source3/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  24 #define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
  25
  26 #include "includes.h"
  27
  28 #ifdef HAVE_KRB5
  29
  30 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
  31 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  32 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  33 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  34 #else /* MIT */
  35 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  36 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  37 #define KRB5_KEY_DATA(k)        ((k)->contents)
  38 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  39
  40 /**************************************************************
  41  Wrappers around kerberos string functions that convert from
  42  utf8 -> unix charset and vica versa.
  43 **************************************************************/
  44
  45 /**************************************************************
  46  krb5_parse_name that takes a UNIX charset.
  47 **************************************************************/
  48
  49  krb5_error_code smb_krb5_parse_name(krb5_context context,
  50                                 const char *name, /* in unix charset */
  51                                 krb5_principal *principal)
  52 {
  53         krb5_error_code ret;
  54         char *utf8_name;
  55         size_t converted_size;
  56
  57         if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
  58                 return ENOMEM;
  59         }
  60
  61         ret = krb5_parse_name(context, utf8_name, principal);
  62         SAFE_FREE(utf8_name);
  63         return ret;
  64 }
  65
  66 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
  67 /**************************************************************
  68  krb5_parse_name_norealm that takes a UNIX charset.
  69 **************************************************************/
  70
  71 static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
  72                                 const char *name, /* in unix charset */
  73                                 krb5_principal *principal)
  74 {
  75         krb5_error_code ret;
  76         char *utf8_name;
  77         size_t converted_size;
  78
  79         *principal = NULL;
  80         if (!push_utf8_allocate(&utf8_name, name, &converted_size)) {
  81                 return ENOMEM;
  82         }
  83
  84         ret = krb5_parse_name_norealm(context, utf8_name, principal);
  85         SAFE_FREE(utf8_name);
  86         return ret;
  87 }
  88 #endif
  89
  90 /**************************************************************
  91  krb5_parse_name that returns a UNIX charset name. Must
  92  be freed with normal free() call.
  93 **************************************************************/
  94
  95  krb5_error_code smb_krb5_unparse_name(krb5_context context,
  96                                         krb5_const_principal principal,
  97                                         char **unix_name)
  98 {
  99         krb5_error_code ret;
 100         char *utf8_name;
 101         size_t converted_size;
 102
 103         *unix_name = NULL;
 104         ret = krb5_unparse_name(context, principal, &utf8_name);
 105         if (ret) {
 106                 return ret;
 107         }
 108
 109         if (!pull_utf8_allocate(unix_name, utf8_name, &converted_size)) {
 110                 krb5_free_unparsed_name(context, utf8_name);
 111                 return ENOMEM;
 112         }
 113         krb5_free_unparsed_name(context, utf8_name);
 114         return 0;
 115 }
 116
 117 #ifndef HAVE_KRB5_SET_REAL_TIME
 118 /*
 119  * This function is not in the Heimdal mainline.
 120  */
 121  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
 122 {
 123         krb5_error_code ret;
 124         int32_t sec, usec;
 125
 126         ret = krb5_us_timeofday(context, &sec, &usec);
 127         if (ret)
 128                 return ret;
 129
 130         context->kdc_sec_offset = seconds - sec;
 131         context->kdc_usec_offset = microseconds - usec;
 132
 133         return 0;
 134 }
 135 #endif
 136
 137 #if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
 138
 139 #if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
 140
 141 /* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
 142  * to krb5_set_default_tgs_ktypes. See
 143  *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
 144  *
 145  * If the MIT libraries are not exporting internal symbols, we will end up in
 146  * this branch, which is correct. Otherwise we will continue to use the
 147  * internal symbol
 148  */
 149  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 150 {
 151     return krb5_set_default_tgs_enctypes(ctx, enc);
 152 }
 153
 154 #elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
 155
 156 /* Heimdal */
 157  krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
 158 {
 159         return krb5_set_default_in_tkt_etypes(ctx, enc);
 160 }
 161
 162 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
 163
 164 #endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
 165
 166 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
 167 /* HEIMDAL */
 168  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 169 {
 170         memset(pkaddr, '\0', sizeof(krb5_address));
 171 #if defined(HAVE_IPV6) && defined(KRB5_ADDRESS_INET6)
 172         if (paddr->ss_family == AF_INET6) {
 173                 pkaddr->addr_type = KRB5_ADDRESS_INET6;
 174                 pkaddr->address.length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 175                 pkaddr->address.data = (char *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 176                 return true;
 177         }
 178 #endif
 179         if (paddr->ss_family == AF_INET) {
 180                 pkaddr->addr_type = KRB5_ADDRESS_INET;
 181                 pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 182                 pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 183                 return true;
 184         }
 185         return false;
 186 }
 187 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 188 /* MIT */
 189  bool setup_kaddr( krb5_address *pkaddr, struct sockaddr_storage *paddr)
 190 {
 191         memset(pkaddr, '\0', sizeof(krb5_address));
 192 #if defined(HAVE_IPV6) && defined(ADDRTYPE_INET6)
 193         if (paddr->ss_family == AF_INET6) {
 194                 pkaddr->addrtype = ADDRTYPE_INET6;
 195                 pkaddr->length = sizeof(((struct sockaddr_in6 *)paddr)->sin6_addr);
 196                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in6 *)paddr)->sin6_addr);
 197                 return true;
 198         }
 199 #endif
 200         if (paddr->ss_family == AF_INET) {
 201                 pkaddr->addrtype = ADDRTYPE_INET;
 202                 pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 203                 pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 204                 return true;
 205         }
 206         return false;
 207 }
 208 #else
 209 #error UNKNOWN_ADDRTYPE
 210 #endif
 211
 212 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
 213 static int create_kerberos_key_from_string_direct(krb5_context context,
 214                                                   krb5_principal host_princ,
 215                                                   krb5_data *password,
 216                                                   krb5_keyblock *key,
 217                                                   krb5_enctype enctype,
 218                                                   bool no_salt)
 219 {
 220         int ret = 0;
 221         krb5_data salt;
 222         krb5_encrypt_block eblock;
 223
 224         if (no_salt) {
 225                 key->contents = (krb5_octet *)SMB_MALLOC(password->length);
 226                 if (!key->contents) {
 227                         return ENOMEM;
 228                 }
 229                 memcpy(key->contents, password->data, password->length);
 230                 key->length = password->length;
 231                 key->enctype = enctype;
 232         } else {
 233                 ret = krb5_principal2salt(context, host_princ, &salt);
 234                 if (ret) {
 235                         DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 236                         return ret;
 237                 }
 238                 krb5_use_enctype(context, &eblock, enctype);
 239                 ret = krb5_string_to_key(context, &eblock, key, password, &salt);
 240                 SAFE_FREE(salt.data);
 241         }
 242         return ret;
 243 }
 244 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 245 static int create_kerberos_key_from_string_direct(krb5_context context,
 246                                                   krb5_principal host_princ,
 247                                                   krb5_data *password,
 248                                                   krb5_keyblock *key,
 249                                                   krb5_enctype enctype,
 250                                                   bool no_salt)
 251 {
 252         int ret;
 253         krb5_salt salt;
 254
 255         if (no_salt) {
 256                 return krb5_keyblock_init(context, enctype,
 257                                           password->data, password->length,
 258                                           key);
 259         } else {
 260                 ret = krb5_get_pw_salt(context, host_princ, &salt);
 261                 if (ret) {
 262                         DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 263                         return ret;
 264                 }
 265
 266                 ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
 267                 krb5_free_salt(context, salt);
 268         }
 269
 270         return ret;
 271 }
 272 #else
 273 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 274 #endif
 275
 276  int create_kerberos_key_from_string(krb5_context context,
 277                                         krb5_principal host_princ,
 278                                         krb5_data *password,
 279                                         krb5_keyblock *key,
 280                                         krb5_enctype enctype,
 281                                         bool no_salt)
 282 {
 283         krb5_principal salt_princ = NULL;
 284         int ret;
 285         /*
 286          * Check if we've determined that the KDC is salting keys for this
 287          * principal/enctype in a non-obvious way.  If it is, try to match
 288          * its behavior.
 289          */
 290         salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
 291         ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype, no_salt);
 292         if (salt_princ) {
 293                 krb5_free_principal(context, salt_princ);
 294         }
 295         return ret;
 296 }
 297
 298 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 299  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 300                                             krb5_enctype **enctypes)
 301 {
 302         return krb5_get_permitted_enctypes(context, enctypes);
 303 }
 304 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 305  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 306                                             krb5_enctype **enctypes)
 307 {
 308         return krb5_get_default_in_tkt_etypes(context, enctypes);
 309 }
 310 #else
 311 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 312 #endif
 313
 314 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 315  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 316                                         krb5_auth_context auth_context,
 317                                         krb5_keyblock *keyblock)
 318 {
 319         return krb5_auth_con_setkey(context, auth_context, keyblock);
 320 }
 321 #endif
 322
 323 bool unwrap_edata_ntstatus(TALLOC_CTX *mem_ctx,
 324                            DATA_BLOB *edata,
 325                            DATA_BLOB *edata_out)
 326 {
 327         DATA_BLOB edata_contents;
 328         ASN1_DATA data;
 329         int edata_type;
 330
 331         if (!edata->length) {
 332                 return False;
 333         }
 334
 335         asn1_load(&data, *edata);
 336         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 337         asn1_start_tag(&data, ASN1_CONTEXT(1));
 338         asn1_read_Integer(&data, &edata_type);
 339
 340         if (edata_type != KRB5_PADATA_PW_SALT) {
 341                 DEBUG(0,("edata is not of required type %d but of type %d\n",
 342                         KRB5_PADATA_PW_SALT, edata_type));
 343                 asn1_free(&data);
 344                 return False;
 345         }
 346
 347         asn1_start_tag(&data, ASN1_CONTEXT(2));
 348         asn1_read_OctetString(&data, &edata_contents);
 349         asn1_end_tag(&data);
 350         asn1_end_tag(&data);
 351         asn1_end_tag(&data);
 352         asn1_free(&data);
 353
 354         *edata_out = data_blob_talloc(mem_ctx, edata_contents.data, edata_contents.length);
 355
 356         data_blob_free(&edata_contents);
 357
 358         return True;
 359 }
 360
 361
 362 bool unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 363 {
 364         DATA_BLOB pac_contents;
 365         ASN1_DATA data;
 366         int data_type;
 367
 368         if (!auth_data->length) {
 369                 return False;
 370         }
 371
 372         asn1_load(&data, *auth_data);
 373         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 374         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 375         asn1_start_tag(&data, ASN1_CONTEXT(0));
 376         asn1_read_Integer(&data, &data_type);
 377
 378         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 379                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 380                 asn1_free(&data);
 381                 return False;
 382         }
 383
 384         asn1_end_tag(&data);
 385         asn1_start_tag(&data, ASN1_CONTEXT(1));
 386         asn1_read_OctetString(&data, &pac_contents);
 387         asn1_end_tag(&data);
 388         asn1_end_tag(&data);
 389         asn1_end_tag(&data);
 390         asn1_free(&data);
 391
 392         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 393
 394         data_blob_free(&pac_contents);
 395
 396         return True;
 397 }
 398
 399  bool get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 400 {
 401         DATA_BLOB auth_data_wrapped;
 402         bool got_auth_data_pac = False;
 403         int i;
 404
 405 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 406         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 407             tkt->enc_part2->authorization_data[0] &&
 408             tkt->enc_part2->authorization_data[0]->length)
 409         {
 410                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 411
 412                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 413                             KRB5_AUTHDATA_IF_RELEVANT) {
 414                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 415                                         tkt->enc_part2->authorization_data[i]->ad_type));
 416                                 continue;
 417                         }
 418
 419                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 420                                                       tkt->enc_part2->authorization_data[i]->length);
 421
 422                         /* check if it is a PAC */
 423                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 424                         data_blob_free(&auth_data_wrapped);
 425
 426                         if (got_auth_data_pac) {
 427                                 return true;
 428                         }
 429                 }
 430
 431                 return got_auth_data_pac;
 432         }
 433
 434 #else
 435         if (tkt->ticket.authorization_data &&
 436             tkt->ticket.authorization_data->len)
 437         {
 438                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 439
 440                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 441                             KRB5_AUTHDATA_IF_RELEVANT) {
 442                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 443                                         tkt->ticket.authorization_data->val[i].ad_type));
 444                                 continue;
 445                         }
 446
 447                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 448                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 449
 450                         /* check if it is a PAC */
 451                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 452                         data_blob_free(&auth_data_wrapped);
 453
 454                         if (got_auth_data_pac) {
 455                                 return true;
 456                         }
 457                 }
 458
 459                 return got_auth_data_pac;
 460         }
 461 #endif
 462         return False;
 463 }
 464
 465  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 466 {
 467 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 468         return tkt->enc_part2->client;
 469 #else
 470         return tkt->client;
 471 #endif
 472 }
 473
 474 #if !defined(HAVE_KRB5_LOCATE_KDC)
 475
 476 /* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
 477  * to a public interface for this functionality, so we have to be able to live
 478  * without it if the MIT libraries are hiding their internal symbols.
 479  */
 480
 481 #if defined(KRB5_KRBHST_INIT)
 482 /* Heimdal */
 483  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 484 {
 485         krb5_krbhst_handle hnd;
 486         krb5_krbhst_info *hinfo;
 487         krb5_error_code rc;
 488         int num_kdcs, i;
 489         struct sockaddr *sa;
 490         struct addrinfo *ai;
 491
 492         *addr_pp = NULL;
 493         *naddrs = 0;
 494
 495         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 496         if (rc) {
 497                 DEBUG(0, ("smb_krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 498                 return rc;
 499         }
 500
 501         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 502                 ;
 503
 504         krb5_krbhst_reset(ctx, hnd);
 505
 506         if (!num_kdcs) {
 507                 DEBUG(0, ("smb_krb5_locate_kdc: zero kdcs found !\n"));
 508                 krb5_krbhst_free(ctx, hnd);
 509                 return -1;
 510         }
 511
 512         sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
 513         if (!sa) {
 514                 DEBUG(0, ("smb_krb5_locate_kdc: malloc failed\n"));
 515                 krb5_krbhst_free(ctx, hnd);
 516                 naddrs = 0;
 517                 return -1;
 518         }
 519
 520         memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
 521
 522         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 523
 524 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
 525                 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
 526                 if (rc) {
 527                         DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
 528                         continue;
 529                 }
 530 #endif
 531                 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
 532                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 533         }
 534
 535         krb5_krbhst_free(ctx, hnd);
 536
 537         *naddrs = num_kdcs;
 538         *addr_pp = sa;
 539         return 0;
 540 }
 541
 542 #else /* ! defined(KRB5_KRBHST_INIT) */
 543
 544  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 545                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 546 {
 547         DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
 548         return KRB5_KDC_UNREACH;
 549 }
 550
 551 #endif /* KRB5_KRBHST_INIT */
 552
 553 #else /* ! HAVE_KRB5_LOCATE_KDC */
 554
 555  krb5_error_code smb_krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 556                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 557 {
 558         return krb5_locate_kdc(ctx, realm, addr_pp, naddrs, get_masters);
 559 }
 560
 561 #endif /* HAVE_KRB5_LOCATE_KDC */
 562
 563 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 564  void krb5_free_unparsed_name(krb5_context context, char *val)
 565 {
 566         SAFE_FREE(val);
 567 }
 568 #endif
 569
 570  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 571 {
 572 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 573         if (pdata->data) {
 574                 krb5_free_data_contents(context, pdata);
 575         }
 576 #else
 577         SAFE_FREE(pdata->data);
 578 #endif
 579 }
 580
 581  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 582 {
 583 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 584         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 585 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 586         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 587 #else
 588 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 589 #endif
 590 }
 591
 592  bool kerberos_compatible_enctypes(krb5_context context,
 593                                   krb5_enctype enctype1,
 594                                   krb5_enctype enctype2)
 595 {
 596 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 597         krb5_boolean similar = 0;
 598
 599         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 600         return similar ? True : False;
 601 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 602         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 603 #endif
 604 }
 605
 606 static bool ads_cleanup_expired_creds(krb5_context context,
 607                                       krb5_ccache  ccache,
 608                                       krb5_creds  *credsp)
 609 {
 610         krb5_error_code retval;
 611         const char *cc_type = krb5_cc_get_type(context, ccache);
 612
 613         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 614                   cc_type, krb5_cc_get_name(context, ccache),
 615                   http_timestring(credsp->times.endtime)));
 616
 617         /* we will probably need new tickets if the current ones
 618            will expire within 10 seconds.
 619         */
 620         if (credsp->times.endtime >= (time(NULL) + 10))
 621                 return False;
 622
 623         /* heimdal won't remove creds from a file ccache, and
 624            perhaps we shouldn't anyway, since internally we
 625            use memory ccaches, and a FILE one probably means that
 626            we're using creds obtained outside of our exectuable
 627         */
 628         if (strequal(cc_type, "FILE")) {
 629                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 630                 return False;
 631         }
 632
 633         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 634         if (retval) {
 635                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 636                           error_message(retval)));
 637                 /* If we have an error in this, we want to display it,
 638                    but continue as though we deleted it */
 639         }
 640         return True;
 641 }
 642
 643 /*
 644   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 645 */
 646 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 647                                        krb5_auth_context *auth_context,
 648                                        const krb5_flags ap_req_options,
 649                                        const char *principal,
 650                                        krb5_ccache ccache,
 651                                        krb5_data *outbuf,
 652                                        time_t *expire_time)
 653 {
 654         krb5_error_code           retval;
 655         krb5_principal    server;
 656         krb5_creds              * credsp;
 657         krb5_creds                creds;
 658         krb5_data in_data;
 659         bool creds_ready = False;
 660         int i = 0, maxtries = 3;
 661
 662         retval = smb_krb5_parse_name(context, principal, &server);
 663         if (retval) {
 664                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 665                 return retval;
 666         }
 667
 668         /* obtain ticket & session key */
 669         ZERO_STRUCT(creds);
 670         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 671                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 672                          error_message(retval)));
 673                 goto cleanup_princ;
 674         }
 675
 676         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 677                 /* This can commonly fail on smbd startup with no ticket in the cache.
 678                  * Report at higher level than 1. */
 679                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 680                          error_message(retval)));
 681                 goto cleanup_creds;
 682         }
 683
 684         while (!creds_ready && (i < maxtries)) {
 685
 686                 if ((retval = krb5_get_credentials(context, 0, ccache,
 687                                                    &creds, &credsp))) {
 688                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 689                                  principal, error_message(retval)));
 690                         goto cleanup_creds;
 691                 }
 692
 693                 /* cope with ticket being in the future due to clock skew */
 694                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 695                         time_t t = time(NULL);
 696                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 697                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 698                         krb5_set_real_time(context, t + time_offset + 1, 0);
 699                 }
 700
 701                 if (!ads_cleanup_expired_creds(context, ccache, credsp)) {
 702                         creds_ready = True;
 703                 }
 704
 705                 i++;
 706         }
 707
 708         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 709                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 710                   http_timestring((unsigned)credsp->times.endtime),
 711                   (unsigned)credsp->times.endtime));
 712
 713         if (expire_time) {
 714                 *expire_time = (time_t)credsp->times.endtime;
 715         }
 716
 717         in_data.length = 0;
 718         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 719                                       &in_data, credsp, outbuf);
 720         if (retval) {
 721                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 722                          error_message(retval)));
 723         }
 724
 725         krb5_free_creds(context, credsp);
 726
 727 cleanup_creds:
 728         krb5_free_cred_contents(context, &creds);
 729
 730 cleanup_princ:
 731         krb5_free_principal(context, server);
 732
 733         return retval;
 734 }
 735
 736 /*
 737   get a kerberos5 ticket for the given service
 738 */
 739 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 740                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 741                         uint32 extra_ap_opts, const char *ccname,
 742                         time_t *tgs_expire)
 743
 744 {
 745         krb5_error_code retval;
 746         krb5_data packet;
 747         krb5_context context = NULL;
 748         krb5_ccache ccdef = NULL;
 749         krb5_auth_context auth_context = NULL;
 750         krb5_enctype enc_types[] = {
 751 #ifdef ENCTYPE_ARCFOUR_HMAC
 752                 ENCTYPE_ARCFOUR_HMAC,
 753 #endif
 754                 ENCTYPE_DES_CBC_MD5,
 755                 ENCTYPE_DES_CBC_CRC,
 756                 ENCTYPE_NULL};
 757
 758         initialize_krb5_error_table();
 759         retval = krb5_init_context(&context);
 760         if (retval) {
 761                 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
 762                          error_message(retval)));
 763                 goto failed;
 764         }
 765
 766         if (time_offset != 0) {
 767                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 768         }
 769
 770         if ((retval = krb5_cc_resolve(context, ccname ?
 771                         ccname : krb5_cc_default_name(context), &ccdef))) {
 772                 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
 773                          error_message(retval)));
 774                 goto failed;
 775         }
 776
 777         if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
 778                 DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
 779                          error_message(retval)));
 780                 goto failed;
 781         }
 782
 783         if ((retval = ads_krb5_mk_req(context,
 784                                         &auth_context,
 785                                         AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 786                                         principal,
 787                                         ccdef, &packet,
 788                                         tgs_expire))) {
 789                 goto failed;
 790         }
 791
 792         get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
 793
 794         *ticket = data_blob(packet.data, packet.length);
 795
 796         kerberos_free_data_contents(context, &packet);
 797
 798 failed:
 799
 800         if ( context ) {
 801                 if (ccdef)
 802                         krb5_cc_close(context, ccdef);
 803                 if (auth_context)
 804                         krb5_auth_con_free(context, auth_context);
 805                 krb5_free_context(context);
 806         }
 807
 808         return retval;
 809 }
 810
 811  bool get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, bool remote)
 812  {
 813         krb5_keyblock *skey;
 814         krb5_error_code err;
 815         bool ret = False;
 816
 817         if (remote)
 818                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 819         else
 820                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 821         if (err == 0 && skey != NULL) {
 822                 DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
 823                 *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 824                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 825
 826                 ret = True;
 827
 828                 krb5_free_keyblock(context, skey);
 829         } else {
 830                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 831         }
 832
 833         return ret;
 834  }
 835
 836
 837 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 838  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 839
 840  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 841 {
 842         static krb5_data kdata;
 843
 844         kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
 845         kdata.length = strlen((const char *)kdata.data);
 846         return &kdata;
 847 }
 848 #endif
 849
 850  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 851 {
 852 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
 853         return krb5_kt_free_entry(context, kt_entry);
 854 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 855         return krb5_free_keytab_entry_contents(context, kt_entry);
 856 #else
 857 #error UNKNOWN_KT_FREE_FUNCTION
 858 #endif
 859 }
 860
 861  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 862                                      struct PAC_SIGNATURE_DATA *sig)
 863 {
 864 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 865         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 866         cksum->checksum.length  = sig->signature.length;
 867         cksum->checksum.data    = sig->signature.data;
 868 #else
 869         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 870         cksum->length           = sig->signature.length;
 871         cksum->contents         = sig->signature.data;
 872 #endif
 873 }
 874
 875  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 876                                           const krb5_keyblock *keyblock,
 877                                          krb5_keyusage usage,
 878                                          krb5_checksum *cksum,
 879                                          uint8 *data,
 880                                          size_t length)
 881 {
 882         krb5_error_code ret;
 883
 884         /* verify the checksum */
 885
 886         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 887          *
 888          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 889          * -----------------------------------------------------------------------------
 890          * krb5_c_verify_checksum       -                       works           works
 891          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 892          */
 893
 894 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 895         {
 896                 krb5_boolean checksum_valid = False;
 897                 krb5_data input;
 898
 899                 input.data = (char *)data;
 900                 input.length = length;
 901
 902                 ret = krb5_c_verify_checksum(context,
 903                                              keyblock,
 904                                              usage,
 905                                              &input,
 906                                              cksum,
 907                                              &checksum_valid);
 908                 if (ret) {
 909                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 910                                 error_message(ret)));
 911                         return ret;
 912                 }
 913
 914                 if (!checksum_valid)
 915                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 916         }
 917
 918 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 919
 920         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 921          * without enctype and it ignores any key_usage types - Guenther */
 922
 923         {
 924
 925                 krb5_crypto crypto;
 926                 ret = krb5_crypto_init(context,
 927                                        keyblock,
 928                                        0,
 929                                        &crypto);
 930                 if (ret) {
 931                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 932                                 error_message(ret)));
 933                         return ret;
 934                 }
 935
 936                 ret = krb5_verify_checksum(context,
 937                                            crypto,
 938                                            usage,
 939                                            data,
 940                                            length,
 941                                            cksum);
 942
 943                 krb5_crypto_destroy(context, crypto);
 944         }
 945
 946 #else
 947 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
 948 #endif
 949
 950         return ret;
 951 }
 952
 953  time_t get_authtime_from_tkt(krb5_ticket *tkt)
 954 {
 955 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 956         return tkt->enc_part2->times.authtime;
 957 #else
 958         return tkt->ticket.authtime;
 959 #endif
 960 }
 961
 962 #ifdef HAVE_KRB5_DECODE_AP_REQ  /* Heimdal */
 963 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
 964 {
 965 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
 966         if (ap_req->ticket->enc_part.kvno)
 967                 return ap_req->ticket->enc_part.kvno;
 968 #else /* Heimdal */
 969         if (ap_req->ticket.enc_part.kvno)
 970                 return *ap_req->ticket.enc_part.kvno;
 971 #endif
 972         return 0;
 973 }
 974
 975 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
 976 {
 977 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
 978         return ap_req->ticket.enc_part.etype;
 979 #else /* MIT */
 980         return ap_req->ticket->enc_part.enctype;
 981 #endif
 982 }
 983 #endif  /* HAVE_KRB5_DECODE_AP_REQ */
 984
 985 static krb5_error_code
 986 get_key_from_keytab(krb5_context context,
 987                     krb5_const_principal server,
 988                     krb5_enctype enctype,
 989                     krb5_kvno kvno,
 990                     krb5_keyblock **out_key)
 991 {
 992         krb5_keytab_entry entry;
 993         krb5_error_code ret;
 994         krb5_keytab keytab;
 995         char *name = NULL;
 996
 997         /* We have to open a new keytab handle here, as MIT does
 998            an implicit open/getnext/close on krb5_kt_get_entry. We
 999            may be in the middle of a keytab enumeration when this is
1000            called. JRA. */
1001
1002         ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
1003         if (ret) {
1004                 DEBUG(1,("get_key_from_keytab: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
1005                 return ret;
1006         }
1007
1008         if ( DEBUGLEVEL >= 10 ) {
1009                 if (smb_krb5_unparse_name(context, server, &name) == 0) {
1010                         DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
1011                                 kvno, enctype, name));
1012                         SAFE_FREE(name);
1013                 }
1014         }
1015
1016         ret = krb5_kt_get_entry(context,
1017                                 keytab,
1018                                 server,
1019                                 kvno,
1020                                 enctype,
1021                                 &entry);
1022
1023         if (ret) {
1024                 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
1025                 goto out;
1026         }
1027
1028 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
1029         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
1030 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
1031         ret = krb5_copy_keyblock(context, &entry.key, out_key);
1032 #else
1033 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
1034 #endif
1035
1036         if (ret) {
1037                 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
1038                 goto out;
1039         }
1040
1041         smb_krb5_kt_free_entry(context, &entry);
1042
1043 out:
1044         krb5_kt_close(context, keytab);
1045         return ret;
1046 }
1047
1048 /* Prototypes */
1049
1050  krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
1051                                                  const krb5_data *inbuf,
1052                                                  krb5_kvno *kvno,
1053                                                  krb5_enctype *enctype)
1054 {
1055 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
1056         {
1057                 krb5_error_code ret;
1058                 krb5_ap_req ap_req;
1059
1060                 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
1061                 if (ret)
1062                         return ret;
1063
1064                 *kvno = get_kvno_from_ap_req(&ap_req);
1065                 *enctype = get_enctype_from_ap_req(&ap_req);
1066
1067                 free_AP_REQ(&ap_req);
1068                 return 0;
1069         }
1070 #endif
1071
1072         /* Possibly not an appropriate error code. */
1073         return KRB5KDC_ERR_BADOPTION;
1074 }
1075
1076  krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
1077                                                         krb5_auth_context *auth_context,
1078                                                         const krb5_data *inbuf,
1079                                                         krb5_const_principal server,
1080                                                         krb5_keytab keytab,
1081                                                         krb5_flags *ap_req_options,
1082                                                         krb5_ticket **ticket,
1083                                                         krb5_keyblock **keyblock)
1084 {
1085         krb5_error_code ret;
1086         krb5_kvno kvno;
1087         krb5_enctype enctype;
1088         krb5_keyblock *local_keyblock;
1089
1090         ret = krb5_rd_req(context,
1091                           auth_context,
1092                           inbuf,
1093                           server,
1094                           keytab,
1095                           ap_req_options,
1096                           ticket);
1097         if (ret) {
1098                 return ret;
1099         }
1100
1101 #ifdef KRB5_TICKET_HAS_KEYINFO
1102         enctype = (*ticket)->enc_part.enctype;
1103         kvno = (*ticket)->enc_part.kvno;
1104 #else
1105         ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
1106         if (ret) {
1107                 return ret;
1108         }
1109 #endif
1110
1111         ret = get_key_from_keytab(context,
1112                                   server,
1113                                   enctype,
1114                                   kvno,
1115                                   &local_keyblock);
1116         if (ret) {
1117                 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
1118                 goto out;
1119         }
1120
1121 out:
1122         if (ret && local_keyblock != NULL) {
1123                 krb5_free_keyblock(context, local_keyblock);
1124         } else {
1125                 *keyblock = local_keyblock;
1126         }
1127
1128         return ret;
1129 }
1130
1131  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
1132                                             const char *name,
1133                                             krb5_principal *principal)
1134 {
1135 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
1136         return smb_krb5_parse_name_norealm_conv(context, name, principal);
1137 #endif
1138
1139         /* we are cheating here because parse_name will in fact set the realm.
1140          * We don't care as the only caller of smb_krb5_parse_name_norealm
1141          * ignores the realm anyway when calling
1142          * smb_krb5_principal_compare_any_realm later - Guenther */
1143
1144         return smb_krb5_parse_name(context, name, principal);
1145 }
1146
1147  bool smb_krb5_principal_compare_any_realm(krb5_context context,
1148                                           krb5_const_principal princ1,
1149                                           krb5_const_principal princ2)
1150 {
1151 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1152
1153         return krb5_principal_compare_any_realm(context, princ1, princ2);
1154
1155 /* krb5_princ_size is a macro in MIT */
1156 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
1157
1158         int i, len1, len2;
1159         const krb5_data *p1, *p2;
1160
1161         len1 = krb5_princ_size(context, princ1);
1162         len2 = krb5_princ_size(context, princ2);
1163
1164         if (len1 != len2)
1165                 return False;
1166
1167         for (i = 0; i < len1; i++) {
1168
1169                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1170                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1171
1172                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
1173                         return False;
1174         }
1175
1176         return True;
1177 #else
1178 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1179 #endif
1180 }
1181
1182  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
1183                                        const char *client_string,       /* gd@BER.SUSE.DE */
1184                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1185                                        time_t *expire_time)
1186 {
1187         krb5_error_code ret;
1188         krb5_context context = NULL;
1189         krb5_ccache ccache = NULL;
1190         krb5_principal client = NULL;
1191         krb5_creds creds, creds_in, *creds_out = NULL;
1192
1193         ZERO_STRUCT(creds);
1194         ZERO_STRUCT(creds_in);
1195
1196         initialize_krb5_error_table();
1197         ret = krb5_init_context(&context);
1198         if (ret) {
1199                 goto done;
1200         }
1201
1202         if (!ccache_string) {
1203                 ccache_string = krb5_cc_default_name(context);
1204         }
1205
1206         if (!ccache_string) {
1207                 ret = EINVAL;
1208                 goto done;
1209         }
1210
1211         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1212
1213         /* FIXME: we should not fall back to defaults */
1214         ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1215         if (ret) {
1216                 goto done;
1217         }
1218
1219         if (client_string) {
1220                 ret = smb_krb5_parse_name(context, client_string, &client);
1221                 if (ret) {
1222                         goto done;
1223                 }
1224         } else {
1225                 ret = krb5_cc_get_principal(context, ccache, &client);
1226                 if (ret) {
1227                         goto done;
1228                 }
1229         }
1230
1231 #ifdef HAVE_KRB5_GET_RENEWED_CREDS      /* MIT */
1232         {
1233                 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1234                 if (ret) {
1235                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1236                         goto done;
1237                 }
1238         }
1239 #elif defined(HAVE_KRB5_GET_KDC_CRED)   /* Heimdal */
1240         {
1241                 krb5_kdc_flags flags;
1242                 krb5_realm *client_realm = NULL;
1243
1244                 ret = krb5_copy_principal(context, client, &creds_in.client);
1245                 if (ret) {
1246                         goto done;
1247                 }
1248
1249                 if (service_string) {
1250                         ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1251                         if (ret) {
1252                                 goto done;
1253                         }
1254                 } else {
1255                         /* build tgt service by default */
1256                         client_realm = krb5_princ_realm(context, creds_in.client);
1257                         if (!client_realm) {
1258                                 ret = ENOMEM;
1259                                 goto done;
1260                         }
1261                         ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1262                         if (ret) {
1263                                 goto done;
1264                         }
1265                 }
1266
1267                 flags.i = 0;
1268                 flags.b.renewable = flags.b.renew = True;
1269
1270                 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds_out);
1271                 if (ret) {
1272                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1273                         goto done;
1274                 }
1275
1276                 creds = *creds_out;
1277         }
1278 #else
1279 #error NO_SUITABLE_KRB5_TICKET_RENEW_FUNCTION_AVAILABLE
1280 #endif
1281
1282         /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1283         ret = krb5_cc_initialize(context, ccache, client);
1284         if (ret) {
1285                 goto done;
1286         }
1287
1288         ret = krb5_cc_store_cred(context, ccache, &creds);
1289
1290         if (expire_time) {
1291                 *expire_time = (time_t) creds.times.endtime;
1292         }
1293
1294 done:
1295         krb5_free_cred_contents(context, &creds_in);
1296
1297         if (creds_out) {
1298                 krb5_free_creds(context, creds_out);
1299         } else {
1300                 krb5_free_cred_contents(context, &creds);
1301         }
1302
1303         if (client) {
1304                 krb5_free_principal(context, client);
1305         }
1306         if (ccache) {
1307                 krb5_cc_close(context, ccache);
1308         }
1309         if (context) {
1310                 krb5_free_context(context);
1311         }
1312
1313         return ret;
1314 }
1315
1316  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1317 {
1318         krb5_error_code ret = 0;
1319         if (addr == NULL) {
1320                 return ret;
1321         }
1322 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1323         krb5_free_addresses(context, addr->addrs);
1324 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1325         ret = krb5_free_addresses(context, addr->addrs);
1326         SAFE_FREE(addr->addrs);
1327 #endif
1328         SAFE_FREE(addr);
1329         addr = NULL;
1330         return ret;
1331 }
1332
1333  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1334 {
1335         krb5_error_code ret = 0;
1336         nstring buf;
1337 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1338         krb5_address **addrs = NULL;
1339 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1340         krb5_addresses *addrs = NULL;
1341 #endif
1342
1343         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
1344         if (*kerb_addr == NULL) {
1345                 return ENOMEM;
1346         }
1347
1348         put_name(buf, global_myname(), ' ', 0x20);
1349
1350 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1351         {
1352                 int num_addr = 2;
1353
1354                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
1355                 if (addrs == NULL) {
1356                         SAFE_FREE(kerb_addr);
1357                         return ENOMEM;
1358                 }
1359
1360                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
1361
1362                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1363                 if (addrs[0] == NULL) {
1364                         SAFE_FREE(addrs);
1365                         SAFE_FREE(kerb_addr);
1366                         return ENOMEM;
1367                 }
1368
1369                 addrs[0]->magic = KV5M_ADDRESS;
1370                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1371                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
1372                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1373                 if (addrs[0]->contents == NULL) {
1374                         SAFE_FREE(addrs[0]);
1375                         SAFE_FREE(addrs);
1376                         SAFE_FREE(kerb_addr);
1377                         return ENOMEM;
1378                 }
1379
1380                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
1381
1382                 addrs[1] = NULL;
1383         }
1384 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1385         {
1386                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1387                 if (addrs == NULL) {
1388                         SAFE_FREE(kerb_addr);
1389                         return ENOMEM;
1390                 }
1391
1392                 memset(addrs, 0, sizeof(krb5_addresses));
1393
1394                 addrs->len = 1;
1395                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1396                 if (addrs->val == NULL) {
1397                         SAFE_FREE(addrs);
1398                         SAFE_FREE(kerb_addr);
1399                         return ENOMEM;
1400                 }
1401
1402                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1403                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1404                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1405                 if (addrs->val[0].address.data == NULL) {
1406                         SAFE_FREE(addrs->val);
1407                         SAFE_FREE(addrs);
1408                         SAFE_FREE(kerb_addr);
1409                         return ENOMEM;
1410                 }
1411
1412                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1413         }
1414 #else
1415 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1416 #endif
1417         (*kerb_addr)->addrs = addrs;
1418
1419         return ret;
1420 }
1421
1422  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1423 {
1424 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1425         krb5_free_error_contents(context, krberror);
1426 #else /* MIT */
1427         krb5_free_error(context, krberror);
1428 #endif
1429 }
1430
1431  krb5_error_code handle_krberror_packet(krb5_context context,
1432                                         krb5_data *packet)
1433 {
1434         krb5_error_code ret;
1435         bool got_error_code = False;
1436
1437         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1438
1439 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1440         {
1441                 krb5_error krberror;
1442
1443                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1444                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1445                                 error_message(ret)));
1446                         return ret;
1447                 }
1448
1449                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1450                         ret = (krb5_error_code) krberror.error_code;
1451                         got_error_code = True;
1452                 }
1453
1454                 smb_krb5_free_error(context, &krberror);
1455         }
1456 #else /* MIT */
1457         {
1458                 krb5_error *krberror;
1459
1460                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1461                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1462                                 error_message(ret)));
1463                         return ret;
1464                 }
1465
1466                 if (krberror->e_data.data == NULL) {
1467                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1468                         got_error_code = True;
1469                 }
1470                 smb_krb5_free_error(context, krberror);
1471         }
1472 #endif
1473         if (got_error_code) {
1474                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1475                         error_message(ret), ret));
1476         }
1477         return ret;
1478 }
1479
1480  krb5_error_code smb_krb5_get_init_creds_opt_alloc(krb5_context context,
1481                                             krb5_get_init_creds_opt **opt)
1482 {
1483 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC
1484         /* Heimdal or modern MIT version */
1485         return krb5_get_init_creds_opt_alloc(context, opt);
1486 #else
1487         /* Historical MIT version */
1488         krb5_get_init_creds_opt *my_opt;
1489
1490         *opt = NULL;
1491
1492         if ((my_opt = SMB_MALLOC_P(krb5_get_init_creds_opt)) == NULL) {
1493                 return ENOMEM;
1494         }
1495
1496         krb5_get_init_creds_opt_init(my_opt);
1497
1498         *opt =  my_opt;
1499         return 0;
1500 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC  */
1501 }
1502
1503  void smb_krb5_get_init_creds_opt_free(krb5_context context,
1504                                 krb5_get_init_creds_opt *opt)
1505 {
1506 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_FREE
1507
1508 #ifdef KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT
1509         /* Modern MIT or Heimdal version */
1510         krb5_get_init_creds_opt_free(context, opt);
1511 #else
1512         /* Heimdal version */
1513         krb5_get_init_creds_opt_free(opt);
1514 #endif /* KRB5_CREDS_OPT_FREE_REQUIRES_CONTEXT */
1515
1516 #else /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1517         /* Historical MIT version */
1518         SAFE_FREE(opt);
1519         opt = NULL;
1520 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_FREE */
1521 }
1522
1523  krb5_enctype smb_get_enctype_from_kt_entry(const krb5_keytab_entry *kt_entry)
1524 {
1525 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
1526         return kt_entry->key.enctype;
1527 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)  /* Heimdal */
1528         return kt_entry->keyblock.keytype;
1529 #else
1530 #error UNKNOWN_KRB5_KEYTAB_ENTRY_KEYBLOCK_FORMAT
1531 #endif
1532 }
1533
1534
1535 /* caller needs to free etype_s */
1536  krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
1537                                             krb5_enctype enctype,
1538                                             char **etype_s)
1539 {
1540 #ifdef HAVE_KRB5_ENCTYPE_TO_STRING_WITH_KRB5_CONTEXT_ARG
1541         return krb5_enctype_to_string(context, enctype, etype_s); /* Heimdal */
1542 #elif defined(HAVE_KRB5_ENCTYPE_TO_STRING_WITH_SIZE_T_ARG)
1543         char buf[256];
1544         krb5_error_code ret = krb5_enctype_to_string(enctype, buf, 256); /* MIT */
1545         if (ret) {
1546                 return ret;
1547         }
1548         *etype_s = SMB_STRDUP(buf);
1549         if (!*etype_s) {
1550                 return ENOMEM;
1551         }
1552         return ret;
1553 #else
1554 #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
1555 #endif
1556 }
1557
1558  krb5_error_code smb_krb5_mk_error(krb5_context context,
1559                                 krb5_error_code error_code,
1560                                 const krb5_principal server,
1561                                 krb5_data *reply)
1562 {
1563 #ifdef HAVE_SHORT_KRB5_MK_ERROR_INTERFACE /* MIT */
1564         /*
1565          * The MIT interface is *terrible*.
1566          * We have to construct this ourselves...
1567          */
1568         krb5_error e;
1569
1570         memset(&e, 0, sizeof(e));
1571         krb5_us_timeofday(context, &e.stime, &e.susec);
1572         e.server = server;
1573 #if defined(krb5_err_base)
1574         e.error = error_code - krb5_err_base;
1575 #elif defined(ERROR_TABLE_BASE_krb5)
1576         e.error = error_code - ERROR_TABLE_BASE_krb5;
1577 #else
1578         e.error = error_code; /* Almost certainly wrong, but what can we do... ? */
1579 #endif
1580
1581         return krb5_mk_error(context, &e, reply);
1582 #else /* Heimdal. */
1583         return krb5_mk_error(context,
1584                                 error_code,
1585                                 NULL,
1586                                 NULL, /* e_data */
1587                                 NULL,
1588                                 server,
1589                                 NULL,
1590                                 NULL,
1591                                 reply);
1592 #endif
1593 }
1594
1595 /**********************************************************************
1596  * Open a krb5 keytab with flags, handles readonly or readwrite access and
1597  * allows to process non-default keytab names.
1598  * @param context krb5_context
1599  * @param keytab_name_req string
1600  * @param write_access bool if writable keytab is required
1601  * @param krb5_keytab pointer to krb5_keytab (close with krb5_kt_close())
1602  * @return krb5_error_code
1603 **********************************************************************/
1604
1605 /* This MAX_NAME_LEN is a constant defined in krb5.h */
1606 #ifndef MAX_KEYTAB_NAME_LEN
1607 #define MAX_KEYTAB_NAME_LEN 1100
1608 #endif
1609
1610  krb5_error_code smb_krb5_open_keytab(krb5_context context,
1611                                       const char *keytab_name_req,
1612                                       bool write_access,
1613                                       krb5_keytab *keytab)
1614 {
1615         krb5_error_code ret = 0;
1616         TALLOC_CTX *mem_ctx;
1617         char keytab_string[MAX_KEYTAB_NAME_LEN];
1618         char *kt_str = NULL;
1619         bool found_valid_name = False;
1620         const char *pragma = "FILE";
1621         const char *tmp = NULL;
1622
1623         if (!write_access && !keytab_name_req) {
1624                 /* caller just wants to read the default keytab readonly, so be it */
1625                 return krb5_kt_default(context, keytab);
1626         }
1627
1628         mem_ctx = talloc_init("smb_krb5_open_keytab");
1629         if (!mem_ctx) {
1630                 return ENOMEM;
1631         }
1632
1633 #ifdef HAVE_WRFILE_KEYTAB
1634         if (write_access) {
1635                 pragma = "WRFILE";
1636         }
1637 #endif
1638
1639         if (keytab_name_req) {
1640
1641                 if (strlen(keytab_name_req) > MAX_KEYTAB_NAME_LEN) {
1642                         ret = KRB5_CONFIG_NOTENUFSPACE;
1643                         goto out;
1644                 }
1645
1646                 if ((strncmp(keytab_name_req, "WRFILE:/", 8) == 0) ||
1647                     (strncmp(keytab_name_req, "FILE:/", 6) == 0)) {
1648                         tmp = keytab_name_req;
1649                         goto resolve;
1650                 }
1651
1652                 if (keytab_name_req[0] != '/') {
1653                         ret = KRB5_KT_BADNAME;
1654                         goto out;
1655                 }
1656
1657                 tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, keytab_name_req);
1658                 if (!tmp) {
1659                         ret = ENOMEM;
1660                         goto out;
1661                 }
1662
1663                 goto resolve;
1664         }
1665
1666         /* we need to handle more complex keytab_strings, like:
1667          * "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab" */
1668
1669         ret = krb5_kt_default_name(context, &keytab_string[0], MAX_KEYTAB_NAME_LEN - 2);
1670         if (ret) {
1671                 goto out;
1672         }
1673
1674         DEBUG(10,("smb_krb5_open_keytab: krb5_kt_default_name returned %s\n", keytab_string));
1675
1676         tmp = talloc_strdup(mem_ctx, keytab_string);
1677         if (!tmp) {
1678                 ret = ENOMEM;
1679                 goto out;
1680         }
1681
1682         if (strncmp(tmp, "ANY:", 4) == 0) {
1683                 tmp += 4;
1684         }
1685
1686         memset(&keytab_string, '\0', sizeof(keytab_string));
1687
1688         while (next_token_talloc(mem_ctx, &tmp, &kt_str, ",")) {
1689                 if (strncmp(kt_str, "WRFILE:", 7) == 0) {
1690                         found_valid_name = True;
1691                         tmp = kt_str;
1692                         tmp += 7;
1693                 }
1694
1695                 if (strncmp(kt_str, "FILE:", 5) == 0) {
1696                         found_valid_name = True;
1697                         tmp = kt_str;
1698                         tmp += 5;
1699                 }
1700
1701                 if (found_valid_name) {
1702                         if (tmp[0] != '/') {
1703                                 ret = KRB5_KT_BADNAME;
1704                                 goto out;
1705                         }
1706
1707                         tmp = talloc_asprintf(mem_ctx, "%s:%s", pragma, tmp);
1708                         if (!tmp) {
1709                                 ret = ENOMEM;
1710                                 goto out;
1711                         }
1712                         break;
1713                 }
1714         }
1715
1716         if (!found_valid_name) {
1717                 ret = KRB5_KT_UNKNOWN_TYPE;
1718                 goto out;
1719         }
1720
1721  resolve:
1722         DEBUG(10,("smb_krb5_open_keytab: resolving: %s\n", tmp));
1723         ret = krb5_kt_resolve(context, tmp, keytab);
1724
1725  out:
1726         TALLOC_FREE(mem_ctx);
1727         return ret;
1728 }
1729
1730 krb5_error_code smb_krb5_keytab_name(TALLOC_CTX *mem_ctx,
1731                                      krb5_context context,
1732                                      krb5_keytab keytab,
1733                                      const char **keytab_name)
1734 {
1735         char keytab_string[MAX_KEYTAB_NAME_LEN];
1736         krb5_error_code ret = 0;
1737
1738         ret = krb5_kt_get_name(context, keytab,
1739                                keytab_string, MAX_KEYTAB_NAME_LEN - 2);
1740         if (ret) {
1741                 return ret;
1742         }
1743
1744         *keytab_name = talloc_strdup(mem_ctx, keytab_string);
1745         if (!*keytab_name) {
1746                 return ENOMEM;
1747         }
1748
1749         return ret;
1750 }
1751
1752 #else /* HAVE_KRB5 */
1753  /* this saves a few linking headaches */
1754  int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1755                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1756                         const char *ccname, time_t *tgs_expire)
1757 {
1758          DEBUG(0,("NO KERBEROS SUPPORT\n"));
1759          return 1;
1760 }
1761
1762 #endif