2 Unix SMB/CIFS implementation.
3 kerberos utility library
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001
6 Copyright (C) Luke Howard 2003
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 verify an incoming ticket and parse out the principal name and
29 authorization_data if available
31 NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket,
32 char **principal, DATA_BLOB *auth_data,
34 uint8 session_key[16])
36 NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
37 krb5_context context = NULL;
38 krb5_auth_context auth_context = NULL;
39 krb5_keytab keytab = NULL;
41 krb5_ticket *tkt = NULL;
42 krb5_rcache rcache = NULL;
44 krb5_keyblock *key = NULL;
45 krb5_principal host_princ;
46 char *host_princ_s = NULL;
48 char *password_s = NULL;
50 krb5_enctype *enctypes = NULL;
52 krb5_address local_addr;
53 krb5_address remote_addr;
58 ZERO_STRUCT(password);
59 ZERO_STRUCTP(auth_data);
62 if (!secrets_init()) {
63 DEBUG(1,("ads_verify_ticket: secrets_init failed\n"));
64 return NT_STATUS_LOGON_FAILURE;
67 password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
69 DEBUG(1,("ads_verify_ticket: failed to fetch machine password\n"));
70 return NT_STATUS_LOGON_FAILURE;
73 password.data = password_s;
74 password.length = strlen(password_s);
76 ret = krb5_init_context(&context);
78 DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
79 return NT_STATUS_LOGON_FAILURE;
82 ret = krb5_set_default_realm(context, ads->auth.realm);
84 DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
85 sret = NT_STATUS_LOGON_FAILURE;
89 /* This whole process is far more complex than I would
90 like. We have to go through all this to allow us to store
91 the secret internally, instead of using /etc/krb5.keytab */
93 ret = krb5_auth_con_init(context, &auth_context);
95 DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
96 sret = NT_STATUS_LOGON_FAILURE;
100 fstrcpy(myname, global_myname());
102 asprintf(&host_princ_s, "HOST/%s@%s", myname, lp_realm());
103 ret = krb5_parse_name(context, host_princ_s, &host_princ);
105 DEBUG(1,("ads_verify_ticket: krb5_parse_name(%s) failed (%s)\n",
106 host_princ_s, error_message(ret)));
107 sret = NT_STATUS_LOGON_FAILURE;
112 * JRA. We must set the rcache here. This will prevent replay attacks.
115 ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache);
117 DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache failed (%s)\n", error_message(ret)));
118 sret = NT_STATUS_LOGON_FAILURE;
122 ret = krb5_auth_con_setrcache(context, auth_context, rcache);
124 DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache failed (%s)\n", error_message(ret)));
125 sret = NT_STATUS_LOGON_FAILURE;
129 /* CIFS doesn't use addresses in tickets. This would breat NAT. JRA */
131 if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) {
132 sret = NT_STATUS_NO_MEMORY;
136 if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) {
137 DEBUG(1,("ads_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n",
138 error_message(ret)));
139 sret = NT_STATUS_LOGON_FAILURE;
143 /* Lock a mutex surrounding the replay as there is no locking in the MIT krb5
144 * code surrounding the replay cache... */
146 if (!grab_server_mutex("replay cache mutex")) {
147 DEBUG(1,("ads_verify_ticket: unable to protect replay cache with mutex.\n"));
148 sret = NT_STATUS_LOGON_FAILURE;
152 /* We need to setup a auth context with each possible encoding type in turn. */
153 for (i=0;enctypes[i];i++) {
154 if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) {
158 krb5_auth_con_setuseruserkey(context, auth_context, key);
160 packet.length = ticket->length;
161 packet.data = (krb5_pointer)ticket->data;
163 if (!(ret = krb5_rd_req(context, &auth_context, &packet,
164 NULL, keytab, NULL, &tkt))) {
165 DEBUG(10,("ads_verify_ticket: enc type [%u] decrypted message !\n",
166 (unsigned int)enctypes[i] ));
167 free_kerberos_etypes(context, enctypes);
172 DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
173 ("ads_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
174 (unsigned int)enctypes[i], error_message(ret)));
177 release_server_mutex();
180 DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n",
181 error_message(ret)));
182 sret = NT_STATUS_LOGON_FAILURE;
186 ret = krb5_mk_rep(context, auth_context, &packet);
188 DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
189 error_message(ret)));
190 sret = NT_STATUS_LOGON_FAILURE;
194 *ap_rep = data_blob(packet.data, packet.length);
197 get_krb5_smb_session_key(context, auth_context, session_key, True);
198 #ifdef DEBUG_PASSWORD
199 DEBUG(10,("SMB session key (from ticket) follows:\n"));
200 dump_data(10, session_key, 16);
204 file_save("/tmp/ticket.dat", ticket->data, ticket->length);
207 get_auth_data_from_tkt(auth_data, tkt);
210 TALLOC_CTX *ctx = talloc_init("pac data");
211 decode_pac_data(auth_data, ctx);
216 if (tkt->enc_part2) {
217 file_save("/tmp/authdata.dat",
218 tkt->enc_part2->authorization_data[0]->contents,
219 tkt->enc_part2->authorization_data[0]->length);
222 if ((ret = krb5_unparse_name(context, get_principal_from_tkt(tkt),
224 DEBUG(3,("ads_verify_ticket: krb5_unparse_name failed (%s)\n",
225 error_message(ret)));
226 sret = NT_STATUS_LOGON_FAILURE;
234 if (!NT_STATUS_IS_OK(sret))
235 data_blob_free(auth_data);
237 if (!NT_STATUS_IS_OK(sret))
238 data_blob_free(ap_rep);
240 SAFE_FREE(host_princ_s);
241 SAFE_FREE(password_s);
244 krb5_auth_con_free(context, auth_context);
247 krb5_free_context(context);
252 #endif /* HAVE_KRB5 */