* obtain ticket & session key */
 258         ZERO_STRUCT(creds);
 259         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 260                 DEBUG(1,("krb5_copy_principal failed (%s)\n",
 261                          error_message(retval)));
 262                 goto cleanup_princ;
 263         }
 264
 265         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 266                 DEBUG(1,("krb5_cc_get_principal failed (%s)\n",
 267                          error_message(retval)));
 268                 goto cleanup_creds;
 269         }
 270
 271         if ((retval = krb5_get_credentials(context, 0,
 272                                            ccache, &creds, &credsp))) {
 273                 DEBUG(1,("krb5_get_credentials failed for %s (%s)\n",
 274                          principal, error_message(retval)));
 275                 goto cleanup_creds;
 276         }
 277
 278         /* cope with the ticket being in the future due to clock skew */
 279         if ((unsigned)credsp->times.starttime > time(NULL)) {
 280                 time_t t = time(NULL);
 281                 int time_offset = (unsigned)credsp->times.starttime - t;
 282                 DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 283                 krb5_set_real_time(context, t + time_offset + 1, 0);
 284         }
 285
 286         in_data.length = 0;
 287         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 288                                       &in_data, credsp, outbuf);
 289         if (retval) {
 290                 DEBUG(1,("krb5_mk_req_extended failed (%s)\n",
 291                          error_message(retval)));
 292         }
 293
 294         krb5_free_creds(context, credsp);
 295
 296 cleanup_creds:
 297         krb5_free_cred_contents(context, &creds);
 298
 299 cleanup_princ:
 300         krb5_free_principal(context, server);
 301
 302         return retval;
 303 }
 304
 305 /*
 306   get a kerberos5 ticket for the given service
 307 */
 308 DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset)
 309 {
 310         krb5_error_code retval;
 311         krb5_data packet;
 312         krb5_ccache ccdef;
 313         krb5_context context;
 314         krb5_auth_context auth_context = NULL;
 315         DATA_BLOB ret;
 316         krb5_enctype enc_types[] = {
 317 #ifdef ENCTYPE_ARCFOUR_HMAC
 318                 ENCTYPE_ARCFOUR_HMAC,
 319 #endif
 320                 ENCTYPE_DES_CBC_MD5,
 321                 ENCTYPE_DES_CBC_CRC,
 322                 ENCTYPE_NULL};
 323
 324         retval = krb5_init_context(&context);
 325         if (retval) {
 326                 DEBUG(1,("krb5_init_context failed (%s)\n",
 327                          error_message(retval)));
 328                 goto failed;
 329         }
 330
 331         if (time_offset != 0) {
 332                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 333         }
 334
 335         if ((retval = krb5_cc_default(context, &ccdef))) {
 336                 DEBUG(1,("krb5_cc_default failed (%s)\n",
 337                          error_message(retval)));
 338                 goto failed;
 339         }
 340
 341         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 342                 DEBUG(1,("krb5_set_default_tgs_ktypes failed (%s)\n",
 343                          error_message(retval)));
 344                 goto failed;
 345         }
 346
 347         if ((retval = ads_krb5_mk_req(context,
 348                                       &auth_context,
 349                                       0,
 350                                       principal,
 351                                       ccdef, &packet))) {
 352                 goto failed;
 353         }
 354
 355         ret = data_blob(packet.data, packet.length);
 356 /* Hmm, heimdal dooesn't have this - what's the correct call? */
 357 /*      krb5_free_data_contents(context, &packet); */
 358         krb5_free_context(context);
 359         return ret;
 360
 361 failed:
 362         if ( context )
 363                 krb5_free_context(context);
 364
 365         return data_blob(NULL, 0);
 366 }
 367
 368  BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16])
 369  {
 370 #ifdef ENCTYPE_ARCFOUR_HMAC
 371         krb5_keyblock *skey;
 372 #endif
 373         BOOL ret = False;
 374
 375         memset(session_key, 0, 16);
 376
 377 #ifdef ENCTYPE_ARCFOUR_HMAC
 378         if (krb5_auth_con_getremotesubkey(context, auth_context, &skey) == 0 && skey != NULL) {
 379                 if (KRB5_KEY_TYPE(skey) ==
 380                     ENCTYPE_ARCFOUR_HMAC
 381                     && KRB5_KEY_LENGTH(skey) == 16) {
 382                         memcpy(session_key, KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 383                         ret = True;
 384                 }
 385                 krb5_free_keyblock(context, skey);
 386         }
 387 #endif /* ENCTYPE_ARCFOUR_HMAC */
 388
 389         return ret;
 390  }
 391 #else /* HAVE_KRB5 */
 392  /* this saves a few linking headaches */
 393 DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset)
 394  {
 395          DEBUG(0,("NO KERBEROS SUPPORT\n"));
 396          return data_blob(NULL, 0);
 397  }
 398
 399 #endif