lib/krb5/verify_init.c

   1 /*
   2  * Copyright (c) 1997 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. All advertising materials mentioning features or use of this software
  18  *    must display the following acknowledgement:
  19  *      This product includes software developed by Kungliga Tekniska
  20  *      Högskolan and its contributors.
  21  *
  22  * 4. Neither the name of the Institute nor the names of its contributors
  23  *    may be used to endorse or promote products derived from this software
  24  *    without specific prior written permission.
  25  *
  26  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  36  * SUCH DAMAGE.
  37  */
  38
  39 #include "krb5_locl.h"
  40
  41 RCSID("$Id$");
  42
  43 void
  44 krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options)
  45 {
  46     memset (options, 0, sizeof(*options));
  47 }
  48
  49 void
  50 krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options,
  51                                              int ap_req_nofail)
  52 {
  53     options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
  54     options->ap_req_nofail = ap_req_nofail;
  55 }
  56
  57 krb5_error_code
  58 krb5_verify_init_creds(krb5_context context,
  59                        krb5_creds *creds,
  60                        krb5_principal ap_req_server,
  61                        krb5_keytab ap_req_keytab,
  62                        krb5_ccache *ccache,
  63                        krb5_verify_init_creds_opt *options)
  64 {
  65     krb5_error_code ret;
  66     krb5_data req;
  67     krb5_ccache local_ccache;
  68     krb5_keytab_entry entry;
  69     krb5_creds *new_creds = NULL;
  70     krb5_auth_context auth_context = NULL;
  71     krb5_principal server = NULL;
  72     krb5_keytab keytab = NULL;
  73
  74     krb5_data_zero (&req);
  75     memset (&entry, 0, sizeof(entry));
  76
  77     if (ap_req_server == NULL) {
  78         char local_hostname[MAXHOSTNAMELEN];
  79
  80         if (gethostname (local_hostname, sizeof(local_hostname)) < 0)
  81             return errno;
  82
  83         ret = krb5_sname_to_principal (context,
  84                                        local_hostname,
  85                                        "host",
  86                                        KRB5_NT_SRV_HST,
  87                                        &server);
  88         if (ret)
  89             goto cleanup;
  90     } else
  91         server = ap_req_server;
  92
  93     if (ap_req_keytab == NULL) {
  94         ret = krb5_kt_default (context, &keytab);
  95         if (ret)
  96             goto cleanup;
  97     } else
  98         keytab = ap_req_keytab;
  99
 100     if (ccache && *ccache)
 101         local_ccache = *ccache;
 102     else {
 103         ret = krb5_cc_gen_new (context, &krb5_mcc_ops, &local_ccache);
 104         if (ret)
 105             goto cleanup;
 106         ret = krb5_cc_initialize (context,
 107                                   local_ccache,
 108                                   creds->client);
 109         if (ret)
 110             goto cleanup;
 111         ret = krb5_cc_store_cred (context,
 112                                   local_ccache,
 113                                   creds);
 114         if (ret)
 115             goto cleanup;
 116     }
 117
 118     if (!krb5_principal_compare (context, server, creds->server)) {
 119         krb5_creds match_cred;
 120
 121         memset (&match_cred, 0, sizeof(match_cred));
 122
 123         match_cred.client = creds->client;
 124         match_cred.server = server;
 125
 126         ret = krb5_get_credentials (context,
 127                                     0,
 128                                     local_ccache,
 129                                     &match_cred,
 130                                     &new_creds);
 131         if (ret)
 132             goto cleanup;
 133     } else
 134         new_creds = creds;
 135
 136     ret = krb5_mk_req_extended (context,
 137                                 &auth_context,
 138                                 0,
 139                                 NULL,
 140                                 new_creds,
 141                                 &req);
 142
 143     krb5_auth_con_free (context, auth_context);
 144     auth_context = NULL;
 145
 146     if (ret)
 147         goto cleanup;
 148
 149     ret = krb5_kt_get_entry (context,
 150                              keytab,
 151                              server,
 152                              0,
 153                              KEYTYPE_DES,
 154                              &entry);
 155     if (ret) {
 156         const char *p;
 157
 158         if (((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL) &&
 159              options->ap_req_nofail == 1) ||
 160             krb5_config_get_bool (context->cf,
 161                                   "libdefaults",
 162                                   "verify_ap_req_nofail",
 163                                   NULL)) {
 164             goto cleanup;
 165         } else {
 166             ret = 0;
 167             goto cleanup;
 168         }
 169     }
 170
 171     ret = krb5_rd_req_with_keyblock (context,
 172                                      &auth_context,
 173                                      &req,
 174                                      server,
 175                                      &entry.keyblock,
 176                                      0,
 177                                      NULL);
 178
 179 cleanup:
 180     if (auth_context)
 181         krb5_auth_con_free (context, auth_context);
 182     krb5_data_free (&req);
 183     krb5_kt_free_entry (context, &entry);
 184     if (new_creds)
 185         krb5_free_creds (context, new_creds);
 186     if (ap_req_server == NULL && server)
 187         krb5_free_principal (context, server);
 188     if (ap_req_keytab == NULL && keytab)
 189         krb5_kt_close (context, keytab);
 190     if (ccache == NULL
 191         || (ret != 0 && *ccache == NULL))
 192         krb5_cc_destroy (context, local_ccache);
 193
 194     if (ret == 0 && ccache != NULL && *ccache == NULL)
 195         *ccache = local_ccache;
 196
 197     return ret;
 198 }