source4/auth/kerberos/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "system/network.h"
  26 #include "system/kerberos.h"
  27 #include "system/time.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "asn_1.h"
  30
  31 #ifdef HAVE_KRB5
  32
  33 #ifndef HAVE_KRB5_SET_REAL_TIME
  34 /*
  35  * This function is not in the Heimdal mainline.
  36  */
  37  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
  38 {
  39         krb5_error_code ret;
  40         int32_t sec, usec;
  41
  42         ret = krb5_us_timeofday(context, &sec, &usec);
  43         if (ret)
  44                 return ret;
  45
  46         context->kdc_sec_offset = seconds - sec;
  47         context->kdc_usec_offset = microseconds - usec;
  48
  49         return 0;
  50 }
  51 #endif
  52
  53 #if defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES) && !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
  54  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
  55 {
  56         return krb5_set_default_in_tkt_etypes(ctx, enc);
  57 }
  58 #endif
  59
  60 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
  61 /* HEIMDAL */
  62  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
  63 {
  64         pkaddr->addr_type = KRB5_ADDRESS_INET;
  65         pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
  66         pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
  67 }
  68 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
  69 /* MIT */
  70  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
  71 {
  72         pkaddr->addrtype = ADDRTYPE_INET;
  73         pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
  74         pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
  75 }
  76 #else
  77 #error UNKNOWN_ADDRTYPE
  78 #endif
  79
  80 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
  81  int create_kerberos_key_from_string(krb5_context context,
  82                                         krb5_principal host_princ,
  83                                         krb5_data *password,
  84                                         krb5_keyblock *key,
  85                                         krb5_enctype enctype)
  86 {
  87         int ret;
  88         krb5_data salt;
  89         krb5_encrypt_block eblock;
  90
  91         ret = krb5_principal2salt(context, host_princ, &salt);
  92         if (ret) {
  93                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
  94                 return ret;
  95         }
  96         krb5_use_enctype(context, &eblock, enctype);
  97         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
  98         SAFE_FREE(salt.data);
  99         return ret;
 100 }
 101 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 102  int create_kerberos_key_from_string(krb5_context context,
 103                                         krb5_principal host_princ,
 104                                         krb5_data *password,
 105                                         krb5_keyblock *key,
 106                                         krb5_enctype enctype)
 107 {
 108         int ret;
 109         krb5_salt salt;
 110
 111         ret = krb5_get_pw_salt(context, host_princ, &salt);
 112         if (ret) {
 113                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 114                 return ret;
 115         }
 116         ret = krb5_string_to_key_salt(context, enctype, password->data,
 117                                       salt, key);
 118         krb5_free_salt(context, salt);
 119         return ret;
 120 }
 121 #else
 122 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 123 #endif
 124
 125 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 126  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 127                                             krb5_enctype **enctypes)
 128 {
 129         return krb5_get_permitted_enctypes(context, enctypes);
 130 }
 131 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 132  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 133                                             krb5_enctype **enctypes)
 134 {
 135         return krb5_get_default_in_tkt_etypes(context, enctypes);
 136 }
 137 #else
 138 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 139 #endif
 140
 141  void free_kerberos_etypes(krb5_context context,
 142                            krb5_enctype *enctypes)
 143 {
 144 #if defined(HAVE_KRB5_FREE_KTYPES)
 145         krb5_free_ktypes(context, enctypes);
 146         return;
 147 #else
 148         SAFE_FREE(enctypes);
 149         return;
 150 #endif
 151 }
 152
 153 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 154  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 155                                         krb5_auth_context auth_context,
 156                                         krb5_keyblock *keyblock)
 157 {
 158         return krb5_auth_con_setkey(context, auth_context, keyblock);
 159 }
 160 #endif
 161
 162 BOOL unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 163 {
 164         DATA_BLOB pac_contents;
 165         struct asn1_data data;
 166         int data_type;
 167
 168         if (!auth_data->length) {
 169                 return False;
 170         }
 171
 172         asn1_load(&data, *auth_data);
 173         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 174         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 175         asn1_start_tag(&data, ASN1_CONTEXT(0));
 176         asn1_read_Integer(&data, &data_type);
 177
 178         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 179                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 180                 asn1_free(&data);
 181                 return False;
 182         }
 183
 184         asn1_end_tag(&data);
 185         asn1_start_tag(&data, ASN1_CONTEXT(1));
 186         asn1_read_OctetString(&data, &pac_contents);
 187         asn1_end_tag(&data);
 188         asn1_end_tag(&data);
 189         asn1_end_tag(&data);
 190         asn1_free(&data);
 191
 192         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 193
 194         data_blob_free(&pac_contents);
 195
 196         return True;
 197 }
 198
 199  BOOL get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 200 {
 201         DATA_BLOB auth_data_wrapped;
 202         BOOL got_auth_data_pac = False;
 203         int i;
 204
 205 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 206         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 207             tkt->enc_part2->authorization_data[0] &&
 208             tkt->enc_part2->authorization_data[0]->length)
 209         {
 210                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 211
 212                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 213                             KRB5_AUTHDATA_IF_RELEVANT) {
 214                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 215                                         tkt->enc_part2->authorization_data[i]->ad_type));
 216                                 continue;
 217                         }
 218
 219                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 220                                                       tkt->enc_part2->authorization_data[i]->length);
 221
 222                         /* check if it is a PAC */
 223                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 224                         data_blob_free(&auth_data_wrapped);
 225
 226                         if (!got_auth_data_pac) {
 227                                 continue;
 228                         }
 229                 }
 230
 231                 return got_auth_data_pac;
 232         }
 233
 234 #else
 235         if (tkt->ticket.authorization_data &&
 236             tkt->ticket.authorization_data->len)
 237         {
 238                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 239
 240                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 241                             KRB5_AUTHDATA_IF_RELEVANT) {
 242                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 243                                         tkt->ticket.authorization_data->val[i].ad_type));
 244                                 continue;
 245                         }
 246
 247                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 248                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 249
 250                         /* check if it is a PAC */
 251                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 252                         data_blob_free(&auth_data_wrapped);
 253
 254                         if (!got_auth_data_pac) {
 255                                 continue;
 256                         }
 257                 }
 258
 259                 return got_auth_data_pac;
 260         }
 261 #endif
 262         return False;
 263 }
 264
 265  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 266 {
 267 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 268         return tkt->enc_part2->client;
 269 #else
 270         return tkt->client;
 271 #endif
 272 }
 273
 274 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 275  void krb5_free_unparsed_name(krb5_context context, char *val)
 276 {
 277         SAFE_FREE(val);
 278 }
 279 #endif
 280
 281  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 282 {
 283 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 284         if (pdata->data) {
 285                 krb5_free_data_contents(context, pdata);
 286         }
 287 #else
 288         SAFE_FREE(pdata->data);
 289 #endif
 290 }
 291
 292  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 293 {
 294 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 295         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 296 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 297         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 298 #else
 299 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 300 #endif
 301 }
 302
 303  BOOL kerberos_compatible_enctypes(krb5_context context,
 304                                   krb5_enctype enctype1,
 305                                   krb5_enctype enctype2)
 306 {
 307 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 308         krb5_boolean similar = 0;
 309
 310         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 311         return similar ? True : False;
 312 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 313         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 314 #endif
 315 }
 316
 317 static BOOL ads_cleanup_expired_creds(krb5_context context,
 318                                       krb5_ccache  ccache,
 319                                       krb5_creds  *credsp)
 320 {
 321         krb5_error_code retval;
 322         TALLOC_CTX *mem_ctx = talloc_init("ticket expied time");
 323         if (!mem_ctx) {
 324                 return False;
 325         }
 326
 327         DEBUG(3, ("Ticket in ccache[%s] expiration %s\n",
 328                   krb5_cc_default_name(context),
 329                   http_timestring(mem_ctx, credsp->times.endtime)));
 330
 331         talloc_free(mem_ctx);
 332
 333         /* we will probably need new tickets if the current ones
 334            will expire within 10 seconds.
 335         */
 336         if (credsp->times.endtime >= (time(NULL) + 10))
 337                 return False;
 338
 339         /* heimdal won't remove creds from a file ccache, and
 340            perhaps we shouldn't anyway, since internally we
 341            use memory ccaches, and a FILE one probably means that
 342            we're using creds obtained outside of our exectuable
 343         */
 344         if (strcasecmp_m(krb5_cc_get_type(context, ccache), "FILE") == 0) {
 345                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a FILE ccache\n"));
 346                 return False;
 347         }
 348
 349         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 350         if (retval) {
 351                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 352                           error_message(retval)));
 353                 /* If we have an error in this, we want to display it,
 354                    but continue as though we deleted it */
 355         }
 356         return True;
 357 }
 358
 359 /*
 360   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 361 */
 362 krb5_error_code ads_krb5_mk_req(krb5_context context,
 363                                 krb5_auth_context *auth_context,
 364                                 const krb5_flags ap_req_options,
 365                                 const char *principal,
 366                                 krb5_ccache ccache,
 367                                 krb5_data *outbuf)
 368 {
 369         krb5_error_code           retval;
 370         krb5_principal    server;
 371         krb5_creds              * credsp;
 372         krb5_creds                creds;
 373         krb5_data in_data;
 374         BOOL creds_ready = False;
 375
 376         TALLOC_CTX *mem_ctx = NULL;
 377
 378         retval = krb5_parse_name(context, principal, &server);
 379         if (retval) {
 380                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 381                 return retval;
 382         }
 383
 384         /* obtain ticket & session key */
 385         ZERO_STRUCT(creds);
 386         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 387                 DEBUG(1,("krb5_copy_principal failed (%s)\n",
 388                          error_message(retval)));
 389                 goto cleanup_princ;
 390         }
 391
 392         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 393                 /* This can commonly fail on smbd startup with no ticket in the cache.
 394                  * Report at higher level than 1. */
 395                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 396                          error_message(retval)));
 397                 goto cleanup_creds;
 398         }
 399
 400         while(!creds_ready) {
 401                 if ((retval = krb5_get_credentials(context, 0, ccache,
 402                                                    &creds, &credsp))) {
 403                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 404                                  principal, error_message(retval)));
 405                         goto cleanup_creds;
 406                 }
 407
 408                 /* cope with ticket being in the future due to clock skew */
 409                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 410                         time_t t = time(NULL);
 411                         int time_offset =(unsigned)credsp->times.starttime-t;
 412                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 413                         krb5_set_real_time(context, t + time_offset + 1, 0);
 414                 }
 415
 416                 if (!ads_cleanup_expired_creds(context, ccache, credsp))
 417                         creds_ready = True;
 418         }
 419
 420         mem_ctx = talloc_init("ticket expied time");
 421         if (!mem_ctx) {
 422                 retval = ENOMEM;
 423                 goto cleanup_creds;
 424         }
 425         DEBUG(10,("Ticket (%s) in ccache (%s) is valid until: (%s - %d)\n",
 426                   principal, krb5_cc_default_name(context),
 427                   http_timestring(mem_ctx, (unsigned)credsp->times.endtime),
 428                   (unsigned)credsp->times.endtime));
 429
 430         in_data.length = 0;
 431         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 432                                       &in_data, credsp, outbuf);
 433         if (retval) {
 434                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 435                          error_message(retval)));
 436         }
 437
 438         krb5_free_creds(context, credsp);
 439
 440 cleanup_creds:
 441         krb5_free_cred_contents(context, &creds);
 442
 443 cleanup_princ:
 444         krb5_free_principal(context, server);
 445
 446         return retval;
 447 }
 448
 449  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 450 {
 451 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
 452         return krb5_kt_free_entry(context, kt_entry);
 453 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 454         return krb5_free_keytab_entry_contents(context, kt_entry);
 455 #else
 456 #error UNKNOWN_KT_FREE_FUNCTION
 457 #endif
 458 }
 459
 460  char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx)
 461 {
 462         char *ret;
 463
 464 #if defined(HAVE_KRB5_GET_ERROR_STRING) && defined(HAVE_KRB5_FREE_ERROR_STRING)
 465         char *context_error = krb5_get_error_string(context);
 466         if (context_error) {
 467                 ret = talloc_asprintf(mem_ctx, "%s: %s", error_message(code), context_error);
 468                 krb5_free_error_string(context, context_error);
 469                 return ret;
 470         }
 471 #endif
 472         ret = talloc_strdup(mem_ctx, error_message(code));
 473         return ret;
 474 }
 475
 476 #endif