kdc/krb5tgs.c

   1 /*
   2  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kdc_locl.h"
  35
  36 /*
  37  * return the realm of a krbtgt-ticket or NULL
  38  */
  39
  40 static Realm
  41 get_krbtgt_realm(const PrincipalName *p)
  42 {
  43     if(p->name_string.len == 2
  44        && strcmp(p->name_string.val[0], KRB5_TGS_NAME) == 0)
  45         return p->name_string.val[1];
  46     else
  47         return NULL;
  48 }
  49
  50 /*
  51  * The KDC might add a signed path to the ticket authorization data
  52  * field. This is to avoid server impersonating clients and the
  53  * request constrained delegation.
  54  *
  55  * This is done by storing a KRB5_AUTHDATA_IF_RELEVANT with a single
  56  * entry of type KRB5SignedPath.
  57  */
  58
  59 static krb5_error_code
  60 find_KRB5SignedPath(krb5_context context,
  61                     const AuthorizationData *ad,
  62                     krb5_data *data)
  63 {
  64     AuthorizationData child;
  65     krb5_error_code ret;
  66     int pos;
  67
  68     if (ad == NULL || ad->len == 0)
  69         return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
  70
  71     pos = ad->len - 1;
  72
  73     if (ad->val[pos].ad_type != KRB5_AUTHDATA_IF_RELEVANT)
  74         return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
  75
  76     ret = decode_AuthorizationData(ad->val[pos].ad_data.data,
  77                                    ad->val[pos].ad_data.length,
  78                                    &child,
  79                                    NULL);
  80     if (ret) {
  81         krb5_set_error_message(context, ret, "Failed to decode "
  82                                "IF_RELEVANT with %d", ret);
  83         return ret;
  84     }
  85
  86     if (child.len != 1) {
  87         free_AuthorizationData(&child);
  88         return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
  89     }
  90
  91     if (child.val[0].ad_type != KRB5_AUTHDATA_SIGNTICKET) {
  92         free_AuthorizationData(&child);
  93         return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
  94     }
  95
  96     if (data)
  97         ret = der_copy_octet_string(&child.val[0].ad_data, data);
  98     free_AuthorizationData(&child);
  99     return ret;
 100 }
 101
 102 krb5_error_code
 103 _kdc_add_KRB5SignedPath(krb5_context context,
 104                         krb5_kdc_configuration *config,
 105                         hdb_entry_ex *krbtgt,
 106                         krb5_enctype enctype,
 107                         krb5_principal client,
 108                         krb5_const_principal server,
 109                         krb5_principals principals,
 110                         EncTicketPart *tkt)
 111 {
 112     krb5_error_code ret;
 113     KRB5SignedPath sp;
 114     krb5_data data;
 115     krb5_crypto crypto = NULL;
 116     size_t size;
 117
 118     if (server && principals) {
 119         ret = add_Principals(principals, server);
 120         if (ret)
 121             return ret;
 122     }
 123
 124     {
 125         KRB5SignedPathData spd;
 126
 127         spd.client = client;
 128         spd.authtime = tkt->authtime;
 129         spd.delegated = principals;
 130         spd.method_data = NULL;
 131
 132         ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length,
 133                            &spd, &size, ret);
 134         if (ret)
 135             return ret;
 136         if (data.length != size)
 137             krb5_abortx(context, "internal asn.1 encoder error");
 138     }
 139
 140     {
 141         Key *key;
 142         ret = hdb_enctype2key(context, &krbtgt->entry, enctype, &key);
 143         if (ret == 0)
 144             ret = krb5_crypto_init(context, &key->key, 0, &crypto);
 145         if (ret) {
 146             free(data.data);
 147             return ret;
 148         }
 149     }
 150
 151     /*
 152      * Fill in KRB5SignedPath
 153      */
 154
 155     sp.etype = enctype;
 156     sp.delegated = principals;
 157     sp.method_data = NULL;
 158
 159     ret = krb5_create_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH, 0,
 160                                data.data, data.length, &sp.cksum);
 161     krb5_crypto_destroy(context, crypto);
 162     free(data.data);
 163     if (ret)
 164         return ret;
 165
 166     ASN1_MALLOC_ENCODE(KRB5SignedPath, data.data, data.length, &sp, &size, ret);
 167     free_Checksum(&sp.cksum);
 168     if (ret)
 169         return ret;
 170     if (data.length != size)
 171         krb5_abortx(context, "internal asn.1 encoder error");
 172
 173
 174     /*
 175      * Add IF-RELEVANT(KRB5SignedPath) to the last slot in
 176      * authorization data field.
 177      */
 178
 179     ret = _kdc_tkt_add_if_relevant_ad(context, tkt,
 180                                       KRB5_AUTHDATA_SIGNTICKET, &data);
 181     krb5_data_free(&data);
 182
 183     return ret;
 184 }
 185
 186 static krb5_error_code
 187 check_KRB5SignedPath(krb5_context context,
 188                      krb5_kdc_configuration *config,
 189                      hdb_entry_ex *krbtgt,
 190                      krb5_principal cp,
 191                      EncTicketPart *tkt,
 192                      krb5_principals *delegated,
 193                      int *signedpath)
 194 {
 195     krb5_error_code ret;
 196     krb5_data data;
 197     krb5_crypto crypto = NULL;
 198
 199     if (delegated)
 200         *delegated = NULL;
 201
 202     ret = find_KRB5SignedPath(context, tkt->authorization_data, &data);
 203     if (ret == 0) {
 204         KRB5SignedPathData spd;
 205         KRB5SignedPath sp;
 206         size_t size;
 207
 208         ret = decode_KRB5SignedPath(data.data, data.length, &sp, NULL);
 209         krb5_data_free(&data);
 210         if (ret)
 211             return ret;
 212
 213         spd.client = cp;
 214         spd.authtime = tkt->authtime;
 215         spd.delegated = sp.delegated;
 216         spd.method_data = sp.method_data;
 217
 218         ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length,
 219                            &spd, &size, ret);
 220         if (ret) {
 221             free_KRB5SignedPath(&sp);
 222             return ret;
 223         }
 224         if (data.length != size)
 225             krb5_abortx(context, "internal asn.1 encoder error");
 226
 227         {
 228             Key *key;
 229             ret = hdb_enctype2key(context, &krbtgt->entry, sp.etype, &key);
 230             if (ret == 0)
 231                 ret = krb5_crypto_init(context, &key->key, 0, &crypto);
 232             if (ret) {
 233                 free(data.data);
 234                 free_KRB5SignedPath(&sp);
 235                 return ret;
 236             }
 237         }
 238         ret = krb5_verify_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH,
 239                                    data.data, data.length,
 240                                    &sp.cksum);
 241         krb5_crypto_destroy(context, crypto);
 242         free(data.data);
 243         if (ret) {
 244             free_KRB5SignedPath(&sp);
 245             kdc_log(context, config, 5,
 246                     "KRB5SignedPath not signed correctly, not marking as signed");
 247             return 0;
 248         }
 249
 250         if (delegated && sp.delegated) {
 251
 252             *delegated = malloc(sizeof(*sp.delegated));
 253             if (*delegated == NULL) {
 254                 free_KRB5SignedPath(&sp);
 255                 return ENOMEM;
 256             }
 257
 258             ret = copy_Principals(*delegated, sp.delegated);
 259             if (ret) {
 260                 free_KRB5SignedPath(&sp);
 261                 free(*delegated);
 262                 *delegated = NULL;
 263                 return ret;
 264             }
 265         }
 266         free_KRB5SignedPath(&sp);
 267
 268         *signedpath = 1;
 269     }
 270
 271     return 0;
 272 }
 273
 274 /*
 275  *
 276  */
 277
 278 static krb5_error_code
 279 check_PAC(krb5_context context,
 280           krb5_kdc_configuration *config,
 281           const krb5_principal client_principal,
 282           hdb_entry_ex *client,
 283           hdb_entry_ex *server,
 284           const EncryptionKey *server_key,
 285           const EncryptionKey *krbtgt_key,
 286           EncTicketPart *tkt,
 287           krb5_data *rspac,
 288           int *signedpath)
 289 {
 290     AuthorizationData *ad = tkt->authorization_data;
 291     unsigned i, j;
 292     krb5_error_code ret;
 293
 294     if (ad == NULL || ad->len == 0)
 295         return 0;
 296
 297     for (i = 0; i < ad->len; i++) {
 298         AuthorizationData child;
 299
 300         if (ad->val[i].ad_type != KRB5_AUTHDATA_IF_RELEVANT)
 301             continue;
 302
 303         ret = decode_AuthorizationData(ad->val[i].ad_data.data,
 304                                        ad->val[i].ad_data.length,
 305                                        &child,
 306                                        NULL);
 307         if (ret) {
 308             krb5_set_error_message(context, ret, "Failed to decode "
 309                                    "IF_RELEVANT with %d", ret);
 310             return ret;
 311         }
 312         for (j = 0; j < child.len; j++) {
 313
 314             if (child.val[j].ad_type == KRB5_AUTHDATA_WIN2K_PAC) {
 315                 int signed_pac = 0;
 316                 krb5_pac pac;
 317
 318                 /* Found PAC */
 319                 ret = krb5_pac_parse(context,
 320                                      child.val[j].ad_data.data,
 321                                      child.val[j].ad_data.length,
 322                                      &pac);
 323                 free_AuthorizationData(&child);
 324                 if (ret)
 325                     return ret;
 326
 327                 ret = krb5_pac_verify(context, pac, tkt->authtime,
 328                                       client_principal,
 329                                       krbtgt_key, NULL);
 330                 if (ret) {
 331                     krb5_pac_free(context, pac);
 332                     return ret;
 333                 }
 334
 335                 ret = _kdc_pac_verify(context, client_principal,
 336                                       client, server, &pac, &signed_pac);
 337                 if (ret) {
 338                     krb5_pac_free(context, pac);
 339                     return ret;
 340                 }
 341
 342                 /*
 343                  * Only re-sign PAC if we could verify it with the PAC
 344                  * function. The no-verify case happens when we get in
 345                  * a PAC from cross realm from a Windows domain and
 346                  * that there is no PAC verification function.
 347                  */
 348                 if (signed_pac) {
 349                     *signedpath = 1;
 350                     ret = _krb5_pac_sign(context, pac, tkt->authtime,
 351                                          client_principal,
 352                                          server_key, krbtgt_key, rspac);
 353                 }
 354                 krb5_pac_free(context, pac);
 355
 356                 return ret;
 357             }
 358         }
 359         free_AuthorizationData(&child);
 360     }
 361     return 0;
 362 }
 363
 364 /*
 365  *
 366  */
 367
 368 static krb5_error_code
 369 check_tgs_flags(krb5_context context,
 370                 krb5_kdc_configuration *config,
 371                 KDC_REQ_BODY *b, const EncTicketPart *tgt, EncTicketPart *et)
 372 {
 373     KDCOptions f = b->kdc_options;
 374
 375     if(f.validate){
 376         if(!tgt->flags.invalid || tgt->starttime == NULL){
 377             kdc_log(context, config, 0,
 378                     "Bad request to validate ticket");
 379             return KRB5KDC_ERR_BADOPTION;
 380         }
 381         if(*tgt->starttime > kdc_time){
 382             kdc_log(context, config, 0,
 383                     "Early request to validate ticket");
 384             return KRB5KRB_AP_ERR_TKT_NYV;
 385         }
 386         /* XXX  tkt = tgt */
 387         et->flags.invalid = 0;
 388     }else if(tgt->flags.invalid){
 389         kdc_log(context, config, 0,
 390                 "Ticket-granting ticket has INVALID flag set");
 391         return KRB5KRB_AP_ERR_TKT_INVALID;
 392     }
 393
 394     if(f.forwardable){
 395         if(!tgt->flags.forwardable){
 396             kdc_log(context, config, 0,
 397                     "Bad request for forwardable ticket");
 398             return KRB5KDC_ERR_BADOPTION;
 399         }
 400         et->flags.forwardable = 1;
 401     }
 402     if(f.forwarded){
 403         if(!tgt->flags.forwardable){
 404             kdc_log(context, config, 0,
 405                     "Request to forward non-forwardable ticket");
 406             return KRB5KDC_ERR_BADOPTION;
 407         }
 408         et->flags.forwarded = 1;
 409         et->caddr = b->addresses;
 410     }
 411     if(tgt->flags.forwarded)
 412         et->flags.forwarded = 1;
 413
 414     if(f.proxiable){
 415         if(!tgt->flags.proxiable){
 416             kdc_log(context, config, 0,
 417                     "Bad request for proxiable ticket");
 418             return KRB5KDC_ERR_BADOPTION;
 419         }
 420         et->flags.proxiable = 1;
 421     }
 422     if(f.proxy){
 423         if(!tgt->flags.proxiable){
 424             kdc_log(context, config, 0,
 425                     "Request to proxy non-proxiable ticket");
 426             return KRB5KDC_ERR_BADOPTION;
 427         }
 428         et->flags.proxy = 1;
 429         et->caddr = b->addresses;
 430     }
 431     if(tgt->flags.proxy)
 432         et->flags.proxy = 1;
 433
 434     if(f.allow_postdate){
 435         if(!tgt->flags.may_postdate){
 436             kdc_log(context, config, 0,
 437                     "Bad request for post-datable ticket");
 438             return KRB5KDC_ERR_BADOPTION;
 439         }
 440         et->flags.may_postdate = 1;
 441     }
 442     if(f.postdated){
 443         if(!tgt->flags.may_postdate){
 444             kdc_log(context, config, 0,
 445                     "Bad request for postdated ticket");
 446             return KRB5KDC_ERR_BADOPTION;
 447         }
 448         if(b->from)
 449             *et->starttime = *b->from;
 450         et->flags.postdated = 1;
 451         et->flags.invalid = 1;
 452     }else if(b->from && *b->from > kdc_time + context->max_skew){
 453         kdc_log(context, config, 0, "Ticket cannot be postdated");
 454         return KRB5KDC_ERR_CANNOT_POSTDATE;
 455     }
 456
 457     if(f.renewable){
 458         if(!tgt->flags.renewable || tgt->renew_till == NULL){
 459             kdc_log(context, config, 0,
 460                     "Bad request for renewable ticket");
 461             return KRB5KDC_ERR_BADOPTION;
 462         }
 463         et->flags.renewable = 1;
 464         ALLOC(et->renew_till);
 465         _kdc_fix_time(&b->rtime);
 466         *et->renew_till = *b->rtime;
 467     }
 468     if(f.renew){
 469         time_t old_life;
 470         if(!tgt->flags.renewable || tgt->renew_till == NULL){
 471             kdc_log(context, config, 0,
 472                     "Request to renew non-renewable ticket");
 473             return KRB5KDC_ERR_BADOPTION;
 474         }
 475         old_life = tgt->endtime;
 476         if(tgt->starttime)
 477             old_life -= *tgt->starttime;
 478         else
 479             old_life -= tgt->authtime;
 480         et->endtime = *et->starttime + old_life;
 481         if (et->renew_till != NULL)
 482             et->endtime = min(*et->renew_till, et->endtime);
 483     }
 484
 485 #if 0
 486     /* checks for excess flags */
 487     if(f.request_anonymous && !config->allow_anonymous){
 488         kdc_log(context, config, 0,
 489                 "Request for anonymous ticket");
 490         return KRB5KDC_ERR_BADOPTION;
 491     }
 492 #endif
 493     return 0;
 494 }
 495
 496 /*
 497  *
 498  */
 499
 500 static krb5_error_code
 501 check_constrained_delegation(krb5_context context,
 502                              krb5_kdc_configuration *config,
 503                              HDB *clientdb,
 504                              hdb_entry_ex *client,
 505                              krb5_const_principal server)
 506 {
 507     const HDB_Ext_Constrained_delegation_acl *acl;
 508     krb5_error_code ret;
 509     int i;
 510
 511     /* if client delegates to itself, that ok */
 512     if (krb5_principal_compare(context, client->entry.principal, server) == TRUE)
 513         return 0;
 514
 515     if (clientdb->hdb_check_constrained_delegation) {
 516         ret = clientdb->hdb_check_constrained_delegation(context, clientdb, client, server);
 517         if (ret == 0)
 518             return 0;
 519     } else {
 520         ret = hdb_entry_get_ConstrainedDelegACL(&client->entry, &acl);
 521         if (ret) {
 522             krb5_clear_error_message(context);
 523             return ret;
 524         }
 525
 526         if (acl) {
 527             for (i = 0; i < acl->len; i++) {
 528                 if (krb5_principal_compare(context, server, &acl->val[i]) == TRUE)
 529                     return 0;
 530             }
 531         }
 532         ret = KRB5KDC_ERR_BADOPTION;
 533     }
 534     kdc_log(context, config, 0,
 535             "Bad request for constrained delegation");
 536     return ret;
 537 }
 538
 539 /*
 540  *
 541  */
 542
 543 static krb5_error_code
 544 verify_flags (krb5_context context,
 545               krb5_kdc_configuration *config,
 546               const EncTicketPart *et,
 547               const char *pstr)
 548 {
 549     if(et->endtime < kdc_time){
 550         kdc_log(context, config, 0, "Ticket expired (%s)", pstr);
 551         return KRB5KRB_AP_ERR_TKT_EXPIRED;
 552     }
 553     if(et->flags.invalid){
 554         kdc_log(context, config, 0, "Ticket not valid (%s)", pstr);
 555         return KRB5KRB_AP_ERR_TKT_NYV;
 556     }
 557     return 0;
 558 }
 559
 560 /*
 561  *
 562  */
 563
 564 static krb5_error_code
 565 fix_transited_encoding(krb5_context context,
 566                        krb5_kdc_configuration *config,
 567                        krb5_boolean check_policy,
 568                        const TransitedEncoding *tr,
 569                        EncTicketPart *et,
 570                        const char *client_realm,
 571                        const char *server_realm,
 572                        const char *tgt_realm)
 573 {
 574     krb5_error_code ret = 0;
 575     char **realms, **tmp;
 576     unsigned int num_realms;
 577     int i;
 578
 579     switch (tr->tr_type) {
 580     case DOMAIN_X500_COMPRESS:
 581         break;
 582     case 0:
 583         /*
 584          * Allow empty content of type 0 because that is was Microsoft
 585          * generates in their TGT.
 586          */
 587         if (tr->contents.length == 0)
 588             break;
 589         kdc_log(context, config, 0,
 590                 "Transited type 0 with non empty content");
 591         return KRB5KDC_ERR_TRTYPE_NOSUPP;
 592     default:
 593         kdc_log(context, config, 0,
 594                 "Unknown transited type: %u", tr->tr_type);
 595         return KRB5KDC_ERR_TRTYPE_NOSUPP;
 596     }
 597
 598     ret = krb5_domain_x500_decode(context,
 599                                   tr->contents,
 600                                   &realms,
 601                                   &num_realms,
 602                                   client_realm,
 603                                   server_realm);
 604     if(ret){
 605         krb5_warn(context, ret,
 606                   "Decoding transited encoding");
 607         return ret;
 608     }
 609     if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) {
 610         /* not us, so add the previous realm to transited set */
 611         if (num_realms + 1 > UINT_MAX/sizeof(*realms)) {
 612             ret = ERANGE;
 613             goto free_realms;
 614         }
 615         tmp = realloc(realms, (num_realms + 1) * sizeof(*realms));
 616         if(tmp == NULL){
 617             ret = ENOMEM;
 618             goto free_realms;
 619         }
 620         realms = tmp;
 621         realms[num_realms] = strdup(tgt_realm);
 622         if(realms[num_realms] == NULL){
 623             ret = ENOMEM;
 624             goto free_realms;
 625         }
 626         num_realms++;
 627     }
 628     if(num_realms == 0) {
 629         if(strcmp(client_realm, server_realm))
 630             kdc_log(context, config, 0,
 631                     "cross-realm %s -> %s", client_realm, server_realm);
 632     } else {
 633         size_t l = 0;
 634         char *rs;
 635         for(i = 0; i < num_realms; i++)
 636             l += strlen(realms[i]) + 2;
 637         rs = malloc(l);
 638         if(rs != NULL) {
 639             *rs = '\0';
 640             for(i = 0; i < num_realms; i++) {
 641                 if(i > 0)
 642                     strlcat(rs, ", ", l);
 643                 strlcat(rs, realms[i], l);
 644             }
 645             kdc_log(context, config, 0,
 646                     "cross-realm %s -> %s via [%s]",
 647                     client_realm, server_realm, rs);
 648             free(rs);
 649         }
 650     }
 651     if(check_policy) {
 652         ret = krb5_check_transited(context, client_realm,
 653                                    server_realm,
 654                                    realms, num_realms, NULL);
 655         if(ret) {
 656             krb5_warn(context, ret, "cross-realm %s -> %s",
 657                       client_realm, server_realm);
 658             goto free_realms;
 659         }
 660         et->flags.transited_policy_checked = 1;
 661     }
 662     et->transited.tr_type = DOMAIN_X500_COMPRESS;
 663     ret = krb5_domain_x500_encode(realms, num_realms, &et->transited.contents);
 664     if(ret)
 665         krb5_warn(context, ret, "Encoding transited encoding");
 666   free_realms:
 667     for(i = 0; i < num_realms; i++)
 668         free(realms[i]);
 669     free(realms);
 670     return ret;
 671 }
 672
 673
 674 static krb5_error_code
 675 tgs_make_reply(krb5_context context,
 676                krb5_kdc_configuration *config,
 677                KDC_REQ_BODY *b,
 678                krb5_const_principal tgt_name,
 679                const EncTicketPart *tgt,
 680                const krb5_keyblock *replykey,
 681                int rk_is_subkey,
 682                const EncryptionKey *serverkey,
 683                const krb5_keyblock *sessionkey,
 684                krb5_kvno kvno,
 685                AuthorizationData *auth_data,
 686                hdb_entry_ex *server,
 687                krb5_principal server_principal,
 688                const char *server_name,
 689                hdb_entry_ex *client,
 690                krb5_principal client_principal,
 691                hdb_entry_ex *krbtgt,
 692                krb5_enctype krbtgt_etype,
 693                krb5_principals spp,
 694                const krb5_data *rspac,
 695                const METHOD_DATA *enc_pa_data,
 696                const char **e_text,
 697                krb5_data *reply)
 698 {
 699     KDC_REP rep;
 700     EncKDCRepPart ek;
 701     EncTicketPart et;
 702     KDCOptions f = b->kdc_options;
 703     krb5_error_code ret;
 704     int is_weak = 0;
 705
 706     memset(&rep, 0, sizeof(rep));
 707     memset(&et, 0, sizeof(et));
 708     memset(&ek, 0, sizeof(ek));
 709
 710     rep.pvno = 5;
 711     rep.msg_type = krb_tgs_rep;
 712
 713     et.authtime = tgt->authtime;
 714     _kdc_fix_time(&b->till);
 715     et.endtime = min(tgt->endtime, *b->till);
 716     ALLOC(et.starttime);
 717     *et.starttime = kdc_time;
 718
 719     ret = check_tgs_flags(context, config, b, tgt, &et);
 720     if(ret)
 721         goto out;
 722
 723     /* We should check the transited encoding if:
 724        1) the request doesn't ask not to be checked
 725        2) globally enforcing a check
 726        3) principal requires checking
 727        4) we allow non-check per-principal, but principal isn't marked as allowing this
 728        5) we don't globally allow this
 729     */
 730
 731 #define GLOBAL_FORCE_TRANSITED_CHECK            \
 732     (config->trpolicy == TRPOLICY_ALWAYS_CHECK)
 733 #define GLOBAL_ALLOW_PER_PRINCIPAL                      \
 734     (config->trpolicy == TRPOLICY_ALLOW_PER_PRINCIPAL)
 735 #define GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK                    \
 736     (config->trpolicy == TRPOLICY_ALWAYS_HONOUR_REQUEST)
 737
 738 /* these will consult the database in future release */
 739 #define PRINCIPAL_FORCE_TRANSITED_CHECK(P)              0
 740 #define PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(P)      0
 741
 742     ret = fix_transited_encoding(context, config,
 743                                  !f.disable_transited_check ||
 744                                  GLOBAL_FORCE_TRANSITED_CHECK ||
 745                                  PRINCIPAL_FORCE_TRANSITED_CHECK(server) ||
 746                                  !((GLOBAL_ALLOW_PER_PRINCIPAL &&
 747                                     PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(server)) ||
 748                                    GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK),
 749                                  &tgt->transited, &et,
 750                                  krb5_principal_get_realm(context, client_principal),
 751                                  krb5_principal_get_realm(context, server->entry.principal),
 752                                  krb5_principal_get_realm(context, krbtgt->entry.principal));
 753     if(ret)
 754         goto out;
 755
 756     copy_Realm(&server_principal->realm, &rep.ticket.realm);
 757     _krb5_principal2principalname(&rep.ticket.sname, server_principal);
 758     copy_Realm(&tgt_name->realm, &rep.crealm);
 759 /*
 760     if (f.request_anonymous)
 761         _kdc_make_anonymous_principalname (&rep.cname);
 762     else */
 763
 764     copy_PrincipalName(&tgt_name->name, &rep.cname);
 765     rep.ticket.tkt_vno = 5;
 766
 767     ek.caddr = et.caddr;
 768     if(et.caddr == NULL)
 769         et.caddr = tgt->caddr;
 770
 771     {
 772         time_t life;
 773         life = et.endtime - *et.starttime;
 774         if(client && client->entry.max_life)
 775             life = min(life, *client->entry.max_life);
 776         if(server->entry.max_life)
 777             life = min(life, *server->entry.max_life);
 778         et.endtime = *et.starttime + life;
 779     }
 780     if(f.renewable_ok && tgt->flags.renewable &&
 781        et.renew_till == NULL && et.endtime < *b->till &&
 782        tgt->renew_till != NULL)
 783     {
 784         et.flags.renewable = 1;
 785         ALLOC(et.renew_till);
 786         *et.renew_till = *b->till;
 787     }
 788     if(et.renew_till){
 789         time_t renew;
 790         renew = *et.renew_till - et.authtime;
 791         if(client && client->entry.max_renew)
 792             renew = min(renew, *client->entry.max_renew);
 793         if(server->entry.max_renew)
 794             renew = min(renew, *server->entry.max_renew);
 795         *et.renew_till = et.authtime + renew;
 796     }
 797
 798     if(et.renew_till){
 799         *et.renew_till = min(*et.renew_till, *tgt->renew_till);
 800         *et.starttime = min(*et.starttime, *et.renew_till);
 801         et.endtime = min(et.endtime, *et.renew_till);
 802     }
 803
 804     *et.starttime = min(*et.starttime, et.endtime);
 805
 806     if(*et.starttime == et.endtime){
 807         ret = KRB5KDC_ERR_NEVER_VALID;
 808         goto out;
 809     }
 810     if(et.renew_till && et.endtime == *et.renew_till){
 811         free(et.renew_till);
 812         et.renew_till = NULL;
 813         et.flags.renewable = 0;
 814     }
 815
 816     et.flags.pre_authent = tgt->flags.pre_authent;
 817     et.flags.hw_authent  = tgt->flags.hw_authent;
 818     et.flags.anonymous   = tgt->flags.anonymous;
 819     et.flags.ok_as_delegate = server->entry.flags.ok_as_delegate;
 820
 821     if(rspac->length) {
 822         /*
 823          * No not need to filter out the any PAC from the
 824          * auth_data since it's signed by the KDC.
 825          */
 826         ret = _kdc_tkt_add_if_relevant_ad(context, &et,
 827                                           KRB5_AUTHDATA_WIN2K_PAC, rspac);
 828         if (ret)
 829             goto out;
 830     }
 831
 832     if (auth_data) {
 833         unsigned int i = 0;
 834
 835         /* XXX check authdata */
 836
 837         if (et.authorization_data == NULL) {
 838             et.authorization_data = calloc(1, sizeof(*et.authorization_data));
 839             if (et.authorization_data == NULL) {
 840                 ret = ENOMEM;
 841                 krb5_set_error_message(context, ret, "malloc: out of memory");
 842                 goto out;
 843             }
 844         }
 845         for(i = 0; i < auth_data->len ; i++) {
 846             ret = add_AuthorizationData(et.authorization_data, &auth_data->val[i]);
 847             if (ret) {
 848                 krb5_set_error_message(context, ret, "malloc: out of memory");
 849                 goto out;
 850             }
 851         }
 852
 853         /* Filter out type KRB5SignedPath */
 854         ret = find_KRB5SignedPath(context, et.authorization_data, NULL);
 855         if (ret == 0) {
 856             if (et.authorization_data->len == 1) {
 857                 free_AuthorizationData(et.authorization_data);
 858                 free(et.authorization_data);
 859                 et.authorization_data = NULL;
 860             } else {
 861                 AuthorizationData *ad = et.authorization_data;
 862                 free_AuthorizationDataElement(&ad->val[ad->len - 1]);
 863                 ad->len--;
 864             }
 865         }
 866     }
 867
 868     ret = krb5_copy_keyblock_contents(context, sessionkey, &et.key);
 869     if (ret)
 870         goto out;
 871     et.crealm = tgt->crealm;
 872     et.cname = tgt_name->name;
 873
 874     ek.key = et.key;
 875     /* MIT must have at least one last_req */
 876     ek.last_req.len = 1;
 877     ek.last_req.val = calloc(1, sizeof(*ek.last_req.val));
 878     if (ek.last_req.val == NULL) {
 879         ret = ENOMEM;
 880         goto out;
 881     }
 882     ek.nonce = b->nonce;
 883     ek.flags = et.flags;
 884     ek.authtime = et.authtime;
 885     ek.starttime = et.starttime;
 886     ek.endtime = et.endtime;
 887     ek.renew_till = et.renew_till;
 888     ek.srealm = rep.ticket.realm;
 889     ek.sname = rep.ticket.sname;
 890
 891     _kdc_log_timestamp(context, config, "TGS-REQ", et.authtime, et.starttime,
 892                        et.endtime, et.renew_till);
 893
 894     /* Don't sign cross realm tickets, they can't be checked anyway */
 895     {
 896         char *r = get_krbtgt_realm(&ek.sname);
 897
 898         if (r == NULL || strcmp(r, ek.srealm) == 0) {
 899             ret = _kdc_add_KRB5SignedPath(context,
 900                                           config,
 901                                           krbtgt,
 902                                           krbtgt_etype,
 903                                           client_principal,
 904                                           NULL,
 905                                           spp,
 906                                           &et);
 907             if (ret)
 908                 goto out;
 909         }
 910     }
 911
 912     if (enc_pa_data->len) {
 913         rep.padata = calloc(1, sizeof(*rep.padata));
 914         if (rep.padata == NULL) {
 915             ret = ENOMEM;
 916             goto out;
 917         }
 918         ret = copy_METHOD_DATA(enc_pa_data, rep.padata);
 919         if (ret)
 920             goto out;
 921     }
 922
 923     if (krb5_enctype_valid(context, et.key.keytype) != 0
 924         && _kdc_is_weak_exception(server->entry.principal, et.key.keytype))
 925     {
 926         krb5_enctype_enable(context, et.key.keytype);
 927         is_weak = 1;
 928     }
 929
 930
 931     /* It is somewhat unclear where the etype in the following
 932        encryption should come from. What we have is a session
 933        key in the passed tgt, and a list of preferred etypes
 934        *for the new ticket*. Should we pick the best possible
 935        etype, given the keytype in the tgt, or should we look
 936        at the etype list here as well?  What if the tgt
 937        session key is DES3 and we want a ticket with a (say)
 938        CAST session key. Should the DES3 etype be added to the
 939        etype list, even if we don't want a session key with
 940        DES3? */
 941     ret = _kdc_encode_reply(context, config,
 942                             &rep, &et, &ek, et.key.keytype,
 943                             kvno,
 944                             serverkey, 0, replykey, rk_is_subkey,
 945                             e_text, reply);
 946     if (is_weak)
 947         krb5_enctype_disable(context, et.key.keytype);
 948
 949 out:
 950     free_TGS_REP(&rep);
 951     free_TransitedEncoding(&et.transited);
 952     if(et.starttime)
 953         free(et.starttime);
 954     if(et.renew_till)
 955         free(et.renew_till);
 956     if(et.authorization_data) {
 957         free_AuthorizationData(et.authorization_data);
 958         free(et.authorization_data);
 959     }
 960     free_LastReq(&ek.last_req);
 961     memset(et.key.keyvalue.data, 0, et.key.keyvalue.length);
 962     free_EncryptionKey(&et.key);
 963     return ret;
 964 }
 965
 966 static krb5_error_code
 967 tgs_check_authenticator(krb5_context context,
 968                         krb5_kdc_configuration *config,
 969                         krb5_auth_context ac,
 970                         KDC_REQ_BODY *b,
 971                         const char **e_text,
 972                         krb5_keyblock *key)
 973 {
 974     krb5_authenticator auth;
 975     size_t len;
 976     unsigned char *buf;
 977     size_t buf_size;
 978     krb5_error_code ret;
 979     krb5_crypto crypto;
 980
 981     krb5_auth_con_getauthenticator(context, ac, &auth);
 982     if(auth->cksum == NULL){
 983         kdc_log(context, config, 0, "No authenticator in request");
 984         ret = KRB5KRB_AP_ERR_INAPP_CKSUM;
 985         goto out;
 986     }
 987     /*
 988      * according to RFC1510 it doesn't need to be keyed,
 989      * but according to the latest draft it needs to.
 990      */
 991     if (
 992 #if 0
 993 !krb5_checksum_is_keyed(context, auth->cksum->cksumtype)
 994         ||
 995 #endif
 996  !krb5_checksum_is_collision_proof(context, auth->cksum->cksumtype)) {
 997         kdc_log(context, config, 0, "Bad checksum type in authenticator: %d",
 998                 auth->cksum->cksumtype);
 999         ret =  KRB5KRB_AP_ERR_INAPP_CKSUM;
1000         goto out;
1001     }
1002
1003     /* XXX should not re-encode this */
1004     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, b, &len, ret);
1005     if(ret){
1006         const char *msg = krb5_get_error_message(context, ret);
1007         kdc_log(context, config, 0, "Failed to encode KDC-REQ-BODY: %s", msg);
1008         krb5_free_error_message(context, msg);
1009         goto out;
1010     }
1011     if(buf_size != len) {
1012         free(buf);
1013         kdc_log(context, config, 0, "Internal error in ASN.1 encoder");
1014         *e_text = "KDC internal error";
1015         ret = KRB5KRB_ERR_GENERIC;
1016         goto out;
1017     }
1018     ret = krb5_crypto_init(context, key, 0, &crypto);
1019     if (ret) {
1020         const char *msg = krb5_get_error_message(context, ret);
1021         free(buf);
1022         kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1023         krb5_free_error_message(context, msg);
1024         goto out;
1025     }
1026     ret = krb5_verify_checksum(context,
1027                                crypto,
1028                                KRB5_KU_TGS_REQ_AUTH_CKSUM,
1029                                buf,
1030                                len,
1031                                auth->cksum);
1032     free(buf);
1033     krb5_crypto_destroy(context, crypto);
1034     if(ret){
1035         const char *msg = krb5_get_error_message(context, ret);
1036         kdc_log(context, config, 0,
1037                 "Failed to verify authenticator checksum: %s", msg);
1038         krb5_free_error_message(context, msg);
1039     }
1040 out:
1041     free_Authenticator(auth);
1042     free(auth);
1043     return ret;
1044 }
1045
1046 /*
1047  *
1048  */
1049
1050 static const char *
1051 find_rpath(krb5_context context, Realm crealm, Realm srealm)
1052 {
1053     const char *new_realm = krb5_config_get_string(context,
1054                                                    NULL,
1055                                                    "capaths",
1056                                                    crealm,
1057                                                    srealm,
1058                                                    NULL);
1059     return new_realm;
1060 }
1061
1062
1063 static krb5_boolean
1064 need_referral(krb5_context context, krb5_kdc_configuration *config,
1065               const KDCOptions * const options, krb5_principal server,
1066               krb5_realm **realms)
1067 {
1068     const char *name;
1069
1070     if(!options->canonicalize && server->name.name_type != KRB5_NT_SRV_INST)
1071         return FALSE;
1072
1073     if (server->name.name_string.len == 1)
1074         name = server->name.name_string.val[0];
1075     else if (server->name.name_string.len > 1)
1076         name = server->name.name_string.val[1];
1077     else
1078         return FALSE;
1079
1080     kdc_log(context, config, 0, "Searching referral for %s", name);
1081
1082     return _krb5_get_host_realm_int(context, name, FALSE, realms) == 0;
1083 }
1084
1085 static krb5_error_code
1086 tgs_parse_request(krb5_context context,
1087                   krb5_kdc_configuration *config,
1088                   KDC_REQ_BODY *b,
1089                   const PA_DATA *tgs_req,
1090                   hdb_entry_ex **krbtgt,
1091                   krb5_enctype *krbtgt_etype,
1092                   krb5_ticket **ticket,
1093                   const char **e_text,
1094                   const char *from,
1095                   const struct sockaddr *from_addr,
1096                   time_t **csec,
1097                   int **cusec,
1098                   AuthorizationData **auth_data,
1099                   krb5_keyblock **replykey,
1100                   int *rk_is_subkey)
1101 {
1102     krb5_ap_req ap_req;
1103     krb5_error_code ret;
1104     krb5_principal princ;
1105     krb5_auth_context ac = NULL;
1106     krb5_flags ap_req_options;
1107     krb5_flags verify_ap_req_flags;
1108     krb5_crypto crypto;
1109     Key *tkey;
1110     krb5_keyblock *subkey = NULL;
1111     unsigned usage;
1112
1113     *auth_data = NULL;
1114     *csec  = NULL;
1115     *cusec = NULL;
1116     *replykey = NULL;
1117
1118     memset(&ap_req, 0, sizeof(ap_req));
1119     ret = krb5_decode_ap_req(context, &tgs_req->padata_value, &ap_req);
1120     if(ret){
1121         const char *msg = krb5_get_error_message(context, ret);
1122         kdc_log(context, config, 0, "Failed to decode AP-REQ: %s", msg);
1123         krb5_free_error_message(context, msg);
1124         goto out;
1125     }
1126
1127     if(!get_krbtgt_realm(&ap_req.ticket.sname)){
1128         /* XXX check for ticket.sname == req.sname */
1129         kdc_log(context, config, 0, "PA-DATA is not a ticket-granting ticket");
1130         ret = KRB5KDC_ERR_POLICY; /* ? */
1131         goto out;
1132     }
1133
1134     _krb5_principalname2krb5_principal(context,
1135                                        &princ,
1136                                        ap_req.ticket.sname,
1137                                        ap_req.ticket.realm);
1138
1139     ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT, NULL, krbtgt);
1140
1141     if(ret) {
1142         const char *msg = krb5_get_error_message(context, ret);
1143         char *p;
1144         ret = krb5_unparse_name(context, princ, &p);
1145         if (ret != 0)
1146             p = "<unparse_name failed>";
1147         krb5_free_principal(context, princ);
1148         kdc_log(context, config, 0,
1149                 "Ticket-granting ticket not found in database: %s", msg);
1150         krb5_free_error_message(context, msg);
1151         if (ret == 0)
1152             free(p);
1153         ret = KRB5KRB_AP_ERR_NOT_US;
1154         goto out;
1155     }
1156
1157     if(ap_req.ticket.enc_part.kvno &&
1158        *ap_req.ticket.enc_part.kvno != (*krbtgt)->entry.kvno){
1159         char *p;
1160
1161         ret = krb5_unparse_name (context, princ, &p);
1162         krb5_free_principal(context, princ);
1163         if (ret != 0)
1164             p = "<unparse_name failed>";
1165         kdc_log(context, config, 0,
1166                 "Ticket kvno = %d, DB kvno = %d (%s)",
1167                 *ap_req.ticket.enc_part.kvno,
1168                 (*krbtgt)->entry.kvno,
1169                 p);
1170         if (ret == 0)
1171             free (p);
1172         ret = KRB5KRB_AP_ERR_BADKEYVER;
1173         goto out;
1174     }
1175
1176     *krbtgt_etype = ap_req.ticket.enc_part.etype;
1177
1178     ret = hdb_enctype2key(context, &(*krbtgt)->entry,
1179                           ap_req.ticket.enc_part.etype, &tkey);
1180     if(ret){
1181         char *str = NULL, *p = NULL;
1182
1183         krb5_enctype_to_string(context, ap_req.ticket.enc_part.etype, &str);
1184         krb5_unparse_name(context, princ, &p);
1185         kdc_log(context, config, 0,
1186                 "No server key with enctype %s found for %s",
1187                 str ? str : "<unknown enctype>",
1188                 p ? p : "<unparse_name failed>");
1189         free(str);
1190         free(p);
1191         ret = KRB5KRB_AP_ERR_BADKEYVER;
1192         goto out;
1193     }
1194
1195     if (b->kdc_options.validate)
1196         verify_ap_req_flags = KRB5_VERIFY_AP_REQ_IGNORE_INVALID;
1197     else
1198         verify_ap_req_flags = 0;
1199
1200     ret = krb5_verify_ap_req2(context,
1201                               &ac,
1202                               &ap_req,
1203                               princ,
1204                               &tkey->key,
1205                               verify_ap_req_flags,
1206                               &ap_req_options,
1207                               ticket,
1208                               KRB5_KU_TGS_REQ_AUTH);
1209
1210     krb5_free_principal(context, princ);
1211     if(ret) {
1212         const char *msg = krb5_get_error_message(context, ret);
1213         kdc_log(context, config, 0, "Failed to verify AP-REQ: %s", msg);
1214         krb5_free_error_message(context, msg);
1215         goto out;
1216     }
1217
1218     {
1219         krb5_authenticator auth;
1220
1221         ret = krb5_auth_con_getauthenticator(context, ac, &auth);
1222         if (ret == 0) {
1223             *csec   = malloc(sizeof(**csec));
1224             if (*csec == NULL) {
1225                 krb5_free_authenticator(context, &auth);
1226                 kdc_log(context, config, 0, "malloc failed");
1227                 goto out;
1228             }
1229             **csec  = auth->ctime;
1230             *cusec  = malloc(sizeof(**cusec));
1231             if (*cusec == NULL) {
1232                 krb5_free_authenticator(context, &auth);
1233                 kdc_log(context, config, 0, "malloc failed");
1234                 goto out;
1235             }
1236             **cusec  = auth->cusec;
1237             krb5_free_authenticator(context, &auth);
1238         }
1239     }
1240
1241     ret = tgs_check_authenticator(context, config,
1242                                   ac, b, e_text, &(*ticket)->ticket.key);
1243     if (ret) {
1244         krb5_auth_con_free(context, ac);
1245         goto out;
1246     }
1247
1248     usage = KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY;
1249     *rk_is_subkey = 1;
1250
1251     ret = krb5_auth_con_getremotesubkey(context, ac, &subkey);
1252     if(ret){
1253         const char *msg = krb5_get_error_message(context, ret);
1254         krb5_auth_con_free(context, ac);
1255         kdc_log(context, config, 0, "Failed to get remote subkey: %s", msg);
1256         krb5_free_error_message(context, msg);
1257         goto out;
1258     }
1259     if(subkey == NULL){
1260         usage = KRB5_KU_TGS_REQ_AUTH_DAT_SESSION;
1261         *rk_is_subkey = 0;
1262
1263         ret = krb5_auth_con_getkey(context, ac, &subkey);
1264         if(ret) {
1265             const char *msg = krb5_get_error_message(context, ret);
1266             krb5_auth_con_free(context, ac);
1267             kdc_log(context, config, 0, "Failed to get session key: %s", msg);
1268             krb5_free_error_message(context, msg);
1269             goto out;
1270         }
1271     }
1272     if(subkey == NULL){
1273         krb5_auth_con_free(context, ac);
1274         kdc_log(context, config, 0,
1275                 "Failed to get key for enc-authorization-data");
1276         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1277         goto out;
1278     }
1279
1280     *replykey = subkey;
1281
1282     if (b->enc_authorization_data) {
1283         krb5_data ad;
1284
1285         ret = krb5_crypto_init(context, subkey, 0, &crypto);
1286         if (ret) {
1287             const char *msg = krb5_get_error_message(context, ret);
1288             krb5_auth_con_free(context, ac);
1289             kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1290             krb5_free_error_message(context, msg);
1291             goto out;
1292         }
1293         ret = krb5_decrypt_EncryptedData (context,
1294                                           crypto,
1295                                           usage,
1296                                           b->enc_authorization_data,
1297                                           &ad);
1298         krb5_crypto_destroy(context, crypto);
1299         if(ret){
1300             krb5_auth_con_free(context, ac);
1301             kdc_log(context, config, 0,
1302                     "Failed to decrypt enc-authorization-data");
1303             ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1304             goto out;
1305         }
1306         ALLOC(*auth_data);
1307         if (*auth_data == NULL) {
1308             krb5_auth_con_free(context, ac);
1309             ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1310             goto out;
1311         }
1312         ret = decode_AuthorizationData(ad.data, ad.length, *auth_data, NULL);
1313         if(ret){
1314             krb5_auth_con_free(context, ac);
1315             free(*auth_data);
1316             *auth_data = NULL;
1317             kdc_log(context, config, 0, "Failed to decode authorization data");
1318             ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1319             goto out;
1320         }
1321     }
1322
1323     krb5_auth_con_free(context, ac);
1324
1325 out:
1326     free_AP_REQ(&ap_req);
1327
1328     return ret;
1329 }
1330
1331 static krb5_error_code
1332 build_server_referral(krb5_context context,
1333                       krb5_kdc_configuration *config,
1334                       krb5_crypto session,
1335                       krb5_const_realm referred_realm,
1336                       const PrincipalName *true_principal_name,
1337                       const PrincipalName *requested_principal,
1338                       krb5_data *outdata)
1339 {
1340     PA_ServerReferralData ref;
1341     krb5_error_code ret;
1342     EncryptedData ed;
1343     krb5_data data;
1344     size_t size;
1345
1346     memset(&ref, 0, sizeof(ref));
1347
1348     if (referred_realm) {
1349         ALLOC(ref.referred_realm);
1350         if (ref.referred_realm == NULL)
1351             goto eout;
1352         *ref.referred_realm = strdup(referred_realm);
1353         if (*ref.referred_realm == NULL)
1354             goto eout;
1355     }
1356     if (true_principal_name) {
1357         ALLOC(ref.true_principal_name);
1358         if (ref.true_principal_name == NULL)
1359             goto eout;
1360         ret = copy_PrincipalName(true_principal_name, ref.true_principal_name);
1361         if (ret)
1362             goto eout;
1363     }
1364     if (requested_principal) {
1365         ALLOC(ref.requested_principal_name);
1366         if (ref.requested_principal_name == NULL)
1367             goto eout;
1368         ret = copy_PrincipalName(requested_principal,
1369                                  ref.requested_principal_name);
1370         if (ret)
1371             goto eout;
1372     }
1373
1374     ASN1_MALLOC_ENCODE(PA_ServerReferralData,
1375                        data.data, data.length,
1376                        &ref, &size, ret);
1377     free_PA_ServerReferralData(&ref);
1378     if (ret)
1379         return ret;
1380     if (data.length != size)
1381         krb5_abortx(context, "internal asn.1 encoder error");
1382
1383     ret = krb5_encrypt_EncryptedData(context, session,
1384                                      KRB5_KU_PA_SERVER_REFERRAL,
1385                                      data.data, data.length,
1386                                      0 /* kvno */, &ed);
1387     free(data.data);
1388     if (ret)
1389         return ret;
1390
1391     ASN1_MALLOC_ENCODE(EncryptedData,
1392                        outdata->data, outdata->length,
1393                        &ed, &size, ret);
1394     free_EncryptedData(&ed);
1395     if (ret)
1396         return ret;
1397     if (outdata->length != size)
1398         krb5_abortx(context, "internal asn.1 encoder error");
1399
1400     return 0;
1401 eout:
1402     free_PA_ServerReferralData(&ref);
1403     krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1404     return ENOMEM;
1405 }
1406
1407 static krb5_error_code
1408 tgs_build_reply(krb5_context context,
1409                 krb5_kdc_configuration *config,
1410                 KDC_REQ *req,
1411                 KDC_REQ_BODY *b,
1412                 hdb_entry_ex *krbtgt,
1413                 krb5_enctype krbtgt_etype,
1414                 const krb5_keyblock *replykey,
1415                 int rk_is_subkey,
1416                 krb5_ticket *ticket,
1417                 krb5_data *reply,
1418                 const char *from,
1419                 const char **e_text,
1420                 AuthorizationData **auth_data,
1421                 const struct sockaddr *from_addr)
1422 {
1423     krb5_error_code ret;
1424     krb5_principal cp = NULL, sp = NULL;
1425     krb5_principal client_principal = NULL;
1426     char *spn = NULL, *cpn = NULL;
1427     hdb_entry_ex *server = NULL, *client = NULL;
1428     HDB *clientdb;
1429     krb5_realm ref_realm = NULL;
1430     EncTicketPart *tgt = &ticket->ticket;
1431     krb5_principals spp = NULL;
1432     const EncryptionKey *ekey;
1433     krb5_keyblock sessionkey;
1434     krb5_kvno kvno;
1435     krb5_data rspac;
1436
1437     METHOD_DATA enc_pa_data;
1438
1439     PrincipalName *s;
1440     Realm r;
1441     int nloop = 0;
1442     EncTicketPart adtkt;
1443     char opt_str[128];
1444     int signedpath = 0;
1445
1446     Key *tkey;
1447
1448     memset(&sessionkey, 0, sizeof(sessionkey));
1449     memset(&adtkt, 0, sizeof(adtkt));
1450     krb5_data_zero(&rspac);
1451     memset(&enc_pa_data, 0, sizeof(enc_pa_data));
1452
1453     s = b->sname;
1454     r = b->realm;
1455
1456     if(b->kdc_options.enc_tkt_in_skey){
1457         Ticket *t;
1458         hdb_entry_ex *uu;
1459         krb5_principal p;
1460         Key *uukey;
1461
1462         if(b->additional_tickets == NULL ||
1463            b->additional_tickets->len == 0){
1464             ret = KRB5KDC_ERR_BADOPTION; /* ? */
1465             kdc_log(context, config, 0,
1466                     "No second ticket present in request");
1467             goto out;
1468         }
1469         t = &b->additional_tickets->val[0];
1470         if(!get_krbtgt_realm(&t->sname)){
1471             kdc_log(context, config, 0,
1472                     "Additional ticket is not a ticket-granting ticket");
1473             ret = KRB5KDC_ERR_POLICY;
1474             goto out;
1475         }
1476         _krb5_principalname2krb5_principal(context, &p, t->sname, t->realm);
1477         ret = _kdc_db_fetch(context, config, p,
1478                             HDB_F_GET_CLIENT|HDB_F_GET_SERVER,
1479                             NULL, &uu);
1480         krb5_free_principal(context, p);
1481         if(ret){
1482             if (ret == HDB_ERR_NOENTRY)
1483                 ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1484             goto out;
1485         }
1486         ret = hdb_enctype2key(context, &uu->entry,
1487                               t->enc_part.etype, &uukey);
1488         if(ret){
1489             _kdc_free_ent(context, uu);
1490             ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
1491             goto out;
1492         }
1493         ret = krb5_decrypt_ticket(context, t, &uukey->key, &adtkt, 0);
1494         _kdc_free_ent(context, uu);
1495         if(ret)
1496             goto out;
1497
1498         ret = verify_flags(context, config, &adtkt, spn);
1499         if (ret)
1500             goto out;
1501
1502         s = &adtkt.cname;
1503         r = adtkt.crealm;
1504     }
1505
1506     _krb5_principalname2krb5_principal(context, &sp, *s, r);
1507     ret = krb5_unparse_name(context, sp, &spn);
1508     if (ret)
1509         goto out;
1510     _krb5_principalname2krb5_principal(context, &cp, tgt->cname, tgt->crealm);
1511     ret = krb5_unparse_name(context, cp, &cpn);
1512     if (ret)
1513         goto out;
1514     unparse_flags (KDCOptions2int(b->kdc_options),
1515                    asn1_KDCOptions_units(),
1516                    opt_str, sizeof(opt_str));
1517     if(*opt_str)
1518         kdc_log(context, config, 0,
1519                 "TGS-REQ %s from %s for %s [%s]",
1520                 cpn, from, spn, opt_str);
1521     else
1522         kdc_log(context, config, 0,
1523                 "TGS-REQ %s from %s for %s", cpn, from, spn);
1524
1525     /*
1526      * Fetch server
1527      */
1528
1529 server_lookup:
1530     ret = _kdc_db_fetch(context, config, sp, HDB_F_GET_SERVER | HDB_F_CANON,
1531                         NULL, &server);
1532
1533     if(ret){
1534         const char *new_rlm, *msg;
1535         Realm req_rlm;
1536         krb5_realm *realms;
1537
1538         if ((req_rlm = get_krbtgt_realm(&sp->name)) != NULL) {
1539             if(nloop++ < 2) {
1540                 new_rlm = find_rpath(context, tgt->crealm, req_rlm);
1541                 if(new_rlm) {
1542                     kdc_log(context, config, 5, "krbtgt for realm %s "
1543                             "not found, trying %s",
1544                             req_rlm, new_rlm);
1545                     krb5_free_principal(context, sp);
1546                     free(spn);
1547                     krb5_make_principal(context, &sp, r,
1548                                         KRB5_TGS_NAME, new_rlm, NULL);
1549                     ret = krb5_unparse_name(context, sp, &spn);
1550                     if (ret)
1551                         goto out;
1552
1553                     if (ref_realm)
1554                         free(ref_realm);
1555                     ref_realm = strdup(new_rlm);
1556                     goto server_lookup;
1557                 }
1558             }
1559         } else if(need_referral(context, config, &b->kdc_options, sp, &realms)) {
1560             if (strcmp(realms[0], sp->realm) != 0) {
1561                 kdc_log(context, config, 5,
1562                         "Returning a referral to realm %s for "
1563                         "server %s that was not found",
1564                         realms[0], spn);
1565                 krb5_free_principal(context, sp);
1566                 free(spn);
1567                 krb5_make_principal(context, &sp, r, KRB5_TGS_NAME,
1568                                     realms[0], NULL);
1569                 ret = krb5_unparse_name(context, sp, &spn);
1570                 if (ret)
1571                     goto out;
1572
1573                 if (ref_realm)
1574                     free(ref_realm);
1575                 ref_realm = strdup(realms[0]);
1576
1577                 krb5_free_host_realm(context, realms);
1578                 goto server_lookup;
1579             }
1580             krb5_free_host_realm(context, realms);
1581         }
1582         msg = krb5_get_error_message(context, ret);
1583         kdc_log(context, config, 0,
1584                 "Server not found in database: %s: %s", spn, msg);
1585         krb5_free_error_message(context, msg);
1586         if (ret == HDB_ERR_NOENTRY)
1587             ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1588         goto out;
1589     }
1590
1591     ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT | HDB_F_CANON,
1592                         &clientdb, &client);
1593     if(ret) {
1594         const char *krbtgt_realm, *msg;
1595
1596         /*
1597          * If the client belongs to the same realm as our krbtgt, it
1598          * should exist in the local database.
1599          *
1600          */
1601
1602         krbtgt_realm =
1603             krb5_principal_get_comp_string(context,
1604                                            krbtgt->entry.principal, 1);
1605
1606         if(strcmp(krb5_principal_get_realm(context, cp), krbtgt_realm) == 0) {
1607             if (ret == HDB_ERR_NOENTRY)
1608                 ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
1609             kdc_log(context, config, 1, "Client no longer in database: %s",
1610                     cpn);
1611             goto out;
1612         }
1613
1614         msg = krb5_get_error_message(context, ret);
1615         kdc_log(context, config, 1, "Client not found in database: %s", msg);
1616         krb5_free_error_message(context, msg);
1617     }
1618
1619     /*
1620      * Select enctype, return key and kvno.
1621      */
1622
1623     {
1624         krb5_enctype etype;
1625
1626         if(b->kdc_options.enc_tkt_in_skey) {
1627             int i;
1628             ekey = &adtkt.key;
1629             for(i = 0; i < b->etype.len; i++)
1630                 if (b->etype.val[i] == adtkt.key.keytype)
1631                     break;
1632             if(i == b->etype.len) {
1633                 kdc_log(context, config, 0,
1634                         "Addition ticket have not matching etypes");
1635                 krb5_clear_error_message(context);
1636                 ret = KRB5KDC_ERR_ETYPE_NOSUPP;
1637                 goto out;
1638             }
1639             etype = b->etype.val[i];
1640             kvno = 0;
1641         } else {
1642             Key *skey;
1643
1644             ret = _kdc_find_etype(context, server,
1645                                   b->etype.val, b->etype.len, &skey);
1646             if(ret) {
1647                 kdc_log(context, config, 0,
1648                         "Server (%s) has no support for etypes", spn);
1649                 goto out;
1650             }
1651             ekey = &skey->key;
1652             etype = skey->key.keytype;
1653             kvno = server->entry.kvno;
1654         }
1655
1656         ret = krb5_generate_random_keyblock(context, etype, &sessionkey);
1657         if (ret)
1658             goto out;
1659     }
1660
1661     /*
1662      * Check that service is in the same realm as the krbtgt. If it's
1663      * not the same, it's someone that is using a uni-directional trust
1664      * backward.
1665      */
1666
1667     if (strcmp(krb5_principal_get_realm(context, sp),
1668                krb5_principal_get_comp_string(context,
1669                                               krbtgt->entry.principal,
1670                                               1)) != 0) {
1671         char *tpn;
1672         ret = krb5_unparse_name(context, krbtgt->entry.principal, &tpn);
1673         kdc_log(context, config, 0,
1674                 "Request with wrong krbtgt: %s",
1675                 (ret == 0) ? tpn : "<unknown>");
1676         if(ret == 0)
1677             free(tpn);
1678         ret = KRB5KRB_AP_ERR_NOT_US;
1679         goto out;
1680     }
1681
1682     /*
1683      * Validate authoriation data
1684      */
1685
1686     ret = hdb_enctype2key(context, &krbtgt->entry,
1687                           krbtgt_etype, &tkey);
1688     if(ret) {
1689         kdc_log(context, config, 0,
1690                     "Failed to find key for krbtgt PAC check");
1691         goto out;
1692     }
1693
1694     ret = check_PAC(context, config, cp,
1695                     client, server, ekey, &tkey->key,
1696                     tgt, &rspac, &signedpath);
1697     if (ret) {
1698         const char *msg = krb5_get_error_message(context, ret);
1699         kdc_log(context, config, 0,
1700                 "Verify PAC failed for %s (%s) from %s with %s",
1701                 spn, cpn, from, msg);
1702         krb5_free_error_message(context, msg);
1703         goto out;
1704     }
1705
1706     /* also check the krbtgt for signature */
1707     ret = check_KRB5SignedPath(context,
1708                                config,
1709                                krbtgt,
1710                                cp,
1711                                tgt,
1712                                &spp,
1713                                &signedpath);
1714     if (ret) {
1715         const char *msg = krb5_get_error_message(context, ret);
1716         kdc_log(context, config, 0,
1717                 "KRB5SignedPath check failed for %s (%s) from %s with %s",
1718                 spn, cpn, from, msg);
1719         krb5_free_error_message(context, msg);
1720         goto out;
1721     }
1722
1723     /*
1724      * Process request
1725      */
1726
1727     client_principal = cp;
1728
1729     if (client) {
1730         const PA_DATA *sdata;
1731         int i = 0;
1732
1733         sdata = _kdc_find_padata(req, &i, KRB5_PADATA_FOR_USER);
1734         if (sdata) {
1735             krb5_crypto crypto;
1736             krb5_data datack;
1737             PA_S4U2Self self;
1738             char *selfcpn = NULL;
1739             const char *str;
1740
1741             ret = decode_PA_S4U2Self(sdata->padata_value.data,
1742                                      sdata->padata_value.length,
1743                                      &self, NULL);
1744             if (ret) {
1745                 kdc_log(context, config, 0, "Failed to decode PA-S4U2Self");
1746                 goto out;
1747             }
1748
1749             ret = _krb5_s4u2self_to_checksumdata(context, &self, &datack);
1750             if (ret)
1751                 goto out;
1752
1753             ret = krb5_crypto_init(context, &tgt->key, 0, &crypto);
1754             if (ret) {
1755                 const char *msg = krb5_get_error_message(context, ret);
1756                 free_PA_S4U2Self(&self);
1757                 krb5_data_free(&datack);
1758                 kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1759                 krb5_free_error_message(context, msg);
1760                 goto out;
1761             }
1762
1763             ret = krb5_verify_checksum(context,
1764                                        crypto,
1765                                        KRB5_KU_OTHER_CKSUM,
1766                                        datack.data,
1767                                        datack.length,
1768                                        &self.cksum);
1769             krb5_data_free(&datack);
1770             krb5_crypto_destroy(context, crypto);
1771             if (ret) {
1772                 const char *msg = krb5_get_error_message(context, ret);
1773                 free_PA_S4U2Self(&self);
1774                 kdc_log(context, config, 0,
1775                         "krb5_verify_checksum failed for S4U2Self: %s", msg);
1776                 krb5_free_error_message(context, msg);
1777                 goto out;
1778             }
1779
1780             ret = _krb5_principalname2krb5_principal(context,
1781                                                      &client_principal,
1782                                                      self.name,
1783                                                      self.realm);
1784             free_PA_S4U2Self(&self);
1785             if (ret)
1786                 goto out;
1787
1788             ret = krb5_unparse_name(context, client_principal, &selfcpn);
1789             if (ret)
1790                 goto out;
1791
1792             /*
1793              * Check that service doing the impersonating is
1794              * requesting a ticket to it-self.
1795              */
1796             if (krb5_principal_compare(context, cp, sp) != TRUE) {
1797                 kdc_log(context, config, 0, "S4U2Self: %s is not allowed "
1798                         "to impersonate some other user "
1799                         "(tried for user %s to service %s)",
1800                         cpn, selfcpn, spn);
1801                 free(selfcpn);
1802                 ret = KRB5KDC_ERR_BADOPTION; /* ? */
1803                 goto out;
1804             }
1805
1806             /*
1807              * If the service isn't trusted for authentication to
1808              * delegation, remove the forward flag.
1809              */
1810
1811             if (client->entry.flags.trusted_for_delegation) {
1812                 str = "[forwardable]";
1813             } else {
1814                 b->kdc_options.forwardable = 0;
1815                 str = "";
1816             }
1817             kdc_log(context, config, 0, "s4u2self %s impersonating %s to "
1818                     "service %s %s", cpn, selfcpn, spn, str);
1819             free(selfcpn);
1820         }
1821     }
1822
1823     /*
1824      * Constrained delegation
1825      */
1826
1827     if (client != NULL
1828         && b->additional_tickets != NULL
1829         && b->additional_tickets->len != 0
1830         && b->kdc_options.enc_tkt_in_skey == 0)
1831     {
1832         int ad_signedpath = 0;
1833         Key *clientkey;
1834         Ticket *t;
1835         char *str;
1836
1837         /*
1838          * Require that the KDC have issued the service's krbtgt (not
1839          * self-issued ticket with kimpersonate(1).
1840          */
1841         if (!signedpath) {
1842             ret = KRB5KDC_ERR_BADOPTION;
1843             kdc_log(context, config, 0,
1844                     "Constrained delegation done on service ticket %s/%s",
1845                     cpn, spn);
1846             goto out;
1847         }
1848
1849         t = &b->additional_tickets->val[0];
1850
1851         ret = hdb_enctype2key(context, &client->entry,
1852                               t->enc_part.etype, &clientkey);
1853         if(ret){
1854             ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
1855             goto out;
1856         }
1857
1858         ret = krb5_decrypt_ticket(context, t, &clientkey->key, &adtkt, 0);
1859         if (ret) {
1860             kdc_log(context, config, 0,
1861                     "failed to decrypt ticket for "
1862                     "constrained delegation from %s to %s ", cpn, spn);
1863             goto out;
1864         }
1865
1866         /* check that ticket is valid */
1867         if (adtkt.flags.forwardable == 0) {
1868             kdc_log(context, config, 0,
1869                     "Missing forwardable flag on ticket for "
1870                     "constrained delegation from %s to %s ", cpn, spn);
1871             ret = KRB5KDC_ERR_BADOPTION;
1872             goto out;
1873         }
1874
1875         ret = check_constrained_delegation(context, config, clientdb,
1876                                            client, sp);
1877         if (ret) {
1878             kdc_log(context, config, 0,
1879                     "constrained delegation from %s to %s not allowed",
1880                     cpn, spn);
1881             goto out;
1882         }
1883
1884         ret = _krb5_principalname2krb5_principal(context,
1885                                                  &client_principal,
1886                                                  adtkt.cname,
1887                                                  adtkt.crealm);
1888         if (ret)
1889             goto out;
1890
1891         ret = krb5_unparse_name(context, client_principal, &str);
1892         if (ret)
1893             goto out;
1894
1895         ret = verify_flags(context, config, &adtkt, str);
1896         if (ret) {
1897             free(str);
1898             goto out;
1899         }
1900
1901         /*
1902          * Check that the KDC issued the user's ticket.
1903          */
1904         ret = check_KRB5SignedPath(context,
1905                                    config,
1906                                    krbtgt,
1907                                    cp,
1908                                    &adtkt,
1909                                    NULL,
1910                                    &ad_signedpath);
1911         if (ret == 0 && !ad_signedpath)
1912             ret = KRB5KDC_ERR_BADOPTION;
1913         if (ret) {
1914             const char *msg = krb5_get_error_message(context, ret);
1915             kdc_log(context, config, 0,
1916                     "KRB5SignedPath check from service %s failed "
1917                     "for delegation to %s for client %s "
1918                     "from %s failed with %s",
1919                     spn, str, cpn, from, msg);
1920             krb5_free_error_message(context, msg);
1921             free(str);
1922             goto out;
1923         }
1924
1925         kdc_log(context, config, 0, "constrained delegation for %s "
1926                 "from %s to %s", str, cpn, spn);
1927         free(str);
1928     }
1929
1930     /*
1931      * Check flags
1932      */
1933
1934     ret = kdc_check_flags(context, config,
1935                           client, cpn,
1936                           server, spn,
1937                           FALSE);
1938     if(ret)
1939         goto out;
1940
1941     if((b->kdc_options.validate || b->kdc_options.renew) &&
1942        !krb5_principal_compare(context,
1943                                krbtgt->entry.principal,
1944                                server->entry.principal)){
1945         kdc_log(context, config, 0, "Inconsistent request.");
1946         ret = KRB5KDC_ERR_SERVER_NOMATCH;
1947         goto out;
1948     }
1949
1950     /* check for valid set of addresses */
1951     if(!_kdc_check_addresses(context, config, tgt->caddr, from_addr)) {
1952         ret = KRB5KRB_AP_ERR_BADADDR;
1953         kdc_log(context, config, 0, "Request from wrong address");
1954         goto out;
1955     }
1956
1957     /*
1958      * If this is an referral, add server referral data to the
1959      * auth_data reply .
1960      */
1961     if (ref_realm) {
1962         PA_DATA pa;
1963         krb5_crypto crypto;
1964
1965         kdc_log(context, config, 0,
1966                 "Adding server referral to %s", ref_realm);
1967
1968         ret = krb5_crypto_init(context, &sessionkey, 0, &crypto);
1969         if (ret)
1970             goto out;
1971
1972         ret = build_server_referral(context, config, crypto, ref_realm,
1973                                     NULL, s, &pa.padata_value);
1974         krb5_crypto_destroy(context, crypto);
1975         if (ret) {
1976             kdc_log(context, config, 0,
1977                     "Failed building server referral");
1978             goto out;
1979         }
1980         pa.padata_type = KRB5_PADATA_SERVER_REFERRAL;
1981
1982         ret = add_METHOD_DATA(&enc_pa_data, &pa);
1983         krb5_data_free(&pa.padata_value);
1984         if (ret) {
1985             kdc_log(context, config, 0,
1986                     "Add server referral METHOD-DATA failed");
1987             goto out;
1988         }
1989     }
1990
1991     /*
1992      *
1993      */
1994
1995     ret = tgs_make_reply(context,
1996                          config,
1997                          b,
1998                          client_principal,
1999                          tgt,
2000                          replykey,
2001                          rk_is_subkey,
2002                          ekey,
2003                          &sessionkey,
2004                          kvno,
2005                          *auth_data,
2006                          server,
2007                          sp,
2008                          spn,
2009                          client,
2010                          cp,
2011                          krbtgt,
2012                          krbtgt_etype,
2013                          spp,
2014                          &rspac,
2015                          &enc_pa_data,
2016                          e_text,
2017                          reply);
2018
2019 out:
2020     free(spn);
2021     free(cpn);
2022
2023     krb5_data_free(&rspac);
2024     krb5_free_keyblock_contents(context, &sessionkey);
2025     if(server)
2026         _kdc_free_ent(context, server);
2027     if(client)
2028         _kdc_free_ent(context, client);
2029
2030     if (client_principal && client_principal != cp)
2031         krb5_free_principal(context, client_principal);
2032     if (cp)
2033         krb5_free_principal(context, cp);
2034     if (sp)
2035         krb5_free_principal(context, sp);
2036     if (ref_realm)
2037         free(ref_realm);
2038     free_METHOD_DATA(&enc_pa_data);
2039
2040     free_EncTicketPart(&adtkt);
2041
2042     return ret;
2043 }
2044
2045 /*
2046  *
2047  */
2048
2049 krb5_error_code
2050 _kdc_tgs_rep(krb5_context context,
2051              krb5_kdc_configuration *config,
2052              KDC_REQ *req,
2053              krb5_data *data,
2054              const char *from,
2055              struct sockaddr *from_addr,
2056              int datagram_reply)
2057 {
2058     AuthorizationData *auth_data = NULL;
2059     krb5_error_code ret;
2060     int i = 0;
2061     const PA_DATA *tgs_req;
2062
2063     hdb_entry_ex *krbtgt = NULL;
2064     krb5_ticket *ticket = NULL;
2065     const char *e_text = NULL;
2066     krb5_enctype krbtgt_etype = ETYPE_NULL;
2067
2068     krb5_keyblock *replykey = NULL;
2069     int rk_is_subkey = 0;
2070     time_t *csec = NULL;
2071     int *cusec = NULL;
2072
2073     if(req->padata == NULL){
2074         ret = KRB5KDC_ERR_PREAUTH_REQUIRED; /* XXX ??? */
2075         kdc_log(context, config, 0,
2076                 "TGS-REQ from %s without PA-DATA", from);
2077         goto out;
2078     }
2079
2080     tgs_req = _kdc_find_padata(req, &i, KRB5_PADATA_TGS_REQ);
2081
2082     if(tgs_req == NULL){
2083         ret = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
2084
2085         kdc_log(context, config, 0,
2086                 "TGS-REQ from %s without PA-TGS-REQ", from);
2087         goto out;
2088     }
2089     ret = tgs_parse_request(context, config,
2090                             &req->req_body, tgs_req,
2091                             &krbtgt,
2092                             &krbtgt_etype,
2093                             &ticket,
2094                             &e_text,
2095                             from, from_addr,
2096                             &csec, &cusec,
2097                             &auth_data,
2098                             &replykey,
2099                             &rk_is_subkey);
2100     if (ret) {
2101         kdc_log(context, config, 0,
2102                 "Failed parsing TGS-REQ from %s", from);
2103         goto out;
2104     }
2105
2106     ret = tgs_build_reply(context,
2107                           config,
2108                           req,
2109                           &req->req_body,
2110                           krbtgt,
2111                           krbtgt_etype,
2112                           replykey,
2113                           rk_is_subkey,
2114                           ticket,
2115                           data,
2116                           from,
2117                           &e_text,
2118                           &auth_data,
2119                           from_addr);
2120     if (ret) {
2121         kdc_log(context, config, 0,
2122                 "Failed building TGS-REP to %s", from);
2123         goto out;
2124     }
2125
2126     /* */
2127     if (datagram_reply && data->length > config->max_datagram_reply_length) {
2128         krb5_data_free(data);
2129         ret = KRB5KRB_ERR_RESPONSE_TOO_BIG;
2130         e_text = "Reply packet too large";
2131     }
2132
2133 out:
2134     if (replykey)
2135         krb5_free_keyblock(context, replykey);
2136     if(ret && data->data == NULL){
2137         krb5_mk_error(context,
2138                       ret,
2139                       NULL,
2140                       NULL,
2141                       NULL,
2142                       NULL,
2143                       csec,
2144                       cusec,
2145                       data);
2146     }
2147     free(csec);
2148     free(cusec);
2149     if (ticket)
2150         krb5_free_ticket(context, ticket);
2151     if(krbtgt)
2152         _kdc_free_ent(context, krbtgt);
2153
2154     if (auth_data) {
2155         free_AuthorizationData(auth_data);
2156         free(auth_data);
2157     }
2158
2159     return 0;
2160 }