2 Unix SMB/CIFS implementation.
3 kerberos authorization data (PAC) utility library
4 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Luke Howard 2002-2003
8 Copyright (C) Stefan Metzmacher 2004-2005
9 Copyright (C) Guenther Deschner 2005,2007,2008
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #include "librpc/gen_ndr/ndr_krb5pac.h"
29 #include "libcli/auth/krb5_wrap.h"
31 krb5_error_code
check_pac_checksum(DATA_BLOB pac_data
,
32 struct PAC_SIGNATURE_DATA
*sig
,
34 const krb5_keyblock
*keyblock
)
38 krb5_keyusage usage
= 0;
40 smb_krb5_checksum_from_pac_sig(&cksum
, sig
);
42 #ifdef HAVE_KRB5_KU_OTHER_CKSUM /* Heimdal */
43 usage
= KRB5_KU_OTHER_CKSUM
;
44 #elif defined(HAVE_KRB5_KEYUSAGE_APP_DATA_CKSUM) /* MIT */
45 usage
= KRB5_KEYUSAGE_APP_DATA_CKSUM
;
47 #error UNKNOWN_KRB5_KEYUSAGE
50 ret
= smb_krb5_verify_checksum(context
,
58 DEBUG(2,("check_pac_checksum: PAC Verification failed: %s (%d)\n",
59 error_message(ret
), ret
));
67 * @brief Decode a blob containing a NDR envoded PAC structure
69 * @param mem_ctx - The memory context
70 * @param pac_data_blob - The data blob containing the NDR encoded data
71 * @param context - The Kerberos Context
72 * @param service_keyblock - The Service Key used to verify the checksum
73 * @param client_principal - The client principal
74 * @param tgs_authtime - The ticket timestamp
75 * @param pac_data_out - [out] The decoded PAC
77 * @return - A NTSTATUS error code
79 NTSTATUS
kerberos_decode_pac(TALLOC_CTX
*mem_ctx
,
80 DATA_BLOB pac_data_blob
,
82 const krb5_keyblock
*krbtgt_keyblock
,
83 const krb5_keyblock
*service_keyblock
,
84 krb5_const_principal client_principal
,
86 struct PAC_DATA
**pac_data_out
)
89 enum ndr_err_code ndr_err
;
91 DATA_BLOB modified_pac_blob
;
93 NTTIME tgs_authtime_nttime
;
94 krb5_principal client_principal_pac
= NULL
;
97 struct PAC_SIGNATURE_DATA
*srv_sig_ptr
= NULL
;
98 struct PAC_SIGNATURE_DATA
*kdc_sig_ptr
= NULL
;
99 struct PAC_SIGNATURE_DATA
*srv_sig_wipe
= NULL
;
100 struct PAC_SIGNATURE_DATA
*kdc_sig_wipe
= NULL
;
101 struct PAC_LOGON_NAME
*logon_name
= NULL
;
102 struct PAC_LOGON_INFO
*logon_info
= NULL
;
103 struct PAC_DATA
*pac_data
= NULL
;
104 struct PAC_DATA_RAW
*pac_data_raw
= NULL
;
106 DATA_BLOB
*srv_sig_blob
= NULL
;
107 DATA_BLOB
*kdc_sig_blob
= NULL
;
111 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
113 return NT_STATUS_NO_MEMORY
;
117 *pac_data_out
= NULL
;
120 pac_data
= talloc(tmp_ctx
, struct PAC_DATA
);
121 pac_data_raw
= talloc(tmp_ctx
, struct PAC_DATA_RAW
);
122 kdc_sig_wipe
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
123 srv_sig_wipe
= talloc(tmp_ctx
, struct PAC_SIGNATURE_DATA
);
124 if (!pac_data_raw
|| !pac_data
|| !kdc_sig_wipe
|| !srv_sig_wipe
) {
125 talloc_free(tmp_ctx
);
126 return NT_STATUS_NO_MEMORY
;
129 ndr_err
= ndr_pull_struct_blob(&pac_data_blob
, pac_data
, pac_data
,
130 (ndr_pull_flags_fn_t
)ndr_pull_PAC_DATA
);
131 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
132 status
= ndr_map_error2ntstatus(ndr_err
);
133 DEBUG(0,("can't parse the PAC: %s\n",
135 talloc_free(tmp_ctx
);
139 if (pac_data
->num_buffers
< 4) {
140 /* we need logon_ingo, service_key and kdc_key */
141 DEBUG(0,("less than 4 PAC buffers\n"));
142 talloc_free(tmp_ctx
);
143 return NT_STATUS_INVALID_PARAMETER
;
146 ndr_err
= ndr_pull_struct_blob(
147 &pac_data_blob
, pac_data_raw
, pac_data_raw
,
148 (ndr_pull_flags_fn_t
)ndr_pull_PAC_DATA_RAW
);
149 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
150 status
= ndr_map_error2ntstatus(ndr_err
);
151 DEBUG(0,("can't parse the PAC: %s\n",
153 talloc_free(tmp_ctx
);
157 if (pac_data_raw
->num_buffers
< 4) {
158 /* we need logon_ingo, service_key and kdc_key */
159 DEBUG(0,("less than 4 PAC buffers\n"));
160 talloc_free(tmp_ctx
);
161 return NT_STATUS_INVALID_PARAMETER
;
164 if (pac_data
->num_buffers
!= pac_data_raw
->num_buffers
) {
165 /* we need logon_ingo, service_key and kdc_key */
166 DEBUG(0, ("misparse! PAC_DATA has %d buffers while "
167 "PAC_DATA_RAW has %d\n", pac_data
->num_buffers
,
168 pac_data_raw
->num_buffers
));
169 talloc_free(tmp_ctx
);
170 return NT_STATUS_INVALID_PARAMETER
;
173 for (i
=0; i
< pac_data
->num_buffers
; i
++) {
174 struct PAC_BUFFER
*data_buf
= &pac_data
->buffers
[i
];
175 struct PAC_BUFFER_RAW
*raw_buf
= &pac_data_raw
->buffers
[i
];
177 if (data_buf
->type
!= raw_buf
->type
) {
178 DEBUG(0, ("misparse! PAC_DATA buffer %d has type "
179 "%d while PAC_DATA_RAW has %d\n", i
,
180 data_buf
->type
, raw_buf
->type
));
181 talloc_free(tmp_ctx
);
182 return NT_STATUS_INVALID_PARAMETER
;
184 switch (data_buf
->type
) {
185 case PAC_TYPE_LOGON_INFO
:
186 if (!data_buf
->info
) {
189 logon_info
= data_buf
->info
->logon_info
.info
;
191 case PAC_TYPE_SRV_CHECKSUM
:
192 if (!data_buf
->info
) {
195 srv_sig_ptr
= &data_buf
->info
->srv_cksum
;
196 srv_sig_blob
= &raw_buf
->info
->remaining
;
198 case PAC_TYPE_KDC_CHECKSUM
:
199 if (!data_buf
->info
) {
202 kdc_sig_ptr
= &data_buf
->info
->kdc_cksum
;
203 kdc_sig_blob
= &raw_buf
->info
->remaining
;
205 case PAC_TYPE_LOGON_NAME
:
206 logon_name
= &data_buf
->info
->logon_name
;
214 DEBUG(0,("PAC no logon_info\n"));
215 talloc_free(tmp_ctx
);
216 return NT_STATUS_INVALID_PARAMETER
;
220 DEBUG(0,("PAC no logon_name\n"));
221 talloc_free(tmp_ctx
);
222 return NT_STATUS_INVALID_PARAMETER
;
225 if (!srv_sig_ptr
|| !srv_sig_blob
) {
226 DEBUG(0,("PAC no srv_key\n"));
227 talloc_free(tmp_ctx
);
228 return NT_STATUS_INVALID_PARAMETER
;
231 if (!kdc_sig_ptr
|| !kdc_sig_blob
) {
232 DEBUG(0,("PAC no kdc_key\n"));
233 talloc_free(tmp_ctx
);
234 return NT_STATUS_INVALID_PARAMETER
;
237 /* Find and zero out the signatures,
238 * as required by the signing algorithm */
240 /* We find the data blobs above,
241 * now we parse them to get at the exact portion we should zero */
242 ndr_err
= ndr_pull_struct_blob(
243 kdc_sig_blob
, kdc_sig_wipe
, kdc_sig_wipe
,
244 (ndr_pull_flags_fn_t
)ndr_pull_PAC_SIGNATURE_DATA
);
245 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
246 status
= ndr_map_error2ntstatus(ndr_err
);
247 DEBUG(0,("can't parse the KDC signature: %s\n",
249 talloc_free(tmp_ctx
);
253 ndr_err
= ndr_pull_struct_blob(
254 srv_sig_blob
, srv_sig_wipe
, srv_sig_wipe
,
255 (ndr_pull_flags_fn_t
)ndr_pull_PAC_SIGNATURE_DATA
);
256 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
257 status
= ndr_map_error2ntstatus(ndr_err
);
258 DEBUG(0,("can't parse the SRV signature: %s\n",
260 talloc_free(tmp_ctx
);
264 /* Now zero the decoded structure */
265 memset(kdc_sig_wipe
->signature
.data
,
266 '\0', kdc_sig_wipe
->signature
.length
);
267 memset(srv_sig_wipe
->signature
.data
,
268 '\0', srv_sig_wipe
->signature
.length
);
270 /* and reencode, back into the same place it came from */
271 ndr_err
= ndr_push_struct_blob(
272 kdc_sig_blob
, pac_data_raw
, kdc_sig_wipe
,
273 (ndr_push_flags_fn_t
)ndr_push_PAC_SIGNATURE_DATA
);
274 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
275 status
= ndr_map_error2ntstatus(ndr_err
);
276 DEBUG(0,("can't repack the KDC signature: %s\n",
278 talloc_free(tmp_ctx
);
281 ndr_err
= ndr_push_struct_blob(
282 srv_sig_blob
, pac_data_raw
, srv_sig_wipe
,
283 (ndr_push_flags_fn_t
)ndr_push_PAC_SIGNATURE_DATA
);
284 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
285 status
= ndr_map_error2ntstatus(ndr_err
);
286 DEBUG(0,("can't repack the SRV signature: %s\n",
288 talloc_free(tmp_ctx
);
292 /* push out the whole structure, but now with zero'ed signatures */
293 ndr_err
= ndr_push_struct_blob(
294 &modified_pac_blob
, pac_data_raw
, pac_data_raw
,
295 (ndr_push_flags_fn_t
)ndr_push_PAC_DATA_RAW
);
296 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
297 status
= ndr_map_error2ntstatus(ndr_err
);
298 DEBUG(0,("can't repack the RAW PAC: %s\n",
300 talloc_free(tmp_ctx
);
304 if (service_keyblock
) {
305 /* verify by service_key */
306 ret
= check_pac_checksum(modified_pac_blob
, srv_sig_ptr
,
310 DEBUG(1, ("PAC Decode: Failed to verify the service "
311 "signature: %s\n", error_message(ret
)));
312 return NT_STATUS_ACCESS_DENIED
;
315 if (krbtgt_keyblock
) {
316 /* verify the service key checksum by krbtgt_key */
317 ret
= check_pac_checksum(srv_sig_ptr
->signature
, kdc_sig_ptr
,
318 context
, krbtgt_keyblock
);
320 DEBUG(1, ("PAC Decode: Failed to verify the KDC signature: %s\n",
321 smb_get_krb5_error_message(context
, ret
, tmp_ctx
)));
322 talloc_free(tmp_ctx
);
323 return NT_STATUS_ACCESS_DENIED
;
329 /* Convert to NT time, so as not to loose accuracy in comparison */
330 unix_to_nt_time(&tgs_authtime_nttime
, tgs_authtime
);
332 if (tgs_authtime_nttime
!= logon_name
->logon_time
) {
333 DEBUG(2, ("PAC Decode: "
334 "Logon time mismatch between ticket and PAC!\n"));
335 DEBUG(2, ("PAC Decode: PAC: %s\n",
336 nt_time_string(tmp_ctx
, logon_name
->logon_time
)));
337 DEBUG(2, ("PAC Decode: Ticket: %s\n",
338 nt_time_string(tmp_ctx
, tgs_authtime_nttime
)));
339 talloc_free(tmp_ctx
);
340 return NT_STATUS_ACCESS_DENIED
;
344 if (client_principal
) {
345 ret
= smb_krb5_parse_name_norealm(context
,
346 logon_name
->account_name
,
347 &client_principal_pac
);
349 DEBUG(2, ("Could not parse name from PAC: [%s]:%s\n",
350 logon_name
->account_name
, error_message(ret
)));
351 talloc_free(tmp_ctx
);
352 return NT_STATUS_INVALID_PARAMETER
;
355 bool_ret
= smb_krb5_principal_compare_any_realm(context
,
357 client_principal_pac
);
359 krb5_free_principal(context
, client_principal_pac
);
362 DEBUG(2, ("Name in PAC [%s] does not match principal name "
363 "in ticket\n", logon_name
->account_name
));
364 talloc_free(tmp_ctx
);
365 return NT_STATUS_ACCESS_DENIED
;
369 DEBUG(3,("Found account name from PAC: %s [%s]\n",
370 logon_info
->info3
.base
.account_name
.string
,
371 logon_info
->info3
.base
.full_name
.string
));
373 DEBUG(10,("Successfully validated Kerberos PAC\n"));
375 if (DEBUGLEVEL
>= 10) {
377 s
= NDR_PRINT_STRUCT_STRING(tmp_ctx
, PAC_DATA
, pac_data
);
379 DEBUGADD(10,("%s\n", s
));
384 *pac_data_out
= talloc_steal(mem_ctx
, pac_data
);