lib/krb5_wrap/krb5_samba.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "krb5_samba.h"
  25 #include "lib/util/asn1.h"
  26
  27 #ifndef KRB5_AUTHDATA_WIN2K_PAC
  28 #define KRB5_AUTHDATA_WIN2K_PAC 128
  29 #endif
  30
  31 #ifndef KRB5_AUTHDATA_IF_RELEVANT
  32 #define KRB5_AUTHDATA_IF_RELEVANT 1
  33 #endif
  34
  35 #ifdef HAVE_KRB5
  36
  37 #define GSSAPI_CHECKSUM      0x8003             /* Checksum type value for Kerberos */
  38 #define GSSAPI_BNDLENGTH     16                 /* Bind Length (rfc-1964 pg.3) */
  39 #define GSSAPI_CHECKSUM_SIZE (4+GSSAPI_BNDLENGTH+4) /* Length of bind length,
  40                                                         bind field, flags field. */
  41 #define GSS_C_DELEG_FLAG 1
  42
  43 /* MIT krb5 1.7beta3 (in Ubuntu Karmic) is missing the prototype,
  44    but still has the symbol */
  45 #if !HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE
  46 krb5_error_code krb5_auth_con_set_req_cksumtype(
  47         krb5_context     context,
  48         krb5_auth_context      auth_context,
  49         krb5_cksumtype     cksumtype);
  50 #endif
  51
  52 #if !defined(SMB_MALLOC)
  53 #undef malloc
  54 #define SMB_MALLOC(s) malloc((s))
  55 #endif
  56
  57 #ifndef SMB_STRDUP
  58 #define SMB_STRDUP(s) strdup(s)
  59 #endif
  60
  61 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
  62
  63 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
  64
  65 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
  66  * to krb5_set_default_tgs_ktypes. See
  67  *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
  68  *
  69  * If the MIT libraries are not exporting internal symbols, we will end up in
  70  * this branch, which is correct. Otherwise we will continue to use the
  71  * internal symbol
  72  */
  73  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
  74 {
  75     return krb5_set_default_tgs_enctypes(ctx, enc);
  76 }
  77
  78 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
  79
  80 /* Heimdal */
  81  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
  82 {
  83         return krb5_set_default_in_tkt_etypes(ctx, enc);
  84 }
  85
  86 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
  87
  88 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
  89
  90 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
  91 /* HEIMDAL */
  92  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
  93 {
  94         memset(pkaddr, '\0', sizeof(krb5_address));
  95 #if defined(HAVE_IPV6) && defined(KRB5_ADDRESS_INET6)
  96         if (paddr->ss_family == AF_INET6) {
  97                 pkaddr->addr_type = KRB5_ADDRESS_INET6;
  98                 pkaddr->address.length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
  99                 pkaddr->address.data = (char *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 100                 return true;
 101         }
 102 #endif
 103         if (paddr->ss_family == AF_INET) {
 104                 pkaddr->addr_type = KRB5_ADDRESS_INET;
 105                 pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 106                 pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 107                 return true;
 108         }
 109         return false;
 110 }
 111 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 112 /* MIT */
 113 bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 114 {
 115         memset(pkaddr, '\0', sizeof(krb5_address));
 116 #if defined(HAVE_IPV6) && defined(ADDRTYPE_INET6)
 117         if (paddr->ss_family == AF_INET6) {
 118                 pkaddr->addrtype = ADDRTYPE_INET6;
 119                 pkaddr->length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 120                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 121                 return true;
 122         }
 123 #endif
 124         if (paddr->ss_family == AF_INET) {
 125                 pkaddr->addrtype = ADDRTYPE_INET;
 126                 pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 127                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 128                 return true;
 129         }
 130         return false;
 131 }
 132 #else
 133 #error UNKNOWN_ADDRTYPE
 134 #endif
 135
 136 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_C_STRING_TO_KEY)
 137 /* MIT */
 138 int create_kerberos_key_from_string_direct(krb5_context context,
 139                                                   krb5_principal host_princ,
 140                                                   krb5_data *password,
 141                                                   krb5_keyblock *key,
 142                                                   krb5_enctype enctype)
 143 {
 144         int ret = 0;
 145         krb5_data salt;
 146
 147         ret = krb5_principal2salt(context, host_princ, &salt);
 148         if (ret) {
 149                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 150                 return ret;
 151         }
 152         ret = krb5_c_string_to_key(context, enctype, password, &salt, key);
 153         SAFE_FREE(salt.data);
 154
 155         return ret;
 156 }
 157 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 158 /* Heimdal */
 159 int create_kerberos_key_from_string_direct(krb5_context context,
 160                                                   krb5_principal host_princ,
 161                                                   krb5_data *password,
 162                                                   krb5_keyblock *key,
 163                                                   krb5_enctype enctype)
 164 {
 165         int ret;
 166         krb5_salt salt;
 167
 168         ret = krb5_get_pw_salt(context, host_princ, &salt);
 169         if (ret) {
 170                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 171                 return ret;
 172         }
 173
 174         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
 175         krb5_free_salt(context, salt);
 176
 177         return ret;
 178 }
 179 #else
 180 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 181 #endif
 182
 183 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 184  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 185                                             krb5_enctype **enctypes)
 186 {
 187         return krb5_get_permitted_enctypes(context, enctypes);
 188 }
 189 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 190  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 191                                             krb5_enctype **enctypes)
 192 {
 193 #ifdef HAVE_KRB5_PDU_NONE_DECL
 194         return krb5_get_default_in_tkt_etypes(context, KRB5_PDU_NONE, enctypes);
 195 #else
 196         return krb5_get_default_in_tkt_etypes(context, enctypes);
 197 #endif
 198 }
 199 #else
 200 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 201 #endif
 202
 203 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 204  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 205                                         krb5_auth_context auth_context,
 206                                         krb5_keyblock *keyblock)
 207 {
 208         return krb5_auth_con_setkey(context, auth_context, keyblock);
 209 }
 210 #endif
 211
 212 bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
 213                            DATA_BLOB *edata,
 214                            DATA_BLOB *edata_out)
 215 {
 216         DATA_BLOB edata_contents;
 217         ASN1_DATA *data;
 218         int edata_type;
 219
 220         if (!edata->length) {
 221                 return false;
 222         }
 223
 224         data = asn1_init(mem_ctx);
 225         if (data == NULL) {
 226                 return false;
 227         }
 228
 229         asn1_load(data, *edata);
 230         asn1_start_tag(data, ASN1_SEQUENCE(0));
 231         asn1_start_tag(data, ASN1_CONTEXT(1));
 232         asn1_read_Integer(data, &edata_type);
 233
 234         if (edata_type != KRB5_PADATA_PW_SALT) {
 235                 DEBUG(0,("edata is not of required type %d but of type %d\n",
 236                         KRB5_PADATA_PW_SALT, edata_type));
 237                 asn1_free(data);
 238                 return false;
 239         }
 240
 241         asn1_start_tag(data, ASN1_CONTEXT(2));
 242         asn1_read_OctetString(data, talloc_tos(), &edata_contents);
 243         asn1_end_tag(data);
 244         asn1_end_tag(data);
 245         asn1_end_tag(data);
 246         asn1_free(data);
 247
 248         *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
 249
 250         data_blob_free(&edata_contents);
 251
 252         return true;
 253 }
 254
 255
 256 static bool ads_cleanup_expired_creds(krb5_context context,
 257                                       krb5_ccache  ccache,
 258                                       krb5_creds  *credsp)
 259 {
 260         krb5_error_code retval;
 261         const char *cc_type = krb5_cc_get_type(context, ccache);
 262
 263         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 264                   cc_type, krb5_cc_get_name(context, ccache),
 265                   http_timestring(talloc_tos(), credsp->times.endtime)));
 266
 267         /* we will probably need new tickets if the current ones
 268            will expire within 10 seconds.
 269         */
 270         if (credsp->times.endtime >= (time(NULL) + 10))
 271                 return false;
 272
 273         /* heimdal won't remove creds from a file ccache, and
 274            perhaps we shouldn't anyway, since internally we
 275            use memory ccaches, and a FILE one probably means that
 276            we're using creds obtained outside of our exectuable
 277         */
 278         if (strequal(cc_type, "FILE")) {
 279                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 280                 return false;
 281         }
 282
 283         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 284         if (retval) {
 285                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 286                           error_message(retval)));
 287                 /* If we have an error in this, we want to display it,
 288                    but continue as though we deleted it */
 289         }
 290         return true;
 291 }
 292
 293 /* Allocate and setup the auth context into the state we need. */
 294
 295 static krb5_error_code setup_auth_context(krb5_context context,
 296                         krb5_auth_context *auth_context)
 297 {
 298         krb5_error_code retval;
 299
 300         retval = krb5_auth_con_init(context, auth_context );
 301         if (retval) {
 302                 DEBUG(1,("krb5_auth_con_init failed (%s)\n",
 303                         error_message(retval)));
 304                 return retval;
 305         }
 306
 307         /* Ensure this is an addressless ticket. */
 308         retval = krb5_auth_con_setaddrs(context, *auth_context, NULL, NULL);
 309         if (retval) {
 310                 DEBUG(1,("krb5_auth_con_setaddrs failed (%s)\n",
 311                         error_message(retval)));
 312         }
 313
 314         return retval;
 315 }
 316
 317 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 318 static krb5_error_code create_gss_checksum(krb5_data *in_data, /* [inout] */
 319                                                 uint32_t gss_flags)
 320 {
 321         unsigned int orig_length = in_data->length;
 322         unsigned int base_cksum_size = GSSAPI_CHECKSUM_SIZE;
 323         char *gss_cksum = NULL;
 324
 325         if (orig_length) {
 326                 /* Extra length field for delgated ticket. */
 327                 base_cksum_size += 4;
 328         }
 329
 330         if ((unsigned int)base_cksum_size + orig_length <
 331                         (unsigned int)base_cksum_size) {
 332                 return EINVAL;
 333         }
 334
 335         gss_cksum = (char *)SMB_MALLOC(base_cksum_size + orig_length);
 336         if (gss_cksum == NULL) {
 337                 return ENOMEM;
 338         }
 339
 340         memset(gss_cksum, '\0', base_cksum_size + orig_length);
 341         SIVAL(gss_cksum, 0, GSSAPI_BNDLENGTH);
 342
 343         /*
 344          * GSS_C_NO_CHANNEL_BINDINGS means 16 zero bytes.
 345          * This matches the behavior of heimdal and mit.
 346          *
 347          * And it is needed to work against some closed source
 348          * SMB servers.
 349          *
 350          * See bug #7883
 351          */
 352         memset(&gss_cksum[4], 0x00, GSSAPI_BNDLENGTH);
 353
 354         SIVAL(gss_cksum, 20, gss_flags);
 355
 356         if (orig_length) {
 357                 SSVAL(gss_cksum, 24, 1); /* The Delegation Option identifier */
 358                 SSVAL(gss_cksum, 26, orig_length);
 359                 /* Copy the kerberos KRB_CRED data */
 360                 memcpy(gss_cksum + 28, in_data->data, orig_length);
 361                 free(in_data->data);
 362                 in_data->data = NULL;
 363                 in_data->length = 0;
 364         }
 365         in_data->data = gss_cksum;
 366         in_data->length = base_cksum_size + orig_length;
 367         return 0;
 368 }
 369 #endif
 370
 371 /**************************************************************
 372  krb5_parse_name that takes a UNIX charset.
 373 **************************************************************/
 374
 375 krb5_error_code smb_krb5_parse_name(krb5_context context,
 376                                 const char *name, /* in unix charset */
 377                                 krb5_principal *principal)
 378 {
 379         krb5_error_code ret;
 380         char *utf8_name;
 381         size_t converted_size;
 382         TALLOC_CTX *frame = talloc_stackframe();
 383
 384         if (!push_utf8_talloc(frame, &utf8_name, name, &converted_size)) {
 385                 talloc_free(frame);
 386                 return ENOMEM;
 387         }
 388
 389         ret = krb5_parse_name(context, utf8_name, principal);
 390         TALLOC_FREE(frame);
 391         return ret;
 392 }
 393
 394 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 395 void krb5_free_unparsed_name(krb5_context context, char *val)
 396 {
 397         SAFE_FREE(val);
 398 }
 399 #endif
 400
 401 /**************************************************************
 402  krb5_parse_name that returns a UNIX charset name. Must
 403  be freed with talloc_free() call.
 404 **************************************************************/
 405
 406 krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
 407                                       krb5_context context,
 408                                       krb5_const_principal principal,
 409                                       char **unix_name)
 410 {
 411         krb5_error_code ret;
 412         char *utf8_name;
 413         size_t converted_size;
 414
 415         *unix_name = NULL;
 416         ret = krb5_unparse_name(context, principal, &utf8_name);
 417         if (ret) {
 418                 return ret;
 419         }
 420
 421         if (!pull_utf8_talloc(mem_ctx, unix_name, utf8_name, &converted_size)) {
 422                 krb5_free_unparsed_name(context, utf8_name);
 423                 return ENOMEM;
 424         }
 425         krb5_free_unparsed_name(context, utf8_name);
 426         return 0;
 427 }
 428
 429 krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
 430                                             const char *name,
 431                                             krb5_principal *principal)
 432 {
 433         /* we are cheating here because parse_name will in fact set the realm.
 434          * We don't care as the only caller of smb_krb5_parse_name_norealm
 435          * ignores the realm anyway when calling
 436          * smb_krb5_principal_compare_any_realm later - Guenther */
 437
 438         return smb_krb5_parse_name(context, name, principal);
 439 }
 440
 441 bool smb_krb5_principal_compare_any_realm(krb5_context context,
 442                                           krb5_const_principal princ1,
 443                                           krb5_const_principal princ2)
 444 {
 445         return krb5_principal_compare_any_realm(context, princ1, princ2);
 446 }
 447
 448 /*
 449   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 450 */
 451 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 452                                        krb5_auth_context *auth_context,
 453                                        const krb5_flags ap_req_options,
 454                                        const char *principal,
 455                                        krb5_ccache ccache,
 456                                        krb5_data *outbuf,
 457                                        time_t *expire_time,
 458                                        const char *impersonate_princ_s)
 459 {
 460         krb5_error_code           retval;
 461         krb5_principal    server;
 462         krb5_principal impersonate_princ = NULL;
 463         krb5_creds              * credsp;
 464         krb5_creds                creds;
 465         krb5_data in_data;
 466         bool creds_ready = false;
 467         int i = 0, maxtries = 3;
 468
 469         ZERO_STRUCT(in_data);
 470
 471         retval = smb_krb5_parse_name(context, principal, &server);
 472         if (retval) {
 473                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 474                 return retval;
 475         }
 476
 477         if (impersonate_princ_s) {
 478                 retval = smb_krb5_parse_name(context, impersonate_princ_s,
 479                                              &impersonate_princ);
 480                 if (retval) {
 481                         DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", impersonate_princ_s));
 482                         goto cleanup_princ;
 483                 }
 484         }
 485
 486         /* obtain ticket & session key */
 487         ZERO_STRUCT(creds);
 488         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 489                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 490                          error_message(retval)));
 491                 goto cleanup_princ;
 492         }
 493
 494         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 495                 /* This can commonly fail on smbd startup with no ticket in the cache.
 496                  * Report at higher level than 1. */
 497                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 498                          error_message(retval)));
 499                 goto cleanup_creds;
 500         }
 501
 502         while (!creds_ready && (i < maxtries)) {
 503
 504                 if ((retval = smb_krb5_get_credentials(context, ccache,
 505                                                        creds.client,
 506                                                        creds.server,
 507                                                        impersonate_princ,
 508                                                        &credsp))) {
 509                         DEBUG(1,("ads_krb5_mk_req: smb_krb5_get_credentials failed for %s (%s)\n",
 510                                 principal, error_message(retval)));
 511                         goto cleanup_creds;
 512                 }
 513
 514                 /* cope with ticket being in the future due to clock skew */
 515                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 516                         time_t t = time(NULL);
 517                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 518                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 519                         krb5_set_real_time(context, t + time_offset + 1, 0);
 520                 }
 521
 522                 if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
 523                         creds_ready = true;
 524                 }
 525
 526                 i++;
 527         }
 528
 529         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 530                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 531                   http_timestring(talloc_tos(), (unsigned)credsp->times.endtime),
 532                   (unsigned)credsp->times.endtime));
 533
 534         if (expire_time) {
 535                 *expire_time = (time_t)credsp->times.endtime;
 536         }
 537
 538         /* Allocate the auth_context. */
 539         retval = setup_auth_context(context, auth_context);
 540         if (retval) {
 541                 DEBUG(1,("setup_auth_context failed (%s)\n",
 542                         error_message(retval)));
 543                 goto cleanup_creds;
 544         }
 545
 546 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 547         {
 548                 uint32_t gss_flags = 0;
 549
 550                 if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
 551                         /* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
 552                          as part of the kerberos exchange. */
 553
 554                         DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n")  );
 555
 556                         retval = krb5_auth_con_setuseruserkey(context,
 557                                         *auth_context,
 558                                         &credsp->keyblock );
 559                         if (retval) {
 560                                 DEBUG(1,("krb5_auth_con_setuseruserkey failed (%s)\n",
 561                                         error_message(retval)));
 562                                 goto cleanup_creds;
 563                         }
 564
 565                         /* Must use a subkey for forwarded tickets. */
 566                         retval = krb5_auth_con_setflags(context,
 567                                 *auth_context,
 568                                 KRB5_AUTH_CONTEXT_USE_SUBKEY);
 569                         if (retval) {
 570                                 DEBUG(1,("krb5_auth_con_setflags failed (%s)\n",
 571                                         error_message(retval)));
 572                                 goto cleanup_creds;
 573                         }
 574
 575                         retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
 576                                 *auth_context,  /* Authentication context [in] */
 577                                 discard_const_p(char, KRB5_TGS_NAME),  /* Ticket service name ("krbtgt") [in] */
 578                                 credsp->client, /* Client principal for the tgt [in] */
 579                                 credsp->server, /* Server principal for the tgt [in] */
 580                                 ccache,         /* Credential cache to use for storage [in] */
 581                                 1,              /* Turn on for "Forwardable ticket" [in] */
 582                                 &in_data );     /* Resulting response [out] */
 583
 584                         if (retval) {
 585                                 DEBUG( 3, ("krb5_fwd_tgt_creds failed (%s)\n",
 586                                            error_message( retval ) ) );
 587
 588                                 /*
 589                                  * This is not fatal. Delete the *auth_context and continue
 590                                  * with krb5_mk_req_extended to get a non-forwardable ticket.
 591                                  */
 592
 593                                 if (in_data.data) {
 594                                         free( in_data.data );
 595                                         in_data.data = NULL;
 596                                         in_data.length = 0;
 597                                 }
 598                                 krb5_auth_con_free(context, *auth_context);
 599                                 *auth_context = NULL;
 600                                 retval = setup_auth_context(context, auth_context);
 601                                 if (retval) {
 602                                         DEBUG(1,("setup_auth_context failed (%s)\n",
 603                                                 error_message(retval)));
 604                                         goto cleanup_creds;
 605                                 }
 606                         } else {
 607                                 /* We got a delegated ticket. */
 608                                 gss_flags |= GSS_C_DELEG_FLAG;
 609                         }
 610                 }
 611
 612                 /* Frees and reallocates in_data into a GSS checksum blob. */
 613                 retval = create_gss_checksum(&in_data, gss_flags);
 614                 if (retval) {
 615                         goto cleanup_data;
 616                 }
 617
 618                 /* We always want GSS-checksum types. */
 619                 retval = krb5_auth_con_set_req_cksumtype(context, *auth_context, GSSAPI_CHECKSUM );
 620                 if (retval) {
 621                         DEBUG(1,("krb5_auth_con_set_req_cksumtype failed (%s)\n",
 622                                 error_message(retval)));
 623                         goto cleanup_data;
 624                 }
 625         }
 626 #endif
 627
 628         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 629                                       &in_data, credsp, outbuf);
 630         if (retval) {
 631                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 632                          error_message(retval)));
 633         }
 634
 635 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 636 cleanup_data:
 637 #endif
 638
 639         if (in_data.data) {
 640                 free( in_data.data );
 641                 in_data.length = 0;
 642         }
 643
 644         krb5_free_creds(context, credsp);
 645
 646 cleanup_creds:
 647         krb5_free_cred_contents(context, &creds);
 648
 649 cleanup_princ:
 650         krb5_free_principal(context, server);
 651         if (impersonate_princ) {
 652                 krb5_free_principal(context, impersonate_princ);
 653         }
 654
 655         return retval;
 656 }
 657
 658 void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 659 {
 660 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 661         if (pdata->data) {
 662                 krb5_free_data_contents(context, pdata);
 663         }
 664 #elif defined(HAVE_KRB5_DATA_FREE)
 665         krb5_data_free(context, pdata);
 666 #else
 667         SAFE_FREE(pdata->data);
 668 #endif
 669 }
 670
 671 /*
 672   get a kerberos5 ticket for the given service
 673 */
 674 int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
 675                         const char *principal, time_t time_offset,
 676                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 677                         uint32_t extra_ap_opts, const char *ccname,
 678                         time_t *tgs_expire,
 679                         const char *impersonate_princ_s)
 680
 681 {
 682         krb5_error_code retval;
 683         krb5_data packet;
 684         krb5_context context = NULL;
 685         krb5_ccache ccdef = NULL;
 686         krb5_auth_context auth_context = NULL;
 687         krb5_enctype enc_types[] = {
 688 #ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
 689                 ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 690 #endif
 691 #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
 692                 ENCTYPE_AES128_CTS_HMAC_SHA1_96,
 693 #endif
 694                 ENCTYPE_ARCFOUR_HMAC,
 695                 ENCTYPE_DES_CBC_MD5,
 696                 ENCTYPE_DES_CBC_CRC,
 697                 ENCTYPE_NULL};
 698
 699         initialize_krb5_error_table();
 700         retval = krb5_init_context(&context);
 701         if (retval) {
 702                 DEBUG(1, ("krb5_init_context failed (%s)\n",
 703                          error_message(retval)));
 704                 goto failed;
 705         }
 706
 707         if (time_offset != 0) {
 708                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 709         }
 710
 711         if ((retval = krb5_cc_resolve(context, ccname ?
 712                         ccname : krb5_cc_default_name(context), &ccdef))) {
 713                 DEBUG(1, ("krb5_cc_default failed (%s)\n",
 714                          error_message(retval)));
 715                 goto failed;
 716         }
 717
 718         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 719                 DEBUG(1, ("krb5_set_default_tgs_ktypes failed (%s)\n",
 720                          error_message(retval)));
 721                 goto failed;
 722         }
 723
 724         retval = ads_krb5_mk_req(context, &auth_context,
 725                                 AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 726                                 principal, ccdef, &packet,
 727                                 tgs_expire, impersonate_princ_s);
 728         if (retval) {
 729                 goto failed;
 730         }
 731
 732         get_krb5_smb_session_key(mem_ctx, context, auth_context,
 733                                  session_key_krb5, false);
 734
 735         *ticket = data_blob_talloc(mem_ctx, packet.data, packet.length);
 736
 737         kerberos_free_data_contents(context, &packet);
 738
 739 failed:
 740
 741         if (context) {
 742                 if (ccdef)
 743                         krb5_cc_close(context, ccdef);
 744                 if (auth_context)
 745                         krb5_auth_con_free(context, auth_context);
 746                 krb5_free_context(context);
 747         }
 748
 749         return retval;
 750 }
 751
 752 bool get_krb5_smb_session_key(TALLOC_CTX *mem_ctx,
 753                               krb5_context context,
 754                               krb5_auth_context auth_context,
 755                               DATA_BLOB *session_key, bool remote)
 756 {
 757         krb5_keyblock *skey = NULL;
 758         krb5_error_code err = 0;
 759         bool ret = false;
 760
 761         if (remote) {
 762                 err = krb5_auth_con_getremotesubkey(context,
 763                                                     auth_context, &skey);
 764         } else {
 765                 err = krb5_auth_con_getlocalsubkey(context,
 766                                                    auth_context, &skey);
 767         }
 768
 769         if (err || skey == NULL) {
 770                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 771                 goto done;
 772         }
 773
 774         DEBUG(10, ("Got KRB5 session key of length %d\n",
 775                    (int)KRB5_KEY_LENGTH(skey)));
 776
 777         *session_key = data_blob_talloc(mem_ctx,
 778                                          KRB5_KEY_DATA(skey),
 779                                          KRB5_KEY_LENGTH(skey));
 780         dump_data_pw("KRB5 Session Key:\n",
 781                      session_key->data,
 782                      session_key->length);
 783
 784         ret = true;
 785
 786 done:
 787         if (skey) {
 788                 krb5_free_keyblock(context, skey);
 789         }
 790
 791         return ret;
 792 }
 793
 794
 795 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 796  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 797
 798  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 799 {
 800         static krb5_data kdata;
 801
 802         kdata.data = discard_const_p(char, krb5_principal_get_comp_string(context, principal, i));
 803         kdata.length = strlen((const char *)kdata.data);
 804         return &kdata;
 805 }
 806 #endif
 807
 808 /* Prototypes */
 809
 810  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
 811                                        const char *client_string,       /* gd@BER.SUSE.DE */
 812                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
 813                                        time_t *expire_time)
 814 {
 815         krb5_error_code ret;
 816         krb5_context context = NULL;
 817         krb5_ccache ccache = NULL;
 818         krb5_principal client = NULL;
 819         krb5_creds creds, creds_in, *creds_out = NULL;
 820
 821         ZERO_STRUCT(creds);
 822         ZERO_STRUCT(creds_in);
 823
 824         initialize_krb5_error_table();
 825         ret = krb5_init_context(&context);
 826         if (ret) {
 827                 goto done;
 828         }
 829
 830         if (!ccache_string) {
 831                 ccache_string = krb5_cc_default_name(context);
 832         }
 833
 834         if (!ccache_string) {
 835                 ret = EINVAL;
 836                 goto done;
 837         }
 838
 839         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
 840
 841         /* FIXME: we should not fall back to defaults */
 842         ret = krb5_cc_resolve(context, discard_const_p(char, ccache_string), &ccache);
 843         if (ret) {
 844                 goto done;
 845         }
 846
 847         if (client_string) {
 848                 ret = smb_krb5_parse_name(context, client_string, &client);
 849                 if (ret) {
 850                         goto done;
 851                 }
 852         } else {
 853                 ret = krb5_cc_get_principal(context, ccache, &client);
 854                 if (ret) {
 855                         goto done;
 856                 }
 857         }
 858
 859         ret = krb5_get_renewed_creds(context, &creds, client, ccache, discard_const_p(char, service_string));
 860         if (ret) {
 861                 DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
 862                 goto done;
 863         }
 864
 865         /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
 866         ret = krb5_cc_initialize(context, ccache, client);
 867         if (ret) {
 868                 goto done;
 869         }
 870
 871         ret = krb5_cc_store_cred(context, ccache, &creds);
 872
 873         if (expire_time) {
 874                 *expire_time = (time_t) creds.times.endtime;
 875         }
 876
 877 done:
 878         krb5_free_cred_contents(context, &creds_in);
 879
 880         if (creds_out) {
 881                 krb5_free_creds(context, creds_out);
 882         } else {
 883                 krb5_free_cred_contents(context, &creds);
 884         }
 885
 886         if (client) {
 887                 krb5_free_principal(context, client);
 888         }
 889         if (ccache) {
 890                 krb5_cc_close(context, ccache);
 891         }
 892         if (context) {
 893                 krb5_free_context(context);
 894         }
 895
 896         return ret;
 897 }
 898
 899  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
 900 {
 901         krb5_error_code ret = 0;
 902         if (addr == NULL) {
 903                 return ret;
 904         }
 905 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
 906         krb5_free_addresses(context, addr->addrs);
 907 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
 908         ret = krb5_free_addresses(context, addr->addrs);
 909         SAFE_FREE(addr->addrs);
 910 #endif
 911         SAFE_FREE(addr);
 912         addr = NULL;
 913         return ret;
 914 }
 915
 916 #define MAX_NETBIOSNAME_LEN 16
 917  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr,
 918                                                    const char *netbios_name)
 919 {
 920         krb5_error_code ret = 0;
 921         char buf[MAX_NETBIOSNAME_LEN];
 922         int len;
 923 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
 924         krb5_address **addrs = NULL;
 925 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
 926         krb5_addresses *addrs = NULL;
 927 #endif
 928
 929         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
 930         if (*kerb_addr == NULL) {
 931                 return ENOMEM;
 932         }
 933
 934         /* temporarily duplicate put_name() code here to avoid dependency
 935          * issues for a 5 lines function */
 936         len = strlen(netbios_name);
 937         memcpy(buf, netbios_name,
 938                 (len < MAX_NETBIOSNAME_LEN) ? len : MAX_NETBIOSNAME_LEN - 1);
 939         if (len < MAX_NETBIOSNAME_LEN - 1) {
 940                 memset(buf + len, ' ', MAX_NETBIOSNAME_LEN - 1 - len);
 941         }
 942         buf[MAX_NETBIOSNAME_LEN - 1] = 0x20;
 943
 944 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
 945         {
 946                 int num_addr = 2;
 947
 948                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
 949                 if (addrs == NULL) {
 950                         SAFE_FREE(*kerb_addr);
 951                         return ENOMEM;
 952                 }
 953
 954                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
 955
 956                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
 957                 if (addrs[0] == NULL) {
 958                         SAFE_FREE(addrs);
 959                         SAFE_FREE(*kerb_addr);
 960                         return ENOMEM;
 961                 }
 962
 963                 addrs[0]->magic = KV5M_ADDRESS;
 964                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
 965                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
 966                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
 967                 if (addrs[0]->contents == NULL) {
 968                         SAFE_FREE(addrs[0]);
 969                         SAFE_FREE(addrs);
 970                         SAFE_FREE(*kerb_addr);
 971                         return ENOMEM;
 972                 }
 973
 974                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
 975
 976                 addrs[1] = NULL;
 977         }
 978 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
 979         {
 980                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
 981                 if (addrs == NULL) {
 982                         SAFE_FREE(*kerb_addr);
 983                         return ENOMEM;
 984                 }
 985
 986                 memset(addrs, 0, sizeof(krb5_addresses));
 987
 988                 addrs->len = 1;
 989                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
 990                 if (addrs->val == NULL) {
 991                         SAFE_FREE(addrs);
 992                         SAFE_FREE(kerb_addr);
 993                         return ENOMEM;
 994                 }
 995
 996                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
 997                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
 998                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
 999                 if (addrs->val[0].address.data == NULL) {
1000                         SAFE_FREE(addrs->val);
1001                         SAFE_FREE(addrs);
1002                         SAFE_FREE(*kerb_addr);
1003                         return ENOMEM;
1004                 }
1005
1006                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1007         }
1008 #else
1009 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1010 #endif
1011         (*kerb_addr)->addrs = addrs;
1012
1013         return ret;
1014 }
1015
1016  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1017 {
1018 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1019         krb5_free_error_contents(context, krberror);
1020 #else /* MIT */
1021         krb5_free_error(context, krberror);
1022 #endif
1023 }
1024
1025  krb5_error_code handle_krberror_packet(krb5_context context,
1026                                         krb5_data *packet)
1027 {
1028         krb5_error_code ret;
1029         bool got_error_code = false;
1030
1031         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1032
1033 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1034         {
1035                 krb5_error krberror;
1036
1037                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1038                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1039                                 error_message(ret)));
1040                         return ret;
1041                 }
1042
1043                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1044                         ret = (krb5_error_code) krberror.error_code;
1045                         got_error_code = true;
1046                 }
1047
1048                 smb_krb5_free_error(context, &krberror);
1049         }
1050 #else /* MIT */
1051         {
1052                 krb5_error *krberror;
1053
1054                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1055                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1056                                 error_message(ret)));
1057                         return ret;
1058                 }
1059
1060                 if (krberror->e_data.data == NULL) {
1061 #if defined(ERROR_TABLE_BASE_krb5)
1062                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1063 #else
1064                         ret = (krb5_error_code)krberror->error;
1065 #endif
1066                         got_error_code = true;
1067                 }
1068                 smb_krb5_free_error(context, krberror);
1069         }
1070 #endif
1071         if (got_error_code) {
1072                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1073                         error_message(ret), ret));
1074         }
1075         return ret;
1076 }
1077
1078 krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1079                                             krb5_get_init_creds_opt **opt)
1080 {
1081         /* Heimdal or modern MIT version */
1082         return krb5_get_init_creds_opt_alloc(context, opt);
1083 }
1084
1085 void smb_krb5_get_init_creds_opt_free(krb5_context context,
1086                                 krb5_get_init_creds_opt *opt)
1087 {
1088         /* Modern MIT or Heimdal version */
1089         krb5_get_init_creds_opt_free(context, opt);
1090 }
1091
1092 krb5_enctype smb_get_enctype_from_kt_entry(krb5_keytab_entry *kt_entry)
1093 {
1094         return KRB5_KEY_TYPE(KRB5_KT_KEY(kt_entry));
1095 }
1096
1097 krb5_error_code smb_krb5_kt_free_entry(krb5_context context,
1098                                         krb5_keytab_entry *kt_entry)
1099 {
1100 /* Try krb5_free_keytab_entry_contents first, since
1101  * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
1102  * krb5_kt_free_entry but only has a prototype for the first, while the
1103  * second is considered private.
1104  */
1105 #if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
1106         return krb5_free_keytab_entry_contents(context, kt_entry);
1107 #elif defined(HAVE_KRB5_KT_FREE_ENTRY)
1108         return krb5_kt_free_entry(context, kt_entry);
1109 #else
1110 #error UNKNOWN_KT_FREE_FUNCTION
1111 #endif
1112 }
1113
1114
1115 /* caller needs to free etype_s */
1116 krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1117                                            krb5_enctype enctype,
1118                                            char **etype_s)
1119 {
1120 #ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1121         return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1122 #elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1123         char buf[256];
1124         krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1125         if (ret) {
1126                 return ret;
1127         }
1128         *etype_s = SMB_STRDUP(buf);
1129         if (!*etype_s) {
1130                 return ENOMEM;
1131         }
1132         return ret;
1133 #else
1134 #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1135 #endif
1136 }
1137
1138 /**********************************************************************
1139  * Open a krb5 keytab with flags, handles readonly or readwrite access and
1140  * allows to process non-default keytab names.
1141  * @param context krb5_context
1142  * @param keytab_name_req string
1143  * @param write_access bool if writable keytab is required
1144  * @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1145  * @return krb5_error_code
1146 **********************************************************************/
1147
1148 /* This MAX_NAME_LEN is a constant defined in krb5.h */
1149 #ifndef MAX_KEYTAB_NAME_LEN
1150 #define MAX_KEYTAB_NAME_LEN 1100
1151 #endif
1152
1153 krb5_error_code smb_krb5_open_keytab(krb5_context context,
1154                                      const char *keytab_name_req,
1155                                      bool write_access,
1156                                      krb5_keytab *keytab)
1157 {
1158         krb5_error_code ret = 0;
1159         TALLOC_CTX *mem_ctx;
1160         char keytab_string[MAX_KEYTAB_NAME_LEN];
1161         char *kt_str = NULL;
1162         bool found_valid_name = false;
1163         const char *pragma = "FILE";
1164         const char *tmp = NULL;
1165
1166         if (!write_access && !keytab_name_req) {
1167                 /* caller just wants to read the default keytab readonly, so be it */
1168                 return krb5_kt_default(context, keytab);
1169         }
1170
1171         mem_ctx = talloc_init("smb_krb5_open_keytab");
1172         if (!mem_ctx) {
1173                 return ENOMEM;
1174         }
1175
1176 #ifdef HAVE_WRFILE_KEYTAB
1177         if (write_access) {
1178                 pragma = "WRFILE";
1179         }
1180 #endif
1181
1182         if (keytab_name_req) {
1183
1184                 if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1185                         ret = KRB5_CONFIG_NOTENUFSPACE;
1186                         goto out;
1187                 }
1188
1189                 if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) ||
1190                     (strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1191                         tmp = keytab_name_req;
1192                         goto resolve;
1193                 }
1194
1195                 if (keytab_name_req[0] != '/') {
1196                         ret = KRB5_KT_BADNAME;
1197                         goto out;
1198                 }
1199
1200                 tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1201                 if (!tmp) {
1202                         ret = ENOMEM;
1203                         goto out;
1204                 }
1205
1206                 goto resolve;
1207         }
1208
1209         /* we need to handle more complex keytab_strings, like:
1210          * "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1211
1212         ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1213         if (ret) {
1214                 goto out;
1215         }
1216
1217         DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1218
1219         tmp = talloc_strdup(mem_ctx, keytab_string);
1220         if (!tmp) {
1221                 ret = ENOMEM;
1222                 goto out;
1223         }
1224
1225         if (strncmp(tmp, "ANY:", 4) == 0) {
1226                 tmp += 4;
1227         }
1228
1229         memset(&keytab_string, '\0', sizeof(keytab_string));
1230
1231         while (next_token_talloc(mem_ctx, &tmp, &kt_str, ",")) {
1232                 if (strncmp(kt_str, "WRFILE:", 7) == 0) {
1233                         found_valid_name = true;
1234                         tmp = kt_str;
1235                         tmp += 7;
1236                 }
1237
1238                 if (strncmp(kt_str, "FILE:", 5) == 0) {
1239                         found_valid_name = true;
1240                         tmp = kt_str;
1241                         tmp += 5;
1242                 }
1243
1244                 if (tmp[0] == '/') {
1245                         /* Treat as a FILE: keytab definition. */
1246                         found_valid_name = true;
1247                 }
1248
1249                 if (found_valid_name) {
1250                         if (tmp[0] != '/') {
1251                                 ret = KRB5_KT_BADNAME;
1252                                 goto out;
1253                         }
1254
1255                         tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1256                         if (!tmp) {
1257                                 ret = ENOMEM;
1258                                 goto out;
1259                         }
1260                         break;
1261                 }
1262         }
1263
1264         if (!found_valid_name) {
1265                 ret = KRB5_KT_UNKNOWN_TYPE;
1266                 goto out;
1267         }
1268
1269  resolve:
1270         DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1271         ret = krb5_kt_resolve(context, tmp, keytab);
1272
1273  out:
1274         TALLOC_FREE(mem_ctx);
1275         return ret;
1276 }
1277
1278 krb5_error_code smb_krb5_keytab_name(TALLOC_CTX *mem_ctx,
1279                                      krb5_context context,
1280                                      krb5_keytab keytab,
1281                                      const char **keytab_name)
1282 {
1283         char keytab_string[MAX_KEYTAB_NAME_LEN];
1284         krb5_error_code ret = 0;
1285
1286         ret = krb5_kt_get_name(context, keytab,
1287                                keytab_string, MAX_KEYTAB_NAME_LEN - 2);
1288         if (ret) {
1289                 return ret;
1290         }
1291
1292         *keytab_name = talloc_strdup(mem_ctx, keytab_string);
1293         if (!*keytab_name) {
1294                 return ENOMEM;
1295         }
1296
1297         return ret;
1298 }
1299
1300 #if defined(HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE) && \
1301     defined(HAVE_KRB5_GET_CREDS_OPT_ALLOC) && \
1302     defined(HAVE_KRB5_GET_CREDS)
1303 static krb5_error_code smb_krb5_get_credentials_for_user_opt(krb5_context context,
1304                                                              krb5_ccache ccache,
1305                                                              krb5_principal me,
1306                                                              krb5_principal server,
1307                                                              krb5_principal impersonate_princ,
1308                                                              krb5_creds **out_creds)
1309 {
1310         krb5_error_code ret;
1311         krb5_get_creds_opt opt;
1312
1313         ret = krb5_get_creds_opt_alloc(context, &opt);
1314         if (ret) {
1315                 goto done;
1316         }
1317         krb5_get_creds_opt_add_options(context, opt, KRB5_GC_FORWARDABLE);
1318
1319         if (impersonate_princ) {
1320                 ret = krb5_get_creds_opt_set_impersonate(context, opt,
1321                                                          impersonate_princ);
1322                 if (ret) {
1323                         goto done;
1324                 }
1325         }
1326
1327         ret = krb5_get_creds(context, opt, ccache, server, out_creds);
1328         if (ret) {
1329                 goto done;
1330         }
1331
1332  done:
1333         if (opt) {
1334                 krb5_get_creds_opt_free(context, opt);
1335         }
1336         return ret;
1337 }
1338 #endif /* HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE */
1339
1340 #ifdef HAVE_KRB5_GET_CREDENTIALS_FOR_USER
1341 static krb5_error_code smb_krb5_get_credentials_for_user(krb5_context context,
1342                                                          krb5_ccache ccache,
1343                                                          krb5_principal me,
1344                                                          krb5_principal server,
1345                                                          krb5_principal impersonate_princ,
1346                                                          krb5_creds **out_creds)
1347 {
1348         krb5_error_code ret;
1349         krb5_creds in_creds;
1350
1351 #if !HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER
1352 krb5_error_code KRB5_CALLCONV
1353 krb5_get_credentials_for_user(krb5_context context, krb5_flags options,
1354                               krb5_ccache ccache, krb5_creds *in_creds,
1355                               krb5_data *subject_cert,
1356                               krb5_creds **out_creds);
1357 #endif /* !HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER */
1358
1359         ZERO_STRUCT(in_creds);
1360
1361         if (impersonate_princ) {
1362
1363                 in_creds.server = me;
1364                 in_creds.client = impersonate_princ;
1365
1366                 ret = krb5_get_credentials_for_user(context,
1367                                                     0, /* krb5_flags options */
1368                                                     ccache,
1369                                                     &in_creds,
1370                                                     NULL, /* krb5_data *subject_cert */
1371                                                     out_creds);
1372         } else {
1373                 in_creds.client = me;
1374                 in_creds.server = server;
1375
1376                 ret = krb5_get_credentials(context, 0, ccache,
1377                                            &in_creds, out_creds);
1378         }
1379
1380         return ret;
1381 }
1382 #endif /* HAVE_KRB5_GET_CREDENTIALS_FOR_USER */
1383
1384 /*
1385  * smb_krb5_get_credentials
1386  *
1387  * @brief Get krb5 credentials for a server
1388  *
1389  * @param[in] context           An initialized krb5_context
1390  * @param[in] ccache            An initialized krb5_ccache
1391  * @param[in] me                The krb5_principal of the caller
1392  * @param[in] server            The krb5_principal of the requested service
1393  * @param[in] impersonate_princ The krb5_principal of a user to impersonate as (optional)
1394  * @param[out] out_creds        The returned krb5_creds structure
1395  * @return krb5_error_code
1396  *
1397  */
1398 krb5_error_code smb_krb5_get_credentials(krb5_context context,
1399                                          krb5_ccache ccache,
1400                                          krb5_principal me,
1401                                          krb5_principal server,
1402                                          krb5_principal impersonate_princ,
1403                                          krb5_creds **out_creds)
1404 {
1405         krb5_error_code ret;
1406         krb5_creds *creds = NULL;
1407
1408         *out_creds = NULL;
1409
1410         if (impersonate_princ) {
1411 #ifdef HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE /* Heimdal */
1412                 ret = smb_krb5_get_credentials_for_user_opt(context, ccache, me, server, impersonate_princ, &creds);
1413 #elif defined(HAVE_KRB5_GET_CREDENTIALS_FOR_USER) /* MIT */
1414                 ret = smb_krb5_get_credentials_for_user(context, ccache, me, server, impersonate_princ, &creds);
1415 #else
1416                 ret = ENOTSUP;
1417 #endif
1418         } else {
1419                 krb5_creds in_creds;
1420
1421                 ZERO_STRUCT(in_creds);
1422
1423                 in_creds.client = me;
1424                 in_creds.server = server;
1425
1426                 ret = krb5_get_credentials(context, 0, ccache,
1427                                            &in_creds, &creds);
1428         }
1429         if (ret) {
1430                 goto done;
1431         }
1432
1433         if (out_creds) {
1434                 *out_creds = creds;
1435         }
1436
1437  done:
1438         if (creds && ret) {
1439                 krb5_free_creds(context, creds);
1440         }
1441
1442         return ret;
1443 }
1444
1445 krb5_error_code smb_krb5_keyblock_init_contents(krb5_context context,
1446                                                 krb5_enctype enctype,
1447                                                 const void *data,
1448                                                 size_t length,
1449                                                 krb5_keyblock *key)
1450 {
1451 #if defined(HAVE_KRB5_KEYBLOCK_INIT)
1452         return krb5_keyblock_init(context, enctype, data, length, key);
1453 #else
1454         memset(key, 0, sizeof(krb5_keyblock));
1455         KRB5_KEY_DATA(key) = SMB_MALLOC(length);
1456         if (NULL == KRB5_KEY_DATA(key)) {
1457                 return ENOMEM;
1458         }
1459         memcpy(KRB5_KEY_DATA(key), data, length);
1460         KRB5_KEY_LENGTH(key) = length;
1461         KRB5_KEY_TYPE(key) = enctype;
1462         return 0;
1463 #endif
1464 }
1465
1466 /*
1467   simulate a kinit, putting the tgt in the given credentials cache.
1468   Orignally by remus@snapserver.com
1469
1470   This version is built to use a keyblock, rather than needing the
1471   original password.
1472
1473   The impersonate_principal is the principal if NULL, or the principal
1474   to impersonate
1475
1476   The target_service defaults to the krbtgt if NULL, but could be
1477    kpasswd/realm or the local service (if we are doing s4u2self)
1478 */
1479 krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
1480                                            krb5_principal principal,
1481                                            krb5_keyblock *keyblock,
1482                                            const char *target_service,
1483                                            krb5_get_init_creds_opt *krb_options,
1484                                            time_t *expire_time,
1485                                            time_t *kdc_time)
1486 {
1487         krb5_error_code code = 0;
1488         krb5_creds my_creds;
1489
1490 #if defined(HAVE_KRB5_GET_INIT_CREDS_KEYBLOCK)
1491         code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal,
1492                                             keyblock, 0, target_service,
1493                                             krb_options);
1494 #elif defined(HAVE_KRB5_GET_INIT_CREDS_KEYTAB)
1495 {
1496 #define SMB_CREDS_KEYTAB "MEMORY:tmp_smb_creds_XXXXXX"
1497         char tmp_name[sizeof(SMB_CREDS_KEYTAB)];
1498         krb5_keytab_entry entry;
1499         krb5_keytab keytab;
1500
1501         memset(&entry, 0, sizeof(entry));
1502         entry.principal = principal;
1503         *(KRB5_KT_KEY(&entry)) = *keyblock;
1504
1505         memcpy(tmp_name, SMB_CREDS_KEYTAB, sizeof(SMB_CREDS_KEYTAB));
1506         mktemp(tmp_name);
1507         if (tmp_name[0] == 0) {
1508                 return KRB5_KT_BADNAME;
1509         }
1510         code = krb5_kt_resolve(ctx, tmp_name, &keytab);
1511         if (code) {
1512                 return code;
1513         }
1514
1515         code = krb5_kt_add_entry(ctx, keytab, &entry);
1516         if (code) {
1517                 (void)krb5_kt_close(ctx, keytab);
1518                 goto done;
1519         }
1520
1521         code = krb5_get_init_creds_keytab(ctx, &my_creds, principal,
1522                                           keytab, 0, target_service,
1523                                           krb_options);
1524         (void)krb5_kt_close(ctx, keytab);
1525 }
1526 #else
1527 #error krb5_get_init_creds_keyblock not available!
1528 #endif
1529         if (code) {
1530                 return code;
1531         }
1532
1533         code = krb5_cc_initialize(ctx, cc, principal);
1534         if (code) {
1535                 goto done;
1536         }
1537
1538         code = krb5_cc_store_cred(ctx, cc, &my_creds);
1539         if (code) {
1540                 goto done;
1541         }
1542
1543         if (expire_time) {
1544                 *expire_time = (time_t) my_creds.times.endtime;
1545         }
1546
1547         if (kdc_time) {
1548                 *kdc_time = (time_t) my_creds.times.starttime;
1549         }
1550
1551         code = 0;
1552 done:
1553         krb5_free_cred_contents(ctx, &my_creds);
1554         return code;
1555 }
1556
1557 krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
1558                                            krb5_principal principal,
1559                                            const char *password,
1560                                            const char *target_service,
1561                                            krb5_get_init_creds_opt *krb_options,
1562                                            time_t *expire_time,
1563                                            time_t *kdc_time)
1564 {
1565         krb5_error_code code = 0;
1566         krb5_creds my_creds;
1567
1568         code = krb5_get_init_creds_password(ctx, &my_creds, principal,
1569                                             password, NULL, NULL, 0,
1570                                             target_service, krb_options);
1571         if (code) {
1572                 return code;
1573         }
1574
1575         code = krb5_cc_initialize(ctx, cc, principal);
1576         if (code) {
1577                 goto done;
1578         }
1579
1580         code = krb5_cc_store_cred(ctx, cc, &my_creds);
1581         if (code) {
1582                 goto done;
1583         }
1584
1585         if (expire_time) {
1586                 *expire_time = (time_t) my_creds.times.endtime;
1587         }
1588
1589         if (kdc_time) {
1590                 *kdc_time = (time_t) my_creds.times.starttime;
1591         }
1592
1593         code = 0;
1594 done:
1595         krb5_free_cred_contents(ctx, &my_creds);
1596         return code;
1597 }
1598
1599 #ifdef SAMBA4_USES_HEIMDAL
1600 /*
1601   simulate a kinit, putting the tgt in the given credentials cache.
1602   Orignally by remus@snapserver.com
1603
1604   The impersonate_principal is the principal
1605
1606   The self_service, should be the local service (for S4U2Self if
1607   impersonate_principal is given).
1608
1609   The target_service defaults to the krbtgt if NULL, but could be
1610   kpasswd/realm or a remote service (for S4U2Proxy)
1611
1612 */
1613 krb5_error_code kerberos_kinit_s4u2_cc(krb5_context ctx,
1614                                         krb5_ccache store_cc,
1615                                         krb5_principal init_principal,
1616                                         const char *init_password,
1617                                         krb5_principal impersonate_principal,
1618                                         const char *self_service,
1619                                         const char *target_service,
1620                                         krb5_get_init_creds_opt *krb_options,
1621                                         time_t *expire_time,
1622                                         time_t *kdc_time)
1623 {
1624         krb5_error_code code = 0;
1625         krb5_get_creds_opt options;
1626         krb5_principal store_principal;
1627         krb5_creds store_creds;
1628         krb5_creds *s4u2self_creds;
1629         Ticket s4u2self_ticket;
1630         size_t s4u2self_ticketlen;
1631         krb5_creds *s4u2proxy_creds;
1632         krb5_principal self_princ;
1633         bool s4u2proxy;
1634         krb5_principal target_princ;
1635         krb5_ccache tmp_cc;
1636         const char *self_realm;
1637         krb5_principal blacklist_principal = NULL;
1638         krb5_principal whitelist_principal = NULL;
1639
1640         code = krb5_get_init_creds_password(ctx, &store_creds,
1641                                             init_principal,
1642                                             init_password,
1643                                             NULL, NULL,
1644                                             0,
1645                                             NULL,
1646                                             krb_options);
1647         if (code != 0) {
1648                 return code;
1649         }
1650
1651         store_principal = init_principal;
1652
1653         /*
1654          * We are trying S4U2Self now:
1655          *
1656          * As we do not want to expose our TGT in the
1657          * krb5_ccache, which is also holds the impersonated creds.
1658          *
1659          * Some low level krb5/gssapi function might use the TGT
1660          * identity and let the client act as our machine account.
1661          *
1662          * We need to avoid that and use a temporary krb5_ccache
1663          * in order to pass our TGT to the krb5_get_creds() function.
1664          */
1665         code = krb5_cc_new_unique(ctx, NULL, NULL, &tmp_cc);
1666         if (code != 0) {
1667                 krb5_free_cred_contents(ctx, &store_creds);
1668                 return code;
1669         }
1670
1671         code = krb5_cc_initialize(ctx, tmp_cc, store_creds.client);
1672         if (code != 0) {
1673                 krb5_cc_destroy(ctx, tmp_cc);
1674                 krb5_free_cred_contents(ctx, &store_creds);
1675                 return code;
1676         }
1677
1678         code = krb5_cc_store_cred(ctx, tmp_cc, &store_creds);
1679         if (code != 0) {
1680                 krb5_free_cred_contents(ctx, &store_creds);
1681                 krb5_cc_destroy(ctx, tmp_cc);
1682                 return code;
1683         }
1684
1685         /*
1686          * we need to remember the client principal of our
1687          * TGT and make sure the KDC does not return this
1688          * in the impersonated tickets. This can happen
1689          * if the KDC does not support S4U2Self and S4U2Proxy.
1690          */
1691         blacklist_principal = store_creds.client;
1692         store_creds.client = NULL;
1693         krb5_free_cred_contents(ctx, &store_creds);
1694
1695         /*
1696          * Check if we also need S4U2Proxy or if S4U2Self is
1697          * enough in order to get a ticket for the target.
1698          */
1699         if (target_service == NULL) {
1700                 s4u2proxy = false;
1701         } else if (strcmp(target_service, self_service) == 0) {
1702                 s4u2proxy = false;
1703         } else {
1704                 s4u2proxy = true;
1705         }
1706
1707         /*
1708          * For S4U2Self we need our own service principal,
1709          * which belongs to our own realm (available on
1710          * our client principal).
1711          */
1712         self_realm = krb5_principal_get_realm(ctx, init_principal);
1713
1714         code = krb5_parse_name(ctx, self_service, &self_princ);
1715         if (code != 0) {
1716                 krb5_free_principal(ctx, blacklist_principal);
1717                 krb5_cc_destroy(ctx, tmp_cc);
1718                 return code;
1719         }
1720
1721         code = krb5_principal_set_realm(ctx, self_princ, self_realm);
1722         if (code != 0) {
1723                 krb5_free_principal(ctx, blacklist_principal);
1724                 krb5_free_principal(ctx, self_princ);
1725                 krb5_cc_destroy(ctx, tmp_cc);
1726                 return code;
1727         }
1728
1729         code = krb5_get_creds_opt_alloc(ctx, &options);
1730         if (code != 0) {
1731                 krb5_free_principal(ctx, blacklist_principal);
1732                 krb5_free_principal(ctx, self_princ);
1733                 krb5_cc_destroy(ctx, tmp_cc);
1734                 return code;
1735         }
1736
1737         if (s4u2proxy) {
1738                 /*
1739                  * If we want S4U2Proxy, we need the forwardable flag
1740                  * on the S4U2Self ticket.
1741                  */
1742                 krb5_get_creds_opt_set_options(ctx, options, KRB5_GC_FORWARDABLE);
1743         }
1744
1745         code = krb5_get_creds_opt_set_impersonate(ctx, options,
1746                                                   impersonate_principal);
1747         if (code != 0) {
1748                 krb5_get_creds_opt_free(ctx, options);
1749                 krb5_free_principal(ctx, blacklist_principal);
1750                 krb5_free_principal(ctx, self_princ);
1751                 krb5_cc_destroy(ctx, tmp_cc);
1752                 return code;
1753         }
1754
1755         code = krb5_get_creds(ctx, options, tmp_cc,
1756                               self_princ, &s4u2self_creds);
1757         krb5_get_creds_opt_free(ctx, options);
1758         krb5_free_principal(ctx, self_princ);
1759         if (code != 0) {
1760                 krb5_free_principal(ctx, blacklist_principal);
1761                 krb5_cc_destroy(ctx, tmp_cc);
1762                 return code;
1763         }
1764
1765         if (!s4u2proxy) {
1766                 krb5_cc_destroy(ctx, tmp_cc);
1767
1768                 /*
1769                  * Now make sure we store the impersonated principal
1770                  * and creds instead of the TGT related stuff
1771                  * in the krb5_ccache of the caller.
1772                  */
1773                 code = krb5_copy_creds_contents(ctx, s4u2self_creds,
1774                                                 &store_creds);
1775                 krb5_free_creds(ctx, s4u2self_creds);
1776                 if (code != 0) {
1777                         return code;
1778                 }
1779
1780                 /*
1781                  * It's important to store the principal the KDC
1782                  * returned, as otherwise the caller would not find
1783                  * the S4U2Self ticket in the krb5_ccache lookup.
1784                  */
1785                 store_principal = store_creds.client;
1786                 goto store;
1787         }
1788
1789         /*
1790          * We are trying S4U2Proxy:
1791          *
1792          * We need the ticket from the S4U2Self step
1793          * and our TGT in order to get the delegated ticket.
1794          */
1795         code = decode_Ticket((const uint8_t *)s4u2self_creds->ticket.data,
1796                              s4u2self_creds->ticket.length,
1797                              &s4u2self_ticket,
1798                              &s4u2self_ticketlen);
1799         if (code != 0) {
1800                 krb5_free_creds(ctx, s4u2self_creds);
1801                 krb5_free_principal(ctx, blacklist_principal);
1802                 krb5_cc_destroy(ctx, tmp_cc);
1803                 return code;
1804         }
1805
1806         /*
1807          * we need to remember the client principal of the
1808          * S4U2Self stage and as it needs to match the one we
1809          * will get for the S4U2Proxy stage. We need this
1810          * in order to detect KDCs which does not support S4U2Proxy.
1811          */
1812         whitelist_principal = s4u2self_creds->client;
1813         s4u2self_creds->client = NULL;
1814         krb5_free_creds(ctx, s4u2self_creds);
1815
1816         /*
1817          * For S4U2Proxy we also got a target service principal,
1818          * which also belongs to our own realm (available on
1819          * our client principal).
1820          */
1821         code = krb5_parse_name(ctx, target_service, &target_princ);
1822         if (code != 0) {
1823                 free_Ticket(&s4u2self_ticket);
1824                 krb5_free_principal(ctx, whitelist_principal);
1825                 krb5_free_principal(ctx, blacklist_principal);
1826                 krb5_cc_destroy(ctx, tmp_cc);
1827                 return code;
1828         }
1829
1830         code = krb5_principal_set_realm(ctx, target_princ, self_realm);
1831         if (code != 0) {
1832                 free_Ticket(&s4u2self_ticket);
1833                 krb5_free_principal(ctx, target_princ);
1834                 krb5_free_principal(ctx, whitelist_principal);
1835                 krb5_free_principal(ctx, blacklist_principal);
1836                 krb5_cc_destroy(ctx, tmp_cc);
1837                 return code;
1838         }
1839
1840         code = krb5_get_creds_opt_alloc(ctx, &options);
1841         if (code != 0) {
1842                 free_Ticket(&s4u2self_ticket);
1843                 krb5_free_principal(ctx, target_princ);
1844                 krb5_free_principal(ctx, whitelist_principal);
1845                 krb5_free_principal(ctx, blacklist_principal);
1846                 krb5_cc_destroy(ctx, tmp_cc);
1847                 return code;
1848         }
1849
1850         krb5_get_creds_opt_set_options(ctx, options, KRB5_GC_FORWARDABLE);
1851         krb5_get_creds_opt_set_options(ctx, options, KRB5_GC_CONSTRAINED_DELEGATION);
1852
1853         code = krb5_get_creds_opt_set_ticket(ctx, options, &s4u2self_ticket);
1854         free_Ticket(&s4u2self_ticket);
1855         if (code != 0) {
1856                 krb5_get_creds_opt_free(ctx, options);
1857                 krb5_free_principal(ctx, target_princ);
1858                 krb5_free_principal(ctx, whitelist_principal);
1859                 krb5_free_principal(ctx, blacklist_principal);
1860                 krb5_cc_destroy(ctx, tmp_cc);
1861                 return code;
1862         }
1863
1864         code = krb5_get_creds(ctx, options, tmp_cc,
1865                               target_princ, &s4u2proxy_creds);
1866         krb5_get_creds_opt_free(ctx, options);
1867         krb5_free_principal(ctx, target_princ);
1868         krb5_cc_destroy(ctx, tmp_cc);
1869         if (code != 0) {
1870                 krb5_free_principal(ctx, whitelist_principal);
1871                 krb5_free_principal(ctx, blacklist_principal);
1872                 return code;
1873         }
1874
1875         /*
1876          * Now make sure we store the impersonated principal
1877          * and creds instead of the TGT related stuff
1878          * in the krb5_ccache of the caller.
1879          */
1880         code = krb5_copy_creds_contents(ctx, s4u2proxy_creds,
1881                                         &store_creds);
1882         krb5_free_creds(ctx, s4u2proxy_creds);
1883         if (code != 0) {
1884                 krb5_free_principal(ctx, whitelist_principal);
1885                 krb5_free_principal(ctx, blacklist_principal);
1886                 return code;
1887         }
1888
1889         /*
1890          * It's important to store the principal the KDC
1891          * returned, as otherwise the caller would not find
1892          * the S4U2Self ticket in the krb5_ccache lookup.
1893          */
1894         store_principal = store_creds.client;
1895
1896  store:
1897         if (blacklist_principal &&
1898             krb5_principal_compare(ctx, store_creds.client, blacklist_principal)) {
1899                 char *sp = NULL;
1900                 char *ip = NULL;
1901
1902                 code = krb5_unparse_name(ctx, blacklist_principal, &sp);
1903                 if (code != 0) {
1904                         sp = NULL;
1905                 }
1906                 code = krb5_unparse_name(ctx, impersonate_principal, &ip);
1907                 if (code != 0) {
1908                         ip = NULL;
1909                 }
1910                 DEBUG(1, ("kerberos_kinit_password_cc: "
1911                           "KDC returned self principal[%s] while impersonating [%s]\n",
1912                           sp?sp:"<no memory>",
1913                           ip?ip:"<no memory>"));
1914
1915                 SAFE_FREE(sp);
1916                 SAFE_FREE(ip);
1917
1918                 krb5_free_principal(ctx, whitelist_principal);
1919                 krb5_free_principal(ctx, blacklist_principal);
1920                 krb5_free_cred_contents(ctx, &store_creds);
1921                 return KRB5_FWD_BAD_PRINCIPAL;
1922         }
1923         if (blacklist_principal) {
1924                 krb5_free_principal(ctx, blacklist_principal);
1925         }
1926
1927         if (whitelist_principal &&
1928             !krb5_principal_compare(ctx, store_creds.client, whitelist_principal)) {
1929                 char *sp = NULL;
1930                 char *ep = NULL;
1931
1932                 code = krb5_unparse_name(ctx, store_creds.client, &sp);
1933                 if (code != 0) {
1934                         sp = NULL;
1935                 }
1936                 code = krb5_unparse_name(ctx, whitelist_principal, &ep);
1937                 if (code != 0) {
1938                         ep = NULL;
1939                 }
1940                 DEBUG(1, ("kerberos_kinit_password_cc: "
1941                           "KDC returned wrong principal[%s] we expected [%s]\n",
1942                           sp?sp:"<no memory>",
1943                           ep?ep:"<no memory>"));
1944
1945                 SAFE_FREE(sp);
1946                 SAFE_FREE(ep);
1947
1948                 krb5_free_principal(ctx, whitelist_principal);
1949                 krb5_free_cred_contents(ctx, &store_creds);
1950                 return KRB5_FWD_BAD_PRINCIPAL;
1951         }
1952         if (whitelist_principal) {
1953                 krb5_free_principal(ctx, whitelist_principal);
1954         }
1955
1956         code = krb5_cc_initialize(ctx, store_cc, store_principal);
1957         if (code != 0) {
1958                 krb5_free_cred_contents(ctx, &store_creds);
1959                 return code;
1960         }
1961
1962         code = krb5_cc_store_cred(ctx, store_cc, &store_creds);
1963         if (code != 0) {
1964                 krb5_free_cred_contents(ctx, &store_creds);
1965                 return code;
1966         }
1967
1968         if (expire_time) {
1969                 *expire_time = (time_t) store_creds.times.endtime;
1970         }
1971
1972         if (kdc_time) {
1973                 *kdc_time = (time_t) store_creds.times.starttime;
1974         }
1975
1976         krb5_free_cred_contents(ctx, &store_creds);
1977
1978         return 0;
1979 }
1980 #endif
1981
1982 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
1983 krb5_error_code smb_krb5_make_principal(krb5_context context,
1984                                         krb5_principal *principal,
1985                                         const char *_realm, ...)
1986 {
1987         krb5_error_code code;
1988         bool free_realm;
1989         char *realm;
1990         va_list ap;
1991
1992         if (_realm) {
1993                 realm = _realm;
1994                 free_realm = false;
1995         } else {
1996                 code = krb5_get_default_realm(context, &realm);
1997                 if (code) {
1998                         return code;
1999                 }
2000                 free_realm = true;
2001         }
2002
2003         va_start(ap, _realm);
2004         code = krb5_build_principal_alloc_va(context, principal,
2005                                              strlen(realm), realm,
2006                                              ap);
2007         va_end(ap);
2008
2009         if (free_realm) {
2010                 krb5_free_default_realm(context, realm);
2011         }
2012
2013         return code;
2014 }
2015 #endif
2016
2017 #if !defined(HAVE_KRB5_CC_GET_LIFETIME) && defined(HAVE_KRB5_CC_RETRIEVE_CRED)
2018 /**
2019  * @brief Get the lifetime of the initial ticket in the cache.
2020  *
2021  * @param[in]  context  The kerberos context.
2022  *
2023  * @param[in]  id       The credential cache to get the ticket lifetime.
2024  *
2025  * @param[out] t        A pointer to a time value to store the lifetime.
2026  *
2027  * @return              0 on success, a krb5_error_code on error.
2028  */
2029 krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context,
2030                                          krb5_ccache id,
2031                                          time_t *t)
2032 {
2033         krb5_cc_cursor cursor;
2034         krb5_error_code kerr;
2035         krb5_creds cred;
2036         krb5_timestamp now;
2037
2038         *t = 0;
2039
2040         kerr = krb5_timeofday(context, &now);
2041         if (kerr) {
2042                 return kerr;
2043         }
2044
2045         kerr = krb5_cc_start_seq_get(context, id, &cursor);
2046         if (kerr) {
2047                 return kerr;
2048         }
2049
2050         while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) {
2051 #ifndef HAVE_FLAGS_IN_KRB5_CREDS
2052                 if (cred.ticket_flags & TKT_FLG_INITIAL) {
2053 #else
2054                 if (cred.flags.b.initial) {
2055 #endif
2056                         if (now < cred.times.endtime) {
2057                                 *t = (time_t) (cred.times.endtime - now);
2058                         }
2059                         krb5_free_cred_contents(context, &cred);
2060                         break;
2061                 }
2062                 krb5_free_cred_contents(context, &cred);
2063         }
2064
2065         krb5_cc_end_seq_get(context, id, &cursor);
2066
2067         return kerr;
2068 }
2069 #endif /* HAVE_KRB5_CC_GET_LIFETIME */
2070
2071 #if !defined(HAVE_KRB5_FREE_CHECKSUM_CONTENTS) && defined(HAVE_FREE_CHECKSUM)
2072 void smb_krb5_free_checksum_contents(krb5_context ctx, krb5_checksum *cksum)
2073 {
2074         free_Checksum(cksum);
2075 }
2076 #endif
2077
2078 krb5_error_code smb_krb5_make_pac_checksum(TALLOC_CTX *mem_ctx,
2079                                            DATA_BLOB *pac_data,
2080                                            krb5_context context,
2081                                            const krb5_keyblock *keyblock,
2082                                            uint32_t *sig_type,
2083                                            DATA_BLOB *sig_blob)
2084 {
2085         krb5_error_code ret;
2086         krb5_checksum cksum;
2087 #if defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CREATE_CHECKSUM)
2088         krb5_crypto crypto;
2089
2090
2091         ret = krb5_crypto_init(context,
2092                                keyblock,
2093                                0,
2094                                &crypto);
2095         if (ret) {
2096                 DEBUG(0,("krb5_crypto_init() failed: %s\n",
2097                           smb_get_krb5_error_message(context, ret, mem_ctx)));
2098                 return ret;
2099         }
2100         ret = krb5_create_checksum(context,
2101                                    crypto,
2102                                    KRB5_KU_OTHER_CKSUM,
2103                                    0,
2104                                    pac_data->data,
2105                                    pac_data->length,
2106                                    &cksum);
2107         if (ret) {
2108                 DEBUG(2, ("PAC Verification failed: %s\n",
2109                           smb_get_krb5_error_message(context, ret, mem_ctx)));
2110         }
2111
2112         krb5_crypto_destroy(context, crypto);
2113
2114         if (ret) {
2115                 return ret;
2116         }
2117
2118         *sig_type = cksum.cksumtype;
2119         *sig_blob = data_blob_talloc(mem_ctx,
2120                                         cksum.checksum.data,
2121                                         cksum.checksum.length);
2122 #elif defined(HAVE_KRB5_C_MAKE_CHECKSUM)
2123         krb5_data input;
2124
2125         input.data = (char *)pac_data->data;
2126         input.length = pac_data->length;
2127
2128         ret = krb5_c_make_checksum(context,
2129                                    0,
2130                                    keyblock,
2131                                    KRB5_KEYUSAGE_APP_DATA_CKSUM,
2132                                    &input,
2133                                    &cksum);
2134         if (ret) {
2135                 DEBUG(2, ("PAC Verification failed: %s\n",
2136                           smb_get_krb5_error_message(context, ret, mem_ctx)));
2137                 return ret;
2138         }
2139
2140         *sig_type = cksum.checksum_type;
2141         *sig_blob = data_blob_talloc(mem_ctx,
2142                                         cksum.contents,
2143                                         cksum.length);
2144
2145 #else
2146 #error krb5_create_checksum or krb5_c_make_checksum not available
2147 #endif /* HAVE_KRB5_C_MAKE_CHECKSUM */
2148         smb_krb5_free_checksum_contents(context, &cksum);
2149
2150         return 0;
2151 }
2152
2153
2154 /*
2155  * smb_krb5_principal_get_realm
2156  *
2157  * @brief Get realm of a principal
2158  *
2159  * @param[in] context           The krb5_context
2160  * @param[in] principal         The principal
2161  * @return pointer to the realm
2162  *
2163  */
2164
2165 char *smb_krb5_principal_get_realm(krb5_context context,
2166                                    krb5_principal principal)
2167 {
2168 #ifdef HAVE_KRB5_PRINCIPAL_GET_REALM /* Heimdal */
2169         return discard_const_p(char, krb5_principal_get_realm(context, principal));
2170 #elif defined(krb5_princ_realm) /* MIT */
2171         krb5_data *realm;
2172         realm = krb5_princ_realm(context, principal);
2173         return discard_const_p(char, realm->data);
2174 #else
2175         return NULL;
2176 #endif
2177 }
2178
2179 /************************************************************************
2180  Routine to get the default realm from the kerberos credentials cache.
2181  Caller must free if the return value is not NULL.
2182 ************************************************************************/
2183
2184 static char *smb_krb5_get_default_realm_from_ccache(TALLOC_CTX *mem_ctx)
2185 {
2186         char *realm = NULL;
2187         krb5_context ctx = NULL;
2188         krb5_ccache cc = NULL;
2189         krb5_principal princ = NULL;
2190
2191         initialize_krb5_error_table();
2192         if (krb5_init_context(&ctx)) {
2193                 return NULL;
2194         }
2195
2196         DEBUG(5,("kerberos_get_default_realm_from_ccache: "
2197                 "Trying to read krb5 cache: %s\n",
2198                 krb5_cc_default_name(ctx)));
2199         if (krb5_cc_default(ctx, &cc)) {
2200                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
2201                         "failed to read default cache\n"));
2202                 goto out;
2203         }
2204         if (krb5_cc_get_principal(ctx, cc, &princ)) {
2205                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
2206                         "failed to get default principal\n"));
2207                 goto out;
2208         }
2209
2210 #if defined(HAVE_KRB5_PRINCIPAL_GET_REALM)
2211         realm = talloc_strdup(mem_ctx, krb5_principal_get_realm(ctx, princ));
2212 #elif defined(HAVE_KRB5_PRINC_REALM)
2213         {
2214                 krb5_data *realm_data = krb5_princ_realm(ctx, princ);
2215                 realm = talloc_strndup(mem_ctx, realm_data->data, realm_data->length);
2216         }
2217 #endif
2218
2219   out:
2220
2221         if (ctx) {
2222                 if (princ) {
2223                         krb5_free_principal(ctx, princ);
2224                 }
2225                 if (cc) {
2226                         krb5_cc_close(ctx, cc);
2227                 }
2228                 krb5_free_context(ctx);
2229         }
2230
2231         return realm;
2232 }
2233
2234 /************************************************************************
2235  Routine to get the realm from a given DNS name.
2236 ************************************************************************/
2237
2238 static char *smb_krb5_get_realm_from_hostname(TALLOC_CTX *mem_ctx,
2239                                                 const char *hostname)
2240 {
2241 #if defined(HAVE_KRB5_REALM_TYPE)
2242         /* Heimdal. */
2243         krb5_realm *realm_list = NULL;
2244 #else
2245         /* MIT */
2246         char **realm_list = NULL;
2247 #endif
2248         char *realm = NULL;
2249         krb5_error_code kerr;
2250         krb5_context ctx = NULL;
2251
2252         initialize_krb5_error_table();
2253         if (krb5_init_context(&ctx)) {
2254                 return NULL;
2255         }
2256
2257         kerr = krb5_get_host_realm(ctx, hostname, &realm_list);
2258         if (kerr != 0) {
2259                 DEBUG(3,("kerberos_get_realm_from_hostname %s: "
2260                         "failed %s\n",
2261                         hostname ? hostname : "(NULL)",
2262                         error_message(kerr) ));
2263                 goto out;
2264         }
2265
2266         if (realm_list && realm_list[0]) {
2267                 realm = talloc_strdup(mem_ctx, realm_list[0]);
2268         }
2269
2270   out:
2271
2272         if (ctx) {
2273                 if (realm_list) {
2274                         krb5_free_host_realm(ctx, realm_list);
2275                         realm_list = NULL;
2276                 }
2277                 krb5_free_context(ctx);
2278                 ctx = NULL;
2279         }
2280         return realm;
2281 }
2282
2283 char *kerberos_get_principal_from_service_hostname(TALLOC_CTX *mem_ctx,
2284                                                    const char *service,
2285                                                    const char *remote_name,
2286                                                    const char *default_realm)
2287 {
2288         char *realm = NULL;
2289         char *host = NULL;
2290         char *principal;
2291         host = strchr_m(remote_name, '.');
2292         if (host) {
2293                 /* DNS name. */
2294                 realm = smb_krb5_get_realm_from_hostname(talloc_tos(),
2295                                                          remote_name);
2296         } else {
2297                 /* NetBIOS name - use our realm. */
2298                 realm = smb_krb5_get_default_realm_from_ccache(talloc_tos());
2299         }
2300
2301         if (realm == NULL || *realm == '\0') {
2302                 realm = talloc_strdup(talloc_tos(), default_realm);
2303                 if (!realm) {
2304                         return NULL;
2305                 }
2306                 DEBUG(3,("kerberos_get_principal_from_service_hostname: "
2307                          "cannot get realm from, "
2308                          "desthost %s or default ccache. Using default "
2309                          "smb.conf realm %s\n",
2310                          remote_name,
2311                          realm));
2312         }
2313
2314         principal = talloc_asprintf(mem_ctx,
2315                                     "%s/%s@%s",
2316                                     service, remote_name,
2317                                     realm);
2318         TALLOC_FREE(realm);
2319         return principal;
2320 }
2321
2322 char *smb_get_krb5_error_message(krb5_context context,
2323                                  krb5_error_code code,
2324                                  TALLOC_CTX *mem_ctx)
2325 {
2326         char *ret;
2327
2328 #if defined(HAVE_KRB5_GET_ERROR_MESSAGE) && defined(HAVE_KRB5_FREE_ERROR_MESSAGE)
2329         const char *context_error = krb5_get_error_message(context, code);
2330         if (context_error) {
2331                 ret = talloc_asprintf(mem_ctx, "%s: %s",
2332                                         error_message(code), context_error);
2333                 krb5_free_error_message(context, context_error);
2334                 return ret;
2335         }
2336 #endif
2337         ret = talloc_strdup(mem_ctx, error_message(code));
2338         return ret;
2339 }
2340
2341 #else /* HAVE_KRB5 */
2342  /* this saves a few linking headaches */
2343  int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
2344                         const char *principal, time_t time_offset,
2345                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
2346                         uint32_t extra_ap_opts,
2347                         const char *ccname, time_t *tgs_expire,
2348                         const char *impersonate_princ_s)
2349 {
2350          DEBUG(0,("NO KERBEROS SUPPORT\n"));
2351          return 1;
2352 }
2353
2354 #endif /* HAVE_KRB5 */