r7989: Allow the use of hashed passwords in the kerberos client and server,

and create the in-memory keytab with the correct kvno, if available.

Andrew Bartlett
(This used to be commit 7b7b2b038e25f3d767b5db7d6e41dd947fdde091)

diff --git a/source4/auth/kerberos/kerberos.c b/source4/auth/kerberos/kerberos.c
index 4b3750658ffda477fe20624f4510f57c500489a4..8c82ae780e22cdbfbcdc2f7a9b82f39fa9c325b4 100644 (file)
--- a/source4/auth/kerberos/kerberos.c
+++ b/source4/auth/kerberos/kerberos.c
@@ -61,6 +61,60 @@ kerb_prompter(krb5_context ctx, void *data,
        return 0;
 }
 
+/*
+  simulate a kinit, putting the tgt in the given credentials cache. 
+  Orignally by remus@snapserver.com
+ 
+  This version is built to use a keyblock, rather than needing the
+  original password.
+*/
+ int kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc, 
+                               const char *principal, krb5_keyblock *keyblock,
+                               time_t *expire_time, time_t *kdc_time)
+{
+       krb5_error_code code = 0;
+       krb5_principal me;
+       krb5_creds my_creds;
+       krb5_get_init_creds_opt options;
+
+       if ((code = krb5_parse_name(ctx, principal, &me))) {
+               return code;
+       }
+
+       krb5_get_init_creds_opt_init(&options);
+
+       if ((code = krb5_get_init_creds_keyblock(ctx, &my_creds, me, keyblock,
+                                                0, NULL, &options))) {
+               krb5_free_principal(ctx, me);
+               return code;
+       }
+       
+       if ((code = krb5_cc_initialize(ctx, cc, me))) {
+               krb5_free_cred_contents(ctx, &my_creds);
+               krb5_free_principal(ctx, me);
+               return code;
+       }
+       
+       if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
+               krb5_free_cred_contents(ctx, &my_creds);
+               krb5_free_principal(ctx, me);
+               return code;
+       }
+       
+       if (expire_time) {
+               *expire_time = (time_t) my_creds.times.endtime;
+       }
+
+       if (kdc_time) {
+               *kdc_time = (time_t) my_creds.times.starttime;
+       }
+
+       krb5_free_cred_contents(ctx, &my_creds);
+       krb5_free_principal(ctx, me);
+       
+       return 0;
+}
+
 /*
   simulate a kinit, putting the tgt in the given credentials cache. 
   Orignally by remus@snapserver.com

diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
index 9f93ffe7b090d286537d6a56aa8fd099dd466b58..b2d9234aeb3787f26548698928cf0f2a6944e5d2 100644 (file)
--- a/source4/auth/kerberos/kerberos_util.c
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -3,7 +3,7 @@
 
    Kerberos utility functions for GENSEC
    
-   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -149,10 +149,34 @@ static int free_ccache(void *ptr) {
        mem_ctx->ccache = *ccache;
 
        talloc_set_destructor(mem_ctx, free_ccache);
-       ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, *ccache, 
-                                        cli_credentials_get_principal(credentials, mem_ctx), 
-                                        password, NULL, &kdc_time);
-       
+
+       if (password) {
+               ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, *ccache, 
+                                                cli_credentials_get_principal(credentials, mem_ctx), 
+                                                password, NULL, &kdc_time);
+       } else {
+               /* No password available, try to use a keyblock instead */
+
+               krb5_keyblock keyblock;
+               const struct samr_Password *mach_pwd;
+               mach_pwd = cli_credentials_get_nt_hash(credentials, mem_ctx);
+               if (!mach_pwd) {
+                       talloc_free(mem_ctx);
+                       DEBUG(1, ("kinit_to_ccache: No password available for kinit\n"));
+                       return NT_STATUS_WRONG_PASSWORD;
+               }
+               ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
+                                        ENCTYPE_ARCFOUR_HMAC,
+                                        mach_pwd->hash, sizeof(mach_pwd->hash), 
+                                        &keyblock);
+               
+               if (ret == 0) {
+                       ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, *ccache, 
+                                                        cli_credentials_get_principal(credentials, mem_ctx), 
+                                                        &keyblock, NULL, &kdc_time);
+               }
+       }
+
        /* cope with ticket being in the future due to clock skew */
        if ((unsigned)kdc_time > time(NULL)) {
                time_t t = time(NULL);
@@ -206,17 +230,6 @@ static int free_keytab(void *ptr) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       password_s = talloc_strdup(mem_ctx, cli_credentials_get_password(machine_account));
-       if (!password_s) {
-               DEBUG(1, ("create_memory_keytab: Could not obtain password for our local machine account!\n"));
-               talloc_free(mem_ctx);
-               return NT_STATUS_NO_MEMORY;
-       }
-       password.data = password_s;
-       password.length = strlen(password_s);
-       
-       /* this string should be unique */
-       
        ret = krb5_kt_resolve(smb_krb5_context->krb5_context, "MEMORY_WILDCARD:", keytab);
        if (ret) {
                DEBUG(1,("failed to generate a new krb5 keytab: %s\n", 
@@ -239,30 +252,81 @@ static int free_keytab(void *ptr) {
                return NT_STATUS_INTERNAL_ERROR;
        }
 
+       password_s = talloc_strdup(mem_ctx, cli_credentials_get_password(machine_account));
+       if (!password_s) {
+               /* If we don't have the plaintext password, try for
+                * the MD4 password hash */
+
+               krb5_keytab_entry entry;
+               const struct samr_Password *mach_pwd;
+               mach_pwd = cli_credentials_get_nt_hash(machine_account, mem_ctx);
+               if (!mach_pwd) {
+                       talloc_free(mem_ctx);
+                       DEBUG(1, ("create_memory_keytab: Domain trust informaton for account %s not available\n",
+                                 cli_credentials_get_principal(machine_account, mem_ctx)));
+                       return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+               }
+               ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
+                                        ENCTYPE_ARCFOUR_HMAC,
+                                        mach_pwd->hash, sizeof(mach_pwd->hash), 
+                                        &entry.keyblock);
+               if (ret) {
+                       DEBUG(1, ("create_memory_keytab: krb5_keyblock_init failed: %s\n",
+                                 smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
+                                                            ret, mem_ctx)));
+                       return NT_STATUS_INTERNAL_ERROR;
+               }
+
+               entry.principal = salt_princ;
+               entry.vno       = cli_credentials_get_kvno(machine_account);
+               ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, *keytab, &entry);
+               if (ret) {
+                       DEBUG(1, ("Failed to add ARCFOUR_HMAC (only) entry for %s to keytab: %s",
+                                 cli_credentials_get_principal(machine_account, mem_ctx), 
+                                 smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
+                                                            ret, mem_ctx)));
+                       talloc_free(mem_ctx);
+                       krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
+                       return NT_STATUS_INTERNAL_ERROR;
+               }
+               
+               krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
+               return NT_STATUS_OK;
+       }
+               
+       /* good, we actually have the real plaintext */
+
        ret = get_kerberos_allowed_etypes(smb_krb5_context->krb5_context, 
                                          &enctypes);
        if (ret) {
                DEBUG(1,("create_memory_keytab: getting encrption types failed (%s)\n",
                         error_message(ret)));
+               talloc_free(mem_ctx);
                return NT_STATUS_INTERNAL_ERROR;
        }
 
+       password.data = discard_const_p(char *, password_s);
+       password.length = strlen(password_s);
+       
        for (i=0; enctypes[i]; i++) {
                krb5_keytab_entry entry;
                ret = create_kerberos_key_from_string(smb_krb5_context->krb5_context, 
                                                      salt_princ, &password, &entry.keyblock, enctypes[i]);
                if (ret) {
+                       talloc_free(mem_ctx);
                        return NT_STATUS_INTERNAL_ERROR;
                }
 
                 entry.principal = salt_princ;
-                entry.vno       = 0 /* replace with real kvno */;
+                entry.vno       = cli_credentials_get_kvno(machine_account);
                ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, *keytab, &entry);
                if (ret) {
                        DEBUG(1, ("Failed to add entry for %s to keytab: %s",
                                  cli_credentials_get_principal(machine_account, mem_ctx), 
                                  smb_get_krb5_error_message(smb_krb5_context->krb5_context, 
                                                             ret, mem_ctx)));
+                       talloc_free(mem_ctx);
+                       krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
                        return NT_STATUS_INTERNAL_ERROR;
                }
                
@@ -273,3 +337,5 @@ static int free_keytab(void *ptr) {
 
        return NT_STATUS_OK;
 }
+
+