libcli/auth/krb5_wrap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2011
   7    Copyright (C) Guenther Deschner 2005-2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #ifdef HAVE_KRB5
  25
  26 #include "libcli/auth/krb5_wrap.h"
  27 #include "librpc/gen_ndr/krb5pac.h"
  28
  29 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
  30 int create_kerberos_key_from_string_direct(krb5_context context,
  31                                                   krb5_principal host_princ,
  32                                                   krb5_data *password,
  33                                                   krb5_keyblock *key,
  34                                                   krb5_enctype enctype)
  35 {
  36         int ret = 0;
  37         krb5_data salt;
  38         krb5_encrypt_block eblock;
  39
  40         ret = krb5_principal2salt(context, host_princ, &salt);
  41         if (ret) {
  42                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
  43                 return ret;
  44         }
  45         krb5_use_enctype(context, &eblock, enctype);
  46         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
  47         SAFE_FREE(salt.data);
  48
  49         return ret;
  50 }
  51 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
  52 int create_kerberos_key_from_string_direct(krb5_context context,
  53                                                   krb5_principal host_princ,
  54                                                   krb5_data *password,
  55                                                   krb5_keyblock *key,
  56                                                   krb5_enctype enctype)
  57 {
  58         int ret;
  59         krb5_salt salt;
  60
  61         ret = krb5_get_pw_salt(context, host_princ, &salt);
  62         if (ret) {
  63                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
  64                 return ret;
  65         }
  66
  67         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
  68         krb5_free_salt(context, salt);
  69
  70         return ret;
  71 }
  72 #else
  73 #error UNKNOWN_CREATE_KEY_FUNCTIONS
  74 #endif
  75
  76  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
  77 {
  78 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
  79         if (pdata->data) {
  80                 krb5_free_data_contents(context, pdata);
  81         }
  82 #elif defined(HAVE_KRB5_DATA_FREE)
  83         krb5_data_free(context, pdata);
  84 #else
  85         SAFE_FREE(pdata->data);
  86 #endif
  87 }
  88
  89
  90  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
  91 {
  92 /* Try krb5_free_keytab_entry_contents first, since
  93  * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
  94  * krb5_kt_free_entry but only has a prototype for the first, while the
  95  * second is considered private.
  96  */
  97 #if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
  98         return krb5_free_keytab_entry_contents(context, kt_entry);
  99 #elif defined(HAVE_KRB5_KT_FREE_ENTRY)
 100         return krb5_kt_free_entry(context, kt_entry);
 101 #else
 102 #error UNKNOWN_KT_FREE_FUNCTION
 103 #endif
 104 }
 105
 106 /**************************************************************
 107  Wrappers around kerberos string functions that convert from
 108  utf8 -> unix charset and vica versa.
 109 **************************************************************/
 110
 111 /**************************************************************
 112  krb5_parse_name that takes a UNIX charset.
 113 **************************************************************/
 114
 115  krb5_error_code smb_krb5_parse_name(krb5_context context,
 116                                 const char *name, /* in unix charset */
 117                                 krb5_principal *principal)
 118 {
 119         krb5_error_code ret;
 120         char *utf8_name;
 121         size_t converted_size;
 122
 123         if (!push_utf8_talloc(talloc_tos(), &utf8_name, name, &converted_size)) {
 124                 return ENOMEM;
 125         }
 126
 127         ret = krb5_parse_name(context, utf8_name, principal);
 128         TALLOC_FREE(utf8_name);
 129         return ret;
 130 }
 131
 132 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 133 static void krb5_free_unparsed_name(krb5_context context, char *val)
 134 {
 135         SAFE_FREE(val);
 136 }
 137 #endif
 138
 139 /**************************************************************
 140  krb5_parse_name that returns a UNIX charset name. Must
 141  be freed with talloc_free() call.
 142 **************************************************************/
 143
 144 krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
 145                                       krb5_context context,
 146                                       krb5_const_principal principal,
 147                                       char **unix_name)
 148 {
 149         krb5_error_code ret;
 150         char *utf8_name;
 151         size_t converted_size;
 152
 153         *unix_name = NULL;
 154         ret = krb5_unparse_name(context, principal, &utf8_name);
 155         if (ret) {
 156                 return ret;
 157         }
 158
 159         if (!pull_utf8_talloc(mem_ctx, unix_name, utf8_name, &converted_size)) {
 160                 krb5_free_unparsed_name(context, utf8_name);
 161                 return ENOMEM;
 162         }
 163         krb5_free_unparsed_name(context, utf8_name);
 164         return 0;
 165 }
 166
 167  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
 168                                             const char *name,
 169                                             krb5_principal *principal)
 170 {
 171 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
 172         return smb_krb5_parse_name_norealm_conv(context, name, principal);
 173 #endif
 174
 175         /* we are cheating here because parse_name will in fact set the realm.
 176          * We don't care as the only caller of smb_krb5_parse_name_norealm
 177          * ignores the realm anyway when calling
 178          * smb_krb5_principal_compare_any_realm later - Guenther */
 179
 180         return smb_krb5_parse_name(context, name, principal);
 181 }
 182
 183  bool smb_krb5_principal_compare_any_realm(krb5_context context,
 184                                           krb5_const_principal princ1,
 185                                           krb5_const_principal princ2)
 186 {
 187 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
 188
 189         return krb5_principal_compare_any_realm(context, princ1, princ2);
 190
 191 /* krb5_princ_size is a macro in MIT */
 192 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
 193
 194         int i, len1, len2;
 195         const krb5_data *p1, *p2;
 196
 197         len1 = krb5_princ_size(context, princ1);
 198         len2 = krb5_princ_size(context, princ2);
 199
 200         if (len1 != len2)
 201                 return False;
 202
 203         for (i = 0; i < len1; i++) {
 204
 205                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
 206                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
 207
 208                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
 209                         return False;
 210         }
 211
 212         return True;
 213 #else
 214 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
 215 #endif
 216 }
 217
 218  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 219                                      struct PAC_SIGNATURE_DATA *sig)
 220 {
 221 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 222         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 223         cksum->checksum.length  = sig->signature.length;
 224         cksum->checksum.data    = sig->signature.data;
 225 #else
 226         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 227         cksum->length           = sig->signature.length;
 228         cksum->contents         = sig->signature.data;
 229 #endif
 230 }
 231
 232  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 233                                           const krb5_keyblock *keyblock,
 234                                          krb5_keyusage usage,
 235                                          krb5_checksum *cksum,
 236                                          uint8_t *data,
 237                                          size_t length)
 238 {
 239         krb5_error_code ret;
 240
 241         /* verify the checksum */
 242
 243         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 244          *
 245          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 246          * -----------------------------------------------------------------------------
 247          * krb5_c_verify_checksum       -                       works           works
 248          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 249          */
 250
 251 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 252         {
 253                 krb5_boolean checksum_valid = false;
 254                 krb5_data input;
 255
 256                 input.data = (char *)data;
 257                 input.length = length;
 258
 259                 ret = krb5_c_verify_checksum(context,
 260                                              keyblock,
 261                                              usage,
 262                                              &input,
 263                                              cksum,
 264                                              &checksum_valid);
 265                 if (ret) {
 266                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 267                                 error_message(ret)));
 268                         return ret;
 269                 }
 270
 271                 if (!checksum_valid)
 272                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 273         }
 274
 275 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 276
 277         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 278          * without enctype and it ignores any key_usage types - Guenther */
 279
 280         {
 281
 282                 krb5_crypto crypto;
 283                 ret = krb5_crypto_init(context,
 284                                        keyblock,
 285                                        0,
 286                                        &crypto);
 287                 if (ret) {
 288                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 289                                 error_message(ret)));
 290                         return ret;
 291                 }
 292
 293                 ret = krb5_verify_checksum(context,
 294                                            crypto,
 295                                            usage,
 296                                            data,
 297                                            length,
 298                                            cksum);
 299
 300                 krb5_crypto_destroy(context, crypto);
 301         }
 302
 303 #else
 304 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
 305 #endif
 306
 307         return ret;
 308 }
 309
 310  char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx)
 311 {
 312         char *ret;
 313
 314 #if defined(HAVE_KRB5_GET_ERROR_MESSAGE) && defined(HAVE_KRB5_FREE_ERROR_MESSAGE)
 315         const char *context_error = krb5_get_error_message(context, code);
 316         if (context_error) {
 317                 ret = talloc_asprintf(mem_ctx, "%s: %s", error_message(code), context_error);
 318                 krb5_free_error_message(context, context_error);
 319                 return ret;
 320         }
 321 #endif
 322         ret = talloc_strdup(mem_ctx, error_message(code));
 323         return ret;
 324 }
 325
 326 #endif