source4/auth/gensec/gensec_krb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Luke Howard 2002-2003
   9    Copyright (C) Stefan Metzmacher 2004-2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "system/kerberos.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "auth/auth.h"
  30 #include "lib/tsocket/tsocket.h"
  31 #include "librpc/gen_ndr/dcerpc.h"
  32 #include "auth/credentials/credentials.h"
  33 #include "auth/credentials/credentials_krb5.h"
  34 #include "auth/kerberos/kerberos_credentials.h"
  35 #include "auth/gensec/gensec.h"
  36 #include "auth/gensec/gensec_internal.h"
  37 #include "auth/gensec/gensec_proto.h"
  38 #include "auth/gensec/gensec_toplevel_proto.h"
  39 #include "param/param.h"
  40 #include "auth/auth_sam_reply.h"
  41 #include "lib/util/util_net.h"
  42 #include "../lib/util/asn1.h"
  43 #include "auth/kerberos/pac_utils.h"
  44 #include "gensec_krb5.h"
  45
  46 _PUBLIC_ NTSTATUS gensec_krb5_init(void);
  47
  48 enum GENSEC_KRB5_STATE {
  49         GENSEC_KRB5_SERVER_START,
  50         GENSEC_KRB5_CLIENT_START,
  51         GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
  52         GENSEC_KRB5_DONE
  53 };
  54
  55 struct gensec_krb5_state {
  56         enum GENSEC_KRB5_STATE state_position;
  57         struct smb_krb5_context *smb_krb5_context;
  58         krb5_auth_context auth_context;
  59         krb5_data enc_ticket;
  60         krb5_keyblock *keyblock;
  61         krb5_ticket *ticket;
  62         bool gssapi;
  63         krb5_flags ap_req_options;
  64 };
  65
  66 static int gensec_krb5_destroy(struct gensec_krb5_state *gensec_krb5_state)
  67 {
  68         if (!gensec_krb5_state->smb_krb5_context) {
  69                 /* We can't clean anything else up unless we started up this far */
  70                 return 0;
  71         }
  72         if (gensec_krb5_state->enc_ticket.length) {
  73                 kerberos_free_data_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
  74                                             &gensec_krb5_state->enc_ticket);
  75         }
  76
  77         if (gensec_krb5_state->ticket) {
  78                 krb5_free_ticket(gensec_krb5_state->smb_krb5_context->krb5_context,
  79                                  gensec_krb5_state->ticket);
  80         }
  81
  82         /* ccache freed in a child destructor */
  83
  84         krb5_free_keyblock(gensec_krb5_state->smb_krb5_context->krb5_context,
  85                            gensec_krb5_state->keyblock);
  86
  87         if (gensec_krb5_state->auth_context) {
  88                 krb5_auth_con_free(gensec_krb5_state->smb_krb5_context->krb5_context,
  89                                    gensec_krb5_state->auth_context);
  90         }
  91
  92         return 0;
  93 }
  94
  95 static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security, bool gssapi)
  96 {
  97         krb5_error_code ret;
  98         struct gensec_krb5_state *gensec_krb5_state;
  99         struct cli_credentials *creds;
 100         const struct tsocket_address *tlocal_addr, *tremote_addr;
 101         krb5_address my_krb5_addr, peer_krb5_addr;
 102
 103         creds = gensec_get_credentials(gensec_security);
 104         if (!creds) {
 105                 return NT_STATUS_INVALID_PARAMETER;
 106         }
 107
 108         gensec_krb5_state = talloc(gensec_security, struct gensec_krb5_state);
 109         if (!gensec_krb5_state) {
 110                 return NT_STATUS_NO_MEMORY;
 111         }
 112
 113         gensec_security->private_data = gensec_krb5_state;
 114         gensec_krb5_state->smb_krb5_context = NULL;
 115         gensec_krb5_state->auth_context = NULL;
 116         gensec_krb5_state->ticket = NULL;
 117         ZERO_STRUCT(gensec_krb5_state->enc_ticket);
 118         gensec_krb5_state->keyblock = NULL;
 119         gensec_krb5_state->gssapi = gssapi;
 120
 121         talloc_set_destructor(gensec_krb5_state, gensec_krb5_destroy);
 122
 123         if (cli_credentials_get_krb5_context(creds,
 124                                              gensec_security->settings->lp_ctx, &gensec_krb5_state->smb_krb5_context)) {
 125                 talloc_free(gensec_krb5_state);
 126                 return NT_STATUS_INTERNAL_ERROR;
 127         }
 128
 129         ret = krb5_auth_con_init(gensec_krb5_state->smb_krb5_context->krb5_context, &gensec_krb5_state->auth_context);
 130         if (ret) {
 131                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n",
 132                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 133                                                     ret, gensec_krb5_state)));
 134                 talloc_free(gensec_krb5_state);
 135                 return NT_STATUS_INTERNAL_ERROR;
 136         }
 137
 138         ret = krb5_auth_con_setflags(gensec_krb5_state->smb_krb5_context->krb5_context,
 139                                      gensec_krb5_state->auth_context,
 140                                      KRB5_AUTH_CONTEXT_DO_SEQUENCE);
 141         if (ret) {
 142                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setflags failed (%s)\n",
 143                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 144                                                     ret, gensec_krb5_state)));
 145                 talloc_free(gensec_krb5_state);
 146                 return NT_STATUS_INTERNAL_ERROR;
 147         }
 148
 149         tlocal_addr = gensec_get_local_address(gensec_security);
 150         if (tlocal_addr) {
 151                 ssize_t socklen;
 152                 struct sockaddr_storage ss;
 153                 bool ok;
 154
 155                 socklen = tsocket_address_bsd_sockaddr(tlocal_addr,
 156                                 (struct sockaddr *) &ss,
 157                                 sizeof(struct sockaddr_storage));
 158                 if (socklen < 0) {
 159                         talloc_free(gensec_krb5_state);
 160                         return NT_STATUS_INTERNAL_ERROR;
 161                 }
 162                 ok = setup_kaddr(&my_krb5_addr, &ss);
 163                 if (!ok) {
 164                         DBG_WARNING("setup_kaddr (local) failed\n");
 165                         talloc_free(gensec_krb5_state);
 166                         return NT_STATUS_INTERNAL_ERROR;
 167                 }
 168         }
 169
 170         tremote_addr = gensec_get_remote_address(gensec_security);
 171         if (tremote_addr) {
 172                 ssize_t socklen;
 173                 struct sockaddr_storage ss;
 174                 bool ok;
 175
 176                 socklen = tsocket_address_bsd_sockaddr(tremote_addr,
 177                                 (struct sockaddr *) &ss,
 178                                 sizeof(struct sockaddr_storage));
 179                 if (socklen < 0) {
 180                         talloc_free(gensec_krb5_state);
 181                         return NT_STATUS_INTERNAL_ERROR;
 182                 }
 183                 ok = setup_kaddr(&peer_krb5_addr, &ss);
 184                 if (!ok) {
 185                         DBG_WARNING("setup_kaddr (remote) failed\n");
 186                         talloc_free(gensec_krb5_state);
 187                         return NT_STATUS_INTERNAL_ERROR;
 188                 }
 189         }
 190
 191         ret = krb5_auth_con_setaddrs(gensec_krb5_state->smb_krb5_context->krb5_context,
 192                                      gensec_krb5_state->auth_context,
 193                                      tlocal_addr ? &my_krb5_addr : NULL,
 194                                      tremote_addr ? &peer_krb5_addr : NULL);
 195         if (ret) {
 196                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setaddrs failed (%s)\n",
 197                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 198                                                     ret, gensec_krb5_state)));
 199                 talloc_free(gensec_krb5_state);
 200                 return NT_STATUS_INTERNAL_ERROR;
 201         }
 202
 203         return NT_STATUS_OK;
 204 }
 205
 206 static NTSTATUS gensec_krb5_common_server_start(struct gensec_security *gensec_security, bool gssapi)
 207 {
 208         NTSTATUS nt_status;
 209         struct gensec_krb5_state *gensec_krb5_state;
 210
 211         nt_status = gensec_krb5_start(gensec_security, gssapi);
 212         if (!NT_STATUS_IS_OK(nt_status)) {
 213                 return nt_status;
 214         }
 215
 216         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 217         gensec_krb5_state->state_position = GENSEC_KRB5_SERVER_START;
 218
 219         return NT_STATUS_OK;
 220 }
 221
 222 static NTSTATUS gensec_krb5_server_start(struct gensec_security *gensec_security)
 223 {
 224         return gensec_krb5_common_server_start(gensec_security, false);
 225 }
 226
 227 static NTSTATUS gensec_fake_gssapi_krb5_server_start(struct gensec_security *gensec_security)
 228 {
 229         return gensec_krb5_common_server_start(gensec_security, true);
 230 }
 231
 232 static NTSTATUS gensec_krb5_common_client_start(struct gensec_security *gensec_security, bool gssapi)
 233 {
 234         const char *hostname;
 235         struct gensec_krb5_state *gensec_krb5_state;
 236         NTSTATUS nt_status;
 237         hostname = gensec_get_target_hostname(gensec_security);
 238         if (!hostname) {
 239                 DEBUG(3, ("No hostname for target computer passed in, cannot use kerberos for this connection\n"));
 240                 return NT_STATUS_INVALID_PARAMETER;
 241         }
 242         if (is_ipaddress(hostname)) {
 243                 DEBUG(2, ("Cannot do krb5 to an IP address"));
 244                 return NT_STATUS_INVALID_PARAMETER;
 245         }
 246         if (strcmp(hostname, "localhost") == 0) {
 247                 DEBUG(2, ("krb5 to 'localhost' does not make sense"));
 248                 return NT_STATUS_INVALID_PARAMETER;
 249         }
 250
 251         nt_status = gensec_krb5_start(gensec_security, gssapi);
 252         if (!NT_STATUS_IS_OK(nt_status)) {
 253                 return nt_status;
 254         }
 255
 256         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 257         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_START;
 258         gensec_krb5_state->ap_req_options = AP_OPTS_USE_SUBKEY;
 259
 260         if (gensec_krb5_state->gssapi) {
 261                 /* The Fake GSSAPI model emulates Samba3, which does not do mutual authentication */
 262                 if (gensec_setting_bool(gensec_security->settings, "gensec_fake_gssapi_krb5", "mutual", false)) {
 263                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 264                 }
 265         } else {
 266                 /* The wrapping for KPASSWD (a user of the raw KRB5 API) should be mutually authenticated */
 267                 if (gensec_setting_bool(gensec_security->settings, "gensec_krb5", "mutual", true)) {
 268                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 269                 }
 270         }
 271         return NT_STATUS_OK;
 272 }
 273
 274 static NTSTATUS gensec_krb5_common_client_creds(struct gensec_security *gensec_security,
 275                                                 struct tevent_context *ev,
 276                                                 bool gssapi)
 277 {
 278         struct gensec_krb5_state *gensec_krb5_state;
 279         krb5_error_code ret;
 280         struct ccache_container *ccache_container;
 281         const char *error_string;
 282         const char *principal;
 283         const char *hostname;
 284         krb5_data in_data = { .length = 0 };
 285         krb5_data *in_data_p = NULL;
 286 #ifdef SAMBA4_USES_HEIMDAL
 287         struct tevent_context *previous_ev;
 288 #endif
 289
 290         if (lpcfg_parm_bool(gensec_security->settings->lp_ctx,
 291                             NULL, "gensec_krb5", "send_authenticator_checksum", true)) {
 292                 in_data_p = &in_data;
 293         }
 294
 295         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 296
 297         principal = gensec_get_target_principal(gensec_security);
 298         hostname = gensec_get_target_hostname(gensec_security);
 299
 300         ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security),
 301                                          ev,
 302                                          gensec_security->settings->lp_ctx, &ccache_container, &error_string);
 303         switch (ret) {
 304         case 0:
 305                 break;
 306         case KRB5KDC_ERR_PREAUTH_FAILED:
 307         case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
 308                 return NT_STATUS_LOGON_FAILURE;
 309         case KRB5_KDC_UNREACH:
 310                 DEBUG(3, ("Cannot reach a KDC we require to contact %s: %s\n", principal, error_string));
 311                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 312         case KRB5_CC_NOTFOUND:
 313         case KRB5_CC_END:
 314                 DEBUG(3, ("Error preparing credentials we require to contact %s : %s\n", principal, error_string));
 315                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 316         default:
 317                 DEBUG(1, ("gensec_krb5_start: Aquiring initiator credentials failed: %s\n", error_string));
 318                 return NT_STATUS_UNSUCCESSFUL;
 319         }
 320
 321 #ifdef SAMBA4_USES_HEIMDAL
 322         /* Do this every time, in case we have weird recursive issues here */
 323         ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, ev, &previous_ev);
 324         if (ret != 0) {
 325                 DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
 326                 return NT_STATUS_NO_MEMORY;
 327         }
 328 #endif
 329         if (principal) {
 330                 krb5_principal target_principal;
 331                 ret = krb5_parse_name(gensec_krb5_state->smb_krb5_context->krb5_context, principal,
 332                                       &target_principal);
 333                 if (ret == 0) {
 334                         krb5_creds this_cred;
 335                         krb5_creds *cred;
 336
 337                         ZERO_STRUCT(this_cred);
 338                         ret = krb5_cc_get_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 339                                                     ccache_container->ccache,
 340                                                     &this_cred.client);
 341                         if (ret != 0) {
 342                                 return NT_STATUS_UNSUCCESSFUL;
 343                         }
 344
 345                         ret = krb5_copy_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 346                                                   target_principal,
 347                                                   &this_cred.server);
 348                         if (ret != 0) {
 349                                 krb5_free_cred_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
 350                                                         &this_cred);
 351                                 return NT_STATUS_UNSUCCESSFUL;
 352                         }
 353                         this_cred.times.endtime = 0;
 354
 355                         ret = krb5_get_credentials(gensec_krb5_state->smb_krb5_context->krb5_context,
 356                                                    0,
 357                                                    ccache_container->ccache,
 358                                                    &this_cred,
 359                                                    &cred);
 360                         krb5_free_cred_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
 361                                                 &this_cred);
 362                         if (ret != 0) {
 363                                 return NT_STATUS_UNSUCCESSFUL;
 364                         }
 365
 366                         ret = krb5_mk_req_extended(gensec_krb5_state->smb_krb5_context->krb5_context,
 367                                                    &gensec_krb5_state->auth_context,
 368                                                    gensec_krb5_state->ap_req_options,
 369                                                    in_data_p,
 370                                                    cred,
 371                                                    &gensec_krb5_state->enc_ticket);
 372
 373                         krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 374                                             target_principal);
 375                 }
 376         } else {
 377                 ret = krb5_mk_req(gensec_krb5_state->smb_krb5_context->krb5_context,
 378                                   &gensec_krb5_state->auth_context,
 379                                   gensec_krb5_state->ap_req_options,
 380                                   gensec_get_target_service(gensec_security),
 381                                   hostname,
 382                                   in_data_p, ccache_container->ccache,
 383                                   &gensec_krb5_state->enc_ticket);
 384         }
 385
 386 #ifdef SAMBA4_USES_HEIMDAL
 387         smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, ev);
 388 #endif
 389
 390         switch (ret) {
 391         case 0:
 392                 return NT_STATUS_OK;
 393         case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 394                 DEBUG(3, ("Server [%s] is not registered with our KDC: %s\n",
 395                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 396                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 397         case KRB5_KDC_UNREACH:
 398                 DEBUG(3, ("Cannot reach a KDC we require to contact host [%s]: %s\n",
 399                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 400                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 401         case KRB5KDC_ERR_PREAUTH_FAILED:
 402         case KRB5KRB_AP_ERR_TKT_EXPIRED:
 403         case KRB5_CC_END:
 404                 /* Too much clock skew - we will need to kinit to re-skew the clock */
 405         case KRB5KRB_AP_ERR_SKEW:
 406         case KRB5_KDCREP_SKEW:
 407         {
 408                 DEBUG(3, ("kerberos (mk_req) failed: %s\n",
 409                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 410                 /*fall through*/
 411         }
 412
 413         /* just don't print a message for these really ordinary messages */
 414         case KRB5_FCC_NOFILE:
 415         case KRB5_CC_NOTFOUND:
 416         case ENOENT:
 417
 418                 return NT_STATUS_UNSUCCESSFUL;
 419                 break;
 420
 421         default:
 422                 DEBUG(0, ("kerberos: %s\n",
 423                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 424                 return NT_STATUS_UNSUCCESSFUL;
 425         }
 426 }
 427
 428 static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security)
 429 {
 430         return gensec_krb5_common_client_start(gensec_security, false);
 431 }
 432
 433 static NTSTATUS gensec_fake_gssapi_krb5_client_start(struct gensec_security *gensec_security)
 434 {
 435         return gensec_krb5_common_client_start(gensec_security, true);
 436 }
 437
 438
 439 /*
 440   generate a krb5 GSS-API wrapper packet given a ticket
 441 */
 442 static DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2])
 443 {
 444         struct asn1_data *data;
 445         DATA_BLOB ret = data_blob_null;
 446
 447         data = asn1_init(mem_ctx);
 448         if (!data || !ticket->data) {
 449                 return ret;
 450         }
 451
 452         if (!asn1_push_tag(data, ASN1_APPLICATION(0))) goto err;
 453         if (!asn1_write_OID(data, GENSEC_OID_KERBEROS5)) goto err;
 454
 455         if (!asn1_write(data, tok_id, 2)) goto err;
 456         if (!asn1_write(data, ticket->data, ticket->length)) goto err;
 457         if (!asn1_pop_tag(data)) goto err;
 458
 459
 460         if (!asn1_extract_blob(data, mem_ctx, &ret)) {
 461                 goto err;
 462         }
 463         asn1_free(data);
 464
 465         return ret;
 466
 467   err:
 468
 469         DEBUG(1, ("Failed to build krb5 wrapper at offset %d\n",
 470                   (int)asn1_current_ofs(data)));
 471         asn1_free(data);
 472         return ret;
 473 }
 474
 475 /*
 476   parse a krb5 GSS-API wrapper packet giving a ticket
 477 */
 478 static bool gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2])
 479 {
 480         bool ret = false;
 481         struct asn1_data *data = asn1_init(mem_ctx);
 482         int data_remaining;
 483
 484         if (!data) {
 485                 return false;
 486         }
 487
 488         if (!asn1_load(data, *blob)) goto err;
 489         if (!asn1_start_tag(data, ASN1_APPLICATION(0))) goto err;
 490         if (!asn1_check_OID(data, GENSEC_OID_KERBEROS5)) goto err;
 491
 492         data_remaining = asn1_tag_remaining(data);
 493
 494         if (data_remaining < 3) {
 495                 asn1_set_error(data);
 496         } else {
 497                 if (!asn1_read(data, tok_id, 2)) goto err;
 498                 data_remaining -= 2;
 499                 *ticket = data_blob_talloc(mem_ctx, NULL, data_remaining);
 500                 if (!asn1_read(data, ticket->data, ticket->length)) goto err;
 501         }
 502
 503         if (!asn1_end_tag(data)) goto err;
 504
 505         ret = !asn1_has_error(data);
 506
 507   err:
 508
 509         asn1_free(data);
 510
 511         return ret;
 512 }
 513
 514 /**
 515  * Next state function for the Krb5 GENSEC mechanism
 516  *
 517  * @param gensec_krb5_state KRB5 State
 518  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 519  * @param in The request, as a DATA_BLOB
 520  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 521  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 522  *                or NT_STATUS_OK if the user is authenticated.
 523  */
 524
 525 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
 526                                    TALLOC_CTX *out_mem_ctx,
 527                                    struct tevent_context *ev,
 528                                    const DATA_BLOB in, DATA_BLOB *out)
 529 {
 530         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 531         krb5_error_code ret = 0;
 532         NTSTATUS nt_status;
 533
 534         switch (gensec_krb5_state->state_position) {
 535         case GENSEC_KRB5_CLIENT_START:
 536         {
 537                 DATA_BLOB unwrapped_out;
 538
 539                 nt_status = gensec_krb5_common_client_creds(gensec_security, ev, gensec_krb5_state->gssapi);
 540                 if (!NT_STATUS_IS_OK(nt_status)) {
 541                         return nt_status;
 542                 }
 543
 544                 if (gensec_krb5_state->gssapi) {
 545                         unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 546
 547                         /* wrap that up in a nice GSS-API wrapping */
 548                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REQ);
 549                 } else {
 550                         *out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 551                 }
 552                 if (gensec_krb5_state->ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
 553                         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_MUTUAL_AUTH;
 554                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 555                 } else {
 556                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 557                         nt_status = NT_STATUS_OK;
 558                 }
 559                 return nt_status;
 560         }
 561
 562         case GENSEC_KRB5_CLIENT_MUTUAL_AUTH:
 563         {
 564                 DATA_BLOB unwrapped_in;
 565                 krb5_data inbuf;
 566                 krb5_ap_rep_enc_part *repl = NULL;
 567                 uint8_t tok_id[2];
 568
 569                 if (gensec_krb5_state->gssapi) {
 570                         if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 571                                 DEBUG(1,("gensec_gssapi_parse_krb5_wrap(mutual authentication) failed to parse\n"));
 572                                 dump_data_pw("Mutual authentication message:\n", in.data, in.length);
 573                                 return NT_STATUS_INVALID_PARAMETER;
 574                         }
 575                 } else {
 576                         unwrapped_in = in;
 577                 }
 578                 /* TODO: check the tok_id */
 579
 580                 inbuf.data = unwrapped_in.data;
 581                 inbuf.length = unwrapped_in.length;
 582                 ret = krb5_rd_rep(gensec_krb5_state->smb_krb5_context->krb5_context,
 583                                   gensec_krb5_state->auth_context,
 584                                   &inbuf, &repl);
 585                 if (ret) {
 586                         DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
 587                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, out_mem_ctx)));
 588                         dump_data_pw("Mutual authentication message:\n", (uint8_t *)inbuf.data, inbuf.length);
 589                         nt_status = NT_STATUS_ACCESS_DENIED;
 590                 } else {
 591                         *out = data_blob(NULL, 0);
 592                         nt_status = NT_STATUS_OK;
 593                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 594                 }
 595                 if (repl) {
 596                         krb5_free_ap_rep_enc_part(gensec_krb5_state->smb_krb5_context->krb5_context, repl);
 597                 }
 598                 return nt_status;
 599         }
 600
 601         case GENSEC_KRB5_SERVER_START:
 602         {
 603                 DATA_BLOB unwrapped_in;
 604                 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
 605                 krb5_data inbuf, outbuf;
 606                 uint8_t tok_id[2];
 607                 struct keytab_container *keytab;
 608                 krb5_principal server_in_keytab;
 609                 const char *error_string;
 610                 enum credentials_obtained obtained;
 611
 612                 if (!in.data) {
 613                         return NT_STATUS_INVALID_PARAMETER;
 614                 }
 615
 616                 /* Grab the keytab, however generated */
 617                 ret = cli_credentials_get_keytab(gensec_get_credentials(gensec_security),
 618                                                  gensec_security->settings->lp_ctx, &keytab);
 619                 if (ret) {
 620                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 621                 }
 622
 623                 /* This ensures we lookup the correct entry in that
 624                  * keytab.  A NULL principal is acceptable, and means
 625                  * that the krb5 libs should search the keytab at
 626                  * accept time for any matching key */
 627                 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security),
 628                                                  gensec_krb5_state->smb_krb5_context,
 629                                                  &server_in_keytab, &obtained, &error_string);
 630
 631                 if (ret) {
 632                         DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
 633                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 634                 }
 635
 636                 if (keytab->password_based || obtained < CRED_SPECIFIED) {
 637                         /*
 638                          * Use match-by-key in this case (matches
 639                          * cli_credentials_get_server_gss_creds()
 640                          * behaviour).  No need to free the memory,
 641                          * this is handled with a talloc destructor.
 642                          */
 643                         server_in_keytab = NULL;
 644                 }
 645
 646                 /* Parse the GSSAPI wrapping, if it's there... (win2k3 allows it to be omited) */
 647                 if (gensec_krb5_state->gssapi
 648                     && gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 649                         inbuf.data = unwrapped_in.data;
 650                         inbuf.length = unwrapped_in.length;
 651                 } else {
 652                         inbuf.data = in.data;
 653                         inbuf.length = in.length;
 654                 }
 655
 656                 ret = smb_krb5_rd_req_decoded(gensec_krb5_state->smb_krb5_context->krb5_context,
 657                                               &gensec_krb5_state->auth_context,
 658                                               &inbuf,
 659                                               keytab->keytab,
 660                                               server_in_keytab,
 661                                               &outbuf,
 662                                               &gensec_krb5_state->ticket,
 663                                               &gensec_krb5_state->keyblock);
 664
 665                 if (ret) {
 666                         return NT_STATUS_LOGON_FAILURE;
 667                 }
 668                 unwrapped_out.data = (uint8_t *)outbuf.data;
 669                 unwrapped_out.length = outbuf.length;
 670                 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 671                 /* wrap that up in a nice GSS-API wrapping */
 672                 if (gensec_krb5_state->gssapi) {
 673                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REP);
 674                 } else {
 675                         *out = data_blob_talloc(out_mem_ctx, outbuf.data, outbuf.length);
 676                 }
 677                 kerberos_free_data_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
 678                                             &outbuf);
 679                 return NT_STATUS_OK;
 680         }
 681
 682         case GENSEC_KRB5_DONE:
 683         default:
 684                 /* Asking too many times... */
 685                 return NT_STATUS_INVALID_PARAMETER;
 686         }
 687 }
 688
 689 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security,
 690                                         TALLOC_CTX *mem_ctx,
 691                                         DATA_BLOB *session_key)
 692 {
 693         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 694         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 695         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 696         krb5_error_code err = -1;
 697         bool remote = false;
 698         bool ok;
 699
 700         if (gensec_krb5_state->state_position != GENSEC_KRB5_DONE) {
 701                 return NT_STATUS_NO_USER_SESSION_KEY;
 702         }
 703
 704         switch (gensec_security->gensec_role) {
 705         case GENSEC_CLIENT:
 706                 remote = false;
 707                 break;
 708         case GENSEC_SERVER:
 709                 remote = true;
 710                 break;
 711         }
 712
 713         ok = get_krb5_smb_session_key(mem_ctx,
 714                                       context,
 715                                       auth_context,
 716                                       session_key,
 717                                       remote);
 718         if (!ok) {
 719                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 720                 return NT_STATUS_NO_USER_SESSION_KEY;
 721         }
 722
 723         return NT_STATUS_OK;
 724 }
 725
 726 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
 727                                          TALLOC_CTX *mem_ctx,
 728                                          struct auth_session_info **_session_info)
 729 {
 730         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 731         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 732         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 733         struct auth_session_info *session_info = NULL;
 734
 735         krb5_principal client_principal;
 736         char *principal_string;
 737
 738         DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
 739         krb5_data pac_data;
 740
 741         krb5_error_code ret;
 742
 743         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 744         if (!tmp_ctx) {
 745                 return NT_STATUS_NO_MEMORY;
 746         }
 747
 748         ret = krb5_ticket_get_client(context, gensec_krb5_state->ticket, &client_principal);
 749         if (ret) {
 750                 DEBUG(5, ("krb5_ticket_get_client failed to get cleint principal: %s\n",
 751                           smb_get_krb5_error_message(context,
 752                                                      ret, tmp_ctx)));
 753                 talloc_free(tmp_ctx);
 754                 return NT_STATUS_NO_MEMORY;
 755         }
 756
 757         ret = krb5_unparse_name(gensec_krb5_state->smb_krb5_context->krb5_context,
 758                                 client_principal, &principal_string);
 759         if (ret) {
 760                 DEBUG(1, ("Unable to parse client principal: %s\n",
 761                           smb_get_krb5_error_message(context,
 762                                                      ret, tmp_ctx)));
 763                 krb5_free_principal(context, client_principal);
 764                 talloc_free(tmp_ctx);
 765                 return NT_STATUS_NO_MEMORY;
 766         }
 767
 768         ret = krb5_ticket_get_authorization_data_type(context, gensec_krb5_state->ticket,
 769                                                       KRB5_AUTHDATA_WIN2K_PAC,
 770                                                       &pac_data);
 771
 772         if (ret) {
 773                 /* NO pac */
 774                 DEBUG(5, ("krb5_ticket_get_authorization_data_type failed to find PAC: %s\n",
 775                           smb_get_krb5_error_message(context,
 776                                                      ret, tmp_ctx)));
 777         } else {
 778                 /* Found pac */
 779                 pac_blob = data_blob_talloc(tmp_ctx, pac_data.data, pac_data.length);
 780                 kerberos_free_data_contents(context, &pac_data);
 781                 if (!pac_blob.data) {
 782                         free(principal_string);
 783                         krb5_free_principal(context, client_principal);
 784                         talloc_free(tmp_ctx);
 785                         return NT_STATUS_NO_MEMORY;
 786                 }
 787
 788                 /* decode and verify the pac */
 789                 nt_status = kerberos_decode_pac(gensec_krb5_state,
 790                                                 pac_blob,
 791                                                 gensec_krb5_state->smb_krb5_context->krb5_context,
 792                                                 NULL, gensec_krb5_state->keyblock,
 793                                                 client_principal,
 794                                                 gensec_krb5_state->ticket->ticket.authtime, NULL);
 795
 796                 if (!NT_STATUS_IS_OK(nt_status)) {
 797                         free(principal_string);
 798                         krb5_free_principal(context, client_principal);
 799                         talloc_free(tmp_ctx);
 800                         return nt_status;
 801                 }
 802
 803                 pac_blob_ptr = &pac_blob;
 804         }
 805
 806         nt_status = gensec_generate_session_info_pac(tmp_ctx,
 807                                                      gensec_security,
 808                                                      gensec_krb5_state->smb_krb5_context,
 809                                                      pac_blob_ptr, principal_string,
 810                                                      gensec_get_remote_address(gensec_security),
 811                                                      &session_info);
 812
 813         free(principal_string);
 814         krb5_free_principal(context, client_principal);
 815
 816         if (!NT_STATUS_IS_OK(nt_status)) {
 817                 talloc_free(tmp_ctx);
 818                 return nt_status;
 819         }
 820
 821         nt_status = gensec_krb5_session_key(gensec_security, session_info, &session_info->session_key);
 822
 823         if (!NT_STATUS_IS_OK(nt_status)) {
 824                 talloc_free(tmp_ctx);
 825                 return nt_status;
 826         }
 827
 828         *_session_info = talloc_steal(mem_ctx, session_info);
 829
 830         talloc_free(tmp_ctx);
 831         return NT_STATUS_OK;
 832 }
 833
 834 static NTSTATUS gensec_krb5_wrap(struct gensec_security *gensec_security,
 835                                    TALLOC_CTX *mem_ctx,
 836                                    const DATA_BLOB *in,
 837                                    DATA_BLOB *out)
 838 {
 839         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 840         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 841         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 842         krb5_error_code ret;
 843         krb5_data input, output;
 844         input.length = in->length;
 845         input.data = in->data;
 846
 847         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 848                 ret = krb5_mk_priv(context, auth_context, &input, &output, NULL);
 849                 if (ret) {
 850                         DEBUG(1, ("krb5_mk_priv failed: %s\n",
 851                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 852                                                              ret, mem_ctx)));
 853                         return NT_STATUS_ACCESS_DENIED;
 854                 }
 855                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
 856
 857                 kerberos_free_data_contents(context, &output);
 858         } else {
 859                 return NT_STATUS_ACCESS_DENIED;
 860         }
 861         return NT_STATUS_OK;
 862 }
 863
 864 static NTSTATUS gensec_krb5_unwrap(struct gensec_security *gensec_security,
 865                                      TALLOC_CTX *mem_ctx,
 866                                      const DATA_BLOB *in,
 867                                      DATA_BLOB *out)
 868 {
 869         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 870         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 871         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 872         krb5_error_code ret;
 873         krb5_data input, output;
 874         krb5_replay_data replay;
 875         input.length = in->length;
 876         input.data = in->data;
 877
 878         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 879                 ret = krb5_rd_priv(context, auth_context, &input, &output, &replay);
 880                 if (ret) {
 881                         DEBUG(1, ("krb5_rd_priv failed: %s\n",
 882                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 883                                                              ret, mem_ctx)));
 884                         return NT_STATUS_ACCESS_DENIED;
 885                 }
 886                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
 887
 888                 kerberos_free_data_contents(context, &output);
 889         } else {
 890                 return NT_STATUS_ACCESS_DENIED;
 891         }
 892         return NT_STATUS_OK;
 893 }
 894
 895 static bool gensec_krb5_have_feature(struct gensec_security *gensec_security,
 896                                      uint32_t feature)
 897 {
 898         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 899         if (feature & GENSEC_FEATURE_SESSION_KEY) {
 900                 return true;
 901         }
 902         if (!gensec_krb5_state->gssapi &&
 903             (feature & GENSEC_FEATURE_SEAL)) {
 904                 return true;
 905         }
 906
 907         return false;
 908 }
 909
 910 static const char *gensec_krb5_oids[] = {
 911         GENSEC_OID_KERBEROS5,
 912         GENSEC_OID_KERBEROS5_OLD,
 913         NULL
 914 };
 915
 916 static const struct gensec_security_ops gensec_fake_gssapi_krb5_security_ops = {
 917         .name           = "fake_gssapi_krb5",
 918         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
 919         .oid            = gensec_krb5_oids,
 920         .client_start   = gensec_fake_gssapi_krb5_client_start,
 921         .server_start   = gensec_fake_gssapi_krb5_server_start,
 922         .update         = gensec_krb5_update,
 923         .magic          = gensec_magic_check_krb5_oid,
 924         .session_key    = gensec_krb5_session_key,
 925         .session_info   = gensec_krb5_session_info,
 926         .have_feature   = gensec_krb5_have_feature,
 927         .enabled        = false,
 928         .kerberos       = true,
 929         .priority       = GENSEC_KRB5
 930 };
 931
 932 static const struct gensec_security_ops gensec_krb5_security_ops = {
 933         .name           = "krb5",
 934         .client_start   = gensec_krb5_client_start,
 935         .server_start   = gensec_krb5_server_start,
 936         .update         = gensec_krb5_update,
 937         .session_key    = gensec_krb5_session_key,
 938         .session_info   = gensec_krb5_session_info,
 939         .have_feature   = gensec_krb5_have_feature,
 940         .wrap           = gensec_krb5_wrap,
 941         .unwrap         = gensec_krb5_unwrap,
 942         .enabled        = true,
 943         .kerberos       = true,
 944         .priority       = GENSEC_KRB5
 945 };
 946
 947 _PUBLIC_ NTSTATUS gensec_krb5_init(void)
 948 {
 949         NTSTATUS ret;
 950
 951         ret = gensec_register(&gensec_krb5_security_ops);
 952         if (!NT_STATUS_IS_OK(ret)) {
 953                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 954                         gensec_krb5_security_ops.name));
 955                 return ret;
 956         }
 957
 958         ret = gensec_register(&gensec_fake_gssapi_krb5_security_ops);
 959         if (!NT_STATUS_IS_OK(ret)) {
 960                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 961                         gensec_fake_gssapi_krb5_security_ops.name));
 962                 return ret;
 963         }
 964
 965         return ret;
 966 }