source4/heimdal/lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "krb5_locl.h"
  37 #include <assert.h>
  38
  39 static krb5_error_code
  40 get_cred_kdc_capath(krb5_context, krb5_kdc_flags,
  41                     krb5_ccache, krb5_creds *, krb5_principal,
  42                     Ticket *, krb5_creds **, krb5_creds ***);
  43
  44 /*
  45  * Take the `body' and encode it into `padata' using the credentials
  46  * in `creds'.
  47  */
  48
  49 static krb5_error_code
  50 make_pa_tgs_req(krb5_context context,
  51                 krb5_auth_context ac,
  52                 KDC_REQ_BODY *body,
  53                 PA_DATA *padata,
  54                 krb5_creds *creds)
  55 {
  56     u_char *buf;
  57     size_t buf_size;
  58     size_t len;
  59     krb5_data in_data;
  60     krb5_error_code ret;
  61
  62     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  63     if (ret)
  64         goto out;
  65     if(buf_size != len)
  66         krb5_abortx(context, "internal error in ASN.1 encoder");
  67
  68     in_data.length = len;
  69     in_data.data   = buf;
  70     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  71                                 &padata->padata_value,
  72                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  73                                 KRB5_KU_TGS_REQ_AUTH);
  74  out:
  75     free (buf);
  76     if(ret)
  77         return ret;
  78     padata->padata_type = KRB5_PADATA_TGS_REQ;
  79     return 0;
  80 }
  81
  82 /*
  83  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  84  */
  85
  86 static krb5_error_code
  87 set_auth_data (krb5_context context,
  88                KDC_REQ_BODY *req_body,
  89                krb5_authdata *authdata,
  90                krb5_keyblock *subkey)
  91 {
  92     if(authdata->len) {
  93         size_t len, buf_size;
  94         unsigned char *buf;
  95         krb5_crypto crypto;
  96         krb5_error_code ret;
  97
  98         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  99                            &len, ret);
 100         if (ret)
 101             return ret;
 102         if (buf_size != len)
 103             krb5_abortx(context, "internal error in ASN.1 encoder");
 104
 105         ALLOC(req_body->enc_authorization_data, 1);
 106         if (req_body->enc_authorization_data == NULL) {
 107             free (buf);
 108             krb5_set_error_message(context, ENOMEM,
 109                                    N_("malloc: out of memory", ""));
 110             return ENOMEM;
 111         }
 112         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 113         if (ret) {
 114             free (buf);
 115             free (req_body->enc_authorization_data);
 116             req_body->enc_authorization_data = NULL;
 117             return ret;
 118         }
 119         krb5_encrypt_EncryptedData(context,
 120                                    crypto,
 121                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 122                                    buf,
 123                                    len,
 124                                    0,
 125                                    req_body->enc_authorization_data);
 126         free (buf);
 127         krb5_crypto_destroy(context, crypto);
 128     } else {
 129         req_body->enc_authorization_data = NULL;
 130     }
 131     return 0;
 132 }
 133
 134 /*
 135  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 136  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 137  * subkey in `subkey'.
 138  */
 139
 140 static krb5_error_code
 141 init_tgs_req (krb5_context context,
 142               krb5_ccache ccache,
 143               krb5_addresses *addresses,
 144               krb5_kdc_flags flags,
 145               Ticket *second_ticket,
 146               krb5_creds *in_creds,
 147               krb5_creds *krbtgt,
 148               unsigned nonce,
 149               const METHOD_DATA *padata,
 150               krb5_keyblock **subkey,
 151               TGS_REQ *t)
 152 {
 153     krb5_auth_context ac = NULL;
 154     krb5_error_code ret = 0;
 155
 156     memset(t, 0, sizeof(*t));
 157     t->pvno = 5;
 158     t->msg_type = krb_tgs_req;
 159     if (in_creds->session.keytype) {
 160         ALLOC_SEQ(&t->req_body.etype, 1);
 161         if(t->req_body.etype.val == NULL) {
 162             ret = ENOMEM;
 163             krb5_set_error_message(context, ret,
 164                                    N_("malloc: out of memory", ""));
 165             goto fail;
 166         }
 167         t->req_body.etype.val[0] = in_creds->session.keytype;
 168     } else {
 169         ret = krb5_init_etype(context,
 170                               &t->req_body.etype.len,
 171                               &t->req_body.etype.val,
 172                               NULL);
 173     }
 174     if (ret)
 175         goto fail;
 176     t->req_body.addresses = addresses;
 177     t->req_body.kdc_options = flags.b;
 178     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 179     if (ret)
 180         goto fail;
 181     ALLOC(t->req_body.sname, 1);
 182     if (t->req_body.sname == NULL) {
 183         ret = ENOMEM;
 184         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 185         goto fail;
 186     }
 187
 188     /* some versions of some code might require that the client be
 189        present in TGS-REQs, but this is clearly against the spec */
 190
 191     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 192     if (ret)
 193         goto fail;
 194
 195     /* req_body.till should be NULL if there is no endtime specified,
 196        but old MIT code (like DCE secd) doesn't like that */
 197     ALLOC(t->req_body.till, 1);
 198     if(t->req_body.till == NULL){
 199         ret = ENOMEM;
 200         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 201         goto fail;
 202     }
 203     *t->req_body.till = in_creds->times.endtime;
 204
 205     t->req_body.nonce = nonce;
 206     if(second_ticket){
 207         ALLOC(t->req_body.additional_tickets, 1);
 208         if (t->req_body.additional_tickets == NULL) {
 209             ret = ENOMEM;
 210             krb5_set_error_message(context, ret,
 211                                    N_("malloc: out of memory", ""));
 212             goto fail;
 213         }
 214         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 215         if (t->req_body.additional_tickets->val == NULL) {
 216             ret = ENOMEM;
 217             krb5_set_error_message(context, ret,
 218                                    N_("malloc: out of memory", ""));
 219             goto fail;
 220         }
 221         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 222         if (ret)
 223             goto fail;
 224     }
 225     ALLOC(t->padata, 1);
 226     if (t->padata == NULL) {
 227         ret = ENOMEM;
 228         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 229         goto fail;
 230     }
 231     ALLOC_SEQ(t->padata, 1 + padata->len);
 232     if (t->padata->val == NULL) {
 233         ret = ENOMEM;
 234         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 235         goto fail;
 236     }
 237     {
 238         int i;
 239         for (i = 0; i < padata->len; i++) {
 240             ret = copy_PA_DATA(&padata->val[i], &t->padata->val[i + 1]);
 241             if (ret) {
 242                 krb5_set_error_message(context, ret,
 243                                        N_("malloc: out of memory", ""));
 244                 goto fail;
 245             }
 246         }
 247     }
 248
 249     ret = krb5_auth_con_init(context, &ac);
 250     if(ret)
 251         goto fail;
 252
 253     ret = krb5_auth_con_generatelocalsubkey(context, ac, &krbtgt->session);
 254     if (ret)
 255         goto fail;
 256
 257     ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 258                          ac->local_subkey);
 259     if (ret)
 260         goto fail;
 261
 262     ret = make_pa_tgs_req(context,
 263                           ac,
 264                           &t->req_body,
 265                           &t->padata->val[0],
 266                           krbtgt);
 267     if(ret)
 268         goto fail;
 269
 270     ret = krb5_auth_con_getlocalsubkey(context, ac, subkey);
 271     if (ret)
 272         goto fail;
 273
 274 fail:
 275     if (ac)
 276         krb5_auth_con_free(context, ac);
 277     if (ret) {
 278         t->req_body.addresses = NULL;
 279         free_TGS_REQ (t);
 280     }
 281     return ret;
 282 }
 283
 284 krb5_error_code
 285 _krb5_get_krbtgt(krb5_context context,
 286                  krb5_ccache  id,
 287                  krb5_realm realm,
 288                  krb5_creds **cred)
 289 {
 290     krb5_error_code ret;
 291     krb5_creds tmp_cred;
 292
 293     memset(&tmp_cred, 0, sizeof(tmp_cred));
 294
 295     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 296     if (ret)
 297         return ret;
 298
 299     ret = krb5_make_principal(context,
 300                               &tmp_cred.server,
 301                               realm,
 302                               KRB5_TGS_NAME,
 303                               realm,
 304                               NULL);
 305     if(ret) {
 306         krb5_free_principal(context, tmp_cred.client);
 307         return ret;
 308     }
 309     ret = krb5_get_credentials(context,
 310                                KRB5_GC_CACHED,
 311                                id,
 312                                &tmp_cred,
 313                                cred);
 314     krb5_free_principal(context, tmp_cred.client);
 315     krb5_free_principal(context, tmp_cred.server);
 316     if(ret)
 317         return ret;
 318     return 0;
 319 }
 320
 321 /* DCE compatible decrypt proc */
 322 static krb5_error_code KRB5_CALLCONV
 323 decrypt_tkt_with_subkey (krb5_context context,
 324                          krb5_keyblock *key,
 325                          krb5_key_usage usage,
 326                          krb5_const_pointer subkey,
 327                          krb5_kdc_rep *dec_rep)
 328 {
 329     krb5_error_code ret;
 330     krb5_data data;
 331     size_t size;
 332     krb5_crypto crypto;
 333
 334     assert(usage == 0);
 335
 336     /*
 337      * start out with trying with subkey if we have one
 338      */
 339     if (subkey) {
 340         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 341         if (ret)
 342             return ret;
 343         ret = krb5_decrypt_EncryptedData (context,
 344                                           crypto,
 345                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 346                                           &dec_rep->kdc_rep.enc_part,
 347                                           &data);
 348         krb5_crypto_destroy(context, crypto);
 349     }
 350     if (subkey == NULL || ret) {
 351         ret = krb5_crypto_init(context, key, 0, &crypto);
 352         if (ret)
 353             return ret;
 354         ret = krb5_decrypt_EncryptedData (context,
 355                                           crypto,
 356                                           KRB5_KU_TGS_REP_ENC_PART_SESSION,
 357                                           &dec_rep->kdc_rep.enc_part,
 358                                           &data);
 359         krb5_crypto_destroy(context, crypto);
 360     }
 361     if (ret)
 362         return ret;
 363
 364     ret = decode_EncASRepPart(data.data,
 365                               data.length,
 366                               &dec_rep->enc_part,
 367                               &size);
 368     if (ret)
 369         ret = decode_EncTGSRepPart(data.data,
 370                                    data.length,
 371                                    &dec_rep->enc_part,
 372                                    &size);
 373     if (ret)
 374       krb5_set_error_message(context, ret,
 375                              N_("Failed to decode encpart in ticket", ""));
 376     krb5_data_free (&data);
 377     return ret;
 378 }
 379
 380 static krb5_error_code
 381 get_cred_kdc(krb5_context context,
 382              krb5_ccache id,
 383              krb5_kdc_flags flags,
 384              krb5_addresses *addresses,
 385              krb5_creds *in_creds,
 386              krb5_creds *krbtgt,
 387              krb5_principal impersonate_principal,
 388              Ticket *second_ticket,
 389              krb5_creds *out_creds)
 390 {
 391     TGS_REQ req;
 392     krb5_data enc;
 393     krb5_data resp;
 394     krb5_kdc_rep rep;
 395     KRB_ERROR error;
 396     krb5_error_code ret;
 397     unsigned nonce;
 398     krb5_keyblock *subkey = NULL;
 399     size_t len;
 400     Ticket second_ticket_data;
 401     METHOD_DATA padata;
 402
 403     krb5_data_zero(&resp);
 404     krb5_data_zero(&enc);
 405     padata.val = NULL;
 406     padata.len = 0;
 407
 408     krb5_generate_random_block(&nonce, sizeof(nonce));
 409     nonce &= 0xffffffff;
 410
 411     if(flags.b.enc_tkt_in_skey && second_ticket == NULL){
 412         ret = decode_Ticket(in_creds->second_ticket.data,
 413                             in_creds->second_ticket.length,
 414                             &second_ticket_data, &len);
 415         if(ret)
 416             return ret;
 417         second_ticket = &second_ticket_data;
 418     }
 419
 420
 421     if (impersonate_principal) {
 422         krb5_crypto crypto;
 423         PA_S4U2Self self;
 424         krb5_data data;
 425         void *buf;
 426         size_t size;
 427
 428         self.name = impersonate_principal->name;
 429         self.realm = impersonate_principal->realm;
 430         self.auth = estrdup("Kerberos");
 431
 432         ret = _krb5_s4u2self_to_checksumdata(context, &self, &data);
 433         if (ret) {
 434             free(self.auth);
 435             goto out;
 436         }
 437
 438         ret = krb5_crypto_init(context, &krbtgt->session, 0, &crypto);
 439         if (ret) {
 440             free(self.auth);
 441             krb5_data_free(&data);
 442             goto out;
 443         }
 444
 445         ret = krb5_create_checksum(context,
 446                                    crypto,
 447                                    KRB5_KU_OTHER_CKSUM,
 448                                    0,
 449                                    data.data,
 450                                    data.length,
 451                                    &self.cksum);
 452         krb5_crypto_destroy(context, crypto);
 453         krb5_data_free(&data);
 454         if (ret) {
 455             free(self.auth);
 456             goto out;
 457         }
 458
 459         ASN1_MALLOC_ENCODE(PA_S4U2Self, buf, len, &self, &size, ret);
 460         free(self.auth);
 461         free_Checksum(&self.cksum);
 462         if (ret)
 463             goto out;
 464         if (len != size)
 465             krb5_abortx(context, "internal asn1 error");
 466
 467         ret = krb5_padata_add(context, &padata, KRB5_PADATA_FOR_USER, buf, len);
 468         if (ret)
 469             goto out;
 470     }
 471
 472     ret = init_tgs_req (context,
 473                         id,
 474                         addresses,
 475                         flags,
 476                         second_ticket,
 477                         in_creds,
 478                         krbtgt,
 479                         nonce,
 480                         &padata,
 481                         &subkey,
 482                         &req);
 483     if (ret)
 484         goto out;
 485
 486     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 487     if (ret)
 488         goto out;
 489     if(enc.length != len)
 490         krb5_abortx(context, "internal error in ASN.1 encoder");
 491
 492     /* don't free addresses */
 493     req.req_body.addresses = NULL;
 494     free_TGS_REQ(&req);
 495
 496     /*
 497      * Send and receive
 498      */
 499     {
 500         krb5_sendto_ctx stctx;
 501         ret = krb5_sendto_ctx_alloc(context, &stctx);
 502         if (ret)
 503             return ret;
 504         krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
 505
 506         ret = krb5_sendto_context (context, stctx, &enc,
 507                                    krbtgt->server->name.name_string.val[1],
 508                                    &resp);
 509         krb5_sendto_ctx_free(context, stctx);
 510     }
 511     if(ret)
 512         goto out;
 513
 514     memset(&rep, 0, sizeof(rep));
 515     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
 516         unsigned eflags = 0;
 517
 518         ret = krb5_copy_principal(context,
 519                                   in_creds->client,
 520                                   &out_creds->client);
 521         if(ret)
 522             goto out2;
 523         ret = krb5_copy_principal(context,
 524                                   in_creds->server,
 525                                   &out_creds->server);
 526         if(ret)
 527             goto out2;
 528         /* this should go someplace else */
 529         out_creds->times.endtime = in_creds->times.endtime;
 530
 531         /* XXX should do better testing */
 532         if (flags.b.constrained_delegation || impersonate_principal)
 533             eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 534
 535         ret = _krb5_extract_ticket(context,
 536                                    &rep,
 537                                    out_creds,
 538                                    &krbtgt->session,
 539                                    NULL,
 540                                    0,
 541                                    &krbtgt->addresses,
 542                                    nonce,
 543                                    eflags,
 544                                    decrypt_tkt_with_subkey,
 545                                    subkey);
 546     out2:
 547         krb5_free_kdc_rep(context, &rep);
 548     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 549         ret = krb5_error_from_rd_error(context, &error, in_creds);
 550         krb5_free_error_contents(context, &error);
 551     } else if(resp.length > 0 && ((char*)resp.data)[0] == 4) {
 552         ret = KRB5KRB_AP_ERR_V4_REPLY;
 553         krb5_clear_error_message(context);
 554     } else {
 555         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 556         krb5_clear_error_message(context);
 557     }
 558
 559 out:
 560     if (second_ticket == &second_ticket_data)
 561         free_Ticket(&second_ticket_data);
 562     free_METHOD_DATA(&padata);
 563     krb5_data_free(&resp);
 564     krb5_data_free(&enc);
 565     if(subkey)
 566         krb5_free_keyblock(context, subkey);
 567     return ret;
 568
 569 }
 570
 571 /*
 572  * same as above, just get local addresses first if the krbtgt have
 573  * them and the realm is not addressless
 574  */
 575
 576 static krb5_error_code
 577 get_cred_kdc_address(krb5_context context,
 578                      krb5_ccache id,
 579                      krb5_kdc_flags flags,
 580                      krb5_addresses *addrs,
 581                      krb5_creds *in_creds,
 582                      krb5_creds *krbtgt,
 583                      krb5_principal impersonate_principal,
 584                      Ticket *second_ticket,
 585                      krb5_creds *out_creds)
 586 {
 587     krb5_error_code ret;
 588     krb5_addresses addresses = { 0, NULL };
 589
 590     /*
 591      * Inherit the address-ness of the krbtgt if the address is not
 592      * specified.
 593      */
 594
 595     if (addrs == NULL && krbtgt->addresses.len != 0) {
 596         krb5_boolean noaddr;
 597
 598         krb5_appdefault_boolean(context, NULL, krbtgt->server->realm,
 599                                 "no-addresses", FALSE, &noaddr);
 600
 601         if (!noaddr) {
 602             krb5_get_all_client_addrs(context, &addresses);
 603             /* XXX this sucks. */
 604             addrs = &addresses;
 605             if(addresses.len == 0)
 606                 addrs = NULL;
 607         }
 608     }
 609     ret = get_cred_kdc(context, id, flags, addrs, in_creds,
 610                        krbtgt, impersonate_principal,
 611                        second_ticket, out_creds);
 612     krb5_free_addresses(context, &addresses);
 613     return ret;
 614 }
 615
 616 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 617 krb5_get_kdc_cred(krb5_context context,
 618                   krb5_ccache id,
 619                   krb5_kdc_flags flags,
 620                   krb5_addresses *addresses,
 621                   Ticket  *second_ticket,
 622                   krb5_creds *in_creds,
 623                   krb5_creds **out_creds
 624                   )
 625 {
 626     krb5_error_code ret;
 627     krb5_creds *krbtgt;
 628
 629     *out_creds = calloc(1, sizeof(**out_creds));
 630     if(*out_creds == NULL) {
 631         krb5_set_error_message(context, ENOMEM,
 632                                N_("malloc: out of memory", ""));
 633         return ENOMEM;
 634     }
 635     ret = _krb5_get_krbtgt (context,
 636                             id,
 637                             in_creds->server->realm,
 638                             &krbtgt);
 639     if(ret) {
 640         free(*out_creds);
 641         *out_creds = NULL;
 642         return ret;
 643     }
 644     ret = get_cred_kdc(context, id, flags, addresses,
 645                        in_creds, krbtgt, NULL, NULL, *out_creds);
 646     krb5_free_creds (context, krbtgt);
 647     if(ret) {
 648         free(*out_creds);
 649         *out_creds = NULL;
 650     }
 651     return ret;
 652 }
 653
 654 static int
 655 not_found(krb5_context context, krb5_const_principal p, krb5_error_code code)
 656 {
 657     krb5_error_code ret;
 658     char *str;
 659
 660     ret = krb5_unparse_name(context, p, &str);
 661     if(ret) {
 662         krb5_clear_error_message(context);
 663         return code;
 664     }
 665     krb5_set_error_message(context, code,
 666                            N_("Matching credential (%s) not found", ""), str);
 667     free(str);
 668     return code;
 669 }
 670
 671 static krb5_error_code
 672 find_cred(krb5_context context,
 673           krb5_ccache id,
 674           krb5_principal server,
 675           krb5_creds **tgts,
 676           krb5_creds *out_creds)
 677 {
 678     krb5_error_code ret;
 679     krb5_creds mcreds;
 680
 681     krb5_cc_clear_mcred(&mcreds);
 682     mcreds.server = server;
 683     ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
 684                                 &mcreds, out_creds);
 685     if(ret == 0)
 686         return 0;
 687     while(tgts && *tgts){
 688         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 689                               &mcreds, *tgts)){
 690             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 691             return ret;
 692         }
 693         tgts++;
 694     }
 695     return not_found(context, server, KRB5_CC_NOTFOUND);
 696 }
 697
 698 static krb5_error_code
 699 add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 700 {
 701     int i;
 702     krb5_error_code ret;
 703     krb5_creds **tmp = *tgts;
 704
 705     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 706     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 707     if(tmp == NULL) {
 708         krb5_set_error_message(context, ENOMEM,
 709                                N_("malloc: out of memory", ""));
 710         return ENOMEM;
 711     }
 712     *tgts = tmp;
 713     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 714     tmp[i+1] = NULL;
 715     return ret;
 716 }
 717
 718 static krb5_error_code
 719 get_cred_kdc_capath_worker(krb5_context context,
 720                            krb5_kdc_flags flags,
 721                            krb5_ccache ccache,
 722                            krb5_creds *in_creds,
 723                            krb5_const_realm try_realm,
 724                            krb5_principal impersonate_principal,
 725                            Ticket *second_ticket,
 726                            krb5_creds **out_creds,
 727                            krb5_creds ***ret_tgts)
 728 {
 729     krb5_error_code ret;
 730     krb5_creds *tgt, tmp_creds;
 731     krb5_const_realm client_realm, server_realm;
 732     int ok_as_delegate = 1;
 733
 734     *out_creds = NULL;
 735
 736     client_realm = krb5_principal_get_realm(context, in_creds->client);
 737     server_realm = krb5_principal_get_realm(context, in_creds->server);
 738     memset(&tmp_creds, 0, sizeof(tmp_creds));
 739     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 740     if(ret)
 741         return ret;
 742
 743     ret = krb5_make_principal(context,
 744                               &tmp_creds.server,
 745                               try_realm,
 746                               KRB5_TGS_NAME,
 747                               server_realm,
 748                               NULL);
 749     if(ret){
 750         krb5_free_principal(context, tmp_creds.client);
 751         return ret;
 752     }
 753     {
 754         krb5_creds tgts;
 755
 756         ret = find_cred(context, ccache, tmp_creds.server,
 757                         *ret_tgts, &tgts);
 758         if(ret == 0){
 759             if (strcmp(try_realm, client_realm) != 0)
 760                 ok_as_delegate = tgts.flags.b.ok_as_delegate;
 761
 762             *out_creds = calloc(1, sizeof(**out_creds));
 763             if(*out_creds == NULL) {
 764                 ret = ENOMEM;
 765                 krb5_set_error_message(context, ret,
 766                                        N_("malloc: out of memory", ""));
 767             } else {
 768                 ret = get_cred_kdc_address(context, ccache, flags, NULL,
 769                                            in_creds, &tgts,
 770                                            impersonate_principal,
 771                                            second_ticket,
 772                                            *out_creds);
 773                 if (ret) {
 774                     free (*out_creds);
 775                     *out_creds = NULL;
 776                 } else if (ok_as_delegate == 0)
 777                     (*out_creds)->flags.b.ok_as_delegate = 0;
 778             }
 779             krb5_free_cred_contents(context, &tgts);
 780             krb5_free_principal(context, tmp_creds.server);
 781             krb5_free_principal(context, tmp_creds.client);
 782             return ret;
 783         }
 784     }
 785     if(krb5_realm_compare(context, in_creds->client, in_creds->server))
 786         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 787
 788     /* XXX this can loop forever */
 789     while(1){
 790         heim_general_string tgt_inst;
 791
 792         ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 793                                   NULL, NULL, &tgt, ret_tgts);
 794         if(ret) {
 795             krb5_free_principal(context, tmp_creds.server);
 796             krb5_free_principal(context, tmp_creds.client);
 797             return ret;
 798         }
 799         /*
 800          * if either of the chain or the ok_as_delegate was stripped
 801          * by the kdc, make sure we strip it too.
 802          */
 803         if (ok_as_delegate == 0 || tgt->flags.b.ok_as_delegate == 0) {
 804             ok_as_delegate = 0;
 805             tgt->flags.b.ok_as_delegate = 0;
 806         }
 807
 808         ret = add_cred(context, tgt, ret_tgts);
 809         if(ret) {
 810             krb5_free_principal(context, tmp_creds.server);
 811             krb5_free_principal(context, tmp_creds.client);
 812             return ret;
 813         }
 814         tgt_inst = tgt->server->name.name_string.val[1];
 815         if(strcmp(tgt_inst, server_realm) == 0)
 816             break;
 817         krb5_free_principal(context, tmp_creds.server);
 818         ret = krb5_make_principal(context, &tmp_creds.server,
 819                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 820         if(ret) {
 821             krb5_free_principal(context, tmp_creds.server);
 822             krb5_free_principal(context, tmp_creds.client);
 823             return ret;
 824         }
 825         ret = krb5_free_creds(context, tgt);
 826         if(ret) {
 827             krb5_free_principal(context, tmp_creds.server);
 828             krb5_free_principal(context, tmp_creds.client);
 829             return ret;
 830         }
 831     }
 832
 833     krb5_free_principal(context, tmp_creds.server);
 834     krb5_free_principal(context, tmp_creds.client);
 835     *out_creds = calloc(1, sizeof(**out_creds));
 836     if(*out_creds == NULL) {
 837         ret = ENOMEM;
 838         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
 839     } else {
 840         ret = get_cred_kdc_address (context, ccache, flags, NULL,
 841                                     in_creds, tgt, impersonate_principal,
 842                                     second_ticket, *out_creds);
 843         if (ret) {
 844             free (*out_creds);
 845             *out_creds = NULL;
 846         }
 847     }
 848     krb5_free_creds(context, tgt);
 849     return ret;
 850 }
 851
 852 /*
 853 get_cred(server)
 854         creds = cc_get_cred(server)
 855         if(creds) return creds
 856         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 857         if(tgt)
 858                 return get_cred_tgt(server, tgt)
 859         if(client_realm == server_realm)
 860                 return NULL
 861         tgt = get_cred(krbtgt/server_realm@client_realm)
 862         while(tgt_inst != server_realm)
 863                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 864         return get_cred_tgt(server, tgt)
 865         */
 866
 867 static krb5_error_code
 868 get_cred_kdc_capath(krb5_context context,
 869                     krb5_kdc_flags flags,
 870                     krb5_ccache ccache,
 871                     krb5_creds *in_creds,
 872                     krb5_principal impersonate_principal,
 873                     Ticket *second_ticket,
 874                     krb5_creds **out_creds,
 875                     krb5_creds ***ret_tgts)
 876 {
 877     krb5_error_code ret;
 878     krb5_const_realm client_realm, server_realm, try_realm;
 879
 880     client_realm = krb5_principal_get_realm(context, in_creds->client);
 881     server_realm = krb5_principal_get_realm(context, in_creds->server);
 882
 883     try_realm = client_realm;
 884     ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds, try_realm,
 885                                      impersonate_principal, second_ticket, out_creds,
 886                                      ret_tgts);
 887
 888     if (ret == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
 889         try_realm = krb5_config_get_string(context, NULL, "capaths",
 890                                            client_realm, server_realm, NULL);
 891
 892         if (try_realm != NULL && strcmp(try_realm, client_realm)) {
 893             ret = get_cred_kdc_capath_worker(context, flags, ccache, in_creds,
 894                                              try_realm, impersonate_principal,
 895                                              second_ticket, out_creds, ret_tgts);
 896         }
 897     }
 898
 899     return ret;
 900 }
 901
 902 static krb5_error_code
 903 get_cred_kdc_referral(krb5_context context,
 904                       krb5_kdc_flags flags,
 905                       krb5_ccache ccache,
 906                       krb5_creds *in_creds,
 907                       krb5_principal impersonate_principal,
 908                       Ticket *second_ticket,
 909                       krb5_creds **out_creds,
 910                       krb5_creds ***ret_tgts)
 911 {
 912     krb5_const_realm client_realm;
 913     krb5_error_code ret;
 914     krb5_creds tgt, referral, ticket;
 915     int loop = 0;
 916     int ok_as_delegate = 1;
 917
 918     if (in_creds->server->name.name_string.len < 2 && !flags.b.canonicalize) {
 919         krb5_set_error_message(context, KRB5KDC_ERR_PATH_NOT_ACCEPTED,
 920                                N_("Name too short to do referals, skipping", ""));
 921         return KRB5KDC_ERR_PATH_NOT_ACCEPTED;
 922     }
 923
 924     memset(&tgt, 0, sizeof(tgt));
 925     memset(&ticket, 0, sizeof(ticket));
 926
 927     flags.b.canonicalize = 1;
 928
 929     *out_creds = NULL;
 930
 931     client_realm = krb5_principal_get_realm(context, in_creds->client);
 932
 933     /* find tgt for the clients base realm */
 934     {
 935         krb5_principal tgtname;
 936
 937         ret = krb5_make_principal(context, &tgtname,
 938                                   client_realm,
 939                                   KRB5_TGS_NAME,
 940                                   client_realm,
 941                                   NULL);
 942         if(ret)
 943             return ret;
 944
 945         ret = find_cred(context, ccache, tgtname, *ret_tgts, &tgt);
 946         krb5_free_principal(context, tgtname);
 947         if (ret)
 948             return ret;
 949     }
 950
 951     referral = *in_creds;
 952     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
 953     if (ret) {
 954         krb5_free_cred_contents(context, &tgt);
 955         return ret;
 956     }
 957     ret = krb5_principal_set_realm(context, referral.server, client_realm);
 958     if (ret) {
 959         krb5_free_cred_contents(context, &tgt);
 960         krb5_free_principal(context, referral.server);
 961         return ret;
 962     }
 963
 964     while (loop++ < 17) {
 965         krb5_creds **tickets;
 966         krb5_creds mcreds;
 967         char *referral_realm;
 968
 969         /* Use cache if we are not doing impersonation or contrainte deleg */
 970         if (impersonate_principal == NULL || flags.b.constrained_delegation) {
 971             krb5_cc_clear_mcred(&mcreds);
 972             mcreds.server = referral.server;
 973             ret = krb5_cc_retrieve_cred(context, ccache, 0, &mcreds, &ticket);
 974         } else
 975             ret = EINVAL;
 976
 977         if (ret) {
 978             ret = get_cred_kdc_address(context, ccache, flags, NULL,
 979                                        &referral, &tgt, impersonate_principal,
 980                                        second_ticket, &ticket);
 981             if (ret)
 982                 goto out;
 983         }
 984
 985         /* Did we get the right ticket ? */
 986         if (krb5_principal_compare_any_realm(context,
 987                                              referral.server,
 988                                              ticket.server))
 989             break;
 990
 991         if (!krb5_principal_is_krbtgt(context, ticket.server)) {
 992             krb5_set_error_message(context, KRB5KRB_AP_ERR_NOT_US,
 993                                    N_("Got back an non krbtgt "
 994                                       "ticket referrals", ""));
 995             ret = KRB5KRB_AP_ERR_NOT_US;
 996             goto out;
 997         }
 998
 999         referral_realm = ticket.server->name.name_string.val[1];
1000
1001         /* check that there are no referrals loops */
1002         tickets = *ret_tgts;
1003
1004         krb5_cc_clear_mcred(&mcreds);
1005         mcreds.server = ticket.server;
1006
1007         while(tickets && *tickets){
1008             if(krb5_compare_creds(context,
1009                                   KRB5_TC_DONT_MATCH_REALM,
1010                                   &mcreds,
1011                                   *tickets))
1012             {
1013                 krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
1014                                        N_("Referral from %s "
1015                                           "loops back to realm %s", ""),
1016                                        tgt.server->realm,
1017                                        referral_realm);
1018                 ret = KRB5_GET_IN_TKT_LOOP;
1019                 goto out;
1020             }
1021             tickets++;
1022         }
1023
1024         /*
1025          * if either of the chain or the ok_as_delegate was stripped
1026          * by the kdc, make sure we strip it too.
1027          */
1028
1029         if (ok_as_delegate == 0 || ticket.flags.b.ok_as_delegate == 0) {
1030             ok_as_delegate = 0;
1031             ticket.flags.b.ok_as_delegate = 0;
1032         }
1033
1034         ret = add_cred(context, &ticket, ret_tgts);
1035         if (ret)
1036             goto out;
1037
1038         /* try realm in the referral */
1039         ret = krb5_principal_set_realm(context,
1040                                        referral.server,
1041                                        referral_realm);
1042         krb5_free_cred_contents(context, &tgt);
1043         tgt = ticket;
1044         memset(&ticket, 0, sizeof(ticket));
1045         if (ret)
1046             goto out;
1047     }
1048
1049     ret = krb5_copy_creds(context, &ticket, out_creds);
1050
1051 out:
1052     krb5_free_principal(context, referral.server);
1053     krb5_free_cred_contents(context, &tgt);
1054     krb5_free_cred_contents(context, &ticket);
1055     return ret;
1056 }
1057
1058
1059 /*
1060  * Glue function between referrals version and old client chasing
1061  * codebase.
1062  */
1063
1064 krb5_error_code
1065 _krb5_get_cred_kdc_any(krb5_context context,
1066                        krb5_kdc_flags flags,
1067                        krb5_ccache ccache,
1068                        krb5_creds *in_creds,
1069                        krb5_principal impersonate_principal,
1070                        Ticket *second_ticket,
1071                        krb5_creds **out_creds,
1072                        krb5_creds ***ret_tgts)
1073 {
1074     krb5_error_code ret;
1075     krb5_deltat offset;
1076
1077     ret = krb5_cc_get_kdc_offset(context, ccache, &offset);
1078     if (ret) {
1079         context->kdc_sec_offset = offset;
1080         context->kdc_usec_offset = 0;
1081     }
1082
1083     ret = get_cred_kdc_referral(context,
1084                                 flags,
1085                                 ccache,
1086                                 in_creds,
1087                                 impersonate_principal,
1088                                 second_ticket,
1089                                 out_creds,
1090                                 ret_tgts);
1091     if (ret == 0 || flags.b.canonicalize)
1092         return ret;
1093     return get_cred_kdc_capath(context,
1094                                 flags,
1095                                 ccache,
1096                                 in_creds,
1097                                 impersonate_principal,
1098                                 second_ticket,
1099                                 out_creds,
1100                                 ret_tgts);
1101 }
1102
1103
1104 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1105 krb5_get_credentials_with_flags(krb5_context context,
1106                                 krb5_flags options,
1107                                 krb5_kdc_flags flags,
1108                                 krb5_ccache ccache,
1109                                 krb5_creds *in_creds,
1110                                 krb5_creds **out_creds)
1111 {
1112     krb5_error_code ret;
1113     krb5_creds **tgts;
1114     krb5_creds *res_creds;
1115     int i;
1116
1117     if (in_creds->session.keytype) {
1118         ret = krb5_enctype_valid(context, in_creds->session.keytype);
1119         if (ret)
1120             return ret;
1121     }
1122
1123     *out_creds = NULL;
1124     res_creds = calloc(1, sizeof(*res_creds));
1125     if (res_creds == NULL) {
1126         krb5_set_error_message(context, ENOMEM,
1127                                N_("malloc: out of memory", ""));
1128         return ENOMEM;
1129     }
1130
1131     if (in_creds->session.keytype)
1132         options |= KRB5_TC_MATCH_KEYTYPE;
1133
1134     /*
1135      * If we got a credential, check if credential is expired before
1136      * returning it.
1137      */
1138     ret = krb5_cc_retrieve_cred(context,
1139                                 ccache,
1140                                 in_creds->session.keytype ?
1141                                 KRB5_TC_MATCH_KEYTYPE : 0,
1142                                 in_creds, res_creds);
1143     /*
1144      * If we got a credential, check if credential is expired before
1145      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1146      */
1147     if (ret == 0) {
1148         krb5_timestamp timeret;
1149
1150         /* If expired ok, don't bother checking */
1151         if(options & KRB5_GC_EXPIRED_OK) {
1152             *out_creds = res_creds;
1153             return 0;
1154         }
1155
1156         krb5_timeofday(context, &timeret);
1157         if(res_creds->times.endtime > timeret) {
1158             *out_creds = res_creds;
1159             return 0;
1160         }
1161         if(options & KRB5_GC_CACHED)
1162             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1163
1164     } else if(ret != KRB5_CC_END) {
1165         free(res_creds);
1166         return ret;
1167     }
1168     free(res_creds);
1169     if(options & KRB5_GC_CACHED)
1170         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
1171
1172     if(options & KRB5_GC_USER_USER)
1173         flags.b.enc_tkt_in_skey = 1;
1174     if (flags.b.enc_tkt_in_skey)
1175         options |= KRB5_GC_NO_STORE;
1176
1177     tgts = NULL;
1178     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1179                                  in_creds, NULL, NULL, out_creds, &tgts);
1180     for(i = 0; tgts && tgts[i]; i++) {
1181         krb5_cc_store_cred(context, ccache, tgts[i]);
1182         krb5_free_creds(context, tgts[i]);
1183     }
1184     free(tgts);
1185     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1186         krb5_cc_store_cred(context, ccache, *out_creds);
1187     return ret;
1188 }
1189
1190 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1191 krb5_get_credentials(krb5_context context,
1192                      krb5_flags options,
1193                      krb5_ccache ccache,
1194                      krb5_creds *in_creds,
1195                      krb5_creds **out_creds)
1196 {
1197     krb5_kdc_flags flags;
1198     flags.i = 0;
1199     return krb5_get_credentials_with_flags(context, options, flags,
1200                                            ccache, in_creds, out_creds);
1201 }
1202
1203 struct krb5_get_creds_opt_data {
1204     krb5_principal self;
1205     krb5_flags options;
1206     krb5_enctype enctype;
1207     Ticket *ticket;
1208 };
1209
1210
1211 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1212 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
1213 {
1214     *opt = calloc(1, sizeof(**opt));
1215     if (*opt == NULL) {
1216         krb5_set_error_message(context, ENOMEM,
1217                                N_("malloc: out of memory", ""));
1218         return ENOMEM;
1219     }
1220     return 0;
1221 }
1222
1223 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1224 krb5_get_creds_opt_free(krb5_context context, krb5_get_creds_opt opt)
1225 {
1226     if (opt->self)
1227         krb5_free_principal(context, opt->self);
1228     if (opt->ticket) {
1229         free_Ticket(opt->ticket);
1230         free(opt->ticket);
1231     }
1232     memset(opt, 0, sizeof(*opt));
1233     free(opt);
1234 }
1235
1236 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1237 krb5_get_creds_opt_set_options(krb5_context context,
1238                                krb5_get_creds_opt opt,
1239                                krb5_flags options)
1240 {
1241     opt->options = options;
1242 }
1243
1244 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1245 krb5_get_creds_opt_add_options(krb5_context context,
1246                                krb5_get_creds_opt opt,
1247                                krb5_flags options)
1248 {
1249     opt->options |= options;
1250 }
1251
1252 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
1253 krb5_get_creds_opt_set_enctype(krb5_context context,
1254                                krb5_get_creds_opt opt,
1255                                krb5_enctype enctype)
1256 {
1257     opt->enctype = enctype;
1258 }
1259
1260 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1261 krb5_get_creds_opt_set_impersonate(krb5_context context,
1262                                    krb5_get_creds_opt opt,
1263                                    krb5_const_principal self)
1264 {
1265     if (opt->self)
1266         krb5_free_principal(context, opt->self);
1267     return krb5_copy_principal(context, self, &opt->self);
1268 }
1269
1270 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1271 krb5_get_creds_opt_set_ticket(krb5_context context,
1272                               krb5_get_creds_opt opt,
1273                               const Ticket *ticket)
1274 {
1275     if (opt->ticket) {
1276         free_Ticket(opt->ticket);
1277         free(opt->ticket);
1278         opt->ticket = NULL;
1279     }
1280     if (ticket) {
1281         krb5_error_code ret;
1282
1283         opt->ticket = malloc(sizeof(*ticket));
1284         if (opt->ticket == NULL) {
1285             krb5_set_error_message(context, ENOMEM,
1286                                    N_("malloc: out of memory", ""));
1287             return ENOMEM;
1288         }
1289         ret = copy_Ticket(ticket, opt->ticket);
1290         if (ret) {
1291             free(opt->ticket);
1292             opt->ticket = NULL;
1293             krb5_set_error_message(context, ret,
1294                                    N_("malloc: out of memory", ""));
1295             return ret;
1296         }
1297     }
1298     return 0;
1299 }
1300
1301
1302
1303 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1304 krb5_get_creds(krb5_context context,
1305                krb5_get_creds_opt opt,
1306                krb5_ccache ccache,
1307                krb5_const_principal inprinc,
1308                krb5_creds **out_creds)
1309 {
1310     krb5_kdc_flags flags;
1311     krb5_flags options;
1312     krb5_creds in_creds;
1313     krb5_error_code ret;
1314     krb5_creds **tgts;
1315     krb5_creds *res_creds;
1316     int i;
1317
1318     if (opt && opt->enctype) {
1319         ret = krb5_enctype_valid(context, opt->enctype);
1320         if (ret)
1321             return ret;
1322     }
1323
1324     memset(&in_creds, 0, sizeof(in_creds));
1325     in_creds.server = rk_UNCONST(inprinc);
1326
1327     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
1328     if (ret)
1329         return ret;
1330
1331     if (opt)
1332         options = opt->options;
1333     else
1334         options = 0;
1335     flags.i = 0;
1336
1337     *out_creds = NULL;
1338     res_creds = calloc(1, sizeof(*res_creds));
1339     if (res_creds == NULL) {
1340         krb5_free_principal(context, in_creds.client);
1341         krb5_set_error_message(context, ENOMEM,
1342                                N_("malloc: out of memory", ""));
1343         return ENOMEM;
1344     }
1345
1346     if (opt && opt->enctype) {
1347         in_creds.session.keytype = opt->enctype;
1348         options |= KRB5_TC_MATCH_KEYTYPE;
1349     }
1350
1351     /*
1352      * If we got a credential, check if credential is expired before
1353      * returning it.
1354      */
1355     ret = krb5_cc_retrieve_cred(context,
1356                                 ccache,
1357                                 options & KRB5_TC_MATCH_KEYTYPE,
1358                                 &in_creds, res_creds);
1359     /*
1360      * If we got a credential, check if credential is expired before
1361      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1362      */
1363     if (ret == 0) {
1364         krb5_timestamp timeret;
1365
1366         /* If expired ok, don't bother checking */
1367         if(options & KRB5_GC_EXPIRED_OK) {
1368             *out_creds = res_creds;
1369             krb5_free_principal(context, in_creds.client);
1370             goto out;
1371         }
1372
1373         krb5_timeofday(context, &timeret);
1374         if(res_creds->times.endtime > timeret) {
1375             *out_creds = res_creds;
1376             krb5_free_principal(context, in_creds.client);
1377             goto out;
1378         }
1379         if(options & KRB5_GC_CACHED)
1380             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1381
1382     } else if(ret != KRB5_CC_END) {
1383         free(res_creds);
1384         krb5_free_principal(context, in_creds.client);
1385         goto out;
1386     }
1387     free(res_creds);
1388     if(options & KRB5_GC_CACHED) {
1389         krb5_free_principal(context, in_creds.client);
1390         ret = not_found(context, in_creds.server, KRB5_CC_NOTFOUND);
1391         goto out;
1392     }
1393     if(options & KRB5_GC_USER_USER) {
1394         flags.b.enc_tkt_in_skey = 1;
1395         options |= KRB5_GC_NO_STORE;
1396     }
1397     if (options & KRB5_GC_FORWARDABLE)
1398         flags.b.forwardable = 1;
1399     if (options & KRB5_GC_NO_TRANSIT_CHECK)
1400         flags.b.disable_transited_check = 1;
1401     if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
1402         flags.b.request_anonymous = 1; /* XXX ARGH confusion */
1403         flags.b.constrained_delegation = 1;
1404     }
1405     if (options & KRB5_GC_CANONICALIZE)
1406         flags.b.canonicalize = 1;
1407
1408     tgts = NULL;
1409     ret = _krb5_get_cred_kdc_any(context, flags, ccache,
1410                                  &in_creds, opt->self, opt->ticket,
1411                                  out_creds, &tgts);
1412     krb5_free_principal(context, in_creds.client);
1413     for(i = 0; tgts && tgts[i]; i++) {
1414         krb5_cc_store_cred(context, ccache, tgts[i]);
1415         krb5_free_creds(context, tgts[i]);
1416     }
1417     free(tgts);
1418     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1419         krb5_cc_store_cred(context, ccache, *out_creds);
1420
1421  out:
1422     _krb5_debug(context, 5, "krb5_get_creds: ret = %d", ret);
1423
1424     return ret;
1425 }
1426
1427 /*
1428  *
1429  */
1430
1431 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1432 krb5_get_renewed_creds(krb5_context context,
1433                        krb5_creds *creds,
1434                        krb5_const_principal client,
1435                        krb5_ccache ccache,
1436                        const char *in_tkt_service)
1437 {
1438     krb5_error_code ret;
1439     krb5_kdc_flags flags;
1440     krb5_creds in, *template, *out = NULL;
1441
1442     memset(&in, 0, sizeof(in));
1443     memset(creds, 0, sizeof(*creds));
1444
1445     ret = krb5_copy_principal(context, client, &in.client);
1446     if (ret)
1447         return ret;
1448
1449     if (in_tkt_service) {
1450         ret = krb5_parse_name(context, in_tkt_service, &in.server);
1451         if (ret) {
1452             krb5_free_principal(context, in.client);
1453             return ret;
1454         }
1455     } else {
1456         const char *realm = krb5_principal_get_realm(context, client);
1457
1458         ret = krb5_make_principal(context, &in.server, realm, KRB5_TGS_NAME,
1459                                   realm, NULL);
1460         if (ret) {
1461             krb5_free_principal(context, in.client);
1462             return ret;
1463         }
1464     }
1465
1466     flags.i = 0;
1467     flags.b.renewable = flags.b.renew = 1;
1468
1469     /*
1470      * Get template from old credential cache for the same entry, if
1471      * this failes, no worries.
1472      */
1473     ret = krb5_get_credentials(context, KRB5_GC_CACHED, ccache, &in, &template);
1474     if (ret == 0) {
1475         flags.b.forwardable = template->flags.b.forwardable;
1476         flags.b.proxiable = template->flags.b.proxiable;
1477         krb5_free_creds (context, template);
1478     }
1479
1480     ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out);
1481     krb5_free_principal(context, in.client);
1482     krb5_free_principal(context, in.server);
1483     if (ret)
1484         return ret;
1485
1486     ret = krb5_copy_creds_contents(context, out, creds);
1487     krb5_free_creds(context, out);
1488
1489     return ret;
1490 }