lib/krb5_wrap/krb5_samba.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/filesys.h"
  25 #include "krb5_samba.h"
  26 #include "lib/util/asn1.h"
  27
  28 #ifndef KRB5_AUTHDATA_WIN2K_PAC
  29 #define KRB5_AUTHDATA_WIN2K_PAC 128
  30 #endif
  31
  32 #ifndef KRB5_AUTHDATA_IF_RELEVANT
  33 #define KRB5_AUTHDATA_IF_RELEVANT 1
  34 #endif
  35
  36 #ifdef HAVE_KRB5
  37
  38 #define GSSAPI_CHECKSUM      0x8003             /* Checksum type value for Kerberos */
  39 #define GSSAPI_BNDLENGTH     16                 /* Bind Length (rfc-1964 pg.3) */
  40 #define GSSAPI_CHECKSUM_SIZE (4+GSSAPI_BNDLENGTH+4) /* Length of bind length,
  41                                                         bind field, flags field. */
  42 #define GSS_C_DELEG_FLAG 1
  43
  44 /* MIT krb5 1.7beta3 (in Ubuntu Karmic) is missing the prototype,
  45    but still has the symbol */
  46 #if !HAVE_DECL_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE
  47 krb5_error_code krb5_auth_con_set_req_cksumtype(
  48         krb5_context     context,
  49         krb5_auth_context      auth_context,
  50         krb5_cksumtype     cksumtype);
  51 #endif
  52
  53 #if !defined(SMB_MALLOC)
  54 #undef malloc
  55 #define SMB_MALLOC(s) malloc((s))
  56 #endif
  57
  58 #ifndef SMB_STRDUP
  59 #define SMB_STRDUP(s) strdup(s)
  60 #endif
  61
  62 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
  63
  64 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
  65
  66 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
  67  * to krb5_set_default_tgs_ktypes. See
  68  *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
  69  *
  70  * If the MIT libraries are not exporting internal symbols, we will end up in
  71  * this branch, which is correct. Otherwise we will continue to use the
  72  * internal symbol
  73  */
  74  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
  75 {
  76     return krb5_set_default_tgs_enctypes(ctx, enc);
  77 }
  78
  79 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
  80
  81 /* Heimdal */
  82  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
  83 {
  84         return krb5_set_default_in_tkt_etypes(ctx, enc);
  85 }
  86
  87 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
  88
  89 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
  90
  91 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
  92 /* HEIMDAL */
  93  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
  94 {
  95         memset(pkaddr, '\0', sizeof(krb5_address));
  96 #if defined(HAVE_IPV6) && defined(KRB5_ADDRESS_INET6)
  97         if (paddr->ss_family == AF_INET6) {
  98                 pkaddr->addr_type = KRB5_ADDRESS_INET6;
  99                 pkaddr->address.length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 100                 pkaddr->address.data = (char *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 101                 return true;
 102         }
 103 #endif
 104         if (paddr->ss_family == AF_INET) {
 105                 pkaddr->addr_type = KRB5_ADDRESS_INET;
 106                 pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 107                 pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 108                 return true;
 109         }
 110         return false;
 111 }
 112 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 113 /* MIT */
 114 bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 115 {
 116         memset(pkaddr, '\0', sizeof(krb5_address));
 117 #if defined(HAVE_IPV6) && defined(ADDRTYPE_INET6)
 118         if (paddr->ss_family == AF_INET6) {
 119                 pkaddr->addrtype = ADDRTYPE_INET6;
 120                 pkaddr->length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 121                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 122                 return true;
 123         }
 124 #endif
 125         if (paddr->ss_family == AF_INET) {
 126                 pkaddr->addrtype = ADDRTYPE_INET;
 127                 pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 128                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 129                 return true;
 130         }
 131         return false;
 132 }
 133 #else
 134 #error UNKNOWN_ADDRTYPE
 135 #endif
 136
 137 /**
 138 * @brief Create a keyblock based on input parameters
 139 *
 140 * @param context        The krb5_context
 141 * @param host_princ     The krb5_principal to use
 142 * @param salt           The optional salt, if ommitted, salt is calculated with
 143 *                       the provided principal.
 144 * @param password       The krb5_data containing the password
 145 * @param enctype        The krb5_enctype to use for the keyblock generation
 146 * @param key            The returned krb5_keyblock, caller needs to free with
 147 *                       krb5_free_keyblock().
 148 *
 149 * @return krb5_error_code
 150 */
 151 int smb_krb5_create_key_from_string(krb5_context context,
 152                                     krb5_principal *host_princ,
 153                                     krb5_data *salt,
 154                                     krb5_data *password,
 155                                     krb5_enctype enctype,
 156                                     krb5_keyblock *key)
 157 {
 158         int ret = 0;
 159
 160         if (host_princ == NULL && salt == NULL) {
 161                 return -1;
 162         }
 163
 164 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_C_STRING_TO_KEY)
 165 {/* MIT */
 166         krb5_data _salt;
 167
 168         if (salt == NULL) {
 169                 ret = krb5_principal2salt(context, *host_princ, &_salt);
 170                 if (ret) {
 171                         DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 172                         return ret;
 173                 }
 174         } else {
 175                 _salt = *salt;
 176         }
 177         ret = krb5_c_string_to_key(context, enctype, password, &_salt, key);
 178         if (salt == NULL) {
 179                 SAFE_FREE(_salt.data);
 180         }
 181 }
 182 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 183 {/* Heimdal */
 184         krb5_salt _salt;
 185
 186         if (salt == NULL) {
 187                 ret = krb5_get_pw_salt(context, *host_princ, &_salt);
 188                 if (ret) {
 189                         DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 190                         return ret;
 191                 }
 192         } else {
 193                 _salt.saltvalue = *salt;
 194                 _salt.salttype = KRB5_PW_SALT;
 195         }
 196
 197         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, _salt, key);
 198         if (salt == NULL) {
 199                 krb5_free_salt(context, _salt);
 200         }
 201 }
 202 #else
 203 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 204 #endif
 205         return ret;
 206 }
 207
 208 /**
 209 * @brief Create a salt for a given principal
 210 *
 211 * @param context        The initialized krb5_context
 212 * @param host_princ     The krb5_principal to create the salt for
 213 * @param psalt          A pointer to a krb5_data struct
 214 *
 215 * caller has to free the contents of psalt with kerberos_free_data_contents
 216 * when function has succeeded
 217 *
 218 * @return krb5_error_code, returns 0 on success, error code otherwise
 219 */
 220
 221 int smb_krb5_get_pw_salt(krb5_context context,
 222                          krb5_principal host_princ,
 223                          krb5_data *psalt)
 224 #if defined(HAVE_KRB5_GET_PW_SALT)
 225 /* Heimdal */
 226 {
 227         int ret;
 228         krb5_salt salt;
 229
 230         ret = krb5_get_pw_salt(context, host_princ, &salt);
 231         if (ret) {
 232                 return ret;
 233         }
 234
 235         psalt->data = salt.saltvalue.data;
 236         psalt->length = salt.saltvalue.length;
 237
 238         return ret;
 239 }
 240 #elif defined(HAVE_KRB5_PRINCIPAL2SALT)
 241 /* MIT */
 242 {
 243         return krb5_principal2salt(context, host_princ, psalt);
 244 }
 245 #else
 246 #error UNKNOWN_SALT_FUNCTIONS
 247 #endif
 248
 249 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 250  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 251                                             krb5_enctype **enctypes)
 252 {
 253         return krb5_get_permitted_enctypes(context, enctypes);
 254 }
 255 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 256  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 257                                             krb5_enctype **enctypes)
 258 {
 259 #ifdef HAVE_KRB5_PDU_NONE_DECL
 260         return krb5_get_default_in_tkt_etypes(context, KRB5_PDU_NONE, enctypes);
 261 #else
 262         return krb5_get_default_in_tkt_etypes(context, enctypes);
 263 #endif
 264 }
 265 #else
 266 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 267 #endif
 268
 269 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 270  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 271                                         krb5_auth_context auth_context,
 272                                         krb5_keyblock *keyblock)
 273 {
 274         return krb5_auth_con_setkey(context, auth_context, keyblock);
 275 }
 276 #endif
 277
 278 bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
 279                            DATA_BLOB *edata,
 280                            DATA_BLOB *edata_out)
 281 {
 282         DATA_BLOB edata_contents;
 283         ASN1_DATA *data;
 284         int edata_type;
 285
 286         if (!edata->length) {
 287                 return false;
 288         }
 289
 290         data = asn1_init(mem_ctx);
 291         if (data == NULL) {
 292                 return false;
 293         }
 294
 295         asn1_load(data, *edata);
 296         asn1_start_tag(data, ASN1_SEQUENCE(0));
 297         asn1_start_tag(data, ASN1_CONTEXT(1));
 298         asn1_read_Integer(data, &edata_type);
 299
 300         if (edata_type != KRB5_PADATA_PW_SALT) {
 301                 DEBUG(0,("edata is not of required type %d but of type %d\n",
 302                         KRB5_PADATA_PW_SALT, edata_type));
 303                 asn1_free(data);
 304                 return false;
 305         }
 306
 307         asn1_start_tag(data, ASN1_CONTEXT(2));
 308         asn1_read_OctetString(data, talloc_tos(), &edata_contents);
 309         asn1_end_tag(data);
 310         asn1_end_tag(data);
 311         asn1_end_tag(data);
 312         asn1_free(data);
 313
 314         *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
 315
 316         data_blob_free(&edata_contents);
 317
 318         return true;
 319 }
 320
 321
 322 static bool ads_cleanup_expired_creds(krb5_context context,
 323                                       krb5_ccache  ccache,
 324                                       krb5_creds  *credsp)
 325 {
 326         krb5_error_code retval;
 327         const char *cc_type = krb5_cc_get_type(context, ccache);
 328
 329         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 330                   cc_type, krb5_cc_get_name(context, ccache),
 331                   http_timestring(talloc_tos(), credsp->times.endtime)));
 332
 333         /* we will probably need new tickets if the current ones
 334            will expire within 10 seconds.
 335         */
 336         if (credsp->times.endtime >= (time(NULL) + 10))
 337                 return false;
 338
 339         /* heimdal won't remove creds from a file ccache, and
 340            perhaps we shouldn't anyway, since internally we
 341            use memory ccaches, and a FILE one probably means that
 342            we're using creds obtained outside of our exectuable
 343         */
 344         if (strequal(cc_type, "FILE")) {
 345                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 346                 return false;
 347         }
 348
 349         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 350         if (retval) {
 351                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 352                           error_message(retval)));
 353                 /* If we have an error in this, we want to display it,
 354                    but continue as though we deleted it */
 355         }
 356         return true;
 357 }
 358
 359 /* Allocate and setup the auth context into the state we need. */
 360
 361 static krb5_error_code setup_auth_context(krb5_context context,
 362                         krb5_auth_context *auth_context)
 363 {
 364         krb5_error_code retval;
 365
 366         retval = krb5_auth_con_init(context, auth_context );
 367         if (retval) {
 368                 DEBUG(1,("krb5_auth_con_init failed (%s)\n",
 369                         error_message(retval)));
 370                 return retval;
 371         }
 372
 373         /* Ensure this is an addressless ticket. */
 374         retval = krb5_auth_con_setaddrs(context, *auth_context, NULL, NULL);
 375         if (retval) {
 376                 DEBUG(1,("krb5_auth_con_setaddrs failed (%s)\n",
 377                         error_message(retval)));
 378         }
 379
 380         return retval;
 381 }
 382
 383 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 384 static krb5_error_code create_gss_checksum(krb5_data *in_data, /* [inout] */
 385                                                 uint32_t gss_flags)
 386 {
 387         unsigned int orig_length = in_data->length;
 388         unsigned int base_cksum_size = GSSAPI_CHECKSUM_SIZE;
 389         char *gss_cksum = NULL;
 390
 391         if (orig_length) {
 392                 /* Extra length field for delgated ticket. */
 393                 base_cksum_size += 4;
 394         }
 395
 396         if ((unsigned int)base_cksum_size + orig_length <
 397                         (unsigned int)base_cksum_size) {
 398                 return EINVAL;
 399         }
 400
 401         gss_cksum = (char *)SMB_MALLOC(base_cksum_size + orig_length);
 402         if (gss_cksum == NULL) {
 403                 return ENOMEM;
 404         }
 405
 406         memset(gss_cksum, '\0', base_cksum_size + orig_length);
 407         SIVAL(gss_cksum, 0, GSSAPI_BNDLENGTH);
 408
 409         /*
 410          * GSS_C_NO_CHANNEL_BINDINGS means 16 zero bytes.
 411          * This matches the behavior of heimdal and mit.
 412          *
 413          * And it is needed to work against some closed source
 414          * SMB servers.
 415          *
 416          * See bug #7883
 417          */
 418         memset(&gss_cksum[4], 0x00, GSSAPI_BNDLENGTH);
 419
 420         SIVAL(gss_cksum, 20, gss_flags);
 421
 422         if (orig_length) {
 423                 SSVAL(gss_cksum, 24, 1); /* The Delegation Option identifier */
 424                 SSVAL(gss_cksum, 26, orig_length);
 425                 /* Copy the kerberos KRB_CRED data */
 426                 memcpy(gss_cksum + 28, in_data->data, orig_length);
 427                 free(in_data->data);
 428                 in_data->data = NULL;
 429                 in_data->length = 0;
 430         }
 431         in_data->data = gss_cksum;
 432         in_data->length = base_cksum_size + orig_length;
 433         return 0;
 434 }
 435 #endif
 436
 437 /**************************************************************
 438  krb5_parse_name that takes a UNIX charset.
 439 **************************************************************/
 440
 441 krb5_error_code smb_krb5_parse_name(krb5_context context,
 442                                 const char *name, /* in unix charset */
 443                                 krb5_principal *principal)
 444 {
 445         krb5_error_code ret;
 446         char *utf8_name;
 447         size_t converted_size;
 448         TALLOC_CTX *frame = talloc_stackframe();
 449
 450         if (!push_utf8_talloc(frame, &utf8_name, name, &converted_size)) {
 451                 talloc_free(frame);
 452                 return ENOMEM;
 453         }
 454
 455         ret = krb5_parse_name(context, utf8_name, principal);
 456         TALLOC_FREE(frame);
 457         return ret;
 458 }
 459
 460 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 461 void krb5_free_unparsed_name(krb5_context context, char *val)
 462 {
 463         SAFE_FREE(val);
 464 }
 465 #endif
 466
 467 /**************************************************************
 468  krb5_parse_name that returns a UNIX charset name. Must
 469  be freed with talloc_free() call.
 470 **************************************************************/
 471
 472 krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
 473                                       krb5_context context,
 474                                       krb5_const_principal principal,
 475                                       char **unix_name)
 476 {
 477         krb5_error_code ret;
 478         char *utf8_name;
 479         size_t converted_size;
 480
 481         *unix_name = NULL;
 482         ret = krb5_unparse_name(context, principal, &utf8_name);
 483         if (ret) {
 484                 return ret;
 485         }
 486
 487         if (!pull_utf8_talloc(mem_ctx, unix_name, utf8_name, &converted_size)) {
 488                 krb5_free_unparsed_name(context, utf8_name);
 489                 return ENOMEM;
 490         }
 491         krb5_free_unparsed_name(context, utf8_name);
 492         return 0;
 493 }
 494
 495 krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
 496                                             const char *name,
 497                                             krb5_principal *principal)
 498 {
 499         /* we are cheating here because parse_name will in fact set the realm.
 500          * We don't care as the only caller of smb_krb5_parse_name_norealm
 501          * ignores the realm anyway when calling
 502          * smb_krb5_principal_compare_any_realm later - Guenther */
 503
 504         return smb_krb5_parse_name(context, name, principal);
 505 }
 506
 507 bool smb_krb5_principal_compare_any_realm(krb5_context context,
 508                                           krb5_const_principal princ1,
 509                                           krb5_const_principal princ2)
 510 {
 511         return krb5_principal_compare_any_realm(context, princ1, princ2);
 512 }
 513
 514 /*
 515   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 516 */
 517 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 518                                        krb5_auth_context *auth_context,
 519                                        const krb5_flags ap_req_options,
 520                                        const char *principal,
 521                                        krb5_ccache ccache,
 522                                        krb5_data *outbuf,
 523                                        time_t *expire_time,
 524                                        const char *impersonate_princ_s)
 525 {
 526         krb5_error_code           retval;
 527         krb5_principal    server;
 528         krb5_principal impersonate_princ = NULL;
 529         krb5_creds              * credsp;
 530         krb5_creds                creds;
 531         krb5_data in_data;
 532         bool creds_ready = false;
 533         int i = 0, maxtries = 3;
 534
 535         ZERO_STRUCT(in_data);
 536
 537         retval = smb_krb5_parse_name(context, principal, &server);
 538         if (retval) {
 539                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 540                 return retval;
 541         }
 542
 543         if (impersonate_princ_s) {
 544                 retval = smb_krb5_parse_name(context, impersonate_princ_s,
 545                                              &impersonate_princ);
 546                 if (retval) {
 547                         DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", impersonate_princ_s));
 548                         goto cleanup_princ;
 549                 }
 550         }
 551
 552         /* obtain ticket & session key */
 553         ZERO_STRUCT(creds);
 554         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 555                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 556                          error_message(retval)));
 557                 goto cleanup_princ;
 558         }
 559
 560         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 561                 /* This can commonly fail on smbd startup with no ticket in the cache.
 562                  * Report at higher level than 1. */
 563                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 564                          error_message(retval)));
 565                 goto cleanup_creds;
 566         }
 567
 568         while (!creds_ready && (i < maxtries)) {
 569
 570                 if ((retval = smb_krb5_get_credentials(context, ccache,
 571                                                        creds.client,
 572                                                        creds.server,
 573                                                        impersonate_princ,
 574                                                        &credsp))) {
 575                         DEBUG(1,("ads_krb5_mk_req: smb_krb5_get_credentials failed for %s (%s)\n",
 576                                 principal, error_message(retval)));
 577                         goto cleanup_creds;
 578                 }
 579
 580                 /* cope with ticket being in the future due to clock skew */
 581                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 582                         time_t t = time(NULL);
 583                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 584                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 585                         krb5_set_real_time(context, t + time_offset + 1, 0);
 586                 }
 587
 588                 if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
 589                         creds_ready = true;
 590                 }
 591
 592                 i++;
 593         }
 594
 595         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 596                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 597                   http_timestring(talloc_tos(), (unsigned)credsp->times.endtime),
 598                   (unsigned)credsp->times.endtime));
 599
 600         if (expire_time) {
 601                 *expire_time = (time_t)credsp->times.endtime;
 602         }
 603
 604         /* Allocate the auth_context. */
 605         retval = setup_auth_context(context, auth_context);
 606         if (retval) {
 607                 DEBUG(1,("setup_auth_context failed (%s)\n",
 608                         error_message(retval)));
 609                 goto cleanup_creds;
 610         }
 611
 612 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 613         {
 614                 uint32_t gss_flags = 0;
 615
 616                 if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
 617                         /* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
 618                          as part of the kerberos exchange. */
 619
 620                         DEBUG( 3, ("ads_krb5_mk_req: server marked as OK to delegate to, building forwardable TGT\n")  );
 621
 622                         retval = krb5_auth_con_setuseruserkey(context,
 623                                         *auth_context,
 624                                         &credsp->keyblock );
 625                         if (retval) {
 626                                 DEBUG(1,("krb5_auth_con_setuseruserkey failed (%s)\n",
 627                                         error_message(retval)));
 628                                 goto cleanup_creds;
 629                         }
 630
 631                         /* Must use a subkey for forwarded tickets. */
 632                         retval = krb5_auth_con_setflags(context,
 633                                 *auth_context,
 634                                 KRB5_AUTH_CONTEXT_USE_SUBKEY);
 635                         if (retval) {
 636                                 DEBUG(1,("krb5_auth_con_setflags failed (%s)\n",
 637                                         error_message(retval)));
 638                                 goto cleanup_creds;
 639                         }
 640
 641                         retval = krb5_fwd_tgt_creds(context,/* Krb5 context [in] */
 642                                 *auth_context,  /* Authentication context [in] */
 643                                 discard_const_p(char, KRB5_TGS_NAME),  /* Ticket service name ("krbtgt") [in] */
 644                                 credsp->client, /* Client principal for the tgt [in] */
 645                                 credsp->server, /* Server principal for the tgt [in] */
 646                                 ccache,         /* Credential cache to use for storage [in] */
 647                                 1,              /* Turn on for "Forwardable ticket" [in] */
 648                                 &in_data );     /* Resulting response [out] */
 649
 650                         if (retval) {
 651                                 DEBUG( 3, ("krb5_fwd_tgt_creds failed (%s)\n",
 652                                            error_message( retval ) ) );
 653
 654                                 /*
 655                                  * This is not fatal. Delete the *auth_context and continue
 656                                  * with krb5_mk_req_extended to get a non-forwardable ticket.
 657                                  */
 658
 659                                 if (in_data.data) {
 660                                         free( in_data.data );
 661                                         in_data.data = NULL;
 662                                         in_data.length = 0;
 663                                 }
 664                                 krb5_auth_con_free(context, *auth_context);
 665                                 *auth_context = NULL;
 666                                 retval = setup_auth_context(context, auth_context);
 667                                 if (retval) {
 668                                         DEBUG(1,("setup_auth_context failed (%s)\n",
 669                                                 error_message(retval)));
 670                                         goto cleanup_creds;
 671                                 }
 672                         } else {
 673                                 /* We got a delegated ticket. */
 674                                 gss_flags |= GSS_C_DELEG_FLAG;
 675                         }
 676                 }
 677
 678                 /* Frees and reallocates in_data into a GSS checksum blob. */
 679                 retval = create_gss_checksum(&in_data, gss_flags);
 680                 if (retval) {
 681                         goto cleanup_data;
 682                 }
 683
 684                 /* We always want GSS-checksum types. */
 685                 retval = krb5_auth_con_set_req_cksumtype(context, *auth_context, GSSAPI_CHECKSUM );
 686                 if (retval) {
 687                         DEBUG(1,("krb5_auth_con_set_req_cksumtype failed (%s)\n",
 688                                 error_message(retval)));
 689                         goto cleanup_data;
 690                 }
 691         }
 692 #endif
 693
 694         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 695                                       &in_data, credsp, outbuf);
 696         if (retval) {
 697                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 698                          error_message(retval)));
 699         }
 700
 701 #if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
 702 cleanup_data:
 703 #endif
 704
 705         if (in_data.data) {
 706                 free( in_data.data );
 707                 in_data.length = 0;
 708         }
 709
 710         krb5_free_creds(context, credsp);
 711
 712 cleanup_creds:
 713         krb5_free_cred_contents(context, &creds);
 714
 715 cleanup_princ:
 716         krb5_free_principal(context, server);
 717         if (impersonate_princ) {
 718                 krb5_free_principal(context, impersonate_princ);
 719         }
 720
 721         return retval;
 722 }
 723
 724 void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 725 {
 726 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 727         if (pdata->data) {
 728                 krb5_free_data_contents(context, pdata);
 729         }
 730 #elif defined(HAVE_KRB5_DATA_FREE)
 731         krb5_data_free(context, pdata);
 732 #else
 733         SAFE_FREE(pdata->data);
 734 #endif
 735 }
 736
 737 /*
 738   get a kerberos5 ticket for the given service
 739 */
 740 int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
 741                         const char *principal, time_t time_offset,
 742                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 743                         uint32_t extra_ap_opts, const char *ccname,
 744                         time_t *tgs_expire,
 745                         const char *impersonate_princ_s)
 746
 747 {
 748         krb5_error_code retval;
 749         krb5_data packet;
 750         krb5_context context = NULL;
 751         krb5_ccache ccdef = NULL;
 752         krb5_auth_context auth_context = NULL;
 753         krb5_enctype enc_types[] = {
 754 #ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
 755                 ENCTYPE_AES256_CTS_HMAC_SHA1_96,
 756 #endif
 757 #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
 758                 ENCTYPE_AES128_CTS_HMAC_SHA1_96,
 759 #endif
 760                 ENCTYPE_ARCFOUR_HMAC,
 761                 ENCTYPE_DES_CBC_MD5,
 762                 ENCTYPE_DES_CBC_CRC,
 763                 ENCTYPE_NULL};
 764
 765         initialize_krb5_error_table();
 766         retval = krb5_init_context(&context);
 767         if (retval) {
 768                 DEBUG(1, ("krb5_init_context failed (%s)\n",
 769                          error_message(retval)));
 770                 goto failed;
 771         }
 772
 773         if (time_offset != 0) {
 774                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 775         }
 776
 777         if ((retval = krb5_cc_resolve(context, ccname ?
 778                         ccname : krb5_cc_default_name(context), &ccdef))) {
 779                 DEBUG(1, ("krb5_cc_default failed (%s)\n",
 780                          error_message(retval)));
 781                 goto failed;
 782         }
 783
 784         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 785                 DEBUG(1, ("krb5_set_default_tgs_ktypes failed (%s)\n",
 786                          error_message(retval)));
 787                 goto failed;
 788         }
 789
 790         retval = ads_krb5_mk_req(context, &auth_context,
 791                                 AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 792                                 principal, ccdef, &packet,
 793                                 tgs_expire, impersonate_princ_s);
 794         if (retval) {
 795                 goto failed;
 796         }
 797
 798         get_krb5_smb_session_key(mem_ctx, context, auth_context,
 799                                  session_key_krb5, false);
 800
 801         *ticket = data_blob_talloc(mem_ctx, packet.data, packet.length);
 802
 803         kerberos_free_data_contents(context, &packet);
 804
 805 failed:
 806
 807         if (context) {
 808                 if (ccdef)
 809                         krb5_cc_close(context, ccdef);
 810                 if (auth_context)
 811                         krb5_auth_con_free(context, auth_context);
 812                 krb5_free_context(context);
 813         }
 814
 815         return retval;
 816 }
 817
 818 bool get_krb5_smb_session_key(TALLOC_CTX *mem_ctx,
 819                               krb5_context context,
 820                               krb5_auth_context auth_context,
 821                               DATA_BLOB *session_key, bool remote)
 822 {
 823         krb5_keyblock *skey = NULL;
 824         krb5_error_code err = 0;
 825         bool ret = false;
 826
 827         if (remote) {
 828                 err = krb5_auth_con_getremotesubkey(context,
 829                                                     auth_context, &skey);
 830         } else {
 831                 err = krb5_auth_con_getlocalsubkey(context,
 832                                                    auth_context, &skey);
 833         }
 834
 835         if (err || skey == NULL) {
 836                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 837                 goto done;
 838         }
 839
 840         DEBUG(10, ("Got KRB5 session key of length %d\n",
 841                    (int)KRB5_KEY_LENGTH(skey)));
 842
 843         *session_key = data_blob_talloc(mem_ctx,
 844                                          KRB5_KEY_DATA(skey),
 845                                          KRB5_KEY_LENGTH(skey));
 846         dump_data_pw("KRB5 Session Key:\n",
 847                      session_key->data,
 848                      session_key->length);
 849
 850         ret = true;
 851
 852 done:
 853         if (skey) {
 854                 krb5_free_keyblock(context, skey);
 855         }
 856
 857         return ret;
 858 }
 859
 860
 861 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 862  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 863
 864  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 865 {
 866         static krb5_data kdata;
 867
 868         kdata.data = discard_const_p(char, krb5_principal_get_comp_string(context, principal, i));
 869         kdata.length = strlen((const char *)kdata.data);
 870         return &kdata;
 871 }
 872 #endif
 873
 874 /*
 875  * @brief Get talloced string component of a principal
 876  *
 877  * @param[in] mem_ctx           The TALLOC_CTX
 878  * @param[in] context           The krb5_context
 879  * @param[in] principal         The principal
 880  * @param[in] component         The component
 881  * @return string component
 882  *
 883  * Caller must talloc_free if the return value is not NULL.
 884  *
 885  */
 886
 887 /* caller has to free returned string with free() */
 888 char *smb_krb5_principal_get_comp_string(TALLOC_CTX *mem_ctx,
 889                                          krb5_context context,
 890                                          krb5_const_principal principal,
 891                                          unsigned int component)
 892 {
 893 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING)
 894         return talloc_strdup(mem_ctx, krb5_principal_get_comp_string(context, principal, component));
 895 #else
 896         krb5_data *data;
 897
 898         if (component >= krb5_princ_size(context, principal)) {
 899                 return NULL;
 900         }
 901
 902         data = krb5_princ_component(context, principal, component);
 903         if (data == NULL) {
 904                 return NULL;
 905         }
 906
 907         return talloc_strndup(mem_ctx, data->data, data->length);
 908 #endif
 909 }
 910
 911 /* Prototypes */
 912
 913  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
 914                                        const char *client_string,       /* gd@BER.SUSE.DE */
 915                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
 916                                        time_t *expire_time)
 917 {
 918         krb5_error_code ret;
 919         krb5_context context = NULL;
 920         krb5_ccache ccache = NULL;
 921         krb5_principal client = NULL;
 922         krb5_creds creds, creds_in;
 923
 924         ZERO_STRUCT(creds);
 925         ZERO_STRUCT(creds_in);
 926
 927         initialize_krb5_error_table();
 928         ret = krb5_init_context(&context);
 929         if (ret) {
 930                 goto done;
 931         }
 932
 933         if (!ccache_string) {
 934                 ccache_string = krb5_cc_default_name(context);
 935         }
 936
 937         if (!ccache_string) {
 938                 ret = EINVAL;
 939                 goto done;
 940         }
 941
 942         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
 943
 944         /* FIXME: we should not fall back to defaults */
 945         ret = krb5_cc_resolve(context, discard_const_p(char, ccache_string), &ccache);
 946         if (ret) {
 947                 goto done;
 948         }
 949
 950         if (client_string) {
 951                 ret = smb_krb5_parse_name(context, client_string, &client);
 952                 if (ret) {
 953                         goto done;
 954                 }
 955         } else {
 956                 ret = krb5_cc_get_principal(context, ccache, &client);
 957                 if (ret) {
 958                         goto done;
 959                 }
 960         }
 961
 962         ret = krb5_get_renewed_creds(context, &creds, client, ccache, discard_const_p(char, service_string));
 963         if (ret) {
 964                 DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
 965                 goto done;
 966         }
 967
 968         /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
 969         ret = krb5_cc_initialize(context, ccache, client);
 970         if (ret) {
 971                 goto done;
 972         }
 973
 974         ret = krb5_cc_store_cred(context, ccache, &creds);
 975
 976         if (expire_time) {
 977                 *expire_time = (time_t) creds.times.endtime;
 978         }
 979
 980 done:
 981         krb5_free_cred_contents(context, &creds_in);
 982         krb5_free_cred_contents(context, &creds);
 983
 984         if (client) {
 985                 krb5_free_principal(context, client);
 986         }
 987         if (ccache) {
 988                 krb5_cc_close(context, ccache);
 989         }
 990         if (context) {
 991                 krb5_free_context(context);
 992         }
 993
 994         return ret;
 995 }
 996
 997  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
 998 {
 999         krb5_error_code ret = 0;
1000         if (addr == NULL) {
1001                 return ret;
1002         }
1003 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1004         krb5_free_addresses(context, addr->addrs);
1005 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1006         ret = krb5_free_addresses(context, addr->addrs);
1007         SAFE_FREE(addr->addrs);
1008 #endif
1009         SAFE_FREE(addr);
1010         addr = NULL;
1011         return ret;
1012 }
1013
1014 #define MAX_NETBIOSNAME_LEN 16
1015  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr,
1016                                                    const char *netbios_name)
1017 {
1018         krb5_error_code ret = 0;
1019         char buf[MAX_NETBIOSNAME_LEN];
1020         int len;
1021 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1022         krb5_address **addrs = NULL;
1023 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1024         krb5_addresses *addrs = NULL;
1025 #endif
1026
1027         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
1028         if (*kerb_addr == NULL) {
1029                 return ENOMEM;
1030         }
1031
1032         /* temporarily duplicate put_name() code here to avoid dependency
1033          * issues for a 5 lines function */
1034         len = strlen(netbios_name);
1035         memcpy(buf, netbios_name,
1036                 (len < MAX_NETBIOSNAME_LEN) ? len : MAX_NETBIOSNAME_LEN - 1);
1037         if (len < MAX_NETBIOSNAME_LEN - 1) {
1038                 memset(buf + len, ' ', MAX_NETBIOSNAME_LEN - 1 - len);
1039         }
1040         buf[MAX_NETBIOSNAME_LEN - 1] = 0x20;
1041
1042 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1043         {
1044                 int num_addr = 2;
1045
1046                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
1047                 if (addrs == NULL) {
1048                         SAFE_FREE(*kerb_addr);
1049                         return ENOMEM;
1050                 }
1051
1052                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
1053
1054                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1055                 if (addrs[0] == NULL) {
1056                         SAFE_FREE(addrs);
1057                         SAFE_FREE(*kerb_addr);
1058                         return ENOMEM;
1059                 }
1060
1061                 addrs[0]->magic = KV5M_ADDRESS;
1062                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1063                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
1064                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1065                 if (addrs[0]->contents == NULL) {
1066                         SAFE_FREE(addrs[0]);
1067                         SAFE_FREE(addrs);
1068                         SAFE_FREE(*kerb_addr);
1069                         return ENOMEM;
1070                 }
1071
1072                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
1073
1074                 addrs[1] = NULL;
1075         }
1076 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1077         {
1078                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1079                 if (addrs == NULL) {
1080                         SAFE_FREE(*kerb_addr);
1081                         return ENOMEM;
1082                 }
1083
1084                 memset(addrs, 0, sizeof(krb5_addresses));
1085
1086                 addrs->len = 1;
1087                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1088                 if (addrs->val == NULL) {
1089                         SAFE_FREE(addrs);
1090                         SAFE_FREE(kerb_addr);
1091                         return ENOMEM;
1092                 }
1093
1094                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1095                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1096                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1097                 if (addrs->val[0].address.data == NULL) {
1098                         SAFE_FREE(addrs->val);
1099                         SAFE_FREE(addrs);
1100                         SAFE_FREE(*kerb_addr);
1101                         return ENOMEM;
1102                 }
1103
1104                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1105         }
1106 #else
1107 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1108 #endif
1109         (*kerb_addr)->addrs = addrs;
1110
1111         return ret;
1112 }
1113
1114  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1115 {
1116 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1117         krb5_free_error_contents(context, krberror);
1118 #else /* MIT */
1119         krb5_free_error(context, krberror);
1120 #endif
1121 }
1122
1123  krb5_error_code handle_krberror_packet(krb5_context context,
1124                                         krb5_data *packet)
1125 {
1126         krb5_error_code ret;
1127         bool got_error_code = false;
1128
1129         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1130
1131 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1132         {
1133                 krb5_error krberror;
1134
1135                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1136                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1137                                 error_message(ret)));
1138                         return ret;
1139                 }
1140
1141                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1142                         ret = (krb5_error_code) krberror.error_code;
1143                         got_error_code = true;
1144                 }
1145
1146                 smb_krb5_free_error(context, &krberror);
1147         }
1148 #else /* MIT */
1149         {
1150                 krb5_error *krberror;
1151
1152                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1153                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1154                                 error_message(ret)));
1155                         return ret;
1156                 }
1157
1158                 if (krberror->e_data.data == NULL) {
1159 #if defined(ERROR_TABLE_BASE_krb5)
1160                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1161 #else
1162                         ret = (krb5_error_code)krberror->error;
1163 #endif
1164                         got_error_code = true;
1165                 }
1166                 smb_krb5_free_error(context, krberror);
1167         }
1168 #endif
1169         if (got_error_code) {
1170                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1171                         error_message(ret), ret));
1172         }
1173         return ret;
1174 }
1175
1176 krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1177                                             krb5_get_init_creds_opt **opt)
1178 {
1179         /* Heimdal or modern MIT version */
1180         return krb5_get_init_creds_opt_alloc(context, opt);
1181 }
1182
1183 void smb_krb5_get_init_creds_opt_free(krb5_context context,
1184                                 krb5_get_init_creds_opt *opt)
1185 {
1186         /* Modern MIT or Heimdal version */
1187         krb5_get_init_creds_opt_free(context, opt);
1188 }
1189
1190 krb5_enctype smb_get_enctype_from_kt_entry(krb5_keytab_entry *kt_entry)
1191 {
1192         return KRB5_KEY_TYPE(KRB5_KT_KEY(kt_entry));
1193 }
1194
1195 krb5_error_code smb_krb5_kt_free_entry(krb5_context context,
1196                                         krb5_keytab_entry *kt_entry)
1197 {
1198 /* Try krb5_free_keytab_entry_contents first, since
1199  * MIT Kerberos >= 1.7 has both krb5_free_keytab_entry_contents and
1200  * krb5_kt_free_entry but only has a prototype for the first, while the
1201  * second is considered private.
1202  */
1203 #if defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
1204         return krb5_free_keytab_entry_contents(context, kt_entry);
1205 #elif defined(HAVE_KRB5_KT_FREE_ENTRY)
1206         return krb5_kt_free_entry(context, kt_entry);
1207 #else
1208 #error UNKNOWN_KT_FREE_FUNCTION
1209 #endif
1210 }
1211
1212
1213 /* caller needs to free etype_s */
1214 krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1215                                            krb5_enctype enctype,
1216                                            char **etype_s)
1217 {
1218 #ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1219         return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1220 #elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1221         char buf[256];
1222         krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1223         if (ret) {
1224                 return ret;
1225         }
1226         *etype_s = SMB_STRDUP(buf);
1227         if (!*etype_s) {
1228                 return ENOMEM;
1229         }
1230         return ret;
1231 #else
1232 #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1233 #endif
1234 }
1235
1236 /**********************************************************************
1237  * Open a krb5 keytab with flags, handles readonly or readwrite access and
1238  * allows to process non-default keytab names.
1239  * @param context krb5_context
1240  * @param keytab_name_req string
1241  * @param write_access bool if writable keytab is required
1242  * @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1243  * @return krb5_error_code
1244 **********************************************************************/
1245
1246 /* This MAX_NAME_LEN is a constant defined in krb5.h */
1247 #ifndef MAX_KEYTAB_NAME_LEN
1248 #define MAX_KEYTAB_NAME_LEN 1100
1249 #endif
1250
1251 krb5_error_code smb_krb5_open_keytab(krb5_context context,
1252                                      const char *keytab_name_req,
1253                                      bool write_access,
1254                                      krb5_keytab *keytab)
1255 {
1256         krb5_error_code ret = 0;
1257         TALLOC_CTX *mem_ctx;
1258         char keytab_string[MAX_KEYTAB_NAME_LEN];
1259         char *kt_str = NULL;
1260         bool found_valid_name = false;
1261         const char *pragma = "FILE";
1262         const char *tmp = NULL;
1263
1264         if (!write_access && !keytab_name_req) {
1265                 /* caller just wants to read the default keytab readonly, so be it */
1266                 return krb5_kt_default(context, keytab);
1267         }
1268
1269         mem_ctx = talloc_init("smb_krb5_open_keytab");
1270         if (!mem_ctx) {
1271                 return ENOMEM;
1272         }
1273
1274 #ifdef HAVE_WRFILE_KEYTAB
1275         if (write_access) {
1276                 pragma = "WRFILE";
1277         }
1278 #endif
1279
1280         if (keytab_name_req) {
1281
1282                 if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1283                         ret = KRB5_CONFIG_NOTENUFSPACE;
1284                         goto out;
1285                 }
1286
1287                 if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) ||
1288                     (strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1289                         tmp = keytab_name_req;
1290                         goto resolve;
1291                 }
1292
1293                 if (keytab_name_req[0] != '/') {
1294                         ret = KRB5_KT_BADNAME;
1295                         goto out;
1296                 }
1297
1298                 tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1299                 if (!tmp) {
1300                         ret = ENOMEM;
1301                         goto out;
1302                 }
1303
1304                 goto resolve;
1305         }
1306
1307         /* we need to handle more complex keytab_strings, like:
1308          * "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1309
1310         ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1311         if (ret) {
1312                 goto out;
1313         }
1314
1315         DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1316
1317         tmp = talloc_strdup(mem_ctx, keytab_string);
1318         if (!tmp) {
1319                 ret = ENOMEM;
1320                 goto out;
1321         }
1322
1323         if (strncmp(tmp, "ANY:", 4) == 0) {
1324                 tmp += 4;
1325         }
1326
1327         memset(&keytab_string, '\0', sizeof(keytab_string));
1328
1329         while (next_token_talloc(mem_ctx, &tmp, &kt_str, ",")) {
1330                 if (strncmp(kt_str, "WRFILE:", 7) == 0) {
1331                         found_valid_name = true;
1332                         tmp = kt_str;
1333                         tmp += 7;
1334                 }
1335
1336                 if (strncmp(kt_str, "FILE:", 5) == 0) {
1337                         found_valid_name = true;
1338                         tmp = kt_str;
1339                         tmp += 5;
1340                 }
1341
1342                 if (tmp[0] == '/') {
1343                         /* Treat as a FILE: keytab definition. */
1344                         found_valid_name = true;
1345                 }
1346
1347                 if (found_valid_name) {
1348                         if (tmp[0] != '/') {
1349                                 ret = KRB5_KT_BADNAME;
1350                                 goto out;
1351                         }
1352
1353                         tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1354                         if (!tmp) {
1355                                 ret = ENOMEM;
1356                                 goto out;
1357                         }
1358                         break;
1359                 }
1360         }
1361
1362         if (!found_valid_name) {
1363                 ret = KRB5_KT_UNKNOWN_TYPE;
1364                 goto out;
1365         }
1366
1367  resolve:
1368         DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1369         ret = krb5_kt_resolve(context, tmp, keytab);
1370
1371  out:
1372         TALLOC_FREE(mem_ctx);
1373         return ret;
1374 }
1375
1376 krb5_error_code smb_krb5_keytab_name(TALLOC_CTX *mem_ctx,
1377                                      krb5_context context,
1378                                      krb5_keytab keytab,
1379                                      const char **keytab_name)
1380 {
1381         char keytab_string[MAX_KEYTAB_NAME_LEN];
1382         krb5_error_code ret = 0;
1383
1384         ret = krb5_kt_get_name(context, keytab,
1385                                keytab_string, MAX_KEYTAB_NAME_LEN - 2);
1386         if (ret) {
1387                 return ret;
1388         }
1389
1390         *keytab_name = talloc_strdup(mem_ctx, keytab_string);
1391         if (!*keytab_name) {
1392                 return ENOMEM;
1393         }
1394
1395         return ret;
1396 }
1397
1398 #if defined(HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE) && \
1399     defined(HAVE_KRB5_GET_CREDS_OPT_ALLOC) && \
1400     defined(HAVE_KRB5_GET_CREDS)
1401 static krb5_error_code smb_krb5_get_credentials_for_user_opt(krb5_context context,
1402                                                              krb5_ccache ccache,
1403                                                              krb5_principal me,
1404                                                              krb5_principal server,
1405                                                              krb5_principal impersonate_princ,
1406                                                              krb5_creds **out_creds)
1407 {
1408         krb5_error_code ret;
1409         krb5_get_creds_opt opt;
1410
1411         ret = krb5_get_creds_opt_alloc(context, &opt);
1412         if (ret) {
1413                 goto done;
1414         }
1415         krb5_get_creds_opt_add_options(context, opt, KRB5_GC_FORWARDABLE);
1416
1417         if (impersonate_princ) {
1418                 ret = krb5_get_creds_opt_set_impersonate(context, opt,
1419                                                          impersonate_princ);
1420                 if (ret) {
1421                         goto done;
1422                 }
1423         }
1424
1425         ret = krb5_get_creds(context, opt, ccache, server, out_creds);
1426         if (ret) {
1427                 goto done;
1428         }
1429
1430  done:
1431         if (opt) {
1432                 krb5_get_creds_opt_free(context, opt);
1433         }
1434         return ret;
1435 }
1436 #endif /* HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE */
1437
1438 #ifdef HAVE_KRB5_GET_CREDENTIALS_FOR_USER
1439
1440 #if !HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER
1441 krb5_error_code KRB5_CALLCONV
1442 krb5_get_credentials_for_user(krb5_context context, krb5_flags options,
1443                               krb5_ccache ccache, krb5_creds *in_creds,
1444                               krb5_data *subject_cert,
1445                               krb5_creds **out_creds);
1446 #endif /* !HAVE_DECL_KRB5_GET_CREDENTIALS_FOR_USER */
1447
1448 static krb5_error_code smb_krb5_get_credentials_for_user(krb5_context context,
1449                                                          krb5_ccache ccache,
1450                                                          krb5_principal me,
1451                                                          krb5_principal server,
1452                                                          krb5_principal impersonate_princ,
1453                                                          krb5_creds **out_creds)
1454 {
1455         krb5_error_code ret;
1456         krb5_creds in_creds;
1457
1458         ZERO_STRUCT(in_creds);
1459
1460         if (impersonate_princ) {
1461
1462                 in_creds.server = me;
1463                 in_creds.client = impersonate_princ;
1464
1465                 ret = krb5_get_credentials_for_user(context,
1466                                                     0, /* krb5_flags options */
1467                                                     ccache,
1468                                                     &in_creds,
1469                                                     NULL, /* krb5_data *subject_cert */
1470                                                     out_creds);
1471         } else {
1472                 in_creds.client = me;
1473                 in_creds.server = server;
1474
1475                 ret = krb5_get_credentials(context, 0, ccache,
1476                                            &in_creds, out_creds);
1477         }
1478
1479         return ret;
1480 }
1481 #endif /* HAVE_KRB5_GET_CREDENTIALS_FOR_USER */
1482
1483 /*
1484  * smb_krb5_get_credentials
1485  *
1486  * @brief Get krb5 credentials for a server
1487  *
1488  * @param[in] context           An initialized krb5_context
1489  * @param[in] ccache            An initialized krb5_ccache
1490  * @param[in] me                The krb5_principal of the caller
1491  * @param[in] server            The krb5_principal of the requested service
1492  * @param[in] impersonate_princ The krb5_principal of a user to impersonate as (optional)
1493  * @param[out] out_creds        The returned krb5_creds structure
1494  * @return krb5_error_code
1495  *
1496  */
1497 krb5_error_code smb_krb5_get_credentials(krb5_context context,
1498                                          krb5_ccache ccache,
1499                                          krb5_principal me,
1500                                          krb5_principal server,
1501                                          krb5_principal impersonate_princ,
1502                                          krb5_creds **out_creds)
1503 {
1504         krb5_error_code ret;
1505         krb5_creds *creds = NULL;
1506
1507         if (out_creds != NULL) {
1508                 *out_creds = NULL;
1509         }
1510
1511         if (impersonate_princ) {
1512 #ifdef HAVE_KRB5_GET_CREDS_OPT_SET_IMPERSONATE /* Heimdal */
1513                 ret = smb_krb5_get_credentials_for_user_opt(context, ccache, me, server, impersonate_princ, &creds);
1514 #elif defined(HAVE_KRB5_GET_CREDENTIALS_FOR_USER) /* MIT */
1515                 ret = smb_krb5_get_credentials_for_user(context, ccache, me, server, impersonate_princ, &creds);
1516 #else
1517                 ret = ENOTSUP;
1518 #endif
1519         } else {
1520                 krb5_creds in_creds;
1521
1522                 ZERO_STRUCT(in_creds);
1523
1524                 in_creds.client = me;
1525                 in_creds.server = server;
1526
1527                 ret = krb5_get_credentials(context, 0, ccache,
1528                                            &in_creds, &creds);
1529         }
1530         if (ret) {
1531                 goto done;
1532         }
1533
1534         if (out_creds) {
1535                 *out_creds = creds;
1536         }
1537
1538  done:
1539         if (creds && ret) {
1540                 krb5_free_creds(context, creds);
1541         }
1542
1543         return ret;
1544 }
1545
1546 krb5_error_code smb_krb5_keyblock_init_contents(krb5_context context,
1547                                                 krb5_enctype enctype,
1548                                                 const void *data,
1549                                                 size_t length,
1550                                                 krb5_keyblock *key)
1551 {
1552 #if defined(HAVE_KRB5_KEYBLOCK_INIT)
1553         return krb5_keyblock_init(context, enctype, data, length, key);
1554 #else
1555         memset(key, 0, sizeof(krb5_keyblock));
1556         KRB5_KEY_DATA(key) = SMB_MALLOC(length);
1557         if (NULL == KRB5_KEY_DATA(key)) {
1558                 return ENOMEM;
1559         }
1560         memcpy(KRB5_KEY_DATA(key), data, length);
1561         KRB5_KEY_LENGTH(key) = length;
1562         KRB5_KEY_TYPE(key) = enctype;
1563         return 0;
1564 #endif
1565 }
1566
1567 /*
1568   simulate a kinit, putting the tgt in the given credentials cache.
1569   Orignally by remus@snapserver.com
1570
1571   This version is built to use a keyblock, rather than needing the
1572   original password.
1573
1574   The impersonate_principal is the principal if NULL, or the principal
1575   to impersonate
1576
1577   The target_service defaults to the krbtgt if NULL, but could be
1578    kpasswd/realm or the local service (if we are doing s4u2self)
1579 */
1580 krb5_error_code kerberos_kinit_keyblock_cc(krb5_context ctx, krb5_ccache cc,
1581                                            krb5_principal principal,
1582                                            krb5_keyblock *keyblock,
1583                                            const char *target_service,
1584                                            krb5_get_init_creds_opt *krb_options,
1585                                            time_t *expire_time,
1586                                            time_t *kdc_time)
1587 {
1588         krb5_error_code code = 0;
1589         krb5_creds my_creds;
1590
1591 #if defined(HAVE_KRB5_GET_INIT_CREDS_KEYBLOCK)
1592         code = krb5_get_init_creds_keyblock(ctx, &my_creds, principal,
1593                                             keyblock, 0, target_service,
1594                                             krb_options);
1595 #elif defined(HAVE_KRB5_GET_INIT_CREDS_KEYTAB)
1596 {
1597 #define SMB_CREDS_KEYTAB "MEMORY:tmp_smb_creds_XXXXXX"
1598         char tmp_name[sizeof(SMB_CREDS_KEYTAB)];
1599         krb5_keytab_entry entry;
1600         krb5_keytab keytab;
1601         mode_t mask;
1602
1603         memset(&entry, 0, sizeof(entry));
1604         entry.principal = principal;
1605         *(KRB5_KT_KEY(&entry)) = *keyblock;
1606
1607         memcpy(tmp_name, SMB_CREDS_KEYTAB, sizeof(SMB_CREDS_KEYTAB));
1608         mask = umask(S_IRWXO | S_IRWXG);
1609         mktemp(tmp_name);
1610         umask(mask);
1611         if (tmp_name[0] == 0) {
1612                 return KRB5_KT_BADNAME;
1613         }
1614         code = krb5_kt_resolve(ctx, tmp_name, &keytab);
1615         if (code) {
1616                 return code;
1617         }
1618
1619         code = krb5_kt_add_entry(ctx, keytab, &entry);
1620         if (code) {
1621                 (void)krb5_kt_close(ctx, keytab);
1622                 goto done;
1623         }
1624
1625         code = krb5_get_init_creds_keytab(ctx, &my_creds, principal,
1626                                           keytab, 0, target_service,
1627                                           krb_options);
1628         (void)krb5_kt_close(ctx, keytab);
1629 }
1630 #else
1631 #error krb5_get_init_creds_keyblock not available!
1632 #endif
1633         if (code) {
1634                 return code;
1635         }
1636
1637         code = krb5_cc_initialize(ctx, cc, principal);
1638         if (code) {
1639                 goto done;
1640         }
1641
1642         code = krb5_cc_store_cred(ctx, cc, &my_creds);
1643         if (code) {
1644                 goto done;
1645         }
1646
1647         if (expire_time) {
1648                 *expire_time = (time_t) my_creds.times.endtime;
1649         }
1650
1651         if (kdc_time) {
1652                 *kdc_time = (time_t) my_creds.times.starttime;
1653         }
1654
1655         code = 0;
1656 done:
1657         krb5_free_cred_contents(ctx, &my_creds);
1658         return code;
1659 }
1660
1661 krb5_error_code kerberos_kinit_password_cc(krb5_context ctx, krb5_ccache cc,
1662                                            krb5_principal principal,
1663                                            const char *password,
1664                                            const char *target_service,
1665                                            krb5_get_init_creds_opt *krb_options,
1666                                            time_t *expire_time,
1667                                            time_t *kdc_time)
1668 {
1669         krb5_error_code code = 0;
1670         krb5_creds my_creds;
1671
1672         code = krb5_get_init_creds_password(ctx, &my_creds, principal,
1673                                             password, NULL, NULL, 0,
1674                                             target_service, krb_options);
1675         if (code) {
1676                 return code;
1677         }
1678
1679         code = krb5_cc_initialize(ctx, cc, principal);
1680         if (code) {
1681                 goto done;
1682         }
1683
1684         code = krb5_cc_store_cred(ctx, cc, &my_creds);
1685         if (code) {
1686                 goto done;
1687         }
1688
1689         if (expire_time) {
1690                 *expire_time = (time_t) my_creds.times.endtime;
1691         }
1692
1693         if (kdc_time) {
1694                 *kdc_time = (time_t) my_creds.times.starttime;
1695         }
1696
1697         code = 0;
1698 done:
1699         krb5_free_cred_contents(ctx, &my_creds);
1700         return code;
1701 }
1702
1703 #ifdef SAMBA4_USES_HEIMDAL
1704 /*
1705   simulate a kinit, putting the tgt in the given credentials cache.
1706   Orignally by remus@snapserver.com
1707
1708   The impersonate_principal is the principal
1709
1710   The self_service, should be the local service (for S4U2Self if
1711   impersonate_principal is given).
1712
1713   The target_service defaults to the krbtgt if NULL, but could be
1714   kpasswd/realm or a remote service (for S4U2Proxy)
1715
1716 */
1717 krb5_error_code kerberos_kinit_s4u2_cc(krb5_context ctx,
1718                                         krb5_ccache store_cc,
1719                                         krb5_principal init_principal,
1720                                         const char *init_password,
1721                                         krb5_principal impersonate_principal,
1722                                         const char *self_service,
1723                                         const char *target_service,
1724                                         krb5_get_init_creds_opt *krb_options,
1725                                         time_t *expire_time,
1726                                         time_t *kdc_time)
1727 {
1728         krb5_error_code code = 0;
1729         krb5_get_creds_opt options;
1730         krb5_principal store_principal;
1731         krb5_creds store_creds;
1732         krb5_creds *s4u2self_creds;
1733         Ticket s4u2self_ticket;
1734         size_t s4u2self_ticketlen;
1735         krb5_creds *s4u2proxy_creds;
1736         krb5_principal self_princ;
1737         bool s4u2proxy;
1738         krb5_principal target_princ;
1739         krb5_ccache tmp_cc;
1740         const char *self_realm;
1741         krb5_principal blacklist_principal = NULL;
1742         krb5_principal whitelist_principal = NULL;
1743
1744         code = krb5_get_init_creds_password(ctx, &store_creds,
1745                                             init_principal,
1746                                             init_password,
1747                                             NULL, NULL,
1748                                             0,
1749                                             NULL,
1750                                             krb_options);
1751         if (code != 0) {
1752                 return code;
1753         }
1754
1755         store_principal = init_principal;
1756
1757         /*
1758          * We are trying S4U2Self now:
1759          *
1760          * As we do not want to expose our TGT in the
1761          * krb5_ccache, which is also holds the impersonated creds.
1762          *
1763          * Some low level krb5/gssapi function might use the TGT
1764          * identity and let the client act as our machine account.
1765          *
1766          * We need to avoid that and use a temporary krb5_ccache
1767          * in order to pass our TGT to the krb5_get_creds() function.
1768          */
1769         code = krb5_cc_new_unique(ctx, NULL, NULL, &tmp_cc);
1770         if (code != 0) {
1771                 krb5_free_cred_contents(ctx, &store_creds);
1772                 return code;
1773         }
1774
1775         code = krb5_cc_initialize(ctx, tmp_cc, store_creds.client);
1776         if (code != 0) {
1777                 krb5_cc_destroy(ctx, tmp_cc);
1778                 krb5_free_cred_contents(ctx, &store_creds);
1779                 return code;
1780         }
1781
1782         code = krb5_cc_store_cred(ctx, tmp_cc, &store_creds);
1783         if (code != 0) {
1784                 krb5_free_cred_contents(ctx, &store_creds);
1785                 krb5_cc_destroy(ctx, tmp_cc);
1786                 return code;
1787         }
1788
1789         /*
1790          * we need to remember the client principal of our
1791          * TGT and make sure the KDC does not return this
1792          * in the impersonated tickets. This can happen
1793          * if the KDC does not support S4U2Self and S4U2Proxy.
1794          */
1795         blacklist_principal = store_creds.client;
1796         store_creds.client = NULL;
1797         krb5_free_cred_contents(ctx, &store_creds);
1798
1799         /*
1800          * Check if we also need S4U2Proxy or if S4U2Self is
1801          * enough in order to get a ticket for the target.
1802          */
1803         if (target_service == NULL) {
1804                 s4u2proxy = false;
1805         } else if (strcmp(target_service, self_service) == 0) {
1806                 s4u2proxy = false;
1807         } else {
1808                 s4u2proxy = true;
1809         }
1810
1811         /*
1812          * For S4U2Self we need our own service principal,
1813          * which belongs to our own realm (available on
1814          * our client principal).
1815          */
1816         self_realm = krb5_principal_get_realm(ctx, init_principal);
1817
1818         code = krb5_parse_name(ctx, self_service, &self_princ);
1819         if (code != 0) {
1820                 krb5_free_principal(ctx, blacklist_principal);
1821                 krb5_cc_destroy(ctx, tmp_cc);
1822                 return code;
1823         }
1824
1825         code = krb5_principal_set_realm(ctx, self_princ, self_realm);
1826         if (code != 0) {
1827                 krb5_free_principal(ctx, blacklist_principal);
1828                 krb5_free_principal(ctx, self_princ);
1829                 krb5_cc_destroy(ctx, tmp_cc);
1830                 return code;
1831         }
1832
1833         code = krb5_get_creds_opt_alloc(ctx, &options);
1834         if (code != 0) {
1835                 krb5_free_principal(ctx, blacklist_principal);
1836                 krb5_free_principal(ctx, self_princ);
1837                 krb5_cc_destroy(ctx, tmp_cc);
1838                 return code;
1839         }
1840
1841         if (s4u2proxy) {
1842                 /*
1843                  * If we want S4U2Proxy, we need the forwardable flag
1844                  * on the S4U2Self ticket.
1845                  */
1846                 krb5_get_creds_opt_set_options(ctx, options, KRB5_GC_FORWARDABLE);
1847         }
1848
1849         code = krb5_get_creds_opt_set_impersonate(ctx, options,
1850                                                   impersonate_principal);
1851         if (code != 0) {
1852                 krb5_get_creds_opt_free(ctx, options);
1853                 krb5_free_principal(ctx, blacklist_principal);
1854                 krb5_free_principal(ctx, self_princ);
1855                 krb5_cc_destroy(ctx, tmp_cc);
1856                 return code;
1857         }
1858
1859         code = krb5_get_creds(ctx, options, tmp_cc,
1860                               self_princ, &s4u2self_creds);
1861         krb5_get_creds_opt_free(ctx, options);
1862         krb5_free_principal(ctx, self_princ);
1863         if (code != 0) {
1864                 krb5_free_principal(ctx, blacklist_principal);
1865                 krb5_cc_destroy(ctx, tmp_cc);
1866                 return code;
1867         }
1868
1869         if (!s4u2proxy) {
1870                 krb5_cc_destroy(ctx, tmp_cc);
1871
1872                 /*
1873                  * Now make sure we store the impersonated principal
1874                  * and creds instead of the TGT related stuff
1875                  * in the krb5_ccache of the caller.
1876                  */
1877                 code = krb5_copy_creds_contents(ctx, s4u2self_creds,
1878                                                 &store_creds);
1879                 krb5_free_creds(ctx, s4u2self_creds);
1880                 if (code != 0) {
1881                         return code;
1882                 }
1883
1884                 /*
1885                  * It's important to store the principal the KDC
1886                  * returned, as otherwise the caller would not find
1887                  * the S4U2Self ticket in the krb5_ccache lookup.
1888                  */
1889                 store_principal = store_creds.client;
1890                 goto store;
1891         }
1892
1893         /*
1894          * We are trying S4U2Proxy:
1895          *
1896          * We need the ticket from the S4U2Self step
1897          * and our TGT in order to get the delegated ticket.
1898          */
1899         code = decode_Ticket((const uint8_t *)s4u2self_creds->ticket.data,
1900                              s4u2self_creds->ticket.length,
1901                              &s4u2self_ticket,
1902                              &s4u2self_ticketlen);
1903         if (code != 0) {
1904                 krb5_free_creds(ctx, s4u2self_creds);
1905                 krb5_free_principal(ctx, blacklist_principal);
1906                 krb5_cc_destroy(ctx, tmp_cc);
1907                 return code;
1908         }
1909
1910         /*
1911          * we need to remember the client principal of the
1912          * S4U2Self stage and as it needs to match the one we
1913          * will get for the S4U2Proxy stage. We need this
1914          * in order to detect KDCs which does not support S4U2Proxy.
1915          */
1916         whitelist_principal = s4u2self_creds->client;
1917         s4u2self_creds->client = NULL;
1918         krb5_free_creds(ctx, s4u2self_creds);
1919
1920         /*
1921          * For S4U2Proxy we also got a target service principal,
1922          * which also belongs to our own realm (available on
1923          * our client principal).
1924          */
1925         code = krb5_parse_name(ctx, target_service, &target_princ);
1926         if (code != 0) {
1927                 free_Ticket(&s4u2self_ticket);
1928                 krb5_free_principal(ctx, whitelist_principal);
1929                 krb5_free_principal(ctx, blacklist_principal);
1930                 krb5_cc_destroy(ctx, tmp_cc);
1931                 return code;
1932         }
1933
1934         code = krb5_principal_set_realm(ctx, target_princ, self_realm);
1935         if (code != 0) {
1936                 free_Ticket(&s4u2self_ticket);
1937                 krb5_free_principal(ctx, target_princ);
1938                 krb5_free_principal(ctx, whitelist_principal);
1939                 krb5_free_principal(ctx, blacklist_principal);
1940                 krb5_cc_destroy(ctx, tmp_cc);
1941                 return code;
1942         }
1943
1944         code = krb5_get_creds_opt_alloc(ctx, &options);
1945         if (code != 0) {
1946                 free_Ticket(&s4u2self_ticket);
1947                 krb5_free_principal(ctx, target_princ);
1948                 krb5_free_principal(ctx, whitelist_principal);
1949                 krb5_free_principal(ctx, blacklist_principal);
1950                 krb5_cc_destroy(ctx, tmp_cc);
1951                 return code;
1952         }
1953
1954         krb5_get_creds_opt_set_options(ctx, options, KRB5_GC_FORWARDABLE);
1955         krb5_get_creds_opt_set_options(ctx, options, KRB5_GC_CONSTRAINED_DELEGATION);
1956
1957         code = krb5_get_creds_opt_set_ticket(ctx, options, &s4u2self_ticket);
1958         free_Ticket(&s4u2self_ticket);
1959         if (code != 0) {
1960                 krb5_get_creds_opt_free(ctx, options);
1961                 krb5_free_principal(ctx, target_princ);
1962                 krb5_free_principal(ctx, whitelist_principal);
1963                 krb5_free_principal(ctx, blacklist_principal);
1964                 krb5_cc_destroy(ctx, tmp_cc);
1965                 return code;
1966         }
1967
1968         code = krb5_get_creds(ctx, options, tmp_cc,
1969                               target_princ, &s4u2proxy_creds);
1970         krb5_get_creds_opt_free(ctx, options);
1971         krb5_free_principal(ctx, target_princ);
1972         krb5_cc_destroy(ctx, tmp_cc);
1973         if (code != 0) {
1974                 krb5_free_principal(ctx, whitelist_principal);
1975                 krb5_free_principal(ctx, blacklist_principal);
1976                 return code;
1977         }
1978
1979         /*
1980          * Now make sure we store the impersonated principal
1981          * and creds instead of the TGT related stuff
1982          * in the krb5_ccache of the caller.
1983          */
1984         code = krb5_copy_creds_contents(ctx, s4u2proxy_creds,
1985                                         &store_creds);
1986         krb5_free_creds(ctx, s4u2proxy_creds);
1987         if (code != 0) {
1988                 krb5_free_principal(ctx, whitelist_principal);
1989                 krb5_free_principal(ctx, blacklist_principal);
1990                 return code;
1991         }
1992
1993         /*
1994          * It's important to store the principal the KDC
1995          * returned, as otherwise the caller would not find
1996          * the S4U2Self ticket in the krb5_ccache lookup.
1997          */
1998         store_principal = store_creds.client;
1999
2000  store:
2001         if (blacklist_principal &&
2002             krb5_principal_compare(ctx, store_creds.client, blacklist_principal)) {
2003                 char *sp = NULL;
2004                 char *ip = NULL;
2005
2006                 code = krb5_unparse_name(ctx, blacklist_principal, &sp);
2007                 if (code != 0) {
2008                         sp = NULL;
2009                 }
2010                 code = krb5_unparse_name(ctx, impersonate_principal, &ip);
2011                 if (code != 0) {
2012                         ip = NULL;
2013                 }
2014                 DEBUG(1, ("kerberos_kinit_password_cc: "
2015                           "KDC returned self principal[%s] while impersonating [%s]\n",
2016                           sp?sp:"<no memory>",
2017                           ip?ip:"<no memory>"));
2018
2019                 SAFE_FREE(sp);
2020                 SAFE_FREE(ip);
2021
2022                 krb5_free_principal(ctx, whitelist_principal);
2023                 krb5_free_principal(ctx, blacklist_principal);
2024                 krb5_free_cred_contents(ctx, &store_creds);
2025                 return KRB5_FWD_BAD_PRINCIPAL;
2026         }
2027         if (blacklist_principal) {
2028                 krb5_free_principal(ctx, blacklist_principal);
2029         }
2030
2031         if (whitelist_principal &&
2032             !krb5_principal_compare(ctx, store_creds.client, whitelist_principal)) {
2033                 char *sp = NULL;
2034                 char *ep = NULL;
2035
2036                 code = krb5_unparse_name(ctx, store_creds.client, &sp);
2037                 if (code != 0) {
2038                         sp = NULL;
2039                 }
2040                 code = krb5_unparse_name(ctx, whitelist_principal, &ep);
2041                 if (code != 0) {
2042                         ep = NULL;
2043                 }
2044                 DEBUG(1, ("kerberos_kinit_password_cc: "
2045                           "KDC returned wrong principal[%s] we expected [%s]\n",
2046                           sp?sp:"<no memory>",
2047                           ep?ep:"<no memory>"));
2048
2049                 SAFE_FREE(sp);
2050                 SAFE_FREE(ep);
2051
2052                 krb5_free_principal(ctx, whitelist_principal);
2053                 krb5_free_cred_contents(ctx, &store_creds);
2054                 return KRB5_FWD_BAD_PRINCIPAL;
2055         }
2056         if (whitelist_principal) {
2057                 krb5_free_principal(ctx, whitelist_principal);
2058         }
2059
2060         code = krb5_cc_initialize(ctx, store_cc, store_principal);
2061         if (code != 0) {
2062                 krb5_free_cred_contents(ctx, &store_creds);
2063                 return code;
2064         }
2065
2066         code = krb5_cc_store_cred(ctx, store_cc, &store_creds);
2067         if (code != 0) {
2068                 krb5_free_cred_contents(ctx, &store_creds);
2069                 return code;
2070         }
2071
2072         if (expire_time) {
2073                 *expire_time = (time_t) store_creds.times.endtime;
2074         }
2075
2076         if (kdc_time) {
2077                 *kdc_time = (time_t) store_creds.times.starttime;
2078         }
2079
2080         krb5_free_cred_contents(ctx, &store_creds);
2081
2082         return 0;
2083 }
2084 #endif
2085
2086 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
2087 krb5_error_code smb_krb5_make_principal(krb5_context context,
2088                                         krb5_principal *principal,
2089                                         const char *_realm, ...)
2090 {
2091         krb5_error_code code;
2092         bool free_realm;
2093         char *realm;
2094         va_list ap;
2095
2096         if (_realm) {
2097                 realm = _realm;
2098                 free_realm = false;
2099         } else {
2100                 code = krb5_get_default_realm(context, &realm);
2101                 if (code) {
2102                         return code;
2103                 }
2104                 free_realm = true;
2105         }
2106
2107         va_start(ap, _realm);
2108         code = krb5_build_principal_alloc_va(context, principal,
2109                                              strlen(realm), realm,
2110                                              ap);
2111         va_end(ap);
2112
2113         if (free_realm) {
2114                 krb5_free_default_realm(context, realm);
2115         }
2116
2117         return code;
2118 }
2119 #endif
2120
2121 #if !defined(HAVE_KRB5_CC_GET_LIFETIME) && defined(HAVE_KRB5_CC_RETRIEVE_CRED)
2122 /**
2123  * @brief Get the lifetime of the initial ticket in the cache.
2124  *
2125  * @param[in]  context  The kerberos context.
2126  *
2127  * @param[in]  id       The credential cache to get the ticket lifetime.
2128  *
2129  * @param[out] t        A pointer to a time value to store the lifetime.
2130  *
2131  * @return              0 on success, a krb5_error_code on error.
2132  */
2133 krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context,
2134                                          krb5_ccache id,
2135                                          time_t *t)
2136 {
2137         krb5_cc_cursor cursor;
2138         krb5_error_code kerr;
2139         krb5_creds cred;
2140         krb5_timestamp now;
2141
2142         *t = 0;
2143
2144         kerr = krb5_timeofday(context, &now);
2145         if (kerr) {
2146                 return kerr;
2147         }
2148
2149         kerr = krb5_cc_start_seq_get(context, id, &cursor);
2150         if (kerr) {
2151                 return kerr;
2152         }
2153
2154         while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) {
2155 #ifndef HAVE_FLAGS_IN_KRB5_CREDS
2156                 if (cred.ticket_flags & TKT_FLG_INITIAL) {
2157 #else
2158                 if (cred.flags.b.initial) {
2159 #endif
2160                         if (now < cred.times.endtime) {
2161                                 *t = (time_t) (cred.times.endtime - now);
2162                         }
2163                         krb5_free_cred_contents(context, &cred);
2164                         break;
2165                 }
2166                 krb5_free_cred_contents(context, &cred);
2167         }
2168
2169         krb5_cc_end_seq_get(context, id, &cursor);
2170
2171         return kerr;
2172 }
2173 #endif /* HAVE_KRB5_CC_GET_LIFETIME */
2174
2175 #if !defined(HAVE_KRB5_FREE_CHECKSUM_CONTENTS) && defined(HAVE_FREE_CHECKSUM)
2176 void smb_krb5_free_checksum_contents(krb5_context ctx, krb5_checksum *cksum)
2177 {
2178         free_Checksum(cksum);
2179 }
2180 #endif
2181
2182 krb5_error_code smb_krb5_make_pac_checksum(TALLOC_CTX *mem_ctx,
2183                                            DATA_BLOB *pac_data,
2184                                            krb5_context context,
2185                                            const krb5_keyblock *keyblock,
2186                                            uint32_t *sig_type,
2187                                            DATA_BLOB *sig_blob)
2188 {
2189         krb5_error_code ret;
2190         krb5_checksum cksum;
2191 #if defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CREATE_CHECKSUM)
2192         krb5_crypto crypto;
2193
2194
2195         ret = krb5_crypto_init(context,
2196                                keyblock,
2197                                0,
2198                                &crypto);
2199         if (ret) {
2200                 DEBUG(0,("krb5_crypto_init() failed: %s\n",
2201                           smb_get_krb5_error_message(context, ret, mem_ctx)));
2202                 return ret;
2203         }
2204         ret = krb5_create_checksum(context,
2205                                    crypto,
2206                                    KRB5_KU_OTHER_CKSUM,
2207                                    0,
2208                                    pac_data->data,
2209                                    pac_data->length,
2210                                    &cksum);
2211         if (ret) {
2212                 DEBUG(2, ("PAC Verification failed: %s\n",
2213                           smb_get_krb5_error_message(context, ret, mem_ctx)));
2214         }
2215
2216         krb5_crypto_destroy(context, crypto);
2217
2218         if (ret) {
2219                 return ret;
2220         }
2221
2222         *sig_type = cksum.cksumtype;
2223         *sig_blob = data_blob_talloc(mem_ctx,
2224                                         cksum.checksum.data,
2225                                         cksum.checksum.length);
2226 #elif defined(HAVE_KRB5_C_MAKE_CHECKSUM)
2227         krb5_data input;
2228
2229         input.data = (char *)pac_data->data;
2230         input.length = pac_data->length;
2231
2232         ret = krb5_c_make_checksum(context,
2233                                    0,
2234                                    keyblock,
2235                                    KRB5_KEYUSAGE_APP_DATA_CKSUM,
2236                                    &input,
2237                                    &cksum);
2238         if (ret) {
2239                 DEBUG(2, ("PAC Verification failed: %s\n",
2240                           smb_get_krb5_error_message(context, ret, mem_ctx)));
2241                 return ret;
2242         }
2243
2244         *sig_type = cksum.checksum_type;
2245         *sig_blob = data_blob_talloc(mem_ctx,
2246                                         cksum.contents,
2247                                         cksum.length);
2248
2249 #else
2250 #error krb5_create_checksum or krb5_c_make_checksum not available
2251 #endif /* HAVE_KRB5_C_MAKE_CHECKSUM */
2252         smb_krb5_free_checksum_contents(context, &cksum);
2253
2254         return 0;
2255 }
2256
2257
2258 /*
2259  * smb_krb5_principal_get_realm
2260  *
2261  * @brief Get realm of a principal
2262  *
2263  * @param[in] context           The krb5_context
2264  * @param[in] principal         The principal
2265  * @return pointer to the realm
2266  *
2267  */
2268
2269 char *smb_krb5_principal_get_realm(krb5_context context,
2270                                    krb5_principal principal)
2271 {
2272 #ifdef HAVE_KRB5_PRINCIPAL_GET_REALM /* Heimdal */
2273         return discard_const_p(char, krb5_principal_get_realm(context, principal));
2274 #elif defined(krb5_princ_realm) /* MIT */
2275         krb5_data *realm;
2276         realm = krb5_princ_realm(context, principal);
2277         return discard_const_p(char, realm->data);
2278 #else
2279         return NULL;
2280 #endif
2281 }
2282
2283 /************************************************************************
2284  Routine to get the default realm from the kerberos credentials cache.
2285  Caller must free if the return value is not NULL.
2286 ************************************************************************/
2287
2288 static char *smb_krb5_get_default_realm_from_ccache(TALLOC_CTX *mem_ctx)
2289 {
2290         char *realm = NULL;
2291         krb5_context ctx = NULL;
2292         krb5_ccache cc = NULL;
2293         krb5_principal princ = NULL;
2294
2295         initialize_krb5_error_table();
2296         if (krb5_init_context(&ctx)) {
2297                 return NULL;
2298         }
2299
2300         DEBUG(5,("kerberos_get_default_realm_from_ccache: "
2301                 "Trying to read krb5 cache: %s\n",
2302                 krb5_cc_default_name(ctx)));
2303         if (krb5_cc_default(ctx, &cc)) {
2304                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
2305                         "failed to read default cache\n"));
2306                 goto out;
2307         }
2308         if (krb5_cc_get_principal(ctx, cc, &princ)) {
2309                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
2310                         "failed to get default principal\n"));
2311                 goto out;
2312         }
2313
2314 #if defined(HAVE_KRB5_PRINCIPAL_GET_REALM)
2315         realm = talloc_strdup(mem_ctx, krb5_principal_get_realm(ctx, princ));
2316 #elif defined(HAVE_KRB5_PRINC_REALM)
2317         {
2318                 krb5_data *realm_data = krb5_princ_realm(ctx, princ);
2319                 realm = talloc_strndup(mem_ctx, realm_data->data, realm_data->length);
2320         }
2321 #endif
2322
2323   out:
2324
2325         if (ctx) {
2326                 if (princ) {
2327                         krb5_free_principal(ctx, princ);
2328                 }
2329                 if (cc) {
2330                         krb5_cc_close(ctx, cc);
2331                 }
2332                 krb5_free_context(ctx);
2333         }
2334
2335         return realm;
2336 }
2337
2338 /************************************************************************
2339  Routine to get the realm from a given DNS name.
2340 ************************************************************************/
2341
2342 static char *smb_krb5_get_realm_from_hostname(TALLOC_CTX *mem_ctx,
2343                                                 const char *hostname)
2344 {
2345 #if defined(HAVE_KRB5_REALM_TYPE)
2346         /* Heimdal. */
2347         krb5_realm *realm_list = NULL;
2348 #else
2349         /* MIT */
2350         char **realm_list = NULL;
2351 #endif
2352         char *realm = NULL;
2353         krb5_error_code kerr;
2354         krb5_context ctx = NULL;
2355
2356         initialize_krb5_error_table();
2357         if (krb5_init_context(&ctx)) {
2358                 return NULL;
2359         }
2360
2361         kerr = krb5_get_host_realm(ctx, hostname, &realm_list);
2362         if (kerr != 0) {
2363                 DEBUG(3,("kerberos_get_realm_from_hostname %s: "
2364                         "failed %s\n",
2365                         hostname ? hostname : "(NULL)",
2366                         error_message(kerr) ));
2367                 goto out;
2368         }
2369
2370         if (realm_list && realm_list[0]) {
2371                 realm = talloc_strdup(mem_ctx, realm_list[0]);
2372         }
2373
2374   out:
2375
2376         if (ctx) {
2377                 if (realm_list) {
2378                         krb5_free_host_realm(ctx, realm_list);
2379                         realm_list = NULL;
2380                 }
2381                 krb5_free_context(ctx);
2382                 ctx = NULL;
2383         }
2384         return realm;
2385 }
2386
2387 char *kerberos_get_principal_from_service_hostname(TALLOC_CTX *mem_ctx,
2388                                                    const char *service,
2389                                                    const char *remote_name,
2390                                                    const char *default_realm)
2391 {
2392         char *realm = NULL;
2393         char *host = NULL;
2394         char *principal;
2395         host = strchr_m(remote_name, '.');
2396         if (host) {
2397                 /* DNS name. */
2398                 realm = smb_krb5_get_realm_from_hostname(talloc_tos(),
2399                                                          remote_name);
2400         } else {
2401                 /* NetBIOS name - use our realm. */
2402                 realm = smb_krb5_get_default_realm_from_ccache(talloc_tos());
2403         }
2404
2405         if (realm == NULL || *realm == '\0') {
2406                 realm = talloc_strdup(talloc_tos(), default_realm);
2407                 if (!realm) {
2408                         return NULL;
2409                 }
2410                 DEBUG(3,("kerberos_get_principal_from_service_hostname: "
2411                          "cannot get realm from, "
2412                          "desthost %s or default ccache. Using default "
2413                          "smb.conf realm %s\n",
2414                          remote_name,
2415                          realm));
2416         }
2417
2418         principal = talloc_asprintf(mem_ctx,
2419                                     "%s/%s@%s",
2420                                     service, remote_name,
2421                                     realm);
2422         TALLOC_FREE(realm);
2423         return principal;
2424 }
2425
2426 char *smb_get_krb5_error_message(krb5_context context,
2427                                  krb5_error_code code,
2428                                  TALLOC_CTX *mem_ctx)
2429 {
2430         char *ret;
2431
2432 #if defined(HAVE_KRB5_GET_ERROR_MESSAGE) && defined(HAVE_KRB5_FREE_ERROR_MESSAGE)
2433         const char *context_error = krb5_get_error_message(context, code);
2434         if (context_error) {
2435                 ret = talloc_asprintf(mem_ctx, "%s: %s",
2436                                         error_message(code), context_error);
2437                 krb5_free_error_message(context, context_error);
2438                 return ret;
2439         }
2440 #endif
2441         ret = talloc_strdup(mem_ctx, error_message(code));
2442         return ret;
2443 }
2444
2445
2446 /**
2447 * @brief Return the kerberos library setting for "libdefaults:allow_weak_crypto"
2448 *
2449 * @param context        The krb5_context
2450 *
2451 * @return krb5_boolean
2452 *
2453 * Function returns true if weak crypto is allowd, false if not
2454 */
2455
2456 krb5_boolean smb_krb5_get_allowed_weak_crypto(krb5_context context)
2457 #if defined(HAVE_KRB5_CONFIG_GET_BOOL_DEFAULT)
2458 {
2459         return krb5_config_get_bool_default(context,
2460                                             NULL,
2461                                             FALSE,
2462                                             "libdefaults",
2463                                             "allow_weak_crypto",
2464                                             NULL);
2465 }
2466 #elif defined(HAVE_PROFILE_H) && defined(HAVE_KRB5_GET_PROFILE)
2467 {
2468 #include <profile.h>
2469         krb5_error_code ret;
2470         krb5_boolean ret_default = false;
2471         profile_t profile;
2472         int ret_profile;
2473
2474         ret = krb5_get_profile(context,
2475                                &profile);
2476         if (ret) {
2477                 return ret_default;
2478         }
2479
2480         ret = profile_get_boolean(profile,
2481                                   "libdefaults",
2482                                   "allow_weak_crypto",
2483                                   NULL, /* subsubname */
2484                                   ret_default, /* def_val */
2485                                   &ret_profile /* *ret_default */);
2486         if (ret) {
2487                 return ret_default;
2488         }
2489
2490         profile_release(profile);
2491
2492         return ret_profile;
2493 }
2494 #else
2495 #error UNKNOWN_KRB5_CONFIG_ROUTINES
2496 #endif
2497
2498 #else /* HAVE_KRB5 */
2499  /* this saves a few linking headaches */
2500  int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx,
2501                         const char *principal, time_t time_offset,
2502                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
2503                         uint32_t extra_ap_opts,
2504                         const char *ccname, time_t *tgs_expire,
2505                         const char *impersonate_princ_s)
2506 {
2507          DEBUG(0,("NO KERBEROS SUPPORT\n"));
2508          return 1;
2509 }
2510
2511 #endif /* HAVE_KRB5 */