source4/heimdal/lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "krb5_locl.h"
  37 #include <assert.h>
  38
  39 static krb5_error_code
  40 get_cred_kdc_capath(krb5_context, krb5_kdc_flags,
  41                     krb5_ccache, krb5_creds *, krb5_principal,
  42                     Ticket *, krb5_creds **, krb5_creds ***);
  43
  44 /*
  45  * Take the `body' and encode it into `padata' using the credentials
  46  * in `creds'.
  47  */
  48
  49 static krb5_error_code
  50 make_pa_tgs_req(krb5_context context,
  51                 krb5_auth_context ac,
  52                 KDC_REQ_BODY *body,
  53                 PA_DATA *padata,
  54                 krb5_creds *creds)
  55 {
  56     u_char *buf;
  57     size_t buf_size;
  58     size_t len = 0;
  59     krb5_data in_data;
  60     krb5_error_code ret;
  61
  62     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  63     if (ret)
  64         goto out;
  65     if(buf_size != len)
  66         krb5_abortx(context, "internal error in ASN.1 encoder");
  67
  68     in_data.length = len;
  69     in_data.data   = buf;
  70     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  71                                 &padata->padata_value,
  72                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  73                                 KRB5_KU_TGS_REQ_AUTH);
  74  out:
  75     free (buf);
  76     if(ret)
  77         return ret;
  78     padata->padata_type = KRB5_PADATA_TGS_REQ;
  79     return 0;
  80 }
  81
  82 /*
  83  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  84  */
  85
  86 static krb5_error_code
  87 set_auth_data (krb5_context context,
  88                KDC_REQ_BODY *req_body,
  89                krb5_authdata *authdata,
  90                krb5_keyblock *subkey)
  91 {
  92     if(authdata->len) {
  93         size_t len = 0, buf_size;
  94         unsigned char *buf;
  95         krb5_crypto crypto;
  96         krb5_error_code ret;
  97
  98         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  99                            &len, ret);
 100         if (ret)
 101             return ret;
 102         if (buf_size != len)
 103             krb5_abortx(context, "internal error in ASN.1 encoder");
 104
 105         ALLOC(req_body->enc_authorization_data, 1);
 106         if (req_body->enc_authorization_data == NULL) {
 107             free (buf);
 108             krb5_set_error_message(context, ENOMEM,
 109                                    N_("malloc: out of memory", ""));
 110             return ENOMEM;
 111         }
 112         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 113         if (ret) {
 114             free (buf);
 115             free (req_body->enc_authorization_data);
 116             req_body->enc_authorization_data = NULL;
 117             return ret;
 118         }
 119         krb5_encrypt_EncryptedData(context,
 120                                    crypto,
 121                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 122                                    buf,
 123                                    len,
 124                                    0,
 125                                    req_body->enc_authorization_data);
 126         free (buf);
 127         krb5_crypto_destroy(context, crypto);
 128     } else {
 129         req_body->enc_authorization_data = NULL;
 130     }
 131     return 0;
 132 }
 133
 134 /*
 135  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 136  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 137  * subkey in `subkey'.
 138  */
 139
 140 static krb5_error_code
 141 init_tgs_req (krb5_context context,
 142               krb5_ccache ccache,
 143               krb5_addresses *addresses,
 144               krb5_kdc_flags flags,
 145               Ticket *second_ticket,
 146               krb5_creds *in_creds,
 147               krb5_creds *krbtgt,
 148               unsigned nonce,
 149               const METHOD_DATA *padata,
 150               krb5_keyblock **subkey,
 151               TGS_REQ *t)
 152 {
 153     krb5_auth_context ac = NULL;
 154     krb5_error_code ret = 0;
 155
 156     memset(t, 0, sizeof(*t));
 157     t->pvno = 5;
 158     t->msg_type = krb_tgs_req;
 159     if (in_creds->session.keytype) {
 160         ALLOC_SEQ(&t->req_body.etype, 1);
 161         if(t->req_body.etype.val == NULL) {
 162             ret = ENOMEM;
 163             krb5_set_error_message(context, ret,
 164                                    N_("malloc: out of memory", ""));
 165             goto fail;
 166         }
 167         t->req_body.etype.val[0] = in_creds->session.keytype;
 168     } else {
 169         ret = _krb5_init_etype(context,
 170                                KRB5_PDU_TGS_REQUEST,
 171                                &t->req_body.etype.len,
 172                                &t->req_body.etype.val,
 173                                NULL);
 174     }
 175     if (ret)
 176         goto fail;
 177     t->req_body.addresses = addresses;
 178     t->req_body.kdc_options = flags.b;
 179     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 180     if (ret)
 181         goto fail;
 182     ALLOC(t->req_body.sname, 1);
 183     if (t->req_body.sname == NULL) {
 184         ret = ENOMEM;
 185         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 186         goto fail;
 187     }
 188
 189     /* some versions of some code might require that the client be
 190        present in TGS-REQs, but this is clearly against the spec */
 191
 192     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 193     if (ret)
 194         goto fail;
 195
 196     /* req_body.till should be NULL if there is no endtime specified,
 197        but old MIT code (like DCE secd) doesn't like that */
 198     ALLOC(t->req_body.till, 1);
 199     if(t->req_body.till == NULL){
 200         ret = ENOMEM;
 201         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 202         goto fail;
 203     }
 204     *t->req_body.till = in_creds->times.endtime;
 205
 206     t->req_body.nonce = nonce;
 207     if(second_ticket){
 208         ALLOC(t->req_body.additional_tickets, 1);
 209         if (t->req_body.additional_tickets == NULL) {
 210             ret = ENOMEM;
 211             krb5_set_error_message(context, ret,
 212                                    N_("malloc: out of memory", ""));
 213             goto fail;
 214         }
 215         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 216         if (t->req_body.additional_tickets->val == NULL) {
 217             ret = ENOMEM;
 218             krb5_set_error_message(context, ret,
 219                                    N_("malloc: out of memory", ""));
 220             goto fail;
 221         }
 222         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 223         if (ret)
 224             goto fail;
 225     }
 226     ALLOC(t->padata, 1);
 227     if (t->padata == NULL) {
 228         ret = ENOMEM;
 229         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 230         goto fail;
 231     }
 232     ALLOC_SEQ(t->padata, 1 + padata->len);
 233     if (t->padata->val == NULL) {
 234         ret = ENOMEM;
 235         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 236         goto fail;
 237     }
 238     {
 239         size_t i;
 240         for (i = 0; i < padata->len; i++) {
 241             ret = copy_PA_DATA(&padata->val[i], &t->padata->val[i + 1]);
 242             if (ret) {
 243                 krb5_set_error_message(context, ret,
 244                                        N_("malloc: out of memory", ""));
 245                 goto fail;
 246             }
 247         }
 248     }
 249
 250     ret = krb5_auth_con_init(context, &ac);
 251     if(ret)
 252         goto fail;
 253
 254     ret = krb5_auth_con_generatelocalsubkey(context, ac, &krbtgt->session);
 255     if (ret)
 256         goto fail;
 257
 258     ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 259                          ac->local_subkey);
 260     if (ret)
 261         goto fail;
 262
 263     ret = make_pa_tgs_req(context,
 264                           ac,
 265                           &t->req_body,
 266                           &t->padata->val[0],
 267                           krbtgt);
 268     if(ret)
 269         goto fail;
 270
 271     ret = krb5_auth_con_getlocalsubkey(context, ac, subkey);
 272     if (ret)
 273         goto fail;
 274
 275 fail:
 276     if (ac)
 277         krb5_auth_con_free(context, ac);
 278     if (ret) {
 279         t->req_body.addresses = NULL;
 280         free_TGS_REQ (t);
 281     }
 282     return ret;
 283 }
 284
 285 krb5_error_code
 286 _krb5_get_krbtgt(krb5_context context,
 287                  krb5_ccache  id,
 288                  krb5_realm realm,
 289                  krb5_creds **cred)
 290 {
 291     krb5_error_code ret;
 292     krb5_creds tmp_cred;
 293
 294     memset(&tmp_cred, 0, sizeof(tmp_cred));
 295
 296     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 297     if (ret)
 298         return ret;
 299
 300     ret = krb5_make_principal(context,
 301                               &tmp_cred.server,
 302                               realm,
 303                               KRB5_TGS_NAME,
 304                               realm,
 305                               NULL);
 306     if(ret) {
 307         krb5_free_principal(context, tmp_cred.client);
 308         return ret;
 309     }
 310     ret = krb5_get_credentials(context,
 311                                KRB5_GC_CACHED,
 312                                id,
 313                                &tmp_cred,
 314                                cred);
 315     krb5_free_principal(context, tmp_cred.client);
 316     krb5_free_principal(context, tmp_cred.server);
 317     if(ret)
 318         return ret;
 319     return 0;
 320 }
 321
 322 /* DCE compatible decrypt proc */
 323 static krb5_error_code KRB5_CALLCONV
 324 decrypt_tkt_with_subkey (krb5_context context,
 325                          krb5_keyblock *key,
 326                          krb5_key_usage usage,
 327                          krb5_const_pointer skey,
 328                          krb5_kdc_rep *dec_rep)
 329 {
 330     const krb5_keyblock *subkey = skey;
 331     krb5_error_code ret = 0;
 332     krb5_data data;
 333     size_t size;
 334     krb5_crypto crypto;
 335
 336     assert(usage == 0);
 337
 338     krb5_data_zero(&data);
 339
 340     /*
 341      * start out with trying with subkey if we have one
 342      */
 343     if (subkey) {
 344         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 345         if (ret)
 346             return ret;
 347         ret = krb5_decrypt_EncryptedData (context,
 348                                           crypto,
 349                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 350                                           &dec_rep->kdc_rep.enc_part,
 351                                           &data);
 352         /*
 353          * If the is Windows 2000 DC, we need to retry with key usage
 354          * 8 when doing ARCFOUR.
 355          */
 356         if (ret && subkey->keytype == ETYPE_ARCFOUR_HMAC_MD5) {
 357             ret = krb5_decrypt_EncryptedData(context,
 358                                              crypto,
 359                                              8,
 360                                              &dec_rep->kdc_rep.enc_part,
 361                                              &data);
 362         }
 363         krb5_crypto_destroy(context, crypto);
 364     }
 365     if (subkey == NULL || ret) {
 366         ret = krb5_crypto_init(context, key, 0, &crypto);
 367         if (ret)
 368             return ret;
 369         ret = krb5_decrypt_EncryptedData (context,
 370                                           crypto,
 371                                           KRB5_KU_TGS_REP_ENC_PART_SESSION,
 372                                           &dec_rep->kdc_rep.enc_part,
 373                                           &data);
 374         krb5_crypto_destroy(context, crypto);
 375     }
 376     if (ret)
 377         return ret;
 378
 379     ret = decode_EncASRepPart(data.data,
 380                               data.length,
 381                               &dec_rep->enc_part,
 382                               &size);
 383     if (ret)
 384         ret = decode_EncTGSRepPart(data.data,
 385                                    data.length,
 386                                    &dec_rep->enc_part,
 387                                    &size);
 388     if (ret)
 389       krb5_set_error_message(context, ret,
 390                              N_("Failed to decode encpart in ticket", ""));
 391     krb5_data_free (&data);
 392     return ret;
 393 }
 394
 395 static krb5_error_code
 396 get_cred_kdc(krb5_context context,
 397              krb5_ccache id,
 398              krb5_kdc_flags flags,
 399              krb5_addresses *addresses,
 400              krb5_creds *in_creds,
 401              krb5_creds *krbtgt,
 402              krb5_principal impersonate_principal,
 403              Ticket *second_ticket,
 404              krb5_creds *out_creds)
 405 {
 406     TGS_REQ req;
 407     krb5_data enc;
 408     krb5_data resp;
 409     krb5_kdc_rep rep;
 410     KRB_ERROR error;
 411     krb5_error_code ret;
 412     unsigned nonce;
 413     krb5_keyblock *subkey = NULL;
 414     size_t len = 0;
 415     Ticket second_ticket_data;
 416     METHOD_DATA padata;
 417
 418     krb5_data_zero(&resp);
 419     krb5_data_zero(&enc);
 420     padata.val = NULL;
 421     padata.len = 0;
 422
 423     krb5_generate_random_block(&nonce, sizeof(nonce));
 424     nonce &= 0xffffffff;
 425
 426     if(flags.b.enc_tkt_in_skey && second_ticket == NULL){
 427         ret = decode_Ticket(in_creds->second_ticket.data,
 428                             in_creds->second_ticket.length,
 429                             &second_ticket_data, &len);
 430         if(ret)
 431             return ret;
 432         second_ticket = &second_ticket_data;
 433     }
 434
 435
 436     if (impersonate_principal) {
 437         krb5_crypto crypto;
 438         PA_S4U2Self self;
 439         krb5_data data;
 440         void *buf;
 441         size_t size = 0;
 442
 443         self.name = impersonate_principal->name;
 444         self.realm = impersonate_principal->realm;
 445         self.auth = estrdup("Kerberos");
 446
 447         ret = _krb5_s4u2self_to_checksumdata(context, &self, &data);
 448         if (ret) {
 449             free(self.auth);
 450             goto out;
 451         }
 452
 453         ret = krb5_crypto_init(context, &krbtgt->session, 0, &crypto);
 454         if (ret) {
 455             free(self.auth);
 456             krb5_data_free(&data);
 457             goto out;
 458         }
 459
 460         ret = krb5_create_checksum(context,
 461                                    crypto,
 462                                    KRB5_KU_OTHER_CKSUM,
 463                                    0,
 464                                    data.data,
 465                                    data.length,
 466                                    &self.cksum);
 467         krb5_crypto_destroy(context, crypto);
 468         krb5_data_free(&data);
 469         if (ret) {
 470             free(self.auth);
 471             goto out;
 472         }
 473
 474         ASN1_MALLOC_ENCODE(PA_S4U2Self, buf, len, &self, &size, ret);
 475         free(self.auth);
 476         free_Checksum(&self.cksum);
 477         if (ret)
 478             goto out;
 479         if (len != size)
 480             krb5_abortx(context, "internal asn1 error");
 481
 482         ret = krb5_padata_add(context, &padata, KRB5_PADATA_FOR_USER, buf, len);
 483         if (ret)
 484             goto out;
 485     }
 486
 487     ret = init_tgs_req (context,
 488                         id,
 489                         addresses,
 490                         flags,
 491                         second_ticket,
 492                         in_creds,
 493                         krbtgt,
 494                         nonce,
 495                         &padata,
 496                         &subkey,
 497                         &req);
 498     if (ret)
 499         goto out;
 500
 501     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 502     if (ret)
 503         goto out;
 504     if(enc.length != len)
 505         krb5_abortx(context, "internal error in ASN.1 encoder");
 506
 507     /* don't free addresses */
 508     req.req_body.addresses = NULL;
 509     free_TGS_REQ(&req);
 510
 511     /*
 512      * Send and receive
 513      */
 514     {
 515         krb5_sendto_ctx stctx;
 516         ret = krb5_sendto_ctx_alloc(context, &stctx);
 517         if (ret)
 518             return ret;
 519         krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
 520
 521         ret = krb5_sendto_context (context, stctx, &enc,
 522                                    krbtgt->server->name.name_string.val[1],
 523                                    &resp);
 524         krb5_sendto_ctx_free(context, stctx);
 525     }
 526     if(ret)
 527         goto out;
 528
 529     memset(&rep, 0, sizeof(rep));
 530     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
 531         unsigned eflags = 0;
 532
 533         ret = krb5_copy_principal(context,
 534                                   in_creds->client,
 535                                   &out_creds->client);
 536         if(ret)
 537             goto out2;
 538         ret = krb5_copy_principal(context,
 539                                   in_creds->server,
 540                                   &out_creds->server);
 541         if(ret)
 542             goto out2;
 543         /* this should go someplace else */
 544         out_creds->times.endtime = in_creds->times.endtime;
 545
 546         /*
 547          * Windows KDCs always canonicalize the server name
 548          */
 549         eflags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
 550
 551         /* XXX should do better testing */
 552         if (flags.b.constrained_delegation || impersonate_principal)
 553             eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 554
 555         ret = _krb5_extract_ticket(context,
 556                                    &rep,
 557                                    out_creds,
 558                                    &krbtgt->session,
 559                                    NULL,
 560                                    0,
 561                                    &krbtgt->addresses,
 562                                    nonce,
 563                                    eflags,
 564                                    decrypt_tkt_with_subkey,
 565                                    subkey);
 566     out2:
 567         krb5_free_kdc_rep(context, &rep);
 568     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 569         ret = krb5_error_from_rd_error(context, &error, in_creds);
 570         krb5_free_error_contents(context, &error);
 571     } else if(resp.length > 0 && ((char*)resp.data)[0] == 4) {
 572         ret = KRB5KRB_AP_ERR_V4_REPLY;
 573         krb5_clear_error_message(context);
 574     } else {
 575         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 576         krb5_clear_error_message(context);
 577     }
 578
 579 out:
 580     if (second_ticket == &second_ticket_data)
 581         free_Ticket(&second_ticket_data);
 582     free_METHOD_DATA(&padata);
 583     krb5_data_free(&resp);
 584     krb5_data_free(&enc);
 585     if(subkey)
 586         krb5_free_keyblock(context, subkey);
 587     return ret;
 588
 589 }
 590
 591 /*
 592  * same as above, just get local addresses first if the krbtgt have
 593  * them and the realm is not addressless
 594  */
 595
 596 static krb5_error_code
 597 get_cred_kdc_address(krb5_context context,
 598                      krb5_ccache id,
 599                      krb5_kdc_flags flags,
 600                      krb5_addresses *addrs,
 601                      krb5_creds *in_creds,
 602                      krb5_creds *krbtgt,
 603                      krb5_principal impersonate_principal,
 604                      Ticket *second_ticket,
 605                      krb5_creds *out_creds)
 606 {
 607     krb5_error_code ret;
 608     krb5_addresses addresses = { 0, NULL };
 609
 610     /*
 611      * Inherit the address-ness of the krbtgt if the address is not
 612      * specified.
 613      */
 614
 615     if (addrs == NULL && krbtgt->addresses.len != 0) {
 616         krb5_boolean noaddr;
 617
 618         krb5_appdefault_boolean(context, NULL, krbtgt->server->realm,
 619                                 "no-addresses", FALSE, &noaddr);
 620
 621         if (!noaddr) {
 622             krb5_get_all_client_addrs(context, &addresses);
 623             /* XXX this sucks. */
 624             addrs = &addresses;
 625             if(addresses.len == 0)
 626                 addrs = NULL;
 627         }
 628     }
 629     ret = get_cred_kdc(context, id, flags, addrs, in_creds,
 630                        krbtgt, impersonate_principal,
 631                        second_ticket, out_creds);
 632     krb5_free_addresses(context, &addresses);
 633     return ret;
 634 }
 635
 636 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 637 krb5_get_kdc_cred(krb5_context context,
 638                   krb5_ccache id,
 639                   krb5_kdc_flags flags,
 640                   krb5_addresses *addresses,
 641                   Ticket  *second_ticket,
 642                   krb5_creds *in_creds,
 643                   krb5_creds **out_creds
 644                   )
 645 {
 646     krb5_error_code ret;
 647     krb5_creds *krbtgt;
 648
 649     *out_creds = calloc(1, sizeof(**out_creds));
 650     if(*out_creds == NULL) {
 651         krb5_set_error_message(context, ENOMEM,
 652                                N_("malloc: out of memory", ""));
 653         return ENOMEM;
 654     }
 655     ret = _krb5_get_krbtgt (context,
 656                             id,
 657                             in_creds->server->realm,
 658                             &krbtgt);
 659     if(ret) {
 660         free(*out_creds);
 661         *out_creds = NULL;
 662         return ret;
 663     }
 664     ret = get_cred_kdc(context, id, flags, addresses,
 665                        in_creds, krbtgt, NULL, NULL, *out_creds);
 666     krb5_free_creds (context, krbtgt);
 667     if(ret) {
 668         free(*out_creds);
 669         *out_creds = NULL;
 670     }
 671     return ret;
 672 }
 673
 674 static int
 675 not_found(krb5_context context, krb5_const_principal p, krb5_error_code code)
 676 {
 677     krb5_error_code ret;
 678     char *str;
 679
 680     ret = krb5_unparse_name(context, p, &str);
 681     if(ret) {
 682         krb5_clear_error_message(context);
 683         return code;
 684     }
 685     krb5_set_error_message(context, code,
 686                            N_("Matching credential (%s) not found", ""), str);
 687     free(str);
 688     return code;
 689 }
 690
 691 static krb5_error_code
 692 find_cred(krb5_context context,
 693           krb5_ccache id,
 694           krb5_principal server,
 695           krb5_creds **tgts,
 696           krb5_creds *out_creds)
 697 {
 698     krb5_error_code ret;
 699     krb5_creds mcreds;
 700
 701     krb5_cc_clear_mcred(&mcreds);
 702     mcreds.server = server;
 703     ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
 704                                 &mcreds, out_creds);
 705     if(ret == 0)
 706         return 0;
 707     while(tgts && *tgts){
 708         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 709                               &mcreds, *tgts)){
 710             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 711             return ret;
 712         }
 713         tgts++;
 714     }
 715     return not_found(context, server, KRB5_CC_NOTFOUND);
 716 }
 717
 718 static krb5_error_code
 719 add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 720 {
 721     int i;
 722     krb5_error_code ret;
 723     krb5_creds **tmp = *tgts;
 724
 725     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 726     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 727     if(tmp == NULL) {
 728         krb5_set_error_message(context, ENOMEM,
 729                                N_("malloc: out of memory", ""));
 730         return ENOMEM;
 731     }
 732     *tgts = tmp;
 733     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 734     tmp[i+1] = NULL;
 735     return ret;
 736 }
 737
 738 static krb5_error_code
 739 get_cred_kdc_capath_worker(krb5_context context,
 740                            krb5_kdc_flags flags,
 741                            krb5_ccache ccache,
 742                            krb5_creds *in_creds,
 743                            krb5_const_realm try_realm,
 744                            krb5_principal impersonate_principal,
 745                            Ticket *second_ticket,
 746                            krb5_creds **out_creds,
 747                            krb5_creds ***ret_tgts)
 748 {
 749     krb5_error_code ret;
 750     krb5_creds *tgt, tmp_creds;
 751     krb5_const_realm client_realm, server_realm;
 752     int ok_as_delegate = 1;
 753
 754     *out_creds = NULL;
 755
 756     client_realm = krb5_principal_get_realm(context, in_creds->client);
 757     server_realm = krb5_principal_get_realm(context, in_creds->server);
 758     memset(&tmp_creds, 0, sizeof(tmp_creds));
 759     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 760     if(ret)
 761         return ret;
 762
 763     ret = krb5_make_principal(context,
 764                               &tmp_creds.server,
 765                               try_realm,
 766                               KRB5_TGS_NAME,
 767                               server_realm,
 768                               NULL);
 769     if(ret){
 770         krb5_free_principal(context, tmp_creds.client);
 771         return ret;
 772     }
 773     {
 774         krb5_creds tgts;
 775
 776         ret = find_cred(context, ccache, tmp_creds.server,
 777                         *ret_tgts, &tgts);
 778         if(ret == 0){
 779             /* only allow implicit ok_as_delegate if the realm is the clients realm */
 780             if (strcmp(try_realm, client_realm) != 0 || strcmp(try_realm, server_realm) != 0)
 781                 ok_as_delegate = tgts.flags.b.ok_as_delegate;
 782
 783             *out_creds = calloc(1, sizeof(**out_creds));
 784             if(*out_creds == NULL) {
 785                 ret = ENOMEM;
 786                 krb5_set_error_message(context, ret,
 787                                        N_("malloc: out of memory", ""));
 788             } else {
 789                 ret = get_cred_kdc_address(context, ccache, flags, NULL,
 790                                            in_creds, &tgts,
 791                                            impersonate_principal,
 792                                            second_ticket,
 793                                            *out_creds);
 794                 if (ret) {
 795                     free (*out_creds);
 796                     *out_creds = NULL;
 797                 } else if (ok_as_delegate == 0)
 798                     (*out_creds)->flags.b.ok_as_delegate = 0;
 799             }
 800             krb5_free_cred_contents(context, &tgts);
 801             krb5_free_principal(context, tmp_creds.server);
 802             krb5_free_principal(context, tmp_creds.client);
 803             return ret;
 804         }
 805     }
 806     if(krb5_realm_compare(context, in_creds->client, in_creds->server))
 807         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 808
 809     /* XXX this can loop forever */
 810     while(1){
 811         heim_general_string tgt_inst;
 812
 813         ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 814                                   NULL, NULL, &tgt, ret_tgts);
 815         if(ret) {
 816             krb5_free_principal(context, tmp_creds.server);
 817             krb5_free_principal(context, tmp_creds.client);
 818             return ret;
 819         }
 820         /*
 821          * if either of the chain or the ok_as_delegate was stripped
 822          * by the kdc, make sure we strip it too.
 823          */
 824         if (ok_as_delegate == 0 || tgt->flags.b.ok_as_delegate == 0) {
 825             ok_as_delegate = 0;
 826             tgt->flags.b.ok_as_delegate = 0;
 827         }
 828
 829         ret = add_cred(context, tgt, ret_tgts);
 830         if(ret) {
 831             krb5_free_principal(context, tmp_creds.server);
 832             krb5_free_principal(context, tmp_creds.client);
 833             return ret;
 834         }
 835         tgt_inst = tgt->server->name.name_string.val[1];
 836         if(strcmp(tgt_inst, server_realm) == 0)
 837             break;
 838         krb5_free_principal(context, tmp_creds.server);
 839         ret = krb5_make_principal(context, &tmp_creds.server,
 840                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 841         if(ret) {
 842             krb5_free_principal(context, tmp_creds.server);
 843             krb5_free_principal(context, tmp_creds.client);
 844             return ret;
 845         }
 846         ret = krb5_free_creds(context, tgt);
 847         if(ret) {
 848             krb5_free_principal(context, tmp_creds.server);
 849             krb5_free_principal(context, tmp_creds.client);
 850             return ret;
 851         }
 852     }
 853
 854     krb5_free_principal(context, tmp_creds.server);
 855     krb5_free_principal(context, tmp_creds.client);
 856     *out_creds = calloc(1, sizeof(**out_creds));
 857     if(*out_creds == NULL) {
 858         ret = ENOMEM;
 859         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 860     } else {
 861         ret = get_cred_kdc_address (context, ccache, flags, NULL,
 862                                     in_creds, tgt, impersonate_principal,
 863                                     second_ticket, *out_creds);
 864         if (ret) {
 865             free (*out_creds);
 866             *out_creds = NULL;
 867         }
 868     }
 869     krb5_free_creds(context, tgt);
 870     return ret;
 871 }
 872
 873 /*
 874 get_cred(server)
 875         creds = cc_get_cred(server)
 876         if(creds) return creds
 877         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 878         if(tgt)
 879                 return get_cred_tgt(server, tgt)
 880         if(client_realm == server_realm)
 881                 return NULL
 882         tgt = get_cred(krbtgt/server_realm@client_realm)
 883         while(tgt_inst != server_realm)
 884                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 885         return get_cred_tgt(server, tgt)
 886         */
 887
 888 static krb5_error_code
 889 get_cred_kdc_capath(krb5_context context,
 890                     krb5_kdc_flags flags,
 891                     krb5_ccache ccache,
 892                     krb5_creds *in_creds,
 893                     krb5_principal impersonate_principal,
 894                     Ticket *second_ticket,
 895                     krb5_creds **out_creds,
 896                     krb5_creds ***ret_tgts)
 897 {
 898     krb5_error_code ret;
 899     krb5_const_realm client_realm, server_realm, try_realm;
 900
 901     client_realm = krb5_principal_get_realm(context, in_creds->client);
 902     server_realm = krb5_principal_get_realm(context, in_creds->server);
 903
 904     try_realm = client_realm;
 905     ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds, try_realm,
 906                                      impersonate_principal, second_ticket, out_creds,
 907                                      ret_tgts);
 908
 909     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
 910         try_realm = krb5_config_get_string(context, NULL, "capaths",
 911                                            client_realm, server_realm, NULL);
 912
 913         if (try_realm != NULL && strcmp(try_realm, client_realm)) {
 914             ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds,
 915                                              try_realm, impersonate_principal,
 916                                              second_ticket, out_creds, ret_tgts);
 917         }
 918     }
 919
 920     return ret;
 921 }
 922
 923 static krb5_error_code
 924 get_cred_kdc_referral(krb5_context context,
 925                       krb5_kdc_flags flags,
 926                       krb5_ccache ccache,
 927                       krb5_creds *in_creds,
 928                       krb5_principal impersonate_principal,
 929                       Ticket *second_ticket,
 930                       krb5_creds **out_creds,
 931                       krb5_creds ***ret_tgts)
 932 {
 933     krb5_const_realm client_realm;
 934     krb5_error_code ret;
 935     krb5_creds tgt, referral, ticket;
 936     int loop = 0;
 937     int ok_as_delegate = 1;
 938
 939     if (in_creds->server->name.name_string.len < 2 && !flags.b.canonicalize) {
 940         krb5_set_error_message(context, KRB5KDC_ERR_PATH_NOT_ACCEPTED,
 941                                N_("Name too short to do referals, skipping", ""));
 942         return KRB5KDC_ERR_PATH_NOT_ACCEPTED;
 943     }
 944
 945     memset(&tgt, 0, sizeof(tgt));
 946     memset(&ticket, 0, sizeof(ticket));
 947
 948     flags.b.canonicalize = 1;
 949
 950     *out_creds = NULL;
 951
 952     client_realm = krb5_principal_get_realm(context, in_creds->client);
 953
 954     /* find tgt for the clients base realm */
 955     {
 956         krb5_principal tgtname;
 957
 958         ret = krb5_make_principal(context, &tgtname,
 959                                   client_realm,
 960                                   KRB5_TGS_NAME,
 961                                   client_realm,
 962                                   NULL);
 963         if(ret)
 964             return ret;
 965
 966         ret = find_cred(context, ccache, tgtname, *ret_tgts, &tgt);
 967         krb5_free_principal(context, tgtname);
 968         if (ret)
 969             return ret;
 970     }
 971
 972     referral = *in_creds;
 973     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
 974     if (ret) {
 975         krb5_free_cred_contents(context, &tgt);
 976         return ret;
 977     }
 978     ret = krb5_principal_set_realm(context, referral.server, client_realm);
 979     if (ret) {
 980         krb5_free_cred_contents(context, &tgt);
 981         krb5_free_principal(context, referral.server);
 982         return ret;
 983     }
 984
 985     while (loop++ < 17) {
 986         krb5_creds **tickets;
 987         krb5_creds mcreds;
 988         char *referral_realm;
 989
 990         /* Use cache if we are not doing impersonation or contrainte deleg */
 991         if (impersonate_principal == NULL || flags.b.constrained_delegation) {
 992             krb5_cc_clear_mcred(&mcreds);
 993             mcreds.server = referral.server;
 994             ret = krb5_cc_retrieve_cred(context, ccache, 0, &mcreds, &ticket);
 995         } else
 996             ret = EINVAL;
 997
 998         if (ret) {
 999             ret = get_cred_kdc_address(context, ccache, flags, NULL,
1000                                        &referral, &tgt, impersonate_principal,
1001                                        second_ticket, &ticket);
1002             if (ret)
1003                 goto out;
1004         }
1005
1006         /* Did we get the right ticket ? */
1007         if (krb5_principal_compare_any_realm(context,
1008                                              referral.server,
1009                                              ticket.server))
1010             break;
1011
1012         if (!krb5_principal_is_krbtgt(context, ticket.server)) {
1013             krb5_set_error_message(context, KRB5KRB_AP_ERR_NOT_US,
1014                                    N_("Got back an non krbtgt "
1015                                       "ticket referrals", ""));
1016             ret = KRB5KRB_AP_ERR_NOT_US;
1017             goto out;
1018         }
1019
1020         referral_realm = ticket.server->name.name_string.val[1];
1021
1022         /* check that there are no referrals loops */
1023         tickets = *ret_tgts;
1024
1025         krb5_cc_clear_mcred(&mcreds);
1026         mcreds.server = ticket.server;
1027
1028         while(tickets && *tickets){
1029             if(krb5_compare_creds(context,
1030                                   KRB5_TC_DONT_MATCH_REALM,
1031                                   &mcreds,
1032                                   *tickets))
1033             {
1034                 krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
1035                                        N_("Referral from %s "
1036                                           "loops back to realm %s", ""),
1037                                        tgt.server->realm,
1038                                        referral_realm);
1039                 ret = KRB5_GET_IN_TKT_LOOP;
1040                 goto out;
1041             }
1042             tickets++;
1043         }
1044
1045         /*
1046          * if either of the chain or the ok_as_delegate was stripped
1047          * by the kdc, make sure we strip it too.
1048          */
1049
1050         if (ok_as_delegate == 0 || ticket.flags.b.ok_as_delegate == 0) {
1051             ok_as_delegate = 0;
1052             ticket.flags.b.ok_as_delegate = 0;
1053         }
1054
1055         ret = add_cred(context, &ticket, ret_tgts);
1056         if (ret)
1057             goto out;
1058
1059         /* try realm in the referral */
1060         ret = krb5_principal_set_realm(context,
1061                                        referral.server,
1062                                        referral_realm);
1063         krb5_free_cred_contents(context, &tgt);
1064         tgt = ticket;
1065         memset(&ticket, 0, sizeof(ticket));
1066         if (ret)
1067             goto out;
1068     }
1069
1070     ret = krb5_copy_creds(context, &ticket, out_creds);
1071
1072 out:
1073     krb5_free_principal(context, referral.server);
1074     krb5_free_cred_contents(context, &tgt);
1075     krb5_free_cred_contents(context, &ticket);
1076     return ret;
1077 }
1078
1079
1080 /*
1081  * Glue function between referrals version and old client chasing
1082  * codebase.
1083  */
1084
1085 krb5_error_code
1086 _krb5_get_cred_kdc_any(krb5_context context,
1087                        krb5_kdc_flags flags,
1088                        krb5_ccache ccache,
1089                        krb5_creds *in_creds,
1090                        krb5_principal impersonate_principal,
1091                        Ticket *second_ticket,
1092                        krb5_creds **out_creds,
1093                        krb5_creds ***ret_tgts)
1094 {
1095     krb5_error_code ret;
1096     krb5_deltat offset;
1097
1098     ret = krb5_cc_get_kdc_offset(context, ccache, &offset);
1099     if (ret) {
1100         context->kdc_sec_offset = offset;
1101         context->kdc_usec_offset = 0;
1102     }
1103
1104     ret = get_cred_kdc_referral(context,
1105                                 flags,
1106                                 ccache,
1107                                 in_creds,
1108                                 impersonate_principal,
1109                                 second_ticket,
1110                                 out_creds,
1111                                 ret_tgts);
1112     if (ret == 0 || flags.b.canonicalize)
1113         return ret;
1114     return get_cred_kdc_capath(context,
1115                                 flags,
1116                                 ccache,
1117                                 in_creds,
1118                                 impersonate_principal,
1119                                 second_ticket,
1120                                 out_creds,
1121                                 ret_tgts);
1122 }
1123
1124
1125 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1126 krb5_get_credentials_with_flags(krb5_context context,
1127                                 krb5_flags options,
1128                                 krb5_kdc_flags flags,
1129                                 krb5_ccache ccache,
1130                                 krb5_creds *in_creds,
1131                                 krb5_creds **out_creds)
1132 {
1133     krb5_error_code ret;
1134     krb5_creds **tgts;
1135     krb5_creds *res_creds;
1136     int i;
1137
1138     if (in_creds->session.keytype) {
1139         ret = krb5_enctype_valid(context, in_creds->session.keytype);
1140         if (ret)
1141             return ret;
1142     }
1143
1144     *out_creds = NULL;
1145     res_creds = calloc(1, sizeof(*res_creds));
1146     if (res_creds == NULL) {
1147         krb5_set_error_message(context, ENOMEM,
1148                                N_("malloc: out of memory", ""));
1149         return ENOMEM;
1150     }
1151
1152     if (in_creds->session.keytype)
1153         options |= KRB5_TC_MATCH_KEYTYPE;
1154
1155     /*
1156      * If we got a credential, check if credential is expired before
1157      * returning it.
1158      */
1159     ret = krb5_cc_retrieve_cred(context,
1160                                 ccache,
1161                                 in_creds->session.keytype ?
1162                                 KRB5_TC_MATCH_KEYTYPE : 0,
1163                                 in_creds, res_creds);
1164     /*
1165      * If we got a credential, check if credential is expired before
1166      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1167      */
1168     if (ret == 0) {
1169         krb5_timestamp timeret;
1170
1171         /* If expired ok, don't bother checking */
1172         if(options & KRB5_GC_EXPIRED_OK) {
1173             *out_creds = res_creds;
1174             return 0;
1175         }
1176
1177         krb5_timeofday(context, &timeret);
1178         if(res_creds->times.endtime > timeret) {
1179             *out_creds = res_creds;
1180             return 0;
1181         }
1182         if(options & KRB5_GC_CACHED)
1183             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1184
1185     } else if(ret != KRB5_CC_END) {
1186         free(res_creds);
1187         return ret;
1188     }
1189     free(res_creds);
1190     if(options & KRB5_GC_CACHED)
1191         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
1192
1193     if(options & KRB5_GC_USER_USER)
1194         flags.b.enc_tkt_in_skey = 1;
1195     if (flags.b.enc_tkt_in_skey)
1196         options |= KRB5_GC_NO_STORE;
1197
1198     tgts = NULL;
1199     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1200                                  in_creds, NULL, NULL, out_creds, &tgts);
1201     for(i = 0; tgts && tgts[i]; i++) {
1202         krb5_cc_store_cred(context, ccache, tgts[i]);
1203         krb5_free_creds(context, tgts[i]);
1204     }
1205     free(tgts);
1206     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1207         krb5_cc_store_cred(context, ccache, *out_creds);
1208     return ret;
1209 }
1210
1211 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1212 krb5_get_credentials(krb5_context context,
1213                      krb5_flags options,
1214                      krb5_ccache ccache,
1215                      krb5_creds *in_creds,
1216                      krb5_creds **out_creds)
1217 {
1218     krb5_kdc_flags flags;
1219     flags.i = 0;
1220     return krb5_get_credentials_with_flags(context, options, flags,
1221                                            ccache, in_creds, out_creds);
1222 }
1223
1224 struct krb5_get_creds_opt_data {
1225     krb5_principal self;
1226     krb5_flags options;
1227     krb5_enctype enctype;
1228     Ticket *ticket;
1229 };
1230
1231
1232 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1233 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
1234 {
1235     *opt = calloc(1, sizeof(**opt));
1236     if (*opt == NULL) {
1237         krb5_set_error_message(context, ENOMEM,
1238                                N_("malloc: out of memory", ""));
1239         return ENOMEM;
1240     }
1241     return 0;
1242 }
1243
1244 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1245 krb5_get_creds_opt_free(krb5_context context, krb5_get_creds_opt opt)
1246 {
1247     if (opt->self)
1248         krb5_free_principal(context, opt->self);
1249     if (opt->ticket) {
1250         free_Ticket(opt->ticket);
1251         free(opt->ticket);
1252     }
1253     memset(opt, 0, sizeof(*opt));
1254     free(opt);
1255 }
1256
1257 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1258 krb5_get_creds_opt_set_options(krb5_context context,
1259                                krb5_get_creds_opt opt,
1260                                krb5_flags options)
1261 {
1262     opt->options = options;
1263 }
1264
1265 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1266 krb5_get_creds_opt_add_options(krb5_context context,
1267                                krb5_get_creds_opt opt,
1268                                krb5_flags options)
1269 {
1270     opt->options |= options;
1271 }
1272
1273 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1274 krb5_get_creds_opt_set_enctype(krb5_context context,
1275                                krb5_get_creds_opt opt,
1276                                krb5_enctype enctype)
1277 {
1278     opt->enctype = enctype;
1279 }
1280
1281 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1282 krb5_get_creds_opt_set_impersonate(krb5_context context,
1283                                    krb5_get_creds_opt opt,
1284                                    krb5_const_principal self)
1285 {
1286     if (opt->self)
1287         krb5_free_principal(context, opt->self);
1288     return krb5_copy_principal(context, self, &opt->self);
1289 }
1290
1291 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1292 krb5_get_creds_opt_set_ticket(krb5_context context,
1293                               krb5_get_creds_opt opt,
1294                               const Ticket *ticket)
1295 {
1296     if (opt->ticket) {
1297         free_Ticket(opt->ticket);
1298         free(opt->ticket);
1299         opt->ticket = NULL;
1300     }
1301     if (ticket) {
1302         krb5_error_code ret;
1303
1304         opt->ticket = malloc(sizeof(*ticket));
1305         if (opt->ticket == NULL) {
1306             krb5_set_error_message(context, ENOMEM,
1307                                    N_("malloc: out of memory", ""));
1308             return ENOMEM;
1309         }
1310         ret = copy_Ticket(ticket, opt->ticket);
1311         if (ret) {
1312             free(opt->ticket);
1313             opt->ticket = NULL;
1314             krb5_set_error_message(context, ret,
1315                                    N_("malloc: out of memory", ""));
1316             return ret;
1317         }
1318     }
1319     return 0;
1320 }
1321
1322
1323
1324 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1325 krb5_get_creds(krb5_context context,
1326                krb5_get_creds_opt opt,
1327                krb5_ccache ccache,
1328                krb5_const_principal inprinc,
1329                krb5_creds **out_creds)
1330 {
1331     krb5_kdc_flags flags;
1332     krb5_flags options;
1333     krb5_creds in_creds;
1334     krb5_error_code ret;
1335     krb5_creds **tgts;
1336     krb5_creds *res_creds;
1337     int i;
1338
1339     if (opt && opt->enctype) {
1340         ret = krb5_enctype_valid(context, opt->enctype);
1341         if (ret)
1342             return ret;
1343     }
1344
1345     memset(&in_creds, 0, sizeof(in_creds));
1346     in_creds.server = rk_UNCONST(inprinc);
1347
1348     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
1349     if (ret)
1350         return ret;
1351
1352     if (opt)
1353         options = opt->options;
1354     else
1355         options = 0;
1356     flags.i = 0;
1357
1358     *out_creds = NULL;
1359     res_creds = calloc(1, sizeof(*res_creds));
1360     if (res_creds == NULL) {
1361         krb5_free_principal(context, in_creds.client);
1362         krb5_set_error_message(context, ENOMEM,
1363                                N_("malloc: out of memory", ""));
1364         return ENOMEM;
1365     }
1366
1367     if (opt && opt->enctype) {
1368         in_creds.session.keytype = opt->enctype;
1369         options |= KRB5_TC_MATCH_KEYTYPE;
1370     }
1371
1372     /*
1373      * If we got a credential, check if credential is expired before
1374      * returning it.
1375      */
1376     ret = krb5_cc_retrieve_cred(context,
1377                                 ccache,
1378                                 options & KRB5_TC_MATCH_KEYTYPE,
1379                                 &in_creds, res_creds);
1380     /*
1381      * If we got a credential, check if credential is expired before
1382      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1383      */
1384     if (ret == 0) {
1385         krb5_timestamp timeret;
1386
1387         /* If expired ok, don't bother checking */
1388         if(options & KRB5_GC_EXPIRED_OK) {
1389             *out_creds = res_creds;
1390             krb5_free_principal(context, in_creds.client);
1391             goto out;
1392         }
1393
1394         krb5_timeofday(context, &timeret);
1395         if(res_creds->times.endtime > timeret) {
1396             *out_creds = res_creds;
1397             krb5_free_principal(context, in_creds.client);
1398             goto out;
1399         }
1400         if(options & KRB5_GC_CACHED)
1401             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1402
1403     } else if(ret != KRB5_CC_END) {
1404         free(res_creds);
1405         krb5_free_principal(context, in_creds.client);
1406         goto out;
1407     }
1408     free(res_creds);
1409     if(options & KRB5_GC_CACHED) {
1410         krb5_free_principal(context, in_creds.client);
1411         ret = not_found(context, in_creds.server, KRB5_CC_NOTFOUND);
1412         goto out;
1413     }
1414     if(options & KRB5_GC_USER_USER) {
1415         flags.b.enc_tkt_in_skey = 1;
1416         options |= KRB5_GC_NO_STORE;
1417     }
1418     if (options & KRB5_GC_FORWARDABLE)
1419         flags.b.forwardable = 1;
1420     if (options & KRB5_GC_NO_TRANSIT_CHECK)
1421         flags.b.disable_transited_check = 1;
1422     if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
1423         flags.b.request_anonymous = 1; /* XXX ARGH confusion */
1424         flags.b.constrained_delegation = 1;
1425     }
1426     if (options & KRB5_GC_CANONICALIZE)
1427         flags.b.canonicalize = 1;
1428
1429     tgts = NULL;
1430     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1431                                  &in_creds, opt->self, opt->ticket,
1432                                  out_creds, &tgts);
1433     krb5_free_principal(context, in_creds.client);
1434     for(i = 0; tgts && tgts[i]; i++) {
1435         krb5_cc_store_cred(context, ccache, tgts[i]);
1436         krb5_free_creds(context, tgts[i]);
1437     }
1438     free(tgts);
1439     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1440         krb5_cc_store_cred(context, ccache, *out_creds);
1441
1442  out:
1443     _krb5_debug(context, 5, "krb5_get_creds: ret = %d", ret);
1444
1445     return ret;
1446 }
1447
1448 /*
1449  *
1450  */
1451
1452 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1453 krb5_get_renewed_creds(krb5_context context,
1454                        krb5_creds *creds,
1455                        krb5_const_principal client,
1456                        krb5_ccache ccache,
1457                        const char *in_tkt_service)
1458 {
1459     krb5_error_code ret;
1460     krb5_kdc_flags flags;
1461     krb5_creds in, *template, *out = NULL;
1462
1463     memset(&in, 0, sizeof(in));
1464     memset(creds, 0, sizeof(*creds));
1465
1466     ret = krb5_copy_principal(context, client, &in.client);
1467     if (ret)
1468         return ret;
1469
1470     if (in_tkt_service) {
1471         ret = krb5_parse_name(context, in_tkt_service, &in.server);
1472         if (ret) {
1473             krb5_free_principal(context, in.client);
1474             return ret;
1475         }
1476     } else {
1477         const char *realm = krb5_principal_get_realm(context, client);
1478
1479         ret = krb5_make_principal(context, &in.server, realm, KRB5_TGS_NAME,
1480                                   realm, NULL);
1481         if (ret) {
1482             krb5_free_principal(context, in.client);
1483             return ret;
1484         }
1485     }
1486
1487     flags.i = 0;
1488     flags.b.renewable = flags.b.renew = 1;
1489
1490     /*
1491      * Get template from old credential cache for the same entry, if
1492      * this failes, no worries.
1493      */
1494     ret = krb5_get_credentials(context, KRB5_GC_CACHED, ccache, &in, &template);
1495     if (ret == 0) {
1496         flags.b.forwardable = template->flags.b.forwardable;
1497         flags.b.proxiable = template->flags.b.proxiable;
1498         krb5_free_creds (context, template);
1499     }
1500
1501     ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out);
1502     krb5_free_principal(context, in.client);
1503     krb5_free_principal(context, in.server);
1504     if (ret)
1505         return ret;
1506
1507     ret = krb5_copy_creds_contents(context, out, creds);
1508     krb5_free_creds(context, out);
1509
1510     return ret;
1511 }