source/heimdal/lib/krb5/get_cred.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 RCSID("$Id: get_cred.c 23280 2008-06-23 03:26:18Z lha $");
  37
  38 /*
  39  * Take the `body' and encode it into `padata' using the credentials
  40  * in `creds'.
  41  */
  42
  43 static krb5_error_code
  44 make_pa_tgs_req(krb5_context context,
  45                 krb5_auth_context ac,
  46                 KDC_REQ_BODY *body,
  47                 PA_DATA *padata,
  48                 krb5_creds *creds)
  49 {
  50     u_char *buf;
  51     size_t buf_size;
  52     size_t len;
  53     krb5_data in_data;
  54     krb5_error_code ret;
  55
  56     ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
  57     if (ret)
  58         goto out;
  59     if(buf_size != len)
  60         krb5_abortx(context, "internal error in ASN.1 encoder");
  61
  62     in_data.length = len;
  63     in_data.data   = buf;
  64     ret = _krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
  65                                 &padata->padata_value,
  66                                 KRB5_KU_TGS_REQ_AUTH_CKSUM,
  67                                 KRB5_KU_TGS_REQ_AUTH);
  68  out:
  69     free (buf);
  70     if(ret)
  71         return ret;
  72     padata->padata_type = KRB5_PADATA_TGS_REQ;
  73     return 0;
  74 }
  75
  76 /*
  77  * Set the `enc-authorization-data' in `req_body' based on `authdata'
  78  */
  79
  80 static krb5_error_code
  81 set_auth_data (krb5_context context,
  82                KDC_REQ_BODY *req_body,
  83                krb5_authdata *authdata,
  84                krb5_keyblock *key)
  85 {
  86     if(authdata->len) {
  87         size_t len, buf_size;
  88         unsigned char *buf;
  89         krb5_crypto crypto;
  90         krb5_error_code ret;
  91
  92         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, authdata,
  93                            &len, ret);
  94         if (ret)
  95             return ret;
  96         if (buf_size != len)
  97             krb5_abortx(context, "internal error in ASN.1 encoder");
  98
  99         ALLOC(req_body->enc_authorization_data, 1);
 100         if (req_body->enc_authorization_data == NULL) {
 101             free (buf);
 102             krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 103             return ENOMEM;
 104         }
 105         ret = krb5_crypto_init(context, key, 0, &crypto);
 106         if (ret) {
 107             free (buf);
 108             free (req_body->enc_authorization_data);
 109             req_body->enc_authorization_data = NULL;
 110             return ret;
 111         }
 112         krb5_encrypt_EncryptedData(context,
 113                                    crypto,
 114                                    KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY,
 115                                    /* KRB5_KU_TGS_REQ_AUTH_DAT_SESSION? */
 116                                    buf,
 117                                    len,
 118                                    0,
 119                                    req_body->enc_authorization_data);
 120         free (buf);
 121         krb5_crypto_destroy(context, crypto);
 122     } else {
 123         req_body->enc_authorization_data = NULL;
 124     }
 125     return 0;
 126 }
 127
 128 /*
 129  * Create a tgs-req in `t' with `addresses', `flags', `second_ticket'
 130  * (if not-NULL), `in_creds', `krbtgt', and returning the generated
 131  * subkey in `subkey'.
 132  */
 133
 134 static krb5_error_code
 135 init_tgs_req (krb5_context context,
 136               krb5_ccache ccache,
 137               krb5_addresses *addresses,
 138               krb5_kdc_flags flags,
 139               Ticket *second_ticket,
 140               krb5_creds *in_creds,
 141               krb5_creds *krbtgt,
 142               unsigned nonce,
 143               const METHOD_DATA *padata,
 144               krb5_keyblock **subkey,
 145               TGS_REQ *t)
 146 {
 147     krb5_error_code ret = 0;
 148
 149     memset(t, 0, sizeof(*t));
 150     t->pvno = 5;
 151     t->msg_type = krb_tgs_req;
 152     if (in_creds->session.keytype) {
 153         ALLOC_SEQ(&t->req_body.etype, 1);
 154         if(t->req_body.etype.val == NULL) {
 155             ret = ENOMEM;
 156             krb5_set_error_message(context, ret, "malloc: out of memory");
 157             goto fail;
 158         }
 159         t->req_body.etype.val[0] = in_creds->session.keytype;
 160     } else {
 161         ret = krb5_init_etype(context,
 162                               &t->req_body.etype.len,
 163                               &t->req_body.etype.val,
 164                               NULL);
 165     }
 166     if (ret)
 167         goto fail;
 168     t->req_body.addresses = addresses;
 169     t->req_body.kdc_options = flags.b;
 170     ret = copy_Realm(&in_creds->server->realm, &t->req_body.realm);
 171     if (ret)
 172         goto fail;
 173     ALLOC(t->req_body.sname, 1);
 174     if (t->req_body.sname == NULL) {
 175         ret = ENOMEM;
 176         krb5_set_error_message(context, ret, "malloc: out of memory");
 177         goto fail;
 178     }
 179
 180     /* some versions of some code might require that the client be
 181        present in TGS-REQs, but this is clearly against the spec */
 182
 183     ret = copy_PrincipalName(&in_creds->server->name, t->req_body.sname);
 184     if (ret)
 185         goto fail;
 186
 187     /* req_body.till should be NULL if there is no endtime specified,
 188        but old MIT code (like DCE secd) doesn't like that */
 189     ALLOC(t->req_body.till, 1);
 190     if(t->req_body.till == NULL){
 191         ret = ENOMEM;
 192         krb5_set_error_message(context, ret, "malloc: out of memory");
 193         goto fail;
 194     }
 195     *t->req_body.till = in_creds->times.endtime;
 196
 197     t->req_body.nonce = nonce;
 198     if(second_ticket){
 199         ALLOC(t->req_body.additional_tickets, 1);
 200         if (t->req_body.additional_tickets == NULL) {
 201             ret = ENOMEM;
 202             krb5_set_error_message(context, ret, "malloc: out of memory");
 203             goto fail;
 204         }
 205         ALLOC_SEQ(t->req_body.additional_tickets, 1);
 206         if (t->req_body.additional_tickets->val == NULL) {
 207             ret = ENOMEM;
 208             krb5_set_error_message(context, ret, "malloc: out of memory");
 209             goto fail;
 210         }
 211         ret = copy_Ticket(second_ticket, t->req_body.additional_tickets->val);
 212         if (ret)
 213             goto fail;
 214     }
 215     ALLOC(t->padata, 1);
 216     if (t->padata == NULL) {
 217         ret = ENOMEM;
 218         krb5_set_error_message(context, ret, "malloc: out of memory");
 219         goto fail;
 220     }
 221     ALLOC_SEQ(t->padata, 1 + padata->len);
 222     if (t->padata->val == NULL) {
 223         ret = ENOMEM;
 224         krb5_set_error_message(context, ret, "malloc: out of memory");
 225         goto fail;
 226     }
 227     {
 228         int i;
 229         for (i = 0; i < padata->len; i++) {
 230             ret = copy_PA_DATA(&padata->val[i], &t->padata->val[i + 1]);
 231             if (ret) {
 232                 krb5_set_error_message(context, ret, "malloc: out of memory");
 233                 goto fail;
 234             }
 235         }
 236     }
 237
 238     {
 239         krb5_auth_context ac;
 240         krb5_keyblock *key = NULL;
 241
 242         ret = krb5_auth_con_init(context, &ac);
 243         if(ret)
 244             goto fail;
 245
 246         if (krb5_config_get_bool_default(context, NULL, FALSE,
 247                                          "realms",
 248                                          krbtgt->server->realm,
 249                                          "tgs_require_subkey",
 250                                          NULL))
 251         {
 252             ret = krb5_generate_subkey (context, &krbtgt->session, &key);
 253             if (ret) {
 254                 krb5_auth_con_free (context, ac);
 255                 goto fail;
 256             }
 257
 258             ret = krb5_auth_con_setlocalsubkey(context, ac, key);
 259             if (ret) {
 260                 if (key)
 261                     krb5_free_keyblock (context, key);
 262                 krb5_auth_con_free (context, ac);
 263                 goto fail;
 264             }
 265         }
 266
 267         ret = set_auth_data (context, &t->req_body, &in_creds->authdata,
 268                              key ? key : &krbtgt->session);
 269         if (ret) {
 270             if (key)
 271                 krb5_free_keyblock (context, key);
 272             krb5_auth_con_free (context, ac);
 273             goto fail;
 274         }
 275
 276         ret = make_pa_tgs_req(context,
 277                               ac,
 278                               &t->req_body,
 279                               &t->padata->val[0],
 280                               krbtgt);
 281         if(ret) {
 282             if (key)
 283                 krb5_free_keyblock (context, key);
 284             krb5_auth_con_free(context, ac);
 285             goto fail;
 286         }
 287         *subkey = key;
 288
 289         krb5_auth_con_free(context, ac);
 290     }
 291 fail:
 292     if (ret) {
 293         t->req_body.addresses = NULL;
 294         free_TGS_REQ (t);
 295     }
 296     return ret;
 297 }
 298
 299 krb5_error_code
 300 _krb5_get_krbtgt(krb5_context context,
 301                  krb5_ccache  id,
 302                  krb5_realm realm,
 303                  krb5_creds **cred)
 304 {
 305     krb5_error_code ret;
 306     krb5_creds tmp_cred;
 307
 308     memset(&tmp_cred, 0, sizeof(tmp_cred));
 309
 310     ret = krb5_cc_get_principal(context, id, &tmp_cred.client);
 311     if (ret)
 312         return ret;
 313
 314     ret = krb5_make_principal(context,
 315                               &tmp_cred.server,
 316                               realm,
 317                               KRB5_TGS_NAME,
 318                               realm,
 319                               NULL);
 320     if(ret) {
 321         krb5_free_principal(context, tmp_cred.client);
 322         return ret;
 323     }
 324     ret = krb5_get_credentials(context,
 325                                KRB5_GC_CACHED,
 326                                id,
 327                                &tmp_cred,
 328                                cred);
 329     krb5_free_principal(context, tmp_cred.client);
 330     krb5_free_principal(context, tmp_cred.server);
 331     if(ret)
 332         return ret;
 333     return 0;
 334 }
 335
 336 /* DCE compatible decrypt proc */
 337 static krb5_error_code
 338 decrypt_tkt_with_subkey (krb5_context context,
 339                          krb5_keyblock *key,
 340                          krb5_key_usage usage,
 341                          krb5_const_pointer subkey,
 342                          krb5_kdc_rep *dec_rep)
 343 {
 344     krb5_error_code ret;
 345     krb5_data data;
 346     size_t size;
 347     krb5_crypto crypto;
 348
 349     ret = krb5_crypto_init(context, key, 0, &crypto);
 350     if (ret)
 351         return ret;
 352     ret = krb5_decrypt_EncryptedData (context,
 353                                       crypto,
 354                                       usage,
 355                                       &dec_rep->kdc_rep.enc_part,
 356                                       &data);
 357     krb5_crypto_destroy(context, crypto);
 358     if(ret && subkey){
 359         /* DCE compat -- try to decrypt with subkey */
 360         ret = krb5_crypto_init(context, subkey, 0, &crypto);
 361         if (ret)
 362             return ret;
 363         ret = krb5_decrypt_EncryptedData (context,
 364                                           crypto,
 365                                           KRB5_KU_TGS_REP_ENC_PART_SUB_KEY,
 366                                           &dec_rep->kdc_rep.enc_part,
 367                                           &data);
 368         krb5_crypto_destroy(context, crypto);
 369     }
 370     if (ret)
 371         return ret;
 372
 373     ret = krb5_decode_EncASRepPart(context,
 374                                    data.data,
 375                                    data.length,
 376                                    &dec_rep->enc_part,
 377                                    &size);
 378     if (ret)
 379         ret = krb5_decode_EncTGSRepPart(context,
 380                                         data.data,
 381                                         data.length,
 382                                         &dec_rep->enc_part,
 383                                         &size);
 384     krb5_data_free (&data);
 385     return ret;
 386 }
 387
 388 static krb5_error_code
 389 get_cred_kdc(krb5_context context,
 390              krb5_ccache id,
 391              krb5_kdc_flags flags,
 392              krb5_addresses *addresses,
 393              krb5_creds *in_creds,
 394              krb5_creds *krbtgt,
 395              krb5_principal impersonate_principal,
 396              Ticket *second_ticket,
 397              krb5_creds *out_creds)
 398 {
 399     TGS_REQ req;
 400     krb5_data enc;
 401     krb5_data resp;
 402     krb5_kdc_rep rep;
 403     KRB_ERROR error;
 404     krb5_error_code ret;
 405     unsigned nonce;
 406     krb5_keyblock *subkey = NULL;
 407     size_t len;
 408     Ticket second_ticket_data;
 409     METHOD_DATA padata;
 410     int again = 0;
 411
 412 do_again:
 413
 414     krb5_data_zero(&resp);
 415     krb5_data_zero(&enc);
 416     padata.val = NULL;
 417     padata.len = 0;
 418
 419     krb5_generate_random_block(&nonce, sizeof(nonce));
 420     nonce &= 0xffffffff;
 421
 422     if(flags.b.enc_tkt_in_skey && second_ticket == NULL){
 423         ret = decode_Ticket(in_creds->second_ticket.data,
 424                             in_creds->second_ticket.length,
 425                             &second_ticket_data, &len);
 426         if(ret)
 427             return ret;
 428         second_ticket = &second_ticket_data;
 429     }
 430
 431
 432     if (impersonate_principal) {
 433         krb5_crypto crypto;
 434         PA_S4U2Self self;
 435         krb5_data data;
 436         void *buf;
 437         size_t size;
 438
 439         self.name = impersonate_principal->name;
 440         self.realm = impersonate_principal->realm;
 441         self.auth = estrdup("Kerberos");
 442
 443         ret = _krb5_s4u2self_to_checksumdata(context, &self, &data);
 444         if (ret) {
 445             free(self.auth);
 446             goto out;
 447         }
 448
 449         ret = krb5_crypto_init(context, &krbtgt->session, 0, &crypto);
 450         if (ret) {
 451             free(self.auth);
 452             krb5_data_free(&data);
 453             goto out;
 454         }
 455
 456         ret = krb5_create_checksum(context,
 457                                    crypto,
 458                                    KRB5_KU_OTHER_CKSUM,
 459                                    0,
 460                                    data.data,
 461                                    data.length,
 462                                    &self.cksum);
 463         krb5_crypto_destroy(context, crypto);
 464         krb5_data_free(&data);
 465         if (ret) {
 466             free(self.auth);
 467             goto out;
 468         }
 469
 470         ASN1_MALLOC_ENCODE(PA_S4U2Self, buf, len, &self, &size, ret);
 471         free(self.auth);
 472         free_Checksum(&self.cksum);
 473         if (ret)
 474             goto out;
 475         if (len != size)
 476             krb5_abortx(context, "internal asn1 error");
 477
 478         ret = krb5_padata_add(context, &padata, KRB5_PADATA_S4U2SELF, buf, len);
 479         if (ret)
 480             goto out;
 481     }
 482
 483     ret = init_tgs_req (context,
 484                         id,
 485                         addresses,
 486                         flags,
 487                         second_ticket,
 488                         in_creds,
 489                         krbtgt,
 490                         nonce,
 491                         &padata,
 492                         &subkey,
 493                         &req);
 494     if (ret)
 495         goto out;
 496
 497     ASN1_MALLOC_ENCODE(TGS_REQ, enc.data, enc.length, &req, &len, ret);
 498     if (ret)
 499         goto out;
 500     if(enc.length != len)
 501         krb5_abortx(context, "internal error in ASN.1 encoder");
 502
 503     /* don't free addresses */
 504     req.req_body.addresses = NULL;
 505     free_TGS_REQ(&req);
 506
 507     /*
 508      * Send and receive
 509      */
 510     {
 511         krb5_sendto_ctx stctx;
 512         ret = krb5_sendto_ctx_alloc(context, &stctx);
 513         if (ret)
 514             return ret;
 515         krb5_sendto_ctx_set_func(stctx, _krb5_kdc_retry, NULL);
 516
 517         ret = krb5_sendto_context (context, stctx, &enc,
 518                                    krbtgt->server->name.name_string.val[1],
 519                                    &resp);
 520         krb5_sendto_ctx_free(context, stctx);
 521     }
 522     if(ret)
 523         goto out;
 524
 525     memset(&rep, 0, sizeof(rep));
 526     if(decode_TGS_REP(resp.data, resp.length, &rep.kdc_rep, &len) == 0) {
 527         unsigned eflags = 0;
 528
 529         ret = krb5_copy_principal(context,
 530                                   in_creds->client,
 531                                   &out_creds->client);
 532         if(ret)
 533             goto out2;
 534         ret = krb5_copy_principal(context,
 535                                   in_creds->server,
 536                                   &out_creds->server);
 537         if(ret)
 538             goto out2;
 539         /* this should go someplace else */
 540         out_creds->times.endtime = in_creds->times.endtime;
 541
 542         /* XXX should do better testing */
 543         if (flags.b.constrained_delegation || impersonate_principal)
 544             eflags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
 545
 546         ret = _krb5_extract_ticket(context,
 547                                    &rep,
 548                                    out_creds,
 549                                    &krbtgt->session,
 550                                    NULL,
 551                                    KRB5_KU_TGS_REP_ENC_PART_SESSION,
 552                                    &krbtgt->addresses,
 553                                    nonce,
 554                                    eflags,
 555                                    decrypt_tkt_with_subkey,
 556                                    subkey);
 557     out2:
 558         krb5_free_kdc_rep(context, &rep);
 559     } else if(krb5_rd_error(context, &resp, &error) == 0) {
 560         ret = krb5_error_from_rd_error(context, &error, in_creds);
 561         if (ret == KRB5KRB_AP_ERR_SKEW) {
 562 printf("reset time TGS\n");
 563             krb5_set_real_time(context, error.stime, 0);
 564             again++;
 565         }
 566         krb5_free_error_contents(context, &error);
 567     } else if(resp.data && ((char*)resp.data)[0] == 4) {
 568         ret = KRB5KRB_AP_ERR_V4_REPLY;
 569         krb5_clear_error_string(context);
 570     } else {
 571         ret = KRB5KRB_AP_ERR_MSG_TYPE;
 572         krb5_clear_error_string(context);
 573     }
 574
 575 out:
 576     if (second_ticket == &second_ticket_data)
 577         free_Ticket(&second_ticket_data);
 578     free_METHOD_DATA(&padata);
 579     krb5_data_free(&resp);
 580     krb5_data_free(&enc);
 581     if(subkey){
 582         krb5_free_keyblock_contents(context, subkey);
 583         free(subkey);
 584     }
 585 if (ret && again == 1) goto do_again;
 586     return ret;
 587
 588 }
 589
 590 /*
 591  * same as above, just get local addresses first if the krbtgt have
 592  * them and the realm is not addressless
 593  */
 594
 595 static krb5_error_code
 596 get_cred_kdc_address(krb5_context context,
 597                      krb5_ccache id,
 598                      krb5_kdc_flags flags,
 599                      krb5_addresses *addrs,
 600                      krb5_creds *in_creds,
 601                      krb5_creds *krbtgt,
 602                      krb5_principal impersonate_principal,
 603                      Ticket *second_ticket,
 604                      krb5_creds *out_creds)
 605 {
 606     krb5_error_code ret;
 607     krb5_addresses addresses = { 0, NULL };
 608
 609     /*
 610      * Inherit the address-ness of the krbtgt if the address is not
 611      * specified.
 612      */
 613
 614     if (addrs == NULL && krbtgt->addresses.len != 0) {
 615         krb5_boolean noaddr;
 616
 617         krb5_appdefault_boolean(context, NULL, krbtgt->server->realm,
 618                                 "no-addresses", FALSE, &noaddr);
 619
 620         if (!noaddr) {
 621             krb5_get_all_client_addrs(context, &addresses);
 622             /* XXX this sucks. */
 623             addrs = &addresses;
 624             if(addresses.len == 0)
 625                 addrs = NULL;
 626         }
 627     }
 628     ret = get_cred_kdc(context, id, flags, addrs, in_creds,
 629                        krbtgt, impersonate_principal,
 630                        second_ticket, out_creds);
 631     krb5_free_addresses(context, &addresses);
 632     return ret;
 633 }
 634
 635 krb5_error_code KRB5_LIB_FUNCTION
 636 krb5_get_kdc_cred(krb5_context context,
 637                   krb5_ccache id,
 638                   krb5_kdc_flags flags,
 639                   krb5_addresses *addresses,
 640                   Ticket  *second_ticket,
 641                   krb5_creds *in_creds,
 642                   krb5_creds **out_creds
 643                   )
 644 {
 645     krb5_error_code ret;
 646     krb5_creds *krbtgt;
 647
 648     *out_creds = calloc(1, sizeof(**out_creds));
 649     if(*out_creds == NULL) {
 650         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 651         return ENOMEM;
 652     }
 653     ret = _krb5_get_krbtgt (context,
 654                             id,
 655                             in_creds->server->realm,
 656                             &krbtgt);
 657     if(ret) {
 658         free(*out_creds);
 659         return ret;
 660     }
 661     ret = get_cred_kdc(context, id, flags, addresses,
 662                        in_creds, krbtgt, NULL, NULL, *out_creds);
 663     krb5_free_creds (context, krbtgt);
 664     if(ret)
 665         free(*out_creds);
 666     return ret;
 667 }
 668
 669 static int
 670 not_found(krb5_context context, krb5_const_principal p, krb5_error_code code)
 671 {
 672     krb5_error_code ret;
 673     char *str;
 674
 675     ret = krb5_unparse_name(context, p, &str);
 676     if(ret) {
 677         krb5_clear_error_string(context);
 678         return code;
 679     }
 680     krb5_set_error_message(context, code, "Matching credential (%s) not found", str);
 681     free(str);
 682     return code;
 683 }
 684
 685 static krb5_error_code
 686 find_cred(krb5_context context,
 687           krb5_ccache id,
 688           krb5_principal server,
 689           krb5_creds **tgts,
 690           krb5_creds *out_creds)
 691 {
 692     krb5_error_code ret;
 693     krb5_creds mcreds;
 694
 695     krb5_cc_clear_mcred(&mcreds);
 696     mcreds.server = server;
 697     ret = krb5_cc_retrieve_cred(context, id, KRB5_TC_DONT_MATCH_REALM,
 698                                 &mcreds, out_creds);
 699     if(ret == 0)
 700         return 0;
 701     while(tgts && *tgts){
 702         if(krb5_compare_creds(context, KRB5_TC_DONT_MATCH_REALM,
 703                               &mcreds, *tgts)){
 704             ret = krb5_copy_creds_contents(context, *tgts, out_creds);
 705             return ret;
 706         }
 707         tgts++;
 708     }
 709     return not_found(context, server, KRB5_CC_NOTFOUND);
 710 }
 711
 712 static krb5_error_code
 713 add_cred(krb5_context context, krb5_creds const *tkt, krb5_creds ***tgts)
 714 {
 715     int i;
 716     krb5_error_code ret;
 717     krb5_creds **tmp = *tgts;
 718
 719     for(i = 0; tmp && tmp[i]; i++); /* XXX */
 720     tmp = realloc(tmp, (i+2)*sizeof(*tmp));
 721     if(tmp == NULL) {
 722         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 723         return ENOMEM;
 724     }
 725     *tgts = tmp;
 726     ret = krb5_copy_creds(context, tkt, &tmp[i]);
 727     tmp[i+1] = NULL;
 728     return ret;
 729 }
 730
 731 /*
 732 get_cred(server)
 733         creds = cc_get_cred(server)
 734         if(creds) return creds
 735         tgt = cc_get_cred(krbtgt/server_realm@any_realm)
 736         if(tgt)
 737                 return get_cred_tgt(server, tgt)
 738         if(client_realm == server_realm)
 739                 return NULL
 740         tgt = get_cred(krbtgt/server_realm@client_realm)
 741         while(tgt_inst != server_realm)
 742                 tgt = get_cred(krbtgt/server_realm@tgt_inst)
 743         return get_cred_tgt(server, tgt)
 744         */
 745
 746 static krb5_error_code
 747 get_cred_kdc_capath(krb5_context context,
 748                     krb5_kdc_flags flags,
 749                     krb5_ccache ccache,
 750                     krb5_creds *in_creds,
 751                     krb5_principal impersonate_principal,
 752                     Ticket *second_ticket,
 753                     krb5_creds **out_creds,
 754                     krb5_creds ***ret_tgts)
 755 {
 756     krb5_error_code ret;
 757     krb5_creds *tgt, tmp_creds;
 758     krb5_const_realm client_realm, server_realm, try_realm;
 759
 760     *out_creds = NULL;
 761
 762     client_realm = krb5_principal_get_realm(context, in_creds->client);
 763     server_realm = krb5_principal_get_realm(context, in_creds->server);
 764     memset(&tmp_creds, 0, sizeof(tmp_creds));
 765     ret = krb5_copy_principal(context, in_creds->client, &tmp_creds.client);
 766     if(ret)
 767         return ret;
 768
 769     try_realm = krb5_config_get_string(context, NULL, "capaths",
 770                                        client_realm, server_realm, NULL);
 771     if (try_realm == NULL)
 772         try_realm = client_realm;
 773
 774     ret = krb5_make_principal(context,
 775                               &tmp_creds.server,
 776                               try_realm,
 777                               KRB5_TGS_NAME,
 778                               server_realm,
 779                               NULL);
 780     if(ret){
 781         krb5_free_principal(context, tmp_creds.client);
 782         return ret;
 783     }
 784     {
 785         krb5_creds tgts;
 786
 787         ret = find_cred(context, ccache, tmp_creds.server,
 788                         *ret_tgts, &tgts);
 789         if(ret == 0){
 790             *out_creds = calloc(1, sizeof(**out_creds));
 791             if(*out_creds == NULL) {
 792                 ret = ENOMEM;
 793                 krb5_set_error_message(context, ret, "malloc: out of memory");
 794             } else {
 795                 ret = get_cred_kdc_address(context, ccache, flags, NULL,
 796                                            in_creds, &tgts,
 797                                            impersonate_principal,
 798                                            second_ticket,
 799                                            *out_creds);
 800                 if (ret) {
 801                     free (*out_creds);
 802                     *out_creds = NULL;
 803                 }
 804             }
 805             krb5_free_cred_contents(context, &tgts);
 806             krb5_free_principal(context, tmp_creds.server);
 807             krb5_free_principal(context, tmp_creds.client);
 808             return ret;
 809         }
 810     }
 811     if(krb5_realm_compare(context, in_creds->client, in_creds->server))
 812         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
 813
 814     /* XXX this can loop forever */
 815     while(1){
 816         heim_general_string tgt_inst;
 817
 818         ret = get_cred_kdc_capath(context, flags, ccache, &tmp_creds,
 819                                   NULL, NULL, &tgt, ret_tgts);
 820         if(ret) {
 821             krb5_free_principal(context, tmp_creds.server);
 822             krb5_free_principal(context, tmp_creds.client);
 823             return ret;
 824         }
 825         ret = add_cred(context, tgt, ret_tgts);
 826         if(ret) {
 827             krb5_free_principal(context, tmp_creds.server);
 828             krb5_free_principal(context, tmp_creds.client);
 829             return ret;
 830         }
 831         tgt_inst = tgt->server->name.name_string.val[1];
 832         if(strcmp(tgt_inst, server_realm) == 0)
 833             break;
 834         krb5_free_principal(context, tmp_creds.server);
 835         ret = krb5_make_principal(context, &tmp_creds.server,
 836                                   tgt_inst, KRB5_TGS_NAME, server_realm, NULL);
 837         if(ret) {
 838             krb5_free_principal(context, tmp_creds.server);
 839             krb5_free_principal(context, tmp_creds.client);
 840             return ret;
 841         }
 842         ret = krb5_free_creds(context, tgt);
 843         if(ret) {
 844             krb5_free_principal(context, tmp_creds.server);
 845             krb5_free_principal(context, tmp_creds.client);
 846             return ret;
 847         }
 848     }
 849
 850     krb5_free_principal(context, tmp_creds.server);
 851     krb5_free_principal(context, tmp_creds.client);
 852     *out_creds = calloc(1, sizeof(**out_creds));
 853     if(*out_creds == NULL) {
 854         ret = ENOMEM;
 855         krb5_set_error_message(context, ret, "malloc: out of memory");
 856     } else {
 857         ret = get_cred_kdc_address (context, ccache, flags, NULL,
 858                                     in_creds, tgt, impersonate_principal,
 859                                     second_ticket, *out_creds);
 860         if (ret) {
 861             free (*out_creds);
 862             *out_creds = NULL;
 863         }
 864     }
 865     krb5_free_creds(context, tgt);
 866     return ret;
 867 }
 868
 869 static krb5_error_code
 870 get_cred_kdc_referral(krb5_context context,
 871                       krb5_kdc_flags flags,
 872                       krb5_ccache ccache,
 873                       krb5_creds *in_creds,
 874                       krb5_principal impersonate_principal,
 875                       Ticket *second_ticket,
 876                       krb5_creds **out_creds,
 877                       krb5_creds ***ret_tgts)
 878 {
 879     krb5_const_realm client_realm;
 880     krb5_error_code ret;
 881     krb5_creds tgt, referral, ticket;
 882     int loop = 0;
 883
 884     memset(&tgt, 0, sizeof(tgt));
 885     memset(&ticket, 0, sizeof(ticket));
 886
 887     flags.b.canonicalize = 1;
 888
 889     *out_creds = NULL;
 890
 891     client_realm = krb5_principal_get_realm(context, in_creds->client);
 892
 893     /* find tgt for the clients base realm */
 894     {
 895         krb5_principal tgtname;
 896
 897         ret = krb5_make_principal(context, &tgtname,
 898                                   client_realm,
 899                                   KRB5_TGS_NAME,
 900                                   client_realm,
 901                                   NULL);
 902         if(ret)
 903             return ret;
 904
 905         ret = find_cred(context, ccache, tgtname, *ret_tgts, &tgt);
 906         krb5_free_principal(context, tgtname);
 907         if (ret)
 908             return ret;
 909     }
 910
 911     referral = *in_creds;
 912     ret = krb5_copy_principal(context, in_creds->server, &referral.server);
 913     if (ret) {
 914         krb5_free_cred_contents(context, &tgt);
 915         return ret;
 916     }
 917     ret = krb5_principal_set_realm(context, referral.server, client_realm);
 918     if (ret) {
 919         krb5_free_cred_contents(context, &tgt);
 920         krb5_free_principal(context, referral.server);
 921         return ret;
 922     }
 923
 924     while (loop++ < 17) {
 925         krb5_creds **tickets;
 926         krb5_creds mcreds;
 927         char *referral_realm;
 928
 929         /* Use cache if we are not doing impersonation or contrainte deleg */
 930         if (impersonate_principal == NULL || flags.b.constrained_delegation) {
 931             krb5_cc_clear_mcred(&mcreds);
 932             mcreds.server = referral.server;
 933             ret = krb5_cc_retrieve_cred(context, ccache, 0, &mcreds, &ticket);
 934         } else
 935             ret = EINVAL;
 936
 937         if (ret) {
 938             ret = get_cred_kdc_address (context, ccache, flags, NULL,
 939                                         &referral, &tgt, impersonate_principal,
 940                                         second_ticket, &ticket);
 941             if (ret)
 942                 goto out;
 943         }
 944
 945         /* Did we get the right ticket ? */
 946         if (krb5_principal_compare_any_realm(context,
 947                                              referral.server,
 948                                              ticket.server))
 949             break;
 950
 951         if (ticket.server->name.name_string.len != 2 &&
 952             strcmp(ticket.server->name.name_string.val[0], KRB5_TGS_NAME) != 0)
 953         {
 954             krb5_set_error_message(context, KRB5KRB_AP_ERR_NOT_US,
 955                                    "Got back an non krbtgt ticket referrals");
 956             krb5_free_cred_contents(context, &ticket);
 957             return KRB5KRB_AP_ERR_NOT_US;
 958         }
 959
 960         referral_realm = ticket.server->name.name_string.val[1];
 961
 962         /* check that there are no referrals loops */
 963         tickets = *ret_tgts;
 964
 965         krb5_cc_clear_mcred(&mcreds);
 966         mcreds.server = ticket.server;
 967
 968         while(tickets && *tickets){
 969             if(krb5_compare_creds(context,
 970                                   KRB5_TC_DONT_MATCH_REALM,
 971                                   &mcreds,
 972                                   *tickets))
 973             {
 974                 krb5_set_error_message(context, KRB5_GET_IN_TKT_LOOP,
 975                                        "Referral from %s loops back to realm %s",
 976                                        tgt.server->realm,
 977                                        referral_realm);
 978                 krb5_free_cred_contents(context, &ticket);
 979                 return KRB5_GET_IN_TKT_LOOP;
 980             }
 981             tickets++;
 982         }
 983
 984         ret = add_cred(context, &ticket, ret_tgts);
 985         if (ret) {
 986             krb5_free_cred_contents(context, &ticket);
 987             goto out;
 988         }
 989
 990         /* try realm in the referral */
 991         ret = krb5_principal_set_realm(context,
 992                                        referral.server,
 993                                        referral_realm);
 994         krb5_free_cred_contents(context, &tgt);
 995         tgt = ticket;
 996         memset(&ticket, 0, sizeof(ticket));
 997         if (ret)
 998             goto out;
 999     }
1000
1001     ret = krb5_copy_creds(context, &ticket, out_creds);
1002
1003 out:
1004     krb5_free_principal(context, referral.server);
1005     krb5_free_cred_contents(context, &tgt);
1006     return ret;
1007 }
1008
1009
1010 /*
1011  * Glue function between referrals version and old client chasing
1012  * codebase.
1013  */
1014
1015 static krb5_error_code
1016 get_cred_kdc_any(krb5_context context,
1017                  krb5_kdc_flags flags,
1018                  krb5_ccache ccache,
1019                  krb5_creds *in_creds,
1020                  krb5_principal impersonate_principal,
1021                  Ticket *second_ticket,
1022                  krb5_creds **out_creds,
1023                  krb5_creds ***ret_tgts)
1024 {
1025     krb5_error_code ret;
1026
1027     ret = get_cred_kdc_referral(context,
1028                                 flags,
1029                                 ccache,
1030                                 in_creds,
1031                                 impersonate_principal,
1032                                 second_ticket,
1033                                 out_creds,
1034                                 ret_tgts);
1035     if (ret == 0 || flags.b.canonicalize)
1036         return ret;
1037     return get_cred_kdc_capath(context,
1038                                 flags,
1039                                 ccache,
1040                                 in_creds,
1041                                 impersonate_principal,
1042                                 second_ticket,
1043                                 out_creds,
1044                                 ret_tgts);
1045 }
1046
1047
1048 krb5_error_code KRB5_LIB_FUNCTION
1049 krb5_get_cred_from_kdc_opt(krb5_context context,
1050                            krb5_ccache ccache,
1051                            krb5_creds *in_creds,
1052                            krb5_creds **out_creds,
1053                            krb5_creds ***ret_tgts,
1054                            krb5_flags flags)
1055 {
1056     krb5_kdc_flags f;
1057     f.i = flags;
1058     return get_cred_kdc_any(context, f, ccache,
1059                             in_creds, NULL, NULL,
1060                             out_creds, ret_tgts);
1061 }
1062
1063 krb5_error_code KRB5_LIB_FUNCTION
1064 krb5_get_cred_from_kdc(krb5_context context,
1065                        krb5_ccache ccache,
1066                        krb5_creds *in_creds,
1067                        krb5_creds **out_creds,
1068                        krb5_creds ***ret_tgts)
1069 {
1070     return krb5_get_cred_from_kdc_opt(context, ccache,
1071                                       in_creds, out_creds, ret_tgts, 0);
1072 }
1073
1074
1075 krb5_error_code KRB5_LIB_FUNCTION
1076 krb5_get_credentials_with_flags(krb5_context context,
1077                                 krb5_flags options,
1078                                 krb5_kdc_flags flags,
1079                                 krb5_ccache ccache,
1080                                 krb5_creds *in_creds,
1081                                 krb5_creds **out_creds)
1082 {
1083     krb5_error_code ret;
1084     krb5_creds **tgts;
1085     krb5_creds *res_creds;
1086     int i;
1087
1088     *out_creds = NULL;
1089     res_creds = calloc(1, sizeof(*res_creds));
1090     if (res_creds == NULL) {
1091         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1092         return ENOMEM;
1093     }
1094
1095     if (in_creds->session.keytype)
1096         options |= KRB5_TC_MATCH_KEYTYPE;
1097
1098     /*
1099      * If we got a credential, check if credential is expired before
1100      * returning it.
1101      */
1102     ret = krb5_cc_retrieve_cred(context,
1103                                 ccache,
1104                                 in_creds->session.keytype ?
1105                                 KRB5_TC_MATCH_KEYTYPE : 0,
1106                                 in_creds, res_creds);
1107     /*
1108      * If we got a credential, check if credential is expired before
1109      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1110      */
1111     if (ret == 0) {
1112         krb5_timestamp timeret;
1113
1114         /* If expired ok, don't bother checking */
1115         if(options & KRB5_GC_EXPIRED_OK) {
1116             *out_creds = res_creds;
1117             return 0;
1118         }
1119
1120         krb5_timeofday(context, &timeret);
1121         if(res_creds->times.endtime > timeret) {
1122             *out_creds = res_creds;
1123             return 0;
1124         }
1125         if(options & KRB5_GC_CACHED)
1126             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1127
1128     } else if(ret != KRB5_CC_END) {
1129         free(res_creds);
1130         return ret;
1131     }
1132     free(res_creds);
1133     if(options & KRB5_GC_CACHED)
1134         return not_found(context, in_creds->server, KRB5_CC_NOTFOUND);
1135
1136     if(options & KRB5_GC_USER_USER)
1137         flags.b.enc_tkt_in_skey = 1;
1138     if (flags.b.enc_tkt_in_skey)
1139         options |= KRB5_GC_NO_STORE;
1140
1141     tgts = NULL;
1142     ret = get_cred_kdc_any(context, flags, ccache,
1143                            in_creds, NULL, NULL, out_creds, &tgts);
1144     for(i = 0; tgts && tgts[i]; i++) {
1145         krb5_cc_store_cred(context, ccache, tgts[i]);
1146         krb5_free_creds(context, tgts[i]);
1147     }
1148     free(tgts);
1149     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1150         krb5_cc_store_cred(context, ccache, *out_creds);
1151     return ret;
1152 }
1153
1154 krb5_error_code KRB5_LIB_FUNCTION
1155 krb5_get_credentials(krb5_context context,
1156                      krb5_flags options,
1157                      krb5_ccache ccache,
1158                      krb5_creds *in_creds,
1159                      krb5_creds **out_creds)
1160 {
1161     krb5_kdc_flags flags;
1162     flags.i = 0;
1163     return krb5_get_credentials_with_flags(context, options, flags,
1164                                            ccache, in_creds, out_creds);
1165 }
1166
1167 struct krb5_get_creds_opt_data {
1168     krb5_principal self;
1169     krb5_flags options;
1170     krb5_enctype enctype;
1171     Ticket *ticket;
1172 };
1173
1174
1175 krb5_error_code KRB5_LIB_FUNCTION
1176 krb5_get_creds_opt_alloc(krb5_context context, krb5_get_creds_opt *opt)
1177 {
1178     *opt = calloc(1, sizeof(**opt));
1179     if (*opt == NULL) {
1180         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1181         return ENOMEM;
1182     }
1183     return 0;
1184 }
1185
1186 void KRB5_LIB_FUNCTION
1187 krb5_get_creds_opt_free(krb5_context context, krb5_get_creds_opt opt)
1188 {
1189     if (opt->self)
1190         krb5_free_principal(context, opt->self);
1191     memset(opt, 0, sizeof(*opt));
1192     free(opt);
1193 }
1194
1195 void KRB5_LIB_FUNCTION
1196 krb5_get_creds_opt_set_options(krb5_context context,
1197                                krb5_get_creds_opt opt,
1198                                krb5_flags options)
1199 {
1200     opt->options = options;
1201 }
1202
1203 void KRB5_LIB_FUNCTION
1204 krb5_get_creds_opt_add_options(krb5_context context,
1205                                krb5_get_creds_opt opt,
1206                                krb5_flags options)
1207 {
1208     opt->options |= options;
1209 }
1210
1211 void KRB5_LIB_FUNCTION
1212 krb5_get_creds_opt_set_enctype(krb5_context context,
1213                                krb5_get_creds_opt opt,
1214                                krb5_enctype enctype)
1215 {
1216     opt->enctype = enctype;
1217 }
1218
1219 krb5_error_code KRB5_LIB_FUNCTION
1220 krb5_get_creds_opt_set_impersonate(krb5_context context,
1221                                    krb5_get_creds_opt opt,
1222                                    krb5_const_principal self)
1223 {
1224     if (opt->self)
1225         krb5_free_principal(context, opt->self);
1226     return krb5_copy_principal(context, self, &opt->self);
1227 }
1228
1229 krb5_error_code KRB5_LIB_FUNCTION
1230 krb5_get_creds_opt_set_ticket(krb5_context context,
1231                               krb5_get_creds_opt opt,
1232                               const Ticket *ticket)
1233 {
1234     if (opt->ticket) {
1235         free_Ticket(opt->ticket);
1236         free(opt->ticket);
1237         opt->ticket = NULL;
1238     }
1239     if (ticket) {
1240         krb5_error_code ret;
1241
1242         opt->ticket = malloc(sizeof(*ticket));
1243         if (opt->ticket == NULL) {
1244             krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1245             return ENOMEM;
1246         }
1247         ret = copy_Ticket(ticket, opt->ticket);
1248         if (ret) {
1249             free(opt->ticket);
1250             opt->ticket = NULL;
1251             krb5_set_error_message(context, ret, "malloc: out of memory");
1252             return ret;
1253         }
1254     }
1255     return 0;
1256 }
1257
1258
1259
1260 krb5_error_code KRB5_LIB_FUNCTION
1261 krb5_get_creds(krb5_context context,
1262                krb5_get_creds_opt opt,
1263                krb5_ccache ccache,
1264                krb5_const_principal inprinc,
1265                krb5_creds **out_creds)
1266 {
1267     krb5_kdc_flags flags;
1268     krb5_flags options;
1269     krb5_creds in_creds;
1270     krb5_error_code ret;
1271     krb5_creds **tgts;
1272     krb5_creds *res_creds;
1273     int i;
1274
1275     memset(&in_creds, 0, sizeof(in_creds));
1276     in_creds.server = rk_UNCONST(inprinc);
1277
1278     ret = krb5_cc_get_principal(context, ccache, &in_creds.client);
1279     if (ret)
1280         return ret;
1281
1282     options = opt->options;
1283     flags.i = 0;
1284
1285     *out_creds = NULL;
1286     res_creds = calloc(1, sizeof(*res_creds));
1287     if (res_creds == NULL) {
1288         krb5_free_principal(context, in_creds.client);
1289         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1290         return ENOMEM;
1291     }
1292
1293     if (opt->enctype) {
1294         in_creds.session.keytype = opt->enctype;
1295         options |= KRB5_TC_MATCH_KEYTYPE;
1296     }
1297
1298     /*
1299      * If we got a credential, check if credential is expired before
1300      * returning it.
1301      */
1302     ret = krb5_cc_retrieve_cred(context,
1303                                 ccache,
1304                                 opt->enctype ? KRB5_TC_MATCH_KEYTYPE : 0,
1305                                 &in_creds, res_creds);
1306     /*
1307      * If we got a credential, check if credential is expired before
1308      * returning it, but only if KRB5_GC_EXPIRED_OK is not set.
1309      */
1310     if (ret == 0) {
1311         krb5_timestamp timeret;
1312
1313         /* If expired ok, don't bother checking */
1314         if(options & KRB5_GC_EXPIRED_OK) {
1315             *out_creds = res_creds;
1316             krb5_free_principal(context, in_creds.client);
1317             return 0;
1318         }
1319
1320         krb5_timeofday(context, &timeret);
1321         if(res_creds->times.endtime > timeret) {
1322             *out_creds = res_creds;
1323             krb5_free_principal(context, in_creds.client);
1324             return 0;
1325         }
1326         if(options & KRB5_GC_CACHED)
1327             krb5_cc_remove_cred(context, ccache, 0, res_creds);
1328
1329     } else if(ret != KRB5_CC_END) {
1330         free(res_creds);
1331         krb5_free_principal(context, in_creds.client);
1332         return ret;
1333     }
1334     free(res_creds);
1335     if(options & KRB5_GC_CACHED) {
1336         krb5_free_principal(context, in_creds.client);
1337         return not_found(context, in_creds.server, KRB5_CC_NOTFOUND);
1338     }
1339     if(options & KRB5_GC_USER_USER) {
1340         flags.b.enc_tkt_in_skey = 1;
1341         options |= KRB5_GC_NO_STORE;
1342     }
1343     if (options & KRB5_GC_FORWARDABLE)
1344         flags.b.forwardable = 1;
1345     if (options & KRB5_GC_NO_TRANSIT_CHECK)
1346         flags.b.disable_transited_check = 1;
1347     if (options & KRB5_GC_CONSTRAINED_DELEGATION) {
1348         flags.b.request_anonymous = 1; /* XXX ARGH confusion */
1349         flags.b.constrained_delegation = 1;
1350     }
1351     if (options & KRB5_GC_CANONICALIZE)
1352         flags.b.canonicalize = 1;
1353
1354     tgts = NULL;
1355     ret = get_cred_kdc_any(context, flags, ccache,
1356                            &in_creds, opt->self, opt->ticket,
1357                            out_creds, &tgts);
1358     krb5_free_principal(context, in_creds.client);
1359     for(i = 0; tgts && tgts[i]; i++) {
1360         krb5_cc_store_cred(context, ccache, tgts[i]);
1361         krb5_free_creds(context, tgts[i]);
1362     }
1363     free(tgts);
1364     if(ret == 0 && (options & KRB5_GC_NO_STORE) == 0)
1365         krb5_cc_store_cred(context, ccache, *out_creds);
1366     return ret;
1367 }
1368
1369 /*
1370  *
1371  */
1372
1373 krb5_error_code KRB5_LIB_FUNCTION
1374 krb5_get_renewed_creds(krb5_context context,
1375                        krb5_creds *creds,
1376                        krb5_const_principal client,
1377                        krb5_ccache ccache,
1378                        const char *in_tkt_service)
1379 {
1380     krb5_error_code ret;
1381     krb5_kdc_flags flags;
1382     krb5_creds in, *template, *out = NULL;
1383
1384     memset(&in, 0, sizeof(in));
1385     memset(creds, 0, sizeof(*creds));
1386
1387     ret = krb5_copy_principal(context, client, &in.client);
1388     if (ret)
1389         return ret;
1390
1391     if (in_tkt_service) {
1392         ret = krb5_parse_name(context, in_tkt_service, &in.server);
1393         if (ret) {
1394             krb5_free_principal(context, in.client);
1395             return ret;
1396         }
1397     } else {
1398         const char *realm = krb5_principal_get_realm(context, client);
1399
1400         ret = krb5_make_principal(context, &in.server, realm, KRB5_TGS_NAME,
1401                                   realm, NULL);
1402         if (ret) {
1403             krb5_free_principal(context, in.client);
1404             return ret;
1405         }
1406     }
1407
1408     flags.i = 0;
1409     flags.b.renewable = flags.b.renew = 1;
1410
1411     /*
1412      * Get template from old credential cache for the same entry, if
1413      * this failes, no worries.
1414      */
1415     ret = krb5_get_credentials(context, KRB5_GC_CACHED, ccache, &in, &template);
1416     if (ret == 0) {
1417         flags.b.forwardable = template->flags.b.forwardable;
1418         flags.b.proxiable = template->flags.b.proxiable;
1419         krb5_free_creds (context, template);
1420     }
1421
1422     ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &in, &out);
1423     krb5_free_principal(context, in.client);
1424     krb5_free_principal(context, in.server);
1425     if (ret)
1426         return ret;
1427
1428     ret = krb5_copy_creds_contents(context, out, creds);
1429     krb5_free_creds(context, out);
1430
1431     return ret;
1432 }