2 Unix SMB/CIFS implementation.
3 simple kerberos5 routines for active directory
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Luke Howard 2002-2003
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2011
7 Copyright (C) Guenther Deschner 2005-2009
8 Copyright (C) Simo Sorce 2010.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "libcli/auth/krb5_wrap.h"
28 #include "librpc/gen_ndr/krb5pac.h"
30 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
31 int create_kerberos_key_from_string_direct(krb5_context context
,
32 krb5_principal host_princ
,
39 krb5_encrypt_block eblock
;
41 ret
= krb5_principal2salt(context
, host_princ
, &salt
);
43 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret
)));
46 krb5_use_enctype(context
, &eblock
, enctype
);
47 ret
= krb5_string_to_key(context
, &eblock
, key
, password
, &salt
);
52 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
53 int create_kerberos_key_from_string_direct(krb5_context context
,
54 krb5_principal host_princ
,
62 ret
= krb5_get_pw_salt(context
, host_princ
, &salt
);
64 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret
)));
68 ret
= krb5_string_to_key_salt(context
, enctype
, (const char *)password
->data
, salt
, key
);
69 krb5_free_salt(context
, salt
);
74 #error UNKNOWN_CREATE_KEY_FUNCTIONS
77 void kerberos_free_data_contents(krb5_context context
, krb5_data
*pdata
)
79 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
81 krb5_free_data_contents(context
, pdata
);
83 #elif defined(HAVE_KRB5_DATA_FREE)
84 krb5_data_free(context
, pdata
);
86 SAFE_FREE(pdata
->data
);
91 krb5_error_code
smb_krb5_kt_free_entry(krb5_context context
, krb5_keytab_entry
*kt_entry
)
93 /* Try krb5_free_keytab_entry_contents first, since
94 * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
95 * krb5_kt_free_entry but only has a prototype for the first, while the
96 * second is considered private.
98 #if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
99 return krb5_free_keytab_entry_contents(context
, kt_entry
);
100 #elif defined(HAVE_KRB5_KT_FREE_ENTRY)
101 return krb5_kt_free_entry(context
, kt_entry
);
103 #error UNKNOWN_KT_FREE_FUNCTION
107 /**************************************************************
108 Wrappers around kerberos string functions that convert from
109 utf8 -> unix charset and vica versa.
110 **************************************************************/
112 /**************************************************************
113 krb5_parse_name that takes a UNIX charset.
114 **************************************************************/
116 krb5_error_code
smb_krb5_parse_name(krb5_context context
,
117 const char *name
, /* in unix charset */
118 krb5_principal
*principal
)
122 size_t converted_size
;
123 TALLOC_CTX
*frame
= talloc_stackframe();
125 if (!push_utf8_talloc(frame
, &utf8_name
, name
, &converted_size
)) {
130 ret
= krb5_parse_name(context
, utf8_name
, principal
);
135 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
136 static void krb5_free_unparsed_name(krb5_context context
, char *val
)
142 /**************************************************************
143 krb5_parse_name that returns a UNIX charset name. Must
144 be freed with talloc_free() call.
145 **************************************************************/
147 krb5_error_code
smb_krb5_unparse_name(TALLOC_CTX
*mem_ctx
,
148 krb5_context context
,
149 krb5_const_principal principal
,
154 size_t converted_size
;
157 ret
= krb5_unparse_name(context
, principal
, &utf8_name
);
162 if (!pull_utf8_talloc(mem_ctx
, unix_name
, utf8_name
, &converted_size
)) {
163 krb5_free_unparsed_name(context
, utf8_name
);
166 krb5_free_unparsed_name(context
, utf8_name
);
170 krb5_error_code
smb_krb5_parse_name_norealm(krb5_context context
,
172 krb5_principal
*principal
)
174 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
175 return smb_krb5_parse_name_norealm_conv(context
, name
, principal
);
178 /* we are cheating here because parse_name will in fact set the realm.
179 * We don't care as the only caller of smb_krb5_parse_name_norealm
180 * ignores the realm anyway when calling
181 * smb_krb5_principal_compare_any_realm later - Guenther */
183 return smb_krb5_parse_name(context
, name
, principal
);
186 bool smb_krb5_principal_compare_any_realm(krb5_context context
,
187 krb5_const_principal princ1
,
188 krb5_const_principal princ2
)
190 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
192 return krb5_principal_compare_any_realm(context
, princ1
, princ2
);
194 /* krb5_princ_size is a macro in MIT */
195 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
198 const krb5_data
*p1
, *p2
;
200 len1
= krb5_princ_size(context
, princ1
);
201 len2
= krb5_princ_size(context
, princ2
);
206 for (i
= 0; i
< len1
; i
++) {
208 p1
= krb5_princ_component(context
, (krb5_principal
)discard_const(princ1
), i
);
209 p2
= krb5_princ_component(context
, (krb5_principal
)discard_const(princ2
), i
);
211 if (p1
->length
!= p2
->length
|| memcmp(p1
->data
, p2
->data
, p1
->length
))
217 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
221 void smb_krb5_checksum_from_pac_sig(krb5_checksum
*cksum
,
222 struct PAC_SIGNATURE_DATA
*sig
)
224 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
225 cksum
->cksumtype
= (krb5_cksumtype
)sig
->type
;
226 cksum
->checksum
.length
= sig
->signature
.length
;
227 cksum
->checksum
.data
= sig
->signature
.data
;
229 cksum
->checksum_type
= (krb5_cksumtype
)sig
->type
;
230 cksum
->length
= sig
->signature
.length
;
231 cksum
->contents
= sig
->signature
.data
;
235 krb5_error_code
smb_krb5_verify_checksum(krb5_context context
,
236 const krb5_keyblock
*keyblock
,
238 krb5_checksum
*cksum
,
244 /* verify the checksum */
246 /* welcome to the wonderful world of samba's kerberos abstraction layer:
248 * function heimdal 0.6.1rc3 heimdal 0.7 MIT krb 1.4.2
249 * -----------------------------------------------------------------------------
250 * krb5_c_verify_checksum - works works
251 * krb5_verify_checksum works (6 args) works (6 args) broken (7 args)
254 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
256 krb5_boolean checksum_valid
= false;
259 input
.data
= (char *)data
;
260 input
.length
= length
;
262 ret
= krb5_c_verify_checksum(context
,
269 DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
270 error_message(ret
)));
275 ret
= KRB5KRB_AP_ERR_BAD_INTEGRITY
;
278 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
280 /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
281 * without enctype and it ignores any key_usage types - Guenther */
286 ret
= krb5_crypto_init(context
,
291 DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
292 error_message(ret
)));
296 ret
= krb5_verify_checksum(context
,
303 krb5_crypto_destroy(context
, crypto
);
307 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
313 char *gssapi_error_string(TALLOC_CTX
*mem_ctx
,
314 OM_uint32 maj_stat
, OM_uint32 min_stat
,
317 OM_uint32 disp_min_stat
, disp_maj_stat
;
318 gss_buffer_desc maj_error_message
;
319 gss_buffer_desc min_error_message
;
320 char *maj_error_string
, *min_error_string
;
321 OM_uint32 msg_ctx
= 0;
325 maj_error_message
.value
= NULL
;
326 min_error_message
.value
= NULL
;
327 maj_error_message
.length
= 0;
328 min_error_message
.length
= 0;
330 disp_maj_stat
= gss_display_status(&disp_min_stat
, maj_stat
, GSS_C_GSS_CODE
,
331 mech
, &msg_ctx
, &maj_error_message
);
332 disp_maj_stat
= gss_display_status(&disp_min_stat
, min_stat
, GSS_C_MECH_CODE
,
333 mech
, &msg_ctx
, &min_error_message
);
335 maj_error_string
= talloc_strndup(mem_ctx
, (char *)maj_error_message
.value
, maj_error_message
.length
);
337 min_error_string
= talloc_strndup(mem_ctx
, (char *)min_error_message
.value
, min_error_message
.length
);
339 ret
= talloc_asprintf(mem_ctx
, "%s: %s", maj_error_string
, min_error_string
);
341 talloc_free(maj_error_string
);
342 talloc_free(min_error_string
);
344 gss_release_buffer(&disp_min_stat
, &maj_error_message
);
345 gss_release_buffer(&disp_min_stat
, &min_error_message
);
351 char *smb_get_krb5_error_message(krb5_context context
, krb5_error_code code
, TALLOC_CTX
*mem_ctx
)
355 #if defined(HAVE_KRB5_GET_ERROR_MESSAGE) && defined(HAVE_KRB5_FREE_ERROR_MESSAGE)
356 const char *context_error
= krb5_get_error_message(context
, code
);
358 ret
= talloc_asprintf(mem_ctx
, "%s: %s", error_message(code
), context_error
);
359 krb5_free_error_message(context
, context_error
);
363 ret
= talloc_strdup(mem_ctx
, error_message(code
));