third_party/heimdal/kdc/fast.c

   1 /*
   2  * Copyright (c) 1997-2011 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2010 - 2011 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kdc_locl.h"
  37
  38 static krb5_error_code
  39 salt_fastuser_crypto(astgs_request_t r,
  40                      krb5_const_principal salt_principal,
  41                      krb5_enctype enctype,
  42                      krb5_crypto fast_crypto,
  43                      krb5_crypto *salted_crypto)
  44 {
  45     krb5_error_code ret;
  46     krb5_principal client_princ = NULL;
  47     krb5_data salt;
  48     krb5_keyblock dkey;
  49     size_t size;
  50
  51     *salted_crypto = NULL;
  52
  53     krb5_data_zero(&salt);
  54     krb5_keyblock_zero(&dkey);
  55
  56     if (salt_principal == NULL) {
  57         if (r->req.req_body.cname == NULL) {
  58             ret = KRB5KRB_ERR_GENERIC;
  59             goto out;
  60         }
  61
  62         ret = _krb5_principalname2krb5_principal(r->context, &client_princ,
  63                                                  *(r->req.req_body.cname),
  64                                                  r->req.req_body.realm);
  65         if (ret)
  66             goto out;
  67
  68         salt_principal = client_princ;
  69     }
  70
  71     ret = krb5_unparse_name(r->context, salt_principal, (char **)&salt.data);
  72     if (ret)
  73         goto out;
  74
  75     salt.length = strlen(salt.data);
  76
  77     kdc_log(r->context, r->config, 10,
  78             "salt_fastuser_crypto: salt principal is %s (%d)",
  79             (char *)salt.data, enctype);
  80
  81     ret = krb5_enctype_keysize(r->context, enctype, &size);
  82     if (ret)
  83         goto out;
  84
  85     ret = krb5_crypto_prfplus(r->context, fast_crypto, &salt,
  86                               size, &dkey.keyvalue);
  87     if (ret)
  88         goto out;
  89
  90     dkey.keytype = enctype;
  91
  92     ret = krb5_crypto_init(r->context, &dkey, ENCTYPE_NULL, salted_crypto);
  93     if (ret)
  94         goto out;
  95
  96 out:
  97     krb5_free_keyblock_contents(r->context, &dkey);
  98     krb5_data_free(&salt);
  99     krb5_free_principal(r->context, client_princ);
 100
 101     return ret;
 102 }
 103
 104 static krb5_error_code
 105 get_fastuser_crypto(astgs_request_t r,
 106                     krb5_const_principal ticket_client,
 107                     krb5_enctype enctype,
 108                     krb5_crypto *crypto)
 109 {
 110     krb5_principal fast_princ;
 111     HDB *fast_db;
 112     hdb_entry *fast_user = NULL;
 113     Key *cookie_key = NULL;
 114     krb5_crypto fast_crypto = NULL;
 115     krb5_error_code ret;
 116
 117     *crypto = NULL;
 118
 119     ret = krb5_make_principal(r->context, &fast_princ,
 120                               KRB5_WELLKNOWN_ORG_H5L_REALM,
 121                               KRB5_WELLKNOWN_NAME, "org.h5l.fast-cookie", NULL);
 122     if (ret)
 123         goto out;
 124
 125     ret = _kdc_db_fetch(r->context, r->config, fast_princ,
 126                         HDB_F_GET_FAST_COOKIE, NULL, &fast_db, &fast_user);
 127     if (ret)
 128         goto out;
 129
 130     if (enctype == KRB5_ENCTYPE_NULL)
 131         ret = _kdc_get_preferred_key(r->context, r->config, fast_user,
 132                                      "fast-cookie", &enctype, &cookie_key);
 133     else
 134         ret = hdb_enctype2key(r->context, fast_user, NULL,
 135                               enctype, &cookie_key);
 136     if (ret)
 137         goto out;
 138
 139     ret = krb5_crypto_init(r->context, &cookie_key->key,
 140                            ENCTYPE_NULL, &fast_crypto);
 141     if (ret)
 142         goto out;
 143
 144     ret = salt_fastuser_crypto(r, ticket_client,
 145                                cookie_key->key.keytype,
 146                                fast_crypto, crypto);
 147     if (ret)
 148         goto out;
 149
 150  out:
 151     if (fast_user)
 152         _kdc_free_ent(r->context, fast_db, fast_user);
 153     if (fast_crypto)
 154         krb5_crypto_destroy(r->context, fast_crypto);
 155     krb5_free_principal(r->context, fast_princ);
 156
 157     return ret;
 158 }
 159
 160
 161 static krb5_error_code
 162 fast_parse_cookie(astgs_request_t r,
 163                   krb5_const_principal ticket_client,
 164                   const PA_DATA *pa)
 165 {
 166     krb5_crypto crypto = NULL;
 167     krb5_error_code ret;
 168     KDCFastCookie data;
 169     krb5_data d1;
 170     size_t len;
 171
 172     ret = decode_KDCFastCookie(pa->padata_value.data,
 173                                pa->padata_value.length,
 174                                &data, &len);
 175     if (ret)
 176         return ret;
 177
 178     if (len != pa->padata_value.length || strcmp("H5L1", data.version) != 0) {
 179         free_KDCFastCookie(&data);
 180         return KRB5KDC_ERR_POLICY;
 181     }
 182
 183     ret = get_fastuser_crypto(r, ticket_client, data.cookie.etype, &crypto);
 184     if (ret)
 185         goto out;
 186
 187     ret = krb5_decrypt_EncryptedData(r->context, crypto,
 188                                      KRB5_KU_H5L_COOKIE,
 189                                      &data.cookie, &d1);
 190     krb5_crypto_destroy(r->context, crypto);
 191     if (ret)
 192         goto out;
 193
 194     ret = decode_KDCFastState(d1.data, d1.length, &r->fast, &len);
 195     krb5_data_free(&d1);
 196     if (ret)
 197         goto out;
 198
 199     if (r->fast.expiration < kdc_time) {
 200         kdc_log(r->context, r->config, 2, "FAST cookie expired");
 201         ret = KRB5KDC_ERR_POLICY;
 202         goto out;
 203     }
 204
 205  out:
 206     free_KDCFastCookie(&data);
 207
 208     return ret;
 209 }
 210
 211 static krb5_error_code
 212 fast_add_cookie(astgs_request_t r,
 213                 krb5_const_principal ticket_client,
 214                 METHOD_DATA *method_data)
 215 {
 216     krb5_crypto crypto = NULL;
 217     KDCFastCookie shell;
 218     krb5_error_code ret;
 219     krb5_data data;
 220     size_t size;
 221
 222     memset(&shell, 0, sizeof(shell));
 223
 224     r->fast.expiration = kdc_time + FAST_EXPIRATION_TIME;
 225
 226     ASN1_MALLOC_ENCODE(KDCFastState, data.data, data.length,
 227                        &r->fast, &size, ret);
 228     if (ret)
 229         return ret;
 230     heim_assert(size == data.length, "internal asn.1 encoder error");
 231
 232     ret = get_fastuser_crypto(r, ticket_client, KRB5_ENCTYPE_NULL, &crypto);
 233     if (ret) {
 234         kdc_log(r->context, r->config, 0,
 235                 "Failed to find FAST principal for cookie encryption: %d", ret);
 236         goto out;
 237     }
 238
 239     ret = krb5_encrypt_EncryptedData(r->context, crypto,
 240                                      KRB5_KU_H5L_COOKIE,
 241                                      data.data, data.length, 0,
 242                                      &shell.cookie);
 243     krb5_crypto_destroy(r->context, crypto);
 244     if (ret)
 245         goto out;
 246
 247     krb5_data_free(&data);
 248
 249     shell.version = "H5L1";
 250
 251     ASN1_MALLOC_ENCODE(KDCFastCookie, data.data, data.length,
 252                        &shell, &size, ret);
 253     free_EncryptedData(&shell.cookie);
 254     if (ret)
 255         goto out;
 256     heim_assert(size == data.length, "internal asn.1 encoder error");
 257
 258     ret = krb5_padata_add(r->context, method_data,
 259                           KRB5_PADATA_FX_COOKIE,
 260                           data.data, data.length);
 261     if (ret == 0)
 262         krb5_data_zero(&data);
 263
 264  out:
 265     krb5_data_free(&data);
 266     return ret;
 267 }
 268
 269 static krb5_error_code
 270 fast_add_dummy_cookie(astgs_request_t r,
 271                       METHOD_DATA *method_data)
 272 {
 273     krb5_error_code ret;
 274     krb5_data data;
 275     const krb5_data *dummy_fast_cookie = &r->config->dummy_fast_cookie;
 276
 277     if (dummy_fast_cookie->data == NULL)
 278         return 0;
 279
 280     ret = krb5_data_copy(&data,
 281                          dummy_fast_cookie->data,
 282                          dummy_fast_cookie->length);
 283     if (ret)
 284         return ret;
 285
 286     ret = krb5_padata_add(r->context, method_data,
 287                           KRB5_PADATA_FX_COOKIE,
 288                           data.data, data.length);
 289     if (ret) {
 290         krb5_data_free(&data);
 291     }
 292
 293     return ret;
 294 }
 295
 296 krb5_error_code
 297 _kdc_fast_mk_response(krb5_context context,
 298                       krb5_crypto armor_crypto,
 299                       METHOD_DATA *pa_data,
 300                       krb5_keyblock *strengthen_key,
 301                       KrbFastFinished *finished,
 302                       krb5uint32 nonce,
 303                       krb5_data *data)
 304 {
 305     PA_FX_FAST_REPLY fxfastrep;
 306     KrbFastResponse fastrep;
 307     krb5_error_code ret;
 308     krb5_data buf;
 309     size_t size;
 310
 311     memset(&fxfastrep, 0, sizeof(fxfastrep));
 312     memset(&fastrep, 0, sizeof(fastrep));
 313     krb5_data_zero(data);
 314
 315     if (pa_data) {
 316         fastrep.padata.val = pa_data->val;
 317         fastrep.padata.len = pa_data->len;
 318     }
 319     fastrep.strengthen_key = strengthen_key;
 320     fastrep.finished = finished;
 321     fastrep.nonce = nonce;
 322
 323     ASN1_MALLOC_ENCODE(KrbFastResponse, buf.data, buf.length,
 324                        &fastrep, &size, ret);
 325     if (ret)
 326         return ret;
 327     heim_assert(size == buf.length, "internal asn.1 encoder error");
 328
 329     fxfastrep.element = choice_PA_FX_FAST_REPLY_armored_data;
 330
 331     ret = krb5_encrypt_EncryptedData(context,
 332                                      armor_crypto,
 333                                      KRB5_KU_FAST_REP,
 334                                      buf.data,
 335                                      buf.length,
 336                                      0,
 337                                      &fxfastrep.u.armored_data.enc_fast_rep);
 338     krb5_data_free(&buf);
 339     if (ret)
 340         return ret;
 341
 342     ASN1_MALLOC_ENCODE(PA_FX_FAST_REPLY, data->data, data->length,
 343                        &fxfastrep, &size, ret);
 344     free_PA_FX_FAST_REPLY(&fxfastrep);
 345     if (ret)
 346         return ret;
 347     heim_assert(size == data->length, "internal asn.1 encoder error");
 348
 349     return 0;
 350 }
 351
 352
 353 static krb5_error_code
 354 _kdc_fast_mk_e_data(astgs_request_t r,
 355                    METHOD_DATA *error_method,
 356                    krb5_crypto armor_crypto,
 357                    const KDC_REQ_BODY *req_body,
 358                    krb5_error_code outer_error,
 359                    krb5_principal error_client,
 360                    krb5_principal error_server,
 361                    time_t *csec, int *cusec,
 362                    krb5_data *e_data)
 363 {
 364     krb5_error_code ret = 0;
 365     size_t size;
 366
 367     /*
 368      * FX-COOKIE can be used outside of FAST, e.g. SRP or GSS.
 369      */
 370     if (armor_crypto || r->fast.fast_state.len) {
 371         if (r->config->enable_fast_cookie) {
 372             kdc_log(r->context, r->config, 5, "Adding FAST cookie for KRB-ERROR");
 373             ret = fast_add_cookie(r, error_client, error_method);
 374             if (ret) {
 375                 kdc_log(r->context, r->config, 1,
 376                         "Failed to add FAST cookie: %d", ret);
 377                 free_METHOD_DATA(error_method);
 378                 return ret;
 379             }
 380         } else {
 381             kdc_log(r->context, r->config, 5, "Adding dummy FAST cookie for KRB-ERROR");
 382             ret = fast_add_dummy_cookie(r, error_method);
 383             if (ret) {
 384                 kdc_log(r->context, r->config, 1,
 385                         "Failed to add dummy FAST cookie: %d", ret);
 386                 free_METHOD_DATA(error_method);
 387                 return ret;
 388             }
 389         }
 390     }
 391
 392     if (armor_crypto) {
 393         PA_FX_FAST_REPLY fxfastrep;
 394         KrbFastResponse fastrep;
 395
 396         memset(&fxfastrep, 0, sizeof(fxfastrep));
 397         memset(&fastrep, 0, sizeof(fastrep));
 398
 399         kdc_log(r->context, r->config, 5, "Making FAST inner KRB-ERROR");
 400
 401         /* first add the KRB-ERROR to the fast errors */
 402
 403         ret = krb5_mk_error(r->context,
 404                             outer_error,
 405                             r->e_text,
 406                             NULL,
 407                             error_client,
 408                             error_server,
 409                             csec,
 410                             cusec,
 411                             e_data);
 412         if (ret) {
 413             kdc_log(r->context, r->config, 1,
 414                     "Failed to make inner KRB-ERROR: %d", ret);
 415             return ret;
 416         }
 417
 418         ret = krb5_padata_add(r->context, error_method,
 419                               KRB5_PADATA_FX_ERROR,
 420                               e_data->data, e_data->length);
 421         if (ret) {
 422             kdc_log(r->context, r->config, 1,
 423                     "Failed to make add FAST PADATA to inner KRB-ERROR: %d", ret);
 424             krb5_data_free(e_data);
 425             return ret;
 426         }
 427
 428         r->e_text = NULL;
 429
 430         ret = _kdc_fast_mk_response(r->context, armor_crypto,
 431                                     error_method, NULL, NULL,
 432                                     req_body->nonce, e_data);
 433         free_METHOD_DATA(error_method);
 434         if (ret) {
 435             kdc_log(r->context, r->config, 1,
 436                     "Failed to make outer KRB-ERROR: %d", ret);
 437             return ret;
 438         }
 439
 440         ret = krb5_padata_add(r->context, error_method,
 441                               KRB5_PADATA_FX_FAST,
 442                               e_data->data, e_data->length);
 443         if (ret) {
 444             kdc_log(r->context, r->config, 1,
 445                     "Failed to make add FAST PADATA to outer KRB-ERROR: %d", ret);
 446             return ret;
 447         }
 448     } else
 449         kdc_log(r->context, r->config, 5, "Making non-FAST KRB-ERROR");
 450
 451     if (error_method && error_method->len) {
 452         ASN1_MALLOC_ENCODE(METHOD_DATA, e_data->data, e_data->length,
 453                            error_method, &size, ret);
 454         if (ret) {
 455             kdc_log(r->context, r->config, 1,
 456                     "Failed to make encode METHOD-DATA: %d", ret);
 457             return ret;
 458         }
 459         heim_assert(size == e_data->length, "internal asn.1 encoder error");
 460     }
 461
 462     return ret;
 463 }
 464
 465
 466 krb5_error_code
 467 _kdc_fast_mk_error(astgs_request_t r,
 468                    METHOD_DATA *error_method,
 469                    krb5_crypto armor_crypto,
 470                    const KDC_REQ_BODY *req_body,
 471                    krb5_error_code outer_error,
 472                    krb5_principal error_client,
 473                    krb5_principal error_server,
 474                    time_t *csec, int *cusec,
 475                    krb5_data *error_msg)
 476 {
 477     krb5_error_code ret;
 478     krb5_data _e_data;
 479     krb5_data *e_data = NULL;
 480
 481     krb5_data_zero(&_e_data);
 482
 483     heim_assert(r != NULL, "invalid request in _kdc_fast_mk_error");
 484
 485     if (!armor_crypto && r->e_data.length) {
 486         /*
 487          * If we’re not armoring the response with FAST, r->e_data
 488          * takes precedence over the e‐data that would normally be
 489          * generated. r->e_data typically contains a
 490          * Microsoft‐specific NTSTATUS code.
 491          *
 492          * But if FAST is in use, Windows Server suppresses the
 493          * NTSTATUS code in favour of an armored response
 494          * encapsulating an ordinary KRB‐ERROR. So we ignore r->e_data
 495          * in that case.
 496          */
 497         e_data = &r->e_data;
 498     } else {
 499         ret = _kdc_fast_mk_e_data(r,
 500                                   error_method,
 501                                   armor_crypto,
 502                                   req_body,
 503                                   outer_error,
 504                                   error_client,
 505                                   error_server,
 506                                   csec, cusec,
 507                                   &_e_data);
 508         if (ret) {
 509             kdc_log(r->context, r->config, 1,
 510                     "Failed to make FAST e-data: %d", ret);
 511             return ret;
 512         }
 513
 514         e_data = &_e_data;
 515     }
 516
 517     if (armor_crypto) {
 518         if (r->fast.flags.requested_hidden_names) {
 519             error_client = NULL;
 520             error_server = NULL;
 521         }
 522         csec = NULL;
 523         cusec = NULL;
 524     }
 525
 526     ret = krb5_mk_error(r->context,
 527                         outer_error,
 528                         r->e_text,
 529                         (e_data->length ? e_data : NULL),
 530                         error_client,
 531                         error_server,
 532                         csec,
 533                         cusec,
 534                         error_msg);
 535     krb5_data_free(&_e_data);
 536
 537     if (ret)
 538         kdc_log(r->context, r->config, 1,
 539                 "Failed to make encode KRB-ERROR: %d", ret);
 540
 541     return ret;
 542 }
 543
 544 static krb5_error_code
 545 fast_unwrap_request(astgs_request_t r,
 546                     krb5_ticket *tgs_ticket,
 547                     krb5_auth_context tgs_ac)
 548 {
 549     krb5_principal armor_server_principal = NULL;
 550     char *armor_client_principal_name = NULL;
 551     char *armor_server_principal_name = NULL;
 552     PA_FX_FAST_REQUEST fxreq;
 553     krb5_auth_context ac = NULL;
 554     krb5_ticket *ticket = NULL;
 555     krb5_flags ap_req_options;
 556     krb5_keyblock armorkey;
 557     krb5_keyblock explicit_armorkey;
 558     krb5_error_code ret;
 559     krb5_ap_req ap_req;
 560     KrbFastReq fastreq;
 561     const PA_DATA *pa;
 562     krb5_data data;
 563     size_t len;
 564     int i = 0;
 565
 566     memset(&fxreq, 0, sizeof(fxreq));
 567     memset(&fastreq, 0, sizeof(fastreq));
 568
 569     pa = _kdc_find_padata(&r->req, &i, KRB5_PADATA_FX_FAST);
 570     if (pa == NULL) {
 571         if (tgs_ac && r->fast_asserted) {
 572             kdc_log(r->context, r->config, 1,
 573                     "Client asserted FAST but did not include FX-FAST pa-data");
 574             ret = KRB5KRB_AP_ERR_MODIFIED;
 575             goto out;
 576         }
 577
 578         kdc_log(r->context, r->config, 10, "Not a FAST request");
 579         return 0;
 580     }
 581
 582     ret = decode_PA_FX_FAST_REQUEST(pa->padata_value.data,
 583                                     pa->padata_value.length,
 584                                     &fxreq,
 585                                     &len);
 586     if (ret) {
 587         kdc_log(r->context, r->config, 4,
 588                 "Failed to decode PA-FX-FAST-REQUEST: %d", ret);
 589         goto out;
 590     }
 591
 592     if (fxreq.element != choice_PA_FX_FAST_REQUEST_armored_data) {
 593         kdc_log(r->context, r->config, 4,
 594                 "PA-FX-FAST-REQUEST contains unknown type: %d",
 595                 (int)fxreq.element);
 596         ret = KRB5KDC_ERR_PREAUTH_FAILED;
 597         goto out;
 598     }
 599
 600     /*
 601      * If check for armor data or it's not a TGS-REQ with implicit
 602      * armor.
 603      */
 604     if (fxreq.u.armored_data.armor == NULL && tgs_ac == NULL) {
 605         kdc_log(r->context, r->config, 4,
 606                 "AS-REQ armor missing");
 607         ret = KRB5KDC_ERR_PREAUTH_FAILED;
 608         goto out;
 609     }
 610
 611     r->explicit_armor_present = fxreq.u.armored_data.armor != NULL && tgs_ac != NULL;
 612
 613     /*
 614      *
 615      */
 616     if (fxreq.u.armored_data.armor != NULL) {
 617         krb5uint32 kvno;
 618         krb5uint32 *kvno_ptr = NULL;
 619
 620         if (fxreq.u.armored_data.armor->armor_type != 1) {
 621             kdc_log(r->context, r->config, 4,
 622                     "Incorrect AS-REQ armor type");
 623             ret = KRB5KDC_ERR_PREAUTH_FAILED;
 624             goto out;
 625         }
 626
 627         ret = krb5_decode_ap_req(r->context,
 628                                  &fxreq.u.armored_data.armor->armor_value,
 629                                  &ap_req);
 630         if(ret) {
 631             kdc_log(r->context, r->config, 4, "Failed to decode AP-REQ");
 632             goto out;
 633         }
 634
 635         /* Save that principal that was in the request */
 636         ret = _krb5_principalname2krb5_principal(r->context,
 637                                                  &armor_server_principal,
 638                                                  ap_req.ticket.sname,
 639                                                  ap_req.ticket.realm);
 640         if (ret) {
 641             free_AP_REQ(&ap_req);
 642             goto out;
 643         }
 644
 645         if (ap_req.ticket.enc_part.kvno != NULL) {
 646             kvno = *ap_req.ticket.enc_part.kvno;
 647             kvno_ptr = &kvno;
 648         }
 649
 650         ret = _kdc_db_fetch(r->context, r->config, armor_server_principal,
 651                             HDB_F_GET_KRBTGT | HDB_F_DELAY_NEW_KEYS,
 652                             kvno_ptr,
 653                             &r->armor_serverdb, &r->armor_server);
 654         if(ret == HDB_ERR_NOT_FOUND_HERE) {
 655             free_AP_REQ(&ap_req);
 656             kdc_log(r->context, r->config, 5,
 657                     "Armor key does not have secrets at this KDC, "
 658                     "need to proxy");
 659             goto out;
 660         } else if (ret) {
 661             free_AP_REQ(&ap_req);
 662             ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
 663             goto out;
 664         }
 665
 666         ret = hdb_enctype2key(r->context, r->armor_server, NULL,
 667                               ap_req.ticket.enc_part.etype,
 668                               &r->armor_key);
 669         if (ret) {
 670             free_AP_REQ(&ap_req);
 671             goto out;
 672         }
 673
 674         ret = krb5_verify_ap_req2(r->context, &ac,
 675                                   &ap_req,
 676                                   armor_server_principal,
 677                                   &r->armor_key->key,
 678                                   0,
 679                                   &ap_req_options,
 680                                   &r->armor_ticket,
 681                                   KRB5_KU_AP_REQ_AUTH);
 682         free_AP_REQ(&ap_req);
 683         if (ret)
 684             goto out;
 685
 686         ret = krb5_unparse_name(r->context, armor_server_principal,
 687                                 &armor_server_principal_name);
 688         if (ret)
 689             goto out;
 690
 691         /* FIXME krb5_verify_ap_req2() also checks this */
 692         ret = _kdc_verify_flags(r->context, r->config,
 693                                 &r->armor_ticket->ticket,
 694                                 armor_server_principal_name);
 695         if (ret) {
 696             kdc_audit_addreason((kdc_request_t)r,
 697                                 "Armor TGT expired or invalid");
 698             goto out;
 699         }
 700         ticket = r->armor_ticket;
 701     } else {
 702         heim_assert(tgs_ticket != NULL, "TGS authentication context without ticket");
 703         ac = tgs_ac;
 704         ticket = tgs_ticket;
 705     }
 706
 707     (void) krb5_unparse_name(r->context, ticket->client, &armor_client_principal_name);
 708     kdc_audit_addkv((kdc_request_t)r, 0, "armor_client_name", "%s",
 709                     armor_client_principal_name ?
 710                         armor_client_principal_name :
 711                         "<out of memory>");
 712
 713     if (ac->remote_subkey == NULL) {
 714         krb5_auth_con_free(r->context, ac);
 715         kdc_log(r->context, r->config, 2,
 716                 "FAST AP-REQ remote subkey missing");
 717         ret = KRB5KDC_ERR_PREAUTH_FAILED;
 718         goto out;
 719     }
 720
 721     r->fast.flags.kdc_verified =
 722         !_kdc_is_anonymous_pkinit(r->context, ticket->client);
 723
 724     ret = _krb5_fast_armor_key(r->context,
 725                                ac->remote_subkey,
 726                                &ticket->ticket.key,
 727                                &armorkey,
 728                                r->explicit_armor_present ? NULL : &r->armor_crypto);
 729     if (ret)
 730         goto out;
 731
 732     if (r->explicit_armor_present) {
 733         ret = _krb5_fast_explicit_armor_key(r->context,
 734                                             &armorkey,
 735                                             tgs_ac->remote_subkey,
 736                                             &explicit_armorkey,
 737                                             &r->armor_crypto);
 738         if (ret)
 739             goto out;
 740
 741         krb5_free_keyblock_contents(r->context, &explicit_armorkey);
 742     }
 743
 744     krb5_free_keyblock_contents(r->context, &armorkey);
 745
 746     ret = krb5_decrypt_EncryptedData(r->context, r->armor_crypto,
 747                                      KRB5_KU_FAST_ENC,
 748                                      &fxreq.u.armored_data.enc_fast_req,
 749                                      &data);
 750     if (ret) {
 751         kdc_log(r->context, r->config, 2,
 752                 "Failed to decrypt FAST request");
 753         goto out;
 754     }
 755
 756     ret = decode_KrbFastReq(data.data, data.length, &fastreq, NULL);
 757     krb5_data_free(&data);
 758     if (ret)
 759         goto out;
 760
 761     /*
 762      * verify req-checksum of the outer body
 763      */
 764     if (tgs_ac) {
 765         /*
 766          * -- For TGS, contains the checksum performed over the type
 767          * -- AP-REQ in the PA-TGS-REQ padata.
 768          */
 769         i = 0;
 770         pa = _kdc_find_padata(&r->req, &i, KRB5_PADATA_TGS_REQ);
 771         if (pa == NULL) {
 772             kdc_log(r->context, r->config, 4,
 773                     "FAST TGS request missing TGS-REQ padata");
 774             ret = KRB5KRB_ERR_GENERIC;
 775             goto out;
 776         }
 777
 778         ret = _kdc_verify_checksum(r->context, r->armor_crypto,
 779                                    KRB5_KU_FAST_REQ_CHKSUM,
 780                                    &pa->padata_value,
 781                                    &fxreq.u.armored_data.req_checksum);
 782         if (ret) {
 783             kdc_log(r->context, r->config, 2,
 784                     "Bad checksum in FAST TGS request");
 785             goto out;
 786         }
 787     } else {
 788         /*
 789          * -- For AS, contains the checksum performed over the type
 790          * -- KDC-REQ-BODY for the req-body field of the KDC-REQ
 791          * -- structure;
 792          */
 793         ret = _kdc_verify_checksum(r->context, r->armor_crypto,
 794                                    KRB5_KU_FAST_REQ_CHKSUM,
 795                                    &r->req.req_body._save,
 796                                    &fxreq.u.armored_data.req_checksum);
 797         if (ret) {
 798             kdc_log(r->context, r->config, 2,
 799                     "Bad checksum in FAST AS request");
 800             goto out;
 801         }
 802     }
 803
 804     /*
 805      * check for unsupported mandatory options
 806      */
 807     if (FastOptions2int(fastreq.fast_options) & 0xfffc) {
 808         kdc_log(r->context, r->config, 2,
 809                 "FAST unsupported mandatory option set");
 810         ret = KRB5_KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS;
 811         goto out;
 812     }
 813
 814     r->fast.flags.requested_hidden_names = fastreq.fast_options.hide_client_names;
 815
 816     /* KDC MUST ignore outer pa data preauth-14 - 6.5.5 */
 817     if (r->req.padata)
 818         free_METHOD_DATA(r->req.padata);
 819     else
 820         ALLOC(r->req.padata);
 821
 822     ret = copy_METHOD_DATA(&fastreq.padata, r->req.padata);
 823     if (ret)
 824         goto out;
 825
 826     free_KDC_REQ_BODY(&r->req.req_body);
 827     ret = copy_KDC_REQ_BODY(&fastreq.req_body, &r->req.req_body);
 828     if (ret)
 829         goto out;
 830
 831     kdc_log(r->context, r->config, 5, "Client selected FAST");
 832
 833  out:
 834     if (ac && ac != tgs_ac)
 835         krb5_auth_con_free(r->context, ac);
 836
 837     krb5_free_principal(r->context, armor_server_principal);
 838     krb5_xfree(armor_client_principal_name);
 839     krb5_xfree(armor_server_principal_name);
 840
 841     free_KrbFastReq(&fastreq);
 842     free_PA_FX_FAST_REQUEST(&fxreq);
 843
 844     return ret;
 845 }
 846
 847 /*
 848  *
 849  */
 850 krb5_error_code
 851 _kdc_fast_unwrap_request(astgs_request_t r,
 852                          krb5_ticket *tgs_ticket,
 853                          krb5_auth_context tgs_ac)
 854 {
 855     krb5_error_code ret;
 856     const PA_DATA *pa;
 857     int i = 0;
 858
 859     if (!r->config->enable_fast)
 860         return 0;
 861
 862     ret = fast_unwrap_request(r, tgs_ticket, tgs_ac);
 863     if (ret)
 864         return ret;
 865
 866     if (r->config->enable_fast_cookie) {
 867         /*
 868          * FX-COOKIE can be used outside of FAST, e.g. SRP or GSS.
 869          */
 870         pa = _kdc_find_padata(&r->req, &i, KRB5_PADATA_FX_COOKIE);
 871         if (pa) {
 872             krb5_const_principal ticket_client = NULL;
 873
 874             if (tgs_ticket)
 875                 ticket_client = tgs_ticket->client;
 876
 877             ret = fast_parse_cookie(r, ticket_client, pa);
 878         }
 879     }
 880
 881     return ret;
 882 }
 883
 884 /*
 885  * Strengthen reply key by mixing with a random key that is
 886  * protected by FAST.
 887  */
 888 krb5_error_code
 889 _kdc_fast_strengthen_reply_key(astgs_request_t r)
 890 {
 891     if (r->armor_crypto) {
 892         krb5_keyblock new_reply_key;
 893         krb5_error_code ret;
 894
 895         kdc_log(r->context, r->config, 5,
 896                 "FAST strengthen reply key with strengthen-key");
 897
 898         heim_assert(r->reply_key.keytype != KRB5_ENCTYPE_NULL, "NULL reply key enctype");
 899
 900         ret = krb5_generate_random_keyblock(r->context, r->reply_key.keytype,
 901                                             &r->strengthen_key);
 902         if (ret) {
 903             kdc_log(r->context, r->config, 0, "failed to prepare random keyblock");
 904             return ret;
 905         }
 906
 907         ret = _krb5_fast_cf2(r->context,
 908                              &r->strengthen_key, "strengthenkey",
 909                              &r->reply_key, "replykey",
 910                              &new_reply_key, NULL);
 911         if (ret)
 912             return ret;
 913
 914         krb5_free_keyblock_contents(r->context, &r->reply_key);
 915         r->reply_key = new_reply_key;
 916     }
 917
 918     return 0;
 919 }
 920
 921 /*
 922  * Zero and free KDCFastState
 923  */
 924 void
 925 _kdc_free_fast_state(KDCFastState *state)
 926 {
 927     size_t i;
 928
 929     for (i = 0; i < state->fast_state.len; i++) {
 930         PA_DATA *pa = &state->fast_state.val[i];
 931
 932         if (pa->padata_value.data)
 933             memset_s(pa->padata_value.data, 0,
 934                      pa->padata_value.length, pa->padata_value.length);
 935     }
 936     free_KDCFastState(state);
 937 }
 938
 939 krb5_error_code
 940 _kdc_fast_check_armor_pac(astgs_request_t r, int flags)
 941 {
 942     krb5_error_code ret;
 943     krb5_boolean ad_kdc_issued = FALSE;
 944     krb5_pac mspac = NULL;
 945     krb5_principal armor_client_principal = NULL;
 946     HDB *armor_db;
 947     hdb_entry *armor_client = NULL;
 948     char *armor_client_principal_name = NULL;
 949
 950     flags |= HDB_F_ARMOR_PRINCIPAL;
 951     if (_kdc_synthetic_princ_used_p(r->context, r->armor_ticket))
 952         flags |= HDB_F_SYNTHETIC_OK;
 953     if (r->req.req_body.kdc_options.canonicalize)
 954         flags |= HDB_F_CANON;
 955
 956     ret = _krb5_principalname2krb5_principal(r->context,
 957                                              &armor_client_principal,
 958                                              r->armor_ticket->ticket.cname,
 959                                              r->armor_ticket->ticket.crealm);
 960     if (ret)
 961         goto out;
 962
 963     ret = krb5_unparse_name(r->context, armor_client_principal,
 964                             &armor_client_principal_name);
 965     if (ret)
 966         goto out;
 967
 968     ret = _kdc_db_fetch_client(r->context, r->config, flags,
 969                                armor_client_principal, armor_client_principal_name,
 970                                r->req.req_body.realm, &armor_db, &armor_client);
 971     if (ret)
 972         goto out;
 973
 974     ret = kdc_check_flags(r, FALSE, armor_client, NULL);
 975     if (ret)
 976         goto out;
 977
 978     ret = _kdc_check_pac(r, armor_client_principal, NULL,
 979                          armor_client, r->armor_server,
 980                          r->armor_server, r->armor_server,
 981                          &r->armor_key->key, &r->armor_key->key,
 982                          &r->armor_ticket->ticket, &ad_kdc_issued, &mspac, NULL, NULL);
 983     if (ret) {
 984         const char *msg = krb5_get_error_message(r->context, ret);
 985
 986         kdc_log(r->context, r->config, 4,
 987                 "Verify armor PAC (%s) failed for %s (%s) from %s with %s (%s)",
 988                 armor_client_principal_name, r->cname, r->sname,
 989                 r->from, msg, mspac ? "Ticket unsigned" : "No PAC");
 990
 991         krb5_free_error_message(r->context, msg);
 992
 993         goto out;
 994     }
 995
 996     r->armor_clientdb = armor_db;
 997     armor_db = NULL;
 998
 999     r->armor_client = armor_client;
1000     armor_client = NULL;
1001
1002     r->armor_pac = mspac;
1003     mspac = NULL;
1004
1005 out:
1006     krb5_xfree(armor_client_principal_name);
1007     if (armor_client)
1008         _kdc_free_ent(r->context, armor_db, armor_client);
1009     krb5_free_principal(r->context, armor_client_principal);
1010     krb5_pac_free(r->context, mspac);
1011
1012     return ret;
1013 }