source4/heimdal/lib/krb5/get_in_tkt.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 krb5_error_code KRB5_LIB_FUNCTION
  39 krb5_init_etype (krb5_context context,
  40                  unsigned *len,
  41                  krb5_enctype **val,
  42                  const krb5_enctype *etypes)
  43 {
  44     unsigned int i;
  45     krb5_error_code ret;
  46     krb5_enctype *tmp = NULL;
  47
  48     ret = 0;
  49     if (etypes == NULL) {
  50         ret = krb5_get_default_in_tkt_etypes(context,
  51                                              &tmp);
  52         if (ret)
  53             return ret;
  54         etypes = tmp;
  55     }
  56
  57     for (i = 0; etypes[i]; ++i)
  58         ;
  59     *len = i;
  60     *val = malloc(i * sizeof(**val));
  61     if (i != 0 && *val == NULL) {
  62         ret = ENOMEM;
  63         krb5_set_error_message(context, ret, "malloc: out of memory");
  64         goto cleanup;
  65     }
  66     memmove (*val,
  67              etypes,
  68              i * sizeof(*tmp));
  69 cleanup:
  70     if (tmp != NULL)
  71         free (tmp);
  72     return ret;
  73 }
  74
  75 static krb5_error_code
  76 check_server_referral(krb5_context context,
  77                       krb5_kdc_rep *rep,
  78                       unsigned flags,
  79                       krb5_const_principal requested,
  80                       krb5_const_principal returned,
  81                       const krb5_keyblock const * key)
  82 {
  83     krb5_error_code ret;
  84     PA_ServerReferralData ref;
  85     krb5_crypto session;
  86     EncryptedData ed;
  87     size_t len;
  88     krb5_data data;
  89     PA_DATA *pa;
  90     int i = 0, cmp;
  91
  92     if (rep->kdc_rep.padata == NULL)
  93         goto noreferral;
  94
  95     pa = krb5_find_padata(rep->kdc_rep.padata->val,
  96                           rep->kdc_rep.padata->len,
  97                           KRB5_PADATA_SERVER_REFERRAL, &i);
  98     if (pa == NULL)
  99         goto noreferral;
 100
 101     memset(&ed, 0, sizeof(ed));
 102     memset(&ref, 0, sizeof(ref));
 103
 104     ret = decode_EncryptedData(pa->padata_value.data,
 105                                pa->padata_value.length,
 106                                &ed, &len);
 107     if (ret)
 108         return ret;
 109     if (len != pa->padata_value.length) {
 110         free_EncryptedData(&ed);
 111         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED, "Referral EncryptedData wrong");
 112         return KRB5KRB_AP_ERR_MODIFIED;
 113     }
 114
 115     ret = krb5_crypto_init(context, key, 0, &session);
 116     if (ret) {
 117         free_EncryptedData(&ed);
 118         return ret;
 119     }
 120
 121     ret = krb5_decrypt_EncryptedData(context, session,
 122                                      KRB5_KU_PA_SERVER_REFERRAL,
 123                                      &ed, &data);
 124     free_EncryptedData(&ed);
 125     krb5_crypto_destroy(context, session);
 126     if (ret)
 127         return ret;
 128
 129     ret = decode_PA_ServerReferralData(data.data, data.length, &ref, &len);
 130     if (ret) {
 131         krb5_data_free(&data);
 132         return ret;
 133     }
 134     krb5_data_free(&data);
 135
 136     if (strcmp(requested->realm, returned->realm) != 0) {
 137         free_PA_ServerReferralData(&ref);
 138         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 139                                "server ref realm mismatch");
 140         return KRB5KRB_AP_ERR_MODIFIED;
 141     }
 142
 143     if (returned->name.name_string.len == 2 &&
 144         strcmp(returned->name.name_string.val[0], KRB5_TGS_NAME) == 0)
 145     {
 146         const char *realm = returned->name.name_string.val[1];
 147
 148         if (ref.referred_realm == NULL
 149             || strcmp(*ref.referred_realm, realm) != 0)
 150         {
 151             free_PA_ServerReferralData(&ref);
 152             krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 153                                    "tgt returned with wrong ref");
 154             return KRB5KRB_AP_ERR_MODIFIED;
 155         }
 156     } else if (krb5_principal_compare(context, returned, requested) == 0) {
 157         free_PA_ServerReferralData(&ref);
 158         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 159                               "req princ no same as returned");
 160         return KRB5KRB_AP_ERR_MODIFIED;
 161     }
 162
 163     if (ref.requested_principal_name) {
 164         cmp = _krb5_principal_compare_PrincipalName(context,
 165                                                     requested,
 166                                                     ref.requested_principal_name);
 167         if (!cmp) {
 168             free_PA_ServerReferralData(&ref);
 169             krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 170                                    "compare requested failed");
 171             return KRB5KRB_AP_ERR_MODIFIED;
 172         }
 173     } else if (flags & EXTRACT_TICKET_AS_REQ) {
 174         free_PA_ServerReferralData(&ref);
 175         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 176                                "Requested principal missing on AS-REQ");
 177         return KRB5KRB_AP_ERR_MODIFIED;
 178     }
 179
 180     free_PA_ServerReferralData(&ref);
 181
 182     return ret;
 183 noreferral:
 184     if (krb5_principal_compare(context, requested, returned) == FALSE) {
 185         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 186                                "Not same server principal returned "
 187                               "as requested");
 188         return KRB5KRB_AP_ERR_MODIFIED;
 189     }
 190     return 0;
 191 }
 192
 193
 194 /*
 195  * Verify referral data
 196  */
 197
 198
 199 static krb5_error_code
 200 check_client_referral(krb5_context context,
 201                       krb5_kdc_rep *rep,
 202                       krb5_const_principal requested,
 203                       krb5_const_principal mapped,
 204                       krb5_keyblock const * key)
 205 {
 206     krb5_error_code ret;
 207     PA_ClientCanonicalized canon;
 208     krb5_crypto crypto;
 209     krb5_data data;
 210     PA_DATA *pa;
 211     size_t len;
 212     int i = 0;
 213
 214     if (rep->kdc_rep.padata == NULL)
 215         goto noreferral;
 216
 217     pa = krb5_find_padata(rep->kdc_rep.padata->val,
 218                           rep->kdc_rep.padata->len,
 219                           KRB5_PADATA_CLIENT_CANONICALIZED, &i);
 220     if (pa == NULL)
 221         goto noreferral;
 222
 223     ret = decode_PA_ClientCanonicalized(pa->padata_value.data,
 224                                         pa->padata_value.length,
 225                                         &canon, &len);
 226     if (ret) {
 227         krb5_set_error_message(context, ret, "Failed to decode "
 228                                "PA_ClientCanonicalized");
 229         return ret;
 230     }
 231
 232     ASN1_MALLOC_ENCODE(PA_ClientCanonicalizedNames, data.data, data.length,
 233                        &canon.names, &len, ret);
 234     if (ret) {
 235         free_PA_ClientCanonicalized(&canon);
 236         return ret;
 237     }
 238     if (data.length != len)
 239         krb5_abortx(context, "internal asn.1 error");
 240
 241     ret = krb5_crypto_init(context, key, 0, &crypto);
 242     if (ret) {
 243         free(data.data);
 244         free_PA_ClientCanonicalized(&canon);
 245         return ret;
 246     }
 247
 248     ret = krb5_verify_checksum(context, crypto, KRB5_KU_CANONICALIZED_NAMES,
 249                                data.data, data.length,
 250                                &canon.canon_checksum);
 251     krb5_crypto_destroy(context, crypto);
 252     free(data.data);
 253     if (ret) {
 254         krb5_set_error_message(context, ret, "Failed to verify "
 255                               "client canonicalized data");
 256         free_PA_ClientCanonicalized(&canon);
 257         return ret;
 258     }
 259
 260     if (!_krb5_principal_compare_PrincipalName(context,
 261                                                requested,
 262                                                &canon.names.requested_name))
 263     {
 264         free_PA_ClientCanonicalized(&canon);
 265         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
 266                                "Requested name doesn't match"
 267                               " in client referral");
 268         return KRB5_PRINC_NOMATCH;
 269     }
 270     if (!_krb5_principal_compare_PrincipalName(context,
 271                                                mapped,
 272                                                &canon.names.mapped_name))
 273     {
 274         free_PA_ClientCanonicalized(&canon);
 275         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
 276                                "Mapped name doesn't match"
 277                               " in client referral");
 278         return KRB5_PRINC_NOMATCH;
 279     }
 280
 281     return 0;
 282
 283 noreferral:
 284     if (krb5_principal_compare(context, requested, mapped) == FALSE) {
 285         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 286                                "Not same client principal returned "
 287                               "as requested");
 288         return KRB5KRB_AP_ERR_MODIFIED;
 289     }
 290     return 0;
 291 }
 292
 293
 294
 295 static krb5_error_code
 296 decrypt_tkt (krb5_context context,
 297              krb5_keyblock *key,
 298              krb5_key_usage usage,
 299              krb5_const_pointer decrypt_arg,
 300              krb5_kdc_rep *dec_rep)
 301 {
 302     krb5_error_code ret;
 303     krb5_data data;
 304     size_t size;
 305     krb5_crypto crypto;
 306
 307     ret = krb5_crypto_init(context, key, 0, &crypto);
 308     if (ret)
 309         return ret;
 310
 311     ret = krb5_decrypt_EncryptedData (context,
 312                                       crypto,
 313                                       usage,
 314                                       &dec_rep->kdc_rep.enc_part,
 315                                       &data);
 316     krb5_crypto_destroy(context, crypto);
 317
 318     if (ret)
 319         return ret;
 320
 321     ret = krb5_decode_EncASRepPart(context,
 322                                    data.data,
 323                                    data.length,
 324                                    &dec_rep->enc_part,
 325                                    &size);
 326     if (ret)
 327         ret = krb5_decode_EncTGSRepPart(context,
 328                                         data.data,
 329                                         data.length,
 330                                         &dec_rep->enc_part,
 331                                         &size);
 332     krb5_data_free (&data);
 333     if (ret)
 334         return ret;
 335     return 0;
 336 }
 337
 338 int
 339 _krb5_extract_ticket(krb5_context context,
 340                      krb5_kdc_rep *rep,
 341                      krb5_creds *creds,
 342                      krb5_keyblock *key,
 343                      krb5_const_pointer keyseed,
 344                      krb5_key_usage key_usage,
 345                      krb5_addresses *addrs,
 346                      unsigned nonce,
 347                      unsigned flags,
 348                      krb5_decrypt_proc decrypt_proc,
 349                      krb5_const_pointer decryptarg)
 350 {
 351     krb5_error_code ret;
 352     krb5_principal tmp_principal;
 353     size_t len;
 354     time_t tmp_time;
 355     krb5_timestamp sec_now;
 356
 357     /* decrypt */
 358
 359     if (decrypt_proc == NULL)
 360         decrypt_proc = decrypt_tkt;
 361
 362     ret = (*decrypt_proc)(context, key, key_usage, decryptarg, rep);
 363     if (ret)
 364         goto out;
 365
 366     /* save session key */
 367
 368     creds->session.keyvalue.length = 0;
 369     creds->session.keyvalue.data   = NULL;
 370     creds->session.keytype = rep->enc_part.key.keytype;
 371     ret = krb5_data_copy (&creds->session.keyvalue,
 372                           rep->enc_part.key.keyvalue.data,
 373                           rep->enc_part.key.keyvalue.length);
 374     if (ret) {
 375         krb5_clear_error_string(context);
 376         goto out;
 377     }
 378
 379     /*
 380      * HACK:
 381      * this is really a ugly hack, to support using the Netbios Domain Name
 382      * as realm against windows KDC's, they always return the full realm
 383      * based on the DNS Name.
 384      */
 385     flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
 386     flags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 387
 388    /* compare client and save */
 389     ret = _krb5_principalname2krb5_principal (context,
 390                                               &tmp_principal,
 391                                               rep->kdc_rep.cname,
 392                                               rep->kdc_rep.crealm);
 393     if (ret)
 394         goto out;
 395
 396     /* check client referral and save principal */
 397     /* anonymous here ? */
 398     if((flags & EXTRACT_TICKET_ALLOW_CNAME_MISMATCH) == 0) {
 399         ret = check_client_referral(context, rep,
 400                                     creds->client,
 401                                     tmp_principal,
 402                                     &creds->session);
 403         if (ret) {
 404             krb5_free_principal (context, tmp_principal);
 405             goto out;
 406         }
 407     }
 408     krb5_free_principal (context, creds->client);
 409     creds->client = tmp_principal;
 410
 411     /* check server referral and save principal */
 412     ret = _krb5_principalname2krb5_principal (context,
 413                                               &tmp_principal,
 414                                               rep->kdc_rep.ticket.sname,
 415                                               rep->kdc_rep.ticket.realm);
 416     if (ret)
 417         goto out;
 418     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
 419         ret = check_server_referral(context,
 420                                     rep,
 421                                     flags,
 422                                     creds->server,
 423                                     tmp_principal,
 424                                     &creds->session);
 425         if (ret) {
 426             krb5_free_principal (context, tmp_principal);
 427             goto out;
 428         }
 429     }
 430     krb5_free_principal(context, creds->server);
 431     creds->server = tmp_principal;
 432
 433     /* verify names */
 434     if(flags & EXTRACT_TICKET_MATCH_REALM){
 435         const char *srealm = krb5_principal_get_realm(context, creds->server);
 436         const char *crealm = krb5_principal_get_realm(context, creds->client);
 437
 438         if (strcmp(rep->enc_part.srealm, srealm) != 0 ||
 439             strcmp(rep->enc_part.srealm, crealm) != 0)
 440         {
 441             ret = KRB5KRB_AP_ERR_MODIFIED;
 442             krb5_clear_error_string(context);
 443             goto out;
 444         }
 445     }
 446
 447     /* compare nonces */
 448
 449     if (nonce != rep->enc_part.nonce) {
 450         ret = KRB5KRB_AP_ERR_MODIFIED;
 451         krb5_set_error_message(context, ret, "malloc: out of memory");
 452         goto out;
 453     }
 454
 455     /* set kdc-offset */
 456
 457     krb5_timeofday (context, &sec_now);
 458     if (rep->enc_part.flags.initial
 459         && context->kdc_sec_offset == 0
 460         && krb5_config_get_bool (context, NULL,
 461                                  "libdefaults",
 462                                  "kdc_timesync",
 463                                  NULL)) {
 464         context->kdc_sec_offset = rep->enc_part.authtime - sec_now;
 465         krb5_timeofday (context, &sec_now);
 466     }
 467
 468     /* check all times */
 469
 470     if (rep->enc_part.starttime) {
 471         tmp_time = *rep->enc_part.starttime;
 472     } else
 473         tmp_time = rep->enc_part.authtime;
 474
 475     if (creds->times.starttime == 0
 476         && abs(tmp_time - sec_now) > context->max_skew) {
 477         ret = KRB5KRB_AP_ERR_SKEW;
 478         krb5_set_error_message (context, ret,
 479                                "time skew (%d) larger than max (%d)",
 480                                abs(tmp_time - sec_now),
 481                                (int)context->max_skew);
 482         goto out;
 483     }
 484
 485     if (creds->times.starttime != 0
 486         && tmp_time != creds->times.starttime) {
 487         krb5_clear_error_string (context);
 488         ret = KRB5KRB_AP_ERR_MODIFIED;
 489         goto out;
 490     }
 491
 492     creds->times.starttime = tmp_time;
 493
 494     if (rep->enc_part.renew_till) {
 495         tmp_time = *rep->enc_part.renew_till;
 496     } else
 497         tmp_time = 0;
 498
 499     if (creds->times.renew_till != 0
 500         && tmp_time > creds->times.renew_till) {
 501         krb5_clear_error_string (context);
 502         ret = KRB5KRB_AP_ERR_MODIFIED;
 503         goto out;
 504     }
 505
 506     creds->times.renew_till = tmp_time;
 507
 508     creds->times.authtime = rep->enc_part.authtime;
 509
 510     if (creds->times.endtime != 0
 511         && rep->enc_part.endtime > creds->times.endtime) {
 512         krb5_clear_error_string (context);
 513         ret = KRB5KRB_AP_ERR_MODIFIED;
 514         goto out;
 515     }
 516
 517     creds->times.endtime  = rep->enc_part.endtime;
 518
 519     if(rep->enc_part.caddr)
 520         krb5_copy_addresses (context, rep->enc_part.caddr, &creds->addresses);
 521     else if(addrs)
 522         krb5_copy_addresses (context, addrs, &creds->addresses);
 523     else {
 524         creds->addresses.len = 0;
 525         creds->addresses.val = NULL;
 526     }
 527     creds->flags.b = rep->enc_part.flags;
 528
 529     creds->authdata.len = 0;
 530     creds->authdata.val = NULL;
 531
 532     /* extract ticket */
 533     ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length,
 534                        &rep->kdc_rep.ticket, &len, ret);
 535     if(ret)
 536         goto out;
 537     if (creds->ticket.length != len)
 538         krb5_abortx(context, "internal error in ASN.1 encoder");
 539     creds->second_ticket.length = 0;
 540     creds->second_ticket.data   = NULL;
 541
 542
 543 out:
 544     memset (rep->enc_part.key.keyvalue.data, 0,
 545             rep->enc_part.key.keyvalue.length);
 546     return ret;
 547 }
 548
 549
 550 static krb5_error_code
 551 make_pa_enc_timestamp(krb5_context context, PA_DATA *pa,
 552                       krb5_enctype etype, krb5_keyblock *key)
 553 {
 554     PA_ENC_TS_ENC p;
 555     unsigned char *buf;
 556     size_t buf_size;
 557     size_t len;
 558     EncryptedData encdata;
 559     krb5_error_code ret;
 560     int32_t usec;
 561     int usec2;
 562     krb5_crypto crypto;
 563
 564     krb5_us_timeofday (context, &p.patimestamp, &usec);
 565     usec2         = usec;
 566     p.pausec      = &usec2;
 567
 568     ASN1_MALLOC_ENCODE(PA_ENC_TS_ENC, buf, buf_size, &p, &len, ret);
 569     if (ret)
 570         return ret;
 571     if(buf_size != len)
 572         krb5_abortx(context, "internal error in ASN.1 encoder");
 573     ret = krb5_crypto_init(context, key, 0, &crypto);
 574     if (ret) {
 575         free(buf);
 576         return ret;
 577     }
 578     ret = krb5_encrypt_EncryptedData(context,
 579                                      crypto,
 580                                      KRB5_KU_PA_ENC_TIMESTAMP,
 581                                      buf,
 582                                      len,
 583                                      0,
 584                                      &encdata);
 585     free(buf);
 586     krb5_crypto_destroy(context, crypto);
 587     if (ret)
 588         return ret;
 589
 590     ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_size, &encdata, &len, ret);
 591     free_EncryptedData(&encdata);
 592     if (ret)
 593         return ret;
 594     if(buf_size != len)
 595         krb5_abortx(context, "internal error in ASN.1 encoder");
 596     pa->padata_type = KRB5_PADATA_ENC_TIMESTAMP;
 597     pa->padata_value.length = len;
 598     pa->padata_value.data = buf;
 599     return 0;
 600 }
 601
 602 static krb5_error_code
 603 add_padata(krb5_context context,
 604            METHOD_DATA *md,
 605            krb5_principal client,
 606            krb5_key_proc key_proc,
 607            krb5_const_pointer keyseed,
 608            krb5_enctype *enctypes,
 609            unsigned netypes,
 610            krb5_salt *salt)
 611 {
 612     krb5_error_code ret;
 613     PA_DATA *pa2;
 614     krb5_salt salt2;
 615     krb5_enctype *ep;
 616     int i;
 617
 618     if(salt == NULL) {
 619         /* default to standard salt */
 620         ret = krb5_get_pw_salt (context, client, &salt2);
 621         salt = &salt2;
 622     }
 623     if (!enctypes) {
 624         enctypes = context->etypes;
 625         netypes = 0;
 626         for (ep = enctypes; *ep != ETYPE_NULL; ep++)
 627             netypes++;
 628     }
 629     pa2 = realloc (md->val, (md->len + netypes) * sizeof(*md->val));
 630     if (pa2 == NULL) {
 631         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 632         return ENOMEM;
 633     }
 634     md->val = pa2;
 635
 636     for (i = 0; i < netypes; ++i) {
 637         krb5_keyblock *key;
 638
 639         ret = (*key_proc)(context, enctypes[i], *salt, keyseed, &key);
 640         if (ret)
 641             continue;
 642         ret = make_pa_enc_timestamp (context, &md->val[md->len],
 643                                      enctypes[i], key);
 644         krb5_free_keyblock (context, key);
 645         if (ret)
 646             return ret;
 647         ++md->len;
 648     }
 649     if(salt == &salt2)
 650         krb5_free_salt(context, salt2);
 651     return 0;
 652 }
 653
 654 static krb5_error_code
 655 init_as_req (krb5_context context,
 656              KDCOptions opts,
 657              krb5_creds *creds,
 658              const krb5_addresses *addrs,
 659              const krb5_enctype *etypes,
 660              const krb5_preauthtype *ptypes,
 661              const krb5_preauthdata *preauth,
 662              krb5_key_proc key_proc,
 663              krb5_const_pointer keyseed,
 664              unsigned nonce,
 665              AS_REQ *a)
 666 {
 667     krb5_error_code ret;
 668     krb5_salt salt;
 669
 670     memset(a, 0, sizeof(*a));
 671
 672     a->pvno = 5;
 673     a->msg_type = krb_as_req;
 674     a->req_body.kdc_options = opts;
 675     a->req_body.cname = malloc(sizeof(*a->req_body.cname));
 676     if (a->req_body.cname == NULL) {
 677         ret = ENOMEM;
 678         krb5_set_error_message(context, ret, "malloc: out of memory");
 679         goto fail;
 680     }
 681     a->req_body.sname = malloc(sizeof(*a->req_body.sname));
 682     if (a->req_body.sname == NULL) {
 683         ret = ENOMEM;
 684         krb5_set_error_message(context, ret, "malloc: out of memory");
 685         goto fail;
 686     }
 687     ret = _krb5_principal2principalname (a->req_body.cname, creds->client);
 688     if (ret)
 689         goto fail;
 690     ret = _krb5_principal2principalname (a->req_body.sname, creds->server);
 691     if (ret)
 692         goto fail;
 693     ret = copy_Realm(&creds->client->realm, &a->req_body.realm);
 694     if (ret)
 695         goto fail;
 696
 697     if(creds->times.starttime) {
 698         a->req_body.from = malloc(sizeof(*a->req_body.from));
 699         if (a->req_body.from == NULL) {
 700             ret = ENOMEM;
 701             krb5_set_error_message(context, ret, "malloc: out of memory");
 702             goto fail;
 703         }
 704         *a->req_body.from = creds->times.starttime;
 705     }
 706     if(creds->times.endtime){
 707         ALLOC(a->req_body.till, 1);
 708         *a->req_body.till = creds->times.endtime;
 709     }
 710     if(creds->times.renew_till){
 711         a->req_body.rtime = malloc(sizeof(*a->req_body.rtime));
 712         if (a->req_body.rtime == NULL) {
 713             ret = ENOMEM;
 714             krb5_set_error_message(context, ret, "malloc: out of memory");
 715             goto fail;
 716         }
 717         *a->req_body.rtime = creds->times.renew_till;
 718     }
 719     a->req_body.nonce = nonce;
 720     ret = krb5_init_etype (context,
 721                            &a->req_body.etype.len,
 722                            &a->req_body.etype.val,
 723                            etypes);
 724     if (ret)
 725         goto fail;
 726
 727     /*
 728      * This means no addresses
 729      */
 730
 731     if (addrs && addrs->len == 0) {
 732         a->req_body.addresses = NULL;
 733     } else {
 734         a->req_body.addresses = malloc(sizeof(*a->req_body.addresses));
 735         if (a->req_body.addresses == NULL) {
 736             ret = ENOMEM;
 737             krb5_set_error_message(context, ret, "malloc: out of memory");
 738             goto fail;
 739         }
 740
 741         if (addrs)
 742             ret = krb5_copy_addresses(context, addrs, a->req_body.addresses);
 743         else {
 744             ret = krb5_get_all_client_addrs (context, a->req_body.addresses);
 745             if(ret == 0 && a->req_body.addresses->len == 0) {
 746                 free(a->req_body.addresses);
 747                 a->req_body.addresses = NULL;
 748             }
 749         }
 750         if (ret)
 751             return ret;
 752     }
 753
 754     a->req_body.enc_authorization_data = NULL;
 755     a->req_body.additional_tickets = NULL;
 756
 757     if(preauth != NULL) {
 758         int i;
 759         ALLOC(a->padata, 1);
 760         if(a->padata == NULL) {
 761             ret = ENOMEM;
 762             krb5_set_error_message(context, ret, "malloc: out of memory");
 763             goto fail;
 764         }
 765         a->padata->val = NULL;
 766         a->padata->len = 0;
 767         for(i = 0; i < preauth->len; i++) {
 768             if(preauth->val[i].type == KRB5_PADATA_ENC_TIMESTAMP){
 769                 int j;
 770
 771                 for(j = 0; j < preauth->val[i].info.len; j++) {
 772                     krb5_salt *sp = &salt;
 773                     if(preauth->val[i].info.val[j].salttype)
 774                         salt.salttype = *preauth->val[i].info.val[j].salttype;
 775                     else
 776                         salt.salttype = KRB5_PW_SALT;
 777                     if(preauth->val[i].info.val[j].salt)
 778                         salt.saltvalue = *preauth->val[i].info.val[j].salt;
 779                     else
 780                         if(salt.salttype == KRB5_PW_SALT)
 781                             sp = NULL;
 782                         else
 783                             krb5_data_zero(&salt.saltvalue);
 784                     ret = add_padata(context, a->padata, creds->client,
 785                                      key_proc, keyseed,
 786                                      &preauth->val[i].info.val[j].etype, 1,
 787                                      sp);
 788                     if (ret == 0)
 789                         break;
 790                 }
 791             }
 792         }
 793     } else
 794     /* not sure this is the way to use `ptypes' */
 795     if (ptypes == NULL || *ptypes == KRB5_PADATA_NONE)
 796         a->padata = NULL;
 797     else if (*ptypes ==  KRB5_PADATA_ENC_TIMESTAMP) {
 798         ALLOC(a->padata, 1);
 799         if (a->padata == NULL) {
 800             ret = ENOMEM;
 801             krb5_set_error_message(context, ret, "malloc: out of memory");
 802             goto fail;
 803         }
 804         a->padata->len = 0;
 805         a->padata->val = NULL;
 806
 807         /* make a v5 salted pa-data */
 808         add_padata(context, a->padata, creds->client,
 809                    key_proc, keyseed, a->req_body.etype.val,
 810                    a->req_body.etype.len, NULL);
 811
 812         /* make a v4 salted pa-data */
 813         salt.salttype = KRB5_PW_SALT;
 814         krb5_data_zero(&salt.saltvalue);
 815         add_padata(context, a->padata, creds->client,
 816                    key_proc, keyseed, a->req_body.etype.val,
 817                    a->req_body.etype.len, &salt);
 818     } else {
 819         ret = KRB5_PREAUTH_BAD_TYPE;
 820         krb5_set_error_message (context, ret, "pre-auth type %d not supported",
 821                                *ptypes);
 822         goto fail;
 823     }
 824     return 0;
 825 fail:
 826     free_AS_REQ(a);
 827     return ret;
 828 }
 829
 830 static int
 831 set_ptypes(krb5_context context,
 832            KRB_ERROR *error,
 833            const krb5_preauthtype **ptypes,
 834            krb5_preauthdata **preauth)
 835 {
 836     static krb5_preauthdata preauth2;
 837     static krb5_preauthtype ptypes2[] = { KRB5_PADATA_ENC_TIMESTAMP, KRB5_PADATA_NONE };
 838
 839     if(error->e_data) {
 840         METHOD_DATA md;
 841         int i;
 842         decode_METHOD_DATA(error->e_data->data,
 843                            error->e_data->length,
 844                            &md,
 845                            NULL);
 846         for(i = 0; i < md.len; i++){
 847             switch(md.val[i].padata_type){
 848             case KRB5_PADATA_ENC_TIMESTAMP:
 849                 *ptypes = ptypes2;
 850                 break;
 851             case KRB5_PADATA_ETYPE_INFO:
 852                 *preauth = &preauth2;
 853                 ALLOC_SEQ(*preauth, 1);
 854                 (*preauth)->val[0].type = KRB5_PADATA_ENC_TIMESTAMP;
 855                 krb5_decode_ETYPE_INFO(context,
 856                                        md.val[i].padata_value.data,
 857                                        md.val[i].padata_value.length,
 858                                        &(*preauth)->val[0].info,
 859                                        NULL);
 860                 break;
 861             default:
 862                 break;
 863             }
 864         }
 865         free_METHOD_DATA(&md);
 866     } else {
 867         *ptypes = ptypes2;
 868     }
 869     return(1);
 870 }
 871
 872 krb5_error_code KRB5_LIB_FUNCTION
 873 krb5_get_in_cred(krb5_context context,
 874                  krb5_flags options,
 875                  const krb5_addresses *addrs,
 876                  const krb5_enctype *etypes,
 877                  const krb5_preauthtype *ptypes,
 878                  const krb5_preauthdata *preauth,
 879                  krb5_key_proc key_proc,
 880                  krb5_const_pointer keyseed,
 881                  krb5_decrypt_proc decrypt_proc,
 882                  krb5_const_pointer decryptarg,
 883                  krb5_creds *creds,
 884                  krb5_kdc_rep *ret_as_reply)
 885 {
 886     krb5_error_code ret;
 887     AS_REQ a;
 888     krb5_kdc_rep rep;
 889     krb5_data req, resp;
 890     size_t len;
 891     krb5_salt salt;
 892     krb5_keyblock *key;
 893     size_t size;
 894     KDCOptions opts;
 895     PA_DATA *pa;
 896     krb5_enctype etype;
 897     krb5_preauthdata *my_preauth = NULL;
 898     unsigned nonce;
 899     int done;
 900
 901     opts = int2KDCOptions(options);
 902
 903     krb5_generate_random_block (&nonce, sizeof(nonce));
 904     nonce &= 0xffffffff;
 905
 906     do {
 907         done = 1;
 908         ret = init_as_req (context,
 909                            opts,
 910                            creds,
 911                            addrs,
 912                            etypes,
 913                            ptypes,
 914                            preauth,
 915                            key_proc,
 916                            keyseed,
 917                            nonce,
 918                            &a);
 919         if (my_preauth) {
 920             free_ETYPE_INFO(&my_preauth->val[0].info);
 921             free (my_preauth->val);
 922             my_preauth = NULL;
 923         }
 924         if (ret)
 925             return ret;
 926
 927         ASN1_MALLOC_ENCODE(AS_REQ, req.data, req.length, &a, &len, ret);
 928         free_AS_REQ(&a);
 929         if (ret)
 930             return ret;
 931         if(len != req.length)
 932             krb5_abortx(context, "internal error in ASN.1 encoder");
 933
 934         ret = krb5_sendto_kdc (context, &req, &creds->client->realm, &resp);
 935         krb5_data_free(&req);
 936         if (ret)
 937             return ret;
 938
 939         memset (&rep, 0, sizeof(rep));
 940         ret = decode_AS_REP(resp.data, resp.length, &rep.kdc_rep, &size);
 941         if(ret) {
 942             /* let's try to parse it as a KRB-ERROR */
 943             KRB_ERROR error;
 944             int ret2;
 945
 946             ret2 = krb5_rd_error(context, &resp, &error);
 947             if(ret2 && resp.data && ((char*)resp.data)[0] == 4)
 948                 ret = KRB5KRB_AP_ERR_V4_REPLY;
 949             krb5_data_free(&resp);
 950             if (ret2 == 0) {
 951                 ret = krb5_error_from_rd_error(context, &error, creds);
 952                 /* if no preauth was set and KDC requires it, give it
 953                    one more try */
 954                 if (!ptypes && !preauth
 955                     && ret == KRB5KDC_ERR_PREAUTH_REQUIRED
 956 #if 0
 957                         || ret == KRB5KDC_ERR_BADOPTION
 958 #endif
 959                     && set_ptypes(context, &error, &ptypes, &my_preauth)) {
 960                     done = 0;
 961                     preauth = my_preauth;
 962                     krb5_free_error_contents(context, &error);
 963                     krb5_clear_error_string(context);
 964                     continue;
 965                 }
 966                 if(ret_as_reply)
 967                     ret_as_reply->error = error;
 968                 else
 969                     free_KRB_ERROR (&error);
 970                 return ret;
 971             }
 972             return ret;
 973         }
 974         krb5_data_free(&resp);
 975     } while(!done);
 976
 977     pa = NULL;
 978     etype = rep.kdc_rep.enc_part.etype;
 979     if(rep.kdc_rep.padata){
 980         int i = 0;
 981         pa = krb5_find_padata(rep.kdc_rep.padata->val, rep.kdc_rep.padata->len,
 982                               KRB5_PADATA_PW_SALT, &i);
 983         if(pa == NULL) {
 984             i = 0;
 985             pa = krb5_find_padata(rep.kdc_rep.padata->val,
 986                                   rep.kdc_rep.padata->len,
 987                                   KRB5_PADATA_AFS3_SALT, &i);
 988         }
 989     }
 990     if(pa) {
 991         salt.salttype = pa->padata_type;
 992         salt.saltvalue = pa->padata_value;
 993
 994         ret = (*key_proc)(context, etype, salt, keyseed, &key);
 995     } else {
 996         /* make a v5 salted pa-data */
 997         ret = krb5_get_pw_salt (context, creds->client, &salt);
 998
 999         if (ret)
1000             goto out;
1001         ret = (*key_proc)(context, etype, salt, keyseed, &key);
1002         krb5_free_salt(context, salt);
1003     }
1004     if (ret)
1005         goto out;
1006
1007     {
1008         unsigned flags = 0;
1009         if (opts.request_anonymous)
1010             flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
1011
1012         ret = _krb5_extract_ticket(context,
1013                                    &rep,
1014                                    creds,
1015                                    key,
1016                                    keyseed,
1017                                    KRB5_KU_AS_REP_ENC_PART,
1018                                    NULL,
1019                                    nonce,
1020                                    flags,
1021                                    decrypt_proc,
1022                                    decryptarg);
1023     }
1024     memset (key->keyvalue.data, 0, key->keyvalue.length);
1025     krb5_free_keyblock_contents (context, key);
1026     free (key);
1027
1028 out:
1029     if (ret == 0 && ret_as_reply)
1030         *ret_as_reply = rep;
1031     else
1032         krb5_free_kdc_rep (context, &rep);
1033     return ret;
1034 }
1035
1036 krb5_error_code KRB5_LIB_FUNCTION
1037 krb5_get_in_tkt(krb5_context context,
1038                 krb5_flags options,
1039                 const krb5_addresses *addrs,
1040                 const krb5_enctype *etypes,
1041                 const krb5_preauthtype *ptypes,
1042                 krb5_key_proc key_proc,
1043                 krb5_const_pointer keyseed,
1044                 krb5_decrypt_proc decrypt_proc,
1045                 krb5_const_pointer decryptarg,
1046                 krb5_creds *creds,
1047                 krb5_ccache ccache,
1048                 krb5_kdc_rep *ret_as_reply)
1049 {
1050     krb5_error_code ret;
1051
1052     ret = krb5_get_in_cred (context,
1053                             options,
1054                             addrs,
1055                             etypes,
1056                             ptypes,
1057                             NULL,
1058                             key_proc,
1059                             keyseed,
1060                             decrypt_proc,
1061                             decryptarg,
1062                             creds,
1063                             ret_as_reply);
1064     if(ret)
1065         return ret;
1066     if (ccache)
1067         ret = krb5_cc_store_cred (context, ccache, creds);
1068     return ret;
1069 }