source3/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  24 #define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
  25
  26 #include "includes.h"
  27
  28 #ifdef HAVE_KRB5
  29
  30 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
  31 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  32 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  33 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  34 #else /* MIT */
  35 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  36 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  37 #define KRB5_KEY_DATA(k)        ((k)->contents)
  38 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  39
  40 /**************************************************************
  41  Wrappers around kerberos string functions that convert from
  42  utf8 -> unix charset and vica versa.
  43 **************************************************************/
  44
  45 /**************************************************************
  46  krb5_parse_name that takes a UNIX charset.
  47 **************************************************************/
  48
  49  krb5_error_code smb_krb5_parse_name(krb5_context context,
  50                                 const char *name, /* in unix charset */
  51                                 krb5_principal *principal)
  52 {
  53         krb5_error_code ret;
  54         char *utf8_name;
  55         size_t converted_size;
  56
  57         if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
  58                 return ENOMEM;
  59         }
  60
  61         ret = krb5_parse_name(context, utf8_name, principal);
  62         SAFE_FREE(utf8_name);
  63         return ret;
  64 }
  65
  66 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
  67 /**************************************************************
  68  krb5_parse_name_norealm that takes a UNIX charset.
  69 **************************************************************/
  70
  71 static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
  72                                 const char *name, /* in unix charset */
  73                                 krb5_principal *principal)
  74 {
  75         krb5_error_code ret;
  76         char *utf8_name;
  77         size_t converted_size;
  78
  79         *principal = NULL;
  80         if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
  81                 return ENOMEM;
  82         }
  83
  84         ret = krb5_parse_name_norealm(context, utf8_name, principal);
  85         SAFE_FREE(utf8_name);
  86         return ret;
  87 }
  88 #endif
  89
  90 /**************************************************************
  91  krb5_parse_name that returns a UNIX charset name. Must
  92  be freed with normal free() call.
  93 **************************************************************/
  94
  95  krb5_error_code smb_krb5_unparse_name(krb5_context context,
  96                                         krb5_const_principal principal,
  97                                         char **unix_name)
  98 {
  99         krb5_error_code ret;
 100         char *utf8_name;
 101         size_t converted_size;
 102
 103         *unix_name = NULL;
 104         ret = krb5_unparse_name(context, principal, &utf8_name);
 105         if (ret) {
 106                 return ret;
 107         }
 108
 109         if (!pull_utf8_allocate(unix_name, utf8_name, &converted_size)) {
 110                 krb5_free_unparsed_name(context, utf8_name);
 111                 return ENOMEM;
 112         }
 113         krb5_free_unparsed_name(context, utf8_name);
 114         return 0;
 115 }
 116
 117 #ifndef HAVE_KRB5_SET_REAL_TIME
 118 /*
 119  * This function is not in the Heimdal mainline.
 120  */
 121  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
 122 {
 123         krb5_error_code ret;
 124         int32_t sec, usec;
 125
 126         ret = krb5_us_timeofday(context, &sec, &usec);
 127         if (ret)
 128                 return ret;
 129
 130         context->kdc_sec_offset = seconds - sec;
 131         context->kdc_usec_offset = microseconds - usec;
 132
 133         return 0;
 134 }
 135 #endif
 136
 137 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
 138
 139 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
 140
 141 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
 142  * to krb5_set_default_tgs_ktypes. See
 143  *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
 144  *
 145  * If the MIT libraries are not exporting internal symbols, we will end up in
 146  * this branch, which is correct. Otherwise we will continue to use the
 147  * internal symbol
 148  */
 149  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 150 {
 151     return krb5_set_default_tgs_enctypes(ctx, enc);
 152 }
 153
 154 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
 155
 156 /* Heimdal */
 157  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 158 {
 159         return krb5_set_default_in_tkt_etypes(ctx, enc);
 160 }
 161
 162 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
 163
 164 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
 165
 166 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
 167 /* HEIMDAL */
 168  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 169 {
 170         memset(pkaddr, '\0', sizeof(krb5_address));
 171 #if defined(HAVE_IPV6) && defined(KRB5_ADDRESS_INET6)
 172         if (paddr->ss_family == AF_INET6) {
 173                 pkaddr->addr_type = KRB5_ADDRESS_INET6;
 174                 pkaddr->address.length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 175                 pkaddr->address.data = (char *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 176                 return true;
 177         }
 178 #endif
 179         if (paddr->ss_family == AF_INET) {
 180                 pkaddr->addr_type = KRB5_ADDRESS_INET;
 181                 pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 182                 pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 183                 return true;
 184         }
 185         return false;
 186 }
 187 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 188 /* MIT */
 189  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 190 {
 191         memset(pkaddr, '\0', sizeof(krb5_address));
 192 #if defined(HAVE_IPV6) && defined(ADDRTYPE_INET6)
 193         if (paddr->ss_family == AF_INET6) {
 194                 pkaddr->addrtype = ADDRTYPE_INET6;
 195                 pkaddr->length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 196                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 197                 return true;
 198         }
 199 #endif
 200         if (paddr->ss_family == AF_INET) {
 201                 pkaddr->addrtype = ADDRTYPE_INET;
 202                 pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 203                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 204                 return true;
 205         }
 206         return false;
 207 }
 208 #else
 209 #error UNKNOWN_ADDRTYPE
 210 #endif
 211
 212 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
 213  int create_kerberos_key_from_string_direct(krb5_context context,
 214                                         krb5_principal host_princ,
 215                                         krb5_data *password,
 216                                         krb5_keyblock *key,
 217                                         krb5_enctype enctype)
 218 {
 219         int ret;
 220         krb5_data salt;
 221         krb5_encrypt_block eblock;
 222
 223         ret = krb5_principal2salt(context, host_princ, &salt);
 224         if (ret) {
 225                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 226                 return ret;
 227         }
 228         krb5_use_enctype(context, &eblock, enctype);
 229         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
 230         SAFE_FREE(salt.data);
 231         return ret;
 232 }
 233 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 234  int create_kerberos_key_from_string_direct(krb5_context context,
 235                                         krb5_principal host_princ,
 236                                         krb5_data *password,
 237                                         krb5_keyblock *key,
 238                                         krb5_enctype enctype)
 239 {
 240         int ret;
 241         krb5_salt salt;
 242
 243         ret = krb5_get_pw_salt(context, host_princ, &salt);
 244         if (ret) {
 245                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 246                 return ret;
 247         }
 248
 249         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
 250         krb5_free_salt(context, salt);
 251         return ret;
 252 }
 253 #else
 254 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 255 #endif
 256
 257  int create_kerberos_key_from_string(krb5_context context,
 258                                         krb5_principal host_princ,
 259                                         krb5_data *password,
 260                                         krb5_keyblock *key,
 261                                         krb5_enctype enctype)
 262 {
 263         krb5_principal salt_princ = NULL;
 264         int ret;
 265         /*
 266          * Check if we've determined that the KDC is salting keys for this
 267          * principal/enctype in a non-obvious way.  If it is, try to match
 268          * its behavior.
 269          */
 270         salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
 271         ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
 272         if (salt_princ) {
 273                 krb5_free_principal(context, salt_princ);
 274         }
 275         return ret;
 276 }
 277
 278 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 279  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 280                                             krb5_enctype **enctypes)
 281 {
 282         return krb5_get_permitted_enctypes(context, enctypes);
 283 }
 284 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 285  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 286                                             krb5_enctype **enctypes)
 287 {
 288         return krb5_get_default_in_tkt_etypes(context, enctypes);
 289 }
 290 #else
 291 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 292 #endif
 293
 294 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 295  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 296                                         krb5_auth_context auth_context,
 297                                         krb5_keyblock *keyblock)
 298 {
 299         return krb5_auth_con_setkey(context, auth_context, keyblock);
 300 }
 301 #endif
 302
 303 bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
 304                            DATA_BLOB *edata,
 305                            DATA_BLOB *edata_out)
 306 {
 307         DATA_BLOB edata_contents;
 308         ASN1_DATA data;
 309         int edata_type;
 310
 311         if (!edata->length) {
 312                 return False;
 313         }
 314
 315         asn1_load(&data, *edata);
 316         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 317         asn1_start_tag(&data, ASN1_CONTEXT(1));
 318         asn1_read_Integer(&data, &edata_type);
 319
 320         if (edata_type != KRB5_PADATA_PW_SALT) {
 321                 DEBUG(0,("edata is not of required type %d but of type %d\n",
 322                         KRB5_PADATA_PW_SALT, edata_type));
 323                 asn1_free(&data);
 324                 return False;
 325         }
 326
 327         asn1_start_tag(&data, ASN1_CONTEXT(2));
 328         asn1_read_OctetString(&data, &edata_contents);
 329         asn1_end_tag(&data);
 330         asn1_end_tag(&data);
 331         asn1_end_tag(&data);
 332         asn1_free(&data);
 333
 334         *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
 335
 336         data_blob_free(&edata_contents);
 337
 338         return True;
 339 }
 340
 341
 342 bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 343 {
 344         DATA_BLOB pac_contents;
 345         ASN1_DATA data;
 346         int data_type;
 347
 348         if (!auth_data->length) {
 349                 return False;
 350         }
 351
 352         asn1_load(&data, *auth_data);
 353         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 354         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 355         asn1_start_tag(&data, ASN1_CONTEXT(0));
 356         asn1_read_Integer(&data, &data_type);
 357
 358         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 359                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 360                 asn1_free(&data);
 361                 return False;
 362         }
 363
 364         asn1_end_tag(&data);
 365         asn1_start_tag(&data, ASN1_CONTEXT(1));
 366         asn1_read_OctetString(&data, &pac_contents);
 367         asn1_end_tag(&data);
 368         asn1_end_tag(&data);
 369         asn1_end_tag(&data);
 370         asn1_free(&data);
 371
 372         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 373
 374         data_blob_free(&pac_contents);
 375
 376         return True;
 377 }
 378
 379  bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 380 {
 381         DATA_BLOB auth_data_wrapped;
 382         bool got_auth_data_pac = False;
 383         int i;
 384
 385 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 386         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 387             tkt->enc_part2->authorization_data[0] &&
 388             tkt->enc_part2->authorization_data[0]->length)
 389         {
 390                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 391
 392                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 393                             KRB5_AUTHDATA_IF_RELEVANT) {
 394                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 395                                         tkt->enc_part2->authorization_data[i]->ad_type));
 396                                 continue;
 397                         }
 398
 399                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 400                                                       tkt->enc_part2->authorization_data[i]->length);
 401
 402                         /* check if it is a PAC */
 403                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 404                         data_blob_free(&auth_data_wrapped);
 405
 406                         if (got_auth_data_pac) {
 407                                 return true;
 408                         }
 409                 }
 410
 411                 return got_auth_data_pac;
 412         }
 413
 414 #else
 415         if (tkt->ticket.authorization_data &&
 416             tkt->ticket.authorization_data->len)
 417         {
 418                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 419
 420                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 421                             KRB5_AUTHDATA_IF_RELEVANT) {
 422                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 423                                         tkt->ticket.authorization_data->val[i].ad_type));
 424                                 continue;
 425                         }
 426
 427                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 428                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 429
 430                         /* check if it is a PAC */
 431                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 432                         data_blob_free(&auth_data_wrapped);
 433
 434                         if (got_auth_data_pac) {
 435                                 return true;
 436                         }
 437                 }
 438
 439                 return got_auth_data_pac;
 440         }
 441 #endif
 442         return False;
 443 }
 444
 445  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 446 {
 447 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 448         return tkt->enc_part2->client;
 449 #else
 450         return tkt->client;
 451 #endif
 452 }
 453
 454 #if !defined(HAVE_KRB5_LOCATE_KDC)
 455
 456 /* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
 457  * to a public interface for this functionality, so we have to be able to live
 458  * without it if the MIT libraries are hiding their internal symbols.
 459  */
 460
 461 #if defined(KRB5_KRBHST_INIT)
 462 /* Heimdal */
 463  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 464 {
 465         krb5_krbhst_handle hnd;
 466         krb5_krbhst_info *hinfo;
 467         krb5_error_code rc;
 468         int num_kdcs, i;
 469         struct sockaddr *sa;
 470         struct addrinfo *ai;
 471
 472         *addr_pp = NULL;
 473         *naddrs = 0;
 474
 475         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 476         if (rc) {
 477                 DEBUG(0, ("smb_krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 478                 return rc;
 479         }
 480
 481         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 482                 ;
 483
 484         krb5_krbhst_reset(ctx, hnd);
 485
 486         if (!num_kdcs) {
 487                 DEBUG(0, ("smb_krb5_locate_kdc: zero kdcs found !\n"));
 488                 krb5_krbhst_free(ctx, hnd);
 489                 return -1;
 490         }
 491
 492         sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
 493         if (!sa) {
 494                 DEBUG(0, ("smb_krb5_locate_kdc: malloc failed\n"));
 495                 krb5_krbhst_free(ctx, hnd);
 496                 naddrs = 0;
 497                 return -1;
 498         }
 499
 500         memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
 501
 502         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 503
 504 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
 505                 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
 506                 if (rc) {
 507                         DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
 508                         continue;
 509                 }
 510 #endif
 511                 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
 512                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 513         }
 514
 515         krb5_krbhst_free(ctx, hnd);
 516
 517         *naddrs = num_kdcs;
 518         *addr_pp = sa;
 519         return 0;
 520 }
 521
 522 #else /* ! defined(KRB5_KRBHST_INIT) */
 523
 524  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 525                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 526 {
 527         DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
 528         return KRB5_KDC_UNREACH;
 529 }
 530
 531 #endif /* KRB5_KRBHST_INIT */
 532
 533 #else /* ! HAVE_KRB5_LOCATE_KDC */
 534
 535  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 536                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 537 {
 538         return krb5_locate_kdc(ctx, realm, addr_pp, naddrs, get_masters);
 539 }
 540
 541 #endif /* HAVE_KRB5_LOCATE_KDC */
 542
 543 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 544  void krb5_free_unparsed_name(krb5_context context, char *val)
 545 {
 546         SAFE_FREE(val);
 547 }
 548 #endif
 549
 550  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 551 {
 552 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 553         if (pdata->data) {
 554                 krb5_free_data_contents(context, pdata);
 555         }
 556 #else
 557         SAFE_FREE(pdata->data);
 558 #endif
 559 }
 560
 561  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 562 {
 563 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 564         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 565 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 566         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 567 #else
 568 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 569 #endif
 570 }
 571
 572  bool kerberos_compatible_enctypes(krb5_context context,
 573                                   krb5_enctype enctype1,
 574                                   krb5_enctype enctype2)
 575 {
 576 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 577         krb5_boolean similar = 0;
 578
 579         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 580         return similar ? True : False;
 581 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 582         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 583 #endif
 584 }
 585
 586 static bool ads_cleanup_expired_creds(krb5_context context,
 587                                       krb5_ccache  ccache,
 588                                       krb5_creds  *credsp)
 589 {
 590         krb5_error_code retval;
 591         const char *cc_type = krb5_cc_get_type(context, ccache);
 592
 593         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 594                   cc_type, krb5_cc_get_name(context, ccache),
 595                   http_timestring(credsp->times.endtime)));
 596
 597         /* we will probably need new tickets if the current ones
 598            will expire within 10 seconds.
 599         */
 600         if (credsp->times.endtime >= (time(NULL) + 10))
 601                 return False;
 602
 603         /* heimdal won't remove creds from a file ccache, and
 604            perhaps we shouldn't anyway, since internally we
 605            use memory ccaches, and a FILE one probably means that
 606            we're using creds obtained outside of our exectuable
 607         */
 608         if (strequal(cc_type, "FILE")) {
 609                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 610                 return False;
 611         }
 612
 613         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 614         if (retval) {
 615                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 616                           error_message(retval)));
 617                 /* If we have an error in this, we want to display it,
 618                    but continue as though we deleted it */
 619         }
 620         return True;
 621 }
 622
 623 /*
 624   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 625 */
 626 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 627                                        krb5_auth_context *auth_context,
 628                                        const krb5_flags ap_req_options,
 629                                        const char *principal,
 630                                        krb5_ccache ccache,
 631                                        krb5_data *outbuf,
 632                                        time_t *expire_time)
 633 {
 634         krb5_error_code           retval;
 635         krb5_principal    server;
 636         krb5_creds              * credsp;
 637         krb5_creds                creds;
 638         krb5_data in_data;
 639         bool creds_ready = False;
 640         int i = 0, maxtries = 3;
 641
 642         retval = smb_krb5_parse_name(context, principal, &server);
 643         if (retval) {
 644                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 645                 return retval;
 646         }
 647
 648         /* obtain ticket & session key */
 649         ZERO_STRUCT(creds);
 650         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 651                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 652                          error_message(retval)));
 653                 goto cleanup_princ;
 654         }
 655
 656         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 657                 /* This can commonly fail on smbd startup with no ticket in the cache.
 658                  * Report at higher level than 1. */
 659                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 660                          error_message(retval)));
 661                 goto cleanup_creds;
 662         }
 663
 664         while (!creds_ready && (i < maxtries)) {
 665
 666                 if ((retval = krb5_get_credentials(context, 0, ccache,
 667                                                    &creds, &credsp))) {
 668                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 669                                  principal, error_message(retval)));
 670                         goto cleanup_creds;
 671                 }
 672
 673                 /* cope with ticket being in the future due to clock skew */
 674                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 675                         time_t t = time(NULL);
 676                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 677                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 678                         krb5_set_real_time(context, t + time_offset + 1, 0);
 679                 }
 680
 681                 if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
 682                         creds_ready = True;
 683                 }
 684
 685                 i++;
 686         }
 687
 688         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 689                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 690                   http_timestring((unsigned)credsp->times.endtime),
 691                   (unsigned)credsp->times.endtime));
 692
 693         if (expire_time) {
 694                 *expire_time = (time_t)credsp->times.endtime;
 695         }
 696
 697         in_data.length = 0;
 698         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 699                                       &in_data, credsp, outbuf);
 700         if (retval) {
 701                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 702                          error_message(retval)));
 703         }
 704
 705         krb5_free_creds(context, credsp);
 706
 707 cleanup_creds:
 708         krb5_free_cred_contents(context, &creds);
 709
 710 cleanup_princ:
 711         krb5_free_principal(context, server);
 712
 713         return retval;
 714 }
 715
 716 /*
 717   get a kerberos5 ticket for the given service
 718 */
 719 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 720                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 721                         uint32 extra_ap_opts, const char *ccname,
 722                         time_t *tgs_expire)
 723
 724 {
 725         krb5_error_code retval;
 726         krb5_data packet;
 727         krb5_context context = NULL;
 728         krb5_ccache ccdef = NULL;
 729         krb5_auth_context auth_context = NULL;
 730         krb5_enctype enc_types[] = {
 731 #ifdef ENCTYPE_ARCFOUR_HMAC
 732                 ENCTYPE_ARCFOUR_HMAC,
 733 #endif
 734                 ENCTYPE_DES_CBC_MD5,
 735                 ENCTYPE_DES_CBC_CRC,
 736                 ENCTYPE_NULL};
 737
 738         initialize_krb5_error_table();
 739         retval = krb5_init_context(&context);
 740         if (retval) {
 741                 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
 742                          error_message(retval)));
 743                 goto failed;
 744         }
 745
 746         if (time_offset != 0) {
 747                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 748         }
 749
 750         if ((retval = krb5_cc_resolve(context, ccname ?
 751                         ccname : krb5_cc_default_name(context), &ccdef))) {
 752                 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
 753                          error_message(retval)));
 754                 goto failed;
 755         }
 756
 757         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 758                 DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
 759                          error_message(retval)));
 760                 goto failed;
 761         }
 762
 763         if ((retval = ads_krb5_mk_req(context,
 764                                         &auth_context,
 765                                         AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 766                                         principal,
 767                                         ccdef, &packet,
 768                                         tgs_expire))) {
 769                 goto failed;
 770         }
 771
 772         get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
 773
 774         *ticket = data_blob(packet.data, packet.length);
 775
 776         kerberos_free_data_contents(context, &packet);
 777
 778 failed:
 779
 780         if ( context ) {
 781                 if (ccdef)
 782                         krb5_cc_close(context, ccdef);
 783                 if (auth_context)
 784                         krb5_auth_con_free(context, auth_context);
 785                 krb5_free_context(context);
 786         }
 787
 788         return retval;
 789 }
 790
 791  bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
 792  {
 793         krb5_keyblock *skey;
 794         krb5_error_code err;
 795         bool ret = False;
 796
 797         if (remote)
 798                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 799         else
 800                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 801         if (err == 0 && skey != NULL) {
 802                 DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
 803                 *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 804                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 805
 806                 ret = True;
 807
 808                 krb5_free_keyblock(context, skey);
 809         } else {
 810                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 811         }
 812
 813         return ret;
 814  }
 815
 816
 817 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 818  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 819
 820  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 821 {
 822         static krb5_data kdata;
 823
 824         kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
 825         kdata.length = strlen((const char *)kdata.data);
 826         return &kdata;
 827 }
 828 #endif
 829
 830  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 831 {
 832 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
 833         return krb5_kt_free_entry(context, kt_entry);
 834 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 835         return krb5_free_keytab_entry_contents(context, kt_entry);
 836 #else
 837 #error UNKNOWN_KT_FREE_FUNCTION
 838 #endif
 839 }
 840
 841  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 842                                      struct PAC_SIGNATURE_DATA *sig)
 843 {
 844 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 845         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 846         cksum->checksum.length  = sig->signature.length;
 847         cksum->checksum.data    = sig->signature.data;
 848 #else
 849         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 850         cksum->length           = sig->signature.length;
 851         cksum->contents         = sig->signature.data;
 852 #endif
 853 }
 854
 855  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 856                                           const krb5_keyblock *keyblock,
 857                                          krb5_keyusage usage,
 858                                          krb5_checksum *cksum,
 859                                          uint8 *data,
 860                                          size_t length)
 861 {
 862         krb5_error_code ret;
 863
 864         /* verify the checksum */
 865
 866         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 867          *
 868          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 869          * -----------------------------------------------------------------------------
 870          * krb5_c_verify_checksum       -                       works           works
 871          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 872          */
 873
 874 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 875         {
 876                 krb5_boolean checksum_valid = False;
 877                 krb5_data input;
 878
 879                 input.data = (char *)data;
 880                 input.length = length;
 881
 882                 ret = krb5_c_verify_checksum(context,
 883                                              keyblock,
 884                                              usage,
 885                                              &input,
 886                                              cksum,
 887                                              &checksum_valid);
 888                 if (ret) {
 889                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 890                                 error_message(ret)));
 891                         return ret;
 892                 }
 893
 894                 if (!checksum_valid)
 895                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 896         }
 897
 898 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 899
 900         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 901          * without enctype and it ignores any key_usage types - Guenther */
 902
 903         {
 904
 905                 krb5_crypto crypto;
 906                 ret = krb5_crypto_init(context,
 907                                        keyblock,
 908                                        0,
 909                                        &crypto);
 910                 if (ret) {
 911                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 912                                 error_message(ret)));
 913                         return ret;
 914                 }
 915
 916                 ret = krb5_verify_checksum(context,
 917                                            crypto,
 918                                            usage,
 919                                            data,
 920                                            length,
 921                                            cksum);
 922
 923                 krb5_crypto_destroy(context, crypto);
 924         }
 925
 926 #else
 927 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
 928 #endif
 929
 930         return ret;
 931 }
 932
 933  time_t get_authtime_from_tkt(krb5_ticket *tkt)
 934 {
 935 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 936         return tkt->enc_part2->times.authtime;
 937 #else
 938         return tkt->ticket.authtime;
 939 #endif
 940 }
 941
 942 #ifdef HAVE_KRB5_DECODE_AP_REQ  /* Heimdal */
 943 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
 944 {
 945 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
 946         if (ap_req->ticket->enc_part.kvno)
 947                 return ap_req->ticket->enc_part.kvno;
 948 #else /* Heimdal */
 949         if (ap_req->ticket.enc_part.kvno)
 950                 return *ap_req->ticket.enc_part.kvno;
 951 #endif
 952         return 0;
 953 }
 954
 955 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
 956 {
 957 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
 958         return ap_req->ticket.enc_part.etype;
 959 #else /* MIT */
 960         return ap_req->ticket->enc_part.enctype;
 961 #endif
 962 }
 963 #endif  /* HAVE_KRB5_DECODE_AP_REQ */
 964
 965 static krb5_error_code
 966 get_key_from_keytab(krb5_context context,
 967                     krb5_const_principal server,
 968                     krb5_enctype enctype,
 969                     krb5_kvno kvno,
 970                     krb5_keyblock **out_key)
 971 {
 972         krb5_keytab_entry entry;
 973         krb5_error_code ret;
 974         krb5_keytab keytab;
 975         char *name = NULL;
 976
 977         /* We have to open a new keytab handle here, as MIT does
 978            an implicit open/getnext/close on krb5_kt_get_entry. We
 979            may be in the middle of a keytab enumeration when this is
 980            called. JRA. */
 981
 982         ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
 983         if (ret) {
 984                 DEBUG(1,("get_key_from_keytab: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 985                 return ret;
 986         }
 987
 988         if ( DEBUGLEVEL >= 10 ) {
 989                 if (smb_krb5_unparse_name(context, server, &name) == 0) {
 990                         DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
 991                                 kvno, enctype, name));
 992                         SAFE_FREE(name);
 993                 }
 994         }
 995
 996         ret = krb5_kt_get_entry(context,
 997                                 keytab,
 998                                 server,
 999                                 kvno,
1000                                 enctype,
1001                                 &entry);
1002
1003         if (ret) {
1004                 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
1005                 goto out;
1006         }
1007
1008 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
1009         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
1010 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
1011         ret = krb5_copy_keyblock(context, &entry.key, out_key);
1012 #else
1013 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
1014 #endif
1015
1016         if (ret) {
1017                 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
1018                 goto out;
1019         }
1020
1021         smb_krb5_kt_free_entry(context, &entry);
1022
1023 out:
1024         krb5_kt_close(context, keytab);
1025         return ret;
1026 }
1027
1028 /* Prototypes */
1029
1030  krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
1031                                                  const krb5_data *inbuf,
1032                                                  krb5_kvno *kvno,
1033                                                  krb5_enctype *enctype)
1034 {
1035 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1036         {
1037                 krb5_error_code ret;
1038                 krb5_ap_req ap_req;
1039
1040                 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
1041                 if (ret)
1042                         return ret;
1043
1044                 *kvno = get_kvno_from_ap_req(&ap_req);
1045                 *enctype = get_enctype_from_ap_req(&ap_req);
1046
1047                 free_AP_REQ(&ap_req);
1048                 return 0;
1049         }
1050 #endif
1051
1052         /* Possibly not an appropriate error code. */
1053         return KRB5KDC_ERR_BADOPTION;
1054 }
1055
1056  krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
1057                                                         krb5_auth_context *auth_context,
1058                                                         const krb5_data *inbuf,
1059                                                         krb5_const_principal server,
1060                                                         krb5_keytab keytab,
1061                                                         krb5_flags *ap_req_options,
1062                                                         krb5_ticket **ticket,
1063                                                         krb5_keyblock **keyblock)
1064 {
1065         krb5_error_code ret;
1066         krb5_kvno kvno;
1067         krb5_enctype enctype;
1068         krb5_keyblock *local_keyblock;
1069
1070         ret = krb5_rd_req(context,
1071                           auth_context,
1072                           inbuf,
1073                           server,
1074                           keytab,
1075                           ap_req_options,
1076                           ticket);
1077         if (ret) {
1078                 return ret;
1079         }
1080
1081 #ifdef KRB5_TICKET_HAS_KEYINFO
1082         enctype = (*ticket)->enc_part.enctype;
1083         kvno = (*ticket)->enc_part.kvno;
1084 #else
1085         ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
1086         if (ret) {
1087                 return ret;
1088         }
1089 #endif
1090
1091         ret = get_key_from_keytab(context,
1092                                   server,
1093                                   enctype,
1094                                   kvno,
1095                                   &local_keyblock);
1096         if (ret) {
1097                 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
1098                 goto out;
1099         }
1100
1101 out:
1102         if (ret && local_keyblock != NULL) {
1103                 krb5_free_keyblock(context, local_keyblock);
1104         } else {
1105                 *keyblock = local_keyblock;
1106         }
1107
1108         return ret;
1109 }
1110
1111  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
1112                                             const char *name,
1113                                             krb5_principal *principal)
1114 {
1115 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
1116         return smb_krb5_parse_name_norealm_conv(context, name, principal);
1117 #endif
1118
1119         /* we are cheating here because parse_name will in fact set the realm.
1120          * We don't care as the only caller of smb_krb5_parse_name_norealm
1121          * ignores the realm anyway when calling
1122          * smb_krb5_principal_compare_any_realm later - Guenther */
1123
1124         return smb_krb5_parse_name(context, name, principal);
1125 }
1126
1127  bool smb_krb5_principal_compare_any_realm(krb5_context context,
1128                                           krb5_const_principal princ1,
1129                                           krb5_const_principal princ2)
1130 {
1131 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1132
1133         return krb5_principal_compare_any_realm(context, princ1, princ2);
1134
1135 /* krb5_princ_size is a macro in MIT */
1136 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
1137
1138         int i, len1, len2;
1139         const krb5_data *p1, *p2;
1140
1141         len1 = krb5_princ_size(context, princ1);
1142         len2 = krb5_princ_size(context, princ2);
1143
1144         if (len1 != len2)
1145                 return False;
1146
1147         for (i = 0; i < len1; i++) {
1148
1149                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1150                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1151
1152                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
1153                         return False;
1154         }
1155
1156         return True;
1157 #else
1158 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1159 #endif
1160 }
1161
1162  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
1163                                        const char *client_string,       /* gd@BER.SUSE.DE */
1164                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1165                                        time_t *expire_time)
1166 {
1167         krb5_error_code ret;
1168         krb5_context context = NULL;
1169         krb5_ccache ccache = NULL;
1170         krb5_principal client = NULL;
1171         krb5_creds creds, creds_in, *creds_out = NULL;
1172
1173         ZERO_STRUCT(creds);
1174         ZERO_STRUCT(creds_in);
1175
1176         initialize_krb5_error_table();
1177         ret = krb5_init_context(&context);
1178         if (ret) {
1179                 goto done;
1180         }
1181
1182         if (!ccache_string) {
1183                 ccache_string = krb5_cc_default_name(context);
1184         }
1185
1186         if (!ccache_string) {
1187                 ret = EINVAL;
1188                 goto done;
1189         }
1190
1191         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1192
1193         /* FIXME: we should not fall back to defaults */
1194         ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1195         if (ret) {
1196                 goto done;
1197         }
1198
1199         if (client_string) {
1200                 ret = smb_krb5_parse_name(context, client_string, &client);
1201                 if (ret) {
1202                         goto done;
1203                 }
1204         } else {
1205                 ret = krb5_cc_get_principal(context, ccache, &client);
1206                 if (ret) {
1207                         goto done;
1208                 }
1209         }
1210
1211 #ifdef HAVE_KRB5_GET_RENEWED_CREDS      /* MIT */
1212         {
1213                 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1214                 if (ret) {
1215                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1216                         goto done;
1217                 }
1218         }
1219 #elif defined(HAVE_KRB5_GET_KDC_CRED)   /* Heimdal */
1220         {
1221                 krb5_kdc_flags flags;
1222                 krb5_realm *client_realm = NULL;
1223
1224                 ret = krb5_copy_principal(context, client, &creds_in.client);
1225                 if (ret) {
1226                         goto done;
1227                 }
1228
1229                 if (service_string) {
1230                         ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1231                         if (ret) {
1232                                 goto done;
1233                         }
1234                 } else {
1235                         /* build tgt service by default */
1236                         client_realm = krb5_princ_realm(context, creds_in.client);
1237                         if (!client_realm) {
1238                                 ret = ENOMEM;
1239                                 goto done;
1240                         }
1241                         ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1242                         if (ret) {
1243                                 goto done;
1244                         }
1245                 }
1246
1247                 flags.i = 0;
1248                 flags.b.renewable = flags.b.renew = True;
1249
1250                 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds_out);
1251                 if (ret) {
1252                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1253                         goto done;
1254                 }
1255
1256                 creds = *creds_out;
1257         }
1258 #else
1259 #error NO_SUITABLE_KRB5_TICKET_RENEW_FUNCTION_AVAILABLE
1260 #endif
1261
1262         /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1263         ret = krb5_cc_initialize(context, ccache, client);
1264         if (ret) {
1265                 goto done;
1266         }
1267
1268         ret = krb5_cc_store_cred(context, ccache, &creds);
1269
1270         if (expire_time) {
1271                 *expire_time = (time_t) creds.times.endtime;
1272         }
1273
1274 done:
1275         krb5_free_cred_contents(context, &creds_in);
1276
1277         if (creds_out) {
1278                 krb5_free_creds(context, creds_out);
1279         } else {
1280                 krb5_free_cred_contents(context, &creds);
1281         }
1282
1283         if (client) {
1284                 krb5_free_principal(context, client);
1285         }
1286         if (ccache) {
1287                 krb5_cc_close(context, ccache);
1288         }
1289         if (context) {
1290                 krb5_free_context(context);
1291         }
1292
1293         return ret;
1294 }
1295
1296  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1297 {
1298         krb5_error_code ret = 0;
1299         if (addr == NULL) {
1300                 return ret;
1301         }
1302 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1303         krb5_free_addresses(context, addr->addrs);
1304 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1305         ret = krb5_free_addresses(context, addr->addrs);
1306         SAFE_FREE(addr->addrs);
1307 #endif
1308         SAFE_FREE(addr);
1309         addr = NULL;
1310         return ret;
1311 }
1312
1313  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1314 {
1315         krb5_error_code ret = 0;
1316         nstring buf;
1317 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1318         krb5_address **addrs = NULL;
1319 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1320         krb5_addresses *addrs = NULL;
1321 #endif
1322
1323         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
1324         if (*kerb_addr == NULL) {
1325                 return ENOMEM;
1326         }
1327
1328         put_name(buf, global_myname(), ' ', 0x20);
1329
1330 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1331         {
1332                 int num_addr = 2;
1333
1334                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
1335                 if (addrs == NULL) {
1336                         SAFE_FREE(kerb_addr);
1337                         return ENOMEM;
1338                 }
1339
1340                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
1341
1342                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1343                 if (addrs[0] == NULL) {
1344                         SAFE_FREE(addrs);
1345                         SAFE_FREE(kerb_addr);
1346                         return ENOMEM;
1347                 }
1348
1349                 addrs[0]->magic = KV5M_ADDRESS;
1350                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1351                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
1352                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1353                 if (addrs[0]->contents == NULL) {
1354                         SAFE_FREE(addrs[0]);
1355                         SAFE_FREE(addrs);
1356                         SAFE_FREE(kerb_addr);
1357                         return ENOMEM;
1358                 }
1359
1360                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
1361
1362                 addrs[1] = NULL;
1363         }
1364 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1365         {
1366                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1367                 if (addrs == NULL) {
1368                         SAFE_FREE(kerb_addr);
1369                         return ENOMEM;
1370                 }
1371
1372                 memset(addrs, 0, sizeof(krb5_addresses));
1373
1374                 addrs->len = 1;
1375                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1376                 if (addrs->val == NULL) {
1377                         SAFE_FREE(addrs);
1378                         SAFE_FREE(kerb_addr);
1379                         return ENOMEM;
1380                 }
1381
1382                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1383                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1384                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1385                 if (addrs->val[0].address.data == NULL) {
1386                         SAFE_FREE(addrs->val);
1387                         SAFE_FREE(addrs);
1388                         SAFE_FREE(kerb_addr);
1389                         return ENOMEM;
1390                 }
1391
1392                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1393         }
1394 #else
1395 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1396 #endif
1397         (*kerb_addr)->addrs = addrs;
1398
1399         return ret;
1400 }
1401
1402  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1403 {
1404 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1405         krb5_free_error_contents(context, krberror);
1406 #else /* MIT */
1407         krb5_free_error(context, krberror);
1408 #endif
1409 }
1410
1411  krb5_error_code handle_krberror_packet(krb5_context context,
1412                                         krb5_data *packet)
1413 {
1414         krb5_error_code ret;
1415         bool got_error_code = False;
1416
1417         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1418
1419 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1420         {
1421                 krb5_error krberror;
1422
1423                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1424                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1425                                 error_message(ret)));
1426                         return ret;
1427                 }
1428
1429                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1430                         ret = (krb5_error_code) krberror.error_code;
1431                         got_error_code = True;
1432                 }
1433
1434                 smb_krb5_free_error(context, &krberror);
1435         }
1436 #else /* MIT */
1437         {
1438                 krb5_error *krberror;
1439
1440                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1441                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1442                                 error_message(ret)));
1443                         return ret;
1444                 }
1445
1446                 if (krberror->e_data.data == NULL) {
1447                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1448                         got_error_code = True;
1449                 }
1450                 smb_krb5_free_error(context, krberror);
1451         }
1452 #endif
1453         if (got_error_code) {
1454                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1455                         error_message(ret), ret));
1456         }
1457         return ret;
1458 }
1459
1460  krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1461                                             krb5_get_init_creds_opt **opt)
1462 {
1463 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
1464         /* Heimdal or modern MIT version */
1465         return krb5_get_init_creds_opt_alloc(context, opt);
1466 #else
1467         /* Historical MIT version */
1468         krb5_get_init_creds_opt *my_opt;
1469
1470         *opt = NULL;
1471
1472         if ((my_opt = SMB_MALLOC_P(krb5_get_init_creds_opt)) == NULL) {
1473                 return ENOMEM;
1474         }
1475
1476         krb5_get_init_creds_opt_init(my_opt);
1477
1478         *opt =  my_opt;
1479         return 0;
1480 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC  */
1481 }
1482
1483  void smb_krb5_get_init_creds_opt_free(krb5_context context,
1484                                 krb5_get_init_creds_opt *opt)
1485 {
1486 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
1487
1488 #ifdef KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT
1489         /* Modern MIT or Heimdal version */
1490         krb5_get_init_creds_opt_free(context, opt);
1491 #else
1492         /* Heimdal version */
1493         krb5_get_init_creds_opt_free(opt);
1494 #endif /* KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT */
1495
1496 #else /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1497         /* Historical MIT version */
1498         SAFE_FREE(opt);
1499         opt = NULL;
1500 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1501 }
1502
1503  krb5_enctype smb_get_enctype_from_kt_entry(const krb5_keytab_entry *kt_entry)
1504 {
1505 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
1506         return kt_entry->key.enctype;
1507 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)  /* Heimdal */
1508         return kt_entry->keyblock.keytype;
1509 #else
1510 #error UNKNOWN_KRB5_KEYTAB_ENTRY_KEYBLOCK_FORMAT
1511 #endif
1512 }
1513
1514
1515 /* caller needs to free etype_s */
1516  krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1517                                             krb5_enctype enctype,
1518                                             char **etype_s)
1519 {
1520 #ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1521         return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1522 #elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1523         char buf[256];
1524         krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1525         if (ret) {
1526                 return ret;
1527         }
1528         *etype_s = SMB_STRDUP(buf);
1529         if (!*etype_s) {
1530                 return ENOMEM;
1531         }
1532         return ret;
1533 #else
1534 #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1535 #endif
1536 }
1537
1538  krb5_error_code smb_krb5_mk_error(krb5_context context,
1539                                 krb5_error_code error_code,
1540                                 const krb5_principal server,
1541                                 krb5_data *reply)
1542 {
1543 #ifdef HAVE_SHORT_KRB5_MK_ERROR_INTERFACE /* MIT */
1544         /*
1545          * The MIT interface is *terrible*.
1546          * We have to construct this ourselves...
1547          */
1548         krb5_error e;
1549
1550         memset(&e, 0, sizeof(e));
1551         krb5_us_timeofday(context, &e.stime, &e.susec);
1552         e.server = server;
1553 #if defined(krb5_err_base)
1554         e.error = error_code - krb5_err_base;
1555 #elif defined(ERROR_TABLE_BASE_krb5)
1556         e.error = error_code - ERROR_TABLE_BASE_krb5;
1557 #else
1558         e.error = error_code; /* Almost certainly wrong, but what can we do... ? */
1559 #endif
1560
1561         return krb5_mk_error(context, &e, reply);
1562 #else /* Heimdal. */
1563         return krb5_mk_error(context,
1564                                 error_code,
1565                                 NULL,
1566                                 NULL, /* e_data */
1567                                 NULL,
1568                                 server,
1569                                 NULL,
1570                                 NULL,
1571                                 reply);
1572 #endif
1573 }
1574
1575 /**********************************************************************
1576  * Open a krb5 keytab with flags, handles readonly or readwrite access and
1577  * allows to process non-default keytab names.
1578  * @param context krb5_context
1579  * @param keytab_name_req string
1580  * @param write_access bool if writable keytab is required
1581  * @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1582  * @return krb5_error_code
1583 **********************************************************************/
1584
1585 /* This MAX_NAME_LEN is a constant defined in krb5.h */
1586 #ifndef MAX_KEYTAB_NAME_LEN
1587 #define MAX_KEYTAB_NAME_LEN 1100
1588 #endif
1589
1590  krb5_error_code smb_krb5_open_keytab(krb5_context context,
1591                                       const char *keytab_name_req,
1592                                       bool write_access,
1593                                       krb5_keytab *keytab)
1594 {
1595         krb5_error_code ret = 0;
1596         TALLOC_CTX *mem_ctx;
1597         char keytab_string[MAX_KEYTAB_NAME_LEN];
1598         char *kt_str = NULL;
1599         bool found_valid_name = False;
1600         const char *pragma = "FILE";
1601         const char *tmp = NULL;
1602
1603         if (!write_access && !keytab_name_req) {
1604                 /* caller just wants to read the default keytab readonly, so be it */
1605                 return krb5_kt_default(context, keytab);
1606         }
1607
1608         mem_ctx = talloc_init("smb_krb5_open_keytab");
1609         if (!mem_ctx) {
1610                 return ENOMEM;
1611         }
1612
1613 #ifdef HAVE_WRFILE_KEYTAB
1614         if (write_access) {
1615                 pragma = "WRFILE";
1616         }
1617 #endif
1618
1619         if (keytab_name_req) {
1620
1621                 if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1622                         ret = KRB5_CONFIG_NOTENUFSPACE;
1623                         goto out;
1624                 }
1625
1626                 if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) ||
1627                     (strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1628                         tmp = keytab_name_req;
1629                         goto resolve;
1630                 }
1631
1632                 if (keytab_name_req[0] != '/') {
1633                         ret = KRB5_KT_BADNAME;
1634                         goto out;
1635                 }
1636
1637                 tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1638                 if (!tmp) {
1639                         ret = ENOMEM;
1640                         goto out;
1641                 }
1642
1643                 goto resolve;
1644         }
1645
1646         /* we need to handle more complex keytab_strings, like:
1647          * "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1648
1649         ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1650         if (ret) {
1651                 goto out;
1652         }
1653
1654         DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1655
1656         tmp = talloc_strdup(mem_ctx, keytab_string);
1657         if (!tmp) {
1658                 ret = ENOMEM;
1659                 goto out;
1660         }
1661
1662         if (strncmp(tmp, "ANY:", 4) == 0) {
1663                 tmp += 4;
1664         }
1665
1666         memset(&keytab_string, '\0', sizeof(keytab_string));
1667
1668         while (next_token_talloc(mem_ctx, &tmp, &kt_str, ",")) {
1669                 if (strncmp(kt_str, "WRFILE:", 7) == 0) {
1670                         found_valid_name = True;
1671                         tmp = kt_str;
1672                         tmp += 7;
1673                 }
1674
1675                 if (strncmp(kt_str, "FILE:", 5) == 0) {
1676                         found_valid_name = True;
1677                         tmp = kt_str;
1678                         tmp += 5;
1679                 }
1680
1681                 if (found_valid_name) {
1682                         if (tmp[0] != '/') {
1683                                 ret = KRB5_KT_BADNAME;
1684                                 goto out;
1685                         }
1686
1687                         tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1688                         if (!tmp) {
1689                                 ret = ENOMEM;
1690                                 goto out;
1691                         }
1692                         break;
1693                 }
1694         }
1695
1696         if (!found_valid_name) {
1697                 ret = KRB5_KT_UNKNOWN_TYPE;
1698                 goto out;
1699         }
1700
1701  resolve:
1702         DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1703         ret = krb5_kt_resolve(context, tmp, keytab);
1704
1705  out:
1706         TALLOC_FREE(mem_ctx);
1707         return ret;
1708 }
1709
1710 #else /* HAVE_KRB5 */
1711  /* this saves a few linking headaches */
1712  int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1713                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1714                         const char *ccname, time_t *tgs_expire)
1715 {
1716          DEBUG(0,("NO KERBEROS SUPPORT\n"));
1717          return 1;
1718 }
1719
1720 #endif