source/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  24 #define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
  25
  26 #include "includes.h"
  27
  28 #ifdef HAVE_KRB5
  29
  30 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
  31 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  32 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  33 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  34 #else /* MIT */
  35 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  36 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  37 #define KRB5_KEY_DATA(k)        ((k)->contents)
  38 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  39
  40 /**************************************************************
  41  Wrappers around kerberos string functions that convert from
  42  utf8 -> unix charset and vica versa.
  43 **************************************************************/
  44
  45 /**************************************************************
  46  krb5_parse_name that takes a UNIX charset.
  47 **************************************************************/
  48
  49  krb5_error_code smb_krb5_parse_name(krb5_context context,
  50                                 const char *name, /* in unix charset */
  51                                 krb5_principal *principal)
  52 {
  53         krb5_error_code ret;
  54         char *utf8_name;
  55
  56         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  57                 return ENOMEM;
  58         }
  59
  60         ret = krb5_parse_name(context, utf8_name, principal);
  61         SAFE_FREE(utf8_name);
  62         return ret;
  63 }
  64
  65 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
  66 /**************************************************************
  67  krb5_parse_name_norealm that takes a UNIX charset.
  68 **************************************************************/
  69
  70 static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
  71                                 const char *name, /* in unix charset */
  72                                 krb5_principal *principal)
  73 {
  74         krb5_error_code ret;
  75         char *utf8_name;
  76
  77         *principal = NULL;
  78         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  79                 return ENOMEM;
  80         }
  81
  82         ret = krb5_parse_name_norealm(context, utf8_name, principal);
  83         SAFE_FREE(utf8_name);
  84         return ret;
  85 }
  86 #endif
  87
  88 /**************************************************************
  89  krb5_parse_name that returns a UNIX charset name. Must
  90  be freed with normal free() call.
  91 **************************************************************/
  92
  93  krb5_error_code smb_krb5_unparse_name(krb5_context context,
  94                                         krb5_const_principal principal,
  95                                         char **unix_name)
  96 {
  97         krb5_error_code ret;
  98         char *utf8_name;
  99
 100         *unix_name = NULL;
 101         ret = krb5_unparse_name(context, principal, &utf8_name);
 102         if (ret) {
 103                 return ret;
 104         }
 105
 106         if (pull_utf8_allocate(unix_name, utf8_name)==-1) {
 107                 krb5_free_unparsed_name(context, utf8_name);
 108                 return ENOMEM;
 109         }
 110         krb5_free_unparsed_name(context, utf8_name);
 111         return 0;
 112 }
 113
 114 #ifndef HAVE_KRB5_SET_REAL_TIME
 115 /*
 116  * This function is not in the Heimdal mainline.
 117  */
 118  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
 119 {
 120         krb5_error_code ret;
 121         int32_t sec, usec;
 122
 123         ret = krb5_us_timeofday(context, &sec, &usec);
 124         if (ret)
 125                 return ret;
 126
 127         context->kdc_sec_offset = seconds - sec;
 128         context->kdc_usec_offset = microseconds - usec;
 129
 130         return 0;
 131 }
 132 #endif
 133
 134 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
 135
 136 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
 137
 138 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
 139  * to krb5_set_default_tgs_ktypes. See
 140  *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
 141  *
 142  * If the MIT libraries are not exporting internal symbols, we will end up in
 143  * this branch, which is correct. Otherwise we will continue to use the
 144  * internal symbol
 145  */
 146  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 147 {
 148     return krb5_set_default_tgs_enctypes(ctx, enc);
 149 }
 150
 151 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
 152
 153 /* Heimdal */
 154  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 155 {
 156         return krb5_set_default_in_tkt_etypes(ctx, enc);
 157 }
 158
 159 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
 160
 161 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
 162
 163 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
 164 /* HEIMDAL */
 165  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
 166 {
 167         pkaddr->addr_type = KRB5_ADDRESS_INET;
 168         pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 169         pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 170 }
 171 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 172 /* MIT */
 173  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
 174 {
 175         pkaddr->addrtype = ADDRTYPE_INET;
 176         pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 177         pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 178 }
 179 #else
 180 #error UNKNOWN_ADDRTYPE
 181 #endif
 182
 183 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
 184  int create_kerberos_key_from_string_direct(krb5_context context,
 185                                         krb5_principal host_princ,
 186                                         krb5_data *password,
 187                                         krb5_keyblock *key,
 188                                         krb5_enctype enctype)
 189 {
 190         int ret;
 191         krb5_data salt;
 192         krb5_encrypt_block eblock;
 193
 194         ret = krb5_principal2salt(context, host_princ, &salt);
 195         if (ret) {
 196                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 197                 return ret;
 198         }
 199         krb5_use_enctype(context, &eblock, enctype);
 200         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
 201         SAFE_FREE(salt.data);
 202         return ret;
 203 }
 204 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 205  int create_kerberos_key_from_string_direct(krb5_context context,
 206                                         krb5_principal host_princ,
 207                                         krb5_data *password,
 208                                         krb5_keyblock *key,
 209                                         krb5_enctype enctype)
 210 {
 211         int ret;
 212         krb5_salt salt;
 213
 214         ret = krb5_get_pw_salt(context, host_princ, &salt);
 215         if (ret) {
 216                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 217                 return ret;
 218         }
 219
 220         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
 221         krb5_free_salt(context, salt);
 222         return ret;
 223 }
 224 #else
 225 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 226 #endif
 227
 228  int create_kerberos_key_from_string(krb5_context context,
 229                                         krb5_principal host_princ,
 230                                         krb5_data *password,
 231                                         krb5_keyblock *key,
 232                                         krb5_enctype enctype)
 233 {
 234         krb5_principal salt_princ = NULL;
 235         int ret;
 236         /*
 237          * Check if we've determined that the KDC is salting keys for this
 238          * principal/enctype in a non-obvious way.  If it is, try to match
 239          * its behavior.
 240          */
 241         salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
 242         ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
 243         if (salt_princ) {
 244                 krb5_free_principal(context, salt_princ);
 245         }
 246         return ret;
 247 }
 248
 249 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 250  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 251                                             krb5_enctype **enctypes)
 252 {
 253         return krb5_get_permitted_enctypes(context, enctypes);
 254 }
 255 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 256  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 257                                             krb5_enctype **enctypes)
 258 {
 259         return krb5_get_default_in_tkt_etypes(context, enctypes);
 260 }
 261 #else
 262 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 263 #endif
 264
 265 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 266  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 267                                         krb5_auth_context auth_context,
 268                                         krb5_keyblock *keyblock)
 269 {
 270         return krb5_auth_con_setkey(context, auth_context, keyblock);
 271 }
 272 #endif
 273
 274 bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
 275                            DATA_BLOB *edata,
 276                            DATA_BLOB *edata_out)
 277 {
 278         DATA_BLOB edata_contents;
 279         ASN1_DATA data;
 280         int edata_type;
 281
 282         if (!edata->length) {
 283                 return False;
 284         }
 285
 286         asn1_load(&data, *edata);
 287         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 288         asn1_start_tag(&data, ASN1_CONTEXT(1));
 289         asn1_read_Integer(&data, &edata_type);
 290
 291         if (edata_type != KRB5_PADATA_PW_SALT) {
 292                 DEBUG(0,("edata is not of required type %d but of type %d\n",
 293                         KRB5_PADATA_PW_SALT, edata_type));
 294                 asn1_free(&data);
 295                 return False;
 296         }
 297
 298         asn1_start_tag(&data, ASN1_CONTEXT(2));
 299         asn1_read_OctetString(&data, &edata_contents);
 300         asn1_end_tag(&data);
 301         asn1_end_tag(&data);
 302         asn1_end_tag(&data);
 303         asn1_free(&data);
 304
 305         *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
 306
 307         data_blob_free(&edata_contents);
 308
 309         return True;
 310 }
 311
 312
 313 bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 314 {
 315         DATA_BLOB pac_contents;
 316         ASN1_DATA data;
 317         int data_type;
 318
 319         if (!auth_data->length) {
 320                 return False;
 321         }
 322
 323         asn1_load(&data, *auth_data);
 324         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 325         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 326         asn1_start_tag(&data, ASN1_CONTEXT(0));
 327         asn1_read_Integer(&data, &data_type);
 328
 329         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 330                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 331                 asn1_free(&data);
 332                 return False;
 333         }
 334
 335         asn1_end_tag(&data);
 336         asn1_start_tag(&data, ASN1_CONTEXT(1));
 337         asn1_read_OctetString(&data, &pac_contents);
 338         asn1_end_tag(&data);
 339         asn1_end_tag(&data);
 340         asn1_end_tag(&data);
 341         asn1_free(&data);
 342
 343         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 344
 345         data_blob_free(&pac_contents);
 346
 347         return True;
 348 }
 349
 350  bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 351 {
 352         DATA_BLOB auth_data_wrapped;
 353         bool got_auth_data_pac = False;
 354         int i;
 355
 356 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 357         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 358             tkt->enc_part2->authorization_data[0] &&
 359             tkt->enc_part2->authorization_data[0]->length)
 360         {
 361                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 362
 363                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 364                             KRB5_AUTHDATA_IF_RELEVANT) {
 365                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 366                                         tkt->enc_part2->authorization_data[i]->ad_type));
 367                                 continue;
 368                         }
 369
 370                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 371                                                       tkt->enc_part2->authorization_data[i]->length);
 372
 373                         /* check if it is a PAC */
 374                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 375                         data_blob_free(&auth_data_wrapped);
 376
 377                         if (!got_auth_data_pac) {
 378                                 continue;
 379                         }
 380                 }
 381
 382                 return got_auth_data_pac;
 383         }
 384
 385 #else
 386         if (tkt->ticket.authorization_data &&
 387             tkt->ticket.authorization_data->len)
 388         {
 389                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 390
 391                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 392                             KRB5_AUTHDATA_IF_RELEVANT) {
 393                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 394                                         tkt->ticket.authorization_data->val[i].ad_type));
 395                                 continue;
 396                         }
 397
 398                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 399                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 400
 401                         /* check if it is a PAC */
 402                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 403                         data_blob_free(&auth_data_wrapped);
 404
 405                         if (!got_auth_data_pac) {
 406                                 continue;
 407                         }
 408                 }
 409
 410                 return got_auth_data_pac;
 411         }
 412 #endif
 413         return False;
 414 }
 415
 416  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 417 {
 418 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 419         return tkt->enc_part2->client;
 420 #else
 421         return tkt->client;
 422 #endif
 423 }
 424
 425 #if !defined(HAVE_KRB5_LOCATE_KDC)
 426
 427 /* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
 428  * to a public interface for this functionality, so we have to be able to live
 429  * without it if the MIT libraries are hiding their internal symbols.
 430  */
 431
 432 #if defined(KRB5_KRBHST_INIT)
 433 /* Heimdal */
 434  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 435 {
 436         krb5_krbhst_handle hnd;
 437         krb5_krbhst_info *hinfo;
 438         krb5_error_code rc;
 439         int num_kdcs, i;
 440         struct sockaddr *sa;
 441         struct addrinfo *ai;
 442
 443         *addr_pp = NULL;
 444         *naddrs = 0;
 445
 446         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 447         if (rc) {
 448                 DEBUG(0, ("smb_krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 449                 return rc;
 450         }
 451
 452         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 453                 ;
 454
 455         krb5_krbhst_reset(ctx, hnd);
 456
 457         if (!num_kdcs) {
 458                 DEBUG(0, ("smb_krb5_locate_kdc: zero kdcs found !\n"));
 459                 krb5_krbhst_free(ctx, hnd);
 460                 return -1;
 461         }
 462
 463         sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
 464         if (!sa) {
 465                 DEBUG(0, ("smb_krb5_locate_kdc: malloc failed\n"));
 466                 krb5_krbhst_free(ctx, hnd);
 467                 naddrs = 0;
 468                 return -1;
 469         }
 470
 471         memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
 472
 473         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 474
 475 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
 476                 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
 477                 if (rc) {
 478                         DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
 479                         continue;
 480                 }
 481 #endif
 482                 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
 483                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 484         }
 485
 486         krb5_krbhst_free(ctx, hnd);
 487
 488         *naddrs = num_kdcs;
 489         *addr_pp = sa;
 490         return 0;
 491 }
 492
 493 #else /* ! defined(KRB5_KRBHST_INIT) */
 494
 495  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 496                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 497 {
 498         DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
 499         return KRB5_KDC_UNREACH;
 500 }
 501
 502 #endif /* KRB5_KRBHST_INIT */
 503
 504 #else /* ! HAVE_KRB5_LOCATE_KDC */
 505
 506  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 507                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 508 {
 509         return krb5_locate_kdc(ctx, realm, addr_pp, naddrs, get_masters);
 510 }
 511
 512 #endif /* HAVE_KRB5_LOCATE_KDC */
 513
 514 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 515  void krb5_free_unparsed_name(krb5_context context, char *val)
 516 {
 517         SAFE_FREE(val);
 518 }
 519 #endif
 520
 521  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 522 {
 523 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 524         if (pdata->data) {
 525                 krb5_free_data_contents(context, pdata);
 526         }
 527 #else
 528         SAFE_FREE(pdata->data);
 529 #endif
 530 }
 531
 532  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 533 {
 534 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 535         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 536 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 537         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 538 #else
 539 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 540 #endif
 541 }
 542
 543  bool kerberos_compatible_enctypes(krb5_context context,
 544                                   krb5_enctype enctype1,
 545                                   krb5_enctype enctype2)
 546 {
 547 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 548         krb5_boolean similar = 0;
 549
 550         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 551         return similar ? True : False;
 552 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 553         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 554 #endif
 555 }
 556
 557 static bool ads_cleanup_expired_creds(krb5_context context,
 558                                       krb5_ccache  ccache,
 559                                       krb5_creds  *credsp)
 560 {
 561         krb5_error_code retval;
 562         const char *cc_type = krb5_cc_get_type(context, ccache);
 563
 564         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 565                   cc_type, krb5_cc_get_name(context, ccache),
 566                   http_timestring(credsp->times.endtime)));
 567
 568         /* we will probably need new tickets if the current ones
 569            will expire within 10 seconds.
 570         */
 571         if (credsp->times.endtime >= (time(NULL) + 10))
 572                 return False;
 573
 574         /* heimdal won't remove creds from a file ccache, and
 575            perhaps we shouldn't anyway, since internally we
 576            use memory ccaches, and a FILE one probably means that
 577            we're using creds obtained outside of our exectuable
 578         */
 579         if (strequal(cc_type, "FILE")) {
 580                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 581                 return False;
 582         }
 583
 584         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 585         if (retval) {
 586                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 587                           error_message(retval)));
 588                 /* If we have an error in this, we want to display it,
 589                    but continue as though we deleted it */
 590         }
 591         return True;
 592 }
 593
 594 /*
 595   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 596 */
 597 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 598                                        krb5_auth_context *auth_context,
 599                                        const krb5_flags ap_req_options,
 600                                        const char *principal,
 601                                        krb5_ccache ccache,
 602                                        krb5_data *outbuf,
 603                                        time_t *expire_time)
 604 {
 605         krb5_error_code           retval;
 606         krb5_principal    server;
 607         krb5_creds              * credsp;
 608         krb5_creds                creds;
 609         krb5_data in_data;
 610         bool creds_ready = False;
 611         int i = 0, maxtries = 3;
 612
 613         retval = smb_krb5_parse_name(context, principal, &server);
 614         if (retval) {
 615                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 616                 return retval;
 617         }
 618
 619         /* obtain ticket & session key */
 620         ZERO_STRUCT(creds);
 621         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 622                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 623                          error_message(retval)));
 624                 goto cleanup_princ;
 625         }
 626
 627         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 628                 /* This can commonly fail on smbd startup with no ticket in the cache.
 629                  * Report at higher level than 1. */
 630                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 631                          error_message(retval)));
 632                 goto cleanup_creds;
 633         }
 634
 635         while (!creds_ready && (i < maxtries)) {
 636
 637                 if ((retval = krb5_get_credentials(context, 0, ccache,
 638                                                    &creds, &credsp))) {
 639                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 640                                  principal, error_message(retval)));
 641                         goto cleanup_creds;
 642                 }
 643
 644                 /* cope with ticket being in the future due to clock skew */
 645                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 646                         time_t t = time(NULL);
 647                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 648                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 649                         krb5_set_real_time(context, t + time_offset + 1, 0);
 650                 }
 651
 652                 if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
 653                         creds_ready = True;
 654                 }
 655
 656                 i++;
 657         }
 658
 659         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 660                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 661                   http_timestring((unsigned)credsp->times.endtime),
 662                   (unsigned)credsp->times.endtime));
 663
 664         if (expire_time) {
 665                 *expire_time = (time_t)credsp->times.endtime;
 666         }
 667
 668         in_data.length = 0;
 669         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 670                                       &in_data, credsp, outbuf);
 671         if (retval) {
 672                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 673                          error_message(retval)));
 674         }
 675
 676         krb5_free_creds(context, credsp);
 677
 678 cleanup_creds:
 679         krb5_free_cred_contents(context, &creds);
 680
 681 cleanup_princ:
 682         krb5_free_principal(context, server);
 683
 684         return retval;
 685 }
 686
 687 /*
 688   get a kerberos5 ticket for the given service
 689 */
 690 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 691                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 692                         uint32 extra_ap_opts, const char *ccname,
 693                         time_t *tgs_expire)
 694
 695 {
 696         krb5_error_code retval;
 697         krb5_data packet;
 698         krb5_context context = NULL;
 699         krb5_ccache ccdef = NULL;
 700         krb5_auth_context auth_context = NULL;
 701         krb5_enctype enc_types[] = {
 702 #ifdef ENCTYPE_ARCFOUR_HMAC
 703                 ENCTYPE_ARCFOUR_HMAC,
 704 #endif
 705                 ENCTYPE_DES_CBC_MD5,
 706                 ENCTYPE_DES_CBC_CRC,
 707                 ENCTYPE_NULL};
 708
 709         initialize_krb5_error_table();
 710         retval = krb5_init_context(&context);
 711         if (retval) {
 712                 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
 713                          error_message(retval)));
 714                 goto failed;
 715         }
 716
 717         if (time_offset != 0) {
 718                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 719         }
 720
 721         if ((retval = krb5_cc_resolve(context, ccname ?
 722                         ccname : krb5_cc_default_name(context), &ccdef))) {
 723                 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
 724                          error_message(retval)));
 725                 goto failed;
 726         }
 727
 728         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 729                 DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
 730                          error_message(retval)));
 731                 goto failed;
 732         }
 733
 734         if ((retval = ads_krb5_mk_req(context,
 735                                         &auth_context,
 736                                         AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 737                                         principal,
 738                                         ccdef, &packet,
 739                                         tgs_expire))) {
 740                 goto failed;
 741         }
 742
 743         get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
 744
 745         *ticket = data_blob(packet.data, packet.length);
 746
 747         kerberos_free_data_contents(context, &packet);
 748
 749 failed:
 750
 751         if ( context ) {
 752                 if (ccdef)
 753                         krb5_cc_close(context, ccdef);
 754                 if (auth_context)
 755                         krb5_auth_con_free(context, auth_context);
 756                 krb5_free_context(context);
 757         }
 758
 759         return retval;
 760 }
 761
 762  bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
 763  {
 764         krb5_keyblock *skey;
 765         krb5_error_code err;
 766         bool ret = False;
 767
 768         if (remote)
 769                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 770         else
 771                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 772         if (err == 0 && skey != NULL) {
 773                 DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
 774                 *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 775                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 776
 777                 ret = True;
 778
 779                 krb5_free_keyblock(context, skey);
 780         } else {
 781                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 782         }
 783
 784         return ret;
 785  }
 786
 787
 788 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 789  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 790
 791  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 792 {
 793         static krb5_data kdata;
 794
 795         kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
 796         kdata.length = strlen((const char *)kdata.data);
 797         return &kdata;
 798 }
 799 #endif
 800
 801  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 802 {
 803 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
 804         return krb5_kt_free_entry(context, kt_entry);
 805 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 806         return krb5_free_keytab_entry_contents(context, kt_entry);
 807 #else
 808 #error UNKNOWN_KT_FREE_FUNCTION
 809 #endif
 810 }
 811
 812  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 813                                     PAC_SIGNATURE_DATA *sig)
 814 {
 815 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 816         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 817         cksum->checksum.length  = sig->signature.buf_len;
 818         cksum->checksum.data    = sig->signature.buffer;
 819 #else
 820         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 821         cksum->length           = sig->signature.buf_len;
 822         cksum->contents         = sig->signature.buffer;
 823 #endif
 824 }
 825
 826  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 827                                          krb5_keyblock *keyblock,
 828                                          krb5_keyusage usage,
 829                                          krb5_checksum *cksum,
 830                                          uint8 *data,
 831                                          size_t length)
 832 {
 833         krb5_error_code ret;
 834
 835         /* verify the checksum */
 836
 837         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 838          *
 839          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 840          * -----------------------------------------------------------------------------
 841          * krb5_c_verify_checksum       -                       works           works
 842          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 843          */
 844
 845 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 846         {
 847                 krb5_boolean checksum_valid = False;
 848                 krb5_data input;
 849
 850                 input.data = (char *)data;
 851                 input.length = length;
 852
 853                 ret = krb5_c_verify_checksum(context,
 854                                              keyblock,
 855                                              usage,
 856                                              &input,
 857                                              cksum,
 858                                              &checksum_valid);
 859                 if (ret) {
 860                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 861                                 error_message(ret)));
 862                         return ret;
 863                 }
 864
 865                 if (!checksum_valid)
 866                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 867         }
 868
 869 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 870
 871         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 872          * without enctype and it ignores any key_usage types - Guenther */
 873
 874         {
 875
 876                 krb5_crypto crypto;
 877                 ret = krb5_crypto_init(context,
 878                                        keyblock,
 879                                        0,
 880                                        &crypto);
 881                 if (ret) {
 882                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 883                                 error_message(ret)));
 884                         return ret;
 885                 }
 886
 887                 ret = krb5_verify_checksum(context,
 888                                            crypto,
 889                                            usage,
 890                                            data,
 891                                            length,
 892                                            cksum);
 893
 894                 krb5_crypto_destroy(context, crypto);
 895         }
 896
 897 #else
 898 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
 899 #endif
 900
 901         return ret;
 902 }
 903
 904  time_t get_authtime_from_tkt(krb5_ticket *tkt)
 905 {
 906 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 907         return tkt->enc_part2->times.authtime;
 908 #else
 909         return tkt->ticket.authtime;
 910 #endif
 911 }
 912
 913 #ifdef HAVE_KRB5_DECODE_AP_REQ  /* Heimdal */
 914 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
 915 {
 916 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
 917         if (ap_req->ticket->enc_part.kvno)
 918                 return ap_req->ticket->enc_part.kvno;
 919 #else /* Heimdal */
 920         if (ap_req->ticket.enc_part.kvno)
 921                 return *ap_req->ticket.enc_part.kvno;
 922 #endif
 923         return 0;
 924 }
 925
 926 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
 927 {
 928 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
 929         return ap_req->ticket.enc_part.etype;
 930 #else /* MIT */
 931         return ap_req->ticket->enc_part.enctype;
 932 #endif
 933 }
 934 #endif  /* HAVE_KRB5_DECODE_AP_REQ */
 935
 936 static krb5_error_code
 937 get_key_from_keytab(krb5_context context,
 938                     krb5_const_principal server,
 939                     krb5_enctype enctype,
 940                     krb5_kvno kvno,
 941                     krb5_keyblock **out_key)
 942 {
 943         krb5_keytab_entry entry;
 944         krb5_error_code ret;
 945         krb5_keytab keytab;
 946         char *name = NULL;
 947
 948         /* We have to open a new keytab handle here, as MIT does
 949            an implicit open/getnext/close on krb5_kt_get_entry. We
 950            may be in the middle of a keytab enumeration when this is
 951            called. JRA. */
 952
 953         ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
 954         if (ret) {
 955                 DEBUG(1,("get_key_from_keytab: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 956                 return ret;
 957         }
 958
 959         if ( DEBUGLEVEL >= 10 ) {
 960                 if (smb_krb5_unparse_name(context, server, &name) == 0) {
 961                         DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
 962                                 kvno, enctype, name));
 963                         SAFE_FREE(name);
 964                 }
 965         }
 966
 967         ret = krb5_kt_get_entry(context,
 968                                 keytab,
 969                                 server,
 970                                 kvno,
 971                                 enctype,
 972                                 &entry);
 973
 974         if (ret) {
 975                 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
 976                 goto out;
 977         }
 978
 979 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
 980         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
 981 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
 982         ret = krb5_copy_keyblock(context, &entry.key, out_key);
 983 #else
 984 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
 985 #endif
 986
 987         if (ret) {
 988                 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
 989                 goto out;
 990         }
 991
 992         smb_krb5_kt_free_entry(context, &entry);
 993
 994 out:
 995         krb5_kt_close(context, keytab);
 996         return ret;
 997 }
 998
 999 /* Prototypes */
1000
1001  krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
1002                                                  const krb5_data *inbuf,
1003                                                  krb5_kvno *kvno,
1004                                                  krb5_enctype *enctype)
1005 {
1006 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1007         {
1008                 krb5_error_code ret;
1009                 krb5_ap_req ap_req;
1010
1011                 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
1012                 if (ret)
1013                         return ret;
1014
1015                 *kvno = get_kvno_from_ap_req(&ap_req);
1016                 *enctype = get_enctype_from_ap_req(&ap_req);
1017
1018                 free_AP_REQ(&ap_req);
1019                 return 0;
1020         }
1021 #endif
1022
1023         /* Possibly not an appropriate error code. */
1024         return KRB5KDC_ERR_BADOPTION;
1025 }
1026
1027  krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
1028                                                         krb5_auth_context *auth_context,
1029                                                         const krb5_data *inbuf,
1030                                                         krb5_const_principal server,
1031                                                         krb5_keytab keytab,
1032                                                         krb5_flags *ap_req_options,
1033                                                         krb5_ticket **ticket,
1034                                                         krb5_keyblock **keyblock)
1035 {
1036         krb5_error_code ret;
1037         krb5_kvno kvno;
1038         krb5_enctype enctype;
1039         krb5_keyblock *local_keyblock;
1040
1041         ret = krb5_rd_req(context,
1042                           auth_context,
1043                           inbuf,
1044                           server,
1045                           keytab,
1046                           ap_req_options,
1047                           ticket);
1048         if (ret) {
1049                 return ret;
1050         }
1051
1052 #ifdef KRB5_TICKET_HAS_KEYINFO
1053         enctype = (*ticket)->enc_part.enctype;
1054         kvno = (*ticket)->enc_part.kvno;
1055 #else
1056         ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
1057         if (ret) {
1058                 return ret;
1059         }
1060 #endif
1061
1062         ret = get_key_from_keytab(context,
1063                                   server,
1064                                   enctype,
1065                                   kvno,
1066                                   &local_keyblock);
1067         if (ret) {
1068                 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
1069                 goto out;
1070         }
1071
1072 out:
1073         if (ret && local_keyblock != NULL) {
1074                 krb5_free_keyblock(context, local_keyblock);
1075         } else {
1076                 *keyblock = local_keyblock;
1077         }
1078
1079         return ret;
1080 }
1081
1082  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
1083                                             const char *name,
1084                                             krb5_principal *principal)
1085 {
1086 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
1087         return smb_krb5_parse_name_norealm_conv(context, name, principal);
1088 #endif
1089
1090         /* we are cheating here because parse_name will in fact set the realm.
1091          * We don't care as the only caller of smb_krb5_parse_name_norealm
1092          * ignores the realm anyway when calling
1093          * smb_krb5_principal_compare_any_realm later - Guenther */
1094
1095         return smb_krb5_parse_name(context, name, principal);
1096 }
1097
1098  bool smb_krb5_principal_compare_any_realm(krb5_context context,
1099                                           krb5_const_principal princ1,
1100                                           krb5_const_principal princ2)
1101 {
1102 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1103
1104         return krb5_principal_compare_any_realm(context, princ1, princ2);
1105
1106 /* krb5_princ_size is a macro in MIT */
1107 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
1108
1109         int i, len1, len2;
1110         const krb5_data *p1, *p2;
1111
1112         len1 = krb5_princ_size(context, princ1);
1113         len2 = krb5_princ_size(context, princ2);
1114
1115         if (len1 != len2)
1116                 return False;
1117
1118         for (i = 0; i < len1; i++) {
1119
1120                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1121                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1122
1123                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
1124                         return False;
1125         }
1126
1127         return True;
1128 #else
1129 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1130 #endif
1131 }
1132
1133  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
1134                                        const char *client_string,       /* gd@BER.SUSE.DE */
1135                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1136                                        time_t *expire_time)
1137 {
1138         krb5_error_code ret;
1139         krb5_context context = NULL;
1140         krb5_ccache ccache = NULL;
1141         krb5_principal client = NULL;
1142         krb5_creds creds, creds_in, *creds_out = NULL;
1143
1144         ZERO_STRUCT(creds);
1145         ZERO_STRUCT(creds_in);
1146
1147         initialize_krb5_error_table();
1148         ret = krb5_init_context(&context);
1149         if (ret) {
1150                 goto done;
1151         }
1152
1153         if (!ccache_string) {
1154                 ccache_string = krb5_cc_default_name(context);
1155         }
1156
1157         if (!ccache_string) {
1158                 ret = EINVAL;
1159                 goto done;
1160         }
1161
1162         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1163
1164         /* FIXME: we should not fall back to defaults */
1165         ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1166         if (ret) {
1167                 goto done;
1168         }
1169
1170         if (client_string) {
1171                 ret = smb_krb5_parse_name(context, client_string, &client);
1172                 if (ret) {
1173                         goto done;
1174                 }
1175         } else {
1176                 ret = krb5_cc_get_principal(context, ccache, &client);
1177                 if (ret) {
1178                         goto done;
1179                 }
1180         }
1181
1182 #ifdef HAVE_KRB5_GET_RENEWED_CREDS      /* MIT */
1183         {
1184                 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1185                 if (ret) {
1186                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1187                         goto done;
1188                 }
1189         }
1190 #elif defined(HAVE_KRB5_GET_KDC_CRED)   /* Heimdal */
1191         {
1192                 krb5_kdc_flags flags;
1193                 krb5_realm *client_realm = NULL;
1194
1195                 ret = krb5_copy_principal(context, client, &creds_in.client);
1196                 if (ret) {
1197                         goto done;
1198                 }
1199
1200                 if (service_string) {
1201                         ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1202                         if (ret) {
1203                                 goto done;
1204                         }
1205                 } else {
1206                         /* build tgt service by default */
1207                         client_realm = krb5_princ_realm(context, creds_in.client);
1208                         if (!client_realm) {
1209                                 ret = ENOMEM;
1210                                 goto done;
1211                         }
1212                         ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1213                         if (ret) {
1214                                 goto done;
1215                         }
1216                 }
1217
1218                 flags.i = 0;
1219                 flags.b.renewable = flags.b.renew = True;
1220
1221                 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds_out);
1222                 if (ret) {
1223                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1224                         goto done;
1225                 }
1226
1227                 creds = *creds_out;
1228         }
1229 #else
1230 #error NO_SUITABLE_KRB5_TICKET_RENEW_FUNCTION_AVAILABLE
1231 #endif
1232
1233         /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1234         ret = krb5_cc_initialize(context, ccache, client);
1235         if (ret) {
1236                 goto done;
1237         }
1238
1239         ret = krb5_cc_store_cred(context, ccache, &creds);
1240
1241         if (expire_time) {
1242                 *expire_time = (time_t) creds.times.endtime;
1243         }
1244
1245 done:
1246         krb5_free_cred_contents(context, &creds_in);
1247
1248         if (creds_out) {
1249                 krb5_free_creds(context, creds_out);
1250         } else {
1251                 krb5_free_cred_contents(context, &creds);
1252         }
1253
1254         if (client) {
1255                 krb5_free_principal(context, client);
1256         }
1257         if (ccache) {
1258                 krb5_cc_close(context, ccache);
1259         }
1260         if (context) {
1261                 krb5_free_context(context);
1262         }
1263
1264         return ret;
1265 }
1266
1267  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1268 {
1269         krb5_error_code ret = 0;
1270         if (addr == NULL) {
1271                 return ret;
1272         }
1273 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1274         krb5_free_addresses(context, addr->addrs);
1275 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1276         ret = krb5_free_addresses(context, addr->addrs);
1277         SAFE_FREE(addr->addrs);
1278 #endif
1279         SAFE_FREE(addr);
1280         addr = NULL;
1281         return ret;
1282 }
1283
1284  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1285 {
1286         krb5_error_code ret = 0;
1287         nstring buf;
1288 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1289         krb5_address **addrs = NULL;
1290 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1291         krb5_addresses *addrs = NULL;
1292 #endif
1293
1294         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
1295         if (*kerb_addr == NULL) {
1296                 return ENOMEM;
1297         }
1298
1299         put_name(buf, global_myname(), ' ', 0x20);
1300
1301 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1302         {
1303                 int num_addr = 2;
1304
1305                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
1306                 if (addrs == NULL) {
1307                         SAFE_FREE(kerb_addr);
1308                         return ENOMEM;
1309                 }
1310
1311                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
1312
1313                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1314                 if (addrs[0] == NULL) {
1315                         SAFE_FREE(addrs);
1316                         SAFE_FREE(kerb_addr);
1317                         return ENOMEM;
1318                 }
1319
1320                 addrs[0]->magic = KV5M_ADDRESS;
1321                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1322                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
1323                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1324                 if (addrs[0]->contents == NULL) {
1325                         SAFE_FREE(addrs[0]);
1326                         SAFE_FREE(addrs);
1327                         SAFE_FREE(kerb_addr);
1328                         return ENOMEM;
1329                 }
1330
1331                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
1332
1333                 addrs[1] = NULL;
1334         }
1335 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1336         {
1337                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1338                 if (addrs == NULL) {
1339                         SAFE_FREE(kerb_addr);
1340                         return ENOMEM;
1341                 }
1342
1343                 memset(addrs, 0, sizeof(krb5_addresses));
1344
1345                 addrs->len = 1;
1346                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1347                 if (addrs->val == NULL) {
1348                         SAFE_FREE(addrs);
1349                         SAFE_FREE(kerb_addr);
1350                         return ENOMEM;
1351                 }
1352
1353                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1354                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1355                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1356                 if (addrs->val[0].address.data == NULL) {
1357                         SAFE_FREE(addrs->val);
1358                         SAFE_FREE(addrs);
1359                         SAFE_FREE(kerb_addr);
1360                         return ENOMEM;
1361                 }
1362
1363                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1364         }
1365 #else
1366 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1367 #endif
1368         (*kerb_addr)->addrs = addrs;
1369
1370         return ret;
1371 }
1372
1373  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1374 {
1375 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1376         krb5_free_error_contents(context, krberror);
1377 #else /* MIT */
1378         krb5_free_error(context, krberror);
1379 #endif
1380 }
1381
1382  krb5_error_code handle_krberror_packet(krb5_context context,
1383                                         krb5_data *packet)
1384 {
1385         krb5_error_code ret;
1386         bool got_error_code = False;
1387
1388         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1389
1390 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1391         {
1392                 krb5_error krberror;
1393
1394                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1395                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1396                                 error_message(ret)));
1397                         return ret;
1398                 }
1399
1400                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1401                         ret = (krb5_error_code) krberror.error_code;
1402                         got_error_code = True;
1403                 }
1404
1405                 smb_krb5_free_error(context, &krberror);
1406         }
1407 #else /* MIT */
1408         {
1409                 krb5_error *krberror;
1410
1411                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1412                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1413                                 error_message(ret)));
1414                         return ret;
1415                 }
1416
1417                 if (krberror->e_data.data == NULL) {
1418                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1419                         got_error_code = True;
1420                 }
1421                 smb_krb5_free_error(context, krberror);
1422         }
1423 #endif
1424         if (got_error_code) {
1425                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1426                         error_message(ret), ret));
1427         }
1428         return ret;
1429 }
1430
1431  krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1432                                             krb5_get_init_creds_opt **opt)
1433 {
1434 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
1435         /* Heimdal or modern MIT version */
1436         return krb5_get_init_creds_opt_alloc(context, opt);
1437 #else
1438         /* Historical MIT version */
1439         krb5_get_init_creds_opt *my_opt;
1440
1441         *opt = NULL;
1442
1443         if ((my_opt = SMB_MALLOC_P(krb5_get_init_creds_opt)) == NULL) {
1444                 return ENOMEM;
1445         }
1446
1447         krb5_get_init_creds_opt_init(my_opt);
1448
1449         *opt =  my_opt;
1450         return 0;
1451 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC  */
1452 }
1453
1454  void smb_krb5_get_init_creds_opt_free(krb5_context context,
1455                                 krb5_get_init_creds_opt *opt)
1456 {
1457 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
1458
1459 #ifdef KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT
1460         /* Modern MIT or Heimdal version */
1461         krb5_get_init_creds_opt_free(context, opt);
1462 #else
1463         /* Heimdal version */
1464         krb5_get_init_creds_opt_free(opt);
1465 #endif /* KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT */
1466
1467 #else /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1468         /* Historical MIT version */
1469         SAFE_FREE(opt);
1470         opt = NULL;
1471 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1472 }
1473
1474  krb5_enctype smb_get_enctype_from_kt_entry(const krb5_keytab_entry *kt_entry)
1475 {
1476 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
1477         return kt_entry->key.enctype;
1478 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)  /* Heimdal */
1479         return kt_entry->keyblock.keytype;
1480 #else
1481 #error UNKNOWN_KRB5_KEYTAB_ENTRY_KEYBLOCK_FORMAT
1482 #endif
1483 }
1484
1485
1486 /* caller needs to free etype_s */
1487  krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1488                                             krb5_enctype enctype,
1489                                             char **etype_s)
1490 {
1491 #ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1492         return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1493 #elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1494         char buf[256];
1495         krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1496         if (ret) {
1497                 return ret;
1498         }
1499         *etype_s = SMB_STRDUP(buf);
1500         if (!*etype_s) {
1501                 return ENOMEM;
1502         }
1503         return ret;
1504 #else
1505 #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1506 #endif
1507 }
1508
1509  krb5_error_code smb_krb5_mk_error(krb5_context context,
1510                                 krb5_error_code error_code,
1511                                 const krb5_principal server,
1512                                 krb5_data *reply)
1513 {
1514 #ifdef HAVE_SHORT_KRB5_MK_ERROR_INTERFACE /* MIT */
1515         /*
1516          * The MIT interface is *terrible*.
1517          * We have to construct this ourselves...
1518          */
1519         krb5_error e;
1520
1521         memset(&e, 0, sizeof(e));
1522         krb5_us_timeofday(context, &e.stime, &e.susec);
1523         e.server = server;
1524 #if defined(krb5_err_base)
1525         e.error = error_code - krb5_err_base;
1526 #elif defined(ERROR_TABLE_BASE_krb5)
1527         e.error = error_code - ERROR_TABLE_BASE_krb5;
1528 #else
1529         e.error = error_code; /* Almost certainly wrong, but what can we do... ? */
1530 #endif
1531
1532         return krb5_mk_error(context, &e, reply);
1533 #else /* Heimdal. */
1534         return krb5_mk_error(context,
1535                                 error_code,
1536                                 NULL,
1537                                 NULL, /* e_data */
1538                                 NULL,
1539                                 server,
1540                                 NULL,
1541                                 NULL,
1542                                 reply);
1543 #endif
1544 }
1545
1546 /**********************************************************************
1547  * Open a krb5 keytab with flags, handles readonly or readwrite access and
1548  * allows to process non-default keytab names.
1549  * @param context krb5_context
1550  * @param keytab_name_req string
1551  * @param write_access bool if writable keytab is required
1552  * @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1553  * @return krb5_error_code
1554 **********************************************************************/
1555
1556 /* This MAX_NAME_LEN is a constant defined in krb5.h */
1557 #ifndef MAX_KEYTAB_NAME_LEN
1558 #define MAX_KEYTAB_NAME_LEN 1100
1559 #endif
1560
1561  krb5_error_code smb_krb5_open_keytab(krb5_context context,
1562                                       const char *keytab_name_req,
1563                                       bool write_access,
1564                                       krb5_keytab *keytab)
1565 {
1566         krb5_error_code ret = 0;
1567         TALLOC_CTX *mem_ctx;
1568         char keytab_string[MAX_KEYTAB_NAME_LEN];
1569         bool found_valid_name = False;
1570         const char *pragma = "FILE";
1571         const char *tmp = NULL;
1572
1573         if (!write_access && !keytab_name_req) {
1574                 /* caller just wants to read the default keytab readonly, so be it */
1575                 return krb5_kt_default(context, keytab);
1576         }
1577
1578         mem_ctx = talloc_init("smb_krb5_open_keytab");
1579         if (!mem_ctx) {
1580                 return ENOMEM;
1581         }
1582
1583 #ifdef HAVE_WRFILE_KEYTAB
1584         if (write_access) {
1585                 pragma = "WRFILE";
1586         }
1587 #endif
1588
1589         if (keytab_name_req) {
1590
1591                 if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1592                         ret = KRB5_CONFIG_NOTENUFSPACE;
1593                         goto out;
1594                 }
1595
1596                 if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) ||
1597                     (strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1598                         tmp = keytab_name_req;
1599                         goto resolve;
1600                 }
1601
1602                 if (keytab_name_req[0] != '/') {
1603                         ret = KRB5_KT_BADNAME;
1604                         goto out;
1605                 }
1606
1607                 tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1608                 if (!tmp) {
1609                         ret = ENOMEM;
1610                         goto out;
1611                 }
1612
1613                 goto resolve;
1614         }
1615
1616         /* we need to handle more complex keytab_strings, like:
1617          * "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1618
1619         ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1620         if (ret) {
1621                 goto out;
1622         }
1623
1624         DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1625
1626         tmp = talloc_strdup(mem_ctx, keytab_string);
1627         if (!tmp) {
1628                 ret = ENOMEM;
1629                 goto out;
1630         }
1631
1632         if (strncmp(tmp, "ANY:", 4) == 0) {
1633                 tmp += 4;
1634         }
1635
1636         memset(&keytab_string, '\0', sizeof(keytab_string));
1637
1638         while (next_token(&tmp, keytab_string, ",", sizeof(keytab_string))) {
1639
1640                 if (strncmp(keytab_string, "WRFILE:", 7) == 0) {
1641                         found_valid_name = True;
1642                         tmp = keytab_string;
1643                         tmp += 7;
1644                 }
1645
1646                 if (strncmp(keytab_string, "FILE:", 5) == 0) {
1647                         found_valid_name = True;
1648                         tmp = keytab_string;
1649                         tmp += 5;
1650                 }
1651
1652                 if (found_valid_name) {
1653
1654                         if (tmp[0] != '/') {
1655                                 ret = KRB5_KT_BADNAME;
1656                                 goto out;
1657                         }
1658
1659                         tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1660                         if (!tmp) {
1661                                 ret = ENOMEM;
1662                                 goto out;
1663                         }
1664                         break;
1665                 }
1666         }
1667
1668         if (!found_valid_name) {
1669                 ret = KRB5_KT_UNKNOWN_TYPE;
1670                 goto out;
1671         }
1672
1673  resolve:
1674         DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1675         ret = krb5_kt_resolve(context, tmp, keytab);
1676
1677  out:
1678         TALLOC_FREE(mem_ctx);
1679         return ret;
1680 }
1681
1682 #else /* HAVE_KRB5 */
1683  /* this saves a few linking headaches */
1684  int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1685                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1686                         const char *ccname, time_t *tgs_expire)
1687 {
1688          DEBUG(0,("NO KERBEROS SUPPORT\n"));
1689          return 1;
1690 }
1691
1692 #endif