source4/libcli/auth/kerberos_verify.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Luke Howard 2003
   7    Copyright (C) Guenther Deschner 2003
   8    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "system/kerberos.h"
  27 #include "libcli/auth/kerberos.h"
  28 #include "asn_1.h"
  29 #include "lib/ldb/include/ldb.h"
  30 #include "secrets.h"
  31 #include "pstring.h"
  32
  33 #ifdef HAVE_KRB5
  34
  35 #if !defined(HAVE_KRB5_PRINC_COMPONENT)
  36 const krb5_data *krb5_princ_component(krb5_context, krb5_principal, int );
  37 #endif
  38 static DATA_BLOB unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data)
  39 {
  40         DATA_BLOB out;
  41         DATA_BLOB pac_contents = data_blob(NULL, 0);
  42         struct asn1_data data;
  43         int data_type;
  44         if (!auth_data->length) {
  45                 return data_blob(NULL, 0);
  46         }
  47
  48         asn1_load(&data, *auth_data);
  49         asn1_start_tag(&data, ASN1_SEQUENCE(0));
  50         asn1_start_tag(&data, ASN1_SEQUENCE(0));
  51         asn1_start_tag(&data, ASN1_CONTEXT(0));
  52         asn1_read_Integer(&data, &data_type);
  53         asn1_end_tag(&data);
  54         asn1_start_tag(&data, ASN1_CONTEXT(1));
  55         asn1_read_OctetString(&data, &pac_contents);
  56         asn1_end_tag(&data);
  57         asn1_end_tag(&data);
  58         asn1_end_tag(&data);
  59         asn1_free(&data);
  60
  61         out = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
  62
  63         data_blob_free(&pac_contents);
  64
  65         return out;
  66 }
  67
  68 /**********************************************************************************
  69  Try to verify a ticket using the system keytab... the system keytab has kvno -1 entries, so
  70  it's more like what microsoft does... see comment in utils/net_ads.c in the
  71  ads_keytab_add_entry function for details.
  72 ***********************************************************************************/
  73
  74 static krb5_error_code ads_keytab_verify_ticket(TALLOC_CTX *mem_ctx, krb5_context context,
  75                                                 krb5_auth_context auth_context,
  76                                                 const char *service,
  77                                                 const DATA_BLOB *ticket, krb5_data *p_packet,
  78                                                 krb5_ticket **pp_tkt,
  79                                                 krb5_keyblock *keyblock)
  80 {
  81         krb5_error_code ret = 0;
  82         BOOL auth_ok = False;
  83         krb5_keytab keytab = NULL;
  84         char *my_fqdn;
  85         fstring my_name;
  86         fstring my_Fqdn, my_NAME;
  87         char *p_fqdn;
  88         char *host_princ_s[18];
  89         krb5_principal host_princ;
  90         int i;
  91
  92         ret = krb5_kt_default(context, &keytab);
  93         if (ret) {
  94                 DEBUG(1, ("ads_keytab_verify_ticket: krb5_kt_default failed (%s)\n", error_message(ret)));
  95                 goto out;
  96         }
  97
  98         /* Generate the list of principal names which we expect clients might
  99          * want to use for authenticating to the file service. */
 100
 101         fstrcpy(my_name, lp_netbios_name());
 102         strlower_m(my_name);
 103
 104         fstrcpy(my_NAME, lp_netbios_name());
 105         strupper_m(my_NAME);
 106
 107         my_fqdn = name_to_fqdn(mem_ctx, lp_netbios_name());
 108         strlower_m(my_fqdn);
 109
 110         p_fqdn = strchr_m(my_fqdn, '.');
 111         fstrcpy(my_Fqdn, my_NAME);
 112         if (p_fqdn) {
 113                 fstrcat(my_Fqdn, p_fqdn);
 114         }
 115
 116         asprintf(&host_princ_s[0], "%s$@%s", my_name, lp_realm());
 117         asprintf(&host_princ_s[1], "%s$@%s", my_NAME, lp_realm());
 118         asprintf(&host_princ_s[2], "host/%s@%s", my_name, lp_realm());
 119         asprintf(&host_princ_s[3], "host/%s@%s", my_NAME, lp_realm());
 120         asprintf(&host_princ_s[4], "host/%s@%s", my_fqdn, lp_realm());
 121         asprintf(&host_princ_s[5], "host/%s@%s", my_Fqdn, lp_realm());
 122         asprintf(&host_princ_s[6], "HOST/%s@%s", my_name, lp_realm());
 123         asprintf(&host_princ_s[7], "HOST/%s@%s", my_NAME, lp_realm());
 124         asprintf(&host_princ_s[8], "HOST/%s@%s", my_fqdn, lp_realm());
 125         asprintf(&host_princ_s[9], "HOST/%s@%s", my_Fqdn, lp_realm());
 126         asprintf(&host_princ_s[10], "%s/%s@%s", service, my_name, lp_realm());
 127         asprintf(&host_princ_s[11], "%s/%s@%s", service, my_NAME, lp_realm());
 128         asprintf(&host_princ_s[12], "%s/%s@%s", service, my_fqdn, lp_realm());
 129         asprintf(&host_princ_s[13], "%s/%s@%s", service, my_Fqdn, lp_realm());
 130         asprintf(&host_princ_s[14], "%s/%s@%s", strupper_talloc(mem_ctx, service), my_name, lp_realm());
 131         asprintf(&host_princ_s[15], "%s/%s@%s", strupper_talloc(mem_ctx, service), my_NAME, lp_realm());
 132         asprintf(&host_princ_s[16], "%s/%s@%s", strupper_talloc(mem_ctx, service), my_fqdn, lp_realm());
 133         asprintf(&host_princ_s[17], "%s/%s@%s", strupper_talloc(mem_ctx, service), my_Fqdn, lp_realm());
 134
 135         /* Now try to verify the ticket using the key associated with each of
 136          * the principals which we think clients will expect us to be
 137          * participating as. */
 138         for (i = 0; i < sizeof(host_princ_s) / sizeof(host_princ_s[0]); i++) {
 139                 host_princ = NULL;
 140                 ret = krb5_parse_name(context, host_princ_s[i], &host_princ);
 141                 if (ret) {
 142                         DEBUG(1, ("ads_keytab_verify_ticket: krb5_parse_name(%s) failed (%s)\n",
 143                                 host_princ_s[i], error_message(ret)));
 144                         goto out;
 145                 }
 146                 p_packet->length = ticket->length;
 147                 p_packet->data = (krb5_pointer)ticket->data;
 148                 *pp_tkt = NULL;
 149                 ret = krb5_rd_req(context, &auth_context, p_packet, host_princ, keytab, NULL, pp_tkt);
 150                 krb5_free_principal(context, host_princ);
 151                 if (ret) {
 152                         DEBUG(0, ("krb5_rd_req(%s) failed: %s\n", host_princ_s[i], error_message(ret)));
 153                 } else {
 154                         DEBUG(10,("krb5_rd_req succeeded for principal %s\n", host_princ_s[i]));
 155                         auth_ok = True;
 156                         break;
 157                 }
 158         }
 159
 160         for (i = 0; i < sizeof(host_princ_s) / sizeof(host_princ_s[0]); i++) {
 161                 SAFE_FREE(host_princ_s[i]);
 162         }
 163
 164   out:
 165
 166         if (keytab) {
 167                 krb5_kt_close(context, keytab);
 168         }
 169
 170         return ret;
 171 }
 172
 173 /**********************************************************************************
 174  Try to verify a ticket using the secrets.tdb.
 175 ***********************************************************************************/
 176
 177 static krb5_error_code ads_secrets_verify_ticket(TALLOC_CTX *mem_ctx, krb5_context context,
 178                                                  krb5_auth_context auth_context,
 179                                                  krb5_principal host_princ,
 180                                                  const DATA_BLOB *ticket, krb5_data *p_packet,
 181                                                  krb5_ticket **pp_tkt,
 182                                                  krb5_keyblock *keyblock)
 183 {
 184         krb5_error_code ret = 0;
 185         krb5_data password;
 186         krb5_enctype *enctypes = NULL;
 187         int i;
 188         const struct ldb_val *password_v;
 189         struct ldb_wrap *ldb;
 190         int ldb_ret;
 191         struct ldb_message **msgs;
 192         const char *base_dn = SECRETS_PRIMARY_DOMAIN_DN;
 193         const char *attrs[] = {
 194                 "secret",
 195                 NULL
 196         };
 197
 198         ZERO_STRUCTP(keyblock);
 199
 200         /* Local secrets are stored in secrets.ldb */
 201         ldb = secrets_db_connect(mem_ctx);
 202         if (!ldb) {
 203                 return ENOENT;
 204         }
 205
 206         /* search for the secret record */
 207         ldb_ret = gendb_search(ldb,
 208                                mem_ctx, base_dn, &msgs, attrs,
 209                                SECRETS_PRIMARY_REALM_FILTER,
 210                                lp_realm());
 211         if (ldb_ret == 0) {
 212                 DEBUG(1, ("Could not find domain join record for %s\n",
 213                           lp_realm()));
 214                 return ENOENT;
 215         } else if (ldb_ret != 1) {
 216                 DEBUG(1, ("Found %d records matching cn=%s under DN %s\n", ldb_ret,
 217                           lp_realm(), base_dn));
 218                 return ENOENT;
 219         }
 220
 221         password_v = ldb_msg_find_ldb_val(msgs[0], "secret");
 222
 223         password.data = password_v->data;
 224         password.length = password_v->length;
 225
 226         /* CIFS doesn't use addresses in tickets. This would break NAT. JRA */
 227
 228         if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) {
 229                 DEBUG(1,("ads_secrets_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n",
 230                          error_message(ret)));
 231                 goto out;
 232         }
 233
 234         p_packet->length = ticket->length;
 235         p_packet->data = (krb5_pointer)ticket->data;
 236
 237         ret = KRB5_BAD_ENCTYPE;
 238         /* We need to setup a auth context with each possible encoding type in turn. */
 239         for (i=0;enctypes[i];i++) {
 240                 krb5_error_code our_ret;
 241                 our_ret = create_kerberos_key_from_string(context, host_princ, &password, keyblock, enctypes[i]);
 242                 if (our_ret) {
 243                         ret = our_ret;
 244                         continue;
 245                 }
 246
 247                 krb5_auth_con_setuseruserkey(context, auth_context, keyblock);
 248
 249                 our_ret = krb5_rd_req(context, &auth_context, p_packet,
 250                                         NULL,
 251                                         NULL, NULL, pp_tkt);
 252                 if (!our_ret) {
 253                         DEBUG(10,("ads_secrets_verify_ticket: enc type [%u] decrypted message !\n",
 254                                 (unsigned int)enctypes[i] ));
 255                         ret = our_ret;
 256                         break;
 257                 }
 258
 259                 krb5_free_keyblock_contents(context, keyblock);
 260
 261                 DEBUG((our_ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
 262                                 ("ads_secrets_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
 263                                 (unsigned int)enctypes[i], error_message(our_ret)));
 264
 265                 if (our_ret !=  KRB5_BAD_ENCTYPE) {
 266                         ret = our_ret;
 267                 }
 268         }
 269
 270  out:
 271
 272         free_kerberos_etypes(context, enctypes);
 273
 274         return ret;
 275 }
 276
 277 /**********************************************************************************
 278  Verify an incoming ticket and parse out the principal name and
 279  authorization_data if available.
 280 ***********************************************************************************/
 281
 282  NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
 283                             krb5_context context,
 284                             krb5_auth_context auth_context,
 285                             const char *realm, const char *service,
 286                             const DATA_BLOB *ticket,
 287                             char **principal, DATA_BLOB *auth_data,
 288                             DATA_BLOB *ap_rep,
 289                             krb5_keyblock *keyblock)
 290 {
 291         NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
 292         krb5_data packet;
 293         krb5_ticket *tkt = NULL;
 294         krb5_rcache rcache = NULL;
 295         int ret;
 296
 297         krb5_principal host_princ = NULL;
 298         char *host_princ_s = NULL;
 299         BOOL got_replay_mutex = False;
 300
 301         char *malloc_principal;
 302
 303         ZERO_STRUCT(packet);
 304         ZERO_STRUCTP(auth_data);
 305         ZERO_STRUCTP(ap_rep);
 306
 307         /* This whole process is far more complex than I would
 308            like. We have to go through all this to allow us to store
 309            the secret internally, instead of using /etc/krb5.keytab */
 310
 311         asprintf(&host_princ_s, "%s$", lp_netbios_name());
 312         strlower_m(host_princ_s);
 313         ret = krb5_parse_name(context, host_princ_s, &host_princ);
 314         if (ret) {
 315                 DEBUG(1,("ads_verify_ticket: krb5_parse_name(%s) failed (%s)\n",
 316                                         host_princ_s, error_message(ret)));
 317                 goto out;
 318         }
 319
 320
 321         /* Lock a mutex surrounding the replay as there is no locking in the MIT krb5
 322          * code surrounding the replay cache... */
 323
 324         if (!grab_server_mutex("replay cache mutex")) {
 325                 DEBUG(1,("ads_verify_ticket: unable to protect replay cache with mutex.\n"));
 326                 goto out;
 327         }
 328
 329         got_replay_mutex = True;
 330
 331         /*
 332          * JRA. We must set the rcache here. This will prevent replay attacks.
 333          */
 334
 335         ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache);
 336         if (ret) {
 337                 DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache failed (%s)\n", error_message(ret)));
 338                 goto out;
 339         }
 340
 341         ret = krb5_auth_con_setrcache(context, auth_context, rcache);
 342         if (ret) {
 343                 DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache failed (%s)\n", error_message(ret)));
 344                 goto out;
 345         }
 346
 347         ret = ads_keytab_verify_ticket(mem_ctx, context, auth_context,
 348                                        service, ticket, &packet, &tkt, keyblock);
 349         if (ret) {
 350                 DEBUG(10, ("ads_secrets_verify_ticket: using host principal: [%s]\n", host_princ_s));
 351                 ret = ads_secrets_verify_ticket(mem_ctx, context, auth_context,
 352                                                 host_princ, ticket,
 353                                                 &packet, &tkt, keyblock);
 354         }
 355
 356         release_server_mutex();
 357         got_replay_mutex = False;
 358
 359         if (ret) {
 360                 DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n",
 361                          error_message(ret)));
 362                 goto out;
 363         }
 364
 365         ret = krb5_mk_rep(context, auth_context, &packet);
 366         if (ret) {
 367                 DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
 368                         error_message(ret)));
 369                 goto out;
 370         }
 371
 372         *ap_rep = data_blob_talloc(mem_ctx, packet.data, packet.length);
 373         SAFE_FREE(packet.data);
 374         packet.length = 0;
 375
 376 #if 0
 377         file_save("/tmp/ticket.dat", ticket->data, ticket->length);
 378 #endif
 379
 380         *auth_data = get_auth_data_from_tkt(mem_ctx, tkt);
 381
 382         *auth_data = unwrap_pac(mem_ctx, auth_data);
 383
 384 #if 0
 385         if (tkt->enc_part2) {
 386                 file_save("/tmp/authdata.dat",
 387                           tkt->enc_part2->authorization_data[0]->contents,
 388                           tkt->enc_part2->authorization_data[0]->length);
 389         }
 390 #endif
 391
 392         if ((ret = krb5_unparse_name(context, get_principal_from_tkt(tkt),
 393                                      &malloc_principal))) {
 394                 DEBUG(3,("ads_verify_ticket: krb5_unparse_name failed (%s)\n",
 395                          error_message(ret)));
 396                 sret = NT_STATUS_LOGON_FAILURE;
 397                 goto out;
 398         }
 399
 400         *principal = talloc_strdup(mem_ctx, malloc_principal);
 401         SAFE_FREE(malloc_principal);
 402         if (!principal) {
 403                 DEBUG(3,("ads_verify_ticket: talloc_strdup() failed\n"));
 404                 sret = NT_STATUS_NO_MEMORY;
 405                 goto out;
 406         }
 407
 408         sret = NT_STATUS_OK;
 409
 410  out:
 411
 412         if (got_replay_mutex) {
 413                 release_server_mutex();
 414         }
 415
 416         if (!NT_STATUS_IS_OK(sret)) {
 417                 data_blob_free(auth_data);
 418         }
 419
 420         if (!NT_STATUS_IS_OK(sret)) {
 421                 data_blob_free(ap_rep);
 422         }
 423
 424         if (host_princ) {
 425                 krb5_free_principal(context, host_princ);
 426         }
 427
 428         if (tkt != NULL) {
 429                 krb5_free_ticket(context, tkt);
 430         }
 431
 432         SAFE_FREE(host_princ_s);
 433
 434         return sret;
 435 }
 436
 437 #endif /* HAVE_KRB5 */