lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "krb5_locl.h"
  37 #include <assert.h>
  38
  39 static krb5_error_code
  40 get_cred_kdc_capath(krb5_context, krb5_kdc_flags,
  41                     krb5_ccache, krb5_creds *, krb5_principal,
  42                     Ticket *, krb5_creds **, krb5_creds ***);
  43
  44 /*
  45  * Take the `body' and encode it into `padata' using the credentials
  46  * in `creds'.
  47  */
  48
  49 static krb5_error_code
  50 make_pa_tgs_req(krb5_context context,
  51                 krb5_auth_context ac,
  52                 KDC_REQ_BODY *body,
  53                 PA_DATA *padata,
  54                 krb5_creds *creds)
  55 {
  56     u_char *buf;
  57     size_t buf_size;
  58     size_t len = 0;
  59     krb5_data in_data;
  60     krb5_error_code ret;
  61
  62     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  63     if (ret)
  64         goto out;
  65     if(buf_size != len)
  66         krb5_abortx(context, "internal error in ASN.1 encoder");
  67
  68     in_data.length = len;
  69     in_data.data   = buf;
  70     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  71                                 &padata->padata_value,
  72                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  73                                 KRB5_KU_TGS_REQ_AUTH);
  74  out:
  75     free (buf);
  76     if(ret)
  77         return ret;
  78     padata->padata_type = KRB5_PADATA_TGS_REQ;
  79     return 0;
  80 }
  81
  82 /*
  83  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  84  */
  85
  86 static krb5_error_code
  87 set_auth_data (krb5_context context,
  88                KDC_REQ_BODY *req_body,
  89                krb5_authdata *authdata,
  90                krb5_keyblock *subkey)
  91 {
  92     if(authdata->len) {
  93         size_t len = 0, buf_size;
  94         unsigned char *buf;
  95         krb5_crypto crypto;
  96         krb5_error_code ret;
  97
  98         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  99                            &len, ret);
 100         if (ret)
 101             return ret;
 102         if (buf_size != len)
 103             krb5_abortx(context, "internal error in ASN.1 encoder");
 104
 105         ALLOC(req_body->enc_authorization_data, 1);
 106         if (req_body->enc_authorization_data == NULL) {
 107             free (buf);
 108             return krb5_enomem(context);
 109         }
 110         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 111         if (ret) {
 112             free (buf);
 113             free (req_body->enc_authorization_data);
 114             req_body->enc_authorization_data = NULL;
 115             return ret;
 116         }
 117         krb5_encrypt_EncryptedData(context,
 118                                    crypto,
 119                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 120                                    buf,
 121                                    len,
 122                                    0,
 123                                    req_body->enc_authorization_data);
 124         free (buf);
 125         krb5_crypto_destroy(context, crypto);
 126     } else {
 127         req_body->enc_authorization_data = NULL;
 128     }
 129     return 0;
 130 }
 131
 132 /*
 133  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 134  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 135  * subkey in `subkey'.
 136  */
 137
 138 static krb5_error_code
 139 init_tgs_req (krb5_context context,
 140               krb5_ccache ccache,
 141               krb5_addresses *addresses,
 142               krb5_kdc_flags flags,
 143               Ticket *second_ticket,
 144               krb5_creds *in_creds,
 145               krb5_creds *krbtgt,
 146               unsigned nonce,
 147               const METHOD_DATA *padata,
 148               krb5_keyblock **subkey,
 149               TGS_REQ *t)
 150 {
 151     krb5_auth_context ac = NULL;
 152     krb5_error_code ret = 0;
 153
 154     memset(t, 0, sizeof(*t));
 155     t->pvno = 5;
 156     t->msg_type = krb_tgs_req;
 157     if (in_creds->session.keytype) {
 158         ALLOC_SEQ(&t->req_body.etype, 1);
 159         if(t->req_body.etype.val == NULL) {
 160             ret = krb5_enomem(context);
 161             goto fail;
 162         }
 163         t->req_body.etype.val[0] = in_creds->session.keytype;
 164     } else {
 165         ret = _krb5_init_etype(context,
 166                                KRB5_PDU_TGS_REQUEST,
 167                                &t->req_body.etype.len,
 168                                &t->req_body.etype.val,
 169                                NULL);
 170     }
 171     if (ret)
 172         goto fail;
 173     t->req_body.addresses = addresses;
 174     t->req_body.kdc_options = flags.b;
 175     t->req_body.kdc_options.forwardable = krbtgt->flags.b.forwardable;
 176     t->req_body.kdc_options.renewable = krbtgt->flags.b.renewable;
 177     t->req_body.kdc_options.proxiable = krbtgt->flags.b.proxiable;
 178     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 179     if (ret)
 180         goto fail;
 181     ALLOC(t->req_body.sname, 1);
 182     if (t->req_body.sname == NULL) {
 183         ret = krb5_enomem(context);
 184         goto fail;
 185     }
 186
 187     /* some versions of some code might require that the client be
 188        present in TGS-REQs, but this is clearly against the spec */
 189
 190     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 191     if (ret)
 192         goto fail;
 193
 194     if (krbtgt->times.starttime) {
 195         ALLOC(t->req_body.from, 1);
 196         if(t->req_body.from == NULL){
 197             ret = krb5_enomem(context);
 198             goto fail;
 199         }
 200         *t->req_body.from = in_creds->times.starttime;
 201     }
 202
 203     /* req_body.till should be NULL if there is no endtime specified,
 204        but old MIT code (like DCE secd) doesn't like that */
 205     ALLOC(t->req_body.till, 1);
 206     if(t->req_body.till == NULL){
 207         ret = krb5_enomem(context);
 208         goto fail;
 209     }
 210     *t->req_body.till = in_creds->times.endtime;
 211
 212     if (t->req_body.kdc_options.renewable && krbtgt->times.renew_till) {
 213         ALLOC(t->req_body.rtime, 1);
 214         if(t->req_body.rtime == NULL){
 215             ret = krb5_enomem(context);
 216             goto fail;
 217         }
 218         *t->req_body.rtime = in_creds->times.renew_till;
 219     }
 220
 221     t->req_body.nonce = nonce;
 222     if(second_ticket){
 223         ALLOC(t->req_body.additional_tickets, 1);
 224         if (t->req_body.additional_tickets == NULL) {
 225             ret = krb5_enomem(context);
 226             goto fail;
 227         }
 228         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 229         if (t->req_body.additional_tickets->val == NULL) {
 230             ret = krb5_enomem(context);
 231             goto fail;
 232         }
 233         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 234         if (ret)
 235             goto fail;
 236     }
 237     ALLOC(t->padata, 1);
 238     if (t->padata == NULL) {
 239         ret = krb5_enomem(context);
 240         goto fail;
 241     }
 242     ALLOC_SEQ(t->padata, 1 + padata->len);
 243     if (t->padata->val == NULL) {
 244         ret = krb5_enomem(context);
 245         goto fail;
 246     }
 247     {
 248         size_t i;
 249         for (i = 0; i < padata->len; i++) {
 250             ret = copy_PA_DATA(&padata->val[i], &t->padata->val[i + 1]);
 251             if (ret) {
 252                 krb5_set_error_message(context, ret,
 253                                        N_("malloc: out of memory", ""));
 254                 goto fail;
 255             }
 256         }
 257     }
 258
 259     ret = krb5_auth_con_init(context, &ac);
 260     if(ret)
 261         goto fail;
 262
 263     ret = krb5_auth_con_generatelocalsubkey(context, ac, &krbtgt->session);
 264     if (ret)
 265         goto fail;
 266
 267     ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 268                          ac->local_subkey);
 269     if (ret)
 270         goto fail;
 271
 272     ret = make_pa_tgs_req(context,
 273                           ac,
 274                           &t->req_body,
 275                           &t->padata->val[0],
 276                           krbtgt);
 277     if(ret)
 278         goto fail;
 279
 280     ret = krb5_auth_con_getlocalsubkey(context, ac, subkey);
 281     if (ret)
 282         goto fail;
 283
 284 fail:
 285     if (ac)
 286         krb5_auth_con_free(context, ac);
 287     if (ret) {
 288         t->req_body.addresses = NULL;
 289         free_TGS_REQ (t);
 290     }
 291     return ret;
 292 }
 293
 294 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 295 _krb5_get_krbtgt(krb5_context context,
 296                  krb5_ccache  id,
 297                  krb5_realm realm,
 298                  krb5_creds **cred)
 299 {
 300     krb5_error_code ret;
 301     krb5_creds tmp_cred;
 302
 303     memset(&tmp_cred, 0, sizeof(tmp_cred));
 304
 305     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 306     if (ret)
 307         return ret;
 308
 309     ret = krb5_make_principal(context,
 310                               &tmp_cred.server,
 311                               realm,
 312                               KRB5_TGS_NAME,
 313                               realm,
 314                               NULL);
 315     if(ret) {
 316         krb5_free_principal(context, tmp_cred.client);
 317         return ret;
 318     }
 319     ret = krb5_get_credentials(context,
 320                                KRB5_GC_CACHED,
 321                                id,
 322                                &tmp_cred,
 323                                cred);
 324     krb5_free_principal(context, tmp_cred.client);
 325     krb5_free_principal(context, tmp_cred.server);
 326     if(ret)
 327         return ret;
 328     return 0;
 329 }
 330
 331 /* DCE compatible decrypt proc */
 332 static krb5_error_code KRB5_CALLCONV
 333 decrypt_tkt_with_subkey (krb5_context context,
 334                          krb5_keyblock *key,
 335                          krb5_key_usage usage,
 336                          krb5_const_pointer skey,
 337                          krb5_kdc_rep *dec_rep)
 338 {
 339     const krb5_keyblock *subkey = skey;
 340     krb5_error_code ret = 0;
 341     krb5_data data;
 342     size_t size;
 343     krb5_crypto crypto;
 344
 345     assert(usage == 0);
 346
 347     krb5_data_zero(&data);
 348
 349     /*
 350      * start out with trying with subkey if we have one
 351      */
 352     if (subkey) {
 353         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 354         if (ret)
 355             return ret;
 356         ret = krb5_decrypt_EncryptedData (context,
 357                                           crypto,
 358                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 359                                           &dec_rep->kdc_rep.enc_part,
 360                                           &data);
 361         /*
 362          * If the is Windows 2000 DC, we need to retry with key usage
 363          * 8 when doing ARCFOUR.
 364          */
 365         if (ret && subkey->keytype == ETYPE_ARCFOUR_HMAC_MD5) {
 366             ret = krb5_decrypt_EncryptedData(context,
 367                                              crypto,
 368                                              8,
 369                                              &dec_rep->kdc_rep.enc_part,
 370                                              &data);
 371         }
 372         krb5_crypto_destroy(context, crypto);
 373     }
 374     if (subkey == NULL || ret) {
 375         ret = krb5_crypto_init(context, key, 0, &crypto);
 376         if (ret)
 377             return ret;
 378         ret = krb5_decrypt_EncryptedData (context,
 379                                           crypto,
 380                                           KRB5_KU_TGS_REP_ENC_PART_SESSION,
 381                                           &dec_rep->kdc_rep.enc_part,
 382                                           &data);
 383         krb5_crypto_destroy(context, crypto);
 384     }
 385     if (ret)
 386         return ret;
 387
 388     ret = decode_EncASRepPart(data.data,
 389                               data.length,
 390                               &dec_rep->enc_part,
 391                               &size);
 392     if (ret)
 393         ret = decode_EncTGSRepPart(data.data,
 394                                    data.length,
 395                                    &dec_rep->enc_part,
 396                                    &size);
 397     if (ret)
 398       krb5_set_error_message(context, ret,
 399                              N_("Failed to decode encpart in ticket", ""));
 400     krb5_data_free (&data);
 401     return ret;
 402 }
 403
 404 static krb5_error_code
 405 get_cred_kdc(krb5_context context,
 406              krb5_ccache id,
 407              krb5_kdc_flags flags,
 408              krb5_addresses *addresses,
 409              krb5_creds *in_creds,
 410              krb5_creds *krbtgt,
 411              krb5_principal impersonate_principal,
 412              Ticket *second_ticket,
 413              krb5_creds *out_creds)
 414 {
 415     TGS_REQ req;
 416     krb5_data enc;
 417     krb5_data resp;
 418     krb5_kdc_rep rep;
 419     KRB_ERROR error;
 420     krb5_error_code ret;
 421     unsigned nonce;
 422     krb5_keyblock *subkey = NULL;
 423     size_t len = 0;
 424     Ticket second_ticket_data;
 425     METHOD_DATA padata;
 426
 427     krb5_data_zero(&resp);
 428     krb5_data_zero(&enc);
 429     padata.val = NULL;
 430     padata.len = 0;
 431
 432     krb5_generate_random_block(&nonce, sizeof(nonce));
 433     nonce &= 0xffffffff;
 434
 435     if(flags.b.enc_tkt_in_skey && second_ticket == NULL){
 436         ret = decode_Ticket(in_creds->second_ticket.data,
 437                             in_creds->second_ticket.length,
 438                             &second_ticket_data, &len);
 439         if(ret)
 440             return ret;
 441         second_ticket = &second_ticket_data;
 442     }
 443
 444
 445     if (impersonate_principal) {
 446         krb5_crypto crypto;
 447         PA_S4U2Self self;
 448         krb5_data data;
 449         void *buf;
 450         size_t size = 0;
 451
 452         self.name = impersonate_principal->name;
 453         self.realm = impersonate_principal->realm;
 454         self.auth = estrdup("Kerberos");
 455
 456         ret = _krb5_s4u2self_to_checksumdata(context, &self, &data);
 457         if (ret) {
 458             free(self.auth);
 459             goto out;
 460         }
 461
 462         ret = krb5_crypto_init(context, &krbtgt->session, 0, &crypto);
 463         if (ret) {
 464             free(self.auth);
 465             krb5_data_free(&data);
 466             goto out;
 467         }
 468
 469         ret = krb5_create_checksum(context,
 470                                    crypto,
 471                                    KRB5_KU_OTHER_CKSUM,
 472                                    0,
 473                                    data.data,
 474                                    data.length,
 475                                    &self.cksum);
 476         krb5_crypto_destroy(context, crypto);
 477         krb5_data_free(&data);
 478         if (ret) {
 479             free(self.auth);
 480             goto out;
 481         }
 482
 483         ASN1_MALLOC_ENCODE(PA_S4U2Self, buf, len, &self, &size, ret);
 484         free(self.auth);
 485         free_Checksum(&self.cksum);
 486         if (ret)
 487             goto out;
 488         if (len != size)
 489             krb5_abortx(context, "internal asn1 error");
 490
 491         ret = krb5_padata_add(context, &padata, KRB5_PADATA_FOR_USER, buf, len);
 492         if (ret)
 493             goto out;
 494     }
 495
 496     ret = init_tgs_req (context,
 497                         id,
 498                         addresses,
 499                         flags,
 500                         second_ticket,
 501                         in_creds,
 502                         krbtgt,
 503                         nonce,
 504                         &padata,
 505                         &subkey,
 506                         &req);
 507     if (ret)
 508         goto out;
 509
 510     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 511     if (ret)
 512         goto out;
 513     if(enc.length != len)
 514         krb5_abortx(context, "internal error in ASN.1 encoder");
 515
 516     /* don't free addresses */
 517     req.req_body.addresses = NULL;
 518     free_TGS_REQ(&req);
 519
 520     /*
 521      * Send and receive
 522      */
 523     {
 524         krb5_sendto_ctx stctx;
 525         ret = krb5_sendto_ctx_alloc(context, &stctx);
 526         if (ret)
 527             return ret;
 528         krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
 529
 530         ret = krb5_sendto_context (context, stctx, &enc,
 531                                    krbtgt->server->name.name_string.val[1],
 532                                    &resp);
 533         krb5_sendto_ctx_free(context, stctx);
 534     }
 535     if(ret)
 536         goto out;
 537
 538     memset(&rep, 0, sizeof(rep));
 539     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
 540         unsigned eflags = 0;
 541
 542         ret = krb5_copy_principal(context,
 543                                   in_creds->client,
 544                                   &out_creds->client);
 545         if(ret)
 546             goto out2;
 547         ret = krb5_copy_principal(context,
 548                                   in_creds->server,
 549                                   &out_creds->server);
 550         if(ret)
 551             goto out2;
 552         /* this should go someplace else */
 553         out_creds->times.endtime = in_creds->times.endtime;
 554
 555         /* XXX should do better testing */
 556         if (flags.b.constrained_delegation || impersonate_principal)
 557             eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 558
 559         ret = _krb5_extract_ticket(context,
 560                                    &rep,
 561                                    out_creds,
 562                                    &krbtgt->session,
 563                                    NULL,
 564                                    0,
 565                                    &krbtgt->addresses,
 566                                    nonce,
 567                                    eflags,
 568                                    NULL,
 569                                    decrypt_tkt_with_subkey,
 570                                    subkey);
 571     out2:
 572         krb5_free_kdc_rep(context, &rep);
 573     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 574         ret = krb5_error_from_rd_error(context, &error, in_creds);
 575         krb5_free_error_contents(context, &error);
 576     } else if(resp.length > 0 && ((char*)resp.data)[0] == 4) {
 577         ret = KRB5KRB_AP_ERR_V4_REPLY;
 578         krb5_clear_error_message(context);
 579     } else {
 580         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 581         krb5_clear_error_message(context);
 582     }
 583
 584 out:
 585     if (second_ticket == &second_ticket_data)
 586         free_Ticket(&second_ticket_data);
 587     free_METHOD_DATA(&padata);
 588     krb5_data_free(&resp);
 589     krb5_data_free(&enc);
 590     if(subkey)
 591         krb5_free_keyblock(context, subkey);
 592     return ret;
 593
 594 }
 595
 596 /*
 597  * same as above, just get local addresses first if the krbtgt have
 598  * them and the realm is not addressless
 599  */
 600
 601 static krb5_error_code
 602 get_cred_kdc_address(krb5_context context,
 603                      krb5_ccache id,
 604                      krb5_kdc_flags flags,
 605                      krb5_addresses *addrs,
 606                      krb5_creds *in_creds,
 607                      krb5_creds *krbtgt,
 608                      krb5_principal impersonate_principal,
 609                      Ticket *second_ticket,
 610                      krb5_creds *out_creds)
 611 {
 612     krb5_error_code ret;
 613     krb5_addresses addresses = { 0, NULL };
 614
 615     /*
 616      * Inherit the address-ness of the krbtgt if the address is not
 617      * specified.
 618      */
 619
 620     if (addrs == NULL && krbtgt->addresses.len != 0) {
 621         krb5_boolean noaddr;
 622
 623         krb5_appdefault_boolean(context, NULL, krbtgt->server->realm,
 624                                 "no-addresses", FALSE, &noaddr);
 625
 626         if (!noaddr) {
 627             krb5_get_all_client_addrs(context, &addresses);
 628             /* XXX this sucks. */
 629             addrs = &addresses;
 630             if(addresses.len == 0)
 631                 addrs = NULL;
 632         }
 633     }
 634     ret = get_cred_kdc(context, id, flags, addrs, in_creds,
 635                        krbtgt, impersonate_principal,
 636                        second_ticket, out_creds);
 637     krb5_free_addresses(context, &addresses);
 638     return ret;
 639 }
 640
 641 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 642 krb5_get_kdc_cred(krb5_context context,
 643                   krb5_ccache id,
 644                   krb5_kdc_flags flags,
 645                   krb5_addresses *addresses,
 646                   Ticket  *second_ticket,
 647                   krb5_creds *in_creds,
 648                   krb5_creds **out_creds
 649                   )
 650 {
 651     krb5_error_code ret;
 652     krb5_creds *krbtgt;
 653
 654     *out_creds = calloc(1, sizeof(**out_creds));
 655     if(*out_creds == NULL)
 656         return krb5_enomem(context);
 657     ret = _krb5_get_krbtgt (context,
 658                             id,
 659                             in_creds->server->realm,
 660                             &krbtgt);
 661     if(ret) {
 662         free(*out_creds);
 663         *out_creds = NULL;
 664         return ret;
 665     }
 666     ret = get_cred_kdc(context, id, flags, addresses,
 667                        in_creds, krbtgt, NULL, NULL, *out_creds);
 668     krb5_free_creds (context, krbtgt);
 669     if(ret) {
 670         free(*out_creds);
 671         *out_creds = NULL;
 672     }
 673     return ret;
 674 }
 675
 676 static int
 677 not_found(krb5_context context, krb5_const_principal p, krb5_error_code code)
 678 {
 679     krb5_error_code ret;
 680     char *str;
 681
 682     ret = krb5_unparse_name(context, p, &str);
 683     if(ret) {
 684         krb5_clear_error_message(context);
 685         return code;
 686     }
 687     krb5_set_error_message(context, code,
 688                            N_("Matching credential (%s) not found", ""), str);
 689     free(str);
 690     return code;
 691 }
 692
 693 static krb5_error_code
 694 find_cred(krb5_context context,
 695           krb5_ccache id,
 696           krb5_principal server,
 697           krb5_creds **tgts,
 698           krb5_creds *out_creds)
 699 {
 700     krb5_error_code ret;
 701     krb5_creds mcreds;
 702
 703     krb5_cc_clear_mcred(&mcreds);
 704     mcreds.server = server;
 705     krb5_timeofday(context, &mcreds.times.endtime);
 706     ret = krb5_cc_retrieve_cred(context, id,
 707                                 KRB5_TC_DONT_MATCH_REALM |
 708                                 KRB5_TC_MATCH_TIMES,
 709                                 &mcreds, out_creds);
 710     if(ret == 0)
 711         return 0;
 712     while(tgts && *tgts){
 713         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 714                               &mcreds, *tgts)){
 715             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 716             return ret;
 717         }
 718         tgts++;
 719     }
 720     return not_found(context, server, KRB5_CC_NOTFOUND);
 721 }
 722
 723 static krb5_error_code
 724 add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 725 {
 726     int i;
 727     krb5_error_code ret;
 728     krb5_creds **tmp = *tgts;
 729
 730     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 731     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 732     if(tmp == NULL)
 733         return krb5_enomem(context);
 734     *tgts = tmp;
 735     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 736     tmp[i+1] = NULL;
 737     return ret;
 738 }
 739
 740 static krb5_error_code
 741 get_cred_kdc_capath_worker(krb5_context context,
 742                            krb5_kdc_flags flags,
 743                            krb5_ccache ccache,
 744                            krb5_creds *in_creds,
 745                            krb5_const_realm try_realm,
 746                            krb5_principal impersonate_principal,
 747                            Ticket *second_ticket,
 748                            krb5_creds **out_creds,
 749                            krb5_creds ***ret_tgts)
 750 {
 751     krb5_error_code ret;
 752     krb5_creds *tgt, tmp_creds;
 753     krb5_const_realm client_realm, server_realm;
 754     int ok_as_delegate = 1;
 755
 756     *out_creds = NULL;
 757
 758     client_realm = krb5_principal_get_realm(context, in_creds->client);
 759     server_realm = krb5_principal_get_realm(context, in_creds->server);
 760     memset(&tmp_creds, 0, sizeof(tmp_creds));
 761     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 762     if(ret)
 763         return ret;
 764
 765     ret = krb5_make_principal(context,
 766                               &tmp_creds.server,
 767                               try_realm,
 768                               KRB5_TGS_NAME,
 769                               server_realm,
 770                               NULL);
 771     if(ret){
 772         krb5_free_principal(context, tmp_creds.client);
 773         return ret;
 774     }
 775     {
 776         krb5_creds tgts;
 777
 778         ret = find_cred(context, ccache, tmp_creds.server,
 779                         *ret_tgts, &tgts);
 780         if(ret == 0){
 781             /* only allow implicit ok_as_delegate if the realm is the clients realm */
 782             if (strcmp(try_realm, client_realm) != 0 || strcmp(try_realm, server_realm) != 0)
 783                 ok_as_delegate = tgts.flags.b.ok_as_delegate;
 784
 785             *out_creds = calloc(1, sizeof(**out_creds));
 786             if(*out_creds == NULL) {
 787                 ret = krb5_enomem(context);
 788             } else {
 789                 ret = get_cred_kdc_address(context, ccache, flags, NULL,
 790                                            in_creds, &tgts,
 791                                            impersonate_principal,
 792                                            second_ticket,
 793                                            *out_creds);
 794                 if (ret) {
 795                     free (*out_creds);
 796                     *out_creds = NULL;
 797                 } else if (ok_as_delegate == 0)
 798                     (*out_creds)->flags.b.ok_as_delegate = 0;
 799             }
 800             krb5_free_cred_contents(context, &tgts);
 801             krb5_free_principal(context, tmp_creds.server);
 802             krb5_free_principal(context, tmp_creds.client);
 803             return ret;
 804         }
 805     }
 806     if(krb5_realm_compare(context, in_creds->client, in_creds->server))
 807         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 808
 809     /* XXX this can loop forever */
 810     while(1){
 811         heim_general_string tgt_inst;
 812
 813         ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 814                                   NULL, NULL, &tgt, ret_tgts);
 815         if(ret) {
 816             krb5_free_principal(context, tmp_creds.server);
 817             krb5_free_principal(context, tmp_creds.client);
 818             return ret;
 819         }
 820         /*
 821          * if either of the chain or the ok_as_delegate was stripped
 822          * by the kdc, make sure we strip it too.
 823          */
 824         if (ok_as_delegate == 0 || tgt->flags.b.ok_as_delegate == 0) {
 825             ok_as_delegate = 0;
 826             tgt->flags.b.ok_as_delegate = 0;
 827         }
 828
 829         ret = add_cred(context, tgt, ret_tgts);
 830         if(ret) {
 831             krb5_free_principal(context, tmp_creds.server);
 832             krb5_free_principal(context, tmp_creds.client);
 833             return ret;
 834         }
 835         tgt_inst = tgt->server->name.name_string.val[1];
 836         if(strcmp(tgt_inst, server_realm) == 0)
 837             break;
 838         krb5_free_principal(context, tmp_creds.server);
 839         ret = krb5_make_principal(context, &tmp_creds.server,
 840                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 841         if(ret) {
 842             krb5_free_principal(context, tmp_creds.server);
 843             krb5_free_principal(context, tmp_creds.client);
 844             return ret;
 845         }
 846         ret = krb5_free_creds(context, tgt);
 847         if(ret) {
 848             krb5_free_principal(context, tmp_creds.server);
 849             krb5_free_principal(context, tmp_creds.client);
 850             return ret;
 851         }
 852     }
 853
 854     krb5_free_principal(context, tmp_creds.server);
 855     krb5_free_principal(context, tmp_creds.client);
 856     *out_creds = calloc(1, sizeof(**out_creds));
 857     if(*out_creds == NULL) {
 858         ret = krb5_enomem(context);
 859     } else {
 860         ret = get_cred_kdc_address (context, ccache, flags, NULL,
 861                                     in_creds, tgt, impersonate_principal,
 862                                     second_ticket, *out_creds);
 863         if (ret) {
 864             free (*out_creds);
 865             *out_creds = NULL;
 866         }
 867     }
 868     krb5_free_creds(context, tgt);
 869     return ret;
 870 }
 871
 872 /*
 873 get_cred(server)
 874         creds = cc_get_cred(server)
 875         if(creds) return creds
 876         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 877         if(tgt)
 878                 return get_cred_tgt(server, tgt)
 879         if(client_realm == server_realm)
 880                 return NULL
 881         tgt = get_cred(krbtgt/server_realm@client_realm)
 882         while(tgt_inst != server_realm)
 883                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 884         return get_cred_tgt(server, tgt)
 885         */
 886
 887 static krb5_error_code
 888 get_cred_kdc_capath(krb5_context context,
 889                     krb5_kdc_flags flags,
 890                     krb5_ccache ccache,
 891                     krb5_creds *in_creds,
 892                     krb5_principal impersonate_principal,
 893                     Ticket *second_ticket,
 894                     krb5_creds **out_creds,
 895                     krb5_creds ***ret_tgts)
 896 {
 897     krb5_error_code ret;
 898     krb5_const_realm client_realm, server_realm, try_realm;
 899
 900     client_realm = krb5_principal_get_realm(context, in_creds->client);
 901     server_realm = krb5_principal_get_realm(context, in_creds->server);
 902
 903     try_realm = client_realm;
 904     ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds, try_realm,
 905                                      impersonate_principal, second_ticket, out_creds,
 906                                      ret_tgts);
 907
 908     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
 909         try_realm = krb5_config_get_string(context, NULL, "capaths",
 910                                            client_realm, server_realm, NULL);
 911
 912         if (try_realm != NULL && strcmp(try_realm, client_realm)) {
 913             ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds,
 914                                              try_realm, impersonate_principal,
 915                                              second_ticket, out_creds, ret_tgts);
 916         }
 917     }
 918
 919     return ret;
 920 }
 921
 922 static krb5_error_code
 923 get_cred_kdc_referral(krb5_context context,
 924                       krb5_kdc_flags flags,
 925                       krb5_ccache ccache,
 926                       krb5_creds *in_creds,
 927                       krb5_principal impersonate_principal,
 928                       Ticket *second_ticket,
 929                       krb5_creds **out_creds,
 930                       krb5_creds ***ret_tgts)
 931 {
 932     krb5_const_realm client_realm;
 933     krb5_error_code ret;
 934     krb5_creds tgt, referral, ticket;
 935     int loop = 0;
 936     int ok_as_delegate = 1;
 937
 938     if (in_creds->server->name.name_string.len < 2 && !flags.b.canonicalize) {
 939         krb5_set_error_message(context, KRB5KDC_ERR_PATH_NOT_ACCEPTED,
 940                                N_("Name too short to do referals, skipping", ""));
 941         return KRB5KDC_ERR_PATH_NOT_ACCEPTED;
 942     }
 943
 944     memset(&tgt, 0, sizeof(tgt));
 945     memset(&ticket, 0, sizeof(ticket));
 946
 947     flags.b.canonicalize = 1;
 948
 949     *out_creds = NULL;
 950
 951     client_realm = krb5_principal_get_realm(context, in_creds->client);
 952
 953     /* find tgt for the clients base realm */
 954     {
 955         krb5_principal tgtname;
 956
 957         ret = krb5_make_principal(context, &tgtname,
 958                                   client_realm,
 959                                   KRB5_TGS_NAME,
 960                                   client_realm,
 961                                   NULL);
 962         if(ret)
 963             return ret;
 964
 965         ret = find_cred(context, ccache, tgtname, *ret_tgts, &tgt);
 966         krb5_free_principal(context, tgtname);
 967         if (ret)
 968             return ret;
 969     }
 970
 971     referral = *in_creds;
 972     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
 973     if (ret) {
 974         krb5_free_cred_contents(context, &tgt);
 975         return ret;
 976     }
 977     ret = krb5_principal_set_realm(context, referral.server, client_realm);
 978     if (ret) {
 979         krb5_free_cred_contents(context, &tgt);
 980         krb5_free_principal(context, referral.server);
 981         return ret;
 982     }
 983
 984     while (loop++ < 17) {
 985         krb5_creds **tickets;
 986         krb5_creds mcreds;
 987         char *referral_realm;
 988
 989         /* Use cache if we are not doing impersonation or contrained deleg */
 990         if (impersonate_principal == NULL || flags.b.constrained_delegation) {
 991             krb5_cc_clear_mcred(&mcreds);
 992             mcreds.server = referral.server;
 993             krb5_timeofday(context, &mcreds.times.endtime);
 994             ret = krb5_cc_retrieve_cred(context, ccache, KRB5_TC_MATCH_TIMES,
 995                                         &mcreds, &ticket);
 996         } else
 997             ret = EINVAL;
 998
 999         if (ret) {
1000             ret = get_cred_kdc_address(context, ccache, flags, NULL,
1001                                        &referral, &tgt, impersonate_principal,
1002                                        second_ticket, &ticket);
1003             if (ret)
1004                 goto out;
1005         }
1006
1007         /* Did we get the right ticket ? */
1008         if (krb5_principal_compare_any_realm(context,
1009                                              referral.server,
1010                                              ticket.server))
1011             break;
1012
1013         if (!krb5_principal_is_krbtgt(context, ticket.server)) {
1014             krb5_set_error_message(context, KRB5KRB_AP_ERR_NOT_US,
1015                                    N_("Got back an non krbtgt "
1016                                       "ticket referrals", ""));
1017             ret = KRB5KRB_AP_ERR_NOT_US;
1018             goto out;
1019         }
1020
1021         referral_realm = ticket.server->name.name_string.val[1];
1022
1023         /* check that there are no referrals loops */
1024         tickets = *ret_tgts;
1025
1026         krb5_cc_clear_mcred(&mcreds);
1027         mcreds.server = ticket.server;
1028
1029         while(tickets && *tickets){
1030             if(krb5_compare_creds(context,
1031                                   KRB5_TC_DONT_MATCH_REALM,
1032                                   &mcreds,
1033                                   *tickets))
1034             {
1035                 krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
1036                                        N_("Referral from %s "
1037                                           "loops back to realm %s", ""),
1038                                        tgt.server->realm,
1039                                        referral_realm);
1040                 ret = KRB5_GET_IN_TKT_LOOP;
1041                 goto out;
1042             }
1043             tickets++;
1044         }
1045
1046         /*
1047          * if either of the chain or the ok_as_delegate was stripped
1048          * by the kdc, make sure we strip it too.
1049          */
1050
1051         if (ok_as_delegate == 0 || ticket.flags.b.ok_as_delegate == 0) {
1052             ok_as_delegate = 0;
1053             ticket.flags.b.ok_as_delegate = 0;
1054         }
1055
1056         ret = add_cred(context, &ticket, ret_tgts);
1057         if (ret)
1058             goto out;
1059
1060         /* try realm in the referral */
1061         ret = krb5_principal_set_realm(context,
1062                                        referral.server,
1063                                        referral_realm);
1064         krb5_free_cred_contents(context, &tgt);
1065         tgt = ticket;
1066         memset(&ticket, 0, sizeof(ticket));
1067         if (ret)
1068             goto out;
1069     }
1070
1071     ret = krb5_copy_creds(context, &ticket, out_creds);
1072
1073 out:
1074     krb5_free_principal(context, referral.server);
1075     krb5_free_cred_contents(context, &tgt);
1076     krb5_free_cred_contents(context, &ticket);
1077     return ret;
1078 }
1079
1080
1081 /*
1082  * Glue function between referrals version and old client chasing
1083  * codebase.
1084  */
1085
1086 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1087 _krb5_get_cred_kdc_any(krb5_context context,
1088                        krb5_kdc_flags flags,
1089                        krb5_ccache ccache,
1090                        krb5_creds *in_creds,
1091                        krb5_principal impersonate_principal,
1092                        Ticket *second_ticket,
1093                        krb5_creds **out_creds,
1094                        krb5_creds ***ret_tgts)
1095 {
1096     krb5_error_code ret;
1097     krb5_deltat offset;
1098
1099     ret = krb5_cc_get_kdc_offset(context, ccache, &offset);
1100     if (ret) {
1101         context->kdc_sec_offset = offset;
1102         context->kdc_usec_offset = 0;
1103     }
1104
1105     ret = get_cred_kdc_referral(context,
1106                                 flags,
1107                                 ccache,
1108                                 in_creds,
1109                                 impersonate_principal,
1110                                 second_ticket,
1111                                 out_creds,
1112                                 ret_tgts);
1113     if (ret == 0 || flags.b.canonicalize)
1114         return ret;
1115     return get_cred_kdc_capath(context,
1116                                 flags,
1117                                 ccache,
1118                                 in_creds,
1119                                 impersonate_principal,
1120                                 second_ticket,
1121                                 out_creds,
1122                                 ret_tgts);
1123 }
1124
1125 static krb5_error_code
1126 check_cc(krb5_context context, krb5_flags options, krb5_ccache ccache,
1127          krb5_creds *in_creds, krb5_creds *out_creds)
1128 {
1129     krb5_error_code ret;
1130     krb5_timestamp now;
1131     krb5_times save_times;
1132
1133     save_times = in_creds->times;
1134
1135     krb5_timeofday(context, &now);
1136
1137     if (!(options & KRB5_GC_EXPIRED_OK) &&
1138         in_creds->times.endtime < now) {
1139         in_creds->times.renew_till = 0;
1140         krb5_timeofday(context, &in_creds->times.endtime);
1141         options |= KRB5_TC_MATCH_TIMES;
1142     }
1143     ret = krb5_cc_retrieve_cred(context, ccache,
1144                                 (options &
1145                                  (KRB5_TC_MATCH_KEYTYPE |
1146                                   KRB5_TC_MATCH_TIMES)),
1147                                 in_creds, out_creds);
1148
1149     in_creds->times = save_times;
1150     return ret;
1151 }
1152
1153 static void
1154 store_cred(krb5_context context, krb5_ccache ccache,
1155            krb5_const_principal server_princ, krb5_creds *creds)
1156 {
1157     krb5_error_code ret;
1158     krb5_principal tmp_princ = creds->server;
1159     krb5_principal p;
1160
1161     krb5_cc_store_cred(context, ccache, creds);
1162     if (strcmp(server_princ->realm, "") != 0)
1163         return;
1164
1165     ret = krb5_copy_principal(context, server_princ, &p);
1166     if (ret)
1167         return;
1168     if (p->name.name_type == KRB5_NT_SRV_HST_NEEDS_CANON)
1169         p->name.name_type = KRB5_NT_SRV_HST;
1170     creds->server = p;
1171     krb5_cc_store_cred(context, ccache, creds);
1172     creds->server = tmp_princ;
1173     krb5_free_principal(context, p);
1174 }
1175
1176
1177 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1178 krb5_get_credentials_with_flags(krb5_context context,
1179                                 krb5_flags options,
1180                                 krb5_kdc_flags flags,
1181                                 krb5_ccache ccache,
1182                                 krb5_creds *in_creds,
1183                                 krb5_creds **out_creds)
1184 {
1185     krb5_error_code ret;
1186     krb5_name_canon_iterator name_canon_iter = NULL;
1187     krb5_name_canon_rule_options rule_opts;
1188     krb5_creds **tgts;
1189     krb5_creds *try_creds;
1190     krb5_creds *res_creds;
1191     int i;
1192
1193     if (in_creds->session.keytype) {
1194         ret = krb5_enctype_valid(context, in_creds->session.keytype);
1195         if (ret)
1196             return ret;
1197         options |= KRB5_TC_MATCH_KEYTYPE;
1198     }
1199
1200     *out_creds = NULL;
1201     res_creds = calloc(1, sizeof(*res_creds));
1202     if (res_creds == NULL)
1203         return krb5_enomem(context);
1204
1205     if (in_creds->server->name.name_type == KRB5_NT_SRV_HST_NEEDS_CANON) {
1206         ret = check_cc(context, options, ccache, in_creds, res_creds);
1207         if (ret == 0) {
1208             *out_creds = res_creds;
1209             return 0;
1210         }
1211     }
1212
1213     ret = krb5_name_canon_iterator_start(context, NULL, in_creds,
1214                                          &name_canon_iter);
1215     if (ret)
1216         return ret;
1217
1218 next_rule:
1219     krb5_free_cred_contents(context, res_creds);
1220     memset(res_creds, 0, sizeof (*res_creds));
1221     ret = krb5_name_canon_iterate_creds(context, &name_canon_iter, &try_creds,
1222                                         &rule_opts);
1223     if (ret)
1224         goto out;
1225     if (name_canon_iter == NULL) {
1226         if (options & KRB5_GC_CACHED)
1227             ret = KRB5_CC_NOTFOUND;
1228         else
1229             ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1230         goto out;
1231     }
1232
1233     ret = check_cc(context, options, ccache, try_creds, res_creds);
1234     if (ret == 0) {
1235         *out_creds = res_creds;
1236         goto out;
1237     } else if(ret != KRB5_CC_END) {
1238         goto out;
1239     }
1240     if(options & KRB5_GC_CACHED)
1241         goto next_rule;
1242
1243     if(options & KRB5_GC_USER_USER)
1244         flags.b.enc_tkt_in_skey = 1;
1245     if (flags.b.enc_tkt_in_skey)
1246         options |= KRB5_GC_NO_STORE;
1247
1248     tgts = NULL;
1249     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1250                                  try_creds, NULL, NULL, out_creds, &tgts);
1251     for(i = 0; tgts && tgts[i]; i++) {
1252         krb5_cc_store_cred(context, ccache, tgts[i]);
1253         krb5_free_creds(context, tgts[i]);
1254     }
1255     free(tgts);
1256     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN &&
1257         !(rule_opts & KRB5_NCRO_SECURE))
1258         goto next_rule;
1259
1260     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1261         store_cred(context, ccache, in_creds->server, *out_creds);
1262
1263 out:
1264     krb5_free_name_canon_iterator(context, name_canon_iter);
1265     if (ret) {
1266         krb5_free_creds(context, res_creds);
1267         return not_found(context, in_creds->server, ret);
1268     }
1269     return 0;
1270 }
1271
1272 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1273 krb5_get_credentials(krb5_context context,
1274                      krb5_flags options,
1275                      krb5_ccache ccache,
1276                      krb5_creds *in_creds,
1277                      krb5_creds **out_creds)
1278 {
1279     krb5_kdc_flags flags;
1280     flags.i = 0;
1281     return krb5_get_credentials_with_flags(context, options, flags,
1282                                            ccache, in_creds, out_creds);
1283 }
1284
1285 struct krb5_get_creds_opt_data {
1286     krb5_principal self;
1287     krb5_flags options;
1288     krb5_enctype enctype;
1289     Ticket *ticket;
1290 };
1291
1292
1293 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1294 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
1295 {
1296     *opt = calloc(1, sizeof(**opt));
1297     if (*opt == NULL)
1298         return krb5_enomem(context);
1299     return 0;
1300 }
1301
1302 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1303 krb5_get_creds_opt_free(krb5_context context, krb5_get_creds_opt opt)
1304 {
1305     if (opt->self)
1306         krb5_free_principal(context, opt->self);
1307     if (opt->ticket) {
1308         free_Ticket(opt->ticket);
1309         free(opt->ticket);
1310     }
1311     memset(opt, 0, sizeof(*opt));
1312     free(opt);
1313 }
1314
1315 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1316 krb5_get_creds_opt_set_options(krb5_context context,
1317                                krb5_get_creds_opt opt,
1318                                krb5_flags options)
1319 {
1320     opt->options = options;
1321 }
1322
1323 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1324 krb5_get_creds_opt_add_options(krb5_context context,
1325                                krb5_get_creds_opt opt,
1326                                krb5_flags options)
1327 {
1328     opt->options |= options;
1329 }
1330
1331 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1332 krb5_get_creds_opt_set_enctype(krb5_context context,
1333                                krb5_get_creds_opt opt,
1334                                krb5_enctype enctype)
1335 {
1336     opt->enctype = enctype;
1337 }
1338
1339 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1340 krb5_get_creds_opt_set_impersonate(krb5_context context,
1341                                    krb5_get_creds_opt opt,
1342                                    krb5_const_principal self)
1343 {
1344     if (opt->self)
1345         krb5_free_principal(context, opt->self);
1346     return krb5_copy_principal(context, self, &opt->self);
1347 }
1348
1349 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1350 krb5_get_creds_opt_set_ticket(krb5_context context,
1351                               krb5_get_creds_opt opt,
1352                               const Ticket *ticket)
1353 {
1354     if (opt->ticket) {
1355         free_Ticket(opt->ticket);
1356         free(opt->ticket);
1357         opt->ticket = NULL;
1358     }
1359     if (ticket) {
1360         krb5_error_code ret;
1361
1362         opt->ticket = malloc(sizeof(*ticket));
1363         if (opt->ticket == NULL)
1364             return krb5_enomem(context);
1365         ret = copy_Ticket(ticket, opt->ticket);
1366         if (ret) {
1367             free(opt->ticket);
1368             opt->ticket = NULL;
1369             krb5_set_error_message(context, ret,
1370                                    N_("malloc: out of memory", ""));
1371             return ret;
1372         }
1373     }
1374     return 0;
1375 }
1376
1377
1378 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1379 krb5_get_creds(krb5_context context,
1380                krb5_get_creds_opt opt,
1381                krb5_ccache ccache,
1382                krb5_const_principal inprinc,
1383                krb5_creds **out_creds)
1384 {
1385     krb5_kdc_flags flags;
1386     krb5_flags options;
1387     krb5_creds in_creds;
1388     krb5_error_code ret;
1389     krb5_creds **tgts;
1390     krb5_creds *try_creds;
1391     krb5_creds *res_creds;
1392     krb5_name_canon_iterator name_canon_iter = NULL;
1393     krb5_name_canon_rule_options rule_opts;
1394     int i;
1395
1396     if (opt && opt->enctype) {
1397         ret = krb5_enctype_valid(context, opt->enctype);
1398         if (ret)
1399             return ret;
1400     }
1401
1402     memset(&in_creds, 0, sizeof(in_creds));
1403     in_creds.server = rk_UNCONST(inprinc);
1404
1405     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
1406     if (ret)
1407         return ret;
1408
1409     if (opt)
1410         options = opt->options;
1411     else
1412         options = 0;
1413     flags.i = 0;
1414
1415     *out_creds = NULL;
1416     res_creds = calloc(1, sizeof(*res_creds));
1417     if (res_creds == NULL) {
1418         krb5_free_principal(context, in_creds.client);
1419         return krb5_enomem(context);
1420     }
1421
1422     if (opt && opt->enctype) {
1423         in_creds.session.keytype = opt->enctype;
1424         options |= KRB5_TC_MATCH_KEYTYPE;
1425     }
1426
1427     /* Check for entry in ccache */
1428     if (inprinc->name.name_type == KRB5_NT_SRV_HST_NEEDS_CANON) {
1429         ret = check_cc(context, options, ccache, &in_creds, res_creds);
1430         if (ret == 0) {
1431             *out_creds = res_creds;
1432             goto out;
1433         }
1434     }
1435
1436     ret = krb5_name_canon_iterator_start(context, NULL, &in_creds,
1437                                          &name_canon_iter);
1438     if (ret)
1439         goto out;
1440
1441 next_rule:
1442     ret = krb5_name_canon_iterate_creds(context, &name_canon_iter, &try_creds,
1443                                         &rule_opts);
1444     if (ret)
1445         return ret;
1446     if (name_canon_iter == NULL) {
1447         if (options & KRB5_GC_CACHED)
1448             ret = KRB5_CC_NOTFOUND;
1449         else
1450             ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1451         goto out;
1452     }
1453     ret = check_cc(context, options, ccache, try_creds, res_creds);
1454     if (ret == 0) {
1455         *out_creds = res_creds;
1456         goto out;
1457     } else if(ret != KRB5_CC_END) {
1458         goto out;
1459     }
1460     if(options & KRB5_GC_CACHED)
1461         goto next_rule;
1462
1463     if(rule_opts & KRB5_NCRO_USE_REFERRALS)
1464         flags.b.canonicalize = 1;
1465     else if(rule_opts & KRB5_NCRO_NO_REFERRALS)
1466         flags.b.canonicalize = 0;
1467     else
1468         flags.b.canonicalize = (options & KRB5_GC_CANONICALIZE) ? 1 : 0;
1469     if(options & KRB5_GC_USER_USER) {
1470         flags.b.enc_tkt_in_skey = 1;
1471         options |= KRB5_GC_NO_STORE;
1472     }
1473     if (options & KRB5_GC_FORWARDABLE)
1474         flags.b.forwardable = 1;
1475     if (options & KRB5_GC_NO_TRANSIT_CHECK)
1476         flags.b.disable_transited_check = 1;
1477     if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
1478         flags.b.request_anonymous = 1; /* XXX ARGH confusion */
1479         flags.b.constrained_delegation = 1;
1480     }
1481
1482     tgts = NULL;
1483     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1484                                  try_creds, opt ? opt->self : 0,
1485                                  opt ? opt->ticket : 0, out_creds,
1486                                  &tgts);
1487     for(i = 0; tgts && tgts[i]; i++) {
1488         krb5_cc_store_cred(context, ccache, tgts[i]);
1489         krb5_free_creds(context, tgts[i]);
1490     }
1491     free(tgts);
1492
1493     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN &&
1494         !(rule_opts & KRB5_NCRO_SECURE))
1495         goto next_rule;
1496
1497     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1498         store_cred(context, ccache, inprinc, *out_creds);
1499
1500 out:
1501     if (ret) {
1502         krb5_free_creds(context, res_creds);
1503         ret = not_found(context, inprinc, ret);
1504     }
1505     krb5_free_principal(context, in_creds.client);
1506     krb5_free_name_canon_iterator(context, name_canon_iter);
1507     _krb5_debug(context, 5, "krb5_get_creds: ret = %d", ret);
1508     return ret;
1509 }
1510
1511 /*
1512  *
1513  */
1514
1515 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1516 krb5_get_renewed_creds(krb5_context context,
1517                        krb5_creds *creds,
1518                        krb5_const_principal client,
1519                        krb5_ccache ccache,
1520                        const char *in_tkt_service)
1521 {
1522     krb5_error_code ret;
1523     krb5_kdc_flags flags;
1524     krb5_creds in, *template, *out = NULL;
1525
1526     memset(&in, 0, sizeof(in));
1527     memset(creds, 0, sizeof(*creds));
1528
1529     ret = krb5_copy_principal(context, client, &in.client);
1530     if (ret)
1531         return ret;
1532
1533     if (in_tkt_service) {
1534         ret = krb5_parse_name(context, in_tkt_service, &in.server);
1535         if (ret) {
1536             krb5_free_principal(context, in.client);
1537             return ret;
1538         }
1539     } else {
1540         const char *realm = krb5_principal_get_realm(context, client);
1541
1542         ret = krb5_make_principal(context, &in.server, realm, KRB5_TGS_NAME,
1543                                   realm, NULL);
1544         if (ret) {
1545             krb5_free_principal(context, in.client);
1546             return ret;
1547         }
1548     }
1549
1550     flags.i = 0;
1551     flags.b.renewable = flags.b.renew = 1;
1552
1553     /*
1554      * Get template from old credential cache for the same entry, if
1555      * this failes, no worries.
1556      */
1557     ret = krb5_get_credentials(context, KRB5_GC_CACHED, ccache, &in, &template);
1558     if (ret == 0) {
1559         flags.b.forwardable = template->flags.b.forwardable;
1560         flags.b.proxiable = template->flags.b.proxiable;
1561         krb5_free_creds (context, template);
1562     }
1563
1564     ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out);
1565     krb5_free_principal(context, in.client);
1566     krb5_free_principal(context, in.server);
1567     if (ret)
1568         return ret;
1569
1570     ret = krb5_copy_creds_contents(context, out, creds);
1571     krb5_free_creds(context, out);
1572
1573     return ret;
1574 }