2 * Copyright (c) 1997 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. All advertising materials mentioning features or use of this software
18 * must display the following acknowledgement:
19 * This product includes software developed by Kungliga Tekniska
20 * Högskolan and its contributors.
22 * 4. Neither the name of the Institute nor the names of its contributors
23 * may be used to endorse or promote products derived from this software
24 * without specific prior written permission.
26 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
45 do_524(Ticket
*t
, krb5_data
*reply
, const char *from
)
48 krb5_principal sprinc
= NULL
;
50 Key
*skey
, *ekey
= NULL
;
56 unsigned char buf
[MAX_KTXT_LEN
+ 4 * 4];
59 principalname2krb5_principal(&sprinc
, t
->sname
, t
->realm
);
60 krb5_unparse_name(context
, sprinc
, &spn
);
61 server
= db_fetch(sprinc
);
63 kdc_log(0, "Request to convert ticket from %s for unknown principal %s",
67 ret
= hdb_etype2key(context
, server
, t
->enc_part
.etype
, &skey
);
69 kdc_log(0, "No suitable key found for server (%s) "
70 "when converting ticket from ", spn
, from
);
73 ekey
= unseal_key(skey
);
74 ret
= krb5_decrypt (context
,
75 t
->enc_part
.cipher
.data
,
76 t
->enc_part
.cipher
.length
,
82 kdc_log(0, "Failed to decrypt ticket from %s for %s", from
, spn
);
85 ret
= decode_EncTicketPart(et_data
.data
, et_data
.length
, &et
, &len
);
86 krb5_data_free(&et_data
);
88 kdc_log(0, "Failed to decode ticket from %s for %s", from
, spn
);
92 krb5_principal client
;
94 principalname2krb5_principal(&client
, et
.cname
, et
.crealm
);
95 krb5_unparse_name(context
, client
, &cpn
);
96 kdc_log(1, "524-REQ %s from %s for %s", cpn
, from
, spn
);
98 krb5_free_principal(context
, client
);
101 if(et
.endtime
< kdc_time
){
102 kdc_log(0, "Ticket expired (%s)", spn
);
103 free_EncTicketPart(&et
);
104 ret
= KRB5KRB_AP_ERR_TKT_EXPIRED
;
107 if(et
.flags
.invalid
){
108 kdc_log(0, "Ticket not valid (%s)", spn
);
109 free_EncTicketPart(&et
);
110 ret
= KRB5KRB_AP_ERR_TKT_NYV
;
114 ret
= encode_v4_ticket(buf
+ sizeof(buf
) - 1, sizeof(buf
),
115 &et
, &t
->sname
, &len
);
116 free_EncTicketPart(&et
);
118 kdc_log(0, "Failed to encode v4 ticket (%s)", spn
);
121 ret
= hdb_etype2key(context
, server
, KEYTYPE_DES
, &skey
);
123 kdc_log(0, "No DES key for server (%s)", spn
);
126 ekey
= unseal_key(skey
);
127 ret
= encrypt_v4_ticket(buf
+ sizeof(buf
) - len
, len
,
128 ekey
->key
.keyvalue
.data
, &ticket
);
131 kdc_log(0, "Failed to encrypt v4 ticket (%s)", spn
);
136 memset(buf
, 0, sizeof(buf
));
137 sp
= krb5_storage_from_mem(buf
, sizeof(buf
));
138 krb5_store_int32(sp
, ret
);
140 krb5_store_int32(sp
, server
->kvno
); /* is this right? */
141 krb5_store_data(sp
, ticket
.cipher
);
142 /* Aargh! This is coded as a KTEXT_ST. */
143 sp
->seek(sp
, MAX_KTXT_LEN
- ticket
.cipher
.length
, SEEK_CUR
);
144 krb5_store_int32(sp
, 0); /* mbz */
145 free_EncryptedData(&ticket
);
147 ret
= krb5_storage_to_data(sp
, reply
);
148 krb5_storage_free(sp
);
153 krb5_free_principal(context
, sprinc
);
154 hdb_free_entry(context
, server
);