?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r14279: Fix coverity #86, 87, 88, 89:
[Samba/nascimento.git] / source3 / libsmb / clikrb5.c
blobda3ef6a0e48d1df69e44d89f26b53ae8bcdc4620
1 /*
2 Unix SMB/CIFS implementation.
3 simple kerberos5 routines for active directory
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Luke Howard 2002-2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 Copyright (C) Guenther Deschner 2005
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #define KRB5_PRIVATE 1 /* this file uses PRIVATE interfaces! */
25 #define KRB5_DEPRECATED 1 /* this file uses DEPRECATED interfaces! */
26
27 #include "includes.h"
28
29 #ifdef HAVE_KRB5
30
31 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
32 #define KRB5_KEY_TYPE(k) ((k)->keytype)
33 #define KRB5_KEY_LENGTH(k) ((k)->keyvalue.length)
34 #define KRB5_KEY_DATA(k) ((k)->keyvalue.data)
35 #else
36 #define KRB5_KEY_TYPE(k) ((k)->enctype)
37 #define KRB5_KEY_LENGTH(k) ((k)->length)
38 #define KRB5_KEY_DATA(k) ((k)->contents)
39 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
40
41 #ifndef HAVE_KRB5_SET_REAL_TIME
42 /*
43 * This function is not in the Heimdal mainline.
44 */
45 krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
46 {
47 krb5_error_code ret;
48 int32_t sec, usec;
49
50 ret = krb5_us_timeofday(context, &sec, &usec);
51 if (ret)
52 return ret;
53
54 context->kdc_sec_offset = seconds - sec;
55 context->kdc_usec_offset = microseconds - usec;
56
57 return 0;
58 }
59 #endif
60
61 #if defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES) && !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
62 krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
63 {
64 return krb5_set_default_in_tkt_etypes(ctx, enc);
65 }
66 #endif
67
68 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
69 /* HEIMDAL */
70 void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
71 {
72 pkaddr->addr_type = KRB5_ADDRESS_INET;
73 pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
74 pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
75 }
76 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
77 /* MIT */
78 void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
79 {
80 pkaddr->addrtype = ADDRTYPE_INET;
81 pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
82 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
83 }
84 #else
85 #error UNKNOWN_ADDRTYPE
86 #endif
87
88 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
89 int create_kerberos_key_from_string_direct(krb5_context context,
90 krb5_principal host_princ,
91 krb5_data *password,
92 krb5_keyblock *key,
93 krb5_enctype enctype)
94 {
95 int ret;
96 krb5_data salt;
97 krb5_encrypt_block eblock;
98
99 ret = krb5_principal2salt(context, host_princ, &salt);
100 if (ret) {
101 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
102 return ret;
103 }
104 krb5_use_enctype(context, &eblock, enctype);
105 ret = krb5_string_to_key(context, &eblock, key, password, &salt);
106 SAFE_FREE(salt.data);
107 return ret;
108 }
109 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
110 int create_kerberos_key_from_string_direct(krb5_context context,
111 krb5_principal host_princ,
112 krb5_data *password,
113 krb5_keyblock *key,
114 krb5_enctype enctype)
115 {
116 int ret;
117 krb5_salt salt;
118
119 ret = krb5_get_pw_salt(context, host_princ, &salt);
120 if (ret) {
121 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
122 return ret;
123 }
124
125 ret = krb5_string_to_key_salt(context, enctype, password->data, salt, key);
126 krb5_free_salt(context, salt);
127 return ret;
128 }
129 #else
130 #error UNKNOWN_CREATE_KEY_FUNCTIONS
131 #endif
132
133 int create_kerberos_key_from_string(krb5_context context,
134 krb5_principal host_princ,
135 krb5_data *password,
136 krb5_keyblock *key,
137 krb5_enctype enctype)
138 {
139 krb5_principal salt_princ = NULL;
140 int ret;
141 /*
142 * Check if we've determined that the KDC is salting keys for this
143 * principal/enctype in a non-obvious way. If it is, try to match
144 * its behavior.
145 */
146 salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
147 ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
148 if (salt_princ) {
149 krb5_free_principal(context, salt_princ);
150 }
151 return ret;
152 }
153
154 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
155 krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
156 krb5_enctype **enctypes)
157 {
158 return krb5_get_permitted_enctypes(context, enctypes);
159 }
160 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
161 krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
162 krb5_enctype **enctypes)
163 {
164 return krb5_get_default_in_tkt_etypes(context, enctypes);
165 }
166 #else
167 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
168 #endif
169
170 void free_kerberos_etypes(krb5_context context,
171 krb5_enctype *enctypes)
172 {
173 #if defined(HAVE_KRB5_FREE_KTYPES)
174 krb5_free_ktypes(context, enctypes);
175 return;
176 #else
177 SAFE_FREE(enctypes);
178 return;
179 #endif
180 }
181
182 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
183 krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
184 krb5_auth_context auth_context,
185 krb5_keyblock *keyblock)
186 {
187 return krb5_auth_con_setkey(context, auth_context, keyblock);
188 }
189 #endif
190
191 BOOL unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
192 {
193 DATA_BLOB pac_contents;
194 ASN1_DATA data;
195 int data_type;
196
197 if (!auth_data->length) {
198 return False;
199 }
200
201 asn1_load(&data, *auth_data);
202 asn1_start_tag(&data, ASN1_SEQUENCE(0));
203 asn1_start_tag(&data, ASN1_SEQUENCE(0));
204 asn1_start_tag(&data, ASN1_CONTEXT(0));
205 asn1_read_Integer(&data, &data_type);
206
207 if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
208 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
209 asn1_free(&data);
210 return False;
211 }
212
213 asn1_end_tag(&data);
214 asn1_start_tag(&data, ASN1_CONTEXT(1));
215 asn1_read_OctetString(&data, &pac_contents);
216 asn1_end_tag(&data);
217 asn1_end_tag(&data);
218 asn1_end_tag(&data);
219 asn1_free(&data);
220
221 *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
222
223 data_blob_free(&pac_contents);
224
225 return True;
226 }
227
228 BOOL get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
229 {
230 DATA_BLOB auth_data_wrapped;
231 BOOL got_auth_data_pac = False;
232 int i;
233
234 #if defined(HAVE_KRB5_TKT_ENC_PART2)
235 if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
236 tkt->enc_part2->authorization_data[0] &&
237 tkt->enc_part2->authorization_data[0]->length)
238 {
239 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
240
241 if (tkt->enc_part2->authorization_data[i]->ad_type !=
242 KRB5_AUTHDATA_IF_RELEVANT) {
243 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
244 tkt->enc_part2->authorization_data[i]->ad_type));
245 continue;
246 }
247
248 auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
249 tkt->enc_part2->authorization_data[i]->length);
250
251 /* check if it is a PAC */
252 got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
253 data_blob_free(&auth_data_wrapped);
254
255 if (!got_auth_data_pac) {
256 continue;
257 }
258 }
259
260 return got_auth_data_pac;
261 }
262
263 #else
264 if (tkt->ticket.authorization_data &&
265 tkt->ticket.authorization_data->len)
266 {
267 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
268
269 if (tkt->ticket.authorization_data->val[i].ad_type !=
270 KRB5_AUTHDATA_IF_RELEVANT) {
271 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
272 tkt->ticket.authorization_data->val[i].ad_type));
273 continue;
274 }
275
276 auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
277 tkt->ticket.authorization_data->val[i].ad_data.length);
278
279 /* check if it is a PAC */
280 got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
281 data_blob_free(&auth_data_wrapped);
282
283 if (!got_auth_data_pac) {
284 continue;
285 }
286 }
287
288 return got_auth_data_pac;
289 }
290 #endif
291 return False;
292 }
293
294 krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
295 {
296 #if defined(HAVE_KRB5_TKT_ENC_PART2)
297 return tkt->enc_part2->client;
298 #else
299 return tkt->client;
300 #endif
301 }
302
303 #if !defined(HAVE_KRB5_LOCATE_KDC)
304 krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
305 {
306 krb5_krbhst_handle hnd;
307 krb5_krbhst_info *hinfo;
308 krb5_error_code rc;
309 int num_kdcs, i;
310 struct sockaddr *sa;
311 struct addrinfo *ai;
312
313 *addr_pp = NULL;
314 *naddrs = 0;
315
316 rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
317 if (rc) {
318 DEBUG(0, ("krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
319 return rc;
320 }
321
322 for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
323 ;
324
325 krb5_krbhst_reset(ctx, hnd);
326
327 if (!num_kdcs) {
328 DEBUG(0, ("krb5_locate_kdc: zero kdcs found !\n"));
329 krb5_krbhst_free(ctx, hnd);
330 return -1;
331 }
332
333 sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
334 if (!sa) {
335 DEBUG(0, ("krb5_locate_kdc: malloc failed\n"));
336 krb5_krbhst_free(ctx, hnd);
337 naddrs = 0;
338 return -1;
339 }
340
341 memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
342
343 for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
344
345 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
346 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
347 if (rc) {
348 DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
349 continue;
350 }
351 #endif
352 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
353 memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
354 }
355
356 krb5_krbhst_free(ctx, hnd);
357
358 *naddrs = num_kdcs;
359 *addr_pp = sa;
360 return 0;
361 }
362 #endif
363
364 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
365 void krb5_free_unparsed_name(krb5_context context, char *val)
366 {
367 SAFE_FREE(val);
368 }
369 #endif
370
371 void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
372 {
373 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
374 if (pdata->data) {
375 krb5_free_data_contents(context, pdata);
376 }
377 #else
378 SAFE_FREE(pdata->data);
379 #endif
380 }
381
382 void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
383 {
384 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
385 KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
386 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
387 KRB5_KEY_TYPE((&pcreds->session)) = enctype;
388 #else
389 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
390 #endif
391 }
392
393 BOOL kerberos_compatible_enctypes(krb5_context context,
394 krb5_enctype enctype1,
395 krb5_enctype enctype2)
396 {
397 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
398 krb5_boolean similar = 0;
399
400 krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
401 return similar ? True : False;
402 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
403 return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
404 #endif
405 }
406
407 static BOOL ads_cleanup_expired_creds(krb5_context context,
408 krb5_ccache ccache,
409 krb5_creds *credsp)
410 {
411 krb5_error_code retval;
412 const char *cc_type = krb5_cc_get_type(context, ccache);
413
414 DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
415 cc_type, krb5_cc_get_name(context, ccache),
416 http_timestring(credsp->times.endtime)));
417
418 /* we will probably need new tickets if the current ones
419 will expire within 10 seconds.
420 */
421 if (credsp->times.endtime >= (time(NULL) + 10))
422 return False;
423
424 /* heimdal won't remove creds from a file ccache, and
425 perhaps we shouldn't anyway, since internally we
426 use memory ccaches, and a FILE one probably means that
427 we're using creds obtained outside of our exectuable
428 */
429 if (strequal(cc_type, "KCM") || strequal(cc_type, "FILE")) {
430 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
431 return False;
432 }
433
434 retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
435 if (retval) {
436 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
437 error_message(retval)));
438 /* If we have an error in this, we want to display it,
439 but continue as though we deleted it */
440 }
441 return True;
442 }
443
444 /*
445 we can't use krb5_mk_req because w2k wants the service to be in a particular format
446 */
447 static krb5_error_code ads_krb5_mk_req(krb5_context context,
448 krb5_auth_context *auth_context,
449 const krb5_flags ap_req_options,
450 const char *principal,
451 krb5_ccache ccache,
452 krb5_data *outbuf)
453 {
454 krb5_error_code retval;
455 krb5_principal server;
456 krb5_creds * credsp;
457 krb5_creds creds;
458 krb5_data in_data;
459 BOOL creds_ready = False;
460 int i = 0, maxtries = 3;
461
462 retval = krb5_parse_name(context, principal, &server);
463 if (retval) {
464 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
465 return retval;
466 }
467
468 /* obtain ticket & session key */
469 ZERO_STRUCT(creds);
470 if ((retval = krb5_copy_principal(context, server, &creds.server))) {
471 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
472 error_message(retval)));
473 goto cleanup_princ;
474 }
475
476 if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
477 /* This can commonly fail on smbd startup with no ticket in the cache.
478 * Report at higher level than 1. */
479 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
480 error_message(retval)));
481 goto cleanup_creds;
482 }
483
484 while (!creds_ready && (i < maxtries)) {
485 if ((retval = krb5_get_credentials(context, 0, ccache,
486 &creds, &credsp))) {
487 DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
488 principal, error_message(retval)));
489 goto cleanup_creds;
490 }
491
492 /* cope with ticket being in the future due to clock skew */
493 if ((unsigned)credsp->times.starttime > time(NULL)) {
494 time_t t = time(NULL);
495 int time_offset =(int)((unsigned)credsp->times.starttime-t);
496 DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
497 krb5_set_real_time(context, t + time_offset + 1, 0);
498 }
499
500 if (!ads_cleanup_expired_creds(context, ccache, credsp))
501 creds_ready = True;
502
503 i++;
504 }
505
506 DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
507 principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
508 http_timestring((unsigned)credsp->times.endtime),
509 (unsigned)credsp->times.endtime));
510
511 in_data.length = 0;
512 retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
513 &in_data, credsp, outbuf);
514 if (retval) {
515 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
516 error_message(retval)));
517 }
518
519 krb5_free_creds(context, credsp);
520
521 cleanup_creds:
522 krb5_free_cred_contents(context, &creds);
523
524 cleanup_princ:
525 krb5_free_principal(context, server);
526
527 return retval;
528 }
529
530 /*
531 get a kerberos5 ticket for the given service
532 */
533 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
534 DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
535 uint32 extra_ap_opts, const char *ccname)
536 {
537 krb5_error_code retval;
538 krb5_data packet;
539 krb5_context context = NULL;
540 krb5_ccache ccdef = NULL;
541 krb5_auth_context auth_context = NULL;
542 krb5_enctype enc_types[] = {
543 #ifdef ENCTYPE_ARCFOUR_HMAC
544 ENCTYPE_ARCFOUR_HMAC,
545 #endif
546 ENCTYPE_DES_CBC_MD5,
547 ENCTYPE_DES_CBC_CRC,
548 ENCTYPE_NULL};
549
550 initialize_krb5_error_table();
551 retval = krb5_init_context(&context);
552 if (retval) {
553 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
554 error_message(retval)));
555 goto failed;
556 }
557
558 if (time_offset != 0) {
559 krb5_set_real_time(context, time(NULL) + time_offset, 0);
560 }
561
562 if ((retval = krb5_cc_resolve(context, ccname ?
563 ccname : krb5_cc_default_name(context), &ccdef))) {
564 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
565 error_message(retval)));
566 goto failed;
567 }
568
569 if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
570 DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
571 error_message(retval)));
572 goto failed;
573 }
574
575 if ((retval = ads_krb5_mk_req(context,
576 &auth_context,
577 AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
578 principal,
579 ccdef, &packet))) {
580 goto failed;
581 }
582
583 get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
584
585 *ticket = data_blob(packet.data, packet.length);
586
587 kerberos_free_data_contents(context, &packet);
588
589 failed:
590
591 if ( context ) {
592 if (ccdef)
593 krb5_cc_close(context, ccdef);
594 if (auth_context)
595 krb5_auth_con_free(context, auth_context);
596 krb5_free_context(context);
597 }
598
599 return retval;
600 }
601
602 BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, BOOL remote)
603 {
604 krb5_keyblock *skey;
605 krb5_error_code err;
606 BOOL ret = False;
607
608 if (remote)
609 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
610 else
611 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
612 if (err == 0 && skey != NULL) {
613 DEBUG(10, ("Got KRB5 session key of length %d\n", KRB5_KEY_LENGTH(skey)));
614 *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
615 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
616
617 ret = True;
618
619 krb5_free_keyblock(context, skey);
620 } else {
621 DEBUG(10, ("KRB5 error getting session key %d\n", err));
622 }
623
624 return ret;
625 }
626
627
628 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
629 const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
630
631 const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
632 {
633 static krb5_data kdata;
634
635 kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
636 kdata.length = strlen(kdata.data);
637 return &kdata;
638 }
639 #endif
640
641 krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
642 {
643 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
644 return krb5_kt_free_entry(context, kt_entry);
645 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
646 return krb5_free_keytab_entry_contents(context, kt_entry);
647 #else
648 #error UNKNOWN_KT_FREE_FUNCTION
649 #endif
650 }
651
652 void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
653 PAC_SIGNATURE_DATA *sig)
654 {
655 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
656 cksum->cksumtype = (krb5_cksumtype)sig->type;
657 cksum->checksum.length = sig->signature.buf_len;
658 cksum->checksum.data = sig->signature.buffer;
659 #else
660 cksum->checksum_type = (krb5_cksumtype)sig->type;
661 cksum->length = sig->signature.buf_len;
662 cksum->contents = sig->signature.buffer;
663 #endif
664 }
665
666 krb5_error_code smb_krb5_verify_checksum(krb5_context context,
667 krb5_keyblock *keyblock,
668 krb5_keyusage usage,
669 krb5_checksum *cksum,
670 uint8 *data,
671 size_t length)
672 {
673 krb5_error_code ret;
674
675 /* verify the checksum */
676
677 /* welcome to the wonderful world of samba's kerberos abstraction layer:
678 *
679 * function heimdal 0.6.1rc3 heimdal 0.7 MIT krb 1.4.2
680 * -----------------------------------------------------------------------------
681 * krb5_c_verify_checksum - works works
682 * krb5_verify_checksum works (6 args) works (6 args) broken (7 args)
683 */
684
685 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
686 {
687 krb5_boolean checksum_valid = False;
688 krb5_data input;
689
690 input.data = (char *)data;
691 input.length = length;
692
693 ret = krb5_c_verify_checksum(context,
694 keyblock,
695 usage,
696 &input,
697 cksum,
698 &checksum_valid);
699 if (ret) {
700 DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
701 error_message(ret)));
702 return ret;
703 }
704
705 if (!checksum_valid)
706 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
707 }
708
709 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
710
711 /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
712 * without enctype and it ignores any key_usage types - Guenther */
713
714 {
715
716 krb5_crypto crypto;
717 ret = krb5_crypto_init(context,
718 keyblock,
719 0,
720 &crypto);
721 if (ret) {
722 DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
723 error_message(ret)));
724 return ret;
725 }
726
727 ret = krb5_verify_checksum(context,
728 crypto,
729 usage,
730 data,
731 length,
732 cksum);
733
734 krb5_crypto_destroy(context, crypto);
735 }
736
737 #else
738 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
739 #endif
740
741 return ret;
742 }
743
744 time_t get_authtime_from_tkt(krb5_ticket *tkt)
745 {
746 #if defined(HAVE_KRB5_TKT_ENC_PART2)
747 return tkt->enc_part2->times.authtime;
748 #else
749 return tkt->ticket.authtime;
750 #endif
751 }
752
753 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
754 {
755 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
756 if (ap_req->ticket->enc_part.kvno)
757 return ap_req->ticket->enc_part.kvno;
758 #else /* Heimdal */
759 if (ap_req->ticket.enc_part.kvno)
760 return *ap_req->ticket.enc_part.kvno;
761 #endif
762 return 0;
763 }
764
765 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
766 {
767 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
768 return ap_req->ticket.enc_part.etype;
769 #else /* MIT */
770 return ap_req->ticket->enc_part.enctype;
771 #endif
772 }
773
774 static krb5_error_code
775 get_key_from_keytab(krb5_context context,
776 krb5_const_principal server,
777 krb5_enctype enctype,
778 krb5_kvno kvno,
779 krb5_keyblock **out_key)
780 {
781 krb5_keytab_entry entry;
782 krb5_error_code ret;
783 krb5_keytab keytab;
784 char *name = NULL;
785
786 /* We have to open a new keytab handle here, as MIT does
787 an implicit open/getnext/close on krb5_kt_get_entry. We
788 may be in the middle of a keytab enumeration when this is
789 called. JRA. */
790
791 ret = krb5_kt_default(context, &keytab);
792 if (ret) {
793 DEBUG(0,("get_key_from_keytab: failed to open keytab: %s\n", error_message(ret)));
794 return ret;
795 }
796
797 if ( DEBUGLEVEL >= 10 ) {
798 krb5_unparse_name(context, server, &name);
799 DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
800 kvno, enctype, name));
801 krb5_free_unparsed_name(context, name);
802 }
803
804 ret = krb5_kt_get_entry(context,
805 keytab,
806 server,
807 kvno,
808 enctype,
809 &entry);
810
811 if (ret) {
812 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
813 goto out;
814 }
815
816 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
817 ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
818 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
819 ret = krb5_copy_keyblock(context, &entry.key, out_key);
820 #else
821 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
822 #endif
823
824 if (ret) {
825 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
826 goto out;
827 }
828
829 smb_krb5_kt_free_entry(context, &entry);
830
831 out:
832 krb5_kt_close(context, keytab);
833 return ret;
834 }
835
836 void smb_krb5_free_ap_req(krb5_context context,
837 krb5_ap_req *ap_req)
838 {
839 #ifdef HAVE_KRB5_FREE_AP_REQ /* MIT */
840 krb5_free_ap_req(context, ap_req);
841 #elif defined(HAVE_FREE_AP_REQ) /* Heimdal */
842 free_AP_REQ(ap_req);
843 #else
844 #error UNKNOWN_KRB5_AP_REQ_FREE_FUNCTION
845 #endif
846 }
847
848 /* Prototypes */
849 #if defined(HAVE_DECODE_KRB5_AP_REQ) /* MIT */
850 krb5_error_code decode_krb5_ap_req(const krb5_data *code, krb5_ap_req **rep);
851 #endif
852
853 krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
854 const krb5_data *inbuf,
855 krb5_kvno *kvno,
856 krb5_enctype *enctype)
857 {
858 krb5_error_code ret;
859 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
860 {
861 krb5_ap_req ap_req;
862
863 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
864 if (ret)
865 return ret;
866
867 *kvno = get_kvno_from_ap_req(&ap_req);
868 *enctype = get_enctype_from_ap_req(&ap_req);
869
870 smb_krb5_free_ap_req(context, &ap_req);
871 }
872 #elif defined(HAVE_DECODE_KRB5_AP_REQ) /* MIT */
873 {
874 krb5_ap_req *ap_req = NULL;
875
876 ret = decode_krb5_ap_req(inbuf, &ap_req);
877 if (ret)
878 return ret;
879
880 *kvno = get_kvno_from_ap_req(ap_req);
881 *enctype = get_enctype_from_ap_req(ap_req);
882
883 smb_krb5_free_ap_req(context, ap_req);
884 }
885 #else
886 #error UNKOWN_KRB5_AP_REQ_DECODING_FUNCTION
887 #endif
888 return ret;
889 }
890
891 krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
892 krb5_auth_context *auth_context,
893 const krb5_data *inbuf,
894 krb5_const_principal server,
895 krb5_keytab keytab,
896 krb5_flags *ap_req_options,
897 krb5_ticket **ticket,
898 krb5_keyblock **keyblock)
899 {
900 krb5_error_code ret;
901 krb5_kvno kvno;
902 krb5_enctype enctype;
903 krb5_keyblock *local_keyblock;
904
905 ret = krb5_rd_req(context,
906 auth_context,
907 inbuf,
908 server,
909 keytab,
910 ap_req_options,
911 ticket);
912 if (ret) {
913 return ret;
914 }
915
916 ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
917 if (ret) {
918 return ret;
919 }
920
921 ret = get_key_from_keytab(context,
922 server,
923 enctype,
924 kvno,
925 &local_keyblock);
926 if (ret) {
927 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
928 goto out;
929 }
930
931 out:
932 if (ret && local_keyblock != NULL) {
933 krb5_free_keyblock(context, local_keyblock);
934 } else {
935 *keyblock = local_keyblock;
936 }
937
938 return ret;
939 }
940
941 krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
942 const char *name,
943 krb5_principal *principal)
944 {
945 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
946 return krb5_parse_name_norealm(context, name, principal);
947 #endif
948
949 /* we are cheating here because parse_name will in fact set the realm.
950 * We don't care as the only caller of smb_krb5_parse_name_norealm
951 * ignores the realm anyway when calling
952 * smb_krb5_principal_compare_any_realm later - Guenther */
953
954 return krb5_parse_name(context, name, principal);
955 }
956
957 BOOL smb_krb5_principal_compare_any_realm(krb5_context context,
958 krb5_const_principal princ1,
959 krb5_const_principal princ2)
960 {
961 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
962
963 return krb5_principal_compare_any_realm(context, princ1, princ2);
964
965 /* krb5_princ_size is a macro in MIT */
966 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
967
968 int i, len1, len2;
969 const krb5_data *p1, *p2;
970
971 len1 = krb5_princ_size(context, princ1);
972 len2 = krb5_princ_size(context, princ2);
973
974 if (len1 != len2)
975 return False;
976
977 for (i = 0; i < len1; i++) {
978
979 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
980 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
981
982 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
983 return False;
984 }
985
986 return True;
987 #else
988 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
989 #endif
990 }
991
992 krb5_error_code smb_krb5_renew_ticket(const char *ccache_string, /* FILE:/tmp/krb5cc_0 */
993 const char *client_string, /* gd@BER.SUSE.DE */
994 const char *service_string, /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
995 time_t *new_start_time)
996 {
997 krb5_error_code ret;
998 krb5_context context = NULL;
999 krb5_ccache ccache = NULL;
1000 krb5_principal client = NULL;
1001
1002 initialize_krb5_error_table();
1003 ret = krb5_init_context(&context);
1004 if (ret) {
1005 goto done;
1006 }
1007
1008 if (!ccache_string) {
1009 ccache_string = krb5_cc_default_name(context);
1010 }
1011
1012 DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1013
1014 /* FIXME: we should not fall back to defaults */
1015 ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1016 if (ret) {
1017 goto done;
1018 }
1019
1020 #ifdef HAVE_KRB5_GET_RENEWED_CREDS /* MIT */
1021 {
1022 krb5_creds creds;
1023
1024 if (client_string) {
1025 ret = krb5_parse_name(context, client_string, &client);
1026 if (ret) {
1027 goto done;
1028 }
1029 } else {
1030 ret = krb5_cc_get_principal(context, ccache, &client);
1031 if (ret) {
1032 goto done;
1033 }
1034 }
1035
1036 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1037 if (ret) {
1038 DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1039 goto done;
1040 }
1041
1042 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1043 ret = krb5_cc_initialize(context, ccache, client);
1044 if (ret) {
1045 goto done;
1046 }
1047
1048 ret = krb5_cc_store_cred(context, ccache, &creds);
1049
1050 if (new_start_time) {
1051 *new_start_time = (time_t) creds.times.renew_till;
1052 }
1053
1054 krb5_free_cred_contents(context, &creds);
1055 }
1056 #elif defined(HAVE_KRB5_GET_KDC_CRED) /* Heimdal */
1057 {
1058 krb5_kdc_flags flags;
1059 krb5_creds creds_in;
1060 krb5_realm *client_realm;
1061 krb5_creds *creds;
1062
1063 memset(&creds_in, 0, sizeof(creds_in));
1064
1065 if (client_string) {
1066 ret = krb5_parse_name(context, client_string, &creds_in.client);
1067 if (ret) {
1068 goto done;
1069 }
1070 } else {
1071 ret = krb5_cc_get_principal(context, ccache, &creds_in.client);
1072 if (ret) {
1073 goto done;
1074 }
1075 }
1076
1077 if (service_string) {
1078 ret = krb5_parse_name(context, service_string, &creds_in.server);
1079 if (ret) {
1080 goto done;
1081 }
1082 } else {
1083 /* build tgt service by default */
1084 client_realm = krb5_princ_realm(context, client);
1085 ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1086 if (ret) {
1087 goto done;
1088 }
1089 }
1090
1091 flags.i = 0;
1092 flags.b.renewable = flags.b.renew = True;
1093
1094 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds);
1095 if (ret) {
1096 DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1097 goto done;
1098 }
1099
1100 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1101 ret = krb5_cc_initialize(context, ccache, creds_in.client);
1102 if (ret) {
1103 goto done;
1104 }
1105
1106 ret = krb5_cc_store_cred(context, ccache, creds);
1107
1108 if (new_start_time) {
1109 *new_start_time = (time_t) creds->times.renew_till;
1110 }
1111
1112 krb5_free_cred_contents(context, &creds_in);
1113 krb5_free_creds(context, creds);
1114 }
1115 #else
1116 #error No suitable krb5 ticket renew function available
1117 #endif
1118
1119
1120 done:
1121 if (client) {
1122 krb5_free_principal(context, client);
1123 }
1124 if (context) {
1125 krb5_free_context(context);
1126 }
1127 if (ccache) {
1128 krb5_cc_close(context, ccache);
1129 }
1130
1131 return ret;
1132
1133 }
1134
1135 #else /* HAVE_KRB5 */
1136 /* this saves a few linking headaches */
1137 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1138 DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1139 const char *ccname)
1140 {
1141 DEBUG(0,("NO KERBEROS SUPPORT\n"));
1142 return 1;
1143 }
1144
1145 #endif