source4/heimdal/lib/krb5/get_in_tkt.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 RCSID("$Id: get_in_tkt.c 23316 2008-06-23 04:32:32Z lha $");
  37
  38 krb5_error_code KRB5_LIB_FUNCTION
  39 krb5_init_etype (krb5_context context,
  40                  unsigned *len,
  41                  krb5_enctype **val,
  42                  const krb5_enctype *etypes)
  43 {
  44     unsigned int i;
  45     krb5_error_code ret;
  46     krb5_enctype *tmp = NULL;
  47
  48     ret = 0;
  49     if (etypes == NULL) {
  50         ret = krb5_get_default_in_tkt_etypes(context,
  51                                              &tmp);
  52         if (ret)
  53             return ret;
  54         etypes = tmp;
  55     }
  56
  57     for (i = 0; etypes[i]; ++i)
  58         ;
  59     *len = i;
  60     *val = malloc(i * sizeof(**val));
  61     if (i != 0 && *val == NULL) {
  62         ret = ENOMEM;
  63         krb5_set_error_message(context, ret, "malloc: out of memory");
  64         goto cleanup;
  65     }
  66     memmove (*val,
  67              etypes,
  68              i * sizeof(*tmp));
  69 cleanup:
  70     if (tmp != NULL)
  71         free (tmp);
  72     return ret;
  73 }
  74
  75 static krb5_error_code
  76 check_server_referral(krb5_context context,
  77                       krb5_kdc_rep *rep,
  78                       unsigned flags,
  79                       krb5_const_principal requested,
  80                       krb5_const_principal returned,
  81                       const krb5_keyblock const * key)
  82 {
  83     krb5_error_code ret;
  84     PA_ServerReferralData ref;
  85     krb5_crypto session;
  86     EncryptedData ed;
  87     size_t len;
  88     krb5_data data;
  89     PA_DATA *pa;
  90     int i = 0, cmp;
  91
  92     if (rep->kdc_rep.padata == NULL)
  93         goto noreferral;
  94
  95     pa = krb5_find_padata(rep->kdc_rep.padata->val,
  96                           rep->kdc_rep.padata->len,
  97                           KRB5_PADATA_SERVER_REFERRAL, &i);
  98     if (pa == NULL)
  99         goto noreferral;
 100
 101     memset(&ed, 0, sizeof(ed));
 102     memset(&ref, 0, sizeof(ref));
 103
 104     ret = decode_EncryptedData(pa->padata_value.data,
 105                                pa->padata_value.length,
 106                                &ed, &len);
 107     if (ret)
 108         return ret;
 109     if (len != pa->padata_value.length) {
 110         free_EncryptedData(&ed);
 111         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED, "Referral EncryptedData wrong");
 112         return KRB5KRB_AP_ERR_MODIFIED;
 113     }
 114
 115     ret = krb5_crypto_init(context, key, 0, &session);
 116     if (ret) {
 117         free_EncryptedData(&ed);
 118         return ret;
 119     }
 120
 121     ret = krb5_decrypt_EncryptedData(context, session,
 122                                      KRB5_KU_PA_SERVER_REFERRAL,
 123                                      &ed, &data);
 124     free_EncryptedData(&ed);
 125     krb5_crypto_destroy(context, session);
 126     if (ret)
 127         return ret;
 128
 129     ret = decode_PA_ServerReferralData(data.data, data.length, &ref, &len);
 130     if (ret) {
 131         krb5_data_free(&data);
 132         return ret;
 133     }
 134     krb5_data_free(&data);
 135
 136     if (strcmp(requested->realm, returned->realm) != 0) {
 137         free_PA_ServerReferralData(&ref);
 138         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 139                                "server ref realm mismatch");
 140         return KRB5KRB_AP_ERR_MODIFIED;
 141     }
 142
 143     if (returned->name.name_string.len == 2 &&
 144         strcmp(returned->name.name_string.val[0], KRB5_TGS_NAME) == 0)
 145     {
 146         const char *realm = returned->name.name_string.val[1];
 147
 148         if (ref.referred_realm == NULL
 149             || strcmp(*ref.referred_realm, realm) != 0)
 150         {
 151             free_PA_ServerReferralData(&ref);
 152             krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 153                                    "tgt returned with wrong ref");
 154             return KRB5KRB_AP_ERR_MODIFIED;
 155         }
 156     } else if (krb5_principal_compare(context, returned, requested) == 0) {
 157         free_PA_ServerReferralData(&ref);
 158         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 159                               "req princ no same as returned");
 160         return KRB5KRB_AP_ERR_MODIFIED;
 161     }
 162
 163     if (ref.requested_principal_name) {
 164         cmp = _krb5_principal_compare_PrincipalName(context,
 165                                                     requested,
 166                                                     ref.requested_principal_name);
 167         if (!cmp) {
 168             free_PA_ServerReferralData(&ref);
 169             krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 170                                    "compare requested failed");
 171             return KRB5KRB_AP_ERR_MODIFIED;
 172         }
 173     } else if (flags & EXTRACT_TICKET_AS_REQ) {
 174         free_PA_ServerReferralData(&ref);
 175         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 176                                "Requested principal missing on AS-REQ");
 177         return KRB5KRB_AP_ERR_MODIFIED;
 178     }
 179
 180     free_PA_ServerReferralData(&ref);
 181
 182     return ret;
 183 noreferral:
 184     if (krb5_principal_compare(context, requested, returned) == FALSE) {
 185         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 186                                "Not same server principal returned "
 187                               "as requested");
 188         return KRB5KRB_AP_ERR_MODIFIED;
 189     }
 190     return 0;
 191 }
 192
 193
 194 /*
 195  * Verify referral data
 196  */
 197
 198
 199 static krb5_error_code
 200 check_client_referral(krb5_context context,
 201                       krb5_kdc_rep *rep,
 202                       krb5_const_principal requested,
 203                       krb5_const_principal mapped,
 204                       krb5_keyblock const * key)
 205 {
 206     krb5_error_code ret;
 207     PA_ClientCanonicalized canon;
 208     krb5_crypto crypto;
 209     krb5_data data;
 210     PA_DATA *pa;
 211     size_t len;
 212     int i = 0;
 213
 214     if (rep->kdc_rep.padata == NULL)
 215         goto noreferral;
 216
 217     pa = krb5_find_padata(rep->kdc_rep.padata->val,
 218                           rep->kdc_rep.padata->len,
 219                           KRB5_PADATA_CLIENT_CANONICALIZED, &i);
 220     if (pa == NULL)
 221         goto noreferral;
 222
 223     ret = decode_PA_ClientCanonicalized(pa->padata_value.data,
 224                                         pa->padata_value.length,
 225                                         &canon, &len);
 226     if (ret) {
 227         krb5_set_error_message(context, ret, "Failed to decode "
 228                                "PA_ClientCanonicalized");
 229         return ret;
 230     }
 231
 232     ASN1_MALLOC_ENCODE(PA_ClientCanonicalizedNames, data.data, data.length,
 233                        &canon.names, &len, ret);
 234     if (ret) {
 235         free_PA_ClientCanonicalized(&canon);
 236         return ret;
 237     }
 238     if (data.length != len)
 239         krb5_abortx(context, "internal asn.1 error");
 240
 241     ret = krb5_crypto_init(context, key, 0, &crypto);
 242     if (ret) {
 243         free(data.data);
 244         free_PA_ClientCanonicalized(&canon);
 245         return ret;
 246     }
 247
 248     ret = krb5_verify_checksum(context, crypto, KRB5_KU_CANONICALIZED_NAMES,
 249                                data.data, data.length,
 250                                &canon.canon_checksum);
 251     krb5_crypto_destroy(context, crypto);
 252     free(data.data);
 253     if (ret) {
 254         krb5_set_error_message(context, ret, "Failed to verify "
 255                               "client canonicalized data");
 256         free_PA_ClientCanonicalized(&canon);
 257         return ret;
 258     }
 259
 260     if (!_krb5_principal_compare_PrincipalName(context,
 261                                                requested,
 262                                                &canon.names.requested_name))
 263     {
 264         free_PA_ClientCanonicalized(&canon);
 265         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
 266                                "Requested name doesn't match"
 267                               " in client referral");
 268         return KRB5_PRINC_NOMATCH;
 269     }
 270     if (!_krb5_principal_compare_PrincipalName(context,
 271                                                mapped,
 272                                                &canon.names.mapped_name))
 273     {
 274         free_PA_ClientCanonicalized(&canon);
 275         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
 276                                "Mapped name doesn't match"
 277                               " in client referral");
 278         return KRB5_PRINC_NOMATCH;
 279     }
 280
 281     return 0;
 282
 283 noreferral:
 284     if (krb5_principal_compare(context, requested, mapped) == FALSE) {
 285         krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
 286                                "Not same client principal returned "
 287                               "as requested");
 288         return KRB5KRB_AP_ERR_MODIFIED;
 289     }
 290     return 0;
 291 }
 292
 293
 294
 295 static krb5_error_code
 296 decrypt_tkt (krb5_context context,
 297              krb5_keyblock *key,
 298              krb5_key_usage usage,
 299              krb5_const_pointer decrypt_arg,
 300              krb5_kdc_rep *dec_rep)
 301 {
 302     krb5_error_code ret;
 303     krb5_data data;
 304     size_t size;
 305     krb5_crypto crypto;
 306
 307     ret = krb5_crypto_init(context, key, 0, &crypto);
 308     if (ret)
 309         return ret;
 310
 311     ret = krb5_decrypt_EncryptedData (context,
 312                                       crypto,
 313                                       usage,
 314                                       &dec_rep->kdc_rep.enc_part,
 315                                       &data);
 316     krb5_crypto_destroy(context, crypto);
 317
 318     if (ret)
 319         return ret;
 320
 321     ret = krb5_decode_EncASRepPart(context,
 322                                    data.data,
 323                                    data.length,
 324                                    &dec_rep->enc_part,
 325                                    &size);
 326     if (ret)
 327         ret = krb5_decode_EncTGSRepPart(context,
 328                                         data.data,
 329                                         data.length,
 330                                         &dec_rep->enc_part,
 331                                         &size);
 332     krb5_data_free (&data);
 333     if (ret)
 334         return ret;
 335     return 0;
 336 }
 337
 338 int
 339 _krb5_extract_ticket(krb5_context context,
 340                      krb5_kdc_rep *rep,
 341                      krb5_creds *creds,
 342                      krb5_keyblock *key,
 343                      krb5_const_pointer keyseed,
 344                      krb5_key_usage key_usage,
 345                      krb5_addresses *addrs,
 346                      unsigned nonce,
 347                      unsigned flags,
 348                      krb5_decrypt_proc decrypt_proc,
 349                      krb5_const_pointer decryptarg)
 350 {
 351     krb5_error_code ret;
 352     krb5_principal tmp_principal;
 353     size_t len;
 354     time_t tmp_time;
 355     krb5_timestamp sec_now;
 356
 357     /* decrypt */
 358
 359     if (decrypt_proc == NULL)
 360         decrypt_proc = decrypt_tkt;
 361
 362     ret = (*decrypt_proc)(context, key, key_usage, decryptarg, rep);
 363     if (ret)
 364         goto out;
 365
 366     /* save session key */
 367
 368     creds->session.keyvalue.length = 0;
 369     creds->session.keyvalue.data   = NULL;
 370     creds->session.keytype = rep->enc_part.key.keytype;
 371     ret = krb5_data_copy (&creds->session.keyvalue,
 372                           rep->enc_part.key.keyvalue.data,
 373                           rep->enc_part.key.keyvalue.length);
 374     if (ret) {
 375         krb5_clear_error_string(context);
 376         goto out;
 377     }
 378
 379     /*
 380      * HACK:
 381      * this is really a ugly hack, to support using the Netbios Domain Name
 382      * as realm against windows KDC's, they always return the full realm
 383      * based on the DNS Name.
 384      */
 385     flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
 386     flags |=EXTRACT_TICKET_ALLOW_CNAME_MISMATCH ;
 387
 388
 389    /* compare client and save */
 390     ret = _krb5_principalname2krb5_principal (context,
 391                                               &tmp_principal,
 392                                               rep->kdc_rep.cname,
 393                                               rep->kdc_rep.crealm);
 394     if (ret)
 395         goto out;
 396
 397     /* check client referral and save principal */
 398     /* anonymous here ? */
 399     if((flags & EXTRACT_TICKET_ALLOW_CNAME_MISMATCH) == 0) {
 400         ret = check_client_referral(context, rep,
 401                                     creds->client,
 402                                     tmp_principal,
 403                                     &creds->session);
 404         if (ret) {
 405             krb5_free_principal (context, tmp_principal);
 406             goto out;
 407         }
 408     }
 409     krb5_free_principal (context, creds->client);
 410     creds->client = tmp_principal;
 411
 412     /* check server referral and save principal */
 413     ret = _krb5_principalname2krb5_principal (context,
 414                                               &tmp_principal,
 415                                               rep->kdc_rep.ticket.sname,
 416                                               rep->kdc_rep.ticket.realm);
 417     if (ret)
 418         goto out;
 419     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
 420         ret = check_server_referral(context,
 421                                     rep,
 422                                     flags,
 423                                     creds->server,
 424                                     tmp_principal,
 425                                     &creds->session);
 426         if (ret) {
 427             krb5_free_principal (context, tmp_principal);
 428             goto out;
 429         }
 430     }
 431     krb5_free_principal(context, creds->server);
 432     creds->server = tmp_principal;
 433
 434     /* verify names */
 435     if(flags & EXTRACT_TICKET_MATCH_REALM){
 436         const char *srealm = krb5_principal_get_realm(context, creds->server);
 437         const char *crealm = krb5_principal_get_realm(context, creds->client);
 438
 439         if (strcmp(rep->enc_part.srealm, srealm) != 0 ||
 440             strcmp(rep->enc_part.srealm, crealm) != 0)
 441         {
 442             ret = KRB5KRB_AP_ERR_MODIFIED;
 443             krb5_clear_error_string(context);
 444             goto out;
 445         }
 446     }
 447
 448     /* compare nonces */
 449
 450     if (nonce != rep->enc_part.nonce) {
 451         ret = KRB5KRB_AP_ERR_MODIFIED;
 452         krb5_set_error_message(context, ret, "malloc: out of memory");
 453         goto out;
 454     }
 455
 456     /* set kdc-offset */
 457
 458     krb5_timeofday (context, &sec_now);
 459     if (rep->enc_part.flags.initial
 460         && context->kdc_sec_offset == 0
 461         && krb5_config_get_bool (context, NULL,
 462                                  "libdefaults",
 463                                  "kdc_timesync",
 464                                  NULL)) {
 465         context->kdc_sec_offset = rep->enc_part.authtime - sec_now;
 466         krb5_timeofday (context, &sec_now);
 467     }
 468
 469     /* check all times */
 470
 471     if (rep->enc_part.starttime) {
 472         tmp_time = *rep->enc_part.starttime;
 473     } else
 474         tmp_time = rep->enc_part.authtime;
 475
 476     if (creds->times.starttime == 0
 477         && abs(tmp_time - sec_now) > context->max_skew) {
 478         ret = KRB5KRB_AP_ERR_SKEW;
 479         krb5_set_error_message (context, ret,
 480                                "time skew (%d) larger than max (%d)",
 481                                abs(tmp_time - sec_now),
 482                                (int)context->max_skew);
 483         goto out;
 484     }
 485
 486     if (creds->times.starttime != 0
 487         && tmp_time != creds->times.starttime) {
 488         krb5_clear_error_string (context);
 489         ret = KRB5KRB_AP_ERR_MODIFIED;
 490         goto out;
 491     }
 492
 493     creds->times.starttime = tmp_time;
 494
 495     if (rep->enc_part.renew_till) {
 496         tmp_time = *rep->enc_part.renew_till;
 497     } else
 498         tmp_time = 0;
 499
 500     if (creds->times.renew_till != 0
 501         && tmp_time > creds->times.renew_till) {
 502         krb5_clear_error_string (context);
 503         ret = KRB5KRB_AP_ERR_MODIFIED;
 504         goto out;
 505     }
 506
 507     creds->times.renew_till = tmp_time;
 508
 509     creds->times.authtime = rep->enc_part.authtime;
 510
 511     if (creds->times.endtime != 0
 512         && rep->enc_part.endtime > creds->times.endtime) {
 513         krb5_clear_error_string (context);
 514         ret = KRB5KRB_AP_ERR_MODIFIED;
 515         goto out;
 516     }
 517
 518     creds->times.endtime  = rep->enc_part.endtime;
 519
 520     if(rep->enc_part.caddr)
 521         krb5_copy_addresses (context, rep->enc_part.caddr, &creds->addresses);
 522     else if(addrs)
 523         krb5_copy_addresses (context, addrs, &creds->addresses);
 524     else {
 525         creds->addresses.len = 0;
 526         creds->addresses.val = NULL;
 527     }
 528     creds->flags.b = rep->enc_part.flags;
 529
 530     creds->authdata.len = 0;
 531     creds->authdata.val = NULL;
 532
 533     /* extract ticket */
 534     ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length,
 535                        &rep->kdc_rep.ticket, &len, ret);
 536     if(ret)
 537         goto out;
 538     if (creds->ticket.length != len)
 539         krb5_abortx(context, "internal error in ASN.1 encoder");
 540     creds->second_ticket.length = 0;
 541     creds->second_ticket.data   = NULL;
 542
 543
 544 out:
 545     memset (rep->enc_part.key.keyvalue.data, 0,
 546             rep->enc_part.key.keyvalue.length);
 547     return ret;
 548 }
 549
 550
 551 static krb5_error_code
 552 make_pa_enc_timestamp(krb5_context context, PA_DATA *pa,
 553                       krb5_enctype etype, krb5_keyblock *key)
 554 {
 555     PA_ENC_TS_ENC p;
 556     unsigned char *buf;
 557     size_t buf_size;
 558     size_t len;
 559     EncryptedData encdata;
 560     krb5_error_code ret;
 561     int32_t usec;
 562     int usec2;
 563     krb5_crypto crypto;
 564
 565     krb5_us_timeofday (context, &p.patimestamp, &usec);
 566     usec2         = usec;
 567     p.pausec      = &usec2;
 568
 569     ASN1_MALLOC_ENCODE(PA_ENC_TS_ENC, buf, buf_size, &p, &len, ret);
 570     if (ret)
 571         return ret;
 572     if(buf_size != len)
 573         krb5_abortx(context, "internal error in ASN.1 encoder");
 574     ret = krb5_crypto_init(context, key, 0, &crypto);
 575     if (ret) {
 576         free(buf);
 577         return ret;
 578     }
 579     ret = krb5_encrypt_EncryptedData(context,
 580                                      crypto,
 581                                      KRB5_KU_PA_ENC_TIMESTAMP,
 582                                      buf,
 583                                      len,
 584                                      0,
 585                                      &encdata);
 586     free(buf);
 587     krb5_crypto_destroy(context, crypto);
 588     if (ret)
 589         return ret;
 590
 591     ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_size, &encdata, &len, ret);
 592     free_EncryptedData(&encdata);
 593     if (ret)
 594         return ret;
 595     if(buf_size != len)
 596         krb5_abortx(context, "internal error in ASN.1 encoder");
 597     pa->padata_type = KRB5_PADATA_ENC_TIMESTAMP;
 598     pa->padata_value.length = len;
 599     pa->padata_value.data = buf;
 600     return 0;
 601 }
 602
 603 static krb5_error_code
 604 add_padata(krb5_context context,
 605            METHOD_DATA *md,
 606            krb5_principal client,
 607            krb5_key_proc key_proc,
 608            krb5_const_pointer keyseed,
 609            krb5_enctype *enctypes,
 610            unsigned netypes,
 611            krb5_salt *salt)
 612 {
 613     krb5_error_code ret;
 614     PA_DATA *pa2;
 615     krb5_salt salt2;
 616     krb5_enctype *ep;
 617     int i;
 618
 619     if(salt == NULL) {
 620         /* default to standard salt */
 621         ret = krb5_get_pw_salt (context, client, &salt2);
 622         salt = &salt2;
 623     }
 624     if (!enctypes) {
 625         enctypes = context->etypes;
 626         netypes = 0;
 627         for (ep = enctypes; *ep != ETYPE_NULL; ep++)
 628             netypes++;
 629     }
 630     pa2 = realloc (md->val, (md->len + netypes) * sizeof(*md->val));
 631     if (pa2 == NULL) {
 632         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 633         return ENOMEM;
 634     }
 635     md->val = pa2;
 636
 637     for (i = 0; i < netypes; ++i) {
 638         krb5_keyblock *key;
 639
 640         ret = (*key_proc)(context, enctypes[i], *salt, keyseed, &key);
 641         if (ret)
 642             continue;
 643         ret = make_pa_enc_timestamp (context, &md->val[md->len],
 644                                      enctypes[i], key);
 645         krb5_free_keyblock (context, key);
 646         if (ret)
 647             return ret;
 648         ++md->len;
 649     }
 650     if(salt == &salt2)
 651         krb5_free_salt(context, salt2);
 652     return 0;
 653 }
 654
 655 static krb5_error_code
 656 init_as_req (krb5_context context,
 657              KDCOptions opts,
 658              krb5_creds *creds,
 659              const krb5_addresses *addrs,
 660              const krb5_enctype *etypes,
 661              const krb5_preauthtype *ptypes,
 662              const krb5_preauthdata *preauth,
 663              krb5_key_proc key_proc,
 664              krb5_const_pointer keyseed,
 665              unsigned nonce,
 666              AS_REQ *a)
 667 {
 668     krb5_error_code ret;
 669     krb5_salt salt;
 670
 671     memset(a, 0, sizeof(*a));
 672
 673     a->pvno = 5;
 674     a->msg_type = krb_as_req;
 675     a->req_body.kdc_options = opts;
 676     a->req_body.cname = malloc(sizeof(*a->req_body.cname));
 677     if (a->req_body.cname == NULL) {
 678         ret = ENOMEM;
 679         krb5_set_error_message(context, ret, "malloc: out of memory");
 680         goto fail;
 681     }
 682     a->req_body.sname = malloc(sizeof(*a->req_body.sname));
 683     if (a->req_body.sname == NULL) {
 684         ret = ENOMEM;
 685         krb5_set_error_message(context, ret, "malloc: out of memory");
 686         goto fail;
 687     }
 688     ret = _krb5_principal2principalname (a->req_body.cname, creds->client);
 689     if (ret)
 690         goto fail;
 691     ret = _krb5_principal2principalname (a->req_body.sname, creds->server);
 692     if (ret)
 693         goto fail;
 694     ret = copy_Realm(&creds->client->realm, &a->req_body.realm);
 695     if (ret)
 696         goto fail;
 697
 698     if(creds->times.starttime) {
 699         a->req_body.from = malloc(sizeof(*a->req_body.from));
 700         if (a->req_body.from == NULL) {
 701             ret = ENOMEM;
 702             krb5_set_error_message(context, ret, "malloc: out of memory");
 703             goto fail;
 704         }
 705         *a->req_body.from = creds->times.starttime;
 706     }
 707     if(creds->times.endtime){
 708         ALLOC(a->req_body.till, 1);
 709         *a->req_body.till = creds->times.endtime;
 710     }
 711     if(creds->times.renew_till){
 712         a->req_body.rtime = malloc(sizeof(*a->req_body.rtime));
 713         if (a->req_body.rtime == NULL) {
 714             ret = ENOMEM;
 715             krb5_set_error_message(context, ret, "malloc: out of memory");
 716             goto fail;
 717         }
 718         *a->req_body.rtime = creds->times.renew_till;
 719     }
 720     a->req_body.nonce = nonce;
 721     ret = krb5_init_etype (context,
 722                            &a->req_body.etype.len,
 723                            &a->req_body.etype.val,
 724                            etypes);
 725     if (ret)
 726         goto fail;
 727
 728     /*
 729      * This means no addresses
 730      */
 731
 732     if (addrs && addrs->len == 0) {
 733         a->req_body.addresses = NULL;
 734     } else {
 735         a->req_body.addresses = malloc(sizeof(*a->req_body.addresses));
 736         if (a->req_body.addresses == NULL) {
 737             ret = ENOMEM;
 738             krb5_set_error_message(context, ret, "malloc: out of memory");
 739             goto fail;
 740         }
 741
 742         if (addrs)
 743             ret = krb5_copy_addresses(context, addrs, a->req_body.addresses);
 744         else {
 745             ret = krb5_get_all_client_addrs (context, a->req_body.addresses);
 746             if(ret == 0 && a->req_body.addresses->len == 0) {
 747                 free(a->req_body.addresses);
 748                 a->req_body.addresses = NULL;
 749             }
 750         }
 751         if (ret)
 752             return ret;
 753     }
 754
 755     a->req_body.enc_authorization_data = NULL;
 756     a->req_body.additional_tickets = NULL;
 757
 758     if(preauth != NULL) {
 759         int i;
 760         ALLOC(a->padata, 1);
 761         if(a->padata == NULL) {
 762             ret = ENOMEM;
 763             krb5_set_error_message(context, ret, "malloc: out of memory");
 764             goto fail;
 765         }
 766         a->padata->val = NULL;
 767         a->padata->len = 0;
 768         for(i = 0; i < preauth->len; i++) {
 769             if(preauth->val[i].type == KRB5_PADATA_ENC_TIMESTAMP){
 770                 int j;
 771
 772                 for(j = 0; j < preauth->val[i].info.len; j++) {
 773                     krb5_salt *sp = &salt;
 774                     if(preauth->val[i].info.val[j].salttype)
 775                         salt.salttype = *preauth->val[i].info.val[j].salttype;
 776                     else
 777                         salt.salttype = KRB5_PW_SALT;
 778                     if(preauth->val[i].info.val[j].salt)
 779                         salt.saltvalue = *preauth->val[i].info.val[j].salt;
 780                     else
 781                         if(salt.salttype == KRB5_PW_SALT)
 782                             sp = NULL;
 783                         else
 784                             krb5_data_zero(&salt.saltvalue);
 785                     ret = add_padata(context, a->padata, creds->client,
 786                                      key_proc, keyseed,
 787                                      &preauth->val[i].info.val[j].etype, 1,
 788                                      sp);
 789                     if (ret == 0)
 790                         break;
 791                 }
 792             }
 793         }
 794     } else
 795     /* not sure this is the way to use `ptypes' */
 796     if (ptypes == NULL || *ptypes == KRB5_PADATA_NONE)
 797         a->padata = NULL;
 798     else if (*ptypes ==  KRB5_PADATA_ENC_TIMESTAMP) {
 799         ALLOC(a->padata, 1);
 800         if (a->padata == NULL) {
 801             ret = ENOMEM;
 802             krb5_set_error_message(context, ret, "malloc: out of memory");
 803             goto fail;
 804         }
 805         a->padata->len = 0;
 806         a->padata->val = NULL;
 807
 808         /* make a v5 salted pa-data */
 809         add_padata(context, a->padata, creds->client,
 810                    key_proc, keyseed, a->req_body.etype.val,
 811                    a->req_body.etype.len, NULL);
 812
 813         /* make a v4 salted pa-data */
 814         salt.salttype = KRB5_PW_SALT;
 815         krb5_data_zero(&salt.saltvalue);
 816         add_padata(context, a->padata, creds->client,
 817                    key_proc, keyseed, a->req_body.etype.val,
 818                    a->req_body.etype.len, &salt);
 819     } else {
 820         ret = KRB5_PREAUTH_BAD_TYPE;
 821         krb5_set_error_message (context, ret, "pre-auth type %d not supported",
 822                                *ptypes);
 823         goto fail;
 824     }
 825     return 0;
 826 fail:
 827     free_AS_REQ(a);
 828     return ret;
 829 }
 830
 831 static int
 832 set_ptypes(krb5_context context,
 833            KRB_ERROR *error,
 834            const krb5_preauthtype **ptypes,
 835            krb5_preauthdata **preauth)
 836 {
 837     static krb5_preauthdata preauth2;
 838     static krb5_preauthtype ptypes2[] = { KRB5_PADATA_ENC_TIMESTAMP, KRB5_PADATA_NONE };
 839
 840     if(error->e_data) {
 841         METHOD_DATA md;
 842         int i;
 843         decode_METHOD_DATA(error->e_data->data,
 844                            error->e_data->length,
 845                            &md,
 846                            NULL);
 847         for(i = 0; i < md.len; i++){
 848             switch(md.val[i].padata_type){
 849             case KRB5_PADATA_ENC_TIMESTAMP:
 850                 *ptypes = ptypes2;
 851                 break;
 852             case KRB5_PADATA_ETYPE_INFO:
 853                 *preauth = &preauth2;
 854                 ALLOC_SEQ(*preauth, 1);
 855                 (*preauth)->val[0].type = KRB5_PADATA_ENC_TIMESTAMP;
 856                 krb5_decode_ETYPE_INFO(context,
 857                                        md.val[i].padata_value.data,
 858                                        md.val[i].padata_value.length,
 859                                        &(*preauth)->val[0].info,
 860                                        NULL);
 861                 break;
 862             default:
 863                 break;
 864             }
 865         }
 866         free_METHOD_DATA(&md);
 867     } else {
 868         *ptypes = ptypes2;
 869     }
 870     return(1);
 871 }
 872
 873 krb5_error_code KRB5_LIB_FUNCTION
 874 krb5_get_in_cred(krb5_context context,
 875                  krb5_flags options,
 876                  const krb5_addresses *addrs,
 877                  const krb5_enctype *etypes,
 878                  const krb5_preauthtype *ptypes,
 879                  const krb5_preauthdata *preauth,
 880                  krb5_key_proc key_proc,
 881                  krb5_const_pointer keyseed,
 882                  krb5_decrypt_proc decrypt_proc,
 883                  krb5_const_pointer decryptarg,
 884                  krb5_creds *creds,
 885                  krb5_kdc_rep *ret_as_reply)
 886 {
 887     krb5_error_code ret;
 888     AS_REQ a;
 889     krb5_kdc_rep rep;
 890     krb5_data req, resp;
 891     size_t len;
 892     krb5_salt salt;
 893     krb5_keyblock *key;
 894     size_t size;
 895     KDCOptions opts;
 896     PA_DATA *pa;
 897     krb5_enctype etype;
 898     krb5_preauthdata *my_preauth = NULL;
 899     unsigned nonce;
 900     int done;
 901
 902     opts = int2KDCOptions(options);
 903
 904     krb5_generate_random_block (&nonce, sizeof(nonce));
 905     nonce &= 0xffffffff;
 906
 907     do {
 908         done = 1;
 909         ret = init_as_req (context,
 910                            opts,
 911                            creds,
 912                            addrs,
 913                            etypes,
 914                            ptypes,
 915                            preauth,
 916                            key_proc,
 917                            keyseed,
 918                            nonce,
 919                            &a);
 920         if (my_preauth) {
 921             free_ETYPE_INFO(&my_preauth->val[0].info);
 922             free (my_preauth->val);
 923             my_preauth = NULL;
 924         }
 925         if (ret)
 926             return ret;
 927
 928         ASN1_MALLOC_ENCODE(AS_REQ, req.data, req.length, &a, &len, ret);
 929         free_AS_REQ(&a);
 930         if (ret)
 931             return ret;
 932         if(len != req.length)
 933             krb5_abortx(context, "internal error in ASN.1 encoder");
 934
 935         ret = krb5_sendto_kdc (context, &req, &creds->client->realm, &resp);
 936         krb5_data_free(&req);
 937         if (ret)
 938             return ret;
 939
 940         memset (&rep, 0, sizeof(rep));
 941         ret = decode_AS_REP(resp.data, resp.length, &rep.kdc_rep, &size);
 942         if(ret) {
 943             /* let's try to parse it as a KRB-ERROR */
 944             KRB_ERROR error;
 945             int ret2;
 946
 947             ret2 = krb5_rd_error(context, &resp, &error);
 948             if(ret2 && resp.data && ((char*)resp.data)[0] == 4)
 949                 ret = KRB5KRB_AP_ERR_V4_REPLY;
 950             krb5_data_free(&resp);
 951             if (ret2 == 0) {
 952                 ret = krb5_error_from_rd_error(context, &error, creds);
 953                 /* if no preauth was set and KDC requires it, give it
 954                    one more try */
 955                 if (!ptypes && !preauth
 956                     && ret == KRB5KDC_ERR_PREAUTH_REQUIRED
 957 #if 0
 958                         || ret == KRB5KDC_ERR_BADOPTION
 959 #endif
 960                     && set_ptypes(context, &error, &ptypes, &my_preauth)) {
 961                     done = 0;
 962                     preauth = my_preauth;
 963                     krb5_free_error_contents(context, &error);
 964                     krb5_clear_error_string(context);
 965                     continue;
 966                 }
 967                 if(ret_as_reply)
 968                     ret_as_reply->error = error;
 969                 else
 970                     free_KRB_ERROR (&error);
 971                 return ret;
 972             }
 973             return ret;
 974         }
 975         krb5_data_free(&resp);
 976     } while(!done);
 977
 978     pa = NULL;
 979     etype = rep.kdc_rep.enc_part.etype;
 980     if(rep.kdc_rep.padata){
 981         int i = 0;
 982         pa = krb5_find_padata(rep.kdc_rep.padata->val, rep.kdc_rep.padata->len,
 983                               KRB5_PADATA_PW_SALT, &i);
 984         if(pa == NULL) {
 985             i = 0;
 986             pa = krb5_find_padata(rep.kdc_rep.padata->val,
 987                                   rep.kdc_rep.padata->len,
 988                                   KRB5_PADATA_AFS3_SALT, &i);
 989         }
 990     }
 991     if(pa) {
 992         salt.salttype = pa->padata_type;
 993         salt.saltvalue = pa->padata_value;
 994
 995         ret = (*key_proc)(context, etype, salt, keyseed, &key);
 996     } else {
 997         /* make a v5 salted pa-data */
 998         ret = krb5_get_pw_salt (context, creds->client, &salt);
 999
1000         if (ret)
1001             goto out;
1002         ret = (*key_proc)(context, etype, salt, keyseed, &key);
1003         krb5_free_salt(context, salt);
1004     }
1005     if (ret)
1006         goto out;
1007
1008     {
1009         unsigned flags = 0;
1010         if (opts.request_anonymous)
1011             flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
1012
1013         ret = _krb5_extract_ticket(context,
1014                                    &rep,
1015                                    creds,
1016                                    key,
1017                                    keyseed,
1018                                    KRB5_KU_AS_REP_ENC_PART,
1019                                    NULL,
1020                                    nonce,
1021                                    flags,
1022                                    decrypt_proc,
1023                                    decryptarg);
1024     }
1025     memset (key->keyvalue.data, 0, key->keyvalue.length);
1026     krb5_free_keyblock_contents (context, key);
1027     free (key);
1028
1029 out:
1030     if (ret == 0 && ret_as_reply)
1031         *ret_as_reply = rep;
1032     else
1033         krb5_free_kdc_rep (context, &rep);
1034     return ret;
1035 }
1036
1037 krb5_error_code KRB5_LIB_FUNCTION
1038 krb5_get_in_tkt(krb5_context context,
1039                 krb5_flags options,
1040                 const krb5_addresses *addrs,
1041                 const krb5_enctype *etypes,
1042                 const krb5_preauthtype *ptypes,
1043                 krb5_key_proc key_proc,
1044                 krb5_const_pointer keyseed,
1045                 krb5_decrypt_proc decrypt_proc,
1046                 krb5_const_pointer decryptarg,
1047                 krb5_creds *creds,
1048                 krb5_ccache ccache,
1049                 krb5_kdc_rep *ret_as_reply)
1050 {
1051     krb5_error_code ret;
1052
1053     ret = krb5_get_in_cred (context,
1054                             options,
1055                             addrs,
1056                             etypes,
1057                             ptypes,
1058                             NULL,
1059                             key_proc,
1060                             keyseed,
1061                             decrypt_proc,
1062                             decryptarg,
1063                             creds,
1064                             ret_as_reply);
1065     if(ret)
1066         return ret;
1067     if (ccache)
1068         ret = krb5_cc_store_cred (context, ccache, creds);
1069     return ret;
1070 }