source4/auth/gensec/gensec_krb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Luke Howard 2002-2003
   9    Copyright (C) Stefan Metzmacher 2004-2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "system/kerberos.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "auth/auth.h"
  30 #include "lib/socket/socket.h"
  31 #include "lib/tsocket/tsocket.h"
  32 #include "librpc/rpc/dcerpc.h"
  33 #include "auth/credentials/credentials.h"
  34 #include "auth/credentials/credentials_krb5.h"
  35 #include "auth/kerberos/kerberos_credentials.h"
  36 #include "auth/gensec/gensec.h"
  37 #include "auth/gensec/gensec_proto.h"
  38 #include "param/param.h"
  39 #include "auth/auth_sam_reply.h"
  40 #include "lib/util/util_net.h"
  41
  42 enum GENSEC_KRB5_STATE {
  43         GENSEC_KRB5_SERVER_START,
  44         GENSEC_KRB5_CLIENT_START,
  45         GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
  46         GENSEC_KRB5_DONE
  47 };
  48
  49 struct gensec_krb5_state {
  50         DATA_BLOB session_key;
  51         DATA_BLOB pac;
  52         enum GENSEC_KRB5_STATE state_position;
  53         struct smb_krb5_context *smb_krb5_context;
  54         krb5_auth_context auth_context;
  55         krb5_data enc_ticket;
  56         krb5_keyblock *keyblock;
  57         krb5_ticket *ticket;
  58         bool gssapi;
  59         krb5_flags ap_req_options;
  60 };
  61
  62 static int gensec_krb5_destroy(struct gensec_krb5_state *gensec_krb5_state)
  63 {
  64         if (!gensec_krb5_state->smb_krb5_context) {
  65                 /* We can't clean anything else up unless we started up this far */
  66                 return 0;
  67         }
  68         if (gensec_krb5_state->enc_ticket.length) {
  69                 kerberos_free_data_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
  70                                             &gensec_krb5_state->enc_ticket);
  71         }
  72
  73         if (gensec_krb5_state->ticket) {
  74                 krb5_free_ticket(gensec_krb5_state->smb_krb5_context->krb5_context,
  75                                  gensec_krb5_state->ticket);
  76         }
  77
  78         /* ccache freed in a child destructor */
  79
  80         krb5_free_keyblock(gensec_krb5_state->smb_krb5_context->krb5_context,
  81                            gensec_krb5_state->keyblock);
  82
  83         if (gensec_krb5_state->auth_context) {
  84                 krb5_auth_con_free(gensec_krb5_state->smb_krb5_context->krb5_context,
  85                                    gensec_krb5_state->auth_context);
  86         }
  87
  88         return 0;
  89 }
  90
  91 static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security, bool gssapi)
  92 {
  93         krb5_error_code ret;
  94         struct gensec_krb5_state *gensec_krb5_state;
  95         struct cli_credentials *creds;
  96         const struct tsocket_address *tlocal_addr, *tremote_addr;
  97         krb5_address my_krb5_addr, peer_krb5_addr;
  98
  99         creds = gensec_get_credentials(gensec_security);
 100         if (!creds) {
 101                 return NT_STATUS_INVALID_PARAMETER;
 102         }
 103
 104         gensec_krb5_state = talloc(gensec_security, struct gensec_krb5_state);
 105         if (!gensec_krb5_state) {
 106                 return NT_STATUS_NO_MEMORY;
 107         }
 108
 109         gensec_security->private_data = gensec_krb5_state;
 110         gensec_krb5_state->smb_krb5_context = NULL;
 111         gensec_krb5_state->auth_context = NULL;
 112         gensec_krb5_state->ticket = NULL;
 113         ZERO_STRUCT(gensec_krb5_state->enc_ticket);
 114         gensec_krb5_state->keyblock = NULL;
 115         gensec_krb5_state->session_key = data_blob(NULL, 0);
 116         gensec_krb5_state->pac = data_blob(NULL, 0);
 117         gensec_krb5_state->gssapi = gssapi;
 118
 119         talloc_set_destructor(gensec_krb5_state, gensec_krb5_destroy);
 120
 121         if (cli_credentials_get_krb5_context(creds,
 122                                              gensec_security->settings->lp_ctx, &gensec_krb5_state->smb_krb5_context)) {
 123                 talloc_free(gensec_krb5_state);
 124                 return NT_STATUS_INTERNAL_ERROR;
 125         }
 126
 127         ret = krb5_auth_con_init(gensec_krb5_state->smb_krb5_context->krb5_context, &gensec_krb5_state->auth_context);
 128         if (ret) {
 129                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n",
 130                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 131                                                     ret, gensec_krb5_state)));
 132                 talloc_free(gensec_krb5_state);
 133                 return NT_STATUS_INTERNAL_ERROR;
 134         }
 135
 136         ret = krb5_auth_con_setflags(gensec_krb5_state->smb_krb5_context->krb5_context,
 137                                      gensec_krb5_state->auth_context,
 138                                      KRB5_AUTH_CONTEXT_DO_SEQUENCE);
 139         if (ret) {
 140                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setflags failed (%s)\n",
 141                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 142                                                     ret, gensec_krb5_state)));
 143                 talloc_free(gensec_krb5_state);
 144                 return NT_STATUS_INTERNAL_ERROR;
 145         }
 146
 147         tlocal_addr = gensec_get_local_address(gensec_security);
 148         if (tlocal_addr) {
 149                 ssize_t socklen;
 150                 struct sockaddr_storage ss;
 151
 152                 socklen = tsocket_address_bsd_sockaddr(tlocal_addr,
 153                                 (struct sockaddr *) &ss,
 154                                 sizeof(struct sockaddr_storage));
 155                 if (socklen < 0) {
 156                         return NT_STATUS_INTERNAL_ERROR;
 157                 }
 158                 ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
 159                                 (const struct sockaddr *) &ss, &my_krb5_addr);
 160                 if (ret) {
 161                         DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
 162                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 163                                                             ret, gensec_krb5_state)));
 164                         talloc_free(gensec_krb5_state);
 165                         return NT_STATUS_INTERNAL_ERROR;
 166                 }
 167         }
 168
 169         tremote_addr = gensec_get_remote_address(gensec_security);
 170         if (tremote_addr) {
 171                 ssize_t socklen;
 172                 struct sockaddr_storage ss;
 173
 174                 socklen = tsocket_address_bsd_sockaddr(tremote_addr,
 175                                 (struct sockaddr *) &ss,
 176                                 sizeof(struct sockaddr_storage));
 177                 if (socklen < 0) {
 178                         return NT_STATUS_INTERNAL_ERROR;
 179                 }
 180                 ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
 181                                 (const struct sockaddr *) &ss, &peer_krb5_addr);
 182                 if (ret) {
 183                         DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
 184                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 185                                                             ret, gensec_krb5_state)));
 186                         talloc_free(gensec_krb5_state);
 187                         return NT_STATUS_INTERNAL_ERROR;
 188                 }
 189         }
 190
 191         ret = krb5_auth_con_setaddrs(gensec_krb5_state->smb_krb5_context->krb5_context,
 192                                      gensec_krb5_state->auth_context,
 193                                      tlocal_addr ? &my_krb5_addr : NULL,
 194                                      tremote_addr ? &peer_krb5_addr : NULL);
 195         if (ret) {
 196                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setaddrs failed (%s)\n",
 197                          smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 198                                                     ret, gensec_krb5_state)));
 199                 talloc_free(gensec_krb5_state);
 200                 return NT_STATUS_INTERNAL_ERROR;
 201         }
 202
 203         return NT_STATUS_OK;
 204 }
 205
 206 static NTSTATUS gensec_krb5_common_server_start(struct gensec_security *gensec_security, bool gssapi)
 207 {
 208         NTSTATUS nt_status;
 209         struct gensec_krb5_state *gensec_krb5_state;
 210
 211         nt_status = gensec_krb5_start(gensec_security, gssapi);
 212         if (!NT_STATUS_IS_OK(nt_status)) {
 213                 return nt_status;
 214         }
 215
 216         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 217         gensec_krb5_state->state_position = GENSEC_KRB5_SERVER_START;
 218
 219         return NT_STATUS_OK;
 220 }
 221
 222 static NTSTATUS gensec_krb5_server_start(struct gensec_security *gensec_security)
 223 {
 224         return gensec_krb5_common_server_start(gensec_security, false);
 225 }
 226
 227 static NTSTATUS gensec_fake_gssapi_krb5_server_start(struct gensec_security *gensec_security)
 228 {
 229         return gensec_krb5_common_server_start(gensec_security, true);
 230 }
 231
 232 static NTSTATUS gensec_krb5_common_client_start(struct gensec_security *gensec_security, bool gssapi)
 233 {
 234         struct gensec_krb5_state *gensec_krb5_state;
 235         krb5_error_code ret;
 236         NTSTATUS nt_status;
 237         struct ccache_container *ccache_container;
 238         const char *hostname;
 239         const char *error_string;
 240         const char *principal;
 241         krb5_data in_data;
 242         struct tevent_context *previous_ev;
 243
 244         hostname = gensec_get_target_hostname(gensec_security);
 245         if (!hostname) {
 246                 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
 247                 return NT_STATUS_INVALID_PARAMETER;
 248         }
 249         if (is_ipaddress(hostname)) {
 250                 DEBUG(2, ("Cannot do krb5 to an IP address"));
 251                 return NT_STATUS_INVALID_PARAMETER;
 252         }
 253         if (strcmp(hostname, "localhost") == 0) {
 254                 DEBUG(2, ("krb5 to 'localhost' does not make sense"));
 255                 return NT_STATUS_INVALID_PARAMETER;
 256         }
 257
 258         nt_status = gensec_krb5_start(gensec_security, gssapi);
 259         if (!NT_STATUS_IS_OK(nt_status)) {
 260                 return nt_status;
 261         }
 262
 263         gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 264         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_START;
 265         gensec_krb5_state->ap_req_options = AP_OPTS_USE_SUBKEY;
 266
 267         if (gensec_krb5_state->gssapi) {
 268                 /* The Fake GSSAPI modal emulates Samba3, which does not do mutual authentication */
 269                 if (gensec_setting_bool(gensec_security->settings, "gensec_fake_gssapi_krb5", "mutual", false)) {
 270                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 271                 }
 272         } else {
 273                 /* The wrapping for KPASSWD (a user of the raw KRB5 API) should be mutually authenticated */
 274                 if (gensec_setting_bool(gensec_security->settings, "gensec_krb5", "mutual", true)) {
 275                         gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 276                 }
 277         }
 278
 279         principal = gensec_get_target_principal(gensec_security);
 280
 281         ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security),
 282                                          gensec_security->event_ctx,
 283                                          gensec_security->settings->lp_ctx, &ccache_container, &error_string);
 284         switch (ret) {
 285         case 0:
 286                 break;
 287         case KRB5KDC_ERR_PREAUTH_FAILED:
 288                 return NT_STATUS_LOGON_FAILURE;
 289         case KRB5_KDC_UNREACH:
 290                 DEBUG(3, ("Cannot reach a KDC we require to contact %s: %s\n", principal, error_string));
 291                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 292         case KRB5_CC_NOTFOUND:
 293         case KRB5_CC_END:
 294                 DEBUG(3, ("Error preparing credentials we require to contact %s : %s\n", principal, error_string));
 295                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 296         default:
 297                 DEBUG(1, ("gensec_krb5_start: Aquiring initiator credentials failed: %s\n", error_string));
 298                 return NT_STATUS_UNSUCCESSFUL;
 299         }
 300         in_data.length = 0;
 301
 302         /* Do this every time, in case we have weird recursive issues here */
 303         ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, gensec_security->event_ctx, &previous_ev);
 304         if (ret != 0) {
 305                 DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
 306                 return NT_STATUS_NO_MEMORY;
 307         }
 308         if (principal) {
 309                 krb5_principal target_principal;
 310                 ret = krb5_parse_name(gensec_krb5_state->smb_krb5_context->krb5_context, principal,
 311                                       &target_principal);
 312                 if (ret == 0) {
 313                         ret = krb5_mk_req_exact(gensec_krb5_state->smb_krb5_context->krb5_context,
 314                                                 &gensec_krb5_state->auth_context,
 315                                                 gensec_krb5_state->ap_req_options,
 316                                                 target_principal,
 317                                                 &in_data, ccache_container->ccache,
 318                                                 &gensec_krb5_state->enc_ticket);
 319                         krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
 320                                             target_principal);
 321                 }
 322         } else {
 323                 ret = krb5_mk_req(gensec_krb5_state->smb_krb5_context->krb5_context,
 324                                   &gensec_krb5_state->auth_context,
 325                                   gensec_krb5_state->ap_req_options,
 326                                   gensec_get_target_service(gensec_security),
 327                                   hostname,
 328                                   &in_data, ccache_container->ccache,
 329                                   &gensec_krb5_state->enc_ticket);
 330         }
 331
 332         smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, gensec_security->event_ctx);
 333
 334         switch (ret) {
 335         case 0:
 336                 return NT_STATUS_OK;
 337         case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 338                 DEBUG(3, ("Server [%s] is not registered with our KDC: %s\n",
 339                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 340                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 341         case KRB5_KDC_UNREACH:
 342                 DEBUG(3, ("Cannot reach a KDC we require to contact host [%s]: %s\n",
 343                           hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 344                 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
 345         case KRB5KDC_ERR_PREAUTH_FAILED:
 346         case KRB5KRB_AP_ERR_TKT_EXPIRED:
 347         case KRB5_CC_END:
 348                 /* Too much clock skew - we will need to kinit to re-skew the clock */
 349         case KRB5KRB_AP_ERR_SKEW:
 350         case KRB5_KDCREP_SKEW:
 351         {
 352                 DEBUG(3, ("kerberos (mk_req) failed: %s\n",
 353                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 354                 /*fall through*/
 355         }
 356
 357         /* just don't print a message for these really ordinary messages */
 358         case KRB5_FCC_NOFILE:
 359         case KRB5_CC_NOTFOUND:
 360         case ENOENT:
 361
 362                 return NT_STATUS_UNSUCCESSFUL;
 363                 break;
 364
 365         default:
 366                 DEBUG(0, ("kerberos: %s\n",
 367                           smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
 368                 return NT_STATUS_UNSUCCESSFUL;
 369         }
 370 }
 371
 372 static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security)
 373 {
 374         return gensec_krb5_common_client_start(gensec_security, false);
 375 }
 376
 377 static NTSTATUS gensec_fake_gssapi_krb5_client_start(struct gensec_security *gensec_security)
 378 {
 379         return gensec_krb5_common_client_start(gensec_security, true);
 380 }
 381
 382 /**
 383  * Check if the packet is one for this mechansim
 384  *
 385  * @param gensec_security GENSEC state
 386  * @param in The request, as a DATA_BLOB
 387  * @return Error, INVALID_PARAMETER if it's not a packet for us
 388  *                or NT_STATUS_OK if the packet is ok.
 389  */
 390
 391 static NTSTATUS gensec_fake_gssapi_krb5_magic(struct gensec_security *gensec_security,
 392                                   const DATA_BLOB *in)
 393 {
 394         if (gensec_gssapi_check_oid(in, GENSEC_OID_KERBEROS5)) {
 395                 return NT_STATUS_OK;
 396         } else {
 397                 return NT_STATUS_INVALID_PARAMETER;
 398         }
 399 }
 400
 401
 402 /**
 403  * Next state function for the Krb5 GENSEC mechanism
 404  *
 405  * @param gensec_krb5_state KRB5 State
 406  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 407  * @param in The request, as a DATA_BLOB
 408  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 409  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 410  *                or NT_STATUS_OK if the user is authenticated.
 411  */
 412
 413 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
 414                                    TALLOC_CTX *out_mem_ctx,
 415                                    const DATA_BLOB in, DATA_BLOB *out)
 416 {
 417         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 418         krb5_error_code ret = 0;
 419         NTSTATUS nt_status;
 420
 421         switch (gensec_krb5_state->state_position) {
 422         case GENSEC_KRB5_CLIENT_START:
 423         {
 424                 DATA_BLOB unwrapped_out;
 425
 426                 if (gensec_krb5_state->gssapi) {
 427                         unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 428
 429                         /* wrap that up in a nice GSS-API wrapping */
 430                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REQ);
 431                 } else {
 432                         *out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
 433                 }
 434                 if (gensec_krb5_state->ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
 435                         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_MUTUAL_AUTH;
 436                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 437                 } else {
 438                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 439                         nt_status = NT_STATUS_OK;
 440                 }
 441                 return nt_status;
 442         }
 443
 444         case GENSEC_KRB5_CLIENT_MUTUAL_AUTH:
 445         {
 446                 DATA_BLOB unwrapped_in;
 447                 krb5_data inbuf;
 448                 krb5_ap_rep_enc_part *repl = NULL;
 449                 uint8_t tok_id[2];
 450
 451                 if (gensec_krb5_state->gssapi) {
 452                         if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 453                                 DEBUG(1,("gensec_gssapi_parse_krb5_wrap(mutual authentication) failed to parse\n"));
 454                                 dump_data_pw("Mutual authentication message:\n", in.data, in.length);
 455                                 return NT_STATUS_INVALID_PARAMETER;
 456                         }
 457                 } else {
 458                         unwrapped_in = in;
 459                 }
 460                 /* TODO: check the tok_id */
 461
 462                 inbuf.data = unwrapped_in.data;
 463                 inbuf.length = unwrapped_in.length;
 464                 ret = krb5_rd_rep(gensec_krb5_state->smb_krb5_context->krb5_context,
 465                                   gensec_krb5_state->auth_context,
 466                                   &inbuf, &repl);
 467                 if (ret) {
 468                         DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
 469                                  smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, out_mem_ctx)));
 470                         dump_data_pw("Mutual authentication message:\n", (uint8_t *)inbuf.data, inbuf.length);
 471                         nt_status = NT_STATUS_ACCESS_DENIED;
 472                 } else {
 473                         *out = data_blob(NULL, 0);
 474                         nt_status = NT_STATUS_OK;
 475                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 476                 }
 477                 if (repl) {
 478                         krb5_free_ap_rep_enc_part(gensec_krb5_state->smb_krb5_context->krb5_context, repl);
 479                 }
 480                 return nt_status;
 481         }
 482
 483         case GENSEC_KRB5_SERVER_START:
 484         {
 485                 DATA_BLOB unwrapped_in;
 486                 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
 487                 krb5_data inbuf, outbuf;
 488                 uint8_t tok_id[2];
 489                 struct keytab_container *keytab;
 490                 krb5_principal server_in_keytab;
 491                 const char *error_string;
 492                 enum credentials_obtained obtained;
 493
 494                 if (!in.data) {
 495                         return NT_STATUS_INVALID_PARAMETER;
 496                 }
 497
 498                 /* Grab the keytab, however generated */
 499                 ret = cli_credentials_get_keytab(gensec_get_credentials(gensec_security),
 500                                                  gensec_security->settings->lp_ctx, &keytab);
 501                 if (ret) {
 502                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 503                 }
 504
 505                 /* This ensures we lookup the correct entry in that keytab */
 506                 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security),
 507                                                  gensec_krb5_state->smb_krb5_context,
 508                                                  &server_in_keytab, &obtained, &error_string);
 509
 510                 if (ret) {
 511                         DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
 512                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 513                 }
 514
 515                 /* Parse the GSSAPI wrapping, if it's there... (win2k3 allows it to be omited) */
 516                 if (gensec_krb5_state->gssapi
 517                     && gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 518                         inbuf.data = unwrapped_in.data;
 519                         inbuf.length = unwrapped_in.length;
 520                 } else {
 521                         inbuf.data = in.data;
 522                         inbuf.length = in.length;
 523                 }
 524
 525                 ret = smb_rd_req_return_stuff(gensec_krb5_state->smb_krb5_context->krb5_context,
 526                                               &gensec_krb5_state->auth_context,
 527                                               &inbuf, keytab->keytab, server_in_keytab,
 528                                               &outbuf,
 529                                               &gensec_krb5_state->ticket,
 530                                               &gensec_krb5_state->keyblock);
 531
 532                 if (ret) {
 533                         return NT_STATUS_LOGON_FAILURE;
 534                 }
 535                 unwrapped_out.data = (uint8_t *)outbuf.data;
 536                 unwrapped_out.length = outbuf.length;
 537                 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 538                 /* wrap that up in a nice GSS-API wrapping */
 539                 if (gensec_krb5_state->gssapi) {
 540                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REP);
 541                 } else {
 542                         *out = data_blob_talloc(out_mem_ctx, outbuf.data, outbuf.length);
 543                 }
 544                 krb5_data_free(&outbuf);
 545                 return NT_STATUS_OK;
 546         }
 547
 548         case GENSEC_KRB5_DONE:
 549         default:
 550                 /* Asking too many times... */
 551                 return NT_STATUS_INVALID_PARAMETER;
 552         }
 553 }
 554
 555 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security,
 556                                         DATA_BLOB *session_key)
 557 {
 558         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 559         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 560         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 561         krb5_keyblock *skey;
 562         krb5_error_code err = -1;
 563
 564         if (gensec_krb5_state->state_position != GENSEC_KRB5_DONE) {
 565                 return NT_STATUS_NO_USER_SESSION_KEY;
 566         }
 567
 568         if (gensec_krb5_state->session_key.data) {
 569                 *session_key = gensec_krb5_state->session_key;
 570                 return NT_STATUS_OK;
 571         }
 572
 573         switch (gensec_security->gensec_role) {
 574         case GENSEC_CLIENT:
 575                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 576                 break;
 577         case GENSEC_SERVER:
 578                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 579                 break;
 580         }
 581         if (err == 0 && skey != NULL) {
 582                 DEBUG(10, ("Got KRB5 session key of length %d\n",
 583                            (int)KRB5_KEY_LENGTH(skey)));
 584                 gensec_krb5_state->session_key = data_blob_talloc(gensec_krb5_state,
 585                                                 KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 586                 *session_key = gensec_krb5_state->session_key;
 587                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 588
 589                 krb5_free_keyblock(context, skey);
 590                 return NT_STATUS_OK;
 591         } else {
 592                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 593                 return NT_STATUS_NO_USER_SESSION_KEY;
 594         }
 595 }
 596
 597 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
 598                                          struct auth_session_info **_session_info)
 599 {
 600         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 601         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 602         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 603         struct auth_serversupplied_info *server_info = NULL;
 604         struct auth_session_info *session_info = NULL;
 605         struct PAC_LOGON_INFO *logon_info;
 606
 607         krb5_principal client_principal;
 608         char *principal_string;
 609
 610         DATA_BLOB pac;
 611         krb5_data pac_data;
 612
 613         krb5_error_code ret;
 614
 615         TALLOC_CTX *mem_ctx = talloc_new(gensec_security);
 616         if (!mem_ctx) {
 617                 return NT_STATUS_NO_MEMORY;
 618         }
 619
 620         ret = krb5_ticket_get_client(context, gensec_krb5_state->ticket, &client_principal);
 621         if (ret) {
 622                 DEBUG(5, ("krb5_ticket_get_client failed to get cleint principal: %s\n",
 623                           smb_get_krb5_error_message(context,
 624                                                      ret, mem_ctx)));
 625                 talloc_free(mem_ctx);
 626                 return NT_STATUS_NO_MEMORY;
 627         }
 628
 629         ret = krb5_unparse_name(gensec_krb5_state->smb_krb5_context->krb5_context,
 630                                 client_principal, &principal_string);
 631         if (ret) {
 632                 DEBUG(1, ("Unable to parse client principal: %s\n",
 633                           smb_get_krb5_error_message(context,
 634                                                      ret, mem_ctx)));
 635                 talloc_free(mem_ctx);
 636                 return NT_STATUS_NO_MEMORY;
 637         }
 638
 639         ret = krb5_ticket_get_authorization_data_type(context, gensec_krb5_state->ticket,
 640                                                       KRB5_AUTHDATA_WIN2K_PAC,
 641                                                       &pac_data);
 642
 643         if (ret && gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
 644                 DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access: %s \n",
 645                           principal_string,
 646                           smb_get_krb5_error_message(context,
 647                                                      ret, mem_ctx)));
 648                 krb5_free_principal(context, client_principal);
 649                 free(principal_string);
 650                 return NT_STATUS_ACCESS_DENIED;
 651         } else if (ret) {
 652                 /* NO pac */
 653                 DEBUG(5, ("krb5_ticket_get_authorization_data_type failed to find PAC: %s\n",
 654                           smb_get_krb5_error_message(context,
 655                                                      ret, mem_ctx)));
 656                 if (gensec_security->auth_context &&
 657                     !gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
 658                         DEBUG(1, ("Unable to find PAC for %s, resorting to local user lookup: %s",
 659                                   principal_string, smb_get_krb5_error_message(context,
 660                                                      ret, mem_ctx)));
 661                         nt_status = gensec_security->auth_context->get_server_info_principal(mem_ctx,
 662                                                                                              gensec_security->auth_context,
 663                                                                                              principal_string,
 664                                                                                              NULL, &server_info);
 665                         if (!NT_STATUS_IS_OK(nt_status)) {
 666                                 talloc_free(mem_ctx);
 667                                 return nt_status;
 668                         }
 669                 } else {
 670                         DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access\n",
 671                                   principal_string));
 672                         return NT_STATUS_ACCESS_DENIED;
 673                 }
 674
 675                 krb5_free_principal(context, client_principal);
 676                 free(principal_string);
 677
 678                 if (!NT_STATUS_IS_OK(nt_status)) {
 679                         talloc_free(mem_ctx);
 680                         return nt_status;
 681                 }
 682         } else {
 683                 /* Found pac */
 684                 union netr_Validation validation;
 685                 free(principal_string);
 686
 687                 pac = data_blob_talloc(mem_ctx, pac_data.data, pac_data.length);
 688                 if (!pac.data) {
 689                         krb5_free_principal(context, client_principal);
 690                         talloc_free(mem_ctx);
 691                         return NT_STATUS_NO_MEMORY;
 692                 }
 693
 694                 /* decode and verify the pac */
 695                 nt_status = kerberos_pac_logon_info(gensec_krb5_state,
 696                                                     &logon_info, pac,
 697                                                     gensec_krb5_state->smb_krb5_context->krb5_context,
 698                                                     NULL, gensec_krb5_state->keyblock,
 699                                                     client_principal,
 700                                                     gensec_krb5_state->ticket->ticket.authtime, NULL);
 701                 krb5_free_principal(context, client_principal);
 702
 703                 if (!NT_STATUS_IS_OK(nt_status)) {
 704                         talloc_free(mem_ctx);
 705                         return nt_status;
 706                 }
 707
 708                 validation.sam3 = &logon_info->info3;
 709                 nt_status = make_server_info_netlogon_validation(mem_ctx,
 710                                                                  NULL,
 711                                                                  3, &validation,
 712                                                                  &server_info);
 713                 if (!NT_STATUS_IS_OK(nt_status)) {
 714                         talloc_free(mem_ctx);
 715                         return nt_status;
 716                 }
 717         }
 718
 719         /* references the server_info into the session_info */
 720         nt_status = gensec_generate_session_info(mem_ctx, gensec_security, server_info, &session_info);
 721
 722         if (!NT_STATUS_IS_OK(nt_status)) {
 723                 talloc_free(mem_ctx);
 724                 return nt_status;
 725         }
 726
 727         nt_status = gensec_krb5_session_key(gensec_security, &session_info->session_key);
 728
 729         if (!NT_STATUS_IS_OK(nt_status)) {
 730                 talloc_free(mem_ctx);
 731                 return nt_status;
 732         }
 733
 734         *_session_info = session_info;
 735
 736         talloc_steal(gensec_krb5_state, session_info);
 737         talloc_free(mem_ctx);
 738         return NT_STATUS_OK;
 739 }
 740
 741 static NTSTATUS gensec_krb5_wrap(struct gensec_security *gensec_security,
 742                                    TALLOC_CTX *mem_ctx,
 743                                    const DATA_BLOB *in,
 744                                    DATA_BLOB *out)
 745 {
 746         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 747         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 748         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 749         krb5_error_code ret;
 750         krb5_data input, output;
 751         input.length = in->length;
 752         input.data = in->data;
 753
 754         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 755                 ret = krb5_mk_priv(context, auth_context, &input, &output, NULL);
 756                 if (ret) {
 757                         DEBUG(1, ("krb5_mk_priv failed: %s\n",
 758                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 759                                                              ret, mem_ctx)));
 760                         return NT_STATUS_ACCESS_DENIED;
 761                 }
 762                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
 763
 764                 krb5_data_free(&output);
 765         } else {
 766                 return NT_STATUS_ACCESS_DENIED;
 767         }
 768         return NT_STATUS_OK;
 769 }
 770
 771 static NTSTATUS gensec_krb5_unwrap(struct gensec_security *gensec_security,
 772                                      TALLOC_CTX *mem_ctx,
 773                                      const DATA_BLOB *in,
 774                                      DATA_BLOB *out)
 775 {
 776         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 777         krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
 778         krb5_auth_context auth_context = gensec_krb5_state->auth_context;
 779         krb5_error_code ret;
 780         krb5_data input, output;
 781         krb5_replay_data replay;
 782         input.length = in->length;
 783         input.data = in->data;
 784
 785         if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
 786                 ret = krb5_rd_priv(context, auth_context, &input, &output, &replay);
 787                 if (ret) {
 788                         DEBUG(1, ("krb5_rd_priv failed: %s\n",
 789                                   smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
 790                                                              ret, mem_ctx)));
 791                         return NT_STATUS_ACCESS_DENIED;
 792                 }
 793                 *out = data_blob_talloc(mem_ctx, output.data, output.length);
 794
 795                 krb5_data_free(&output);
 796         } else {
 797                 return NT_STATUS_ACCESS_DENIED;
 798         }
 799         return NT_STATUS_OK;
 800 }
 801
 802 static bool gensec_krb5_have_feature(struct gensec_security *gensec_security,
 803                                      uint32_t feature)
 804 {
 805         struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
 806         if (feature & GENSEC_FEATURE_SESSION_KEY) {
 807                 return true;
 808         }
 809         if (!gensec_krb5_state->gssapi &&
 810             (feature & GENSEC_FEATURE_SEAL)) {
 811                 return true;
 812         }
 813
 814         return false;
 815 }
 816
 817 static const char *gensec_krb5_oids[] = {
 818         GENSEC_OID_KERBEROS5,
 819         GENSEC_OID_KERBEROS5_OLD,
 820         NULL
 821 };
 822
 823 static const struct gensec_security_ops gensec_fake_gssapi_krb5_security_ops = {
 824         .name           = "fake_gssapi_krb5",
 825         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
 826         .oid            = gensec_krb5_oids,
 827         .client_start   = gensec_fake_gssapi_krb5_client_start,
 828         .server_start   = gensec_fake_gssapi_krb5_server_start,
 829         .update         = gensec_krb5_update,
 830         .magic          = gensec_fake_gssapi_krb5_magic,
 831         .session_key    = gensec_krb5_session_key,
 832         .session_info   = gensec_krb5_session_info,
 833         .have_feature   = gensec_krb5_have_feature,
 834         .enabled        = false,
 835         .kerberos       = true,
 836         .priority       = GENSEC_KRB5
 837 };
 838
 839 static const struct gensec_security_ops gensec_krb5_security_ops = {
 840         .name           = "krb5",
 841         .client_start   = gensec_krb5_client_start,
 842         .server_start   = gensec_krb5_server_start,
 843         .update         = gensec_krb5_update,
 844         .session_key    = gensec_krb5_session_key,
 845         .session_info   = gensec_krb5_session_info,
 846         .have_feature   = gensec_krb5_have_feature,
 847         .wrap           = gensec_krb5_wrap,
 848         .unwrap         = gensec_krb5_unwrap,
 849         .enabled        = true,
 850         .kerberos       = true,
 851         .priority       = GENSEC_KRB5
 852 };
 853
 854 _PUBLIC_ NTSTATUS gensec_krb5_init(void)
 855 {
 856         NTSTATUS ret;
 857
 858         ret = gensec_register(&gensec_krb5_security_ops);
 859         if (!NT_STATUS_IS_OK(ret)) {
 860                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 861                         gensec_krb5_security_ops.name));
 862                 return ret;
 863         }
 864
 865         ret = gensec_register(&gensec_fake_gssapi_krb5_security_ops);
 866         if (!NT_STATUS_IS_OK(ret)) {
 867                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 868                         gensec_krb5_security_ops.name));
 869                 return ret;
 870         }
 871
 872         return ret;
 873 }