source3/libads/kerberos_verify.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Luke Howard 2003
   7    Copyright (C) Guenther Deschner 2003
   8    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26
  27 #ifdef HAVE_KRB5
  28
  29 /*
  30   verify an incoming ticket and parse out the principal name and
  31   authorization_data if available
  32 */
  33 NTSTATUS ads_verify_ticket(const char *realm, const DATA_BLOB *ticket,
  34                            char **principal, DATA_BLOB *auth_data,
  35                            DATA_BLOB *ap_rep,
  36                            DATA_BLOB *session_key)
  37 {
  38         NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
  39         krb5_context context = NULL;
  40         krb5_auth_context auth_context = NULL;
  41         krb5_data packet;
  42         krb5_ticket *tkt = NULL;
  43         krb5_rcache rcache = NULL;
  44         int ret, i;
  45         krb5_keyblock *key = NULL;
  46
  47         krb5_principal host_princ;
  48         char *host_princ_s = NULL;
  49         BOOL free_host_princ = False;
  50         BOOL got_replay_mutex = False;
  51
  52         fstring myname;
  53         char *password_s = NULL;
  54         krb5_data password;
  55         krb5_enctype *enctypes = NULL;
  56 #if 0
  57         krb5_address local_addr;
  58         krb5_address remote_addr;
  59 #endif
  60         BOOL auth_ok = False;
  61
  62         ZERO_STRUCT(packet);
  63         ZERO_STRUCT(password);
  64         ZERO_STRUCTP(auth_data);
  65         ZERO_STRUCTP(ap_rep);
  66
  67         if (!secrets_init()) {
  68                 DEBUG(1,("ads_verify_ticket: secrets_init failed\n"));
  69                 return NT_STATUS_LOGON_FAILURE;
  70         }
  71
  72         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
  73         if (!password_s) {
  74                 DEBUG(1,("ads_verify_ticket: failed to fetch machine password\n"));
  75                 return NT_STATUS_LOGON_FAILURE;
  76         }
  77
  78         password.data = password_s;
  79         password.length = strlen(password_s);
  80
  81         ret = krb5_init_context(&context);
  82         if (ret) {
  83                 DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
  84                 return NT_STATUS_LOGON_FAILURE;
  85         }
  86
  87         ret = krb5_set_default_realm(context, realm);
  88         if (ret) {
  89                 DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
  90                 sret = NT_STATUS_LOGON_FAILURE;
  91                 goto out;
  92         }
  93
  94         /* This whole process is far more complex than I would
  95            like. We have to go through all this to allow us to store
  96            the secret internally, instead of using /etc/krb5.keytab */
  97
  98         ret = krb5_auth_con_init(context, &auth_context);
  99         if (ret) {
 100                 DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
 101                 sret = NT_STATUS_LOGON_FAILURE;
 102                 goto out;
 103         }
 104
 105         fstrcpy(myname, global_myname());
 106         strlower_m(myname);
 107         asprintf(&host_princ_s, "HOST/%s@%s", myname, lp_realm());
 108         ret = krb5_parse_name(context, host_princ_s, &host_princ);
 109         if (ret) {
 110                 DEBUG(1,("ads_verify_ticket: krb5_parse_name(%s) failed (%s)\n",
 111                                         host_princ_s, error_message(ret)));
 112                 sret = NT_STATUS_LOGON_FAILURE;
 113                 goto out;
 114         }
 115
 116         free_host_princ = True;
 117
 118         /*
 119          * JRA. We must set the rcache here. This will prevent replay attacks.
 120          */
 121
 122         ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache);
 123         if (ret) {
 124                 DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache failed (%s)\n", error_message(ret)));
 125                 sret = NT_STATUS_LOGON_FAILURE;
 126                 goto out;
 127         }
 128
 129         ret = krb5_auth_con_setrcache(context, auth_context, rcache);
 130         if (ret) {
 131                 DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache failed (%s)\n", error_message(ret)));
 132                 sret = NT_STATUS_LOGON_FAILURE;
 133                 goto out;
 134         }
 135
 136         /* CIFS doesn't use addresses in tickets. This would breat NAT. JRA */
 137
 138         if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) {
 139                 DEBUG(1,("ads_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n",
 140                          error_message(ret)));
 141                 sret = NT_STATUS_LOGON_FAILURE;
 142                 goto out;
 143         }
 144
 145         /* Lock a mutex surrounding the replay as there is no locking in the MIT krb5
 146          * code surrounding the replay cache... */
 147
 148         if (!grab_server_mutex("replay cache mutex")) {
 149                 DEBUG(1,("ads_verify_ticket: unable to protect replay cache with mutex.\n"));
 150                 sret = NT_STATUS_LOGON_FAILURE;
 151                 goto out;
 152         }
 153
 154         got_replay_mutex = True;
 155
 156         /* We need to setup a auth context with each possible encoding type in turn. */
 157         for (i=0;enctypes[i];i++) {
 158                 if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) {
 159                         sret = NT_STATUS_NO_MEMORY;
 160                         goto out;
 161                 }
 162
 163                 if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) {
 164                         continue;
 165                 }
 166
 167                 krb5_auth_con_setuseruserkey(context, auth_context, key);
 168
 169                 krb5_free_keyblock(context, key);
 170
 171                 packet.length = ticket->length;
 172                 packet.data = (krb5_pointer)ticket->data;
 173
 174                 if (!(ret = krb5_rd_req(context, &auth_context, &packet,
 175                                         NULL,
 176                                         NULL, NULL, &tkt))) {
 177                         DEBUG(10,("ads_verify_ticket: enc type [%u] decrypted message !\n",
 178                                 (unsigned int)enctypes[i] ));
 179                         auth_ok = True;
 180                         break;
 181                 }
 182
 183                 DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
 184                                 ("ads_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
 185                                 (unsigned int)enctypes[i], error_message(ret)));
 186         }
 187
 188         release_server_mutex();
 189         got_replay_mutex = False;
 190
 191         if (!auth_ok) {
 192                 DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n",
 193                          error_message(ret)));
 194                 sret = NT_STATUS_LOGON_FAILURE;
 195                 goto out;
 196         }
 197
 198         ret = krb5_mk_rep(context, auth_context, &packet);
 199         if (ret) {
 200                 DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
 201                         error_message(ret)));
 202                 sret = NT_STATUS_LOGON_FAILURE;
 203                 goto out;
 204         }
 205
 206         *ap_rep = data_blob(packet.data, packet.length);
 207         free(packet.data);
 208
 209         get_krb5_smb_session_key(context, auth_context, session_key, True);
 210         dump_data_pw("SMB session key (from ticket)\n", session_key->data, session_key->length);
 211
 212 #if 0
 213         file_save("/tmp/ticket.dat", ticket->data, ticket->length);
 214 #endif
 215
 216         get_auth_data_from_tkt(auth_data, tkt);
 217
 218         {
 219                 TALLOC_CTX *ctx = talloc_init("pac data");
 220                 decode_pac_data(auth_data, ctx);
 221                 talloc_destroy(ctx);
 222         }
 223
 224 #if 0
 225         if (tkt->enc_part2) {
 226                 file_save("/tmp/authdata.dat",
 227                           tkt->enc_part2->authorization_data[0]->contents,
 228                           tkt->enc_part2->authorization_data[0]->length);
 229         }
 230 #endif
 231
 232         if ((ret = krb5_unparse_name(context, get_principal_from_tkt(tkt),
 233                                      principal))) {
 234                 DEBUG(3,("ads_verify_ticket: krb5_unparse_name failed (%s)\n",
 235                          error_message(ret)));
 236                 sret = NT_STATUS_LOGON_FAILURE;
 237                 goto out;
 238         }
 239
 240         sret = NT_STATUS_OK;
 241
 242  out:
 243
 244         if (got_replay_mutex)
 245                 release_server_mutex();
 246
 247         if (!NT_STATUS_IS_OK(sret))
 248                 data_blob_free(auth_data);
 249
 250         if (!NT_STATUS_IS_OK(sret))
 251                 data_blob_free(ap_rep);
 252
 253         if (free_host_princ)
 254                 krb5_free_principal(context, host_princ);
 255
 256         if (tkt != NULL)
 257                 krb5_free_ticket(context, tkt);
 258         free_kerberos_etypes(context, enctypes);
 259         SAFE_FREE(password_s);
 260         SAFE_FREE(host_princ_s);
 261
 262         if (auth_context)
 263                 krb5_auth_con_free(context, auth_context);
 264
 265         if (context)
 266                 krb5_free_context(context);
 267
 268         return sret;
 269 }
 270
 271 #endif /* HAVE_KRB5 */