source/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  24 #define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
  25
  26 #include "includes.h"
  27
  28 #ifdef HAVE_KRB5
  29
  30 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
  31 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  32 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  33 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  34 #else /* MIT */
  35 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  36 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  37 #define KRB5_KEY_DATA(k)        ((k)->contents)
  38 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  39
  40 #define GSSAPI_CHECKSUM      0x8003             /* Checksum type value for Kerberos */
  41 #define GSSAPI_BNDLENGTH     16                 /* Bind Length (rfc-1964 pg.3) */
  42 #define GSSAPI_CHECKSUM_SIZE (12+GSSAPI_BNDLENGTH)
  43
  44 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
  45 static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
  46                                          krb5_auth_context *auth_context,
  47                                          krb5_creds *credsp,
  48                                          krb5_ccache ccache,
  49                                          krb5_data *authenticator);
  50 #endif
  51
  52 /**************************************************************
  53  Wrappers around kerberos string functions that convert from
  54  utf8 -> unix charset and vica versa.
  55 **************************************************************/
  56
  57 /**************************************************************
  58  krb5_parse_name that takes a UNIX charset.
  59 **************************************************************/
  60
  61  krb5_error_code smb_krb5_parse_name(krb5_context context,
  62                                 const char *name, /* in unix charset */
  63                                 krb5_principal *principal)
  64 {
  65         krb5_error_code ret;
  66         char *utf8_name;
  67
  68         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  69                 return ENOMEM;
  70         }
  71
  72         ret = krb5_parse_name(context, utf8_name, principal);
  73         SAFE_FREE(utf8_name);
  74         return ret;
  75 }
  76
  77 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
  78 /**************************************************************
  79  krb5_parse_name_norealm that takes a UNIX charset.
  80 **************************************************************/
  81
  82 static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
  83                                 const char *name, /* in unix charset */
  84                                 krb5_principal *principal)
  85 {
  86         krb5_error_code ret;
  87         char *utf8_name;
  88
  89         *principal = NULL;
  90         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  91                 return ENOMEM;
  92         }
  93
  94         ret = krb5_parse_name_norealm(context, utf8_name, principal);
  95         SAFE_FREE(utf8_name);
  96         return ret;
  97 }
  98 #endif
  99
 100 /**************************************************************
 101  krb5_parse_name that returns a UNIX charset name. Must
 102  be freed with normal free() call.
 103 **************************************************************/
 104
 105  krb5_error_code smb_krb5_unparse_name(krb5_context context,
 106                                         krb5_const_principal principal,
 107                                         char **unix_name)
 108 {
 109         krb5_error_code ret;
 110         char *utf8_name;
 111
 112         *unix_name = NULL;
 113         ret = krb5_unparse_name(context, principal, &utf8_name);
 114         if (ret) {
 115                 return ret;
 116         }
 117
 118         if (pull_utf8_allocate(unix_name, utf8_name)==-1) {
 119                 krb5_free_unparsed_name(context, utf8_name);
 120                 return ENOMEM;
 121         }
 122         krb5_free_unparsed_name(context, utf8_name);
 123         return 0;
 124 }
 125
 126 #ifndef HAVE_KRB5_SET_REAL_TIME
 127 /*
 128  * This function is not in the Heimdal mainline.
 129  */
 130  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
 131 {
 132         krb5_error_code ret;
 133         int32_t sec, usec;
 134
 135         ret = krb5_us_timeofday(context, &sec, &usec);
 136         if (ret)
 137                 return ret;
 138
 139         context->kdc_sec_offset = seconds - sec;
 140         context->kdc_usec_offset = microseconds - usec;
 141
 142         return 0;
 143 }
 144 #endif
 145
 146 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
 147
 148 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
 149
 150 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
 151  * to krb5_set_default_tgs_ktypes. See
 152  *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
 153  *
 154  * If the MIT libraries are not exporting internal symbols, we will end up in
 155  * this branch, which is correct. Otherwise we will continue to use the
 156  * internal symbol
 157  */
 158  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 159 {
 160     return krb5_set_default_tgs_enctypes(ctx, enc);
 161 }
 162
 163 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
 164
 165 /* Heimdal */
 166  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 167 {
 168         return krb5_set_default_in_tkt_etypes(ctx, enc);
 169 }
 170
 171 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
 172
 173 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
 174
 175 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
 176 /* HEIMDAL */
 177  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 178 {
 179         memset(pkaddr, '\0', sizeof(krb5_address));
 180 #if defined(HAVE_IPV6) && defined(KRB5_ADDRESS_INET6)
 181         if (paddr->ss_family == AF_INET6) {
 182                 pkaddr->addr_type = KRB5_ADDRESS_INET6;
 183                 pkaddr->address.length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 184                 pkaddr->address.data = (char *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 185                 return true;
 186         }
 187 #endif
 188         if (paddr->ss_family == AF_INET) {
 189                 pkaddr->addr_type = KRB5_ADDRESS_INET;
 190                 pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 191                 pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 192                 return true;
 193         }
 194         return false;
 195 }
 196 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 197 /* MIT */
 198  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 199 {
 200         memset(pkaddr, '\0', sizeof(krb5_address));
 201 #if defined(HAVE_IPV6) && defined(ADDRTYPE_INET6)
 202         if (paddr->ss_family == AF_INET6) {
 203                 pkaddr->addrtype = ADDRTYPE_INET6;
 204                 pkaddr->length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 205                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 206                 return true;
 207         }
 208 #endif
 209         if (paddr->ss_family == AF_INET) {
 210                 pkaddr->addrtype = ADDRTYPE_INET;
 211                 pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 212                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 213                 return true;
 214         }
 215         return false;
 216 }
 217 #else
 218 #error UNKNOWN_ADDRTYPE
 219 #endif
 220
 221 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
 222  int create_kerberos_key_from_string_direct(krb5_context context,
 223                                         krb5_principal host_princ,
 224                                         krb5_data *password,
 225                                         krb5_keyblock *key,
 226                                         krb5_enctype enctype)
 227 {
 228         int ret;
 229         krb5_data salt;
 230         krb5_encrypt_block eblock;
 231
 232         ret = krb5_principal2salt(context, host_princ, &salt);
 233         if (ret) {
 234                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 235                 return ret;
 236         }
 237         krb5_use_enctype(context, &eblock, enctype);
 238         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
 239         SAFE_FREE(salt.data);
 240         return ret;
 241 }
 242 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 243  int create_kerberos_key_from_string_direct(krb5_context context,
 244                                         krb5_principal host_princ,
 245                                         krb5_data *password,
 246                                         krb5_keyblock *key,
 247                                         krb5_enctype enctype)
 248 {
 249         int ret;
 250         krb5_salt salt;
 251
 252         ret = krb5_get_pw_salt(context, host_princ, &salt);
 253         if (ret) {
 254                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 255                 return ret;
 256         }
 257
 258         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
 259         krb5_free_salt(context, salt);
 260         return ret;
 261 }
 262 #else
 263 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 264 #endif
 265
 266  int create_kerberos_key_from_string(krb5_context context,
 267                                         krb5_principal host_princ,
 268                                         krb5_data *password,
 269                                         krb5_keyblock *key,
 270                                         krb5_enctype enctype)
 271 {
 272         krb5_principal salt_princ = NULL;
 273         int ret;
 274         /*
 275          * Check if we've determined that the KDC is salting keys for this
 276          * principal/enctype in a non-obvious way.  If it is, try to match
 277          * its behavior.
 278          */
 279         salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
 280         ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
 281         if (salt_princ) {
 282                 krb5_free_principal(context, salt_princ);
 283         }
 284         return ret;
 285 }
 286
 287 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 288  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 289                                             krb5_enctype **enctypes)
 290 {
 291         return krb5_get_permitted_enctypes(context, enctypes);
 292 }
 293 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 294  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 295                                             krb5_enctype **enctypes)
 296 {
 297         return krb5_get_default_in_tkt_etypes(context, enctypes);
 298 }
 299 #else
 300 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 301 #endif
 302
 303 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 304  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 305                                         krb5_auth_context auth_context,
 306                                         krb5_keyblock *keyblock)
 307 {
 308         return krb5_auth_con_setkey(context, auth_context, keyblock);
 309 }
 310 #endif
 311
 312 bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
 313                            DATA_BLOB *edata,
 314                            DATA_BLOB *edata_out)
 315 {
 316         DATA_BLOB edata_contents;
 317         ASN1_DATA data;
 318         int edata_type;
 319
 320         if (!edata->length) {
 321                 return False;
 322         }
 323
 324         asn1_load(&data, *edata);
 325         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 326         asn1_start_tag(&data, ASN1_CONTEXT(1));
 327         asn1_read_Integer(&data, &edata_type);
 328
 329         if (edata_type != KRB5_PADATA_PW_SALT) {
 330                 DEBUG(0,("edata is not of required type %d but of type %d\n",
 331                         KRB5_PADATA_PW_SALT, edata_type));
 332                 asn1_free(&data);
 333                 return False;
 334         }
 335
 336         asn1_start_tag(&data, ASN1_CONTEXT(2));
 337         asn1_read_OctetString(&data, &edata_contents);
 338         asn1_end_tag(&data);
 339         asn1_end_tag(&data);
 340         asn1_end_tag(&data);
 341         asn1_free(&data);
 342
 343         *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
 344
 345         data_blob_free(&edata_contents);
 346
 347         return True;
 348 }
 349
 350
 351 bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 352 {
 353         DATA_BLOB pac_contents;
 354         ASN1_DATA data;
 355         int data_type;
 356
 357         if (!auth_data->length) {
 358                 return False;
 359         }
 360
 361         asn1_load(&data, *auth_data);
 362         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 363         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 364         asn1_start_tag(&data, ASN1_CONTEXT(0));
 365         asn1_read_Integer(&data, &data_type);
 366
 367         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 368                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 369                 asn1_free(&data);
 370                 return False;
 371         }
 372
 373         asn1_end_tag(&data);
 374         asn1_start_tag(&data, ASN1_CONTEXT(1));
 375         asn1_read_OctetString(&data, &pac_contents);
 376         asn1_end_tag(&data);
 377         asn1_end_tag(&data);
 378         asn1_end_tag(&data);
 379         asn1_free(&data);
 380
 381         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 382
 383         data_blob_free(&pac_contents);
 384
 385         return True;
 386 }
 387
 388  bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 389 {
 390         DATA_BLOB auth_data_wrapped;
 391         bool got_auth_data_pac = False;
 392         int i;
 393
 394 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 395         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 396             tkt->enc_part2->authorization_data[0] &&
 397             tkt->enc_part2->authorization_data[0]->length)
 398         {
 399                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 400
 401                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 402                             KRB5_AUTHDATA_IF_RELEVANT) {
 403                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 404                                         tkt->enc_part2->authorization_data[i]->ad_type));
 405                                 continue;
 406                         }
 407
 408                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 409                                                       tkt->enc_part2->authorization_data[i]->length);
 410
 411                         /* check if it is a PAC */
 412                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 413                         data_blob_free(&auth_data_wrapped);
 414
 415                         if (got_auth_data_pac) {
 416                                 return true;
 417                         }
 418                 }
 419
 420                 return got_auth_data_pac;
 421         }
 422
 423 #else
 424         if (tkt->ticket.authorization_data &&
 425             tkt->ticket.authorization_data->len)
 426         {
 427                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 428
 429                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 430                             KRB5_AUTHDATA_IF_RELEVANT) {
 431                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 432                                         tkt->ticket.authorization_data->val[i].ad_type));
 433                                 continue;
 434                         }
 435
 436                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 437                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 438
 439                         /* check if it is a PAC */
 440                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 441                         data_blob_free(&auth_data_wrapped);
 442
 443                         if (got_auth_data_pac) {
 444                                 return true;
 445                         }
 446                 }
 447
 448                 return got_auth_data_pac;
 449         }
 450 #endif
 451         return False;
 452 }
 453
 454  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 455 {
 456 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 457         return tkt->enc_part2->client;
 458 #else
 459         return tkt->client;
 460 #endif
 461 }
 462
 463 #if !defined(HAVE_KRB5_LOCATE_KDC)
 464
 465 /* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
 466  * to a public interface for this functionality, so we have to be able to live
 467  * without it if the MIT libraries are hiding their internal symbols.
 468  */
 469
 470 #if defined(KRB5_KRBHST_INIT)
 471 /* Heimdal */
 472  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 473 {
 474         krb5_krbhst_handle hnd;
 475         krb5_krbhst_info *hinfo;
 476         krb5_error_code rc;
 477         int num_kdcs, i;
 478         struct sockaddr *sa;
 479         struct addrinfo *ai;
 480
 481         *addr_pp = NULL;
 482         *naddrs = 0;
 483
 484         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 485         if (rc) {
 486                 DEBUG(0, ("smb_krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 487                 return rc;
 488         }
 489
 490         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 491                 ;
 492
 493         krb5_krbhst_reset(ctx, hnd);
 494
 495         if (!num_kdcs) {
 496                 DEBUG(0, ("smb_krb5_locate_kdc: zero kdcs found !\n"));
 497                 krb5_krbhst_free(ctx, hnd);
 498                 return -1;
 499         }
 500
 501         sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
 502         if (!sa) {
 503                 DEBUG(0, ("smb_krb5_locate_kdc: malloc failed\n"));
 504                 krb5_krbhst_free(ctx, hnd);
 505                 naddrs = 0;
 506                 return -1;
 507         }
 508
 509         memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
 510
 511         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 512
 513 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
 514                 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
 515                 if (rc) {
 516                         DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
 517                         continue;
 518                 }
 519 #endif
 520                 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
 521                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 522         }
 523
 524         krb5_krbhst_free(ctx, hnd);
 525
 526         *naddrs = num_kdcs;
 527         *addr_pp = sa;
 528         return 0;
 529 }
 530
 531 #else /* ! defined(KRB5_KRBHST_INIT) */
 532
 533  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 534                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 535 {
 536         DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
 537         return KRB5_KDC_UNREACH;
 538 }
 539
 540 #endif /* KRB5_KRBHST_INIT */
 541
 542 #else /* ! HAVE_KRB5_LOCATE_KDC */
 543
 544  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 545                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 546 {
 547         return krb5_locate_kdc(ctx, realm, addr_pp, naddrs, get_masters);
 548 }
 549
 550 #endif /* HAVE_KRB5_LOCATE_KDC */
 551
 552 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 553  void krb5_free_unparsed_name(krb5_context context, char *val)
 554 {
 555         SAFE_FREE(val);
 556 }
 557 #endif
 558
 559  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 560 {
 561 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 562         if (pdata->data) {
 563                 krb5_free_data_contents(context, pdata);
 564         }
 565 #else
 566         SAFE_FREE(pdata->data);
 567 #endif
 568 }
 569
 570  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 571 {
 572 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 573         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 574 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 575         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 576 #else
 577 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 578 #endif
 579 }
 580
 581  bool kerberos_compatible_enctypes(krb5_context context,
 582                                   krb5_enctype enctype1,
 583                                   krb5_enctype enctype2)
 584 {
 585 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 586         krb5_boolean similar = 0;
 587
 588         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 589         return similar ? True : False;
 590 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 591         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 592 #endif
 593 }
 594
 595 static bool ads_cleanup_expired_creds(krb5_context context,
 596                                       krb5_ccache  ccache,
 597                                       krb5_creds  *credsp)
 598 {
 599         krb5_error_code retval;
 600         const char *cc_type = krb5_cc_get_type(context, ccache);
 601
 602         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 603                   cc_type, krb5_cc_get_name(context, ccache),
 604                   http_timestring(credsp->times.endtime)));
 605
 606         /* we will probably need new tickets if the current ones
 607            will expire within 10 seconds.
 608         */
 609         if (credsp->times.endtime >= (time(NULL) + 10))
 610                 return False;
 611
 612         /* heimdal won't remove creds from a file ccache, and
 613            perhaps we shouldn't anyway, since internally we
 614            use memory ccaches, and a FILE one probably means that
 615            we're using creds obtained outside of our exectuable
 616         */
 617         if (strequal(cc_type, "FILE")) {
 618                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 619                 return False;
 620         }
 621
 622         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 623         if (retval) {
 624                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 625                           error_message(retval)));
 626                 /* If we have an error in this, we want to display it,
 627                    but continue as though we deleted it */
 628         }
 629         return True;
 630 }
 631
 632 /*
 633   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 634 */
 635 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 636                                        krb5_auth_context *auth_context,
 637                                        const krb5_flags ap_req_options,
 638                                        const char *principal,
 639                                        krb5_ccache ccache,
 640                                        krb5_data *outbuf,
 641                                        time_t *expire_time)
 642 {
 643         krb5_error_code           retval;
 644         krb5_principal    server;
 645         krb5_creds              * credsp;
 646         krb5_creds                creds;
 647         krb5_data in_data;
 648         bool creds_ready = False;
 649         int i = 0, maxtries = 3;
 650
 651         ZERO_STRUCT(in_data);
 652
 653         retval = smb_krb5_parse_name(context, principal, &server);
 654         if (retval) {
 655                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 656                 return retval;
 657         }
 658
 659         /* obtain ticket & session key */
 660         ZERO_STRUCT(creds);
 661         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 662                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 663                          error_message(retval)));
 664                 goto cleanup_princ;
 665         }
 666
 667         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 668                 /* This can commonly fail on smbd startup with no ticket in the cache.
 669                  * Report at higher level than 1. */
 670                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 671                          error_message(retval)));
 672                 goto cleanup_creds;
 673         }
 674
 675         while (!creds_ready && (i < maxtries)) {
 676
 677                 if ((retval = krb5_get_credentials(context, 0, ccache,
 678                                                    &creds, &credsp))) {
 679                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 680                                  principal, error_message(retval)));
 681                         goto cleanup_creds;
 682                 }
 683
 684                 /* cope with ticket being in the future due to clock skew */
 685                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 686                         time_t t = time(NULL);
 687                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 688                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 689                         krb5_set_real_time(context, t + time_offset + 1, 0);
 690                 }
 691
 692                 if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
 693                         creds_ready = True;
 694                 }
 695
 696                 i++;
 697         }
 698
 699         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 700                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 701                   http_timestring((unsigned)credsp->times.endtime),
 702                   (unsigned)credsp->times.endtime));
 703
 704         if (expire_time) {
 705                 *expire_time = (time_t)credsp->times.endtime;
 706         }
 707
 708 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
 709         if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
 710                 /* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
 711                  as part of the kerberos exchange. */
 712
 713                 DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n")  );
 714
 715                 if( *auth_context == NULL ) {
 716                         /* Allocate if it has not yet been allocated. */
 717                         retval = krb5_auth_con_init( context, auth_context );
 718                         if (retval) {
 719                                 DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_init failed (%s)\n",
 720                                         error_message(retval)));
 721                                 goto cleanup_creds;
 722                         }
 723                 }
 724
 725                 retval = krb5_auth_con_setuseruserkey( context, *auth_context, &credsp->keyblock );
 726                 if (retval) {
 727                         DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setuseruserkey failed (%s)\n",
 728                                 error_message(retval)));
 729                         goto cleanup_creds;
 730                 }
 731
 732                 /* Must use a subkey for forwarded tickets. */
 733                 retval = krb5_auth_con_setflags( context, *auth_context, KRB5_AUTH_CONTEXT_USE_SUBKEY);
 734                 if (retval) {
 735                         DEBUG(1,("ads_krb5_mk_req: krb5_auth_con_setflags failed (%s)\n",
 736                                 error_message(retval)));
 737                         goto cleanup_creds;
 738                 }
 739
 740                 retval = ads_krb5_get_fwd_ticket( context,
 741                                                 auth_context,
 742                                                 credsp,
 743                                                 ccache,
 744                                                 &in_data );
 745                 if (retval) {
 746                         DEBUG( 3, ("ads_krb5_get_fwd_ticket failed (%s)\n", error_message( retval ) ) );
 747
 748                         /*
 749                          * This is not fatal. Delete the *auth_context and continue
 750                          * with krb5_mk_req_extended to get a non-forwardable ticket.
 751                          */
 752
 753                         if (in_data.data) {
 754                                 free( in_data.data );
 755                                 in_data.data = NULL;
 756                                 in_data.length = 0;
 757                         }
 758                         krb5_auth_con_free(context, *auth_context);
 759                         *auth_context = NULL;
 760                 }
 761         }
 762 #endif
 763
 764         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 765                                       &in_data, credsp, outbuf);
 766         if (retval) {
 767                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 768                          error_message(retval)));
 769         }
 770
 771         if (in_data.data) {
 772                 free( in_data.data );
 773                 in_data.length = 0;
 774         }
 775
 776         krb5_free_creds(context, credsp);
 777
 778 cleanup_creds:
 779         krb5_free_cred_contents(context, &creds);
 780
 781 cleanup_princ:
 782         krb5_free_principal(context, server);
 783
 784         return retval;
 785 }
 786
 787 /*
 788   get a kerberos5 ticket for the given service
 789 */
 790 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 791                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 792                         uint32 extra_ap_opts, const char *ccname,
 793                         time_t *tgs_expire)
 794
 795 {
 796         krb5_error_code retval;
 797         krb5_data packet;
 798         krb5_context context = NULL;
 799         krb5_ccache ccdef = NULL;
 800         krb5_auth_context auth_context = NULL;
 801         krb5_enctype enc_types[] = {
 802 #ifdef ENCTYPE_ARCFOUR_HMAC
 803                 ENCTYPE_ARCFOUR_HMAC,
 804 #endif
 805                 ENCTYPE_DES_CBC_MD5,
 806                 ENCTYPE_DES_CBC_CRC,
 807                 ENCTYPE_NULL};
 808
 809         initialize_krb5_error_table();
 810         retval = krb5_init_context(&context);
 811         if (retval) {
 812                 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
 813                          error_message(retval)));
 814                 goto failed;
 815         }
 816
 817         if (time_offset != 0) {
 818                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 819         }
 820
 821         if ((retval = krb5_cc_resolve(context, ccname ?
 822                         ccname : krb5_cc_default_name(context), &ccdef))) {
 823                 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
 824                          error_message(retval)));
 825                 goto failed;
 826         }
 827
 828         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 829                 DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
 830                          error_message(retval)));
 831                 goto failed;
 832         }
 833
 834         if ((retval = ads_krb5_mk_req(context,
 835                                         &auth_context,
 836                                         AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 837                                         principal,
 838                                         ccdef, &packet,
 839                                         tgs_expire))) {
 840                 goto failed;
 841         }
 842
 843         get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
 844
 845         *ticket = data_blob(packet.data, packet.length);
 846
 847         kerberos_free_data_contents(context, &packet);
 848
 849 failed:
 850
 851         if ( context ) {
 852                 if (ccdef)
 853                         krb5_cc_close(context, ccdef);
 854                 if (auth_context)
 855                         krb5_auth_con_free(context, auth_context);
 856                 krb5_free_context(context);
 857         }
 858
 859         return retval;
 860 }
 861
 862  bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
 863  {
 864         krb5_keyblock *skey = NULL;
 865         krb5_error_code err = 0;
 866         bool ret = false;
 867
 868         if (remote) {
 869                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 870         } else {
 871                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 872         }
 873
 874         if (err || skey == NULL) {
 875                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 876                 goto done;
 877         }
 878
 879         DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
 880         *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 881         dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 882
 883         ret = true;
 884
 885  done:
 886         if (skey) {
 887                 krb5_free_keyblock(context, skey);
 888         }
 889
 890         return ret;
 891  }
 892
 893
 894 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 895  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 896
 897  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 898 {
 899         static krb5_data kdata;
 900
 901         kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
 902         kdata.length = strlen((const char *)kdata.data);
 903         return &kdata;
 904 }
 905 #endif
 906
 907  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 908 {
 909 /* Try krb5_free_keytab_entry_contents first, since
 910  * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
 911  * krb5_kt_free_entry but only has a prototype for the first, while the
 912  * second is considered private.
 913  */
 914 #if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 915         return krb5_free_keytab_entry_contents(context, kt_entry);
 916 #elif defined(HAVE_KRB5_KT_FREE_ENTRY)
 917         return krb5_kt_free_entry(context, kt_entry);
 918 #else
 919 #error UNKNOWN_KT_FREE_FUNCTION
 920 #endif
 921 }
 922
 923  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 924                                      struct PAC_SIGNATURE_DATA *sig)
 925 {
 926 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 927         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 928         cksum->checksum.length  = sig->signature.length;
 929         cksum->checksum.data    = sig->signature.data;
 930 #else
 931         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 932         cksum->length           = sig->signature.length;
 933         cksum->contents         = sig->signature.data;
 934 #endif
 935 }
 936
 937  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 938                                           const krb5_keyblock *keyblock,
 939                                          krb5_keyusage usage,
 940                                          krb5_checksum *cksum,
 941                                          uint8 *data,
 942                                          size_t length)
 943 {
 944         krb5_error_code ret;
 945
 946         /* verify the checksum */
 947
 948         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 949          *
 950          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 951          * -----------------------------------------------------------------------------
 952          * krb5_c_verify_checksum       -                       works           works
 953          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 954          */
 955
 956 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 957         {
 958                 krb5_boolean checksum_valid = False;
 959                 krb5_data input;
 960
 961                 input.data = (char *)data;
 962                 input.length = length;
 963
 964                 ret = krb5_c_verify_checksum(context,
 965                                              keyblock,
 966                                              usage,
 967                                              &input,
 968                                              cksum,
 969                                              &checksum_valid);
 970                 if (ret) {
 971                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 972                                 error_message(ret)));
 973                         return ret;
 974                 }
 975
 976                 if (!checksum_valid)
 977                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 978         }
 979
 980 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 981
 982         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 983          * without enctype and it ignores any key_usage types - Guenther */
 984
 985         {
 986
 987                 krb5_crypto crypto;
 988                 ret = krb5_crypto_init(context,
 989                                        keyblock,
 990                                        0,
 991                                        &crypto);
 992                 if (ret) {
 993                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 994                                 error_message(ret)));
 995                         return ret;
 996                 }
 997
 998                 ret = krb5_verify_checksum(context,
 999                                            crypto,
1000                                            usage,
1001                                            data,
1002                                            length,
1003                                            cksum);
1004
1005                 krb5_crypto_destroy(context, crypto);
1006         }
1007
1008 #else
1009 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
1010 #endif
1011
1012         return ret;
1013 }
1014
1015  time_t get_authtime_from_tkt(krb5_ticket *tkt)
1016 {
1017 #if defined(HAVE_KRB5_TKT_ENC_PART2)
1018         return tkt->enc_part2->times.authtime;
1019 #else
1020         return tkt->ticket.authtime;
1021 #endif
1022 }
1023
1024 #ifdef HAVE_KRB5_DECODE_AP_REQ  /* Heimdal */
1025 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
1026 {
1027 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
1028         if (ap_req->ticket->enc_part.kvno)
1029                 return ap_req->ticket->enc_part.kvno;
1030 #else /* Heimdal */
1031         if (ap_req->ticket.enc_part.kvno)
1032                 return *ap_req->ticket.enc_part.kvno;
1033 #endif
1034         return 0;
1035 }
1036
1037 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
1038 {
1039 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
1040         return ap_req->ticket.enc_part.etype;
1041 #else /* MIT */
1042         return ap_req->ticket->enc_part.enctype;
1043 #endif
1044 }
1045 #endif  /* HAVE_KRB5_DECODE_AP_REQ */
1046
1047 static krb5_error_code
1048 get_key_from_keytab(krb5_context context,
1049                     krb5_const_principal server,
1050                     krb5_enctype enctype,
1051                     krb5_kvno kvno,
1052                     krb5_keyblock **out_key)
1053 {
1054         krb5_keytab_entry entry;
1055         krb5_error_code ret;
1056         krb5_keytab keytab;
1057         char *name = NULL;
1058
1059         /* We have to open a new keytab handle here, as MIT does
1060            an implicit open/getnext/close on krb5_kt_get_entry. We
1061            may be in the middle of a keytab enumeration when this is
1062            called. JRA. */
1063
1064         ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
1065         if (ret) {
1066                 DEBUG(1,("get_key_from_keytab: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
1067                 return ret;
1068         }
1069
1070         if ( DEBUGLEVEL >= 10 ) {
1071                 if (smb_krb5_unparse_name(context, server, &name) == 0) {
1072                         DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
1073                                 kvno, enctype, name));
1074                         SAFE_FREE(name);
1075                 }
1076         }
1077
1078         ret = krb5_kt_get_entry(context,
1079                                 keytab,
1080                                 server,
1081                                 kvno,
1082                                 enctype,
1083                                 &entry);
1084
1085         if (ret) {
1086                 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
1087                 goto out;
1088         }
1089
1090 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
1091         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
1092 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
1093         ret = krb5_copy_keyblock(context, &entry.key, out_key);
1094 #else
1095 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
1096 #endif
1097
1098         if (ret) {
1099                 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
1100                 goto out;
1101         }
1102
1103         smb_krb5_kt_free_entry(context, &entry);
1104
1105 out:
1106         krb5_kt_close(context, keytab);
1107         return ret;
1108 }
1109
1110 /* Prototypes */
1111
1112  krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
1113                                                  const krb5_data *inbuf,
1114                                                  krb5_kvno *kvno,
1115                                                  krb5_enctype *enctype)
1116 {
1117 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1118         {
1119                 krb5_error_code ret;
1120                 krb5_ap_req ap_req;
1121
1122                 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
1123                 if (ret)
1124                         return ret;
1125
1126                 *kvno = get_kvno_from_ap_req(&ap_req);
1127                 *enctype = get_enctype_from_ap_req(&ap_req);
1128
1129                 free_AP_REQ(&ap_req);
1130                 return 0;
1131         }
1132 #endif
1133
1134         /* Possibly not an appropriate error code. */
1135         return KRB5KDC_ERR_BADOPTION;
1136 }
1137
1138  krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
1139                                                         krb5_auth_context *auth_context,
1140                                                         const krb5_data *inbuf,
1141                                                         krb5_const_principal server,
1142                                                         krb5_keytab keytab,
1143                                                         krb5_flags *ap_req_options,
1144                                                         krb5_ticket **ticket,
1145                                                         krb5_keyblock **keyblock)
1146 {
1147         krb5_error_code ret;
1148         krb5_kvno kvno;
1149         krb5_enctype enctype;
1150         krb5_keyblock *local_keyblock;
1151
1152         ret = krb5_rd_req(context,
1153                           auth_context,
1154                           inbuf,
1155                           server,
1156                           keytab,
1157                           ap_req_options,
1158                           ticket);
1159         if (ret) {
1160                 return ret;
1161         }
1162
1163 #ifdef KRB5_TICKET_HAS_KEYINFO
1164         enctype = (*ticket)->enc_part.enctype;
1165         kvno = (*ticket)->enc_part.kvno;
1166 #else
1167         ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
1168         if (ret) {
1169                 return ret;
1170         }
1171 #endif
1172
1173         ret = get_key_from_keytab(context,
1174                                   server,
1175                                   enctype,
1176                                   kvno,
1177                                   &local_keyblock);
1178         if (ret) {
1179                 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
1180                 goto out;
1181         }
1182
1183 out:
1184         if (ret && local_keyblock != NULL) {
1185                 krb5_free_keyblock(context, local_keyblock);
1186         } else {
1187                 *keyblock = local_keyblock;
1188         }
1189
1190         return ret;
1191 }
1192
1193  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
1194                                             const char *name,
1195                                             krb5_principal *principal)
1196 {
1197 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
1198         return smb_krb5_parse_name_norealm_conv(context, name, principal);
1199 #endif
1200
1201         /* we are cheating here because parse_name will in fact set the realm.
1202          * We don't care as the only caller of smb_krb5_parse_name_norealm
1203          * ignores the realm anyway when calling
1204          * smb_krb5_principal_compare_any_realm later - Guenther */
1205
1206         return smb_krb5_parse_name(context, name, principal);
1207 }
1208
1209  bool smb_krb5_principal_compare_any_realm(krb5_context context,
1210                                           krb5_const_principal princ1,
1211                                           krb5_const_principal princ2)
1212 {
1213 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1214
1215         return krb5_principal_compare_any_realm(context, princ1, princ2);
1216
1217 /* krb5_princ_size is a macro in MIT */
1218 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
1219
1220         int i, len1, len2;
1221         const krb5_data *p1, *p2;
1222
1223         len1 = krb5_princ_size(context, princ1);
1224         len2 = krb5_princ_size(context, princ2);
1225
1226         if (len1 != len2)
1227                 return False;
1228
1229         for (i = 0; i < len1; i++) {
1230
1231                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1232                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1233
1234                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
1235                         return False;
1236         }
1237
1238         return True;
1239 #else
1240 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1241 #endif
1242 }
1243
1244  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
1245                                        const char *client_string,       /* gd@BER.SUSE.DE */
1246                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1247                                        time_t *expire_time)
1248 {
1249         krb5_error_code ret;
1250         krb5_context context = NULL;
1251         krb5_ccache ccache = NULL;
1252         krb5_principal client = NULL;
1253         krb5_creds creds, creds_in, *creds_out = NULL;
1254
1255         ZERO_STRUCT(creds);
1256         ZERO_STRUCT(creds_in);
1257
1258         initialize_krb5_error_table();
1259         ret = krb5_init_context(&context);
1260         if (ret) {
1261                 goto done;
1262         }
1263
1264         if (!ccache_string) {
1265                 ccache_string = krb5_cc_default_name(context);
1266         }
1267
1268         if (!ccache_string) {
1269                 ret = EINVAL;
1270                 goto done;
1271         }
1272
1273         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1274
1275         /* FIXME: we should not fall back to defaults */
1276         ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1277         if (ret) {
1278                 goto done;
1279         }
1280
1281         if (client_string) {
1282                 ret = smb_krb5_parse_name(context, client_string, &client);
1283                 if (ret) {
1284                         goto done;
1285                 }
1286         } else {
1287                 ret = krb5_cc_get_principal(context, ccache, &client);
1288                 if (ret) {
1289                         goto done;
1290                 }
1291         }
1292
1293 #ifdef HAVE_KRB5_GET_RENEWED_CREDS      /* MIT */
1294         {
1295                 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1296                 if (ret) {
1297                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1298                         goto done;
1299                 }
1300         }
1301 #elif defined(HAVE_KRB5_GET_KDC_CRED)   /* Heimdal */
1302         {
1303                 krb5_kdc_flags flags;
1304                 krb5_realm *client_realm = NULL;
1305
1306                 ret = krb5_copy_principal(context, client, &creds_in.client);
1307                 if (ret) {
1308                         goto done;
1309                 }
1310
1311                 if (service_string) {
1312                         ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1313                         if (ret) {
1314                                 goto done;
1315                         }
1316                 } else {
1317                         /* build tgt service by default */
1318                         client_realm = krb5_princ_realm(context, creds_in.client);
1319                         if (!client_realm) {
1320                                 ret = ENOMEM;
1321                                 goto done;
1322                         }
1323                         ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1324                         if (ret) {
1325                                 goto done;
1326                         }
1327                 }
1328
1329                 flags.i = 0;
1330                 flags.b.renewable = flags.b.renew = True;
1331
1332                 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds_out);
1333                 if (ret) {
1334                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1335                         goto done;
1336                 }
1337
1338                 creds = *creds_out;
1339         }
1340 #else
1341 #error NO_SUITABLE_KRB5_TICKET_RENEW_FUNCTION_AVAILABLE
1342 #endif
1343
1344         /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1345         ret = krb5_cc_initialize(context, ccache, client);
1346         if (ret) {
1347                 goto done;
1348         }
1349
1350         ret = krb5_cc_store_cred(context, ccache, &creds);
1351
1352         if (expire_time) {
1353                 *expire_time = (time_t) creds.times.endtime;
1354         }
1355
1356 done:
1357         krb5_free_cred_contents(context, &creds_in);
1358
1359         if (creds_out) {
1360                 krb5_free_creds(context, creds_out);
1361         } else {
1362                 krb5_free_cred_contents(context, &creds);
1363         }
1364
1365         if (client) {
1366                 krb5_free_principal(context, client);
1367         }
1368         if (ccache) {
1369                 krb5_cc_close(context, ccache);
1370         }
1371         if (context) {
1372                 krb5_free_context(context);
1373         }
1374
1375         return ret;
1376 }
1377
1378  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1379 {
1380         krb5_error_code ret = 0;
1381         if (addr == NULL) {
1382                 return ret;
1383         }
1384 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1385         krb5_free_addresses(context, addr->addrs);
1386 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1387         ret = krb5_free_addresses(context, addr->addrs);
1388         SAFE_FREE(addr->addrs);
1389 #endif
1390         SAFE_FREE(addr);
1391         addr = NULL;
1392         return ret;
1393 }
1394
1395  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1396 {
1397         krb5_error_code ret = 0;
1398         nstring buf;
1399 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1400         krb5_address **addrs = NULL;
1401 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1402         krb5_addresses *addrs = NULL;
1403 #endif
1404
1405         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
1406         if (*kerb_addr == NULL) {
1407                 return ENOMEM;
1408         }
1409
1410         put_name(buf, global_myname(), ' ', 0x20);
1411
1412 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1413         {
1414                 int num_addr = 2;
1415
1416                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
1417                 if (addrs == NULL) {
1418                         SAFE_FREE(kerb_addr);
1419                         return ENOMEM;
1420                 }
1421
1422                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
1423
1424                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1425                 if (addrs[0] == NULL) {
1426                         SAFE_FREE(addrs);
1427                         SAFE_FREE(kerb_addr);
1428                         return ENOMEM;
1429                 }
1430
1431                 addrs[0]->magic = KV5M_ADDRESS;
1432                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1433                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
1434                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1435                 if (addrs[0]->contents == NULL) {
1436                         SAFE_FREE(addrs[0]);
1437                         SAFE_FREE(addrs);
1438                         SAFE_FREE(kerb_addr);
1439                         return ENOMEM;
1440                 }
1441
1442                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
1443
1444                 addrs[1] = NULL;
1445         }
1446 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1447         {
1448                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1449                 if (addrs == NULL) {
1450                         SAFE_FREE(kerb_addr);
1451                         return ENOMEM;
1452                 }
1453
1454                 memset(addrs, 0, sizeof(krb5_addresses));
1455
1456                 addrs->len = 1;
1457                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1458                 if (addrs->val == NULL) {
1459                         SAFE_FREE(addrs);
1460                         SAFE_FREE(kerb_addr);
1461                         return ENOMEM;
1462                 }
1463
1464                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1465                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1466                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1467                 if (addrs->val[0].address.data == NULL) {
1468                         SAFE_FREE(addrs->val);
1469                         SAFE_FREE(addrs);
1470                         SAFE_FREE(kerb_addr);
1471                         return ENOMEM;
1472                 }
1473
1474                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1475         }
1476 #else
1477 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1478 #endif
1479         (*kerb_addr)->addrs = addrs;
1480
1481         return ret;
1482 }
1483
1484  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1485 {
1486 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1487         krb5_free_error_contents(context, krberror);
1488 #else /* MIT */
1489         krb5_free_error(context, krberror);
1490 #endif
1491 }
1492
1493  krb5_error_code handle_krberror_packet(krb5_context context,
1494                                         krb5_data *packet)
1495 {
1496         krb5_error_code ret;
1497         bool got_error_code = False;
1498
1499         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1500
1501 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1502         {
1503                 krb5_error krberror;
1504
1505                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1506                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1507                                 error_message(ret)));
1508                         return ret;
1509                 }
1510
1511                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1512                         ret = (krb5_error_code) krberror.error_code;
1513                         got_error_code = True;
1514                 }
1515
1516                 smb_krb5_free_error(context, &krberror);
1517         }
1518 #else /* MIT */
1519         {
1520                 krb5_error *krberror;
1521
1522                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1523                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1524                                 error_message(ret)));
1525                         return ret;
1526                 }
1527
1528                 if (krberror->e_data.data == NULL) {
1529                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1530                         got_error_code = True;
1531                 }
1532                 smb_krb5_free_error(context, krberror);
1533         }
1534 #endif
1535         if (got_error_code) {
1536                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1537                         error_message(ret), ret));
1538         }
1539         return ret;
1540 }
1541
1542  krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1543                                             krb5_get_init_creds_opt **opt)
1544 {
1545 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
1546         /* Heimdal or modern MIT version */
1547         return krb5_get_init_creds_opt_alloc(context, opt);
1548 #else
1549         /* Historical MIT version */
1550         krb5_get_init_creds_opt *my_opt;
1551
1552         *opt = NULL;
1553
1554         if ((my_opt = SMB_MALLOC_P(krb5_get_init_creds_opt)) == NULL) {
1555                 return ENOMEM;
1556         }
1557
1558         krb5_get_init_creds_opt_init(my_opt);
1559
1560         *opt =  my_opt;
1561         return 0;
1562 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC  */
1563 }
1564
1565  void smb_krb5_get_init_creds_opt_free(krb5_context context,
1566                                 krb5_get_init_creds_opt *opt)
1567 {
1568 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
1569
1570 #ifdef KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT
1571         /* Modern MIT or Heimdal version */
1572         krb5_get_init_creds_opt_free(context, opt);
1573 #else
1574         /* Heimdal version */
1575         krb5_get_init_creds_opt_free(opt);
1576 #endif /* KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT */
1577
1578 #else /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1579         /* Historical MIT version */
1580         SAFE_FREE(opt);
1581         opt = NULL;
1582 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1583 }
1584
1585  krb5_enctype smb_get_enctype_from_kt_entry(const krb5_keytab_entry *kt_entry)
1586 {
1587 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
1588         return kt_entry->key.enctype;
1589 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)  /* Heimdal */
1590         return kt_entry->keyblock.keytype;
1591 #else
1592 #error UNKNOWN_KRB5_KEYTAB_ENTRY_KEYBLOCK_FORMAT
1593 #endif
1594 }
1595
1596
1597 /* caller needs to free etype_s */
1598  krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1599                                             krb5_enctype enctype,
1600                                             char **etype_s)
1601 {
1602 #ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1603         return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1604 #elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1605         char buf[256];
1606         krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1607         if (ret) {
1608                 return ret;
1609         }
1610         *etype_s = SMB_STRDUP(buf);
1611         if (!*etype_s) {
1612                 return ENOMEM;
1613         }
1614         return ret;
1615 #else
1616 #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1617 #endif
1618 }
1619
1620  krb5_error_code smb_krb5_mk_error(krb5_context context,
1621                                 krb5_error_code error_code,
1622                                 const krb5_principal server,
1623                                 krb5_data *reply)
1624 {
1625 #ifdef HAVE_SHORT_KRB5_MK_ERROR_INTERFACE /* MIT */
1626         /*
1627          * The MIT interface is *terrible*.
1628          * We have to construct this ourselves...
1629          */
1630         krb5_error e;
1631
1632         memset(&e, 0, sizeof(e));
1633         krb5_us_timeofday(context, &e.stime, &e.susec);
1634         e.server = server;
1635 #if defined(krb5_err_base)
1636         e.error = error_code - krb5_err_base;
1637 #elif defined(ERROR_TABLE_BASE_krb5)
1638         e.error = error_code - ERROR_TABLE_BASE_krb5;
1639 #else
1640         e.error = error_code; /* Almost certainly wrong, but what can we do... ? */
1641 #endif
1642
1643         return krb5_mk_error(context, &e, reply);
1644 #else /* Heimdal. */
1645         return krb5_mk_error(context,
1646                                 error_code,
1647                                 NULL,
1648                                 NULL, /* e_data */
1649                                 NULL,
1650                                 server,
1651                                 NULL,
1652                                 NULL,
1653                                 reply);
1654 #endif
1655 }
1656
1657 /**********************************************************************
1658  * Open a krb5 keytab with flags, handles readonly or readwrite access and
1659  * allows to process non-default keytab names.
1660  * @param context krb5_context
1661  * @param keytab_name_req string
1662  * @param write_access bool if writable keytab is required
1663  * @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1664  * @return krb5_error_code
1665 **********************************************************************/
1666
1667 /* This MAX_NAME_LEN is a constant defined in krb5.h */
1668 #ifndef MAX_KEYTAB_NAME_LEN
1669 #define MAX_KEYTAB_NAME_LEN 1100
1670 #endif
1671
1672  krb5_error_code smb_krb5_open_keytab(krb5_context context,
1673                                       const char *keytab_name_req,
1674                                       bool write_access,
1675                                       krb5_keytab *keytab)
1676 {
1677         krb5_error_code ret = 0;
1678         TALLOC_CTX *mem_ctx;
1679         char keytab_string[MAX_KEYTAB_NAME_LEN];
1680         char *kt_str = NULL;
1681         bool found_valid_name = False;
1682         const char *pragma = "FILE";
1683         const char *tmp = NULL;
1684
1685         if (!write_access && !keytab_name_req) {
1686                 /* caller just wants to read the default keytab readonly, so be it */
1687                 return krb5_kt_default(context, keytab);
1688         }
1689
1690         mem_ctx = talloc_init("smb_krb5_open_keytab");
1691         if (!mem_ctx) {
1692                 return ENOMEM;
1693         }
1694
1695 #ifdef HAVE_WRFILE_KEYTAB
1696         if (write_access) {
1697                 pragma = "WRFILE";
1698         }
1699 #endif
1700
1701         if (keytab_name_req) {
1702
1703                 if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1704                         ret = KRB5_CONFIG_NOTENUFSPACE;
1705                         goto out;
1706                 }
1707
1708                 if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) ||
1709                     (strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1710                         tmp = keytab_name_req;
1711                         goto resolve;
1712                 }
1713
1714                 if (keytab_name_req[0] != '/') {
1715                         ret = KRB5_KT_BADNAME;
1716                         goto out;
1717                 }
1718
1719                 tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1720                 if (!tmp) {
1721                         ret = ENOMEM;
1722                         goto out;
1723                 }
1724
1725                 goto resolve;
1726         }
1727
1728         /* we need to handle more complex keytab_strings, like:
1729          * "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1730
1731         ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1732         if (ret) {
1733                 goto out;
1734         }
1735
1736         DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1737
1738         tmp = talloc_strdup(mem_ctx, keytab_string);
1739         if (!tmp) {
1740                 ret = ENOMEM;
1741                 goto out;
1742         }
1743
1744         if (strncmp(tmp, "ANY:", 4) == 0) {
1745                 tmp += 4;
1746         }
1747
1748         memset(&keytab_string, '\0', sizeof(keytab_string));
1749
1750         while (next_token_talloc(mem_ctx, &tmp, &kt_str, ",")) {
1751                 if (strncmp(kt_str, "WRFILE:", 7) == 0) {
1752                         found_valid_name = True;
1753                         tmp = kt_str;
1754                         tmp += 7;
1755                 }
1756
1757                 if (strncmp(kt_str, "FILE:", 5) == 0) {
1758                         found_valid_name = True;
1759                         tmp = kt_str;
1760                         tmp += 5;
1761                 }
1762
1763                 if (tmp[0] == '/') {
1764                         /* Treat as a FILE: keytab definition. */
1765                         found_valid_name = true;
1766                 }
1767
1768                 if (found_valid_name) {
1769                         if (tmp[0] != '/') {
1770                                 ret = KRB5_KT_BADNAME;
1771                                 goto out;
1772                         }
1773
1774                         tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1775                         if (!tmp) {
1776                                 ret = ENOMEM;
1777                                 goto out;
1778                         }
1779                         break;
1780                 }
1781         }
1782
1783         if (!found_valid_name) {
1784                 ret = KRB5_KT_UNKNOWN_TYPE;
1785                 goto out;
1786         }
1787
1788  resolve:
1789         DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1790         ret = krb5_kt_resolve(context, tmp, keytab);
1791
1792  out:
1793         TALLOC_FREE(mem_ctx);
1794         return ret;
1795 }
1796
1797 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
1798 /**************************************************************
1799 Routine: ads_krb5_get_fwd_ticket
1800  Description:
1801     When a service ticket is flagged as trusted
1802     for delegation we should provide a forwardable
1803     ticket so that the remote host can act on our
1804     behalf.  This is done by taking the 2nd forwardable
1805     TGT and storing it in the GSS-API authenticator
1806     "checksum".  This routine will populate
1807     the krb5_data authenticator with this TGT.
1808  Parameters:
1809     krb5_context context: The kerberos context for this authentication.
1810     krb5_auth_context:    The authentication context.
1811     krb5_creds *credsp:   The ticket credentials (AS-REP).
1812     krb5_ccache ccache:   The credentials cache.
1813     krb5_data &authenticator: The checksum field that will store the TGT, and
1814      authenticator.data must be freed by the caller.
1815
1816  Returns:
1817     krb5_error_code: 0 if no errors, otherwise set.
1818 **************************************************************/
1819
1820 static krb5_error_code ads_krb5_get_fwd_ticket( krb5_context context,
1821                                          krb5_auth_context *auth_context,
1822                                          krb5_creds *credsp,
1823                                          krb5_ccache ccache,
1824                                          krb5_data *authenticator)
1825 {
1826         krb5_data fwdData;
1827         krb5_error_code retval = 0;
1828         char *pChksum = NULL;
1829         char *p = NULL;
1830
1831 /* MIT krb5 1.7beta3 (in Ubuntu Karmic) is missing the prototype,
1832    but still has the symbol */
1833 #if !HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE
1834 krb5_error_code krb5_auth_con_set_req_cksumtype(
1835         krb5_context     context,
1836         krb5_auth_context      auth_context,
1837         krb5_cksumtype     cksumtype);
1838 #endif
1839
1840         ZERO_STRUCT(fwdData);
1841         ZERO_STRUCTP(authenticator);
1842
1843         retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
1844                                 *auth_context,  /* Authentication context [in] */
1845                                 CONST_DISCARD(char *, KRB5_TGS_NAME),  /* Ticket service name ("krbtgt") [in] */
1846                                 credsp->client, /* Client principal for the tgt [in] */
1847                                 credsp->server, /* Server principal for the tgt [in] */
1848                                 ccache,         /* Credential cache to use for storage [in] */
1849                                 1,              /* Turn on for "Forwardable ticket" [in] */
1850                                 &fwdData );     /* Resulting response [out] */
1851
1852
1853         if (retval) {
1854                 DEBUG(1,("ads_krb5_get_fwd_ticket: krb5_fwd_tgt_creds failed (%s)\n",
1855                         error_message(retval)));
1856                 goto out;
1857         }
1858
1859         if ((unsigned int)GSSAPI_CHECKSUM_SIZE + (unsigned int)fwdData.length <
1860                 (unsigned int)GSSAPI_CHECKSUM_SIZE) {
1861                 retval = EINVAL;
1862                 goto out;
1863         }
1864
1865         /* We're going to allocate a gssChecksum structure with a little
1866            extra data the length of the kerberos credentials length
1867            (APPLICATION 22) so that we can pack it on the end of the structure.
1868         */
1869
1870         pChksum = (char *)SMB_MALLOC(GSSAPI_CHECKSUM_SIZE + fwdData.length );
1871         if (!pChksum) {
1872                 retval = ENOMEM;
1873                 goto out;
1874         }
1875
1876         p = pChksum;
1877
1878         SIVAL(p, 0, GSSAPI_BNDLENGTH);
1879         p += 4;
1880
1881         /* Zero out the bindings fields */
1882         memset(p, '\0', GSSAPI_BNDLENGTH );
1883         p += GSSAPI_BNDLENGTH;
1884
1885         SIVAL(p, 0, GSS_C_DELEG_FLAG );
1886         p += 4;
1887         SSVAL(p, 0, 1 );
1888         p += 2;
1889         SSVAL(p, 0, fwdData.length );
1890         p += 2;
1891
1892         /* Migrate the kerberos KRB_CRED data to the checksum delegation */
1893         memcpy(p, fwdData.data, fwdData.length );
1894         p += fwdData.length;
1895
1896         /* We need to do this in order to allow our GSS-API  */
1897         retval = krb5_auth_con_set_req_cksumtype( context, *auth_context, GSSAPI_CHECKSUM );
1898         if (retval) {
1899                 goto out;
1900         }
1901
1902         /* We now have a service ticket, now turn it into an AP-REQ. */
1903         authenticator->length = fwdData.length + GSSAPI_CHECKSUM_SIZE;
1904
1905         /* Caller should call free() when they're done with this. */
1906         authenticator->data = (char *)pChksum;
1907
1908   out:
1909
1910         /* Remove that input data, we never needed it anyway. */
1911         if (fwdData.length > 0) {
1912                 krb5_free_data_contents( context, &fwdData );
1913         }
1914
1915         return retval;
1916 }
1917 #endif
1918
1919 #else /* HAVE_KRB5 */
1920  /* this saves a few linking headaches */
1921  int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1922                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1923                         const char *ccname, time_t *tgs_expire)
1924 {
1925          DEBUG(0,("NO KERBEROS SUPPORT\n"));
1926          return 1;
1927 }
1928
1929 #endif