source/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  25 #define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
  26
  27 #include "includes.h"
  28
  29 #ifdef HAVE_KRB5
  30
  31 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
  32 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  33 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  34 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  35 #else
  36 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  37 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  38 #define KRB5_KEY_DATA(k)        ((k)->contents)
  39 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  40
  41 #ifndef HAVE_KRB5_SET_REAL_TIME
  42 /*
  43  * This function is not in the Heimdal mainline.
  44  */
  45  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
  46 {
  47         krb5_error_code ret;
  48         int32_t sec, usec;
  49
  50         ret = krb5_us_timeofday(context, &sec, &usec);
  51         if (ret)
  52                 return ret;
  53
  54         context->kdc_sec_offset = seconds - sec;
  55         context->kdc_usec_offset = microseconds - usec;
  56
  57         return 0;
  58 }
  59 #endif
  60
  61 #if defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES) && !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
  62  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
  63 {
  64         return krb5_set_default_in_tkt_etypes(ctx, enc);
  65 }
  66 #endif
  67
  68 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
  69 /* HEIMDAL */
  70  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
  71 {
  72         pkaddr->addr_type = KRB5_ADDRESS_INET;
  73         pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
  74         pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
  75 }
  76 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
  77 /* MIT */
  78  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
  79 {
  80         pkaddr->addrtype = ADDRTYPE_INET;
  81         pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
  82         pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
  83 }
  84 #else
  85 #error UNKNOWN_ADDRTYPE
  86 #endif
  87
  88 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
  89  int create_kerberos_key_from_string_direct(krb5_context context,
  90                                         krb5_principal host_princ,
  91                                         krb5_data *password,
  92                                         krb5_keyblock *key,
  93                                         krb5_enctype enctype)
  94 {
  95         int ret;
  96         krb5_data salt;
  97         krb5_encrypt_block eblock;
  98
  99         ret = krb5_principal2salt(context, host_princ, &salt);
 100         if (ret) {
 101                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 102                 return ret;
 103         }
 104         krb5_use_enctype(context, &eblock, enctype);
 105         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
 106         SAFE_FREE(salt.data);
 107         return ret;
 108 }
 109 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 110  int create_kerberos_key_from_string_direct(krb5_context context,
 111                                         krb5_principal host_princ,
 112                                         krb5_data *password,
 113                                         krb5_keyblock *key,
 114                                         krb5_enctype enctype)
 115 {
 116         int ret;
 117         krb5_salt salt;
 118
 119         ret = krb5_get_pw_salt(context, host_princ, &salt);
 120         if (ret) {
 121                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 122                 return ret;
 123         }
 124
 125         ret = krb5_string_to_key_salt(context, enctype, password->data, salt, key);
 126         krb5_free_salt(context, salt);
 127         return ret;
 128 }
 129 #else
 130 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 131 #endif
 132
 133  int create_kerberos_key_from_string(krb5_context context,
 134                                         krb5_principal host_princ,
 135                                         krb5_data *password,
 136                                         krb5_keyblock *key,
 137                                         krb5_enctype enctype)
 138 {
 139         krb5_principal salt_princ = NULL;
 140         int ret;
 141         /*
 142          * Check if we've determined that the KDC is salting keys for this
 143          * principal/enctype in a non-obvious way.  If it is, try to match
 144          * its behavior.
 145          */
 146         salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
 147         ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
 148         if (salt_princ) {
 149                 krb5_free_principal(context, salt_princ);
 150         }
 151         return ret;
 152 }
 153
 154 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 155  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 156                                             krb5_enctype **enctypes)
 157 {
 158         return krb5_get_permitted_enctypes(context, enctypes);
 159 }
 160 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 161  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 162                                             krb5_enctype **enctypes)
 163 {
 164         return krb5_get_default_in_tkt_etypes(context, enctypes);
 165 }
 166 #else
 167 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 168 #endif
 169
 170  void free_kerberos_etypes(krb5_context context,
 171                            krb5_enctype *enctypes)
 172 {
 173 #if defined(HAVE_KRB5_FREE_KTYPES)
 174         krb5_free_ktypes(context, enctypes);
 175         return;
 176 #else
 177         SAFE_FREE(enctypes);
 178         return;
 179 #endif
 180 }
 181
 182 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 183  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 184                                         krb5_auth_context auth_context,
 185                                         krb5_keyblock *keyblock)
 186 {
 187         return krb5_auth_con_setkey(context, auth_context, keyblock);
 188 }
 189 #endif
 190
 191 BOOL unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 192 {
 193         DATA_BLOB pac_contents;
 194         ASN1_DATA data;
 195         int data_type;
 196
 197         if (!auth_data->length) {
 198                 return False;
 199         }
 200
 201         asn1_load(&data, *auth_data);
 202         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 203         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 204         asn1_start_tag(&data, ASN1_CONTEXT(0));
 205         asn1_read_Integer(&data, &data_type);
 206
 207         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 208                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 209                 asn1_free(&data);
 210                 return False;
 211         }
 212
 213         asn1_end_tag(&data);
 214         asn1_start_tag(&data, ASN1_CONTEXT(1));
 215         asn1_read_OctetString(&data, &pac_contents);
 216         asn1_end_tag(&data);
 217         asn1_end_tag(&data);
 218         asn1_end_tag(&data);
 219         asn1_free(&data);
 220
 221         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 222
 223         data_blob_free(&pac_contents);
 224
 225         return True;
 226 }
 227
 228  BOOL get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 229 {
 230         DATA_BLOB auth_data_wrapped;
 231         BOOL got_auth_data_pac = False;
 232         int i;
 233
 234 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 235         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 236             tkt->enc_part2->authorization_data[0] &&
 237             tkt->enc_part2->authorization_data[0]->length)
 238         {
 239                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 240
 241                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 242                             KRB5_AUTHDATA_IF_RELEVANT) {
 243                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 244                                         tkt->enc_part2->authorization_data[i]->ad_type));
 245                                 continue;
 246                         }
 247
 248                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 249                                                       tkt->enc_part2->authorization_data[i]->length);
 250
 251                         /* check if it is a PAC */
 252                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 253                         data_blob_free(&auth_data_wrapped);
 254
 255                         if (!got_auth_data_pac) {
 256                                 continue;
 257                         }
 258                 }
 259
 260                 return got_auth_data_pac;
 261         }
 262
 263 #else
 264         if (tkt->ticket.authorization_data &&
 265             tkt->ticket.authorization_data->len)
 266         {
 267                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 268
 269                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 270                             KRB5_AUTHDATA_IF_RELEVANT) {
 271                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 272                                         tkt->ticket.authorization_data->val[i].ad_type));
 273                                 continue;
 274                         }
 275
 276                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 277                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 278
 279                         /* check if it is a PAC */
 280                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 281                         data_blob_free(&auth_data_wrapped);
 282
 283                         if (!got_auth_data_pac) {
 284                                 continue;
 285                         }
 286                 }
 287
 288                 return got_auth_data_pac;
 289         }
 290 #endif
 291         return False;
 292 }
 293
 294  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 295 {
 296 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 297         return tkt->enc_part2->client;
 298 #else
 299         return tkt->client;
 300 #endif
 301 }
 302
 303 #if !defined(HAVE_KRB5_LOCATE_KDC)
 304  krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 305 {
 306         krb5_krbhst_handle hnd;
 307         krb5_krbhst_info *hinfo;
 308         krb5_error_code rc;
 309         int num_kdcs, i;
 310         struct sockaddr *sa;
 311         struct addrinfo *ai;
 312
 313         *addr_pp = NULL;
 314         *naddrs = 0;
 315
 316         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 317         if (rc) {
 318                 DEBUG(0, ("krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 319                 return rc;
 320         }
 321
 322         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 323                 ;
 324
 325         krb5_krbhst_reset(ctx, hnd);
 326
 327         if (!num_kdcs) {
 328                 DEBUG(0, ("krb5_locate_kdc: zero kdcs found !\n"));
 329                 krb5_krbhst_free(ctx, hnd);
 330                 return -1;
 331         }
 332
 333         sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
 334         if (!sa) {
 335                 DEBUG(0, ("krb5_locate_kdc: malloc failed\n"));
 336                 krb5_krbhst_free(ctx, hnd);
 337                 naddrs = 0;
 338                 return -1;
 339         }
 340
 341         memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
 342
 343         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 344
 345 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
 346                 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
 347                 if (rc) {
 348                         DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
 349                         continue;
 350                 }
 351 #endif
 352                 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
 353                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 354         }
 355
 356         krb5_krbhst_free(ctx, hnd);
 357
 358         *naddrs = num_kdcs;
 359         *addr_pp = sa;
 360         return 0;
 361 }
 362 #endif
 363
 364 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 365  void krb5_free_unparsed_name(krb5_context context, char *val)
 366 {
 367         SAFE_FREE(val);
 368 }
 369 #endif
 370
 371  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 372 {
 373 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 374         if (pdata->data) {
 375                 krb5_free_data_contents(context, pdata);
 376         }
 377 #else
 378         SAFE_FREE(pdata->data);
 379 #endif
 380 }
 381
 382  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 383 {
 384 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 385         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 386 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 387         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 388 #else
 389 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 390 #endif
 391 }
 392
 393  BOOL kerberos_compatible_enctypes(krb5_context context,
 394                                   krb5_enctype enctype1,
 395                                   krb5_enctype enctype2)
 396 {
 397 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 398         krb5_boolean similar = 0;
 399
 400         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 401         return similar ? True : False;
 402 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 403         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 404 #endif
 405 }
 406
 407 static BOOL ads_cleanup_expired_creds(krb5_context context,
 408                                       krb5_ccache  ccache,
 409                                       krb5_creds  *credsp)
 410 {
 411         krb5_error_code retval;
 412         const char *cc_type = krb5_cc_get_type(context, ccache);
 413
 414         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 415                   cc_type, krb5_cc_get_name(context, ccache),
 416                   http_timestring(credsp->times.endtime)));
 417
 418         /* we will probably need new tickets if the current ones
 419            will expire within 10 seconds.
 420         */
 421         if (credsp->times.endtime >= (time(NULL) + 10))
 422                 return False;
 423
 424         /* heimdal won't remove creds from a file ccache, and
 425            perhaps we shouldn't anyway, since internally we
 426            use memory ccaches, and a FILE one probably means that
 427            we're using creds obtained outside of our exectuable
 428         */
 429         if (strequal(cc_type, "KCM") || strequal(cc_type, "FILE")) {
 430                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 431                 return False;
 432         }
 433
 434         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 435         if (retval) {
 436                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 437                           error_message(retval)));
 438                 /* If we have an error in this, we want to display it,
 439                    but continue as though we deleted it */
 440         }
 441         return True;
 442 }
 443
 444 /*
 445   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 446 */
 447 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 448                                        krb5_auth_context *auth_context,
 449                                        const krb5_flags ap_req_options,
 450                                        const char *principal,
 451                                        krb5_ccache ccache,
 452                                        krb5_data *outbuf)
 453 {
 454         krb5_error_code           retval;
 455         krb5_principal    server;
 456         krb5_creds              * credsp;
 457         krb5_creds                creds;
 458         krb5_data in_data;
 459         BOOL creds_ready = False;
 460         int i = 0, maxtries = 3;
 461
 462         retval = krb5_parse_name(context, principal, &server);
 463         if (retval) {
 464                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 465                 return retval;
 466         }
 467
 468         /* obtain ticket & session key */
 469         ZERO_STRUCT(creds);
 470         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 471                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 472                          error_message(retval)));
 473                 goto cleanup_princ;
 474         }
 475
 476         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 477                 /* This can commonly fail on smbd startup with no ticket in the cache.
 478                  * Report at higher level than 1. */
 479                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 480                          error_message(retval)));
 481                 goto cleanup_creds;
 482         }
 483
 484         while (!creds_ready && (i < maxtries)) {
 485                 if ((retval = krb5_get_credentials(context, 0, ccache,
 486                                                    &creds, &credsp))) {
 487                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 488                                  principal, error_message(retval)));
 489                         goto cleanup_creds;
 490                 }
 491
 492                 /* cope with ticket being in the future due to clock skew */
 493                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 494                         time_t t = time(NULL);
 495                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 496                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 497                         krb5_set_real_time(context, t + time_offset + 1, 0);
 498                 }
 499
 500                 if (!ads_cleanup_expired_creds(context, ccache, credsp))
 501                         creds_ready = True;
 502
 503                 i++;
 504         }
 505
 506         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 507                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 508                   http_timestring((unsigned)credsp->times.endtime),
 509                   (unsigned)credsp->times.endtime));
 510
 511         in_data.length = 0;
 512         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 513                                       &in_data, credsp, outbuf);
 514         if (retval) {
 515                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 516                          error_message(retval)));
 517         }
 518
 519         krb5_free_creds(context, credsp);
 520
 521 cleanup_creds:
 522         krb5_free_cred_contents(context, &creds);
 523
 524 cleanup_princ:
 525         krb5_free_principal(context, server);
 526
 527         return retval;
 528 }
 529
 530 /*
 531   get a kerberos5 ticket for the given service
 532 */
 533 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 534                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 535                         uint32 extra_ap_opts, const char *ccname)
 536 {
 537         krb5_error_code retval;
 538         krb5_data packet;
 539         krb5_context context = NULL;
 540         krb5_ccache ccdef = NULL;
 541         krb5_auth_context auth_context = NULL;
 542         krb5_enctype enc_types[] = {
 543 #ifdef ENCTYPE_ARCFOUR_HMAC
 544                 ENCTYPE_ARCFOUR_HMAC,
 545 #endif
 546                 ENCTYPE_DES_CBC_MD5,
 547                 ENCTYPE_DES_CBC_CRC,
 548                 ENCTYPE_NULL};
 549
 550         initialize_krb5_error_table();
 551         retval = krb5_init_context(&context);
 552         if (retval) {
 553                 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
 554                          error_message(retval)));
 555                 goto failed;
 556         }
 557
 558         if (time_offset != 0) {
 559                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 560         }
 561
 562         if ((retval = krb5_cc_resolve(context, ccname ?
 563                         ccname : krb5_cc_default_name(context), &ccdef))) {
 564                 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
 565                          error_message(retval)));
 566                 goto failed;
 567         }
 568
 569         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 570                 DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
 571                          error_message(retval)));
 572                 goto failed;
 573         }
 574
 575         if ((retval = ads_krb5_mk_req(context,
 576                                         &auth_context,
 577                                         AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 578                                         principal,
 579                                         ccdef, &packet))) {
 580                 goto failed;
 581         }
 582
 583         get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
 584
 585         *ticket = data_blob(packet.data, packet.length);
 586
 587         kerberos_free_data_contents(context, &packet);
 588
 589 failed:
 590
 591         if ( context ) {
 592                 if (ccdef)
 593                         krb5_cc_close(context, ccdef);
 594                 if (auth_context)
 595                         krb5_auth_con_free(context, auth_context);
 596                 krb5_free_context(context);
 597         }
 598
 599         return retval;
 600 }
 601
 602  BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, BOOL remote)
 603  {
 604         krb5_keyblock *skey;
 605         krb5_error_code err;
 606         BOOL ret = False;
 607
 608         if (remote)
 609                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 610         else
 611                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 612         if (err == 0 && skey != NULL) {
 613                 DEBUG(10, ("Got KRB5 session key of length %d\n",  KRB5_KEY_LENGTH(skey)));
 614                 *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 615                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 616
 617                 ret = True;
 618
 619                 krb5_free_keyblock(context, skey);
 620         } else {
 621                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 622         }
 623
 624         return ret;
 625  }
 626
 627
 628 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 629  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 630
 631  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 632 {
 633         static krb5_data kdata;
 634
 635         kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
 636         kdata.length = strlen(kdata.data);
 637         return &kdata;
 638 }
 639 #endif
 640
 641  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 642 {
 643 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
 644         return krb5_kt_free_entry(context, kt_entry);
 645 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 646         return krb5_free_keytab_entry_contents(context, kt_entry);
 647 #else
 648 #error UNKNOWN_KT_FREE_FUNCTION
 649 #endif
 650 }
 651
 652  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 653                                     PAC_SIGNATURE_DATA *sig)
 654 {
 655 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 656         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 657         cksum->checksum.length  = sig->signature.buf_len;
 658         cksum->checksum.data    = sig->signature.buffer;
 659 #else
 660         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 661         cksum->length           = sig->signature.buf_len;
 662         cksum->contents         = sig->signature.buffer;
 663 #endif
 664 }
 665
 666  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 667                                          krb5_keyblock *keyblock,
 668                                          krb5_keyusage usage,
 669                                          krb5_checksum *cksum,
 670                                          uint8 *data,
 671                                          size_t length)
 672 {
 673         krb5_error_code ret;
 674
 675         /* verify the checksum */
 676
 677         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 678          *
 679          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 680          * -----------------------------------------------------------------------------
 681          * krb5_c_verify_checksum       -                       works           works
 682          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 683          */
 684
 685 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 686         {
 687                 krb5_boolean checksum_valid = False;
 688                 krb5_data input;
 689
 690                 input.data = (char *)data;
 691                 input.length = length;
 692
 693                 ret = krb5_c_verify_checksum(context,
 694                                              keyblock,
 695                                              usage,
 696                                              &input,
 697                                              cksum,
 698                                              &checksum_valid);
 699                 if (ret) {
 700                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 701                                 error_message(ret)));
 702                         return ret;
 703                 }
 704
 705                 if (!checksum_valid)
 706                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 707         }
 708
 709 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 710
 711         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 712          * without enctype and it ignores any key_usage types - Guenther */
 713
 714         {
 715
 716                 krb5_crypto crypto;
 717                 ret = krb5_crypto_init(context,
 718                                        keyblock,
 719                                        0,
 720                                        &crypto);
 721                 if (ret) {
 722                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 723                                 error_message(ret)));
 724                         return ret;
 725                 }
 726
 727                 ret = krb5_verify_checksum(context,
 728                                            crypto,
 729                                            usage,
 730                                            data,
 731                                            length,
 732                                            cksum);
 733
 734                 krb5_crypto_destroy(context, crypto);
 735         }
 736
 737 #else
 738 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
 739 #endif
 740
 741         return ret;
 742 }
 743
 744  time_t get_authtime_from_tkt(krb5_ticket *tkt)
 745 {
 746 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 747         return tkt->enc_part2->times.authtime;
 748 #else
 749         return tkt->ticket.authtime;
 750 #endif
 751 }
 752
 753 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
 754 {
 755 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
 756         if (ap_req->ticket->enc_part.kvno)
 757                 return ap_req->ticket->enc_part.kvno;
 758 #else /* Heimdal */
 759         if (ap_req->ticket.enc_part.kvno)
 760                 return *ap_req->ticket.enc_part.kvno;
 761 #endif
 762         return 0;
 763 }
 764
 765 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
 766 {
 767 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
 768         return ap_req->ticket.enc_part.etype;
 769 #else /* MIT */
 770         return ap_req->ticket->enc_part.enctype;
 771 #endif
 772 }
 773
 774 static krb5_error_code
 775 get_key_from_keytab(krb5_context context,
 776                     krb5_const_principal server,
 777                     krb5_enctype enctype,
 778                     krb5_kvno kvno,
 779                     krb5_keyblock **out_key)
 780 {
 781         krb5_keytab_entry entry;
 782         krb5_error_code ret;
 783         krb5_keytab keytab;
 784         char *name = NULL;
 785
 786         /* We have to open a new keytab handle here, as MIT does
 787            an implicit open/getnext/close on krb5_kt_get_entry. We
 788            may be in the middle of a keytab enumeration when this is
 789            called. JRA. */
 790
 791         ret = krb5_kt_default(context, &keytab);
 792         if (ret) {
 793                 DEBUG(0,("get_key_from_keytab: failed to open keytab: %s\n", error_message(ret)));
 794                 return ret;
 795         }
 796
 797         if ( DEBUGLEVEL >= 10 ) {
 798                 krb5_unparse_name(context, server, &name);
 799                 DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
 800                         kvno, enctype, name));
 801                 krb5_free_unparsed_name(context, name);
 802         }
 803
 804         ret = krb5_kt_get_entry(context,
 805                                 keytab,
 806                                 server,
 807                                 kvno,
 808                                 enctype,
 809                                 &entry);
 810
 811         if (ret) {
 812                 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
 813                 goto out;
 814         }
 815
 816 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
 817         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
 818 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
 819         ret = krb5_copy_keyblock(context, &entry.key, out_key);
 820 #else
 821 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
 822 #endif
 823
 824         if (ret) {
 825                 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
 826                 goto out;
 827         }
 828
 829         smb_krb5_kt_free_entry(context, &entry);
 830
 831 out:
 832         krb5_kt_close(context, keytab);
 833         return ret;
 834 }
 835
 836  void smb_krb5_free_ap_req(krb5_context context,
 837                           krb5_ap_req *ap_req)
 838 {
 839 #ifdef HAVE_KRB5_FREE_AP_REQ /* MIT */
 840         krb5_free_ap_req(context, ap_req);
 841 #elif defined(HAVE_FREE_AP_REQ) /* Heimdal */
 842         free_AP_REQ(ap_req);
 843 #else
 844 #error UNKNOWN_KRB5_AP_REQ_FREE_FUNCTION
 845 #endif
 846 }
 847
 848 /* Prototypes */
 849 #if defined(HAVE_DECODE_KRB5_AP_REQ) /* MIT */
 850 krb5_error_code decode_krb5_ap_req(const krb5_data *code, krb5_ap_req **rep);
 851 #endif
 852
 853  krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
 854                                                  const krb5_data *inbuf,
 855                                                  krb5_kvno *kvno,
 856                                                  krb5_enctype *enctype)
 857 {
 858         krb5_error_code ret;
 859 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
 860         {
 861                 krb5_ap_req ap_req;
 862
 863                 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
 864                 if (ret)
 865                         return ret;
 866
 867                 *kvno = get_kvno_from_ap_req(&ap_req);
 868                 *enctype = get_enctype_from_ap_req(&ap_req);
 869
 870                 smb_krb5_free_ap_req(context, &ap_req);
 871         }
 872 #elif defined(HAVE_DECODE_KRB5_AP_REQ) /* MIT */
 873         {
 874                 krb5_ap_req *ap_req = NULL;
 875
 876                 ret = decode_krb5_ap_req(inbuf, &ap_req);
 877                 if (ret)
 878                         return ret;
 879
 880                 *kvno = get_kvno_from_ap_req(ap_req);
 881                 *enctype = get_enctype_from_ap_req(ap_req);
 882
 883                 smb_krb5_free_ap_req(context, ap_req);
 884         }
 885 #else
 886 #error UNKOWN_KRB5_AP_REQ_DECODING_FUNCTION
 887 #endif
 888         return ret;
 889 }
 890
 891  krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
 892                                                         krb5_auth_context *auth_context,
 893                                                         const krb5_data *inbuf,
 894                                                         krb5_const_principal server,
 895                                                         krb5_keytab keytab,
 896                                                         krb5_flags *ap_req_options,
 897                                                         krb5_ticket **ticket,
 898                                                         krb5_keyblock **keyblock)
 899 {
 900         krb5_error_code ret;
 901         krb5_ap_req *ap_req = NULL;
 902         krb5_kvno kvno;
 903         krb5_enctype enctype;
 904         krb5_keyblock *local_keyblock;
 905
 906         ret = krb5_rd_req(context,
 907                           auth_context,
 908                           inbuf,
 909                           server,
 910                           keytab,
 911                           ap_req_options,
 912                           ticket);
 913         if (ret) {
 914                 return ret;
 915         }
 916
 917         ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
 918         if (ret) {
 919                 return ret;
 920         }
 921
 922         ret = get_key_from_keytab(context,
 923                                   server,
 924                                   enctype,
 925                                   kvno,
 926                                   &local_keyblock);
 927         if (ret) {
 928                 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
 929                 goto out;
 930         }
 931
 932 out:
 933         if (ap_req) {
 934                 smb_krb5_free_ap_req(context, ap_req);
 935         }
 936
 937         if (ret && local_keyblock != NULL) {
 938                 krb5_free_keyblock(context, local_keyblock);
 939         } else {
 940                 *keyblock = local_keyblock;
 941         }
 942
 943         return ret;
 944 }
 945
 946  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
 947                                             const char *name,
 948                                             krb5_principal *principal)
 949 {
 950 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
 951         return krb5_parse_name_norealm(context, name, principal);
 952 #endif
 953
 954         /* we are cheating here because parse_name will in fact set the realm.
 955          * We don't care as the only caller of smb_krb5_parse_name_norealm
 956          * ignores the realm anyway when calling
 957          * smb_krb5_principal_compare_any_realm later - Guenther */
 958
 959         return krb5_parse_name(context, name, principal);
 960 }
 961
 962  BOOL smb_krb5_principal_compare_any_realm(krb5_context context,
 963                                           krb5_const_principal princ1,
 964                                           krb5_const_principal princ2)
 965 {
 966 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
 967
 968         return krb5_principal_compare_any_realm(context, princ1, princ2);
 969
 970 /* krb5_princ_size is a macro in MIT */
 971 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
 972
 973         int i, len1, len2;
 974         const krb5_data *p1, *p2;
 975
 976         len1 = krb5_princ_size(context, princ1);
 977         len2 = krb5_princ_size(context, princ2);
 978
 979         if (len1 != len2)
 980                 return False;
 981
 982         for (i = 0; i < len1; i++) {
 983
 984                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
 985                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
 986
 987                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
 988                         return False;
 989         }
 990
 991         return True;
 992 #else
 993 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
 994 #endif
 995 }
 996
 997  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
 998                                        const char *client_string,       /* gd@BER.SUSE.DE */
 999                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1000                                        time_t *new_start_time)
1001 {
1002         krb5_error_code ret;
1003         krb5_context context = NULL;
1004         krb5_ccache ccache = NULL;
1005         krb5_principal client = NULL;
1006
1007         initialize_krb5_error_table();
1008         ret = krb5_init_context(&context);
1009         if (ret) {
1010                 goto done;
1011         }
1012
1013         if (!ccache_string) {
1014                 ccache_string = krb5_cc_default_name(context);
1015         }
1016
1017         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1018
1019         /* FIXME: we should not fall back to defaults */
1020         ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1021         if (ret) {
1022                 goto done;
1023         }
1024
1025 #ifdef HAVE_KRB5_GET_RENEWED_CREDS      /* MIT */
1026         {
1027                 krb5_creds creds;
1028
1029                 if (client_string) {
1030                         ret = krb5_parse_name(context, client_string, &client);
1031                         if (ret) {
1032                                 goto done;
1033                         }
1034                 } else {
1035                         ret = krb5_cc_get_principal(context, ccache, &client);
1036                         if (ret) {
1037                                 goto done;
1038                         }
1039                 }
1040
1041                 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1042                 if (ret) {
1043                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1044                         goto done;
1045                 }
1046
1047                 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1048                 ret = krb5_cc_initialize(context, ccache, client);
1049                 if (ret) {
1050                         goto done;
1051                 }
1052
1053                 ret = krb5_cc_store_cred(context, ccache, &creds);
1054
1055                 if (new_start_time) {
1056                         *new_start_time = (time_t) creds.times.renew_till;
1057                 }
1058
1059                 krb5_free_cred_contents(context, &creds);
1060         }
1061 #elif defined(HAVE_KRB5_GET_KDC_CRED)   /* Heimdal */
1062         {
1063                 krb5_kdc_flags flags;
1064                 krb5_creds creds_in;
1065                 krb5_realm *client_realm;
1066                 krb5_creds *creds;
1067
1068                 memset(&creds_in, 0, sizeof(creds_in));
1069
1070                 if (client_string) {
1071                         ret = krb5_parse_name(context, client_string, &creds_in.client);
1072                         if (ret) {
1073                                 goto done;
1074                         }
1075                 } else {
1076                         ret = krb5_cc_get_principal(context, ccache, &creds_in.client);
1077                         if (ret) {
1078                                 goto done;
1079                         }
1080                 }
1081
1082                 if (service_string) {
1083                         ret = krb5_parse_name(context, service_string, &creds_in.server);
1084                         if (ret) {
1085                                 goto done;
1086                         }
1087                 } else {
1088                         /* build tgt service by default */
1089                         client_realm = krb5_princ_realm(context, client);
1090                         ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1091                         if (ret) {
1092                                 goto done;
1093                         }
1094                 }
1095
1096                 flags.i = 0;
1097                 flags.b.renewable = flags.b.renew = True;
1098
1099                 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds);
1100                 if (ret) {
1101                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1102                         goto done;
1103                 }
1104
1105                 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1106                 ret = krb5_cc_initialize(context, ccache, creds_in.client);
1107                 if (ret) {
1108                         goto done;
1109                 }
1110
1111                 ret = krb5_cc_store_cred(context, ccache, creds);
1112
1113                 if (new_start_time) {
1114                         *new_start_time = (time_t) creds->times.renew_till;
1115                 }
1116
1117                 krb5_free_cred_contents(context, &creds_in);
1118                 krb5_free_creds(context, creds);
1119         }
1120 #else
1121 #error No suitable krb5 ticket renew function available
1122 #endif
1123
1124
1125 done:
1126         if (client) {
1127                 krb5_free_principal(context, client);
1128         }
1129         if (context) {
1130                 krb5_free_context(context);
1131         }
1132         if (ccache) {
1133                 krb5_cc_close(context, ccache);
1134         }
1135
1136         return ret;
1137
1138 }
1139
1140 #else /* HAVE_KRB5 */
1141  /* this saves a few linking headaches */
1142  int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1143                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1144                         const char *ccname)
1145 {
1146          DEBUG(0,("NO KERBEROS SUPPORT\n"));
1147          return 1;
1148 }
1149
1150 #endif