4d8da9357901a3097d4768703159c1ef9077dd89
[sfrench/samba-autobuild/.git] / source4 / heimdal / lib / krb5 / ticket.c
1 /*
2  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * 3. Neither the name of the Institute nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35
36 #include "krb5_locl.h"
37
38 /**
39  * Free ticket and content
40  *
41  * @param context a Kerberos 5 context
42  * @param ticket ticket to free
43  *
44  * @return Returns 0 to indicate success.  Otherwise an kerberos et
45  * error code is returned, see krb5_get_error_message().
46  *
47  * @ingroup krb5
48  */
49
50 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
51 krb5_free_ticket(krb5_context context,
52                  krb5_ticket *ticket)
53 {
54     free_EncTicketPart(&ticket->ticket);
55     krb5_free_principal(context, ticket->client);
56     krb5_free_principal(context, ticket->server);
57     free(ticket);
58     return 0;
59 }
60
61 /**
62  * Copy ticket and content
63  *
64  * @param context a Kerberos 5 context
65  * @param from ticket to copy
66  * @param to new copy of ticket, free with krb5_free_ticket()
67  *
68  * @return Returns 0 to indicate success.  Otherwise an kerberos et
69  * error code is returned, see krb5_get_error_message().
70  *
71  * @ingroup krb5
72  */
73
74 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
75 krb5_copy_ticket(krb5_context context,
76                  const krb5_ticket *from,
77                  krb5_ticket **to)
78 {
79     krb5_error_code ret;
80     krb5_ticket *tmp;
81
82     *to = NULL;
83     tmp = malloc(sizeof(*tmp));
84     if(tmp == NULL) {
85         krb5_set_error_message(context, ENOMEM,
86                                N_("malloc: out of memory", ""));
87         return ENOMEM;
88     }
89     if((ret = copy_EncTicketPart(&from->ticket, &tmp->ticket))){
90         free(tmp);
91         return ret;
92     }
93     ret = krb5_copy_principal(context, from->client, &tmp->client);
94     if(ret){
95         free_EncTicketPart(&tmp->ticket);
96         free(tmp);
97         return ret;
98     }
99     ret = krb5_copy_principal(context, from->server, &tmp->server);
100     if(ret){
101         krb5_free_principal(context, tmp->client);
102         free_EncTicketPart(&tmp->ticket);
103         free(tmp);
104         return ret;
105     }
106     *to = tmp;
107     return 0;
108 }
109
110 /**
111  * Return client principal in ticket
112  *
113  * @param context a Kerberos 5 context
114  * @param ticket ticket to copy
115  * @param client client principal, free with krb5_free_principal()
116  *
117  * @return Returns 0 to indicate success.  Otherwise an kerberos et
118  * error code is returned, see krb5_get_error_message().
119  *
120  * @ingroup krb5
121  */
122
123 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
124 krb5_ticket_get_client(krb5_context context,
125                        const krb5_ticket *ticket,
126                        krb5_principal *client)
127 {
128     return krb5_copy_principal(context, ticket->client, client);
129 }
130
131 /**
132  * Return server principal in ticket
133  *
134  * @param context a Kerberos 5 context
135  * @param ticket ticket to copy
136  * @param server server principal, free with krb5_free_principal()
137  *
138  * @return Returns 0 to indicate success.  Otherwise an kerberos et
139  * error code is returned, see krb5_get_error_message().
140  *
141  * @ingroup krb5
142  */
143
144 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
145 krb5_ticket_get_server(krb5_context context,
146                        const krb5_ticket *ticket,
147                        krb5_principal *server)
148 {
149     return krb5_copy_principal(context, ticket->server, server);
150 }
151
152 /**
153  * Return end time of ticket
154  *
155  * @param context a Kerberos 5 context
156  * @param ticket ticket to copy
157  *
158  * @return end time of ticket
159  *
160  * @ingroup krb5
161  */
162
163 KRB5_LIB_FUNCTION time_t KRB5_LIB_CALL
164 krb5_ticket_get_endtime(krb5_context context,
165                         const krb5_ticket *ticket)
166 {
167     return ticket->ticket.endtime;
168 }
169
170 /**
171  * Get the flags from the Kerberos ticket
172  *
173  * @param context Kerberos context
174  * @param ticket Kerberos ticket
175  *
176  * @return ticket flags
177  *
178  * @ingroup krb5_ticket
179  */
180 unsigned long
181 krb5_ticket_get_flags(krb5_context context,
182                       const krb5_ticket *ticket)
183 {
184     return TicketFlags2int(ticket->ticket.flags);
185 }
186
187 static int
188 find_type_in_ad(krb5_context context,
189                 int type,
190                 krb5_data *data,
191                 krb5_boolean *found,
192                 krb5_boolean failp,
193                 krb5_keyblock *sessionkey,
194                 const AuthorizationData *ad,
195                 int level)
196 {
197     krb5_error_code ret = 0;
198     int i;
199
200     if (level > 9) {
201         ret = ENOENT; /* XXX */
202         krb5_set_error_message(context, ret,
203                                N_("Authorization data nested deeper "
204                                   "then %d levels, stop searching", ""),
205                                level);
206         goto out;
207     }
208
209     /*
210      * Only copy out the element the first time we get to it, we need
211      * to run over the whole authorization data fields to check if
212      * there are any container clases we need to care about.
213      */
214     for (i = 0; i < ad->len; i++) {
215         if (!*found && ad->val[i].ad_type == type) {
216             ret = der_copy_octet_string(&ad->val[i].ad_data, data);
217             if (ret) {
218                 krb5_set_error_message(context, ret,
219                                        N_("malloc: out of memory", ""));
220                 goto out;
221             }
222             *found = TRUE;
223             continue;
224         }
225         switch (ad->val[i].ad_type) {
226         case KRB5_AUTHDATA_IF_RELEVANT: {
227             AuthorizationData child;
228             ret = decode_AuthorizationData(ad->val[i].ad_data.data,
229                                            ad->val[i].ad_data.length,
230                                            &child,
231                                            NULL);
232             if (ret) {
233                 krb5_set_error_message(context, ret,
234                                        N_("Failed to decode "
235                                           "IF_RELEVANT with %d", ""),
236                                        (int)ret);
237                 goto out;
238             }
239             ret = find_type_in_ad(context, type, data, found, FALSE,
240                                   sessionkey, &child, level + 1);
241             free_AuthorizationData(&child);
242             if (ret)
243                 goto out;
244             break;
245         }
246 #if 0 /* XXX test */
247         case KRB5_AUTHDATA_KDC_ISSUED: {
248             AD_KDCIssued child;
249
250             ret = decode_AD_KDCIssued(ad->val[i].ad_data.data,
251                                       ad->val[i].ad_data.length,
252                                       &child,
253                                       NULL);
254             if (ret) {
255                 krb5_set_error_message(context, ret,
256                                        N_("Failed to decode "
257                                           "AD_KDCIssued with %d", ""),
258                                        ret);
259                 goto out;
260             }
261             if (failp) {
262                 krb5_boolean valid;
263                 krb5_data buf;
264                 size_t len;
265
266                 ASN1_MALLOC_ENCODE(AuthorizationData, buf.data, buf.length,
267                                    &child.elements, &len, ret);
268                 if (ret) {
269                     free_AD_KDCIssued(&child);
270                     krb5_clear_error_message(context);
271                     goto out;
272                 }
273                 if(buf.length != len)
274                     krb5_abortx(context, "internal error in ASN.1 encoder");
275
276                 ret = krb5_c_verify_checksum(context, sessionkey, 19, &buf,
277                                              &child.ad_checksum, &valid);
278                 krb5_data_free(&buf);
279                 if (ret) {
280                     free_AD_KDCIssued(&child);
281                     goto out;
282                 }
283                 if (!valid) {
284                     krb5_clear_error_message(context);
285                     ret = ENOENT;
286                     free_AD_KDCIssued(&child);
287                     goto out;
288                 }
289             }
290             ret = find_type_in_ad(context, type, data, found, failp, sessionkey,
291                                   &child.elements, level + 1);
292             free_AD_KDCIssued(&child);
293             if (ret)
294                 goto out;
295             break;
296         }
297 #endif
298         case KRB5_AUTHDATA_AND_OR:
299             if (!failp)
300                 break;
301             ret = ENOENT; /* XXX */
302             krb5_set_error_message(context, ret,
303                                    N_("Authorization data contains "
304                                       "AND-OR element that is unknown to the "
305                                       "application", ""));
306             goto out;
307         default:
308             if (!failp)
309                 break;
310             ret = ENOENT; /* XXX */
311             krb5_set_error_message(context, ret,
312                                    N_("Authorization data contains "
313                                       "unknown type (%d) ", ""),
314                                    ad->val[i].ad_type);
315             goto out;
316         }
317     }
318 out:
319     if (ret) {
320         if (*found) {
321             krb5_data_free(data);
322             *found = 0;
323         }
324     }
325     return ret;
326 }
327
328 /**
329  * Extract the authorization data type of type from the ticket. Store
330  * the field in data. This function is to use for kerberos
331  * applications.
332  *
333  * @param context a Kerberos 5 context
334  * @param ticket Kerberos ticket
335  * @param type type to fetch
336  * @param data returned data, free with krb5_data_free()
337  *
338  * @ingroup krb5
339  */
340
341 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
342 krb5_ticket_get_authorization_data_type(krb5_context context,
343                                         krb5_ticket *ticket,
344                                         int type,
345                                         krb5_data *data)
346 {
347     AuthorizationData *ad;
348     krb5_error_code ret;
349     krb5_boolean found = FALSE;
350
351     krb5_data_zero(data);
352
353     ad = ticket->ticket.authorization_data;
354     if (ticket->ticket.authorization_data == NULL) {
355         krb5_set_error_message(context, ENOENT,
356                                N_("Ticket have not authorization data", ""));
357         return ENOENT; /* XXX */
358     }
359
360     ret = find_type_in_ad(context, type, data, &found, TRUE,
361                           &ticket->ticket.key, ad, 0);
362     if (ret)
363         return ret;
364     if (!found) {
365         krb5_set_error_message(context, ENOENT,
366                                N_("Ticket have not "
367                                   "authorization data of type %d", ""),
368                                type);
369         return ENOENT; /* XXX */
370     }
371     return 0;
372 }
373
374 static krb5_error_code
375 check_server_referral(krb5_context context,
376                       krb5_kdc_rep *rep,
377                       unsigned flags,
378                       krb5_const_principal requested,
379                       krb5_const_principal returned,
380                       krb5_keyblock * key)
381 {
382     krb5_error_code ret;
383     PA_ServerReferralData ref;
384     krb5_crypto session;
385     EncryptedData ed;
386     size_t len;
387     krb5_data data;
388     PA_DATA *pa;
389     int i = 0, cmp;
390
391     if (rep->kdc_rep.padata == NULL)
392         goto noreferral;
393
394     pa = krb5_find_padata(rep->kdc_rep.padata->val,
395                           rep->kdc_rep.padata->len,
396                           KRB5_PADATA_SERVER_REFERRAL, &i);
397     if (pa == NULL)
398         goto noreferral;
399
400     memset(&ed, 0, sizeof(ed));
401     memset(&ref, 0, sizeof(ref));
402
403     ret = decode_EncryptedData(pa->padata_value.data,
404                                pa->padata_value.length,
405                                &ed, &len);
406     if (ret)
407         return ret;
408     if (len != pa->padata_value.length) {
409         free_EncryptedData(&ed);
410         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
411                                N_("Referral EncryptedData wrong for realm %s",
412                                   "realm"), requested->realm);
413         return KRB5KRB_AP_ERR_MODIFIED;
414     }
415
416     ret = krb5_crypto_init(context, key, 0, &session);
417     if (ret) {
418         free_EncryptedData(&ed);
419         return ret;
420     }
421
422     ret = krb5_decrypt_EncryptedData(context, session,
423                                      KRB5_KU_PA_SERVER_REFERRAL,
424                                      &ed, &data);
425     free_EncryptedData(&ed);
426     krb5_crypto_destroy(context, session);
427     if (ret)
428         return ret;
429
430     ret = decode_PA_ServerReferralData(data.data, data.length, &ref, &len);
431     if (ret) {
432         krb5_data_free(&data);
433         return ret;
434     }
435     krb5_data_free(&data);
436
437     if (strcmp(requested->realm, returned->realm) != 0) {
438         free_PA_ServerReferralData(&ref);
439         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
440                                N_("server ref realm mismatch, "
441                                   "requested realm %s got back %s", ""),
442                                requested->realm, returned->realm);
443         return KRB5KRB_AP_ERR_MODIFIED;
444     }
445
446     if (returned->name.name_string.len == 2 &&
447         strcmp(returned->name.name_string.val[0], KRB5_TGS_NAME) == 0)
448     {
449         const char *realm = returned->name.name_string.val[1];
450
451         if (ref.referred_realm == NULL
452             || strcmp(*ref.referred_realm, realm) != 0)
453         {
454             free_PA_ServerReferralData(&ref);
455             krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
456                                    N_("tgt returned with wrong ref", ""));
457             return KRB5KRB_AP_ERR_MODIFIED;
458         }
459     } else if (krb5_principal_compare(context, returned, requested) == 0) {
460         free_PA_ServerReferralData(&ref);
461         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
462                                N_("req princ no same as returned", ""));
463         return KRB5KRB_AP_ERR_MODIFIED;
464     }
465
466     if (ref.requested_principal_name) {
467         cmp = _krb5_principal_compare_PrincipalName(context,
468                                                     requested,
469                                                     ref.requested_principal_name);
470         if (!cmp) {
471             free_PA_ServerReferralData(&ref);
472             krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
473                                    N_("referred principal not same "
474                                       "as requested", ""));
475             return KRB5KRB_AP_ERR_MODIFIED;
476         }
477     } else if (flags & EXTRACT_TICKET_AS_REQ) {
478         free_PA_ServerReferralData(&ref);
479         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
480                                N_("Requested principal missing on AS-REQ", ""));
481         return KRB5KRB_AP_ERR_MODIFIED;
482     }
483
484     free_PA_ServerReferralData(&ref);
485
486     return ret;
487 noreferral:
488     if (krb5_principal_compare(context, requested, returned) == FALSE) {
489         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
490                                N_("Not same server principal returned "
491                                   "as requested", ""));
492         return KRB5KRB_AP_ERR_MODIFIED;
493     }
494     return 0;
495 }
496
497
498 /*
499  * Verify referral data
500  */
501
502
503 static krb5_error_code
504 check_client_referral(krb5_context context,
505                       krb5_kdc_rep *rep,
506                       krb5_const_principal requested,
507                       krb5_const_principal mapped,
508                       krb5_keyblock const * key)
509 {
510     krb5_error_code ret;
511     PA_ClientCanonicalized canon;
512     krb5_crypto crypto;
513     krb5_data data;
514     PA_DATA *pa;
515     size_t len;
516     int i = 0;
517
518     if (rep->kdc_rep.padata == NULL)
519         goto noreferral;
520
521     pa = krb5_find_padata(rep->kdc_rep.padata->val,
522                           rep->kdc_rep.padata->len,
523                           KRB5_PADATA_CLIENT_CANONICALIZED, &i);
524     if (pa == NULL)
525         goto noreferral;
526
527     ret = decode_PA_ClientCanonicalized(pa->padata_value.data,
528                                         pa->padata_value.length,
529                                         &canon, &len);
530     if (ret) {
531         krb5_set_error_message(context, ret,
532                                N_("Failed to decode ClientCanonicalized "
533                                   "from realm %s", ""), requested->realm);
534         return ret;
535     }
536
537     ASN1_MALLOC_ENCODE(PA_ClientCanonicalizedNames, data.data, data.length,
538                        &canon.names, &len, ret);
539     if (ret) {
540         free_PA_ClientCanonicalized(&canon);
541         return ret;
542     }
543     if (data.length != len)
544         krb5_abortx(context, "internal asn.1 error");
545
546     ret = krb5_crypto_init(context, key, 0, &crypto);
547     if (ret) {
548         free(data.data);
549         free_PA_ClientCanonicalized(&canon);
550         return ret;
551     }
552
553     ret = krb5_verify_checksum(context, crypto, KRB5_KU_CANONICALIZED_NAMES,
554                                data.data, data.length,
555                                &canon.canon_checksum);
556     krb5_crypto_destroy(context, crypto);
557     free(data.data);
558     if (ret) {
559         krb5_set_error_message(context, ret,
560                                N_("Failed to verify client canonicalized "
561                                   "data from realm %s", ""),
562                                requested->realm);
563         free_PA_ClientCanonicalized(&canon);
564         return ret;
565     }
566
567     if (!_krb5_principal_compare_PrincipalName(context,
568                                                requested,
569                                                &canon.names.requested_name))
570     {
571         free_PA_ClientCanonicalized(&canon);
572         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
573                                N_("Requested name doesn't match"
574                                   " in client referral", ""));
575         return KRB5_PRINC_NOMATCH;
576     }
577     if (!_krb5_principal_compare_PrincipalName(context,
578                                                mapped,
579                                                &canon.names.mapped_name))
580     {
581         free_PA_ClientCanonicalized(&canon);
582         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
583                                N_("Mapped name doesn't match"
584                                   " in client referral", ""));
585         return KRB5_PRINC_NOMATCH;
586     }
587
588     return 0;
589
590 noreferral:
591     if (krb5_principal_compare(context, requested, mapped) == FALSE) {
592         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
593                                N_("Not same client principal returned "
594                                   "as requested", ""));
595         return KRB5KRB_AP_ERR_MODIFIED;
596     }
597     return 0;
598 }
599
600
601 static krb5_error_code
602 decrypt_tkt (krb5_context context,
603              krb5_keyblock *key,
604              krb5_key_usage usage,
605              krb5_const_pointer decrypt_arg,
606              krb5_kdc_rep *dec_rep)
607 {
608     krb5_error_code ret;
609     krb5_data data;
610     size_t size;
611     krb5_crypto crypto;
612
613     ret = krb5_crypto_init(context, key, 0, &crypto);
614     if (ret)
615         return ret;
616
617     ret = krb5_decrypt_EncryptedData (context,
618                                       crypto,
619                                       usage,
620                                       &dec_rep->kdc_rep.enc_part,
621                                       &data);
622     krb5_crypto_destroy(context, crypto);
623
624     if (ret)
625         return ret;
626
627     ret = decode_EncASRepPart(data.data,
628                               data.length,
629                               &dec_rep->enc_part,
630                               &size);
631     if (ret)
632         ret = decode_EncTGSRepPart(data.data,
633                                    data.length,
634                                    &dec_rep->enc_part,
635                                    &size);
636     krb5_data_free (&data);
637     if (ret) {
638         krb5_set_error_message(context, ret, 
639                                N_("Failed to decode encpart in ticket", ""));
640         return ret;
641     }
642     return 0;
643 }
644
645 int
646 _krb5_extract_ticket(krb5_context context,
647                      krb5_kdc_rep *rep,
648                      krb5_creds *creds,
649                      krb5_keyblock *key,
650                      krb5_const_pointer keyseed,
651                      krb5_key_usage key_usage,
652                      krb5_addresses *addrs,
653                      unsigned nonce,
654                      unsigned flags,
655                      krb5_decrypt_proc decrypt_proc,
656                      krb5_const_pointer decryptarg)
657 {
658     krb5_error_code ret;
659     krb5_principal tmp_principal;
660     size_t len;
661     time_t tmp_time;
662     krb5_timestamp sec_now;
663
664     /* decrypt */
665
666     if (decrypt_proc == NULL)
667         decrypt_proc = decrypt_tkt;
668
669     ret = (*decrypt_proc)(context, key, key_usage, decryptarg, rep);
670     if (ret)
671         goto out;
672
673     /* save session key */
674
675     creds->session.keyvalue.length = 0;
676     creds->session.keyvalue.data   = NULL;
677     creds->session.keytype = rep->enc_part.key.keytype;
678     ret = krb5_data_copy (&creds->session.keyvalue,
679                           rep->enc_part.key.keyvalue.data,
680                           rep->enc_part.key.keyvalue.length);
681     if (ret) {
682         krb5_clear_error_message(context);
683         goto out;
684     }
685
686     /*
687      * HACK:
688      * this is really a ugly hack, to support using the Netbios Domain Name
689      * as realm against windows KDC's, they always return the full realm
690      * based on the DNS Name.
691      */
692     flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
693     flags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
694
695     /* compare client and save */
696     ret = _krb5_principalname2krb5_principal (context,
697                                               &tmp_principal,
698                                               rep->kdc_rep.cname,
699                                               rep->kdc_rep.crealm);
700     if (ret)
701         goto out;
702
703     /* check client referral and save principal */
704     /* anonymous here ? */
705     if((flags & EXTRACT_TICKET_ALLOW_CNAME_MISMATCH) == 0) {
706         ret = check_client_referral(context, rep,
707                                     creds->client,
708                                     tmp_principal,
709                                     &creds->session);
710         if (ret) {
711             krb5_free_principal (context, tmp_principal);
712             goto out;
713         }
714     }
715     krb5_free_principal (context, creds->client);
716     creds->client = tmp_principal;
717
718     /* check server referral and save principal */
719     ret = _krb5_principalname2krb5_principal (context,
720                                               &tmp_principal,
721                                               rep->kdc_rep.ticket.sname,
722                                               rep->kdc_rep.ticket.realm);
723     if (ret)
724         goto out;
725     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
726         ret = check_server_referral(context,
727                                     rep,
728                                     flags,
729                                     creds->server,
730                                     tmp_principal,
731                                     &creds->session);
732         if (ret) {
733             krb5_free_principal (context, tmp_principal);
734             goto out;
735         }
736     }
737     krb5_free_principal(context, creds->server);
738     creds->server = tmp_principal;
739
740     /* verify names */
741     if(flags & EXTRACT_TICKET_MATCH_REALM){
742         const char *srealm = krb5_principal_get_realm(context, creds->server);
743         const char *crealm = krb5_principal_get_realm(context, creds->client);
744
745         if (strcmp(rep->enc_part.srealm, srealm) != 0 ||
746             strcmp(rep->enc_part.srealm, crealm) != 0)
747         {
748             ret = KRB5KRB_AP_ERR_MODIFIED;
749             krb5_clear_error_message(context);
750             goto out;
751         }
752     }
753
754     /* compare nonces */
755
756     if (nonce != rep->enc_part.nonce) {
757         ret = KRB5KRB_AP_ERR_MODIFIED;
758         krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
759         goto out;
760     }
761
762     /* set kdc-offset */
763
764     krb5_timeofday (context, &sec_now);
765     if (rep->enc_part.flags.initial
766         && (flags & EXTRACT_TICKET_TIMESYNC)
767         && context->kdc_sec_offset == 0
768         && krb5_config_get_bool (context, NULL,
769                                  "libdefaults",
770                                  "kdc_timesync",
771                                  NULL)) {
772         context->kdc_sec_offset = rep->enc_part.authtime - sec_now;
773         krb5_timeofday (context, &sec_now);
774     }
775
776     /* check all times */
777
778     if (rep->enc_part.starttime) {
779         tmp_time = *rep->enc_part.starttime;
780     } else
781         tmp_time = rep->enc_part.authtime;
782
783     if (creds->times.starttime == 0
784         && abs(tmp_time - sec_now) > context->max_skew) {
785         ret = KRB5KRB_AP_ERR_SKEW;
786         krb5_set_error_message (context, ret,
787                                 N_("time skew (%d) larger than max (%d)", ""),
788                                abs(tmp_time - sec_now),
789                                (int)context->max_skew);
790         goto out;
791     }
792
793     if (creds->times.starttime != 0
794         && tmp_time != creds->times.starttime) {
795         krb5_clear_error_message (context);
796         ret = KRB5KRB_AP_ERR_MODIFIED;
797         goto out;
798     }
799
800     creds->times.starttime = tmp_time;
801
802     if (rep->enc_part.renew_till) {
803         tmp_time = *rep->enc_part.renew_till;
804     } else
805         tmp_time = 0;
806
807     if (creds->times.renew_till != 0
808         && tmp_time > creds->times.renew_till) {
809         krb5_clear_error_message (context);
810         ret = KRB5KRB_AP_ERR_MODIFIED;
811         goto out;
812     }
813
814     creds->times.renew_till = tmp_time;
815
816     creds->times.authtime = rep->enc_part.authtime;
817
818     if (creds->times.endtime != 0
819         && rep->enc_part.endtime > creds->times.endtime) {
820         krb5_clear_error_message (context);
821         ret = KRB5KRB_AP_ERR_MODIFIED;
822         goto out;
823     }
824
825     creds->times.endtime  = rep->enc_part.endtime;
826
827     if(rep->enc_part.caddr)
828         krb5_copy_addresses (context, rep->enc_part.caddr, &creds->addresses);
829     else if(addrs)
830         krb5_copy_addresses (context, addrs, &creds->addresses);
831     else {
832         creds->addresses.len = 0;
833         creds->addresses.val = NULL;
834     }
835     creds->flags.b = rep->enc_part.flags;
836         
837     creds->authdata.len = 0;
838     creds->authdata.val = NULL;
839
840     /* extract ticket */
841     ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length,
842                        &rep->kdc_rep.ticket, &len, ret);
843     if(ret)
844         goto out;
845     if (creds->ticket.length != len)
846         krb5_abortx(context, "internal error in ASN.1 encoder");
847     creds->second_ticket.length = 0;
848     creds->second_ticket.data   = NULL;
849
850
851 out:
852     memset (rep->enc_part.key.keyvalue.data, 0,
853             rep->enc_part.key.keyvalue.length);
854     return ret;
855 }