source4/libcli/auth/gensec_krb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos backend for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Luke Howard 2002-2003
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program; if not, write to the Free Software
  23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24 */
  25
  26 #include "includes.h"
  27 #include "system/kerberos.h"
  28 #include "system/time.h"
  29 #include "libcli/auth/kerberos.h"
  30 #include "librpc/gen_ndr/ndr_krb5pac.h"
  31 #include "auth/auth.h"
  32 #include "asn_1.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_AUTH
  36
  37 enum GENSEC_KRB5_STATE {
  38         GENSEC_KRB5_SERVER_START,
  39         GENSEC_KRB5_CLIENT_START,
  40         GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
  41         GENSEC_KRB5_DONE
  42 };
  43
  44 struct gensec_krb5_state {
  45         DATA_BLOB session_key;
  46         DATA_BLOB pac;
  47         enum GENSEC_KRB5_STATE state_position;
  48         krb5_context krb5_context;
  49         krb5_auth_context krb5_auth_context;
  50         krb5_ccache krb5_ccache;
  51         krb5_data ticket;
  52         krb5_keyblock krb5_keyblock;
  53         char *peer_principal;
  54 };
  55
  56 #ifdef KRB5_DO_VERIFY_PAC
  57 static NTSTATUS gensec_krb5_pac_checksum(DATA_BLOB pac_data,
  58                                             struct PAC_SIGNATURE_DATA *sig,
  59                                             struct gensec_krb5_state *gensec_krb5_state,
  60                                             uint32 keyusage)
  61 {
  62         krb5_error_code ret;
  63         krb5_crypto crypto;
  64         Checksum cksum;
  65         int i;
  66
  67         cksum.cksumtype         = (CKSUMTYPE)sig->type;
  68         cksum.checksum.length   = sizeof(sig->signature);
  69         cksum.checksum.data     = sig->signature;
  70
  71
  72         ret = krb5_crypto_init(gensec_krb5_state->krb5_context,
  73                                 &gensec_krb5_state->krb5_keyblock,
  74                                 0,
  75                                 &crypto);
  76         if (ret) {
  77                 DEBUG(0,("krb5_crypto_init() failed\n"));
  78                 return NT_STATUS_FOOBAR;
  79         }
  80         for (i=0; i < 40; i++) {
  81                 keyusage = i;
  82                 ret = krb5_verify_checksum(gensec_krb5_state->krb5_context,
  83                                            crypto,
  84                                            keyusage,
  85                                            pac_data.data,
  86                                            pac_data.length,
  87                                            &cksum);
  88                 if (!ret) {
  89                         DEBUG(0,("PAC Verified: keyusage: %d\n", keyusage));
  90                         break;
  91                 }
  92         }
  93         krb5_crypto_destroy(gensec_krb5_state->krb5_context, crypto);
  94
  95         if (ret) {
  96                 DEBUG(0,("NOT verifying PAC checksums yet!\n"));
  97                 //return NT_STATUS_LOGON_FAILURE;
  98         } else {
  99                 DEBUG(0,("PAC checksums verified!\n"));
 100         }
 101
 102         return NT_STATUS_OK;
 103 }
 104 #endif
 105
 106 static NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
 107                                 struct PAC_LOGON_INFO **logon_info_out,
 108                                 DATA_BLOB blob,
 109                                 struct gensec_krb5_state *gensec_krb5_state)
 110 {
 111         NTSTATUS status;
 112         struct PAC_SIGNATURE_DATA srv_sig;
 113         struct PAC_SIGNATURE_DATA *srv_sig_ptr;
 114         struct PAC_SIGNATURE_DATA kdc_sig;
 115         struct PAC_SIGNATURE_DATA *kdc_sig_ptr;
 116         struct PAC_LOGON_INFO *logon_info = NULL;
 117         struct PAC_DATA pac_data;
 118 #ifdef KRB5_DO_VERIFY_PAC
 119         DATA_BLOB tmp_blob = data_blob(NULL, 0);
 120 #endif
 121         int i;
 122
 123         status = ndr_pull_struct_blob(&blob, mem_ctx, &pac_data,
 124                                         (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
 125         if (!NT_STATUS_IS_OK(status)) {
 126                 DEBUG(0,("can't parse the PAC\n"));
 127                 return status;
 128         }
 129         NDR_PRINT_DEBUG(PAC_DATA, &pac_data);
 130
 131         if (pac_data.num_buffers < 3) {
 132                 /* we need logon_ingo, service_key and kdc_key */
 133                 DEBUG(0,("less than 3 PAC buffers\n"));
 134                 return NT_STATUS_FOOBAR;
 135         }
 136
 137         for (i=0; i < pac_data.num_buffers; i++) {
 138                 switch (pac_data.buffers[i].type) {
 139                         case PAC_TYPE_LOGON_INFO:
 140                                 if (!pac_data.buffers[i].info) {
 141                                         break;
 142                                 }
 143                                 logon_info = &pac_data.buffers[i].info->logon_info;
 144                                 break;
 145                         case PAC_TYPE_SRV_CHECKSUM:
 146                                 if (!pac_data.buffers[i].info) {
 147                                         break;
 148                                 }
 149                                 srv_sig_ptr = &pac_data.buffers[i].info->srv_cksum;
 150                                 srv_sig = pac_data.buffers[i].info->srv_cksum;
 151                                 break;
 152                         case PAC_TYPE_KDC_CHECKSUM:
 153                                 if (!pac_data.buffers[i].info) {
 154                                         break;
 155                                 }
 156                                 kdc_sig_ptr = &pac_data.buffers[i].info->kdc_cksum;
 157                                 kdc_sig = pac_data.buffers[i].info->kdc_cksum;
 158                                 break;
 159                         case PAC_TYPE_UNKNOWN_10:
 160                                 break;
 161                         default:
 162                                 break;
 163                 }
 164         }
 165
 166         if (!logon_info) {
 167                 DEBUG(0,("PAC no logon_info\n"));
 168                 return NT_STATUS_FOOBAR;
 169         }
 170
 171         if (!srv_sig_ptr) {
 172                 DEBUG(0,("PAC no srv_key\n"));
 173                 return NT_STATUS_FOOBAR;
 174         }
 175
 176         if (!kdc_sig_ptr) {
 177                 DEBUG(0,("PAC no kdc_key\n"));
 178                 return NT_STATUS_FOOBAR;
 179         }
 180 #ifdef KRB5_DO_VERIFY_PAC
 181         /* clear the kdc_key */
 182 /*      memset((void *)kdc_sig_ptr , '\0', sizeof(*kdc_sig_ptr));*/
 183
 184         status = ndr_push_struct_blob(&tmp_blob, mem_ctx, &pac_data,
 185                                               (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
 186         if (!NT_STATUS_IS_OK(status)) {
 187                 return status;
 188         }
 189         status = ndr_pull_struct_blob(&tmp_blob, mem_ctx, &pac_data,
 190                                         (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
 191         if (!NT_STATUS_IS_OK(status)) {
 192                 DEBUG(0,("can't parse the PAC\n"));
 193                 return status;
 194         }
 195         /*NDR_PRINT_DEBUG(PAC_DATA, &pac_data);*/
 196
 197         /* verify by kdc_key */
 198         status = gensec_krb5_pac_checksum(tmp_blob, &kdc_sig, gensec_krb5_state, 0);
 199
 200         if (!NT_STATUS_IS_OK(status)) {
 201                 return status;
 202         }
 203
 204         /* clear the service_key */
 205 /*      memset((void *)srv_sig_ptr , '\0', sizeof(*srv_sig_ptr));*/
 206
 207         status = ndr_push_struct_blob(&tmp_blob, mem_ctx, &pac_data,
 208                                               (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
 209         if (!NT_STATUS_IS_OK(status)) {
 210                 return status;
 211         }
 212         status = ndr_pull_struct_blob(&tmp_blob, mem_ctx, &pac_data,
 213                                         (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
 214         if (!NT_STATUS_IS_OK(status)) {
 215                 DEBUG(0,("can't parse the PAC\n"));
 216                 return status;
 217         }
 218         NDR_PRINT_DEBUG(PAC_DATA, &pac_data);
 219
 220         /* verify by servie_key */
 221         status = gensec_krb5_pac_checksum(tmp_blob, &srv_sig, gensec_krb5_state, 0);
 222
 223         if (!NT_STATUS_IS_OK(status)) {
 224                 return status;
 225         }
 226 #endif
 227         DEBUG(0,("account_name: %s [%s]\n",logon_info->account_name.string, logon_info->full_name.string));
 228         *logon_info_out = logon_info;
 229
 230         return status;
 231 }
 232
 233 static void gensec_krb5_end(struct gensec_security *gensec_security)
 234 {
 235         struct gensec_krb5_state *gensec_krb5_state = gensec_security->private_data;
 236
 237         if (gensec_krb5_state->ticket.length) {
 238         /* Hmm, early heimdal dooesn't have this - correct call would be krb5_data_free */
 239 #ifdef HAVE_KRB5_FREE_DATA_CONTENTS
 240                 krb5_free_data_contents(gensec_krb5_state->krb5_context, &gensec_krb5_state->ticket);
 241 #endif
 242         }
 243         if (gensec_krb5_state->krb5_ccache) {
 244                 /* current heimdal - 0.6.3, which we need anyway, fixes segfaults here */
 245                 krb5_cc_close(gensec_krb5_state->krb5_context, gensec_krb5_state->krb5_ccache);
 246         }
 247
 248         krb5_free_keyblock_contents(gensec_krb5_state->krb5_context,
 249                                     &gensec_krb5_state->krb5_keyblock);
 250
 251         if (gensec_krb5_state->krb5_auth_context) {
 252                 krb5_auth_con_free(gensec_krb5_state->krb5_context,
 253                                    gensec_krb5_state->krb5_auth_context);
 254         }
 255
 256         if (gensec_krb5_state->krb5_context) {
 257                 krb5_free_context(gensec_krb5_state->krb5_context);
 258         }
 259
 260         talloc_free(gensec_krb5_state);
 261         gensec_security->private_data = NULL;
 262 }
 263
 264
 265 static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security)
 266 {
 267         struct gensec_krb5_state *gensec_krb5_state;
 268         krb5_error_code ret = 0;
 269
 270         gensec_krb5_state = talloc_p(gensec_security, struct gensec_krb5_state);
 271         if (!gensec_krb5_state) {
 272                 return NT_STATUS_NO_MEMORY;
 273         }
 274
 275         gensec_security->private_data = gensec_krb5_state;
 276
 277         initialize_krb5_error_table();
 278         gensec_krb5_state->krb5_context = NULL;
 279         gensec_krb5_state->krb5_auth_context = NULL;
 280         gensec_krb5_state->krb5_ccache = NULL;
 281         ZERO_STRUCT(gensec_krb5_state->ticket);
 282         ZERO_STRUCT(gensec_krb5_state->krb5_keyblock);
 283         gensec_krb5_state->session_key = data_blob(NULL, 0);
 284         gensec_krb5_state->pac = data_blob(NULL, 0);
 285
 286         ret = krb5_init_context(&gensec_krb5_state->krb5_context);
 287         if (ret) {
 288                 DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n", error_message(ret)));
 289                 return NT_STATUS_INTERNAL_ERROR;
 290         }
 291
 292         if (lp_realm() && *lp_realm()) {
 293                 ret = krb5_set_default_realm(gensec_krb5_state->krb5_context, lp_realm());
 294                 if (ret) {
 295                         DEBUG(1,("gensec_krb5_start: krb5_set_default_realm failed (%s)\n", error_message(ret)));
 296                         return NT_STATUS_INTERNAL_ERROR;
 297                 }
 298         }
 299
 300         ret = krb5_auth_con_init(gensec_krb5_state->krb5_context, &gensec_krb5_state->krb5_auth_context);
 301         if (ret) {
 302                 DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n", error_message(ret)));
 303                 return NT_STATUS_INTERNAL_ERROR;
 304         }
 305
 306         return NT_STATUS_OK;
 307 }
 308
 309 static NTSTATUS gensec_krb5_server_start(struct gensec_security *gensec_security)
 310 {
 311         NTSTATUS nt_status;
 312         struct gensec_krb5_state *gensec_krb5_state;
 313
 314         nt_status = gensec_krb5_start(gensec_security);
 315         if (!NT_STATUS_IS_OK(nt_status)) {
 316                 return nt_status;
 317         }
 318
 319         gensec_krb5_state = gensec_security->private_data;
 320         gensec_krb5_state->state_position = GENSEC_KRB5_SERVER_START;
 321
 322         return NT_STATUS_OK;
 323 }
 324
 325 static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security)
 326 {
 327         struct gensec_krb5_state *gensec_krb5_state;
 328         krb5_error_code ret;
 329         NTSTATUS nt_status;
 330
 331         nt_status = gensec_krb5_start(gensec_security);
 332         if (!NT_STATUS_IS_OK(nt_status)) {
 333                 return nt_status;
 334         }
 335
 336         gensec_krb5_state = gensec_security->private_data;
 337         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_START;
 338
 339         /* TODO: This is effecivly a static/global variable... */
 340         ret = krb5_cc_default(gensec_krb5_state->krb5_context, &gensec_krb5_state->krb5_ccache);
 341         if (ret) {
 342                 DEBUG(1,("krb5_cc_default failed (%s)\n",
 343                          error_message(ret)));
 344                 return NT_STATUS_INTERNAL_ERROR;
 345         }
 346
 347         while (1) {
 348                 if (gensec_security->target.principal) {
 349                         DEBUG(5, ("Finding ticket for target [%s]\n", gensec_security->target.principal));
 350                         ret = ads_krb5_mk_req(gensec_krb5_state->krb5_context,
 351                                               &gensec_krb5_state->krb5_auth_context,
 352                                               AP_OPTS_USE_SUBKEY | AP_OPTS_MUTUAL_REQUIRED,
 353                                               gensec_security->target.principal,
 354                                               gensec_krb5_state->krb5_ccache,
 355                                               &gensec_krb5_state->ticket);
 356                         if (ret) {
 357                                 DEBUG(1,("ads_krb5_mk_req failed (%s)\n",
 358                                          error_message(ret)));
 359                         }
 360                 } else {
 361                         krb5_data in_data;
 362                         const char *hostname = gensec_get_target_hostname(gensec_security);
 363                         if (!hostname) {
 364                                 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
 365                                 return NT_STATUS_ACCESS_DENIED;
 366                         }
 367
 368                         in_data.length = 0;
 369
 370                         ret = krb5_mk_req(gensec_krb5_state->krb5_context,
 371                                           &gensec_krb5_state->krb5_auth_context,
 372                                           AP_OPTS_USE_SUBKEY | AP_OPTS_MUTUAL_REQUIRED,
 373                                           gensec_get_target_service(gensec_security),
 374                                           hostname,
 375                                           &in_data, gensec_krb5_state->krb5_ccache,
 376                                           &gensec_krb5_state->ticket);
 377                         if (ret) {
 378                                 DEBUG(1,("krb5_mk_req failed (%s)\n",
 379                                          error_message(ret)));
 380                         }
 381
 382                 }
 383                 switch (ret) {
 384                 case 0:
 385                         return NT_STATUS_OK;
 386                 case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 387                         DEBUG(3, ("Server is not registered with our KDC: %s\n",
 388                                   error_message(ret)));
 389                         return NT_STATUS_ACCESS_DENIED;
 390                 case KRB5KDC_ERR_PREAUTH_FAILED:
 391                 case KRB5KRB_AP_ERR_TKT_EXPIRED:
 392                 case KRB5_CC_END:
 393                 {
 394                         DEBUG(3, ("kerberos: %s\n",
 395                                   error_message(ret)));
 396                         /* fall down to remaining code */
 397                 }
 398                 /* just don't print a message for these really ordinary messages */
 399                 case KRB5_FCC_NOFILE:
 400                 case KRB5_CC_NOTFOUND:
 401                 {
 402                         char *password;
 403                         time_t kdc_time = 0;
 404                         nt_status = gensec_get_password(gensec_security,
 405                                                         gensec_security,
 406                                                         &password);
 407                         if (!NT_STATUS_IS_OK(nt_status)) {
 408                                 return nt_status;
 409                         }
 410
 411                         ret = kerberos_kinit_password_cc(gensec_krb5_state->krb5_context, gensec_krb5_state->krb5_ccache,
 412                                                          gensec_get_client_principal(gensec_security, gensec_security),
 413                                                          password, NULL, &kdc_time);
 414
 415                         /* cope with ticket being in the future due to clock skew */
 416                         if ((unsigned)kdc_time > time(NULL)) {
 417                                 time_t t = time(NULL);
 418                                 int time_offset =(unsigned)kdc_time-t;
 419                                 DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 420                                 krb5_set_real_time(gensec_krb5_state->krb5_context, t + time_offset + 1, 0);
 421                         }
 422
 423                         if (ret) {
 424                                 DEBUG(1,("kinit failed (%s)\n",
 425                                          error_message(ret)));
 426                                 return NT_STATUS_WRONG_PASSWORD;
 427                         }
 428                         break;
 429                 }
 430                 default:
 431                         DEBUG(0, ("kerberos: %s\n",
 432                                   error_message(ret)));
 433                         return NT_STATUS_UNSUCCESSFUL;
 434                 }
 435         }
 436 }
 437
 438
 439 /**
 440  * Next state function for the Krb5 GENSEC mechanism
 441  *
 442  * @param gensec_krb5_state KRB5 State
 443  * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
 444  * @param in The request, as a DATA_BLOB
 445  * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
 446  * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
 447  *                or NT_STATUS_OK if the user is authenticated.
 448  */
 449
 450 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
 451                                       const DATA_BLOB in, DATA_BLOB *out)
 452 {
 453         struct gensec_krb5_state *gensec_krb5_state = gensec_security->private_data;
 454         krb5_error_code ret = 0;
 455         DATA_BLOB pac;
 456         NTSTATUS nt_status;
 457
 458         switch (gensec_krb5_state->state_position) {
 459         case GENSEC_KRB5_CLIENT_START:
 460         {
 461                 if (ret) {
 462                         DEBUG(1,("ads_krb5_mk_req (request ticket) failed (%s)\n",
 463                                  error_message(ret)));
 464                         nt_status = NT_STATUS_LOGON_FAILURE;
 465                 } else {
 466                         DATA_BLOB unwrapped_out;
 467
 468 #ifndef GENSEC_SEND_UNWRAPPED_KRB5 /* This should be a switch for the torture code to set */
 469                         unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->ticket.data, gensec_krb5_state->ticket.length);
 470
 471                         /* wrap that up in a nice GSS-API wrapping */
 472                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REQ);
 473 #else
 474                         *out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->ticket.data, gensec_krb5_state->ticket.length);
 475 #endif
 476                         gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_MUTUAL_AUTH;
 477                         nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 478                 }
 479
 480                 return nt_status;
 481         }
 482
 483         case GENSEC_KRB5_CLIENT_MUTUAL_AUTH:
 484         {
 485                 krb5_data inbuf;
 486                 krb5_ap_rep_enc_part *repl = NULL;
 487                 uint8 tok_id[2];
 488                 DATA_BLOB unwrapped_in;
 489
 490                 if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 491                         DEBUG(1,("gensec_gssapi_parse_krb5_wrap(mutual authentication) failed to parse\n"));
 492                         dump_data_pw("Mutual authentication message:\n", in.data, in.length);
 493                         return NT_STATUS_INVALID_PARAMETER;
 494                 }
 495                 /* TODO: check the tok_id */
 496
 497                 inbuf.data = unwrapped_in.data;
 498                 inbuf.length = unwrapped_in.length;
 499                 ret = krb5_rd_rep(gensec_krb5_state->krb5_context,
 500                                   gensec_krb5_state->krb5_auth_context,
 501                                   &inbuf, &repl);
 502                 if (ret) {
 503                         DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
 504                                  error_message(ret)));
 505                         dump_data_pw("Mutual authentication message:\n", inbuf.data, inbuf.length);
 506                         nt_status = NT_STATUS_ACCESS_DENIED;
 507                 } else {
 508                         *out = data_blob(NULL, 0);
 509                         nt_status = NT_STATUS_OK;
 510                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 511                 }
 512                 if (repl) {
 513                         krb5_free_ap_rep_enc_part(gensec_krb5_state->krb5_context, repl);
 514                 }
 515                 return nt_status;
 516         }
 517
 518         case GENSEC_KRB5_SERVER_START:
 519         {
 520                 char *principal;
 521                 DATA_BLOB unwrapped_in;
 522                 DATA_BLOB unwrapped_out;
 523                 uint8 tok_id[2];
 524
 525                 /* Parse the GSSAPI wrapping, if it's there... (win2k3 allows it to be omited) */
 526                 if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
 527                         nt_status = ads_verify_ticket(out_mem_ctx,
 528                                                       gensec_krb5_state->krb5_context,
 529                                                       gensec_krb5_state->krb5_auth_context,
 530                                                       lp_realm(), &in,
 531                                                       &principal, &pac, &unwrapped_out,
 532                                                       &gensec_krb5_state->krb5_keyblock);
 533                 } else {
 534                         /* TODO: check the tok_id */
 535                         nt_status = ads_verify_ticket(out_mem_ctx,
 536                                                       gensec_krb5_state->krb5_context,
 537                                                       gensec_krb5_state->krb5_auth_context,
 538                                                       lp_realm(), &unwrapped_in,
 539                                                       &principal, &pac, &unwrapped_out,
 540                                                       &gensec_krb5_state->krb5_keyblock);
 541                 }
 542
 543                 if (!NT_STATUS_IS_OK(nt_status)) {
 544                         return nt_status;
 545                 }
 546
 547                 if (pac.data) {
 548                         gensec_krb5_state->pac = data_blob_talloc_reference(gensec_krb5_state, &pac);
 549                 }
 550
 551                 if (NT_STATUS_IS_OK(nt_status)) {
 552                         gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
 553                         /* wrap that up in a nice GSS-API wrapping */
 554                         *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REP);
 555
 556                         gensec_krb5_state->peer_principal = talloc_steal(gensec_krb5_state, principal);
 557                 }
 558                 return nt_status;
 559         }
 560         case GENSEC_KRB5_DONE:
 561                 return NT_STATUS_OK;
 562         }
 563
 564         return NT_STATUS_INVALID_PARAMETER;
 565 }
 566
 567 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security,
 568                                            DATA_BLOB *session_key)
 569 {
 570         struct gensec_krb5_state *gensec_krb5_state = gensec_security->private_data;
 571         krb5_context context = gensec_krb5_state->krb5_context;
 572         krb5_auth_context auth_context = gensec_krb5_state->krb5_auth_context;
 573         krb5_keyblock *skey;
 574         krb5_error_code err;
 575
 576         if (gensec_krb5_state->session_key.data) {
 577                 *session_key = gensec_krb5_state->session_key;
 578                 return NT_STATUS_OK;
 579         }
 580
 581         switch (gensec_security->gensec_role) {
 582         case GENSEC_CLIENT:
 583                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 584                 break;
 585         case GENSEC_SERVER:
 586                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 587                 break;
 588         }
 589         if (err == 0 && skey != NULL) {
 590                 DEBUG(10, ("Got KRB5 session key of length %d\n",  KRB5_KEY_LENGTH(skey)));
 591                 gensec_krb5_state->session_key = data_blob_talloc(gensec_krb5_state,
 592                                                 KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 593                 *session_key = gensec_krb5_state->session_key;
 594                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 595
 596                 krb5_free_keyblock(context, skey);
 597                 return NT_STATUS_OK;
 598         } else {
 599                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 600                 return NT_STATUS_NO_USER_SESSION_KEY;
 601         }
 602 }
 603
 604 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
 605                                      struct auth_session_info **session_info_out)
 606 {
 607         NTSTATUS nt_status;
 608         struct gensec_krb5_state *gensec_krb5_state = gensec_security->private_data;
 609         struct auth_serversupplied_info *server_info = NULL;
 610         struct auth_session_info *session_info = NULL;
 611         struct PAC_LOGON_INFO *logon_info;
 612         struct nt_user_token *ptoken;
 613         struct dom_sid *sid;
 614         char *p;
 615         char *principal;
 616         const char *username;
 617         const char *realm;
 618
 619         *session_info_out = NULL;
 620
 621         principal = talloc_strdup(gensec_krb5_state, gensec_krb5_state->peer_principal);
 622         p = strchr(principal, '@');
 623         if (p) {
 624                 *p = '\0';
 625         }
 626         p++;
 627         username = principal;
 628         realm = p;
 629
 630         /* decode and verify the pac */
 631         nt_status = gensec_krb5_decode_pac(gensec_krb5_state, &logon_info, gensec_krb5_state->pac,
 632                                            gensec_krb5_state);
 633
 634         /* IF we have the PAC - otherwise we need to get this
 635          * data from elsewere - local ldb, or (TODO) lookup of some
 636          * kind... */
 637
 638         if (NT_STATUS_IS_OK(nt_status)) {
 639                 nt_status = make_server_info(gensec_krb5_state, &server_info, gensec_krb5_state->peer_principal);
 640                 if (!NT_STATUS_IS_OK(nt_status)) {
 641                         return nt_status;
 642                 }
 643
 644                 server_info->guest = False;
 645
 646                 if (logon_info->account_name.string) {
 647                         server_info->account_name
 648                                 = talloc_reference(server_info,
 649                                                    logon_info->account_name.string);
 650                 } else {
 651                         server_info->account_name = talloc_strdup(server_info, username);
 652                 }
 653
 654                 server_info->domain = talloc_reference(server_info,
 655                                                        logon_info->dom_name.string);
 656                 server_info->realm = talloc_strdup(server_info, realm);
 657                 server_info->full_name = talloc_reference(server_info,
 658                                                           logon_info->full_name.string);
 659                 server_info->logon_script = talloc_reference(server_info,
 660                                                              logon_info->logon_script.string);
 661                 server_info->profile_path = talloc_reference(server_info,
 662                                                              logon_info->profile_path.string);
 663                 server_info->home_directory = talloc_reference(server_info,
 664                                                                logon_info->home_directory.string);
 665                 server_info->home_drive = talloc_reference(server_info,
 666                                                            logon_info->home_drive.string);
 667
 668                 server_info->logon_count = logon_info->logon_count;
 669                 /* TODO: bad password count */
 670
 671                 server_info->acct_flags = logon_info->acct_flags;
 672
 673                 if (!server_info->domain || !server_info->account_name || !server_info->realm) {
 674                         free_server_info(&server_info);
 675                         return NT_STATUS_NO_MEMORY;
 676                 }
 677
 678                 /* references the server_info into the session_info */
 679                 nt_status = make_session_info(gensec_krb5_state, server_info, &session_info);
 680                 if (!NT_STATUS_IS_OK(nt_status)) {
 681                         free_server_info(&server_info);
 682                         return nt_status;
 683                 }
 684
 685                 talloc_free(server_info);
 686
 687                 ptoken = talloc_p(session_info, struct nt_user_token);
 688                 if (!ptoken) {
 689                         return NT_STATUS_NO_MEMORY;
 690                 }
 691
 692                 ptoken->num_sids = 0;
 693
 694                 ptoken->user_sids = talloc_array_p(ptoken, struct dom_sid*, logon_info->groups_count + 2);
 695                 if (!ptoken->user_sids) {
 696                         return NT_STATUS_NO_MEMORY;
 697                 }
 698
 699
 700                 sid = dom_sid_dup(server_info, logon_info->dom_sid);
 701                 server_info->user_sid = dom_sid_add_rid(server_info, sid, logon_info->user_rid);
 702                 sid = dom_sid_dup(server_info, logon_info->dom_sid);
 703                 server_info->primary_group_sid = dom_sid_add_rid(server_info, sid, logon_info->group_rid);
 704
 705                 ptoken->user_sids[0] = talloc_reference(session_info, server_info->user_sid);
 706                 ptoken->num_sids++;
 707                 ptoken->user_sids[1] = talloc_reference(session_info, server_info->primary_group_sid);
 708                 ptoken->num_sids++;
 709
 710                 for (;ptoken->num_sids < (logon_info->groups_count + 2); ptoken->num_sids++) {
 711                         sid = dom_sid_dup(session_info, logon_info->dom_sid);
 712                         ptoken->user_sids[ptoken->num_sids]
 713                                 = dom_sid_add_rid(session_info, sid,
 714                                                   logon_info->groups[ptoken->num_sids - 2].rid);
 715                 }
 716
 717                 debug_nt_user_token(DBGC_AUTH, 0, ptoken);
 718
 719                 session_info->nt_user_token = ptoken;
 720         } else {
 721                 TALLOC_CTX *mem_ctx = talloc_named(gensec_krb5_state, 0, "PAC-less session info discovery for %s@%s", username, realm);
 722                 if (!mem_ctx) {
 723                         return NT_STATUS_NO_MEMORY;
 724                 }
 725                 nt_status = sam_get_server_info(username, realm, gensec_krb5_state, &server_info);
 726                 if (!NT_STATUS_IS_OK(nt_status)) {
 727                         talloc_free(mem_ctx);
 728                         return nt_status;
 729                 }
 730
 731                 /* references the server_info into the session_info */
 732                 nt_status = make_session_info(gensec_krb5_state, server_info, &session_info);
 733                 if (!NT_STATUS_IS_OK(nt_status)) {
 734                         talloc_free(mem_ctx);
 735                         return nt_status;
 736                 }
 737
 738                 talloc_free(mem_ctx);
 739         }
 740
 741         talloc_free(principal);
 742
 743         nt_status = gensec_krb5_session_key(gensec_security, &session_info->session_key);
 744
 745         session_info->workstation = NULL;
 746
 747         *session_info_out = session_info;
 748
 749         return nt_status;
 750 }
 751
 752
 753 static const struct gensec_security_ops gensec_krb5_security_ops = {
 754         .name           = "krb5",
 755         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
 756         .oid            = OID_KERBEROS5,
 757         .client_start   = gensec_krb5_client_start,
 758         .server_start   = gensec_krb5_server_start,
 759         .update         = gensec_krb5_update,
 760         .session_key    = gensec_krb5_session_key,
 761         .session_info   = gensec_krb5_session_info,
 762         .end            = gensec_krb5_end
 763 };
 764
 765 static const struct gensec_security_ops gensec_ms_krb5_security_ops = {
 766         .name           = "ms_krb5",
 767         .auth_type      = DCERPC_AUTH_TYPE_KRB5,
 768         .oid            = OID_KERBEROS5_OLD,
 769         .client_start   = gensec_krb5_client_start,
 770         .server_start   = gensec_krb5_server_start,
 771         .update         = gensec_krb5_update,
 772         .session_key    = gensec_krb5_session_key,
 773         .session_info   = gensec_krb5_session_info,
 774         .end            = gensec_krb5_end
 775 };
 776
 777
 778 NTSTATUS gensec_krb5_init(void)
 779 {
 780         NTSTATUS ret;
 781
 782         ret = register_backend("gensec", &gensec_krb5_security_ops);
 783         if (!NT_STATUS_IS_OK(ret)) {
 784                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 785                         gensec_krb5_security_ops.name));
 786                 return ret;
 787         }
 788
 789         ret = register_backend("gensec", &gensec_ms_krb5_security_ops);
 790         if (!NT_STATUS_IS_OK(ret)) {
 791                 DEBUG(0,("Failed to register '%s' gensec backend!\n",
 792                         gensec_krb5_security_ops.name));
 793                 return ret;
 794         }
 795
 796         return ret;
 797 }