source3/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  25 #define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
  26
  27 #include "includes.h"
  28
  29 #ifdef HAVE_KRB5
  30
  31 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
  32 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  33 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  34 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  35 #else
  36 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  37 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  38 #define KRB5_KEY_DATA(k)        ((k)->contents)
  39 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  40
  41 /**************************************************************
  42  Wrappers around kerberos string functions that convert from
  43  utf8 -> unix charset and vica versa.
  44 **************************************************************/
  45
  46 /**************************************************************
  47  krb5_parse_name that takes a UNIX charset.
  48 **************************************************************/
  49
  50  krb5_error_code smb_krb5_parse_name(krb5_context context,
  51                                 const char *name, /* in unix charset */
  52                                 krb5_principal *principal)
  53 {
  54         krb5_error_code ret;
  55         char *utf8_name;
  56
  57         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  58                 return ENOMEM;
  59         }
  60
  61         ret = krb5_parse_name(context, utf8_name, principal);
  62         SAFE_FREE(utf8_name);
  63         return ret;
  64 }
  65
  66 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
  67 /**************************************************************
  68  krb5_parse_name_norealm that takes a UNIX charset.
  69 **************************************************************/
  70
  71 static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
  72                                 const char *name, /* in unix charset */
  73                                 krb5_principal *principal)
  74 {
  75         krb5_error_code ret;
  76         char *utf8_name;
  77
  78         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  79                 return ENOMEM;
  80         }
  81
  82         ret = krb5_parse_name_norealm(context, utf8_name, principal);
  83         SAFE_FREE(utf8_name);
  84         return ret;
  85 }
  86 #endif
  87
  88 /**************************************************************
  89  krb5_parse_name that returns a UNIX charset name. Must
  90  be freed with normal free() call.
  91 **************************************************************/
  92
  93  krb5_error_code smb_krb5_unparse_name(krb5_context context,
  94                                         krb5_const_principal principal,
  95                                         char **unix_name)
  96 {
  97         krb5_error_code ret;
  98         char *utf8_name;
  99
 100         ret = krb5_unparse_name(context, principal, &utf8_name);
 101         if (ret) {
 102                 return ret;
 103         }
 104
 105         if (pull_utf8_allocate(unix_name, utf8_name)==-1) {
 106                 krb5_free_unparsed_name(context, utf8_name);
 107                 return ENOMEM;
 108         }
 109         krb5_free_unparsed_name(context, utf8_name);
 110         return 0;
 111 }
 112
 113 #ifndef HAVE_KRB5_SET_REAL_TIME
 114 /*
 115  * This function is not in the Heimdal mainline.
 116  */
 117  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
 118 {
 119         krb5_error_code ret;
 120         int32_t sec, usec;
 121
 122         ret = krb5_us_timeofday(context, &sec, &usec);
 123         if (ret)
 124                 return ret;
 125
 126         context->kdc_sec_offset = seconds - sec;
 127         context->kdc_usec_offset = microseconds - usec;
 128
 129         return 0;
 130 }
 131 #endif
 132
 133 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
 134
 135 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
 136
 137 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
 138  * to krb5_set_default_tgs_ktypes. See
 139  *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
 140  *
 141  * If the MIT libraries are not exporting internal symbols, we will end up in
 142  * this branch, which is correct. Otherwise we will continue to use the
 143  * internal symbol
 144  */
 145  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 146 {
 147     return krb5_set_default_tgs_enctypes(ctx, enc);
 148 }
 149
 150 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
 151
 152 /* Heimdal */
 153  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 154 {
 155         return krb5_set_default_in_tkt_etypes(ctx, enc);
 156 }
 157
 158 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
 159
 160 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
 161
 162 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
 163 /* HEIMDAL */
 164  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
 165 {
 166         pkaddr->addr_type = KRB5_ADDRESS_INET;
 167         pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 168         pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 169 }
 170 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 171 /* MIT */
 172  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
 173 {
 174         pkaddr->addrtype = ADDRTYPE_INET;
 175         pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 176         pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 177 }
 178 #else
 179 #error UNKNOWN_ADDRTYPE
 180 #endif
 181
 182 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
 183  int create_kerberos_key_from_string_direct(krb5_context context,
 184                                         krb5_principal host_princ,
 185                                         krb5_data *password,
 186                                         krb5_keyblock *key,
 187                                         krb5_enctype enctype)
 188 {
 189         int ret;
 190         krb5_data salt;
 191         krb5_encrypt_block eblock;
 192
 193         ret = krb5_principal2salt(context, host_princ, &salt);
 194         if (ret) {
 195                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 196                 return ret;
 197         }
 198         krb5_use_enctype(context, &eblock, enctype);
 199         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
 200         SAFE_FREE(salt.data);
 201         return ret;
 202 }
 203 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 204  int create_kerberos_key_from_string_direct(krb5_context context,
 205                                         krb5_principal host_princ,
 206                                         krb5_data *password,
 207                                         krb5_keyblock *key,
 208                                         krb5_enctype enctype)
 209 {
 210         int ret;
 211         krb5_salt salt;
 212
 213         ret = krb5_get_pw_salt(context, host_princ, &salt);
 214         if (ret) {
 215                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 216                 return ret;
 217         }
 218
 219         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
 220         krb5_free_salt(context, salt);
 221         return ret;
 222 }
 223 #else
 224 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 225 #endif
 226
 227  int create_kerberos_key_from_string(krb5_context context,
 228                                         krb5_principal host_princ,
 229                                         krb5_data *password,
 230                                         krb5_keyblock *key,
 231                                         krb5_enctype enctype)
 232 {
 233         krb5_principal salt_princ = NULL;
 234         int ret;
 235         /*
 236          * Check if we've determined that the KDC is salting keys for this
 237          * principal/enctype in a non-obvious way.  If it is, try to match
 238          * its behavior.
 239          */
 240         salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
 241         ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
 242         if (salt_princ) {
 243                 krb5_free_principal(context, salt_princ);
 244         }
 245         return ret;
 246 }
 247
 248 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 249  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 250                                             krb5_enctype **enctypes)
 251 {
 252         return krb5_get_permitted_enctypes(context, enctypes);
 253 }
 254 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 255  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 256                                             krb5_enctype **enctypes)
 257 {
 258         return krb5_get_default_in_tkt_etypes(context, enctypes);
 259 }
 260 #else
 261 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 262 #endif
 263
 264 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 265  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 266                                         krb5_auth_context auth_context,
 267                                         krb5_keyblock *keyblock)
 268 {
 269         return krb5_auth_con_setkey(context, auth_context, keyblock);
 270 }
 271 #endif
 272
 273 BOOL unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 274 {
 275         DATA_BLOB pac_contents;
 276         ASN1_DATA data;
 277         int data_type;
 278
 279         if (!auth_data->length) {
 280                 return False;
 281         }
 282
 283         asn1_load(&data, *auth_data);
 284         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 285         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 286         asn1_start_tag(&data, ASN1_CONTEXT(0));
 287         asn1_read_Integer(&data, &data_type);
 288
 289         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 290                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 291                 asn1_free(&data);
 292                 return False;
 293         }
 294
 295         asn1_end_tag(&data);
 296         asn1_start_tag(&data, ASN1_CONTEXT(1));
 297         asn1_read_OctetString(&data, &pac_contents);
 298         asn1_end_tag(&data);
 299         asn1_end_tag(&data);
 300         asn1_end_tag(&data);
 301         asn1_free(&data);
 302
 303         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 304
 305         data_blob_free(&pac_contents);
 306
 307         return True;
 308 }
 309
 310  BOOL get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 311 {
 312         DATA_BLOB auth_data_wrapped;
 313         BOOL got_auth_data_pac = False;
 314         int i;
 315
 316 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 317         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 318             tkt->enc_part2->authorization_data[0] &&
 319             tkt->enc_part2->authorization_data[0]->length)
 320         {
 321                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 322
 323                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 324                             KRB5_AUTHDATA_IF_RELEVANT) {
 325                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 326                                         tkt->enc_part2->authorization_data[i]->ad_type));
 327                                 continue;
 328                         }
 329
 330                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 331                                                       tkt->enc_part2->authorization_data[i]->length);
 332
 333                         /* check if it is a PAC */
 334                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 335                         data_blob_free(&auth_data_wrapped);
 336
 337                         if (!got_auth_data_pac) {
 338                                 continue;
 339                         }
 340                 }
 341
 342                 return got_auth_data_pac;
 343         }
 344
 345 #else
 346         if (tkt->ticket.authorization_data &&
 347             tkt->ticket.authorization_data->len)
 348         {
 349                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 350
 351                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 352                             KRB5_AUTHDATA_IF_RELEVANT) {
 353                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 354                                         tkt->ticket.authorization_data->val[i].ad_type));
 355                                 continue;
 356                         }
 357
 358                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 359                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 360
 361                         /* check if it is a PAC */
 362                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 363                         data_blob_free(&auth_data_wrapped);
 364
 365                         if (!got_auth_data_pac) {
 366                                 continue;
 367                         }
 368                 }
 369
 370                 return got_auth_data_pac;
 371         }
 372 #endif
 373         return False;
 374 }
 375
 376  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 377 {
 378 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 379         return tkt->enc_part2->client;
 380 #else
 381         return tkt->client;
 382 #endif
 383 }
 384
 385 #if !defined(HAVE_KRB5_LOCATE_KDC)
 386
 387 /* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
 388  * to a public interface for this functionality, so we have to be able to live
 389  * without it if the MIT libraries are hiding their internal symbols.
 390  */
 391
 392 #if defined(KRB5_KRBHST_INIT)
 393 /* Heimdal */
 394  krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 395 {
 396         krb5_krbhst_handle hnd;
 397         krb5_krbhst_info *hinfo;
 398         krb5_error_code rc;
 399         int num_kdcs, i;
 400         struct sockaddr *sa;
 401         struct addrinfo *ai;
 402
 403         *addr_pp = NULL;
 404         *naddrs = 0;
 405
 406         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 407         if (rc) {
 408                 DEBUG(0, ("krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 409                 return rc;
 410         }
 411
 412         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 413                 ;
 414
 415         krb5_krbhst_reset(ctx, hnd);
 416
 417         if (!num_kdcs) {
 418                 DEBUG(0, ("krb5_locate_kdc: zero kdcs found !\n"));
 419                 krb5_krbhst_free(ctx, hnd);
 420                 return -1;
 421         }
 422
 423         sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
 424         if (!sa) {
 425                 DEBUG(0, ("krb5_locate_kdc: malloc failed\n"));
 426                 krb5_krbhst_free(ctx, hnd);
 427                 naddrs = 0;
 428                 return -1;
 429         }
 430
 431         memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
 432
 433         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 434
 435 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
 436                 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
 437                 if (rc) {
 438                         DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
 439                         continue;
 440                 }
 441 #endif
 442                 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
 443                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 444         }
 445
 446         krb5_krbhst_free(ctx, hnd);
 447
 448         *naddrs = num_kdcs;
 449         *addr_pp = sa;
 450         return 0;
 451 }
 452
 453 #else /* ! defined(KRB5_KRBHST_INIT) */
 454
 455  krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 456                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 457 {
 458         DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
 459         return KRB5_KDC_UNREACH;
 460 }
 461
 462 #endif /* KRB5_KRBHST_INIT */
 463
 464 #endif /* HAVE_KRB5_LOCATE_KDC */
 465
 466 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 467  void krb5_free_unparsed_name(krb5_context context, char *val)
 468 {
 469         SAFE_FREE(val);
 470 }
 471 #endif
 472
 473  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 474 {
 475 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 476         if (pdata->data) {
 477                 krb5_free_data_contents(context, pdata);
 478         }
 479 #else
 480         SAFE_FREE(pdata->data);
 481 #endif
 482 }
 483
 484  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 485 {
 486 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 487         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 488 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 489         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 490 #else
 491 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 492 #endif
 493 }
 494
 495  BOOL kerberos_compatible_enctypes(krb5_context context,
 496                                   krb5_enctype enctype1,
 497                                   krb5_enctype enctype2)
 498 {
 499 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 500         krb5_boolean similar = 0;
 501
 502         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 503         return similar ? True : False;
 504 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 505         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 506 #endif
 507 }
 508
 509 static BOOL ads_cleanup_expired_creds(krb5_context context,
 510                                       krb5_ccache  ccache,
 511                                       krb5_creds  *credsp)
 512 {
 513         krb5_error_code retval;
 514         const char *cc_type = krb5_cc_get_type(context, ccache);
 515
 516         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 517                   cc_type, krb5_cc_get_name(context, ccache),
 518                   http_timestring(credsp->times.endtime)));
 519
 520         /* we will probably need new tickets if the current ones
 521            will expire within 10 seconds.
 522         */
 523         if (credsp->times.endtime >= (time(NULL) + 10))
 524                 return False;
 525
 526         /* heimdal won't remove creds from a file ccache, and
 527            perhaps we shouldn't anyway, since internally we
 528            use memory ccaches, and a FILE one probably means that
 529            we're using creds obtained outside of our exectuable
 530         */
 531         if (strequal(cc_type, "FILE")) {
 532                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 533                 return False;
 534         }
 535
 536         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 537         if (retval) {
 538                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 539                           error_message(retval)));
 540                 /* If we have an error in this, we want to display it,
 541                    but continue as though we deleted it */
 542         }
 543         return True;
 544 }
 545
 546 /*
 547   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 548 */
 549 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 550                                        krb5_auth_context *auth_context,
 551                                        const krb5_flags ap_req_options,
 552                                        const char *principal,
 553                                        krb5_ccache ccache,
 554                                        krb5_data *outbuf,
 555                                        time_t *expire_time)
 556 {
 557         krb5_error_code           retval;
 558         krb5_principal    server;
 559         krb5_creds              * credsp;
 560         krb5_creds                creds;
 561         krb5_data in_data;
 562         BOOL creds_ready = False;
 563         int i = 0, maxtries = 3;
 564
 565         retval = smb_krb5_parse_name(context, principal, &server);
 566         if (retval) {
 567                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 568                 return retval;
 569         }
 570
 571         /* obtain ticket & session key */
 572         ZERO_STRUCT(creds);
 573         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 574                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 575                          error_message(retval)));
 576                 goto cleanup_princ;
 577         }
 578
 579         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 580                 /* This can commonly fail on smbd startup with no ticket in the cache.
 581                  * Report at higher level than 1. */
 582                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 583                          error_message(retval)));
 584                 goto cleanup_creds;
 585         }
 586
 587         while (!creds_ready && (i < maxtries)) {
 588
 589                 if ((retval = krb5_get_credentials(context, 0, ccache,
 590                                                    &creds, &credsp))) {
 591                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 592                                  principal, error_message(retval)));
 593                         goto cleanup_creds;
 594                 }
 595
 596                 /* cope with ticket being in the future due to clock skew */
 597                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 598                         time_t t = time(NULL);
 599                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 600                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 601                         krb5_set_real_time(context, t + time_offset + 1, 0);
 602                 }
 603
 604                 if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
 605                         creds_ready = True;
 606                 }
 607
 608                 i++;
 609         }
 610
 611         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 612                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 613                   http_timestring((unsigned)credsp->times.endtime),
 614                   (unsigned)credsp->times.endtime));
 615
 616         if (expire_time) {
 617                 *expire_time = (time_t)credsp->times.endtime;
 618         }
 619
 620         in_data.length = 0;
 621         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 622                                       &in_data, credsp, outbuf);
 623         if (retval) {
 624                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 625                          error_message(retval)));
 626         }
 627
 628         krb5_free_creds(context, credsp);
 629
 630 cleanup_creds:
 631         krb5_free_cred_contents(context, &creds);
 632
 633 cleanup_princ:
 634         krb5_free_principal(context, server);
 635
 636         return retval;
 637 }
 638
 639 /*
 640   get a kerberos5 ticket for the given service
 641 */
 642 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 643                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 644                         uint32 extra_ap_opts, const char *ccname,
 645                         time_t *tgs_expire)
 646
 647 {
 648         krb5_error_code retval;
 649         krb5_data packet;
 650         krb5_context context = NULL;
 651         krb5_ccache ccdef = NULL;
 652         krb5_auth_context auth_context = NULL;
 653         krb5_enctype enc_types[] = {
 654 #ifdef ENCTYPE_ARCFOUR_HMAC
 655                 ENCTYPE_ARCFOUR_HMAC,
 656 #endif
 657                 ENCTYPE_DES_CBC_MD5,
 658                 ENCTYPE_DES_CBC_CRC,
 659                 ENCTYPE_NULL};
 660
 661         initialize_krb5_error_table();
 662         retval = krb5_init_context(&context);
 663         if (retval) {
 664                 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
 665                          error_message(retval)));
 666                 goto failed;
 667         }
 668
 669         if (time_offset != 0) {
 670                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 671         }
 672
 673         if ((retval = krb5_cc_resolve(context, ccname ?
 674                         ccname : krb5_cc_default_name(context), &ccdef))) {
 675                 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
 676                          error_message(retval)));
 677                 goto failed;
 678         }
 679
 680         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 681                 DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
 682                          error_message(retval)));
 683                 goto failed;
 684         }
 685
 686         if ((retval = ads_krb5_mk_req(context,
 687                                         &auth_context,
 688                                         AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 689                                         principal,
 690                                         ccdef, &packet,
 691                                         tgs_expire))) {
 692                 goto failed;
 693         }
 694
 695         get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
 696
 697         *ticket = data_blob(packet.data, packet.length);
 698
 699         kerberos_free_data_contents(context, &packet);
 700
 701 failed:
 702
 703         if ( context ) {
 704                 if (ccdef)
 705                         krb5_cc_close(context, ccdef);
 706                 if (auth_context)
 707                         krb5_auth_con_free(context, auth_context);
 708                 krb5_free_context(context);
 709         }
 710
 711         return retval;
 712 }
 713
 714  BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, BOOL remote)
 715  {
 716         krb5_keyblock *skey;
 717         krb5_error_code err;
 718         BOOL ret = False;
 719
 720         if (remote)
 721                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 722         else
 723                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 724         if (err == 0 && skey != NULL) {
 725                 DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
 726                 *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 727                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 728
 729                 ret = True;
 730
 731                 krb5_free_keyblock(context, skey);
 732         } else {
 733                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 734         }
 735
 736         return ret;
 737  }
 738
 739
 740 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 741  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 742
 743  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 744 {
 745         static krb5_data kdata;
 746
 747         kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
 748         kdata.length = strlen((const char *)kdata.data);
 749         return &kdata;
 750 }
 751 #endif
 752
 753  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 754 {
 755 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
 756         return krb5_kt_free_entry(context, kt_entry);
 757 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 758         return krb5_free_keytab_entry_contents(context, kt_entry);
 759 #else
 760 #error UNKNOWN_KT_FREE_FUNCTION
 761 #endif
 762 }
 763
 764  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 765                                     PAC_SIGNATURE_DATA *sig)
 766 {
 767 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 768         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 769         cksum->checksum.length  = sig->signature.buf_len;
 770         cksum->checksum.data    = sig->signature.buffer;
 771 #else
 772         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 773         cksum->length           = sig->signature.buf_len;
 774         cksum->contents         = sig->signature.buffer;
 775 #endif
 776 }
 777
 778  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 779                                          krb5_keyblock *keyblock,
 780                                          krb5_keyusage usage,
 781                                          krb5_checksum *cksum,
 782                                          uint8 *data,
 783                                          size_t length)
 784 {
 785         krb5_error_code ret;
 786
 787         /* verify the checksum */
 788
 789         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 790          *
 791          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 792          * -----------------------------------------------------------------------------
 793          * krb5_c_verify_checksum       -                       works           works
 794          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 795          */
 796
 797 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 798         {
 799                 krb5_boolean checksum_valid = False;
 800                 krb5_data input;
 801
 802                 input.data = (char *)data;
 803                 input.length = length;
 804
 805                 ret = krb5_c_verify_checksum(context,
 806                                              keyblock,
 807                                              usage,
 808                                              &input,
 809                                              cksum,
 810                                              &checksum_valid);
 811                 if (ret) {
 812                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 813                                 error_message(ret)));
 814                         return ret;
 815                 }
 816
 817                 if (!checksum_valid)
 818                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 819         }
 820
 821 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 822
 823         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 824          * without enctype and it ignores any key_usage types - Guenther */
 825
 826         {
 827
 828                 krb5_crypto crypto;
 829                 ret = krb5_crypto_init(context,
 830                                        keyblock,
 831                                        0,
 832                                        &crypto);
 833                 if (ret) {
 834                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 835                                 error_message(ret)));
 836                         return ret;
 837                 }
 838
 839                 ret = krb5_verify_checksum(context,
 840                                            crypto,
 841                                            usage,
 842                                            data,
 843                                            length,
 844                                            cksum);
 845
 846                 krb5_crypto_destroy(context, crypto);
 847         }
 848
 849 #else
 850 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
 851 #endif
 852
 853         return ret;
 854 }
 855
 856  time_t get_authtime_from_tkt(krb5_ticket *tkt)
 857 {
 858 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 859         return tkt->enc_part2->times.authtime;
 860 #else
 861         return tkt->ticket.authtime;
 862 #endif
 863 }
 864
 865 #ifdef HAVE_KRB5_DECODE_AP_REQ  /* Heimdal */
 866 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
 867 {
 868 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
 869         if (ap_req->ticket->enc_part.kvno)
 870                 return ap_req->ticket->enc_part.kvno;
 871 #else /* Heimdal */
 872         if (ap_req->ticket.enc_part.kvno)
 873                 return *ap_req->ticket.enc_part.kvno;
 874 #endif
 875         return 0;
 876 }
 877
 878 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
 879 {
 880 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
 881         return ap_req->ticket.enc_part.etype;
 882 #else /* MIT */
 883         return ap_req->ticket->enc_part.enctype;
 884 #endif
 885 }
 886 #endif  /* HAVE_KRB5_DECODE_AP_REQ */
 887
 888 static krb5_error_code
 889 get_key_from_keytab(krb5_context context,
 890                     krb5_const_principal server,
 891                     krb5_enctype enctype,
 892                     krb5_kvno kvno,
 893                     krb5_keyblock **out_key)
 894 {
 895         krb5_keytab_entry entry;
 896         krb5_error_code ret;
 897         krb5_keytab keytab;
 898         char *name = NULL;
 899
 900         /* We have to open a new keytab handle here, as MIT does
 901            an implicit open/getnext/close on krb5_kt_get_entry. We
 902            may be in the middle of a keytab enumeration when this is
 903            called. JRA. */
 904
 905         ret = krb5_kt_default(context, &keytab);
 906         if (ret) {
 907                 DEBUG(0,("get_key_from_keytab: failed to open keytab: %s\n", error_message(ret)));
 908                 return ret;
 909         }
 910
 911         if ( DEBUGLEVEL >= 10 ) {
 912                 if (smb_krb5_unparse_name(context, server, &name) == 0) {
 913                         DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
 914                                 kvno, enctype, name));
 915                         SAFE_FREE(name);
 916                 }
 917         }
 918
 919         ret = krb5_kt_get_entry(context,
 920                                 keytab,
 921                                 server,
 922                                 kvno,
 923                                 enctype,
 924                                 &entry);
 925
 926         if (ret) {
 927                 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
 928                 goto out;
 929         }
 930
 931 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
 932         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
 933 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
 934         ret = krb5_copy_keyblock(context, &entry.key, out_key);
 935 #else
 936 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
 937 #endif
 938
 939         if (ret) {
 940                 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
 941                 goto out;
 942         }
 943
 944         smb_krb5_kt_free_entry(context, &entry);
 945
 946 out:
 947         krb5_kt_close(context, keytab);
 948         return ret;
 949 }
 950
 951 /* Prototypes */
 952
 953  krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
 954                                                  const krb5_data *inbuf,
 955                                                  krb5_kvno *kvno,
 956                                                  krb5_enctype *enctype)
 957 {
 958 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
 959         {
 960                 krb5_error_code ret;
 961                 krb5_ap_req ap_req;
 962
 963                 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
 964                 if (ret)
 965                         return ret;
 966
 967                 *kvno = get_kvno_from_ap_req(&ap_req);
 968                 *enctype = get_enctype_from_ap_req(&ap_req);
 969
 970                 free_AP_REQ(&ap_req);
 971                 return 0;
 972         }
 973 #endif
 974
 975         /* Possibly not an appropriate error code. */
 976         return KRB5KDC_ERR_BADOPTION;
 977 }
 978
 979  krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
 980                                                         krb5_auth_context *auth_context,
 981                                                         const krb5_data *inbuf,
 982                                                         krb5_const_principal server,
 983                                                         krb5_keytab keytab,
 984                                                         krb5_flags *ap_req_options,
 985                                                         krb5_ticket **ticket,
 986                                                         krb5_keyblock **keyblock)
 987 {
 988         krb5_error_code ret;
 989         krb5_kvno kvno;
 990         krb5_enctype enctype;
 991         krb5_keyblock *local_keyblock;
 992
 993         ret = krb5_rd_req(context,
 994                           auth_context,
 995                           inbuf,
 996                           server,
 997                           keytab,
 998                           ap_req_options,
 999                           ticket);
1000         if (ret) {
1001                 return ret;
1002         }
1003
1004 #ifdef KRB5_TICKET_HAS_KEYINFO
1005         enctype = (*ticket)->enc_part.enctype;
1006         kvno = (*ticket)->enc_part.kvno;
1007 #else
1008         ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
1009         if (ret) {
1010                 return ret;
1011         }
1012 #endif
1013
1014         ret = get_key_from_keytab(context,
1015                                   server,
1016                                   enctype,
1017                                   kvno,
1018                                   &local_keyblock);
1019         if (ret) {
1020                 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
1021                 goto out;
1022         }
1023
1024 out:
1025         if (ret && local_keyblock != NULL) {
1026                 krb5_free_keyblock(context, local_keyblock);
1027         } else {
1028                 *keyblock = local_keyblock;
1029         }
1030
1031         return ret;
1032 }
1033
1034  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
1035                                             const char *name,
1036                                             krb5_principal *principal)
1037 {
1038 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
1039         return smb_krb5_parse_name_norealm_conv(context, name, principal);
1040 #endif
1041
1042         /* we are cheating here because parse_name will in fact set the realm.
1043          * We don't care as the only caller of smb_krb5_parse_name_norealm
1044          * ignores the realm anyway when calling
1045          * smb_krb5_principal_compare_any_realm later - Guenther */
1046
1047         return smb_krb5_parse_name(context, name, principal);
1048 }
1049
1050  BOOL smb_krb5_principal_compare_any_realm(krb5_context context,
1051                                           krb5_const_principal princ1,
1052                                           krb5_const_principal princ2)
1053 {
1054 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1055
1056         return krb5_principal_compare_any_realm(context, princ1, princ2);
1057
1058 /* krb5_princ_size is a macro in MIT */
1059 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
1060
1061         int i, len1, len2;
1062         const krb5_data *p1, *p2;
1063
1064         len1 = krb5_princ_size(context, princ1);
1065         len2 = krb5_princ_size(context, princ2);
1066
1067         if (len1 != len2)
1068                 return False;
1069
1070         for (i = 0; i < len1; i++) {
1071
1072                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1073                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1074
1075                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
1076                         return False;
1077         }
1078
1079         return True;
1080 #else
1081 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1082 #endif
1083 }
1084
1085  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
1086                                        const char *client_string,       /* gd@BER.SUSE.DE */
1087                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1088                                        time_t *new_start_time)
1089 {
1090         krb5_error_code ret;
1091         krb5_context context = NULL;
1092         krb5_ccache ccache = NULL;
1093         krb5_principal client = NULL;
1094
1095         initialize_krb5_error_table();
1096         ret = krb5_init_context(&context);
1097         if (ret) {
1098                 goto done;
1099         }
1100
1101         if (!ccache_string) {
1102                 ccache_string = krb5_cc_default_name(context);
1103         }
1104
1105         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1106
1107         /* FIXME: we should not fall back to defaults */
1108         ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1109         if (ret) {
1110                 goto done;
1111         }
1112
1113 #ifdef HAVE_KRB5_GET_RENEWED_CREDS      /* MIT */
1114         {
1115                 krb5_creds creds;
1116
1117                 if (client_string) {
1118                         ret = smb_krb5_parse_name(context, client_string, &client);
1119                         if (ret) {
1120                                 goto done;
1121                         }
1122                 } else {
1123                         ret = krb5_cc_get_principal(context, ccache, &client);
1124                         if (ret) {
1125                                 goto done;
1126                         }
1127                 }
1128
1129                 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1130                 if (ret) {
1131                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1132                         goto done;
1133                 }
1134
1135                 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1136                 ret = krb5_cc_initialize(context, ccache, client);
1137                 if (ret) {
1138                         goto done;
1139                 }
1140
1141                 ret = krb5_cc_store_cred(context, ccache, &creds);
1142
1143                 if (new_start_time) {
1144                         *new_start_time = (time_t) creds.times.renew_till;
1145                 }
1146
1147                 krb5_free_cred_contents(context, &creds);
1148         }
1149 #elif defined(HAVE_KRB5_GET_KDC_CRED)   /* Heimdal */
1150         {
1151                 krb5_kdc_flags flags;
1152                 krb5_creds creds_in;
1153                 krb5_realm *client_realm;
1154                 krb5_creds *creds;
1155
1156                 memset(&creds_in, 0, sizeof(creds_in));
1157
1158                 if (client_string) {
1159                         ret = smb_krb5_parse_name(context, client_string, &creds_in.client);
1160                         if (ret) {
1161                                 goto done;
1162                         }
1163                 } else {
1164                         ret = krb5_cc_get_principal(context, ccache, &creds_in.client);
1165                         if (ret) {
1166                                 goto done;
1167                         }
1168                 }
1169
1170                 if (service_string) {
1171                         ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1172                         if (ret) {
1173                                 goto done;
1174                         }
1175                 } else {
1176                         /* build tgt service by default */
1177                         client_realm = krb5_princ_realm(context, client);
1178                         ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1179                         if (ret) {
1180                                 goto done;
1181                         }
1182                 }
1183
1184                 flags.i = 0;
1185                 flags.b.renewable = flags.b.renew = True;
1186
1187                 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds);
1188                 if (ret) {
1189                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1190                         goto done;
1191                 }
1192
1193                 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1194                 ret = krb5_cc_initialize(context, ccache, creds_in.client);
1195                 if (ret) {
1196                         goto done;
1197                 }
1198
1199                 ret = krb5_cc_store_cred(context, ccache, creds);
1200
1201                 if (new_start_time) {
1202                         *new_start_time = (time_t) creds->times.renew_till;
1203                 }
1204
1205                 krb5_free_cred_contents(context, &creds_in);
1206                 krb5_free_creds(context, creds);
1207         }
1208 #else
1209 #error No suitable krb5 ticket renew function available
1210 #endif
1211
1212
1213 done:
1214         if (client) {
1215                 krb5_free_principal(context, client);
1216         }
1217         if (context) {
1218                 krb5_free_context(context);
1219         }
1220         if (ccache) {
1221                 krb5_cc_close(context, ccache);
1222         }
1223
1224         return ret;
1225
1226 }
1227
1228  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1229 {
1230         krb5_error_code ret = 0;
1231         if (addr == NULL) {
1232                 return ret;
1233         }
1234 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1235         krb5_free_addresses(context, addr->addrs);
1236 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1237         ret = krb5_free_addresses(context, addr->addrs);
1238         SAFE_FREE(addr->addrs);
1239 #endif
1240         SAFE_FREE(addr);
1241         addr = NULL;
1242         return ret;
1243 }
1244
1245  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1246 {
1247         krb5_error_code ret = 0;
1248         nstring buf;
1249 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1250         krb5_address **addrs = NULL;
1251 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1252         krb5_addresses *addrs = NULL;
1253 #endif
1254
1255         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
1256         if (*kerb_addr == NULL) {
1257                 return ENOMEM;
1258         }
1259
1260         put_name(buf, global_myname(), ' ', 0x20);
1261
1262 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1263         {
1264                 int num_addr = 2;
1265
1266                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
1267                 if (addrs == NULL) {
1268                         SAFE_FREE(kerb_addr);
1269                         return ENOMEM;
1270                 }
1271
1272                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
1273
1274                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1275                 if (addrs[0] == NULL) {
1276                         SAFE_FREE(addrs);
1277                         SAFE_FREE(kerb_addr);
1278                         return ENOMEM;
1279                 }
1280
1281                 addrs[0]->magic = KV5M_ADDRESS;
1282                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1283                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
1284                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1285                 if (addrs[0]->contents == NULL) {
1286                         SAFE_FREE(addrs[0]);
1287                         SAFE_FREE(addrs);
1288                         SAFE_FREE(kerb_addr);
1289                         return ENOMEM;
1290                 }
1291
1292                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
1293
1294                 addrs[1] = NULL;
1295         }
1296 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1297         {
1298                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1299                 if (addrs == NULL) {
1300                         SAFE_FREE(kerb_addr);
1301                         return ENOMEM;
1302                 }
1303
1304                 memset(addrs, 0, sizeof(krb5_addresses));
1305
1306                 addrs->len = 1;
1307                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1308                 if (addrs->val == NULL) {
1309                         SAFE_FREE(addrs);
1310                         SAFE_FREE(kerb_addr);
1311                         return ENOMEM;
1312                 }
1313
1314                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1315                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1316                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1317                 if (addrs->val[0].address.data == NULL) {
1318                         SAFE_FREE(addrs->val);
1319                         SAFE_FREE(addrs);
1320                         SAFE_FREE(kerb_addr);
1321                         return ENOMEM;
1322                 }
1323
1324                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1325         }
1326 #else
1327 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1328 #endif
1329         (*kerb_addr)->addrs = addrs;
1330
1331         return ret;
1332 }
1333
1334  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1335 {
1336 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1337         krb5_free_error_contents(context, krberror);
1338 #else /* MIT */
1339         krb5_free_error(context, krberror);
1340 #endif
1341 }
1342
1343  krb5_error_code handle_krberror_packet(krb5_context context,
1344                                         krb5_data *packet)
1345 {
1346         krb5_error_code ret;
1347         BOOL got_error_code = False;
1348
1349         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1350
1351 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1352         {
1353                 krb5_error krberror;
1354
1355                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1356                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1357                                 error_message(ret)));
1358                         return ret;
1359                 }
1360
1361                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1362                         ret = (krb5_error_code) krberror.error_code;
1363                         got_error_code = True;
1364                 }
1365
1366                 smb_krb5_free_error(context, &krberror);
1367         }
1368 #else /* MIT */
1369         {
1370                 krb5_error *krberror;
1371
1372                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1373                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1374                                 error_message(ret)));
1375                         return ret;
1376                 }
1377
1378                 if (krberror->e_data.data == NULL) {
1379                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1380                         got_error_code = True;
1381                 }
1382                 smb_krb5_free_error(context, krberror);
1383         }
1384 #endif
1385         if (got_error_code) {
1386                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1387                         error_message(ret), ret));
1388         }
1389         return ret;
1390 }
1391
1392 #ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
1393  krb5_error_code krb5_get_init_creds_opt_alloc(krb5_context context, krb5_get_init_creds_opt **opt)
1394 {
1395         krb5_get_init_creds_opt *my_opt;
1396
1397         *opt = NULL;
1398
1399         if ((my_opt = SMB_MALLOC(sizeof(krb5_get_init_creds_opt))) == NULL) {
1400                 return ENOMEM;
1401         }
1402
1403         krb5_get_init_creds_opt_init(my_opt);
1404
1405         *opt =  my_opt;
1406         return 0;
1407 }
1408 #endif
1409
1410 #ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
1411  void krb5_get_init_creds_opt_free(krb5_get_init_creds_opt *opt)
1412 {
1413         SAFE_FREE(opt);
1414         opt = NULL;
1415 }
1416 #endif
1417
1418 #else /* HAVE_KRB5 */
1419  /* this saves a few linking headaches */
1420  int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1421                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1422                         const char *ccname, time_t *tgs_expire)
1423 {
1424          DEBUG(0,("NO KERBEROS SUPPORT\n"));
1425          return 1;
1426 }
1427
1428 #endif