source4/heimdal/lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 RCSID("$Id: get_cred.c 23280 2008-06-23 03:26:18Z lha $");
  37
  38 /*
  39  * Take the `body' and encode it into `padata' using the credentials
  40  * in `creds'.
  41  */
  42
  43 static krb5_error_code
  44 make_pa_tgs_req(krb5_context context,
  45                 krb5_auth_context ac,
  46                 KDC_REQ_BODY *body,
  47                 PA_DATA *padata,
  48                 krb5_creds *creds)
  49 {
  50     u_char *buf;
  51     size_t buf_size;
  52     size_t len;
  53     krb5_data in_data;
  54     krb5_error_code ret;
  55
  56     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  57     if (ret)
  58         goto out;
  59     if(buf_size != len)
  60         krb5_abortx(context, "internal error in ASN.1 encoder");
  61
  62     in_data.length = len;
  63     in_data.data   = buf;
  64     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  65                                 &padata->padata_value,
  66                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  67                                 KRB5_KU_TGS_REQ_AUTH);
  68  out:
  69     free (buf);
  70     if(ret)
  71         return ret;
  72     padata->padata_type = KRB5_PADATA_TGS_REQ;
  73     return 0;
  74 }
  75
  76 /*
  77  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  78  */
  79
  80 static krb5_error_code
  81 set_auth_data (krb5_context context,
  82                KDC_REQ_BODY *req_body,
  83                krb5_authdata *authdata,
  84                krb5_keyblock *key)
  85 {
  86     if(authdata->len) {
  87         size_t len, buf_size;
  88         unsigned char *buf;
  89         krb5_crypto crypto;
  90         krb5_error_code ret;
  91
  92         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  93                            &len, ret);
  94         if (ret)
  95             return ret;
  96         if (buf_size != len)
  97             krb5_abortx(context, "internal error in ASN.1 encoder");
  98
  99         ALLOC(req_body->enc_authorization_data, 1);
 100         if (req_body->enc_authorization_data == NULL) {
 101             free (buf);
 102             krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 103             return ENOMEM;
 104         }
 105         ret = krb5_crypto_init(context, key, 0, &crypto);
 106         if (ret) {
 107             free (buf);
 108             free (req_body->enc_authorization_data);
 109             req_body->enc_authorization_data = NULL;
 110             return ret;
 111         }
 112         krb5_encrypt_EncryptedData(context,
 113                                    crypto,
 114                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 115                                    /* KRB5_KU_TGS_REQ_AUTH_DAT_SESSION? */
 116                                    buf,
 117                                    len,
 118                                    0,
 119                                    req_body->enc_authorization_data);
 120         free (buf);
 121         krb5_crypto_destroy(context, crypto);
 122     } else {
 123         req_body->enc_authorization_data = NULL;
 124     }
 125     return 0;
 126 }
 127
 128 /*
 129  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 130  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 131  * subkey in `subkey'.
 132  */
 133
 134 static krb5_error_code
 135 init_tgs_req (krb5_context context,
 136               krb5_ccache ccache,
 137               krb5_addresses *addresses,
 138               krb5_kdc_flags flags,
 139               Ticket *second_ticket,
 140               krb5_creds *in_creds,
 141               krb5_creds *krbtgt,
 142               unsigned nonce,
 143               const METHOD_DATA *padata,
 144               krb5_keyblock **subkey,
 145               TGS_REQ *t)
 146 {
 147     krb5_error_code ret = 0;
 148
 149     memset(t, 0, sizeof(*t));
 150     t->pvno = 5;
 151     t->msg_type = krb_tgs_req;
 152     if (in_creds->session.keytype) {
 153         ALLOC_SEQ(&t->req_body.etype, 1);
 154         if(t->req_body.etype.val == NULL) {
 155             ret = ENOMEM;
 156             krb5_set_error_message(context, ret, "malloc: out of memory");
 157             goto fail;
 158         }
 159         t->req_body.etype.val[0] = in_creds->session.keytype;
 160     } else {
 161         ret = krb5_init_etype(context,
 162                               &t->req_body.etype.len,
 163                               &t->req_body.etype.val,
 164                               NULL);
 165     }
 166     if (ret)
 167         goto fail;
 168     t->req_body.addresses = addresses;
 169     t->req_body.kdc_options = flags.b;
 170     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 171     if (ret)
 172         goto fail;
 173     ALLOC(t->req_body.sname, 1);
 174     if (t->req_body.sname == NULL) {
 175         ret = ENOMEM;
 176         krb5_set_error_message(context, ret, "malloc: out of memory");
 177         goto fail;
 178     }
 179
 180     /* some versions of some code might require that the client be
 181        present in TGS-REQs, but this is clearly against the spec */
 182
 183     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 184     if (ret)
 185         goto fail;
 186
 187     /* req_body.till should be NULL if there is no endtime specified,
 188        but old MIT code (like DCE secd) doesn't like that */
 189     ALLOC(t->req_body.till, 1);
 190     if(t->req_body.till == NULL){
 191         ret = ENOMEM;
 192         krb5_set_error_message(context, ret, "malloc: out of memory");
 193         goto fail;
 194     }
 195     *t->req_body.till = in_creds->times.endtime;
 196
 197     t->req_body.nonce = nonce;
 198     if(second_ticket){
 199         ALLOC(t->req_body.additional_tickets, 1);
 200         if (t->req_body.additional_tickets == NULL) {
 201             ret = ENOMEM;
 202             krb5_set_error_message(context, ret, "malloc: out of memory");
 203             goto fail;
 204         }
 205         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 206         if (t->req_body.additional_tickets->val == NULL) {
 207             ret = ENOMEM;
 208             krb5_set_error_message(context, ret, "malloc: out of memory");
 209             goto fail;
 210         }
 211         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 212         if (ret)
 213             goto fail;
 214     }
 215     ALLOC(t->padata, 1);
 216     if (t->padata == NULL) {
 217         ret = ENOMEM;
 218         krb5_set_error_message(context, ret, "malloc: out of memory");
 219         goto fail;
 220     }
 221     ALLOC_SEQ(t->padata, 1 + padata->len);
 222     if (t->padata->val == NULL) {
 223         ret = ENOMEM;
 224         krb5_set_error_message(context, ret, "malloc: out of memory");
 225         goto fail;
 226     }
 227     {
 228         int i;
 229         for (i = 0; i < padata->len; i++) {
 230             ret = copy_PA_DATA(&padata->val[i], &t->padata->val[i + 1]);
 231             if (ret) {
 232                 krb5_set_error_message(context, ret, "malloc: out of memory");
 233                 goto fail;
 234             }
 235         }
 236     }
 237
 238     {
 239         krb5_auth_context ac;
 240         krb5_keyblock *key = NULL;
 241
 242         ret = krb5_auth_con_init(context, &ac);
 243         if(ret)
 244             goto fail;
 245
 246         if (krb5_config_get_bool_default(context, NULL, FALSE,
 247                                          "realms",
 248                                          krbtgt->server->realm,
 249                                          "tgs_require_subkey",
 250                                          NULL))
 251         {
 252             ret = krb5_generate_subkey (context, &krbtgt->session, &key);
 253             if (ret) {
 254                 krb5_auth_con_free (context, ac);
 255                 goto fail;
 256             }
 257
 258             ret = krb5_auth_con_setlocalsubkey(context, ac, key);
 259             if (ret) {
 260                 if (key)
 261                     krb5_free_keyblock (context, key);
 262                 krb5_auth_con_free (context, ac);
 263                 goto fail;
 264             }
 265         }
 266
 267         ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 268                              key ? key : &krbtgt->session);
 269         if (ret) {
 270             if (key)
 271                 krb5_free_keyblock (context, key);
 272             krb5_auth_con_free (context, ac);
 273             goto fail;
 274         }
 275
 276         ret = make_pa_tgs_req(context,
 277                               ac,
 278                               &t->req_body,
 279                               &t->padata->val[0],
 280                               krbtgt);
 281         if(ret) {
 282             if (key)
 283                 krb5_free_keyblock (context, key);
 284             krb5_auth_con_free(context, ac);
 285             goto fail;
 286         }
 287         *subkey = key;
 288
 289         krb5_auth_con_free(context, ac);
 290     }
 291 fail:
 292     if (ret) {
 293         t->req_body.addresses = NULL;
 294         free_TGS_REQ (t);
 295     }
 296     return ret;
 297 }
 298
 299 krb5_error_code
 300 _krb5_get_krbtgt(krb5_context context,
 301                  krb5_ccache  id,
 302                  krb5_realm realm,
 303                  krb5_creds **cred)
 304 {
 305     krb5_error_code ret;
 306     krb5_creds tmp_cred;
 307
 308     memset(&tmp_cred, 0, sizeof(tmp_cred));
 309
 310     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 311     if (ret)
 312         return ret;
 313
 314     ret = krb5_make_principal(context,
 315                               &tmp_cred.server,
 316                               realm,
 317                               KRB5_TGS_NAME,
 318                               realm,
 319                               NULL);
 320     if(ret) {
 321         krb5_free_principal(context, tmp_cred.client);
 322         return ret;
 323     }
 324     ret = krb5_get_credentials(context,
 325                                KRB5_GC_CACHED,
 326                                id,
 327                                &tmp_cred,
 328                                cred);
 329     krb5_free_principal(context, tmp_cred.client);
 330     krb5_free_principal(context, tmp_cred.server);
 331     if(ret)
 332         return ret;
 333     return 0;
 334 }
 335
 336 /* DCE compatible decrypt proc */
 337 static krb5_error_code
 338 decrypt_tkt_with_subkey (krb5_context context,
 339                          krb5_keyblock *key,
 340                          krb5_key_usage usage,
 341                          krb5_const_pointer subkey,
 342                          krb5_kdc_rep *dec_rep)
 343 {
 344     krb5_error_code ret;
 345     krb5_data data;
 346     size_t size;
 347     krb5_crypto crypto;
 348
 349     ret = krb5_crypto_init(context, key, 0, &crypto);
 350     if (ret)
 351         return ret;
 352     ret = krb5_decrypt_EncryptedData (context,
 353                                       crypto,
 354                                       usage,
 355                                       &dec_rep->kdc_rep.enc_part,
 356                                       &data);
 357     krb5_crypto_destroy(context, crypto);
 358     if(ret && subkey){
 359         /* DCE compat -- try to decrypt with subkey */
 360         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 361         if (ret)
 362             return ret;
 363         ret = krb5_decrypt_EncryptedData (context,
 364                                           crypto,
 365                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 366                                           &dec_rep->kdc_rep.enc_part,
 367                                           &data);
 368         krb5_crypto_destroy(context, crypto);
 369     }
 370     if (ret)
 371         return ret;
 372
 373     ret = krb5_decode_EncASRepPart(context,
 374                                    data.data,
 375                                    data.length,
 376                                    &dec_rep->enc_part,
 377                                    &size);
 378     if (ret)
 379         ret = krb5_decode_EncTGSRepPart(context,
 380                                         data.data,
 381                                         data.length,
 382                                         &dec_rep->enc_part,
 383                                         &size);
 384     krb5_data_free (&data);
 385     return ret;
 386 }
 387
 388 static krb5_error_code
 389 get_cred_kdc(krb5_context context,
 390              krb5_ccache id,
 391              krb5_kdc_flags flags,
 392              krb5_addresses *addresses,
 393              krb5_creds *in_creds,
 394              krb5_creds *krbtgt,
 395              krb5_principal impersonate_principal,
 396              Ticket *second_ticket,
 397              krb5_creds *out_creds)
 398 {
 399     TGS_REQ req;
 400     krb5_data enc;
 401     krb5_data resp;
 402     krb5_kdc_rep rep;
 403     KRB_ERROR error;
 404     krb5_error_code ret;
 405     unsigned nonce;
 406     krb5_keyblock *subkey = NULL;
 407     size_t len;
 408     Ticket second_ticket_data;
 409     METHOD_DATA padata;
 410
 411     krb5_data_zero(&resp);
 412     krb5_data_zero(&enc);
 413     padata.val = NULL;
 414     padata.len = 0;
 415
 416     krb5_generate_random_block(&nonce, sizeof(nonce));
 417     nonce &= 0xffffffff;
 418
 419     if(flags.b.enc_tkt_in_skey && second_ticket == NULL){
 420         ret = decode_Ticket(in_creds->second_ticket.data,
 421                             in_creds->second_ticket.length,
 422                             &second_ticket_data, &len);
 423         if(ret)
 424             return ret;
 425         second_ticket = &second_ticket_data;
 426     }
 427
 428
 429     if (impersonate_principal) {
 430         krb5_crypto crypto;
 431         PA_S4U2Self self;
 432         krb5_data data;
 433         void *buf;
 434         size_t size;
 435
 436         self.name = impersonate_principal->name;
 437         self.realm = impersonate_principal->realm;
 438         self.auth = estrdup("Kerberos");
 439
 440         ret = _krb5_s4u2self_to_checksumdata(context, &self, &data);
 441         if (ret) {
 442             free(self.auth);
 443             goto out;
 444         }
 445
 446         ret = krb5_crypto_init(context, &krbtgt->session, 0, &crypto);
 447         if (ret) {
 448             free(self.auth);
 449             krb5_data_free(&data);
 450             goto out;
 451         }
 452
 453         ret = krb5_create_checksum(context,
 454                                    crypto,
 455                                    KRB5_KU_OTHER_CKSUM,
 456                                    0,
 457                                    data.data,
 458                                    data.length,
 459                                    &self.cksum);
 460         krb5_crypto_destroy(context, crypto);
 461         krb5_data_free(&data);
 462         if (ret) {
 463             free(self.auth);
 464             goto out;
 465         }
 466
 467         ASN1_MALLOC_ENCODE(PA_S4U2Self, buf, len, &self, &size, ret);
 468         free(self.auth);
 469         free_Checksum(&self.cksum);
 470         if (ret)
 471             goto out;
 472         if (len != size)
 473             krb5_abortx(context, "internal asn1 error");
 474
 475         ret = krb5_padata_add(context, &padata, KRB5_PADATA_S4U2SELF, buf, len);
 476         if (ret)
 477             goto out;
 478     }
 479
 480     ret = init_tgs_req (context,
 481                         id,
 482                         addresses,
 483                         flags,
 484                         second_ticket,
 485                         in_creds,
 486                         krbtgt,
 487                         nonce,
 488                         &padata,
 489                         &subkey,
 490                         &req);
 491     if (ret)
 492         goto out;
 493
 494     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 495     if (ret)
 496         goto out;
 497     if(enc.length != len)
 498         krb5_abortx(context, "internal error in ASN.1 encoder");
 499
 500     /* don't free addresses */
 501     req.req_body.addresses = NULL;
 502     free_TGS_REQ(&req);
 503
 504     /*
 505      * Send and receive
 506      */
 507     {
 508         krb5_sendto_ctx stctx;
 509         ret = krb5_sendto_ctx_alloc(context, &stctx);
 510         if (ret)
 511             return ret;
 512         krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
 513
 514         ret = krb5_sendto_context (context, stctx, &enc,
 515                                    krbtgt->server->name.name_string.val[1],
 516                                    &resp);
 517         krb5_sendto_ctx_free(context, stctx);
 518     }
 519     if(ret)
 520         goto out;
 521
 522     memset(&rep, 0, sizeof(rep));
 523     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
 524         unsigned eflags = 0;
 525
 526         ret = krb5_copy_principal(context,
 527                                   in_creds->client,
 528                                   &out_creds->client);
 529         if(ret)
 530             goto out2;
 531         ret = krb5_copy_principal(context,
 532                                   in_creds->server,
 533                                   &out_creds->server);
 534         if(ret)
 535             goto out2;
 536         /* this should go someplace else */
 537         out_creds->times.endtime = in_creds->times.endtime;
 538
 539         /* XXX should do better testing */
 540         if (flags.b.constrained_delegation || impersonate_principal)
 541             eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 542
 543         ret = _krb5_extract_ticket(context,
 544                                    &rep,
 545                                    out_creds,
 546                                    &krbtgt->session,
 547                                    NULL,
 548                                    KRB5_KU_TGS_REP_ENC_PART_SESSION,
 549                                    &krbtgt->addresses,
 550                                    nonce,
 551                                    eflags,
 552                                    decrypt_tkt_with_subkey,
 553                                    subkey);
 554     out2:
 555         krb5_free_kdc_rep(context, &rep);
 556     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 557         ret = krb5_error_from_rd_error(context, &error, in_creds);
 558         krb5_free_error_contents(context, &error);
 559     } else if(resp.data && ((char*)resp.data)[0] == 4) {
 560         ret = KRB5KRB_AP_ERR_V4_REPLY;
 561         krb5_clear_error_string(context);
 562     } else {
 563         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 564         krb5_clear_error_string(context);
 565     }
 566
 567 out:
 568     if (second_ticket == &second_ticket_data)
 569         free_Ticket(&second_ticket_data);
 570     free_METHOD_DATA(&padata);
 571     krb5_data_free(&resp);
 572     krb5_data_free(&enc);
 573     if(subkey){
 574         krb5_free_keyblock_contents(context, subkey);
 575         free(subkey);
 576     }
 577     return ret;
 578
 579 }
 580
 581 /*
 582  * same as above, just get local addresses first if the krbtgt have
 583  * them and the realm is not addressless
 584  */
 585
 586 static krb5_error_code
 587 get_cred_kdc_address(krb5_context context,
 588                      krb5_ccache id,
 589                      krb5_kdc_flags flags,
 590                      krb5_addresses *addrs,
 591                      krb5_creds *in_creds,
 592                      krb5_creds *krbtgt,
 593                      krb5_principal impersonate_principal,
 594                      Ticket *second_ticket,
 595                      krb5_creds *out_creds)
 596 {
 597     krb5_error_code ret;
 598     krb5_addresses addresses = { 0, NULL };
 599
 600     /*
 601      * Inherit the address-ness of the krbtgt if the address is not
 602      * specified.
 603      */
 604
 605     if (addrs == NULL && krbtgt->addresses.len != 0) {
 606         krb5_boolean noaddr;
 607
 608         krb5_appdefault_boolean(context, NULL, krbtgt->server->realm,
 609                                 "no-addresses", FALSE, &noaddr);
 610
 611         if (!noaddr) {
 612             krb5_get_all_client_addrs(context, &addresses);
 613             /* XXX this sucks. */
 614             addrs = &addresses;
 615             if(addresses.len == 0)
 616                 addrs = NULL;
 617         }
 618     }
 619     ret = get_cred_kdc(context, id, flags, addrs, in_creds,
 620                        krbtgt, impersonate_principal,
 621                        second_ticket, out_creds);
 622     krb5_free_addresses(context, &addresses);
 623     return ret;
 624 }
 625
 626 krb5_error_code KRB5_LIB_FUNCTION
 627 krb5_get_kdc_cred(krb5_context context,
 628                   krb5_ccache id,
 629                   krb5_kdc_flags flags,
 630                   krb5_addresses *addresses,
 631                   Ticket  *second_ticket,
 632                   krb5_creds *in_creds,
 633                   krb5_creds **out_creds
 634                   )
 635 {
 636     krb5_error_code ret;
 637     krb5_creds *krbtgt;
 638
 639     *out_creds = calloc(1, sizeof(**out_creds));
 640     if(*out_creds == NULL) {
 641         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 642         return ENOMEM;
 643     }
 644     ret = _krb5_get_krbtgt (context,
 645                             id,
 646                             in_creds->server->realm,
 647                             &krbtgt);
 648     if(ret) {
 649         free(*out_creds);
 650         return ret;
 651     }
 652     ret = get_cred_kdc(context, id, flags, addresses,
 653                        in_creds, krbtgt, NULL, NULL, *out_creds);
 654     krb5_free_creds (context, krbtgt);
 655     if(ret)
 656         free(*out_creds);
 657     return ret;
 658 }
 659
 660 static int
 661 not_found(krb5_context context, krb5_const_principal p, krb5_error_code code)
 662 {
 663     krb5_error_code ret;
 664     char *str;
 665
 666     ret = krb5_unparse_name(context, p, &str);
 667     if(ret) {
 668         krb5_clear_error_string(context);
 669         return code;
 670     }
 671     krb5_set_error_message(context, code, "Matching credential (%s) not found", str);
 672     free(str);
 673     return code;
 674 }
 675
 676 static krb5_error_code
 677 find_cred(krb5_context context,
 678           krb5_ccache id,
 679           krb5_principal server,
 680           krb5_creds **tgts,
 681           krb5_creds *out_creds)
 682 {
 683     krb5_error_code ret;
 684     krb5_creds mcreds;
 685
 686     krb5_cc_clear_mcred(&mcreds);
 687     mcreds.server = server;
 688     ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
 689                                 &mcreds, out_creds);
 690     if(ret == 0)
 691         return 0;
 692     while(tgts && *tgts){
 693         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 694                               &mcreds, *tgts)){
 695             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 696             return ret;
 697         }
 698         tgts++;
 699     }
 700     return not_found(context, server, KRB5_CC_NOTFOUND);
 701 }
 702
 703 static krb5_error_code
 704 add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 705 {
 706     int i;
 707     krb5_error_code ret;
 708     krb5_creds **tmp = *tgts;
 709
 710     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 711     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 712     if(tmp == NULL) {
 713         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 714         return ENOMEM;
 715     }
 716     *tgts = tmp;
 717     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 718     tmp[i+1] = NULL;
 719     return ret;
 720 }
 721
 722 /*
 723 get_cred(server)
 724         creds = cc_get_cred(server)
 725         if(creds) return creds
 726         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 727         if(tgt)
 728                 return get_cred_tgt(server, tgt)
 729         if(client_realm == server_realm)
 730                 return NULL
 731         tgt = get_cred(krbtgt/server_realm@client_realm)
 732         while(tgt_inst != server_realm)
 733                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 734         return get_cred_tgt(server, tgt)
 735         */
 736
 737 static krb5_error_code
 738 get_cred_kdc_capath(krb5_context context,
 739                     krb5_kdc_flags flags,
 740                     krb5_ccache ccache,
 741                     krb5_creds *in_creds,
 742                     krb5_principal impersonate_principal,
 743                     Ticket *second_ticket,
 744                     krb5_creds **out_creds,
 745                     krb5_creds ***ret_tgts)
 746 {
 747     krb5_error_code ret;
 748     krb5_creds *tgt, tmp_creds;
 749     krb5_const_realm client_realm, server_realm, try_realm;
 750
 751     *out_creds = NULL;
 752
 753     client_realm = krb5_principal_get_realm(context, in_creds->client);
 754     server_realm = krb5_principal_get_realm(context, in_creds->server);
 755     memset(&tmp_creds, 0, sizeof(tmp_creds));
 756     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 757     if(ret)
 758         return ret;
 759
 760     try_realm = krb5_config_get_string(context, NULL, "capaths",
 761                                        client_realm, server_realm, NULL);
 762     if (try_realm == NULL)
 763         try_realm = client_realm;
 764
 765     ret = krb5_make_principal(context,
 766                               &tmp_creds.server,
 767                               try_realm,
 768                               KRB5_TGS_NAME,
 769                               server_realm,
 770                               NULL);
 771     if(ret){
 772         krb5_free_principal(context, tmp_creds.client);
 773         return ret;
 774     }
 775     {
 776         krb5_creds tgts;
 777
 778         ret = find_cred(context, ccache, tmp_creds.server,
 779                         *ret_tgts, &tgts);
 780         if(ret == 0){
 781             *out_creds = calloc(1, sizeof(**out_creds));
 782             if(*out_creds == NULL) {
 783                 ret = ENOMEM;
 784                 krb5_set_error_message(context, ret, "malloc: out of memory");
 785             } else {
 786                 ret = get_cred_kdc_address(context, ccache, flags, NULL,
 787                                            in_creds, &tgts,
 788                                            impersonate_principal,
 789                                            second_ticket,
 790                                            *out_creds);
 791                 if (ret) {
 792                     free (*out_creds);
 793                     *out_creds = NULL;
 794                 }
 795             }
 796             krb5_free_cred_contents(context, &tgts);
 797             krb5_free_principal(context, tmp_creds.server);
 798             krb5_free_principal(context, tmp_creds.client);
 799             return ret;
 800         }
 801     }
 802     if(krb5_realm_compare(context, in_creds->client, in_creds->server))
 803         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 804
 805     /* XXX this can loop forever */
 806     while(1){
 807         heim_general_string tgt_inst;
 808
 809         ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 810                                   NULL, NULL, &tgt, ret_tgts);
 811         if(ret) {
 812             krb5_free_principal(context, tmp_creds.server);
 813             krb5_free_principal(context, tmp_creds.client);
 814             return ret;
 815         }
 816         ret = add_cred(context, tgt, ret_tgts);
 817         if(ret) {
 818             krb5_free_principal(context, tmp_creds.server);
 819             krb5_free_principal(context, tmp_creds.client);
 820             return ret;
 821         }
 822         tgt_inst = tgt->server->name.name_string.val[1];
 823         if(strcmp(tgt_inst, server_realm) == 0)
 824             break;
 825         krb5_free_principal(context, tmp_creds.server);
 826         ret = krb5_make_principal(context, &tmp_creds.server,
 827                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 828         if(ret) {
 829             krb5_free_principal(context, tmp_creds.server);
 830             krb5_free_principal(context, tmp_creds.client);
 831             return ret;
 832         }
 833         ret = krb5_free_creds(context, tgt);
 834         if(ret) {
 835             krb5_free_principal(context, tmp_creds.server);
 836             krb5_free_principal(context, tmp_creds.client);
 837             return ret;
 838         }
 839     }
 840
 841     krb5_free_principal(context, tmp_creds.server);
 842     krb5_free_principal(context, tmp_creds.client);
 843     *out_creds = calloc(1, sizeof(**out_creds));
 844     if(*out_creds == NULL) {
 845         ret = ENOMEM;
 846         krb5_set_error_message(context, ret, "malloc: out of memory");
 847     } else {
 848         ret = get_cred_kdc_address (context, ccache, flags, NULL,
 849                                     in_creds, tgt, impersonate_principal,
 850                                     second_ticket, *out_creds);
 851         if (ret) {
 852             free (*out_creds);
 853             *out_creds = NULL;
 854         }
 855     }
 856     krb5_free_creds(context, tgt);
 857     return ret;
 858 }
 859
 860 static krb5_error_code
 861 get_cred_kdc_referral(krb5_context context,
 862                       krb5_kdc_flags flags,
 863                       krb5_ccache ccache,
 864                       krb5_creds *in_creds,
 865                       krb5_principal impersonate_principal,
 866                       Ticket *second_ticket,
 867                       krb5_creds **out_creds,
 868                       krb5_creds ***ret_tgts)
 869 {
 870     krb5_const_realm client_realm;
 871     krb5_error_code ret;
 872     krb5_creds tgt, referral, ticket;
 873     int loop = 0;
 874
 875     memset(&tgt, 0, sizeof(tgt));
 876     memset(&ticket, 0, sizeof(ticket));
 877
 878     flags.b.canonicalize = 1;
 879
 880     *out_creds = NULL;
 881
 882     client_realm = krb5_principal_get_realm(context, in_creds->client);
 883
 884     /* find tgt for the clients base realm */
 885     {
 886         krb5_principal tgtname;
 887
 888         ret = krb5_make_principal(context, &tgtname,
 889                                   client_realm,
 890                                   KRB5_TGS_NAME,
 891                                   client_realm,
 892                                   NULL);
 893         if(ret)
 894             return ret;
 895
 896         ret = find_cred(context, ccache, tgtname, *ret_tgts, &tgt);
 897         krb5_free_principal(context, tgtname);
 898         if (ret)
 899             return ret;
 900     }
 901
 902     referral = *in_creds;
 903     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
 904     if (ret) {
 905         krb5_free_cred_contents(context, &tgt);
 906         return ret;
 907     }
 908     ret = krb5_principal_set_realm(context, referral.server, client_realm);
 909     if (ret) {
 910         krb5_free_cred_contents(context, &tgt);
 911         krb5_free_principal(context, referral.server);
 912         return ret;
 913     }
 914
 915     while (loop++ < 17) {
 916         krb5_creds **tickets;
 917         krb5_creds mcreds;
 918         char *referral_realm;
 919
 920         /* Use cache if we are not doing impersonation or contrainte deleg */
 921         if (impersonate_principal == NULL || flags.b.constrained_delegation) {
 922             krb5_cc_clear_mcred(&mcreds);
 923             mcreds.server = referral.server;
 924             ret = krb5_cc_retrieve_cred(context, ccache, 0, &mcreds, &ticket);
 925         } else
 926             ret = EINVAL;
 927
 928         if (ret) {
 929             ret = get_cred_kdc_address (context, ccache, flags, NULL,
 930                                         &referral, &tgt, impersonate_principal,
 931                                         second_ticket, &ticket);
 932             if (ret)
 933                 goto out;
 934         }
 935
 936         /* Did we get the right ticket ? */
 937         if (krb5_principal_compare_any_realm(context,
 938                                              referral.server,
 939                                              ticket.server))
 940             break;
 941
 942         if (ticket.server->name.name_string.len != 2 &&
 943             strcmp(ticket.server->name.name_string.val[0], KRB5_TGS_NAME) != 0)
 944         {
 945             krb5_set_error_message(context, KRB5KRB_AP_ERR_NOT_US,
 946                                    "Got back an non krbtgt ticket referrals");
 947             krb5_free_cred_contents(context, &ticket);
 948             return KRB5KRB_AP_ERR_NOT_US;
 949         }
 950
 951         referral_realm = ticket.server->name.name_string.val[1];
 952
 953         /* check that there are no referrals loops */
 954         tickets = *ret_tgts;
 955
 956         krb5_cc_clear_mcred(&mcreds);
 957         mcreds.server = ticket.server;
 958
 959         while(tickets && *tickets){
 960             if(krb5_compare_creds(context,
 961                                   KRB5_TC_DONT_MATCH_REALM,
 962                                   &mcreds,
 963                                   *tickets))
 964             {
 965                 krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
 966                                        "Referral from %s loops back to realm %s",
 967                                        tgt.server->realm,
 968                                        referral_realm);
 969                 krb5_free_cred_contents(context, &ticket);
 970                 return KRB5_GET_IN_TKT_LOOP;
 971             }
 972             tickets++;
 973         }
 974
 975         ret = add_cred(context, &ticket, ret_tgts);
 976         if (ret) {
 977             krb5_free_cred_contents(context, &ticket);
 978             goto out;
 979         }
 980
 981         /* try realm in the referral */
 982         ret = krb5_principal_set_realm(context,
 983                                        referral.server,
 984                                        referral_realm);
 985         krb5_free_cred_contents(context, &tgt);
 986         tgt = ticket;
 987         memset(&ticket, 0, sizeof(ticket));
 988         if (ret)
 989             goto out;
 990     }
 991
 992     ret = krb5_copy_creds(context, &ticket, out_creds);
 993
 994 out:
 995     krb5_free_principal(context, referral.server);
 996     krb5_free_cred_contents(context, &tgt);
 997     return ret;
 998 }
 999
1000
1001 /*
1002  * Glue function between referrals version and old client chasing
1003  * codebase.
1004  */
1005
1006 static krb5_error_code
1007 get_cred_kdc_any(krb5_context context,
1008                  krb5_kdc_flags flags,
1009                  krb5_ccache ccache,
1010                  krb5_creds *in_creds,
1011                  krb5_principal impersonate_principal,
1012                  Ticket *second_ticket,
1013                  krb5_creds **out_creds,
1014                  krb5_creds ***ret_tgts)
1015 {
1016     krb5_error_code ret;
1017
1018     ret = get_cred_kdc_referral(context,
1019                                 flags,
1020                                 ccache,
1021                                 in_creds,
1022                                 impersonate_principal,
1023                                 second_ticket,
1024                                 out_creds,
1025                                 ret_tgts);
1026     if (ret == 0 || flags.b.canonicalize)
1027         return ret;
1028     return get_cred_kdc_capath(context,
1029                                 flags,
1030                                 ccache,
1031                                 in_creds,
1032                                 impersonate_principal,
1033                                 second_ticket,
1034                                 out_creds,
1035                                 ret_tgts);
1036 }
1037
1038
1039 krb5_error_code KRB5_LIB_FUNCTION
1040 krb5_get_cred_from_kdc_opt(krb5_context context,
1041                            krb5_ccache ccache,
1042                            krb5_creds *in_creds,
1043                            krb5_creds **out_creds,
1044                            krb5_creds ***ret_tgts,
1045                            krb5_flags flags)
1046 {
1047     krb5_kdc_flags f;
1048     f.i = flags;
1049     return get_cred_kdc_any(context, f, ccache,
1050                             in_creds, NULL, NULL,
1051                             out_creds, ret_tgts);
1052 }
1053
1054 krb5_error_code KRB5_LIB_FUNCTION
1055 krb5_get_cred_from_kdc(krb5_context context,
1056                        krb5_ccache ccache,
1057                        krb5_creds *in_creds,
1058                        krb5_creds **out_creds,
1059                        krb5_creds ***ret_tgts)
1060 {
1061     return krb5_get_cred_from_kdc_opt(context, ccache,
1062                                       in_creds, out_creds, ret_tgts, 0);
1063 }
1064
1065
1066 krb5_error_code KRB5_LIB_FUNCTION
1067 krb5_get_credentials_with_flags(krb5_context context,
1068                                 krb5_flags options,
1069                                 krb5_kdc_flags flags,
1070                                 krb5_ccache ccache,
1071                                 krb5_creds *in_creds,
1072                                 krb5_creds **out_creds)
1073 {
1074     krb5_error_code ret;
1075     krb5_creds **tgts;
1076     krb5_creds *res_creds;
1077     int i;
1078
1079     *out_creds = NULL;
1080     res_creds = calloc(1, sizeof(*res_creds));
1081     if (res_creds == NULL) {
1082         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1083         return ENOMEM;
1084     }
1085
1086     if (in_creds->session.keytype)
1087         options |= KRB5_TC_MATCH_KEYTYPE;
1088
1089     /*
1090      * If we got a credential, check if credential is expired before
1091      * returning it.
1092      */
1093     ret = krb5_cc_retrieve_cred(context,
1094                                 ccache,
1095                                 in_creds->session.keytype ?
1096                                 KRB5_TC_MATCH_KEYTYPE : 0,
1097                                 in_creds, res_creds);
1098     /*
1099      * If we got a credential, check if credential is expired before
1100      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1101      */
1102     if (ret == 0) {
1103         krb5_timestamp timeret;
1104
1105         /* If expired ok, don't bother checking */
1106         if(options & KRB5_GC_EXPIRED_OK) {
1107             *out_creds = res_creds;
1108             return 0;
1109         }
1110
1111         krb5_timeofday(context, &timeret);
1112         if(res_creds->times.endtime > timeret) {
1113             *out_creds = res_creds;
1114             return 0;
1115         }
1116         if(options & KRB5_GC_CACHED)
1117             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1118
1119     } else if(ret != KRB5_CC_END) {
1120         free(res_creds);
1121         return ret;
1122     }
1123     free(res_creds);
1124     if(options & KRB5_GC_CACHED)
1125         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
1126
1127     if(options & KRB5_GC_USER_USER)
1128         flags.b.enc_tkt_in_skey = 1;
1129     if (flags.b.enc_tkt_in_skey)
1130         options |= KRB5_GC_NO_STORE;
1131
1132     tgts = NULL;
1133     ret = get_cred_kdc_any(context, flags, ccache,
1134                            in_creds, NULL, NULL, out_creds, &tgts);
1135     for(i = 0; tgts && tgts[i]; i++) {
1136         krb5_cc_store_cred(context, ccache, tgts[i]);
1137         krb5_free_creds(context, tgts[i]);
1138     }
1139     free(tgts);
1140     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1141         krb5_cc_store_cred(context, ccache, *out_creds);
1142     return ret;
1143 }
1144
1145 krb5_error_code KRB5_LIB_FUNCTION
1146 krb5_get_credentials(krb5_context context,
1147                      krb5_flags options,
1148                      krb5_ccache ccache,
1149                      krb5_creds *in_creds,
1150                      krb5_creds **out_creds)
1151 {
1152     krb5_kdc_flags flags;
1153     flags.i = 0;
1154     return krb5_get_credentials_with_flags(context, options, flags,
1155                                            ccache, in_creds, out_creds);
1156 }
1157
1158 struct krb5_get_creds_opt_data {
1159     krb5_principal self;
1160     krb5_flags options;
1161     krb5_enctype enctype;
1162     Ticket *ticket;
1163 };
1164
1165
1166 krb5_error_code KRB5_LIB_FUNCTION
1167 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
1168 {
1169     *opt = calloc(1, sizeof(**opt));
1170     if (*opt == NULL) {
1171         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1172         return ENOMEM;
1173     }
1174     return 0;
1175 }
1176
1177 void KRB5_LIB_FUNCTION
1178 krb5_get_creds_opt_free(krb5_context context, krb5_get_creds_opt opt)
1179 {
1180     if (opt->self)
1181         krb5_free_principal(context, opt->self);
1182     memset(opt, 0, sizeof(*opt));
1183     free(opt);
1184 }
1185
1186 void KRB5_LIB_FUNCTION
1187 krb5_get_creds_opt_set_options(krb5_context context,
1188                                krb5_get_creds_opt opt,
1189                                krb5_flags options)
1190 {
1191     opt->options = options;
1192 }
1193
1194 void KRB5_LIB_FUNCTION
1195 krb5_get_creds_opt_add_options(krb5_context context,
1196                                krb5_get_creds_opt opt,
1197                                krb5_flags options)
1198 {
1199     opt->options |= options;
1200 }
1201
1202 void KRB5_LIB_FUNCTION
1203 krb5_get_creds_opt_set_enctype(krb5_context context,
1204                                krb5_get_creds_opt opt,
1205                                krb5_enctype enctype)
1206 {
1207     opt->enctype = enctype;
1208 }
1209
1210 krb5_error_code KRB5_LIB_FUNCTION
1211 krb5_get_creds_opt_set_impersonate(krb5_context context,
1212                                    krb5_get_creds_opt opt,
1213                                    krb5_const_principal self)
1214 {
1215     if (opt->self)
1216         krb5_free_principal(context, opt->self);
1217     return krb5_copy_principal(context, self, &opt->self);
1218 }
1219
1220 krb5_error_code KRB5_LIB_FUNCTION
1221 krb5_get_creds_opt_set_ticket(krb5_context context,
1222                               krb5_get_creds_opt opt,
1223                               const Ticket *ticket)
1224 {
1225     if (opt->ticket) {
1226         free_Ticket(opt->ticket);
1227         free(opt->ticket);
1228         opt->ticket = NULL;
1229     }
1230     if (ticket) {
1231         krb5_error_code ret;
1232
1233         opt->ticket = malloc(sizeof(*ticket));
1234         if (opt->ticket == NULL) {
1235             krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1236             return ENOMEM;
1237         }
1238         ret = copy_Ticket(ticket, opt->ticket);
1239         if (ret) {
1240             free(opt->ticket);
1241             opt->ticket = NULL;
1242             krb5_set_error_message(context, ret, "malloc: out of memory");
1243             return ret;
1244         }
1245     }
1246     return 0;
1247 }
1248
1249
1250
1251 krb5_error_code KRB5_LIB_FUNCTION
1252 krb5_get_creds(krb5_context context,
1253                krb5_get_creds_opt opt,
1254                krb5_ccache ccache,
1255                krb5_const_principal inprinc,
1256                krb5_creds **out_creds)
1257 {
1258     krb5_kdc_flags flags;
1259     krb5_flags options;
1260     krb5_creds in_creds;
1261     krb5_error_code ret;
1262     krb5_creds **tgts;
1263     krb5_creds *res_creds;
1264     int i;
1265
1266     memset(&in_creds, 0, sizeof(in_creds));
1267     in_creds.server = rk_UNCONST(inprinc);
1268
1269     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
1270     if (ret)
1271         return ret;
1272
1273     options = opt->options;
1274     flags.i = 0;
1275
1276     *out_creds = NULL;
1277     res_creds = calloc(1, sizeof(*res_creds));
1278     if (res_creds == NULL) {
1279         krb5_free_principal(context, in_creds.client);
1280         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1281         return ENOMEM;
1282     }
1283
1284     if (opt->enctype) {
1285         in_creds.session.keytype = opt->enctype;
1286         options |= KRB5_TC_MATCH_KEYTYPE;
1287     }
1288
1289     /*
1290      * If we got a credential, check if credential is expired before
1291      * returning it.
1292      */
1293     ret = krb5_cc_retrieve_cred(context,
1294                                 ccache,
1295                                 opt->enctype ? KRB5_TC_MATCH_KEYTYPE : 0,
1296                                 &in_creds, res_creds);
1297     /*
1298      * If we got a credential, check if credential is expired before
1299      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1300      */
1301     if (ret == 0) {
1302         krb5_timestamp timeret;
1303
1304         /* If expired ok, don't bother checking */
1305         if(options & KRB5_GC_EXPIRED_OK) {
1306             *out_creds = res_creds;
1307             krb5_free_principal(context, in_creds.client);
1308             return 0;
1309         }
1310
1311         krb5_timeofday(context, &timeret);
1312         if(res_creds->times.endtime > timeret) {
1313             *out_creds = res_creds;
1314             krb5_free_principal(context, in_creds.client);
1315             return 0;
1316         }
1317         if(options & KRB5_GC_CACHED)
1318             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1319
1320     } else if(ret != KRB5_CC_END) {
1321         free(res_creds);
1322         krb5_free_principal(context, in_creds.client);
1323         return ret;
1324     }
1325     free(res_creds);
1326     if(options & KRB5_GC_CACHED) {
1327         krb5_free_principal(context, in_creds.client);
1328         return not_found(context, in_creds.server, KRB5_CC_NOTFOUND);
1329     }
1330     if(options & KRB5_GC_USER_USER) {
1331         flags.b.enc_tkt_in_skey = 1;
1332         options |= KRB5_GC_NO_STORE;
1333     }
1334     if (options & KRB5_GC_FORWARDABLE)
1335         flags.b.forwardable = 1;
1336     if (options & KRB5_GC_NO_TRANSIT_CHECK)
1337         flags.b.disable_transited_check = 1;
1338     if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
1339         flags.b.request_anonymous = 1; /* XXX ARGH confusion */
1340         flags.b.constrained_delegation = 1;
1341     }
1342     if (options & KRB5_GC_CANONICALIZE)
1343         flags.b.canonicalize = 1;
1344
1345     tgts = NULL;
1346     ret = get_cred_kdc_any(context, flags, ccache,
1347                            &in_creds, opt->self, opt->ticket,
1348                            out_creds, &tgts);
1349     krb5_free_principal(context, in_creds.client);
1350     for(i = 0; tgts && tgts[i]; i++) {
1351         krb5_cc_store_cred(context, ccache, tgts[i]);
1352         krb5_free_creds(context, tgts[i]);
1353     }
1354     free(tgts);
1355     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1356         krb5_cc_store_cred(context, ccache, *out_creds);
1357     return ret;
1358 }
1359
1360 /*
1361  *
1362  */
1363
1364 krb5_error_code KRB5_LIB_FUNCTION
1365 krb5_get_renewed_creds(krb5_context context,
1366                        krb5_creds *creds,
1367                        krb5_const_principal client,
1368                        krb5_ccache ccache,
1369                        const char *in_tkt_service)
1370 {
1371     krb5_error_code ret;
1372     krb5_kdc_flags flags;
1373     krb5_creds in, *template, *out = NULL;
1374
1375     memset(&in, 0, sizeof(in));
1376     memset(creds, 0, sizeof(*creds));
1377
1378     ret = krb5_copy_principal(context, client, &in.client);
1379     if (ret)
1380         return ret;
1381
1382     if (in_tkt_service) {
1383         ret = krb5_parse_name(context, in_tkt_service, &in.server);
1384         if (ret) {
1385             krb5_free_principal(context, in.client);
1386             return ret;
1387         }
1388     } else {
1389         const char *realm = krb5_principal_get_realm(context, client);
1390
1391         ret = krb5_make_principal(context, &in.server, realm, KRB5_TGS_NAME,
1392                                   realm, NULL);
1393         if (ret) {
1394             krb5_free_principal(context, in.client);
1395             return ret;
1396         }
1397     }
1398
1399     flags.i = 0;
1400     flags.b.renewable = flags.b.renew = 1;
1401
1402     /*
1403      * Get template from old credential cache for the same entry, if
1404      * this failes, no worries.
1405      */
1406     ret = krb5_get_credentials(context, KRB5_GC_CACHED, ccache, &in, &template);
1407     if (ret == 0) {
1408         flags.b.forwardable = template->flags.b.forwardable;
1409         flags.b.proxiable = template->flags.b.proxiable;
1410         krb5_free_creds (context, template);
1411     }
1412
1413     ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out);
1414     krb5_free_principal(context, in.client);
1415     krb5_free_principal(context, in.server);
1416     if (ret)
1417         return ret;
1418
1419     ret = krb5_copy_creds_contents(context, out, creds);
1420     krb5_free_creds(context, out);
1421
1422     return ret;
1423 }