source4/auth/gensec/gensec_krb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Luke Howard 2002-2003
   9    Copyright (C) Stefan Metzmacher 2004-2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "system/kerberos.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "auth/auth.h"
  30 #include "lib/socket/socket.h"
  31 #include "lib/tsocket/tsocket.h"
  32 #include "librpc/rpc/dcerpc.h"
  33 #include "auth/credentials/credentials.h"
  34 #include "auth/credentials/credentials_krb5.h"
  35 #include "auth/kerberos/kerberos_credentials.h"
  36 #include "auth/gensec/gensec.h"
  37 #include "auth/gensec/gensec_proto.h"
  38 #include "param/param.h"
  39 #include "auth/auth_sam_reply.h"
  40 #include "lib/util/util_net.h"
  41
  42 enum GENSEC_KRB5_STATE {
  43         GENSEC_KRB5_SERVER_START,
  44         GENSEC_KRB5_CLIENT_START,
  45         GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
  46         GENSEC_KRB5_DONE
  47 };
  48
  49 struct gensec_krb5_state {
  50         DATA_BLOB session_key;
  51         DATA_BLOB pac;
  52         enum GENSEC_KRB5_STATE state_position;
  53         struct smb_krb5_context *smb_krb5_context;
  54         krb5_auth_context auth_context;
  55         krb5_data enc_ticket;
  56         krb5_keyblock *keyblock;
  57         krb5_ticket *ticket;
  58         bool gssapi;
  59         krb5_flags ap_req_options;
  60 };
  61
  62 static int gensec_krb5_destroy(struct gensec_krb5_state *gensec_krb5_state)
  63 {
  64         if (!gensec_krb5_state->smb_krb5_context) {
  65                 /* We can't clean anything else up unless we started up this far */
  66                 return 0;
  67         }
  68         if (gensec_krb5_state->enc_ticket.length) {
  69                 kerberos_free_data_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
  70                                             &gensec_krb5_state->enc_ticket);
  71         }
  72
  73         if (gensec_krb5_state->ticket) {
  74                 krb5_free_ticket(gensec_krb5_state->smb_krb5_context->krb5_context,
  75                                  gensec_krb5_state->ticket);
  76         }
  77
  78         /* ccache freed in a child destructor */
  79
  80         krb5_free_keyblock(gensec_krb5_state->smb_krb5_context->krb5_context,
  81                            gensec_krb5_state->keyblock);
  82
  83         if (gensec_krb5_state->auth_context) {
  84                 krb5_auth_con_free(gensec_krb5_state->smb_krb5_context->krb5_context,
  85                                    gensec_krb5_state->auth_context);
  86         }
  87
  88         return 0;
  89 }
  90
  91 static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security, bool gssapi)
  92 {
  93         krb5_error_code ret;
  94         struct gensec_krb5_state *gensec_krb5_state;
  95         struct cli_credentials *creds;
  96         const struct tsocket_address *tlocal_addr, *tremote_addr;
  97         krb5_address my_krb5_addr, peer_krb5_addr;
  98
  99         creds = gensec_get_credentials(gensec_security);
 100         if (!creds) {
 101                 return NT_STATUS_INVALID_PARAMETER;
 102         }
 103
 104         gensec_krb5_state = talloc(gensec_security, struct gensec_krb5_state);
 105         if (!gensec_krb5_state) {
 106                 return NT_STATUS_NO_MEMORY;
 107         }
 108
 109         gensec_security->private_data = gensec_krb5_state;
 110         gensec_krb5_state->smb_krb5_context = NULL;
 111         gensec_krb5_state->auth_context = NULL;
 112         gensec_krb5_state->ticket = NULL;
 113         ZERO_STRUCT(gensec_krb5_state->enc_ticket);
 114         gensec_krb5_state->keyblock = NULL;
 115         gensec_krb5_state->session_key = data_blob(NULL, 0);
 116         gensec_krb5_state->pac = data_blob(NULL, 0);
 117         gensec_krb5_state->gssapi = gssapi;
 118
 119         talloc_set_destructor(gensec_krb5_state, gensec_krb5_destroy);
 120
 121         if (cli_credentials_get_krb5_context(creds,
 122                                              gensec_security->settings->lp_ctx, &gensec_krb5_state->smb_krb5_context)) {
 123                 talloc_free(gensec_krb5_state);
 124                 return NT_STATUS_INTERNAL_ERROR;
 125         }
 126
 127         ret = krb5_auth_con_init(gensec_krb5_state->smb_krb5_context->krb5_context, &gensec_krb5_state->auth_context);
 128         if (ret) {
 129                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n",
 130                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 131                                                     ret, gensec_krb5_state)));
 132                 talloc_free(gensec_krb5_state);
 133                 return NT_STATUS_INTERNAL_ERROR;
 134         }
 135
 136         ret = krb5_auth_con_setflags(gensec_krb5_state->smb_krb5_context->krb5_context,
 137                                      gensec_krb5_state->auth_context,
 138                                      KRB5_AUTH_CONTEXT_DO_SEQUENCE);
 139         if (ret) {
 140                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setflags failed (%s)\n",
 141                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 142                                                     ret, gensec_krb5_state)));
 143                 talloc_free(gensec_krb5_state);
 144                 return NT_STATUS_INTERNAL_ERROR;
 145         }
 146
 147         tlocal_addr = gensec_get_local_address(gensec_security);
 148         if (tlocal_addr) {
 149                 ssize_t socklen;
 150                 struct sockaddr_storage ss;
 151
 152                 socklen = tsocket_address_bsd_sockaddr(tlocal_addr,
 153                                 (struct sockaddr *) &ss,
 154                                 sizeof(struct sockaddr_storage));
 155                 if (socklen < 0) {
 156                         return NT_STATUS_INTERNAL_ERROR;
 157                 }
 158                 ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
 159                                 (const struct sockaddr *) &ss, &my_krb5_addr);
 160                 if (ret) {
 161                         DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
 162                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 163                                                             ret, gensec_krb5_state)));
 164                         talloc_free(gensec_krb5_state);
 165                         return NT_STATUS_INTERNAL_ERROR;
 166                 }
 167         }
 168
 169         tremote_addr = gensec_get_remote_address(gensec_security);
 170         if (tremote_addr) {
 171                 ssize_t socklen;
 172                 struct sockaddr_storage ss;
 173
 174                 socklen = tsocket_address_bsd_sockaddr(tremote_addr,
 175                                 (struct sockaddr *) &ss,
 176                                 sizeof(struct sockaddr_storage));
 177                 if (socklen < 0) {
 178                         return NT_STATUS_INTERNAL_ERROR;
 179                 }
 180                 ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
 181                                 (const struct sockaddr *) &ss, &peer_krb5_addr);
 182                 if (ret) {
 183                         DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
 184                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 185                                                             ret, gensec_krb5_state)));
 186                         talloc_free(gensec_krb5_state);
 187                         return NT_STATUS_INTERNAL_ERROR;
 188                 }
 189         }
 190
 191         ret = krb5_auth_con_setaddrs(gensec_krb5_state->smb_krb5_context->krb5_context,
 192                                      gensec_krb5_state->auth_context,
 193                                      tlocal_addr ? &my_krb5_addr : NULL,
 194                                      tremote_addr ? &peer_krb5_addr : NULL);
 195         if (ret) {
 196                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setaddrs failed (%s)\n",
 197                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 198                                                     ret, gensec_krb5_state)));
 199                 talloc_free(gensec_krb5_state);
 200                 return NT_STATUS_INTERNAL_ERROR;
 201         }
 202
 203         return NT_STATUS_OK;
 204 }
 205
 206 static NTSTATUS gensec_krb5_common_server_start(struct gensec_security *gensec_security, bool gssapi)
 207 {
 208         NTSTATUS nt_status;
 209         struct gensec_krb5_state *gensec_krb5_state;
 210
 211         nt_status = gensec_krb5_start(gensec_security, gssapi);
 212         if (!NT_STATUS_IS_OK(nt_status)) {
 213                 return nt_status;
 214         }
 215
 216         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 217         gensec_krb5_state->state_position = GENSEC_KRB5_SERVER_START;
 218
 219         return NT_STATUS_OK;
 220 }
 221
 222 static NTSTATUS gensec_krb5_server_start(struct gensec_security *gensec_security)
 223 {
 224         return gensec_krb5_common_server_start(gensec_security, false);
 225 }
 226
 227 static NTSTATUS gensec_fake_gssapi_krb5_server_start(struct gensec_security *gensec_security)
 228 {
 229         return gensec_krb5_common_server_start(gensec_security, true);
 230 }
 231
 232 static NTSTATUS gensec_krb5_common_client_start(struct gensec_security *gensec_security, bool gssapi)
 233 {
 234         struct gensec_krb5_state *gensec_krb5_state;
 235         krb5_error_code ret;
 236         NTSTATUS nt_status;
 237         struct ccache_container *ccache_container;
 238         const char *hostname;
 239         const char *error_string;
 240         const char *principal;
 241         krb5_data in_data;
 242         struct tevent_context *previous_ev;
 243
 244         hostname = gensec_get_target_hostname(gensec_security);
 245         if (!hostname) {
 246                 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
 247                 return NT_STATUS_INVALID_PARAMETER;
 248         }
 249         if (is_ipaddress(hostname)) {
 250                 DEBUG(2, ("Cannot do krb5 to an IP address"));
 251                 return NT_STATUS_INVALID_PARAMETER;
 252         }
 253         if (strcmp(hostname, "localhost") == 0) {
 254                 DEBUG(2, ("krb5 to 'localhost' does not make sense"));
 255                 return NT_STATUS_INVALID_PARAMETER;
 256         }
 257
 258         nt_status = gensec_krb5_start(gensec_security, gssapi);
 259         if (!NT_STATUS_IS_OK(nt_status)) {
 260                 return nt_status;
 261         }
 262
 263         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 264         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_START;
 265         gensec_krb5_state->ap_req_options = AP_OPTS_USE_SUBKEY;
 266
 267         if (gensec_krb5_state->gssapi) {
 268                 /* The Fake GSSAPI modal emulates Samba3, which does not do mutual authentication */
 269                 if (gensec_setting_bool(gensec_security->settings, "gensec_fake_gssapi_krb5", "mutual", false)) {
 270                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 271                 }
 272         } else {
 273                 /* The wrapping for KPASSWD (a user of the raw KRB5 API) should be mutually authenticated */
 274                 if (gensec_setting_bool(gensec_security->settings, "gensec_krb5", "mutual", true)) {
 275                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 276                 }
 277         }
 278
 279         principal = gensec_get_target_principal(gensec_security);
 280
 281         ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security),
 282                                          gensec_security->event_ctx,
 283                                          gensec_security->settings->lp_ctx, &ccache_container, &error_string);
 284         switch (ret) {
 285         case 0:
 286                 break;
 287         case KRB5KDC_ERR_PREAUTH_FAILED:
 288         case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
 289                 return NT_STATUS_LOGON_FAILURE;
 290         case KRB5_KDC_UNREACH:
 291                 DEBUG(3, ("Cannot reach a KDC we require to contact %s: %s\n", principal, error_string));
 292                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 293         case KRB5_CC_NOTFOUND:
 294         case KRB5_CC_END:
 295                 DEBUG(3, ("Error preparing credentials we require to contact %s : %s\n", principal, error_string));
 296                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 297         default:
 298                 DEBUG(1, ("gensec_krb5_start: Aquiring initiator credentials failed: %s\n", error_string));
 299                 return NT_STATUS_UNSUCCESSFUL;
 300         }
 301         in_data.length = 0;
 302
 303         /* Do this every time, in case we have weird recursive issues here */
 304         ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, gensec_security->event_ctx, &previous_ev);
 305         if (ret != 0) {
 306                 DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
 307                 return NT_STATUS_NO_MEMORY;
 308         }
 309         if (principal) {
 310                 krb5_principal target_principal;
 311                 ret = krb5_parse_name(gensec_krb5_state->smb_krb5_context->krb5_context, principal,
 312                                       &target_principal);
 313                 if (ret == 0) {
 314                         ret = krb5_mk_req_exact(gensec_krb5_state->smb_krb5_context->krb5_context,
 315                                                 &gensec_krb5_state->auth_context,
 316                                                 gensec_krb5_state->ap_req_options,
 317                                                 target_principal,
 318                                                 &in_data, ccache_container->ccache,
 319                                                 &gensec_krb5_state->enc_ticket);
 320                         krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 321                                             target_principal);
 322                 }
 323         } else {
 324                 ret = krb5_mk_req(gensec_krb5_state->smb_krb5_context->krb5_context,
 325                                   &gensec_krb5_state->auth_context,
 326                                   gensec_krb5_state->ap_req_options,
 327                                   gensec_get_target_service(gensec_security),
 328                                   hostname,
 329                                   &in_data, ccache_container->ccache,
 330                                   &gensec_krb5_state->enc_ticket);
 331         }
 332
 333         smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, gensec_security->event_ctx);
 334
 335         switch (ret) {
 336         case 0:
 337                 return NT_STATUS_OK;
 338         case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 339                 DEBUG(3, ("Server [%s] is not registered with our KDC: %s\n",
 340                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 341                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 342         case KRB5_KDC_UNREACH:
 343                 DEBUG(3, ("Cannot reach a KDC we require to contact host [%s]: %s\n",
 344                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 345                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 346         case KRB5KDC_ERR_PREAUTH_FAILED:
 347         case KRB5KRB_AP_ERR_TKT_EXPIRED:
 348         case KRB5_CC_END:
 349                 /* Too much clock skew - we will need to kinit to re-skew the clock */
 350         case KRB5KRB_AP_ERR_SKEW:
 351         case KRB5_KDCREP_SKEW:
 352         {
 353                 DEBUG(3, ("kerberos (mk_req) failed: %s\n",
 354                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 355                 /*fall through*/
 356         }
 357
 358         /* just don't print a message for these really ordinary messages */
 359         case KRB5_FCC_NOFILE:
 360         case KRB5_CC_NOTFOUND:
 361         case ENOENT:
 362
 363                 return NT_STATUS_UNSUCCESSFUL;
 364                 break;
 365
 366         default:
 367                 DEBUG(0, ("kerberos: %s\n",
 368                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 369                 return NT_STATUS_UNSUCCESSFUL;
 370         }
 371 }
 372
 373 static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security)
 374 {
 375         return gensec_krb5_common_client_start(gensec_security, false);
 376 }
 377
 378 static NTSTATUS gensec_fake_gssapi_krb5_client_start(struct gensec_security *gensec_security)
 379 {
 380         return gensec_krb5_common_client_start(gensec_security, true);
 381 }
 382
 383 /**
 384  * Check if the packet is one for this mechansim
 385  *
 386  * @param gensec_security GENSEC state
 387  * @param in The request, as a DATA_BLOB
 388  * @return Error, INVALID_PARAMETER if it's not a packet for us
 389  *                or NT_STATUS_OK if the packet is ok.
 390  */
 391
 392 static NTSTATUS gensec_fake_gssapi_krb5_magic(struct gensec_security *gensec_security,
 393                                   const DATA_BLOB *in)
 394 {
 395         if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
 396                 return NT_STATUS_OK;
 397         } else {
 398                 return NT_STATUS_INVALID_PARAMETER;
 399         }
 400 }
 401
 402
 403 /**
 404  * Next state function for the Krb5 GENSEC mechanism
 405  *
 406  * @param gensec_krb5_state KRB5 State
 407  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 408  * @param in The request, as a DATA_BLOB
 409  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 410  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 411  *                or NT_STATUS_OK if the user is authenticated.
 412  */
 413
 414 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
 415                                    TALLOC_CTX *out_mem_ctx,
 416                                    const DATA_BLOB in, DATA_BLOB *out)
 417 {
 418         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 419         krb5_error_code ret = 0;
 420         NTSTATUS nt_status;
 421
 422         switch (gensec_krb5_state->state_position) {
 423         case GENSEC_KRB5_CLIENT_START:
 424         {
 425                 DATA_BLOB unwrapped_out;
 426
 427                 if (gensec_krb5_state->gssapi) {
 428                         unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 429
 430                         /* wrap that up in a nice GSS-API wrapping */
 431                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REQ);
 432                 } else {
 433                         *out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 434                 }
 435                 if (gensec_krb5_state->ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
 436                         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_MUTUAL_AUTH;
 437                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 438                 } else {
 439                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 440                         nt_status = NT_STATUS_OK;
 441                 }
 442                 return nt_status;
 443         }
 444
 445         case GENSEC_KRB5_CLIENT_MUTUAL_AUTH:
 446         {
 447                 DATA_BLOB unwrapped_in;
 448                 krb5_data inbuf;
 449                 krb5_ap_rep_enc_part *repl = NULL;
 450                 uint8_t tok_id[2];
 451
 452                 if (gensec_krb5_state->gssapi) {
 453                         if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 454                                 DEBUG(1,("gensec_gssapi_parse_krb5_wrap(mutual authentication) failed to parse\n"));
 455                                 dump_data_pw("Mutual authentication message:\n", in.data, in.length);
 456                                 return NT_STATUS_INVALID_PARAMETER;
 457                         }
 458                 } else {
 459                         unwrapped_in = in;
 460                 }
 461                 /* TODO: check the tok_id */
 462
 463                 inbuf.data = unwrapped_in.data;
 464                 inbuf.length = unwrapped_in.length;
 465                 ret = krb5_rd_rep(gensec_krb5_state->smb_krb5_context->krb5_context,
 466                                   gensec_krb5_state->auth_context,
 467                                   &inbuf, &repl);
 468                 if (ret) {
 469                         DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
 470                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, out_mem_ctx)));
 471                         dump_data_pw("Mutual authentication message:\n", (uint8_t *)inbuf.data, inbuf.length);
 472                         nt_status = NT_STATUS_ACCESS_DENIED;
 473                 } else {
 474                         *out = data_blob(NULL, 0);
 475                         nt_status = NT_STATUS_OK;
 476                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 477                 }
 478                 if (repl) {
 479                         krb5_free_ap_rep_enc_part(gensec_krb5_state->smb_krb5_context->krb5_context, repl);
 480                 }
 481                 return nt_status;
 482         }
 483
 484         case GENSEC_KRB5_SERVER_START:
 485         {
 486                 DATA_BLOB unwrapped_in;
 487                 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
 488                 krb5_data inbuf, outbuf;
 489                 uint8_t tok_id[2];
 490                 struct keytab_container *keytab;
 491                 krb5_principal server_in_keytab;
 492                 const char *error_string;
 493                 enum credentials_obtained obtained;
 494
 495                 if (!in.data) {
 496                         return NT_STATUS_INVALID_PARAMETER;
 497                 }
 498
 499                 /* Grab the keytab, however generated */
 500                 ret = cli_credentials_get_keytab(gensec_get_credentials(gensec_security),
 501                                                  gensec_security->settings->lp_ctx, &keytab);
 502                 if (ret) {
 503                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 504                 }
 505
 506                 /* This ensures we lookup the correct entry in that keytab */
 507                 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security),
 508                                                  gensec_krb5_state->smb_krb5_context,
 509                                                  &server_in_keytab, &obtained, &error_string);
 510
 511                 if (ret) {
 512                         DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
 513                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 514                 }
 515
 516                 /* Parse the GSSAPI wrapping, if it's there... (win2k3 allows it to be omited) */
 517                 if (gensec_krb5_state->gssapi
 518                     && gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 519                         inbuf.data = unwrapped_in.data;
 520                         inbuf.length = unwrapped_in.length;
 521                 } else {
 522                         inbuf.data = in.data;
 523                         inbuf.length = in.length;
 524                 }
 525
 526                 ret = smb_rd_req_return_stuff(gensec_krb5_state->smb_krb5_context->krb5_context,
 527                                               &gensec_krb5_state->auth_context,
 528                                               &inbuf, keytab->keytab, server_in_keytab,
 529                                               &outbuf,
 530                                               &gensec_krb5_state->ticket,
 531                                               &gensec_krb5_state->keyblock);
 532
 533                 if (ret) {
 534                         return NT_STATUS_LOGON_FAILURE;
 535                 }
 536                 unwrapped_out.data = (uint8_t *)outbuf.data;
 537                 unwrapped_out.length = outbuf.length;
 538                 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 539                 /* wrap that up in a nice GSS-API wrapping */
 540                 if (gensec_krb5_state->gssapi) {
 541                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REP);
 542                 } else {
 543                         *out = data_blob_talloc(out_mem_ctx, outbuf.data, outbuf.length);
 544                 }
 545                 krb5_data_free(&outbuf);
 546                 return NT_STATUS_OK;
 547         }
 548
 549         case GENSEC_KRB5_DONE:
 550         default:
 551                 /* Asking too many times... */
 552                 return NT_STATUS_INVALID_PARAMETER;
 553         }
 554 }
 555
 556 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security,
 557                                         DATA_BLOB *session_key)
 558 {
 559         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 560         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 561         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 562         krb5_keyblock *skey;
 563         krb5_error_code err = -1;
 564
 565         if (gensec_krb5_state->state_position != GENSEC_KRB5_DONE) {
 566                 return NT_STATUS_NO_USER_SESSION_KEY;
 567         }
 568
 569         if (gensec_krb5_state->session_key.data) {
 570                 *session_key = gensec_krb5_state->session_key;
 571                 return NT_STATUS_OK;
 572         }
 573
 574         switch (gensec_security->gensec_role) {
 575         case GENSEC_CLIENT:
 576                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 577                 break;
 578         case GENSEC_SERVER:
 579                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 580                 break;
 581         }
 582         if (err == 0 && skey != NULL) {
 583                 DEBUG(10, ("Got KRB5 session key of length %d\n",
 584                            (int)KRB5_KEY_LENGTH(skey)));
 585                 gensec_krb5_state->session_key = data_blob_talloc(gensec_krb5_state,
 586                                                 KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 587                 *session_key = gensec_krb5_state->session_key;
 588                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 589
 590                 krb5_free_keyblock(context, skey);
 591                 return NT_STATUS_OK;
 592         } else {
 593                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 594                 return NT_STATUS_NO_USER_SESSION_KEY;
 595         }
 596 }
 597
 598 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
 599                                          struct auth_session_info **_session_info)
 600 {
 601         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 602         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 603         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 604         struct auth_serversupplied_info *server_info = NULL;
 605         struct auth_session_info *session_info = NULL;
 606         struct PAC_LOGON_INFO *logon_info;
 607
 608         krb5_principal client_principal;
 609         char *principal_string;
 610
 611         DATA_BLOB pac;
 612         krb5_data pac_data;
 613
 614         krb5_error_code ret;
 615
 616         TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
 617         if (!mem_ctx) {
 618                 return NT_STATUS_NO_MEMORY;
 619         }
 620
 621         ret = krb5_ticket_get_client(context, gensec_krb5_state->ticket, &client_principal);
 622         if (ret) {
 623                 DEBUG(5, ("krb5_ticket_get_client failed to get cleint principal: %s\n",
 624                           smb_get_krb5_error_message(context,
 625                                                      ret, mem_ctx)));
 626                 talloc_free(mem_ctx);
 627                 return NT_STATUS_NO_MEMORY;
 628         }
 629
 630         ret = krb5_unparse_name(gensec_krb5_state->smb_krb5_context->krb5_context,
 631                                 client_principal, &principal_string);
 632         if (ret) {
 633                 DEBUG(1, ("Unable to parse client principal: %s\n",
 634                           smb_get_krb5_error_message(context,
 635                                                      ret, mem_ctx)));
 636                 talloc_free(mem_ctx);
 637                 return NT_STATUS_NO_MEMORY;
 638         }
 639
 640         ret = krb5_ticket_get_authorization_data_type(context, gensec_krb5_state->ticket,
 641                                                       KRB5_AUTHDATA_WIN2K_PAC,
 642                                                       &pac_data);
 643
 644         if (ret && gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
 645                 DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access: %s \n",
 646                           principal_string,
 647                           smb_get_krb5_error_message(context,
 648                                                      ret, mem_ctx)));
 649                 krb5_free_principal(context, client_principal);
 650                 free(principal_string);
 651                 return NT_STATUS_ACCESS_DENIED;
 652         } else if (ret) {
 653                 /* NO pac */
 654                 DEBUG(5, ("krb5_ticket_get_authorization_data_type failed to find PAC: %s\n",
 655                           smb_get_krb5_error_message(context,
 656                                                      ret, mem_ctx)));
 657                 if (gensec_security->auth_context &&
 658                     !gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
 659                         DEBUG(1, ("Unable to find PAC for %s, resorting to local user lookup: %s",
 660                                   principal_string, smb_get_krb5_error_message(context,
 661                                                      ret, mem_ctx)));
 662                         nt_status = gensec_security->auth_context->get_server_info_principal(mem_ctx,
 663                                                                                              gensec_security->auth_context,
 664                                                                                              principal_string,
 665                                                                                              NULL, &server_info);
 666                         if (!NT_STATUS_IS_OK(nt_status)) {
 667                                 talloc_free(mem_ctx);
 668                                 return nt_status;
 669                         }
 670                 } else {
 671                         DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access\n",
 672                                   principal_string));
 673                         free(principal_string);
 674                         krb5_free_principal(context, client_principal);
 675                         talloc_free(mem_ctx);
 676                         return NT_STATUS_ACCESS_DENIED;
 677                 }
 678         } else {
 679                 /* Found pac */
 680                 union netr_Validation validation;
 681                 free(principal_string);
 682
 683                 pac = data_blob_talloc(mem_ctx, pac_data.data, pac_data.length);
 684                 if (!pac.data) {
 685                         krb5_free_principal(context, client_principal);
 686                         talloc_free(mem_ctx);
 687                         return NT_STATUS_NO_MEMORY;
 688                 }
 689
 690                 /* decode and verify the pac */
 691                 nt_status = kerberos_pac_logon_info(gensec_krb5_state,
 692                                                     &logon_info, pac,
 693                                                     gensec_krb5_state->smb_krb5_context->krb5_context,
 694                                                     NULL, gensec_krb5_state->keyblock,
 695                                                     client_principal,
 696                                                     gensec_krb5_state->ticket->ticket.authtime, NULL);
 697                 krb5_free_principal(context, client_principal);
 698
 699                 if (!NT_STATUS_IS_OK(nt_status)) {
 700                         talloc_free(mem_ctx);
 701                         return nt_status;
 702                 }
 703
 704                 validation.sam3 = &logon_info->info3;
 705                 nt_status = make_server_info_netlogon_validation(mem_ctx,
 706                                                                  NULL,
 707                                                                  3, &validation,
 708                                                                  &server_info);
 709                 if (!NT_STATUS_IS_OK(nt_status)) {
 710                         talloc_free(mem_ctx);
 711                         return nt_status;
 712                 }
 713         }
 714
 715         /* references the server_info into the session_info */
 716         nt_status = gensec_generate_session_info(mem_ctx, gensec_security, server_info, &session_info);
 717
 718         if (!NT_STATUS_IS_OK(nt_status)) {
 719                 talloc_free(mem_ctx);
 720                 return nt_status;
 721         }
 722
 723         nt_status = gensec_krb5_session_key(gensec_security, &session_info->session_key);
 724
 725         if (!NT_STATUS_IS_OK(nt_status)) {
 726                 talloc_free(mem_ctx);
 727                 return nt_status;
 728         }
 729
 730         *_session_info = session_info;
 731
 732         talloc_steal(gensec_krb5_state, session_info);
 733         talloc_free(mem_ctx);
 734         return NT_STATUS_OK;
 735 }
 736
 737 static NTSTATUS gensec_krb5_wrap(struct gensec_security *gensec_security,
 738                                    TALLOC_CTX *mem_ctx,
 739                                    const DATA_BLOB *in,
 740                                    DATA_BLOB *out)
 741 {
 742         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 743         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 744         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 745         krb5_error_code ret;
 746         krb5_data input, output;
 747         input.length = in->length;
 748         input.data = in->data;
 749
 750         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 751                 ret = krb5_mk_priv(context, auth_context, &input, &output, NULL);
 752                 if (ret) {
 753                         DEBUG(1, ("krb5_mk_priv failed: %s\n",
 754                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 755                                                              ret, mem_ctx)));
 756                         return NT_STATUS_ACCESS_DENIED;
 757                 }
 758                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
 759
 760                 krb5_data_free(&output);
 761         } else {
 762                 return NT_STATUS_ACCESS_DENIED;
 763         }
 764         return NT_STATUS_OK;
 765 }
 766
 767 static NTSTATUS gensec_krb5_unwrap(struct gensec_security *gensec_security,
 768                                      TALLOC_CTX *mem_ctx,
 769                                      const DATA_BLOB *in,
 770                                      DATA_BLOB *out)
 771 {
 772         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 773         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 774         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 775         krb5_error_code ret;
 776         krb5_data input, output;
 777         krb5_replay_data replay;
 778         input.length = in->length;
 779         input.data = in->data;
 780
 781         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 782                 ret = krb5_rd_priv(context, auth_context, &input, &output, &replay);
 783                 if (ret) {
 784                         DEBUG(1, ("krb5_rd_priv failed: %s\n",
 785                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 786                                                              ret, mem_ctx)));
 787                         return NT_STATUS_ACCESS_DENIED;
 788                 }
 789                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
 790
 791                 krb5_data_free(&output);
 792         } else {
 793                 return NT_STATUS_ACCESS_DENIED;
 794         }
 795         return NT_STATUS_OK;
 796 }
 797
 798 static bool gensec_krb5_have_feature(struct gensec_security *gensec_security,
 799                                      uint32_t feature)
 800 {
 801         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 802         if (feature & GENSEC_FEATURE_SESSION_KEY) {
 803                 return true;
 804         }
 805         if (!gensec_krb5_state->gssapi &&
 806             (feature & GENSEC_FEATURE_SEAL)) {
 807                 return true;
 808         }
 809
 810         return false;
 811 }
 812
 813 static const char *gensec_krb5_oids[] = {
 814         GENSEC_OID_KERBEROS5,
 815         GENSEC_OID_KERBEROS5_OLD,
 816         NULL
 817 };
 818
 819 static const struct gensec_security_ops gensec_fake_gssapi_krb5_security_ops = {
 820         .name           = "fake_gssapi_krb5",
 821         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
 822         .oid            = gensec_krb5_oids,
 823         .client_start   = gensec_fake_gssapi_krb5_client_start,
 824         .server_start   = gensec_fake_gssapi_krb5_server_start,
 825         .update         = gensec_krb5_update,
 826         .magic          = gensec_fake_gssapi_krb5_magic,
 827         .session_key    = gensec_krb5_session_key,
 828         .session_info   = gensec_krb5_session_info,
 829         .have_feature   = gensec_krb5_have_feature,
 830         .enabled        = false,
 831         .kerberos       = true,
 832         .priority       = GENSEC_KRB5
 833 };
 834
 835 static const struct gensec_security_ops gensec_krb5_security_ops = {
 836         .name           = "krb5",
 837         .client_start   = gensec_krb5_client_start,
 838         .server_start   = gensec_krb5_server_start,
 839         .update         = gensec_krb5_update,
 840         .session_key    = gensec_krb5_session_key,
 841         .session_info   = gensec_krb5_session_info,
 842         .have_feature   = gensec_krb5_have_feature,
 843         .wrap           = gensec_krb5_wrap,
 844         .unwrap         = gensec_krb5_unwrap,
 845         .enabled        = true,
 846         .kerberos       = true,
 847         .priority       = GENSEC_KRB5
 848 };
 849
 850 _PUBLIC_ NTSTATUS gensec_krb5_init(void)
 851 {
 852         NTSTATUS ret;
 853
 854         ret = gensec_register(&gensec_krb5_security_ops);
 855         if (!NT_STATUS_IS_OK(ret)) {
 856                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 857                         gensec_krb5_security_ops.name));
 858                 return ret;
 859         }
 860
 861         ret = gensec_register(&gensec_fake_gssapi_krb5_security_ops);
 862         if (!NT_STATUS_IS_OK(ret)) {
 863                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 864                         gensec_krb5_security_ops.name));
 865                 return ret;
 866         }
 867
 868         return ret;
 869 }