?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
add opt files
[heimdal.git] / kdc / krb5tgs.c
blob1da90c2071f57ca88cb4cbf7d07a6896ea5edc92
1 /*
2 * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "kdc_locl.h"
35
36 /*
37 * return the realm of a krbtgt-ticket or NULL
38 */
39
40 static Realm
41 get_krbtgt_realm(const PrincipalName *p)
42 {
43 if(p->name_string.len == 2
44 && strcmp(p->name_string.val[0], KRB5_TGS_NAME) == 0)
45 return p->name_string.val[1];
46 else
47 return NULL;
48 }
49
50 /*
51 * The KDC might add a signed path to the ticket authorization data
52 * field. This is to avoid server impersonating clients and the
53 * request constrained delegation.
54 *
55 * This is done by storing a KRB5_AUTHDATA_IF_RELEVANT with a single
56 * entry of type KRB5SignedPath.
57 */
58
59 static krb5_error_code
60 find_KRB5SignedPath(krb5_context context,
61 const AuthorizationData *ad,
62 krb5_data *data)
63 {
64 AuthorizationData child;
65 krb5_error_code ret;
66 int pos;
67
68 if (ad == NULL || ad->len == 0)
69 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
70
71 pos = ad->len - 1;
72
73 if (ad->val[pos].ad_type != KRB5_AUTHDATA_IF_RELEVANT)
74 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
75
76 ret = decode_AuthorizationData(ad->val[pos].ad_data.data,
77 ad->val[pos].ad_data.length,
78 &child,
79 NULL);
80 if (ret) {
81 krb5_set_error_message(context, ret, "Failed to decode "
82 "IF_RELEVANT with %d", ret);
83 return ret;
84 }
85
86 if (child.len != 1) {
87 free_AuthorizationData(&child);
88 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
89 }
90
91 if (child.val[0].ad_type != KRB5_AUTHDATA_SIGNTICKET) {
92 free_AuthorizationData(&child);
93 return KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
94 }
95
96 if (data)
97 ret = der_copy_octet_string(&child.val[0].ad_data, data);
98 free_AuthorizationData(&child);
99 return ret;
100 }
101
102 krb5_error_code
103 _kdc_add_KRB5SignedPath(krb5_context context,
104 krb5_kdc_configuration *config,
105 hdb_entry_ex *krbtgt,
106 krb5_enctype enctype,
107 krb5_principal client,
108 krb5_const_principal server,
109 krb5_principals principals,
110 EncTicketPart *tkt)
111 {
112 krb5_error_code ret;
113 KRB5SignedPath sp;
114 krb5_data data;
115 krb5_crypto crypto = NULL;
116 size_t size;
117
118 if (server && principals) {
119 ret = add_Principals(principals, server);
120 if (ret)
121 return ret;
122 }
123
124 {
125 KRB5SignedPathData spd;
126
127 spd.client = client;
128 spd.authtime = tkt->authtime;
129 spd.delegated = principals;
130 spd.method_data = NULL;
131
132 ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length,
133 &spd, &size, ret);
134 if (ret)
135 return ret;
136 if (data.length != size)
137 krb5_abortx(context, "internal asn.1 encoder error");
138 }
139
140 {
141 Key *key;
142 ret = hdb_enctype2key(context, &krbtgt->entry, enctype, &key);
143 if (ret == 0)
144 ret = krb5_crypto_init(context, &key->key, 0, &crypto);
145 if (ret) {
146 free(data.data);
147 return ret;
148 }
149 }
150
151 /*
152 * Fill in KRB5SignedPath
153 */
154
155 sp.etype = enctype;
156 sp.delegated = principals;
157 sp.method_data = NULL;
158
159 ret = krb5_create_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH, 0,
160 data.data, data.length, &sp.cksum);
161 krb5_crypto_destroy(context, crypto);
162 free(data.data);
163 if (ret)
164 return ret;
165
166 ASN1_MALLOC_ENCODE(KRB5SignedPath, data.data, data.length, &sp, &size, ret);
167 free_Checksum(&sp.cksum);
168 if (ret)
169 return ret;
170 if (data.length != size)
171 krb5_abortx(context, "internal asn.1 encoder error");
172
173
174 /*
175 * Add IF-RELEVANT(KRB5SignedPath) to the last slot in
176 * authorization data field.
177 */
178
179 ret = _kdc_tkt_add_if_relevant_ad(context, tkt,
180 KRB5_AUTHDATA_SIGNTICKET, &data);
181 krb5_data_free(&data);
182
183 return ret;
184 }
185
186 static krb5_error_code
187 check_KRB5SignedPath(krb5_context context,
188 krb5_kdc_configuration *config,
189 hdb_entry_ex *krbtgt,
190 krb5_principal cp,
191 EncTicketPart *tkt,
192 krb5_principals *delegated,
193 int *signedpath)
194 {
195 krb5_error_code ret;
196 krb5_data data;
197 krb5_crypto crypto = NULL;
198
199 if (delegated)
200 *delegated = NULL;
201
202 ret = find_KRB5SignedPath(context, tkt->authorization_data, &data);
203 if (ret == 0) {
204 KRB5SignedPathData spd;
205 KRB5SignedPath sp;
206 size_t size;
207
208 ret = decode_KRB5SignedPath(data.data, data.length, &sp, NULL);
209 krb5_data_free(&data);
210 if (ret)
211 return ret;
212
213 spd.client = cp;
214 spd.authtime = tkt->authtime;
215 spd.delegated = sp.delegated;
216 spd.method_data = sp.method_data;
217
218 ASN1_MALLOC_ENCODE(KRB5SignedPathData, data.data, data.length,
219 &spd, &size, ret);
220 if (ret) {
221 free_KRB5SignedPath(&sp);
222 return ret;
223 }
224 if (data.length != size)
225 krb5_abortx(context, "internal asn.1 encoder error");
226
227 {
228 Key *key;
229 ret = hdb_enctype2key(context, &krbtgt->entry, sp.etype, &key);
230 if (ret == 0)
231 ret = krb5_crypto_init(context, &key->key, 0, &crypto);
232 if (ret) {
233 free(data.data);
234 free_KRB5SignedPath(&sp);
235 return ret;
236 }
237 }
238 ret = krb5_verify_checksum(context, crypto, KRB5_KU_KRB5SIGNEDPATH,
239 data.data, data.length,
240 &sp.cksum);
241 krb5_crypto_destroy(context, crypto);
242 free(data.data);
243 if (ret) {
244 free_KRB5SignedPath(&sp);
245 kdc_log(context, config, 5,
246 "KRB5SignedPath not signed correctly, not marking as signed");
247 return 0;
248 }
249
250 if (delegated && sp.delegated) {
251
252 *delegated = malloc(sizeof(*sp.delegated));
253 if (*delegated == NULL) {
254 free_KRB5SignedPath(&sp);
255 return ENOMEM;
256 }
257
258 ret = copy_Principals(*delegated, sp.delegated);
259 if (ret) {
260 free_KRB5SignedPath(&sp);
261 free(*delegated);
262 *delegated = NULL;
263 return ret;
264 }
265 }
266 free_KRB5SignedPath(&sp);
267
268 *signedpath = 1;
269 }
270
271 return 0;
272 }
273
274 /*
275 *
276 */
277
278 static krb5_error_code
279 check_PAC(krb5_context context,
280 krb5_kdc_configuration *config,
281 const krb5_principal client_principal,
282 hdb_entry_ex *client,
283 hdb_entry_ex *server,
284 const EncryptionKey *server_key,
285 const EncryptionKey *krbtgt_key,
286 EncTicketPart *tkt,
287 krb5_data *rspac,
288 int *signedpath)
289 {
290 AuthorizationData *ad = tkt->authorization_data;
291 unsigned i, j;
292 krb5_error_code ret;
293
294 if (ad == NULL || ad->len == 0)
295 return 0;
296
297 for (i = 0; i < ad->len; i++) {
298 AuthorizationData child;
299
300 if (ad->val[i].ad_type != KRB5_AUTHDATA_IF_RELEVANT)
301 continue;
302
303 ret = decode_AuthorizationData(ad->val[i].ad_data.data,
304 ad->val[i].ad_data.length,
305 &child,
306 NULL);
307 if (ret) {
308 krb5_set_error_message(context, ret, "Failed to decode "
309 "IF_RELEVANT with %d", ret);
310 return ret;
311 }
312 for (j = 0; j < child.len; j++) {
313
314 if (child.val[j].ad_type == KRB5_AUTHDATA_WIN2K_PAC) {
315 int signed_pac = 0;
316 krb5_pac pac;
317
318 /* Found PAC */
319 ret = krb5_pac_parse(context,
320 child.val[j].ad_data.data,
321 child.val[j].ad_data.length,
322 &pac);
323 free_AuthorizationData(&child);
324 if (ret)
325 return ret;
326
327 ret = krb5_pac_verify(context, pac, tkt->authtime,
328 client_principal,
329 krbtgt_key, NULL);
330 if (ret) {
331 krb5_pac_free(context, pac);
332 return ret;
333 }
334
335 ret = _kdc_pac_verify(context, client_principal,
336 client, server, &pac, &signed_pac);
337 if (ret) {
338 krb5_pac_free(context, pac);
339 return ret;
340 }
341
342 /*
343 * Only re-sign PAC if we could verify it with the PAC
344 * function. The no-verify case happens when we get in
345 * a PAC from cross realm from a Windows domain and
346 * that there is no PAC verification function.
347 */
348 if (signed_pac) {
349 *signedpath = 1;
350 ret = _krb5_pac_sign(context, pac, tkt->authtime,
351 client_principal,
352 server_key, krbtgt_key, rspac);
353 }
354 krb5_pac_free(context, pac);
355
356 return ret;
357 }
358 }
359 free_AuthorizationData(&child);
360 }
361 return 0;
362 }
363
364 /*
365 *
366 */
367
368 static krb5_error_code
369 check_tgs_flags(krb5_context context,
370 krb5_kdc_configuration *config,
371 KDC_REQ_BODY *b, const EncTicketPart *tgt, EncTicketPart *et)
372 {
373 KDCOptions f = b->kdc_options;
374
375 if(f.validate){
376 if(!tgt->flags.invalid || tgt->starttime == NULL){
377 kdc_log(context, config, 0,
378 "Bad request to validate ticket");
379 return KRB5KDC_ERR_BADOPTION;
380 }
381 if(*tgt->starttime > kdc_time){
382 kdc_log(context, config, 0,
383 "Early request to validate ticket");
384 return KRB5KRB_AP_ERR_TKT_NYV;
385 }
386 /* XXX tkt = tgt */
387 et->flags.invalid = 0;
388 }else if(tgt->flags.invalid){
389 kdc_log(context, config, 0,
390 "Ticket-granting ticket has INVALID flag set");
391 return KRB5KRB_AP_ERR_TKT_INVALID;
392 }
393
394 if(f.forwardable){
395 if(!tgt->flags.forwardable){
396 kdc_log(context, config, 0,
397 "Bad request for forwardable ticket");
398 return KRB5KDC_ERR_BADOPTION;
399 }
400 et->flags.forwardable = 1;
401 }
402 if(f.forwarded){
403 if(!tgt->flags.forwardable){
404 kdc_log(context, config, 0,
405 "Request to forward non-forwardable ticket");
406 return KRB5KDC_ERR_BADOPTION;
407 }
408 et->flags.forwarded = 1;
409 et->caddr = b->addresses;
410 }
411 if(tgt->flags.forwarded)
412 et->flags.forwarded = 1;
413
414 if(f.proxiable){
415 if(!tgt->flags.proxiable){
416 kdc_log(context, config, 0,
417 "Bad request for proxiable ticket");
418 return KRB5KDC_ERR_BADOPTION;
419 }
420 et->flags.proxiable = 1;
421 }
422 if(f.proxy){
423 if(!tgt->flags.proxiable){
424 kdc_log(context, config, 0,
425 "Request to proxy non-proxiable ticket");
426 return KRB5KDC_ERR_BADOPTION;
427 }
428 et->flags.proxy = 1;
429 et->caddr = b->addresses;
430 }
431 if(tgt->flags.proxy)
432 et->flags.proxy = 1;
433
434 if(f.allow_postdate){
435 if(!tgt->flags.may_postdate){
436 kdc_log(context, config, 0,
437 "Bad request for post-datable ticket");
438 return KRB5KDC_ERR_BADOPTION;
439 }
440 et->flags.may_postdate = 1;
441 }
442 if(f.postdated){
443 if(!tgt->flags.may_postdate){
444 kdc_log(context, config, 0,
445 "Bad request for postdated ticket");
446 return KRB5KDC_ERR_BADOPTION;
447 }
448 if(b->from)
449 *et->starttime = *b->from;
450 et->flags.postdated = 1;
451 et->flags.invalid = 1;
452 }else if(b->from && *b->from > kdc_time + context->max_skew){
453 kdc_log(context, config, 0, "Ticket cannot be postdated");
454 return KRB5KDC_ERR_CANNOT_POSTDATE;
455 }
456
457 if(f.renewable){
458 if(!tgt->flags.renewable || tgt->renew_till == NULL){
459 kdc_log(context, config, 0,
460 "Bad request for renewable ticket");
461 return KRB5KDC_ERR_BADOPTION;
462 }
463 et->flags.renewable = 1;
464 ALLOC(et->renew_till);
465 _kdc_fix_time(&b->rtime);
466 *et->renew_till = *b->rtime;
467 }
468 if(f.renew){
469 time_t old_life;
470 if(!tgt->flags.renewable || tgt->renew_till == NULL){
471 kdc_log(context, config, 0,
472 "Request to renew non-renewable ticket");
473 return KRB5KDC_ERR_BADOPTION;
474 }
475 old_life = tgt->endtime;
476 if(tgt->starttime)
477 old_life -= *tgt->starttime;
478 else
479 old_life -= tgt->authtime;
480 et->endtime = *et->starttime + old_life;
481 if (et->renew_till != NULL)
482 et->endtime = min(*et->renew_till, et->endtime);
483 }
484
485 #if 0
486 /* checks for excess flags */
487 if(f.request_anonymous && !config->allow_anonymous){
488 kdc_log(context, config, 0,
489 "Request for anonymous ticket");
490 return KRB5KDC_ERR_BADOPTION;
491 }
492 #endif
493 return 0;
494 }
495
496 /*
497 *
498 */
499
500 static krb5_error_code
501 check_constrained_delegation(krb5_context context,
502 krb5_kdc_configuration *config,
503 HDB *clientdb,
504 hdb_entry_ex *client,
505 krb5_const_principal server)
506 {
507 const HDB_Ext_Constrained_delegation_acl *acl;
508 krb5_error_code ret;
509 int i;
510
511 /* if client delegates to itself, that ok */
512 if (krb5_principal_compare(context, client->entry.principal, server) == TRUE)
513 return 0;
514
515 if (clientdb->hdb_check_constrained_delegation) {
516 ret = clientdb->hdb_check_constrained_delegation(context, clientdb, client, server);
517 if (ret == 0)
518 return 0;
519 } else {
520 ret = hdb_entry_get_ConstrainedDelegACL(&client->entry, &acl);
521 if (ret) {
522 krb5_clear_error_message(context);
523 return ret;
524 }
525
526 if (acl) {
527 for (i = 0; i < acl->len; i++) {
528 if (krb5_principal_compare(context, server, &acl->val[i]) == TRUE)
529 return 0;
530 }
531 }
532 ret = KRB5KDC_ERR_BADOPTION;
533 }
534 kdc_log(context, config, 0,
535 "Bad request for constrained delegation");
536 return ret;
537 }
538
539 /*
540 *
541 */
542
543 static krb5_error_code
544 verify_flags (krb5_context context,
545 krb5_kdc_configuration *config,
546 const EncTicketPart *et,
547 const char *pstr)
548 {
549 if(et->endtime < kdc_time){
550 kdc_log(context, config, 0, "Ticket expired (%s)", pstr);
551 return KRB5KRB_AP_ERR_TKT_EXPIRED;
552 }
553 if(et->flags.invalid){
554 kdc_log(context, config, 0, "Ticket not valid (%s)", pstr);
555 return KRB5KRB_AP_ERR_TKT_NYV;
556 }
557 return 0;
558 }
559
560 /*
561 *
562 */
563
564 static krb5_error_code
565 fix_transited_encoding(krb5_context context,
566 krb5_kdc_configuration *config,
567 krb5_boolean check_policy,
568 const TransitedEncoding *tr,
569 EncTicketPart *et,
570 const char *client_realm,
571 const char *server_realm,
572 const char *tgt_realm)
573 {
574 krb5_error_code ret = 0;
575 char **realms, **tmp;
576 unsigned int num_realms;
577 int i;
578
579 switch (tr->tr_type) {
580 case DOMAIN_X500_COMPRESS:
581 break;
582 case 0:
583 /*
584 * Allow empty content of type 0 because that is was Microsoft
585 * generates in their TGT.
586 */
587 if (tr->contents.length == 0)
588 break;
589 kdc_log(context, config, 0,
590 "Transited type 0 with non empty content");
591 return KRB5KDC_ERR_TRTYPE_NOSUPP;
592 default:
593 kdc_log(context, config, 0,
594 "Unknown transited type: %u", tr->tr_type);
595 return KRB5KDC_ERR_TRTYPE_NOSUPP;
596 }
597
598 ret = krb5_domain_x500_decode(context,
599 tr->contents,
600 &realms,
601 &num_realms,
602 client_realm,
603 server_realm);
604 if(ret){
605 krb5_warn(context, ret,
606 "Decoding transited encoding");
607 return ret;
608 }
609 if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) {
610 /* not us, so add the previous realm to transited set */
611 if (num_realms + 1 > UINT_MAX/sizeof(*realms)) {
612 ret = ERANGE;
613 goto free_realms;
614 }
615 tmp = realloc(realms, (num_realms + 1) * sizeof(*realms));
616 if(tmp == NULL){
617 ret = ENOMEM;
618 goto free_realms;
619 }
620 realms = tmp;
621 realms[num_realms] = strdup(tgt_realm);
622 if(realms[num_realms] == NULL){
623 ret = ENOMEM;
624 goto free_realms;
625 }
626 num_realms++;
627 }
628 if(num_realms == 0) {
629 if(strcmp(client_realm, server_realm))
630 kdc_log(context, config, 0,
631 "cross-realm %s -> %s", client_realm, server_realm);
632 } else {
633 size_t l = 0;
634 char *rs;
635 for(i = 0; i < num_realms; i++)
636 l += strlen(realms[i]) + 2;
637 rs = malloc(l);
638 if(rs != NULL) {
639 *rs = '\0';
640 for(i = 0; i < num_realms; i++) {
641 if(i > 0)
642 strlcat(rs, ", ", l);
643 strlcat(rs, realms[i], l);
644 }
645 kdc_log(context, config, 0,
646 "cross-realm %s -> %s via [%s]",
647 client_realm, server_realm, rs);
648 free(rs);
649 }
650 }
651 if(check_policy) {
652 ret = krb5_check_transited(context, client_realm,
653 server_realm,
654 realms, num_realms, NULL);
655 if(ret) {
656 krb5_warn(context, ret, "cross-realm %s -> %s",
657 client_realm, server_realm);
658 goto free_realms;
659 }
660 et->flags.transited_policy_checked = 1;
661 }
662 et->transited.tr_type = DOMAIN_X500_COMPRESS;
663 ret = krb5_domain_x500_encode(realms, num_realms, &et->transited.contents);
664 if(ret)
665 krb5_warn(context, ret, "Encoding transited encoding");
666 free_realms:
667 for(i = 0; i < num_realms; i++)
668 free(realms[i]);
669 free(realms);
670 return ret;
671 }
672
673
674 static krb5_error_code
675 tgs_make_reply(krb5_context context,
676 krb5_kdc_configuration *config,
677 KDC_REQ_BODY *b,
678 krb5_const_principal tgt_name,
679 const EncTicketPart *tgt,
680 const krb5_keyblock *replykey,
681 int rk_is_subkey,
682 const EncryptionKey *serverkey,
683 const krb5_keyblock *sessionkey,
684 krb5_kvno kvno,
685 AuthorizationData *auth_data,
686 hdb_entry_ex *server,
687 krb5_principal server_principal,
688 const char *server_name,
689 hdb_entry_ex *client,
690 krb5_principal client_principal,
691 hdb_entry_ex *krbtgt,
692 krb5_enctype krbtgt_etype,
693 krb5_principals spp,
694 const krb5_data *rspac,
695 const METHOD_DATA *enc_pa_data,
696 const char **e_text,
697 krb5_data *reply)
698 {
699 KDC_REP rep;
700 EncKDCRepPart ek;
701 EncTicketPart et;
702 KDCOptions f = b->kdc_options;
703 krb5_error_code ret;
704 int is_weak = 0;
705
706 memset(&rep, 0, sizeof(rep));
707 memset(&et, 0, sizeof(et));
708 memset(&ek, 0, sizeof(ek));
709
710 rep.pvno = 5;
711 rep.msg_type = krb_tgs_rep;
712
713 et.authtime = tgt->authtime;
714 _kdc_fix_time(&b->till);
715 et.endtime = min(tgt->endtime, *b->till);
716 ALLOC(et.starttime);
717 *et.starttime = kdc_time;
718
719 ret = check_tgs_flags(context, config, b, tgt, &et);
720 if(ret)
721 goto out;
722
723 /* We should check the transited encoding if:
724 1) the request doesn't ask not to be checked
725 2) globally enforcing a check
726 3) principal requires checking
727 4) we allow non-check per-principal, but principal isn't marked as allowing this
728 5) we don't globally allow this
729 */
730
731 #define GLOBAL_FORCE_TRANSITED_CHECK \
732 (config->trpolicy == TRPOLICY_ALWAYS_CHECK)
733 #define GLOBAL_ALLOW_PER_PRINCIPAL \
734 (config->trpolicy == TRPOLICY_ALLOW_PER_PRINCIPAL)
735 #define GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK \
736 (config->trpolicy == TRPOLICY_ALWAYS_HONOUR_REQUEST)
737
738 /* these will consult the database in future release */
739 #define PRINCIPAL_FORCE_TRANSITED_CHECK(P) 0
740 #define PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(P) 0
741
742 ret = fix_transited_encoding(context, config,
743 !f.disable_transited_check ||
744 GLOBAL_FORCE_TRANSITED_CHECK ||
745 PRINCIPAL_FORCE_TRANSITED_CHECK(server) ||
746 !((GLOBAL_ALLOW_PER_PRINCIPAL &&
747 PRINCIPAL_ALLOW_DISABLE_TRANSITED_CHECK(server)) ||
748 GLOBAL_ALLOW_DISABLE_TRANSITED_CHECK),
749 &tgt->transited, &et,
750 krb5_principal_get_realm(context, client_principal),
751 krb5_principal_get_realm(context, server->entry.principal),
752 krb5_principal_get_realm(context, krbtgt->entry.principal));
753 if(ret)
754 goto out;
755
756 copy_Realm(&server_principal->realm, &rep.ticket.realm);
757 _krb5_principal2principalname(&rep.ticket.sname, server_principal);
758 copy_Realm(&tgt_name->realm, &rep.crealm);
759 /*
760 if (f.request_anonymous)
761 _kdc_make_anonymous_principalname (&rep.cname);
762 else */
763
764 copy_PrincipalName(&tgt_name->name, &rep.cname);
765 rep.ticket.tkt_vno = 5;
766
767 ek.caddr = et.caddr;
768 if(et.caddr == NULL)
769 et.caddr = tgt->caddr;
770
771 {
772 time_t life;
773 life = et.endtime - *et.starttime;
774 if(client && client->entry.max_life)
775 life = min(life, *client->entry.max_life);
776 if(server->entry.max_life)
777 life = min(life, *server->entry.max_life);
778 et.endtime = *et.starttime + life;
779 }
780 if(f.renewable_ok && tgt->flags.renewable &&
781 et.renew_till == NULL && et.endtime < *b->till &&
782 tgt->renew_till != NULL)
783 {
784 et.flags.renewable = 1;
785 ALLOC(et.renew_till);
786 *et.renew_till = *b->till;
787 }
788 if(et.renew_till){
789 time_t renew;
790 renew = *et.renew_till - et.authtime;
791 if(client && client->entry.max_renew)
792 renew = min(renew, *client->entry.max_renew);
793 if(server->entry.max_renew)
794 renew = min(renew, *server->entry.max_renew);
795 *et.renew_till = et.authtime + renew;
796 }
797
798 if(et.renew_till){
799 *et.renew_till = min(*et.renew_till, *tgt->renew_till);
800 *et.starttime = min(*et.starttime, *et.renew_till);
801 et.endtime = min(et.endtime, *et.renew_till);
802 }
803
804 *et.starttime = min(*et.starttime, et.endtime);
805
806 if(*et.starttime == et.endtime){
807 ret = KRB5KDC_ERR_NEVER_VALID;
808 goto out;
809 }
810 if(et.renew_till && et.endtime == *et.renew_till){
811 free(et.renew_till);
812 et.renew_till = NULL;
813 et.flags.renewable = 0;
814 }
815
816 et.flags.pre_authent = tgt->flags.pre_authent;
817 et.flags.hw_authent = tgt->flags.hw_authent;
818 et.flags.anonymous = tgt->flags.anonymous;
819 et.flags.ok_as_delegate = server->entry.flags.ok_as_delegate;
820
821 if(rspac->length) {
822 /*
823 * No not need to filter out the any PAC from the
824 * auth_data since it's signed by the KDC.
825 */
826 ret = _kdc_tkt_add_if_relevant_ad(context, &et,
827 KRB5_AUTHDATA_WIN2K_PAC, rspac);
828 if (ret)
829 goto out;
830 }
831
832 if (auth_data) {
833 unsigned int i = 0;
834
835 /* XXX check authdata */
836
837 if (et.authorization_data == NULL) {
838 et.authorization_data = calloc(1, sizeof(*et.authorization_data));
839 if (et.authorization_data == NULL) {
840 ret = ENOMEM;
841 krb5_set_error_message(context, ret, "malloc: out of memory");
842 goto out;
843 }
844 }
845 for(i = 0; i < auth_data->len ; i++) {
846 ret = add_AuthorizationData(et.authorization_data, &auth_data->val[i]);
847 if (ret) {
848 krb5_set_error_message(context, ret, "malloc: out of memory");
849 goto out;
850 }
851 }
852
853 /* Filter out type KRB5SignedPath */
854 ret = find_KRB5SignedPath(context, et.authorization_data, NULL);
855 if (ret == 0) {
856 if (et.authorization_data->len == 1) {
857 free_AuthorizationData(et.authorization_data);
858 free(et.authorization_data);
859 et.authorization_data = NULL;
860 } else {
861 AuthorizationData *ad = et.authorization_data;
862 free_AuthorizationDataElement(&ad->val[ad->len - 1]);
863 ad->len--;
864 }
865 }
866 }
867
868 ret = krb5_copy_keyblock_contents(context, sessionkey, &et.key);
869 if (ret)
870 goto out;
871 et.crealm = tgt->crealm;
872 et.cname = tgt_name->name;
873
874 ek.key = et.key;
875 /* MIT must have at least one last_req */
876 ek.last_req.len = 1;
877 ek.last_req.val = calloc(1, sizeof(*ek.last_req.val));
878 if (ek.last_req.val == NULL) {
879 ret = ENOMEM;
880 goto out;
881 }
882 ek.nonce = b->nonce;
883 ek.flags = et.flags;
884 ek.authtime = et.authtime;
885 ek.starttime = et.starttime;
886 ek.endtime = et.endtime;
887 ek.renew_till = et.renew_till;
888 ek.srealm = rep.ticket.realm;
889 ek.sname = rep.ticket.sname;
890
891 _kdc_log_timestamp(context, config, "TGS-REQ", et.authtime, et.starttime,
892 et.endtime, et.renew_till);
893
894 /* Don't sign cross realm tickets, they can't be checked anyway */
895 {
896 char *r = get_krbtgt_realm(&ek.sname);
897
898 if (r == NULL || strcmp(r, ek.srealm) == 0) {
899 ret = _kdc_add_KRB5SignedPath(context,
900 config,
901 krbtgt,
902 krbtgt_etype,
903 client_principal,
904 NULL,
905 spp,
906 &et);
907 if (ret)
908 goto out;
909 }
910 }
911
912 if (enc_pa_data->len) {
913 rep.padata = calloc(1, sizeof(*rep.padata));
914 if (rep.padata == NULL) {
915 ret = ENOMEM;
916 goto out;
917 }
918 ret = copy_METHOD_DATA(enc_pa_data, rep.padata);
919 if (ret)
920 goto out;
921 }
922
923 if (krb5_enctype_valid(context, et.key.keytype) != 0
924 && _kdc_is_weak_exception(server->entry.principal, et.key.keytype))
925 {
926 krb5_enctype_enable(context, et.key.keytype);
927 is_weak = 1;
928 }
929
930
931 /* It is somewhat unclear where the etype in the following
932 encryption should come from. What we have is a session
933 key in the passed tgt, and a list of preferred etypes
934 *for the new ticket*. Should we pick the best possible
935 etype, given the keytype in the tgt, or should we look
936 at the etype list here as well? What if the tgt
937 session key is DES3 and we want a ticket with a (say)
938 CAST session key. Should the DES3 etype be added to the
939 etype list, even if we don't want a session key with
940 DES3? */
941 ret = _kdc_encode_reply(context, config,
942 &rep, &et, &ek, et.key.keytype,
943 kvno,
944 serverkey, 0, replykey, rk_is_subkey,
945 e_text, reply);
946 if (is_weak)
947 krb5_enctype_disable(context, et.key.keytype);
948
949 out:
950 free_TGS_REP(&rep);
951 free_TransitedEncoding(&et.transited);
952 if(et.starttime)
953 free(et.starttime);
954 if(et.renew_till)
955 free(et.renew_till);
956 if(et.authorization_data) {
957 free_AuthorizationData(et.authorization_data);
958 free(et.authorization_data);
959 }
960 free_LastReq(&ek.last_req);
961 memset(et.key.keyvalue.data, 0, et.key.keyvalue.length);
962 free_EncryptionKey(&et.key);
963 return ret;
964 }
965
966 static krb5_error_code
967 tgs_check_authenticator(krb5_context context,
968 krb5_kdc_configuration *config,
969 krb5_auth_context ac,
970 KDC_REQ_BODY *b,
971 const char **e_text,
972 krb5_keyblock *key)
973 {
974 krb5_authenticator auth;
975 size_t len;
976 unsigned char *buf;
977 size_t buf_size;
978 krb5_error_code ret;
979 krb5_crypto crypto;
980
981 krb5_auth_con_getauthenticator(context, ac, &auth);
982 if(auth->cksum == NULL){
983 kdc_log(context, config, 0, "No authenticator in request");
984 ret = KRB5KRB_AP_ERR_INAPP_CKSUM;
985 goto out;
986 }
987 /*
988 * according to RFC1510 it doesn't need to be keyed,
989 * but according to the latest draft it needs to.
990 */
991 if (
992 #if 0
993 !krb5_checksum_is_keyed(context, auth->cksum->cksumtype)
994 ||
995 #endif
996 !krb5_checksum_is_collision_proof(context, auth->cksum->cksumtype)) {
997 kdc_log(context, config, 0, "Bad checksum type in authenticator: %d",
998 auth->cksum->cksumtype);
999 ret = KRB5KRB_AP_ERR_INAPP_CKSUM;
1000 goto out;
1001 }
1002
1003 /* XXX should not re-encode this */
1004 ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, b, &len, ret);
1005 if(ret){
1006 const char *msg = krb5_get_error_message(context, ret);
1007 kdc_log(context, config, 0, "Failed to encode KDC-REQ-BODY: %s", msg);
1008 krb5_free_error_message(context, msg);
1009 goto out;
1010 }
1011 if(buf_size != len) {
1012 free(buf);
1013 kdc_log(context, config, 0, "Internal error in ASN.1 encoder");
1014 *e_text = "KDC internal error";
1015 ret = KRB5KRB_ERR_GENERIC;
1016 goto out;
1017 }
1018 ret = krb5_crypto_init(context, key, 0, &crypto);
1019 if (ret) {
1020 const char *msg = krb5_get_error_message(context, ret);
1021 free(buf);
1022 kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1023 krb5_free_error_message(context, msg);
1024 goto out;
1025 }
1026 ret = krb5_verify_checksum(context,
1027 crypto,
1028 KRB5_KU_TGS_REQ_AUTH_CKSUM,
1029 buf,
1030 len,
1031 auth->cksum);
1032 free(buf);
1033 krb5_crypto_destroy(context, crypto);
1034 if(ret){
1035 const char *msg = krb5_get_error_message(context, ret);
1036 kdc_log(context, config, 0,
1037 "Failed to verify authenticator checksum: %s", msg);
1038 krb5_free_error_message(context, msg);
1039 }
1040 out:
1041 free_Authenticator(auth);
1042 free(auth);
1043 return ret;
1044 }
1045
1046 /*
1047 *
1048 */
1049
1050 static const char *
1051 find_rpath(krb5_context context, Realm crealm, Realm srealm)
1052 {
1053 const char *new_realm = krb5_config_get_string(context,
1054 NULL,
1055 "capaths",
1056 crealm,
1057 srealm,
1058 NULL);
1059 return new_realm;
1060 }
1061
1062
1063 static krb5_boolean
1064 need_referral(krb5_context context, krb5_kdc_configuration *config,
1065 const KDCOptions * const options, krb5_principal server,
1066 krb5_realm **realms)
1067 {
1068 const char *name;
1069
1070 if(!options->canonicalize && server->name.name_type != KRB5_NT_SRV_INST)
1071 return FALSE;
1072
1073 if (server->name.name_string.len == 1)
1074 name = server->name.name_string.val[0];
1075 else if (server->name.name_string.len > 1)
1076 name = server->name.name_string.val[1];
1077 else
1078 return FALSE;
1079
1080 kdc_log(context, config, 0, "Searching referral for %s", name);
1081
1082 return _krb5_get_host_realm_int(context, name, FALSE, realms) == 0;
1083 }
1084
1085 static krb5_error_code
1086 tgs_parse_request(krb5_context context,
1087 krb5_kdc_configuration *config,
1088 KDC_REQ_BODY *b,
1089 const PA_DATA *tgs_req,
1090 hdb_entry_ex **krbtgt,
1091 krb5_enctype *krbtgt_etype,
1092 krb5_ticket **ticket,
1093 const char **e_text,
1094 const char *from,
1095 const struct sockaddr *from_addr,
1096 time_t **csec,
1097 int **cusec,
1098 AuthorizationData **auth_data,
1099 krb5_keyblock **replykey,
1100 int *rk_is_subkey)
1101 {
1102 krb5_ap_req ap_req;
1103 krb5_error_code ret;
1104 krb5_principal princ;
1105 krb5_auth_context ac = NULL;
1106 krb5_flags ap_req_options;
1107 krb5_flags verify_ap_req_flags;
1108 krb5_crypto crypto;
1109 Key *tkey;
1110 krb5_keyblock *subkey = NULL;
1111 unsigned usage;
1112
1113 *auth_data = NULL;
1114 *csec = NULL;
1115 *cusec = NULL;
1116 *replykey = NULL;
1117
1118 memset(&ap_req, 0, sizeof(ap_req));
1119 ret = krb5_decode_ap_req(context, &tgs_req->padata_value, &ap_req);
1120 if(ret){
1121 const char *msg = krb5_get_error_message(context, ret);
1122 kdc_log(context, config, 0, "Failed to decode AP-REQ: %s", msg);
1123 krb5_free_error_message(context, msg);
1124 goto out;
1125 }
1126
1127 if(!get_krbtgt_realm(&ap_req.ticket.sname)){
1128 /* XXX check for ticket.sname == req.sname */
1129 kdc_log(context, config, 0, "PA-DATA is not a ticket-granting ticket");
1130 ret = KRB5KDC_ERR_POLICY; /* ? */
1131 goto out;
1132 }
1133
1134 _krb5_principalname2krb5_principal(context,
1135 &princ,
1136 ap_req.ticket.sname,
1137 ap_req.ticket.realm);
1138
1139 ret = _kdc_db_fetch(context, config, princ, HDB_F_GET_KRBTGT, NULL, krbtgt);
1140
1141 if(ret) {
1142 const char *msg = krb5_get_error_message(context, ret);
1143 char *p;
1144 ret = krb5_unparse_name(context, princ, &p);
1145 if (ret != 0)
1146 p = "<unparse_name failed>";
1147 krb5_free_principal(context, princ);
1148 kdc_log(context, config, 0,
1149 "Ticket-granting ticket not found in database: %s", msg);
1150 krb5_free_error_message(context, msg);
1151 if (ret == 0)
1152 free(p);
1153 ret = KRB5KRB_AP_ERR_NOT_US;
1154 goto out;
1155 }
1156
1157 if(ap_req.ticket.enc_part.kvno &&
1158 *ap_req.ticket.enc_part.kvno != (*krbtgt)->entry.kvno){
1159 char *p;
1160
1161 ret = krb5_unparse_name (context, princ, &p);
1162 krb5_free_principal(context, princ);
1163 if (ret != 0)
1164 p = "<unparse_name failed>";
1165 kdc_log(context, config, 0,
1166 "Ticket kvno = %d, DB kvno = %d (%s)",
1167 *ap_req.ticket.enc_part.kvno,
1168 (*krbtgt)->entry.kvno,
1169 p);
1170 if (ret == 0)
1171 free (p);
1172 ret = KRB5KRB_AP_ERR_BADKEYVER;
1173 goto out;
1174 }
1175
1176 *krbtgt_etype = ap_req.ticket.enc_part.etype;
1177
1178 ret = hdb_enctype2key(context, &(*krbtgt)->entry,
1179 ap_req.ticket.enc_part.etype, &tkey);
1180 if(ret){
1181 char *str = NULL, *p = NULL;
1182
1183 krb5_enctype_to_string(context, ap_req.ticket.enc_part.etype, &str);
1184 krb5_unparse_name(context, princ, &p);
1185 kdc_log(context, config, 0,
1186 "No server key with enctype %s found for %s",
1187 str ? str : "<unknown enctype>",
1188 p ? p : "<unparse_name failed>");
1189 free(str);
1190 free(p);
1191 ret = KRB5KRB_AP_ERR_BADKEYVER;
1192 goto out;
1193 }
1194
1195 if (b->kdc_options.validate)
1196 verify_ap_req_flags = KRB5_VERIFY_AP_REQ_IGNORE_INVALID;
1197 else
1198 verify_ap_req_flags = 0;
1199
1200 ret = krb5_verify_ap_req2(context,
1201 &ac,
1202 &ap_req,
1203 princ,
1204 &tkey->key,
1205 verify_ap_req_flags,
1206 &ap_req_options,
1207 ticket,
1208 KRB5_KU_TGS_REQ_AUTH);
1209
1210 krb5_free_principal(context, princ);
1211 if(ret) {
1212 const char *msg = krb5_get_error_message(context, ret);
1213 kdc_log(context, config, 0, "Failed to verify AP-REQ: %s", msg);
1214 krb5_free_error_message(context, msg);
1215 goto out;
1216 }
1217
1218 {
1219 krb5_authenticator auth;
1220
1221 ret = krb5_auth_con_getauthenticator(context, ac, &auth);
1222 if (ret == 0) {
1223 *csec = malloc(sizeof(**csec));
1224 if (*csec == NULL) {
1225 krb5_free_authenticator(context, &auth);
1226 kdc_log(context, config, 0, "malloc failed");
1227 goto out;
1228 }
1229 **csec = auth->ctime;
1230 *cusec = malloc(sizeof(**cusec));
1231 if (*cusec == NULL) {
1232 krb5_free_authenticator(context, &auth);
1233 kdc_log(context, config, 0, "malloc failed");
1234 goto out;
1235 }
1236 **cusec = auth->cusec;
1237 krb5_free_authenticator(context, &auth);
1238 }
1239 }
1240
1241 ret = tgs_check_authenticator(context, config,
1242 ac, b, e_text, &(*ticket)->ticket.key);
1243 if (ret) {
1244 krb5_auth_con_free(context, ac);
1245 goto out;
1246 }
1247
1248 usage = KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY;
1249 *rk_is_subkey = 1;
1250
1251 ret = krb5_auth_con_getremotesubkey(context, ac, &subkey);
1252 if(ret){
1253 const char *msg = krb5_get_error_message(context, ret);
1254 krb5_auth_con_free(context, ac);
1255 kdc_log(context, config, 0, "Failed to get remote subkey: %s", msg);
1256 krb5_free_error_message(context, msg);
1257 goto out;
1258 }
1259 if(subkey == NULL){
1260 usage = KRB5_KU_TGS_REQ_AUTH_DAT_SESSION;
1261 *rk_is_subkey = 0;
1262
1263 ret = krb5_auth_con_getkey(context, ac, &subkey);
1264 if(ret) {
1265 const char *msg = krb5_get_error_message(context, ret);
1266 krb5_auth_con_free(context, ac);
1267 kdc_log(context, config, 0, "Failed to get session key: %s", msg);
1268 krb5_free_error_message(context, msg);
1269 goto out;
1270 }
1271 }
1272 if(subkey == NULL){
1273 krb5_auth_con_free(context, ac);
1274 kdc_log(context, config, 0,
1275 "Failed to get key for enc-authorization-data");
1276 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1277 goto out;
1278 }
1279
1280 *replykey = subkey;
1281
1282 if (b->enc_authorization_data) {
1283 krb5_data ad;
1284
1285 ret = krb5_crypto_init(context, subkey, 0, &crypto);
1286 if (ret) {
1287 const char *msg = krb5_get_error_message(context, ret);
1288 krb5_auth_con_free(context, ac);
1289 kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1290 krb5_free_error_message(context, msg);
1291 goto out;
1292 }
1293 ret = krb5_decrypt_EncryptedData (context,
1294 crypto,
1295 usage,
1296 b->enc_authorization_data,
1297 &ad);
1298 krb5_crypto_destroy(context, crypto);
1299 if(ret){
1300 krb5_auth_con_free(context, ac);
1301 kdc_log(context, config, 0,
1302 "Failed to decrypt enc-authorization-data");
1303 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1304 goto out;
1305 }
1306 ALLOC(*auth_data);
1307 if (*auth_data == NULL) {
1308 krb5_auth_con_free(context, ac);
1309 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1310 goto out;
1311 }
1312 ret = decode_AuthorizationData(ad.data, ad.length, *auth_data, NULL);
1313 if(ret){
1314 krb5_auth_con_free(context, ac);
1315 free(*auth_data);
1316 *auth_data = NULL;
1317 kdc_log(context, config, 0, "Failed to decode authorization data");
1318 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
1319 goto out;
1320 }
1321 }
1322
1323 krb5_auth_con_free(context, ac);
1324
1325 out:
1326 free_AP_REQ(&ap_req);
1327
1328 return ret;
1329 }
1330
1331 static krb5_error_code
1332 build_server_referral(krb5_context context,
1333 krb5_kdc_configuration *config,
1334 krb5_crypto session,
1335 krb5_const_realm referred_realm,
1336 const PrincipalName *true_principal_name,
1337 const PrincipalName *requested_principal,
1338 krb5_data *outdata)
1339 {
1340 PA_ServerReferralData ref;
1341 krb5_error_code ret;
1342 EncryptedData ed;
1343 krb5_data data;
1344 size_t size;
1345
1346 memset(&ref, 0, sizeof(ref));
1347
1348 if (referred_realm) {
1349 ALLOC(ref.referred_realm);
1350 if (ref.referred_realm == NULL)
1351 goto eout;
1352 *ref.referred_realm = strdup(referred_realm);
1353 if (*ref.referred_realm == NULL)
1354 goto eout;
1355 }
1356 if (true_principal_name) {
1357 ALLOC(ref.true_principal_name);
1358 if (ref.true_principal_name == NULL)
1359 goto eout;
1360 ret = copy_PrincipalName(true_principal_name, ref.true_principal_name);
1361 if (ret)
1362 goto eout;
1363 }
1364 if (requested_principal) {
1365 ALLOC(ref.requested_principal_name);
1366 if (ref.requested_principal_name == NULL)
1367 goto eout;
1368 ret = copy_PrincipalName(requested_principal,
1369 ref.requested_principal_name);
1370 if (ret)
1371 goto eout;
1372 }
1373
1374 ASN1_MALLOC_ENCODE(PA_ServerReferralData,
1375 data.data, data.length,
1376 &ref, &size, ret);
1377 free_PA_ServerReferralData(&ref);
1378 if (ret)
1379 return ret;
1380 if (data.length != size)
1381 krb5_abortx(context, "internal asn.1 encoder error");
1382
1383 ret = krb5_encrypt_EncryptedData(context, session,
1384 KRB5_KU_PA_SERVER_REFERRAL,
1385 data.data, data.length,
1386 0 /* kvno */, &ed);
1387 free(data.data);
1388 if (ret)
1389 return ret;
1390
1391 ASN1_MALLOC_ENCODE(EncryptedData,
1392 outdata->data, outdata->length,
1393 &ed, &size, ret);
1394 free_EncryptedData(&ed);
1395 if (ret)
1396 return ret;
1397 if (outdata->length != size)
1398 krb5_abortx(context, "internal asn.1 encoder error");
1399
1400 return 0;
1401 eout:
1402 free_PA_ServerReferralData(&ref);
1403 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1404 return ENOMEM;
1405 }
1406
1407 static krb5_error_code
1408 tgs_build_reply(krb5_context context,
1409 krb5_kdc_configuration *config,
1410 KDC_REQ *req,
1411 KDC_REQ_BODY *b,
1412 hdb_entry_ex *krbtgt,
1413 krb5_enctype krbtgt_etype,
1414 const krb5_keyblock *replykey,
1415 int rk_is_subkey,
1416 krb5_ticket *ticket,
1417 krb5_data *reply,
1418 const char *from,
1419 const char **e_text,
1420 AuthorizationData **auth_data,
1421 const struct sockaddr *from_addr)
1422 {
1423 krb5_error_code ret;
1424 krb5_principal cp = NULL, sp = NULL;
1425 krb5_principal client_principal = NULL;
1426 char *spn = NULL, *cpn = NULL;
1427 hdb_entry_ex *server = NULL, *client = NULL;
1428 HDB *clientdb;
1429 krb5_realm ref_realm = NULL;
1430 EncTicketPart *tgt = &ticket->ticket;
1431 krb5_principals spp = NULL;
1432 const EncryptionKey *ekey;
1433 krb5_keyblock sessionkey;
1434 krb5_kvno kvno;
1435 krb5_data rspac;
1436
1437 METHOD_DATA enc_pa_data;
1438
1439 PrincipalName *s;
1440 Realm r;
1441 int nloop = 0;
1442 EncTicketPart adtkt;
1443 char opt_str[128];
1444 int signedpath = 0;
1445
1446 Key *tkey;
1447
1448 memset(&sessionkey, 0, sizeof(sessionkey));
1449 memset(&adtkt, 0, sizeof(adtkt));
1450 krb5_data_zero(&rspac);
1451 memset(&enc_pa_data, 0, sizeof(enc_pa_data));
1452
1453 s = b->sname;
1454 r = b->realm;
1455
1456 if(b->kdc_options.enc_tkt_in_skey){
1457 Ticket *t;
1458 hdb_entry_ex *uu;
1459 krb5_principal p;
1460 Key *uukey;
1461
1462 if(b->additional_tickets == NULL ||
1463 b->additional_tickets->len == 0){
1464 ret = KRB5KDC_ERR_BADOPTION; /* ? */
1465 kdc_log(context, config, 0,
1466 "No second ticket present in request");
1467 goto out;
1468 }
1469 t = &b->additional_tickets->val[0];
1470 if(!get_krbtgt_realm(&t->sname)){
1471 kdc_log(context, config, 0,
1472 "Additional ticket is not a ticket-granting ticket");
1473 ret = KRB5KDC_ERR_POLICY;
1474 goto out;
1475 }
1476 _krb5_principalname2krb5_principal(context, &p, t->sname, t->realm);
1477 ret = _kdc_db_fetch(context, config, p,
1478 HDB_F_GET_CLIENT|HDB_F_GET_SERVER,
1479 NULL, &uu);
1480 krb5_free_principal(context, p);
1481 if(ret){
1482 if (ret == HDB_ERR_NOENTRY)
1483 ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1484 goto out;
1485 }
1486 ret = hdb_enctype2key(context, &uu->entry,
1487 t->enc_part.etype, &uukey);
1488 if(ret){
1489 _kdc_free_ent(context, uu);
1490 ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
1491 goto out;
1492 }
1493 ret = krb5_decrypt_ticket(context, t, &uukey->key, &adtkt, 0);
1494 _kdc_free_ent(context, uu);
1495 if(ret)
1496 goto out;
1497
1498 ret = verify_flags(context, config, &adtkt, spn);
1499 if (ret)
1500 goto out;
1501
1502 s = &adtkt.cname;
1503 r = adtkt.crealm;
1504 }
1505
1506 _krb5_principalname2krb5_principal(context, &sp, *s, r);
1507 ret = krb5_unparse_name(context, sp, &spn);
1508 if (ret)
1509 goto out;
1510 _krb5_principalname2krb5_principal(context, &cp, tgt->cname, tgt->crealm);
1511 ret = krb5_unparse_name(context, cp, &cpn);
1512 if (ret)
1513 goto out;
1514 unparse_flags (KDCOptions2int(b->kdc_options),
1515 asn1_KDCOptions_units(),
1516 opt_str, sizeof(opt_str));
1517 if(*opt_str)
1518 kdc_log(context, config, 0,
1519 "TGS-REQ %s from %s for %s [%s]",
1520 cpn, from, spn, opt_str);
1521 else
1522 kdc_log(context, config, 0,
1523 "TGS-REQ %s from %s for %s", cpn, from, spn);
1524
1525 /*
1526 * Fetch server
1527 */
1528
1529 server_lookup:
1530 ret = _kdc_db_fetch(context, config, sp, HDB_F_GET_SERVER | HDB_F_CANON,
1531 NULL, &server);
1532
1533 if(ret){
1534 const char *new_rlm, *msg;
1535 Realm req_rlm;
1536 krb5_realm *realms;
1537
1538 if ((req_rlm = get_krbtgt_realm(&sp->name)) != NULL) {
1539 if(nloop++ < 2) {
1540 new_rlm = find_rpath(context, tgt->crealm, req_rlm);
1541 if(new_rlm) {
1542 kdc_log(context, config, 5, "krbtgt for realm %s "
1543 "not found, trying %s",
1544 req_rlm, new_rlm);
1545 krb5_free_principal(context, sp);
1546 free(spn);
1547 krb5_make_principal(context, &sp, r,
1548 KRB5_TGS_NAME, new_rlm, NULL);
1549 ret = krb5_unparse_name(context, sp, &spn);
1550 if (ret)
1551 goto out;
1552
1553 if (ref_realm)
1554 free(ref_realm);
1555 ref_realm = strdup(new_rlm);
1556 goto server_lookup;
1557 }
1558 }
1559 } else if(need_referral(context, config, &b->kdc_options, sp, &realms)) {
1560 if (strcmp(realms[0], sp->realm) != 0) {
1561 kdc_log(context, config, 5,
1562 "Returning a referral to realm %s for "
1563 "server %s that was not found",
1564 realms[0], spn);
1565 krb5_free_principal(context, sp);
1566 free(spn);
1567 krb5_make_principal(context, &sp, r, KRB5_TGS_NAME,
1568 realms[0], NULL);
1569 ret = krb5_unparse_name(context, sp, &spn);
1570 if (ret)
1571 goto out;
1572
1573 if (ref_realm)
1574 free(ref_realm);
1575 ref_realm = strdup(realms[0]);
1576
1577 krb5_free_host_realm(context, realms);
1578 goto server_lookup;
1579 }
1580 krb5_free_host_realm(context, realms);
1581 }
1582 msg = krb5_get_error_message(context, ret);
1583 kdc_log(context, config, 0,
1584 "Server not found in database: %s: %s", spn, msg);
1585 krb5_free_error_message(context, msg);
1586 if (ret == HDB_ERR_NOENTRY)
1587 ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1588 goto out;
1589 }
1590
1591 ret = _kdc_db_fetch(context, config, cp, HDB_F_GET_CLIENT | HDB_F_CANON,
1592 &clientdb, &client);
1593 if(ret) {
1594 const char *krbtgt_realm, *msg;
1595
1596 /*
1597 * If the client belongs to the same realm as our krbtgt, it
1598 * should exist in the local database.
1599 *
1600 */
1601
1602 krbtgt_realm =
1603 krb5_principal_get_comp_string(context,
1604 krbtgt->entry.principal, 1);
1605
1606 if(strcmp(krb5_principal_get_realm(context, cp), krbtgt_realm) == 0) {
1607 if (ret == HDB_ERR_NOENTRY)
1608 ret = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
1609 kdc_log(context, config, 1, "Client no longer in database: %s",
1610 cpn);
1611 goto out;
1612 }
1613
1614 msg = krb5_get_error_message(context, ret);
1615 kdc_log(context, config, 1, "Client not found in database: %s", msg);
1616 krb5_free_error_message(context, msg);
1617 }
1618
1619 /*
1620 * Select enctype, return key and kvno.
1621 */
1622
1623 {
1624 krb5_enctype etype;
1625
1626 if(b->kdc_options.enc_tkt_in_skey) {
1627 int i;
1628 ekey = &adtkt.key;
1629 for(i = 0; i < b->etype.len; i++)
1630 if (b->etype.val[i] == adtkt.key.keytype)
1631 break;
1632 if(i == b->etype.len) {
1633 kdc_log(context, config, 0,
1634 "Addition ticket have not matching etypes");
1635 krb5_clear_error_message(context);
1636 ret = KRB5KDC_ERR_ETYPE_NOSUPP;
1637 goto out;
1638 }
1639 etype = b->etype.val[i];
1640 kvno = 0;
1641 } else {
1642 Key *skey;
1643
1644 ret = _kdc_find_etype(context, server,
1645 b->etype.val, b->etype.len, &skey);
1646 if(ret) {
1647 kdc_log(context, config, 0,
1648 "Server (%s) has no support for etypes", spn);
1649 goto out;
1650 }
1651 ekey = &skey->key;
1652 etype = skey->key.keytype;
1653 kvno = server->entry.kvno;
1654 }
1655
1656 ret = krb5_generate_random_keyblock(context, etype, &sessionkey);
1657 if (ret)
1658 goto out;
1659 }
1660
1661 /*
1662 * Check that service is in the same realm as the krbtgt. If it's
1663 * not the same, it's someone that is using a uni-directional trust
1664 * backward.
1665 */
1666
1667 if (strcmp(krb5_principal_get_realm(context, sp),
1668 krb5_principal_get_comp_string(context,
1669 krbtgt->entry.principal,
1670 1)) != 0) {
1671 char *tpn;
1672 ret = krb5_unparse_name(context, krbtgt->entry.principal, &tpn);
1673 kdc_log(context, config, 0,
1674 "Request with wrong krbtgt: %s",
1675 (ret == 0) ? tpn : "<unknown>");
1676 if(ret == 0)
1677 free(tpn);
1678 ret = KRB5KRB_AP_ERR_NOT_US;
1679 goto out;
1680 }
1681
1682 /*
1683 * Validate authoriation data
1684 */
1685
1686 ret = hdb_enctype2key(context, &krbtgt->entry,
1687 krbtgt_etype, &tkey);
1688 if(ret) {
1689 kdc_log(context, config, 0,
1690 "Failed to find key for krbtgt PAC check");
1691 goto out;
1692 }
1693
1694 ret = check_PAC(context, config, cp,
1695 client, server, ekey, &tkey->key,
1696 tgt, &rspac, &signedpath);
1697 if (ret) {
1698 const char *msg = krb5_get_error_message(context, ret);
1699 kdc_log(context, config, 0,
1700 "Verify PAC failed for %s (%s) from %s with %s",
1701 spn, cpn, from, msg);
1702 krb5_free_error_message(context, msg);
1703 goto out;
1704 }
1705
1706 /* also check the krbtgt for signature */
1707 ret = check_KRB5SignedPath(context,
1708 config,
1709 krbtgt,
1710 cp,
1711 tgt,
1712 &spp,
1713 &signedpath);
1714 if (ret) {
1715 const char *msg = krb5_get_error_message(context, ret);
1716 kdc_log(context, config, 0,
1717 "KRB5SignedPath check failed for %s (%s) from %s with %s",
1718 spn, cpn, from, msg);
1719 krb5_free_error_message(context, msg);
1720 goto out;
1721 }
1722
1723 /*
1724 * Process request
1725 */
1726
1727 client_principal = cp;
1728
1729 if (client) {
1730 const PA_DATA *sdata;
1731 int i = 0;
1732
1733 sdata = _kdc_find_padata(req, &i, KRB5_PADATA_FOR_USER);
1734 if (sdata) {
1735 krb5_crypto crypto;
1736 krb5_data datack;
1737 PA_S4U2Self self;
1738 char *selfcpn = NULL;
1739 const char *str;
1740
1741 ret = decode_PA_S4U2Self(sdata->padata_value.data,
1742 sdata->padata_value.length,
1743 &self, NULL);
1744 if (ret) {
1745 kdc_log(context, config, 0, "Failed to decode PA-S4U2Self");
1746 goto out;
1747 }
1748
1749 ret = _krb5_s4u2self_to_checksumdata(context, &self, &datack);
1750 if (ret)
1751 goto out;
1752
1753 ret = krb5_crypto_init(context, &tgt->key, 0, &crypto);
1754 if (ret) {
1755 const char *msg = krb5_get_error_message(context, ret);
1756 free_PA_S4U2Self(&self);
1757 krb5_data_free(&datack);
1758 kdc_log(context, config, 0, "krb5_crypto_init failed: %s", msg);
1759 krb5_free_error_message(context, msg);
1760 goto out;
1761 }
1762
1763 ret = krb5_verify_checksum(context,
1764 crypto,
1765 KRB5_KU_OTHER_CKSUM,
1766 datack.data,
1767 datack.length,
1768 &self.cksum);
1769 krb5_data_free(&datack);
1770 krb5_crypto_destroy(context, crypto);
1771 if (ret) {
1772 const char *msg = krb5_get_error_message(context, ret);
1773 free_PA_S4U2Self(&self);
1774 kdc_log(context, config, 0,
1775 "krb5_verify_checksum failed for S4U2Self: %s", msg);
1776 krb5_free_error_message(context, msg);
1777 goto out;
1778 }
1779
1780 ret = _krb5_principalname2krb5_principal(context,
1781 &client_principal,
1782 self.name,
1783 self.realm);
1784 free_PA_S4U2Self(&self);
1785 if (ret)
1786 goto out;
1787
1788 ret = krb5_unparse_name(context, client_principal, &selfcpn);
1789 if (ret)
1790 goto out;
1791
1792 /*
1793 * Check that service doing the impersonating is
1794 * requesting a ticket to it-self.
1795 */
1796 if (krb5_principal_compare(context, cp, sp) != TRUE) {
1797 kdc_log(context, config, 0, "S4U2Self: %s is not allowed "
1798 "to impersonate some other user "
1799 "(tried for user %s to service %s)",
1800 cpn, selfcpn, spn);
1801 free(selfcpn);
1802 ret = KRB5KDC_ERR_BADOPTION; /* ? */
1803 goto out;
1804 }
1805
1806 /*
1807 * If the service isn't trusted for authentication to
1808 * delegation, remove the forward flag.
1809 */
1810
1811 if (client->entry.flags.trusted_for_delegation) {
1812 str = "[forwardable]";
1813 } else {
1814 b->kdc_options.forwardable = 0;
1815 str = "";
1816 }
1817 kdc_log(context, config, 0, "s4u2self %s impersonating %s to "
1818 "service %s %s", cpn, selfcpn, spn, str);
1819 free(selfcpn);
1820 }
1821 }
1822
1823 /*
1824 * Constrained delegation
1825 */
1826
1827 if (client != NULL
1828 && b->additional_tickets != NULL
1829 && b->additional_tickets->len != 0
1830 && b->kdc_options.enc_tkt_in_skey == 0)
1831 {
1832 int ad_signedpath = 0;
1833 Key *clientkey;
1834 Ticket *t;
1835 char *str;
1836
1837 /*
1838 * Require that the KDC have issued the service's krbtgt (not
1839 * self-issued ticket with kimpersonate(1).
1840 */
1841 if (!signedpath) {
1842 ret = KRB5KDC_ERR_BADOPTION;
1843 kdc_log(context, config, 0,
1844 "Constrained delegation done on service ticket %s/%s",
1845 cpn, spn);
1846 goto out;
1847 }
1848
1849 t = &b->additional_tickets->val[0];
1850
1851 ret = hdb_enctype2key(context, &client->entry,
1852 t->enc_part.etype, &clientkey);
1853 if(ret){
1854 ret = KRB5KDC_ERR_ETYPE_NOSUPP; /* XXX */
1855 goto out;
1856 }
1857
1858 ret = krb5_decrypt_ticket(context, t, &clientkey->key, &adtkt, 0);
1859 if (ret) {
1860 kdc_log(context, config, 0,
1861 "failed to decrypt ticket for "
1862 "constrained delegation from %s to %s ", cpn, spn);
1863 goto out;
1864 }
1865
1866 /* check that ticket is valid */
1867 if (adtkt.flags.forwardable == 0) {
1868 kdc_log(context, config, 0,
1869 "Missing forwardable flag on ticket for "
1870 "constrained delegation from %s to %s ", cpn, spn);
1871 ret = KRB5KDC_ERR_BADOPTION;
1872 goto out;
1873 }
1874
1875 ret = check_constrained_delegation(context, config, clientdb,
1876 client, sp);
1877 if (ret) {
1878 kdc_log(context, config, 0,
1879 "constrained delegation from %s to %s not allowed",
1880 cpn, spn);
1881 goto out;
1882 }
1883
1884 ret = _krb5_principalname2krb5_principal(context,
1885 &client_principal,
1886 adtkt.cname,
1887 adtkt.crealm);
1888 if (ret)
1889 goto out;
1890
1891 ret = krb5_unparse_name(context, client_principal, &str);
1892 if (ret)
1893 goto out;
1894
1895 ret = verify_flags(context, config, &adtkt, str);
1896 if (ret) {
1897 free(str);
1898 goto out;
1899 }
1900
1901 /*
1902 * Check that the KDC issued the user's ticket.
1903 */
1904 ret = check_KRB5SignedPath(context,
1905 config,
1906 krbtgt,
1907 cp,
1908 &adtkt,
1909 NULL,
1910 &ad_signedpath);
1911 if (ret == 0 && !ad_signedpath)
1912 ret = KRB5KDC_ERR_BADOPTION;
1913 if (ret) {
1914 const char *msg = krb5_get_error_message(context, ret);
1915 kdc_log(context, config, 0,
1916 "KRB5SignedPath check from service %s failed "
1917 "for delegation to %s for client %s "
1918 "from %s failed with %s",
1919 spn, str, cpn, from, msg);
1920 krb5_free_error_message(context, msg);
1921 free(str);
1922 goto out;
1923 }
1924
1925 kdc_log(context, config, 0, "constrained delegation for %s "
1926 "from %s to %s", str, cpn, spn);
1927 free(str);
1928 }
1929
1930 /*
1931 * Check flags
1932 */
1933
1934 ret = kdc_check_flags(context, config,
1935 client, cpn,
1936 server, spn,
1937 FALSE);
1938 if(ret)
1939 goto out;
1940
1941 if((b->kdc_options.validate || b->kdc_options.renew) &&
1942 !krb5_principal_compare(context,
1943 krbtgt->entry.principal,
1944 server->entry.principal)){
1945 kdc_log(context, config, 0, "Inconsistent request.");
1946 ret = KRB5KDC_ERR_SERVER_NOMATCH;
1947 goto out;
1948 }
1949
1950 /* check for valid set of addresses */
1951 if(!_kdc_check_addresses(context, config, tgt->caddr, from_addr)) {
1952 ret = KRB5KRB_AP_ERR_BADADDR;
1953 kdc_log(context, config, 0, "Request from wrong address");
1954 goto out;
1955 }
1956
1957 /*
1958 * If this is an referral, add server referral data to the
1959 * auth_data reply .
1960 */
1961 if (ref_realm) {
1962 PA_DATA pa;
1963 krb5_crypto crypto;
1964
1965 kdc_log(context, config, 0,
1966 "Adding server referral to %s", ref_realm);
1967
1968 ret = krb5_crypto_init(context, &sessionkey, 0, &crypto);
1969 if (ret)
1970 goto out;
1971
1972 ret = build_server_referral(context, config, crypto, ref_realm,
1973 NULL, s, &pa.padata_value);
1974 krb5_crypto_destroy(context, crypto);
1975 if (ret) {
1976 kdc_log(context, config, 0,
1977 "Failed building server referral");
1978 goto out;
1979 }
1980 pa.padata_type = KRB5_PADATA_SERVER_REFERRAL;
1981
1982 ret = add_METHOD_DATA(&enc_pa_data, &pa);
1983 krb5_data_free(&pa.padata_value);
1984 if (ret) {
1985 kdc_log(context, config, 0,
1986 "Add server referral METHOD-DATA failed");
1987 goto out;
1988 }
1989 }
1990
1991 /*
1992 *
1993 */
1994
1995 ret = tgs_make_reply(context,
1996 config,
1997 b,
1998 client_principal,
1999 tgt,
2000 replykey,
2001 rk_is_subkey,
2002 ekey,
2003 &sessionkey,
2004 kvno,
2005 *auth_data,
2006 server,
2007 sp,
2008 spn,
2009 client,
2010 cp,
2011 krbtgt,
2012 krbtgt_etype,
2013 spp,
2014 &rspac,
2015 &enc_pa_data,
2016 e_text,
2017 reply);
2018
2019 out:
2020 free(spn);
2021 free(cpn);
2022
2023 krb5_data_free(&rspac);
2024 krb5_free_keyblock_contents(context, &sessionkey);
2025 if(server)
2026 _kdc_free_ent(context, server);
2027 if(client)
2028 _kdc_free_ent(context, client);
2029
2030 if (client_principal && client_principal != cp)
2031 krb5_free_principal(context, client_principal);
2032 if (cp)
2033 krb5_free_principal(context, cp);
2034 if (sp)
2035 krb5_free_principal(context, sp);
2036 if (ref_realm)
2037 free(ref_realm);
2038 free_METHOD_DATA(&enc_pa_data);
2039
2040 free_EncTicketPart(&adtkt);
2041
2042 return ret;
2043 }
2044
2045 /*
2046 *
2047 */
2048
2049 krb5_error_code
2050 _kdc_tgs_rep(krb5_context context,
2051 krb5_kdc_configuration *config,
2052 KDC_REQ *req,
2053 krb5_data *data,
2054 const char *from,
2055 struct sockaddr *from_addr,
2056 int datagram_reply)
2057 {
2058 AuthorizationData *auth_data = NULL;
2059 krb5_error_code ret;
2060 int i = 0;
2061 const PA_DATA *tgs_req;
2062
2063 hdb_entry_ex *krbtgt = NULL;
2064 krb5_ticket *ticket = NULL;
2065 const char *e_text = NULL;
2066 krb5_enctype krbtgt_etype = ETYPE_NULL;
2067
2068 krb5_keyblock *replykey = NULL;
2069 int rk_is_subkey = 0;
2070 time_t *csec = NULL;
2071 int *cusec = NULL;
2072
2073 if(req->padata == NULL){
2074 ret = KRB5KDC_ERR_PREAUTH_REQUIRED; /* XXX ??? */
2075 kdc_log(context, config, 0,
2076 "TGS-REQ from %s without PA-DATA", from);
2077 goto out;
2078 }
2079
2080 tgs_req = _kdc_find_padata(req, &i, KRB5_PADATA_TGS_REQ);
2081
2082 if(tgs_req == NULL){
2083 ret = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;
2084
2085 kdc_log(context, config, 0,
2086 "TGS-REQ from %s without PA-TGS-REQ", from);
2087 goto out;
2088 }
2089 ret = tgs_parse_request(context, config,
2090 &req->req_body, tgs_req,
2091 &krbtgt,
2092 &krbtgt_etype,
2093 &ticket,
2094 &e_text,
2095 from, from_addr,
2096 &csec, &cusec,
2097 &auth_data,
2098 &replykey,
2099 &rk_is_subkey);
2100 if (ret) {
2101 kdc_log(context, config, 0,
2102 "Failed parsing TGS-REQ from %s", from);
2103 goto out;
2104 }
2105
2106 ret = tgs_build_reply(context,
2107 config,
2108 req,
2109 &req->req_body,
2110 krbtgt,
2111 krbtgt_etype,
2112 replykey,
2113 rk_is_subkey,
2114 ticket,
2115 data,
2116 from,
2117 &e_text,
2118 &auth_data,
2119 from_addr);
2120 if (ret) {
2121 kdc_log(context, config, 0,
2122 "Failed building TGS-REP to %s", from);
2123 goto out;
2124 }
2125
2126 /* */
2127 if (datagram_reply && data->length > config->max_datagram_reply_length) {
2128 krb5_data_free(data);
2129 ret = KRB5KRB_ERR_RESPONSE_TOO_BIG;
2130 e_text = "Reply packet too large";
2131 }
2132
2133 out:
2134 if (replykey)
2135 krb5_free_keyblock(context, replykey);
2136 if(ret && data->data == NULL){
2137 krb5_mk_error(context,
2138 ret,
2139 NULL,
2140 NULL,
2141 NULL,
2142 NULL,
2143 csec,
2144 cusec,
2145 data);
2146 }
2147 free(csec);
2148 free(cusec);
2149 if (ticket)
2150 krb5_free_ticket(context, ticket);
2151 if(krbtgt)
2152 _kdc_free_ent(context, krbtgt);
2153
2154 if (auth_data) {
2155 free_AuthorizationData(auth_data);
2156 free(auth_data);
2157 }
2158
2159 return 0;
2160 }
Heimdal