source3/libsmb/clikrb5.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  25 #define KRB5_DEPRECATED 1       /* this file uses DEPRECATED interfaces! */
  26
  27 #include "includes.h"
  28
  29 #ifdef HAVE_KRB5
  30
  31 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE
  32 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
  33 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
  34 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
  35 #else
  36 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
  37 #define KRB5_KEY_LENGTH(k)      ((k)->length)
  38 #define KRB5_KEY_DATA(k)        ((k)->contents)
  39 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
  40
  41 /**************************************************************
  42  Wrappers around kerberos string functions that convert from
  43  utf8 -> unix charset and vica versa.
  44 **************************************************************/
  45
  46 /**************************************************************
  47  krb5_parse_name that takes a UNIX charset.
  48 **************************************************************/
  49
  50  krb5_error_code smb_krb5_parse_name(krb5_context context,
  51                                 const char *name, /* in unix charset */
  52                                 krb5_principal *principal)
  53 {
  54         krb5_error_code ret;
  55         char *utf8_name;
  56
  57         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  58                 return ENOMEM;
  59         }
  60
  61         ret = krb5_parse_name(context, utf8_name, principal);
  62         SAFE_FREE(utf8_name);
  63         return ret;
  64 }
  65
  66 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
  67 /**************************************************************
  68  krb5_parse_name_norealm that takes a UNIX charset.
  69 **************************************************************/
  70
  71 static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
  72                                 const char *name, /* in unix charset */
  73                                 krb5_principal *principal)
  74 {
  75         krb5_error_code ret;
  76         char *utf8_name;
  77
  78         if (push_utf8_allocate(&utf8_name, name) == (size_t)-1) {
  79                 return ENOMEM;
  80         }
  81
  82         ret = krb5_parse_name_norealm(context, utf8_name, principal);
  83         SAFE_FREE(utf8_name);
  84         return ret;
  85 }
  86 #endif
  87
  88 /**************************************************************
  89  krb5_parse_name that returns a UNIX charset name. Must
  90  be freed with normal free() call.
  91 **************************************************************/
  92
  93  krb5_error_code smb_krb5_unparse_name(krb5_context context,
  94                                         krb5_const_principal principal,
  95                                         char **unix_name)
  96 {
  97         krb5_error_code ret;
  98         char *utf8_name;
  99
 100         ret = krb5_unparse_name(context, principal, &utf8_name);
 101         if (ret) {
 102                 return ret;
 103         }
 104
 105         if (pull_utf8_allocate(unix_name, utf8_name)==-1) {
 106                 krb5_free_unparsed_name(context, utf8_name);
 107                 return ENOMEM;
 108         }
 109         krb5_free_unparsed_name(context, utf8_name);
 110         return 0;
 111 }
 112
 113 #ifndef HAVE_KRB5_SET_REAL_TIME
 114 /*
 115  * This function is not in the Heimdal mainline.
 116  */
 117  krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds)
 118 {
 119         krb5_error_code ret;
 120         int32_t sec, usec;
 121
 122         ret = krb5_us_timeofday(context, &sec, &usec);
 123         if (ret)
 124                 return ret;
 125
 126         context->kdc_sec_offset = seconds - sec;
 127         context->kdc_usec_offset = microseconds - usec;
 128
 129         return 0;
 130 }
 131 #endif
 132
 133 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
 134 /* HEIMDAL */
 135  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
 136 {
 137         pkaddr->addr_type = KRB5_ADDRESS_INET;
 138         pkaddr->address.length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 139         pkaddr->address.data = (char *)&(((struct sockaddr_in *)paddr)->sin_addr);
 140 }
 141 #elif defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS)
 142 /* MIT */
 143  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
 144 {
 145         pkaddr->addrtype = ADDRTYPE_INET;
 146         pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr);
 147         pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr);
 148 }
 149 #else
 150 #error UNKNOWN_ADDRTYPE
 151 #endif
 152
 153 #if defined(HAVE_KRB5_PRINCIPAL2SALT) && defined(HAVE_KRB5_USE_ENCTYPE) && defined(HAVE_KRB5_STRING_TO_KEY) && defined(HAVE_KRB5_ENCRYPT_BLOCK)
 154  int create_kerberos_key_from_string_direct(krb5_context context,
 155                                         krb5_principal host_princ,
 156                                         krb5_data *password,
 157                                         krb5_keyblock *key,
 158                                         krb5_enctype enctype)
 159 {
 160         int ret;
 161         krb5_data salt;
 162         krb5_encrypt_block eblock;
 163
 164         ret = krb5_principal2salt(context, host_princ, &salt);
 165         if (ret) {
 166                 DEBUG(1,("krb5_principal2salt failed (%s)\n", error_message(ret)));
 167                 return ret;
 168         }
 169         krb5_use_enctype(context, &eblock, enctype);
 170         ret = krb5_string_to_key(context, &eblock, key, password, &salt);
 171         SAFE_FREE(salt.data);
 172         return ret;
 173 }
 174 #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT)
 175  int create_kerberos_key_from_string_direct(krb5_context context,
 176                                         krb5_principal host_princ,
 177                                         krb5_data *password,
 178                                         krb5_keyblock *key,
 179                                         krb5_enctype enctype)
 180 {
 181         int ret;
 182         krb5_salt salt;
 183
 184         ret = krb5_get_pw_salt(context, host_princ, &salt);
 185         if (ret) {
 186                 DEBUG(1,("krb5_get_pw_salt failed (%s)\n", error_message(ret)));
 187                 return ret;
 188         }
 189
 190         ret = krb5_string_to_key_salt(context, enctype, (const char *)password->data, salt, key);
 191         krb5_free_salt(context, salt);
 192         return ret;
 193 }
 194 #else
 195 #error UNKNOWN_CREATE_KEY_FUNCTIONS
 196 #endif
 197
 198  int create_kerberos_key_from_string(krb5_context context,
 199                                         krb5_principal host_princ,
 200                                         krb5_data *password,
 201                                         krb5_keyblock *key,
 202                                         krb5_enctype enctype)
 203 {
 204         krb5_principal salt_princ = NULL;
 205         int ret;
 206         /*
 207          * Check if we've determined that the KDC is salting keys for this
 208          * principal/enctype in a non-obvious way.  If it is, try to match
 209          * its behavior.
 210          */
 211         salt_princ = kerberos_fetch_salt_princ_for_host_princ(context, host_princ, enctype);
 212         ret = create_kerberos_key_from_string_direct(context, salt_princ ? salt_princ : host_princ, password, key, enctype);
 213         if (salt_princ) {
 214                 krb5_free_principal(context, salt_princ);
 215         }
 216         return ret;
 217 }
 218
 219 #if defined(HAVE_KRB5_GET_PERMITTED_ENCTYPES)
 220  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 221                                             krb5_enctype **enctypes)
 222 {
 223         return krb5_get_permitted_enctypes(context, enctypes);
 224 }
 225 #elif defined(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES)
 226  krb5_error_code get_kerberos_allowed_etypes(krb5_context context,
 227                                             krb5_enctype **enctypes)
 228 {
 229         return krb5_get_default_in_tkt_etypes(context, enctypes);
 230 }
 231 #else
 232 #error UNKNOWN_GET_ENCTYPES_FUNCTIONS
 233 #endif
 234
 235 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 236  krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context,
 237                                         krb5_auth_context auth_context,
 238                                         krb5_keyblock *keyblock)
 239 {
 240         return krb5_auth_con_setkey(context, auth_context, keyblock);
 241 }
 242 #endif
 243
 244 BOOL unwrap_pac(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, DATA_BLOB *unwrapped_pac_data)
 245 {
 246         DATA_BLOB pac_contents;
 247         ASN1_DATA data;
 248         int data_type;
 249
 250         if (!auth_data->length) {
 251                 return False;
 252         }
 253
 254         asn1_load(&data, *auth_data);
 255         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 256         asn1_start_tag(&data, ASN1_SEQUENCE(0));
 257         asn1_start_tag(&data, ASN1_CONTEXT(0));
 258         asn1_read_Integer(&data, &data_type);
 259
 260         if (data_type != KRB5_AUTHDATA_WIN2K_PAC ) {
 261                 DEBUG(10,("authorization data is not a Windows PAC (type: %d)\n", data_type));
 262                 asn1_free(&data);
 263                 return False;
 264         }
 265
 266         asn1_end_tag(&data);
 267         asn1_start_tag(&data, ASN1_CONTEXT(1));
 268         asn1_read_OctetString(&data, &pac_contents);
 269         asn1_end_tag(&data);
 270         asn1_end_tag(&data);
 271         asn1_end_tag(&data);
 272         asn1_free(&data);
 273
 274         *unwrapped_pac_data = data_blob_talloc(mem_ctx, pac_contents.data, pac_contents.length);
 275
 276         data_blob_free(&pac_contents);
 277
 278         return True;
 279 }
 280
 281  BOOL get_auth_data_from_tkt(TALLOC_CTX *mem_ctx, DATA_BLOB *auth_data, krb5_ticket *tkt)
 282 {
 283         DATA_BLOB auth_data_wrapped;
 284         BOOL got_auth_data_pac = False;
 285         int i;
 286
 287 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 288         if (tkt->enc_part2 && tkt->enc_part2->authorization_data &&
 289             tkt->enc_part2->authorization_data[0] &&
 290             tkt->enc_part2->authorization_data[0]->length)
 291         {
 292                 for (i = 0; tkt->enc_part2->authorization_data[i] != NULL; i++) {
 293
 294                         if (tkt->enc_part2->authorization_data[i]->ad_type !=
 295                             KRB5_AUTHDATA_IF_RELEVANT) {
 296                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 297                                         tkt->enc_part2->authorization_data[i]->ad_type));
 298                                 continue;
 299                         }
 300
 301                         auth_data_wrapped = data_blob(tkt->enc_part2->authorization_data[i]->contents,
 302                                                       tkt->enc_part2->authorization_data[i]->length);
 303
 304                         /* check if it is a PAC */
 305                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 306                         data_blob_free(&auth_data_wrapped);
 307
 308                         if (!got_auth_data_pac) {
 309                                 continue;
 310                         }
 311                 }
 312
 313                 return got_auth_data_pac;
 314         }
 315
 316 #else
 317         if (tkt->ticket.authorization_data &&
 318             tkt->ticket.authorization_data->len)
 319         {
 320                 for (i = 0; i < tkt->ticket.authorization_data->len; i++) {
 321
 322                         if (tkt->ticket.authorization_data->val[i].ad_type !=
 323                             KRB5_AUTHDATA_IF_RELEVANT) {
 324                                 DEBUG(10,("get_auth_data_from_tkt: ad_type is %d\n",
 325                                         tkt->ticket.authorization_data->val[i].ad_type));
 326                                 continue;
 327                         }
 328
 329                         auth_data_wrapped = data_blob(tkt->ticket.authorization_data->val[i].ad_data.data,
 330                                                       tkt->ticket.authorization_data->val[i].ad_data.length);
 331
 332                         /* check if it is a PAC */
 333                         got_auth_data_pac = unwrap_pac(mem_ctx, &auth_data_wrapped, auth_data);
 334                         data_blob_free(&auth_data_wrapped);
 335
 336                         if (!got_auth_data_pac) {
 337                                 continue;
 338                         }
 339                 }
 340
 341                 return got_auth_data_pac;
 342         }
 343 #endif
 344         return False;
 345 }
 346
 347  krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt)
 348 {
 349 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 350         return tkt->enc_part2->client;
 351 #else
 352         return tkt->client;
 353 #endif
 354 }
 355
 356 #if !defined(HAVE_KRB5_LOCATE_KDC)
 357
 358 /* krb5_locate_kdc is an internal MIT symbol. MIT are not yet willing to commit
 359  * to a public interface for this functionality, so we have to be able to live
 360  * without it if the MIT libraries are hiding their internal symbols.
 361  */
 362
 363 #if defined(KRB5_KRBHST_INIT)
 364 /* Heimdal */
 365  krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters)
 366 {
 367         krb5_krbhst_handle hnd;
 368         krb5_krbhst_info *hinfo;
 369         krb5_error_code rc;
 370         int num_kdcs, i;
 371         struct sockaddr *sa;
 372         struct addrinfo *ai;
 373
 374         *addr_pp = NULL;
 375         *naddrs = 0;
 376
 377         rc = krb5_krbhst_init(ctx, realm->data, KRB5_KRBHST_KDC, &hnd);
 378         if (rc) {
 379                 DEBUG(0, ("krb5_locate_kdc: krb5_krbhst_init failed (%s)\n", error_message(rc)));
 380                 return rc;
 381         }
 382
 383         for ( num_kdcs = 0; (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); num_kdcs++)
 384                 ;
 385
 386         krb5_krbhst_reset(ctx, hnd);
 387
 388         if (!num_kdcs) {
 389                 DEBUG(0, ("krb5_locate_kdc: zero kdcs found !\n"));
 390                 krb5_krbhst_free(ctx, hnd);
 391                 return -1;
 392         }
 393
 394         sa = SMB_MALLOC_ARRAY( struct sockaddr, num_kdcs );
 395         if (!sa) {
 396                 DEBUG(0, ("krb5_locate_kdc: malloc failed\n"));
 397                 krb5_krbhst_free(ctx, hnd);
 398                 naddrs = 0;
 399                 return -1;
 400         }
 401
 402         memset(sa, '\0', sizeof(struct sockaddr) * num_kdcs );
 403
 404         for (i = 0; i < num_kdcs && (rc = krb5_krbhst_next(ctx, hnd, &hinfo) == 0); i++) {
 405
 406 #if defined(HAVE_KRB5_KRBHST_GET_ADDRINFO)
 407                 rc = krb5_krbhst_get_addrinfo(ctx, hinfo, &ai);
 408                 if (rc) {
 409                         DEBUG(0,("krb5_krbhst_get_addrinfo failed: %s\n", error_message(rc)));
 410                         continue;
 411                 }
 412 #endif
 413                 if (hinfo->ai && hinfo->ai->ai_family == AF_INET)
 414                         memcpy(&sa[i], hinfo->ai->ai_addr, sizeof(struct sockaddr));
 415         }
 416
 417         krb5_krbhst_free(ctx, hnd);
 418
 419         *naddrs = num_kdcs;
 420         *addr_pp = sa;
 421         return 0;
 422 }
 423
 424 #else /* ! defined(KRB5_KRBHST_INIT) */
 425
 426  krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm,
 427                 struct sockaddr **addr_pp, int *naddrs, int get_masters)
 428 {
 429         DEBUG(0, ("unable to explicitly locate the KDC on this platform\n"));
 430         return KRB5_KDC_UNREACH;
 431 }
 432
 433 #endif /* KRB5_KRBHST_INIT */
 434
 435 #endif /* HAVE_KRB5_LOCATE_KDC */
 436
 437 #if !defined(HAVE_KRB5_FREE_UNPARSED_NAME)
 438  void krb5_free_unparsed_name(krb5_context context, char *val)
 439 {
 440         SAFE_FREE(val);
 441 }
 442 #endif
 443
 444  void kerberos_free_data_contents(krb5_context context, krb5_data *pdata)
 445 {
 446 #if defined(HAVE_KRB5_FREE_DATA_CONTENTS)
 447         if (pdata->data) {
 448                 krb5_free_data_contents(context, pdata);
 449         }
 450 #else
 451         SAFE_FREE(pdata->data);
 452 #endif
 453 }
 454
 455  void kerberos_set_creds_enctype(krb5_creds *pcreds, int enctype)
 456 {
 457 #if defined(HAVE_KRB5_KEYBLOCK_IN_CREDS)
 458         KRB5_KEY_TYPE((&pcreds->keyblock)) = enctype;
 459 #elif defined(HAVE_KRB5_SESSION_IN_CREDS)
 460         KRB5_KEY_TYPE((&pcreds->session)) = enctype;
 461 #else
 462 #error UNKNOWN_KEYBLOCK_MEMBER_IN_KRB5_CREDS_STRUCT
 463 #endif
 464 }
 465
 466  BOOL kerberos_compatible_enctypes(krb5_context context,
 467                                   krb5_enctype enctype1,
 468                                   krb5_enctype enctype2)
 469 {
 470 #if defined(HAVE_KRB5_C_ENCTYPE_COMPARE)
 471         krb5_boolean similar = 0;
 472
 473         krb5_c_enctype_compare(context, enctype1, enctype2, &similar);
 474         return similar ? True : False;
 475 #elif defined(HAVE_KRB5_ENCTYPES_COMPATIBLE_KEYS)
 476         return krb5_enctypes_compatible_keys(context, enctype1, enctype2) ? True : False;
 477 #endif
 478 }
 479
 480 static BOOL ads_cleanup_expired_creds(krb5_context context,
 481                                       krb5_ccache  ccache,
 482                                       krb5_creds  *credsp)
 483 {
 484         krb5_error_code retval;
 485         const char *cc_type = krb5_cc_get_type(context, ccache);
 486
 487         DEBUG(3, ("ads_cleanup_expired_creds: Ticket in ccache[%s:%s] expiration %s\n",
 488                   cc_type, krb5_cc_get_name(context, ccache),
 489                   http_timestring(credsp->times.endtime)));
 490
 491         /* we will probably need new tickets if the current ones
 492            will expire within 10 seconds.
 493         */
 494         if (credsp->times.endtime >= (time(NULL) + 10))
 495                 return False;
 496
 497         /* heimdal won't remove creds from a file ccache, and
 498            perhaps we shouldn't anyway, since internally we
 499            use memory ccaches, and a FILE one probably means that
 500            we're using creds obtained outside of our exectuable
 501         */
 502         if (strequal(cc_type, "FILE")) {
 503                 DEBUG(5, ("ads_cleanup_expired_creds: We do not remove creds from a %s ccache\n", cc_type));
 504                 return False;
 505         }
 506
 507         retval = krb5_cc_remove_cred(context, ccache, 0, credsp);
 508         if (retval) {
 509                 DEBUG(1, ("ads_cleanup_expired_creds: krb5_cc_remove_cred failed, err %s\n",
 510                           error_message(retval)));
 511                 /* If we have an error in this, we want to display it,
 512                    but continue as though we deleted it */
 513         }
 514         return True;
 515 }
 516
 517 /*
 518   we can't use krb5_mk_req because w2k wants the service to be in a particular format
 519 */
 520 static krb5_error_code ads_krb5_mk_req(krb5_context context,
 521                                        krb5_auth_context *auth_context,
 522                                        const krb5_flags ap_req_options,
 523                                        const char *principal,
 524                                        krb5_ccache ccache,
 525                                        krb5_data *outbuf)
 526 {
 527         krb5_error_code           retval;
 528         krb5_principal    server;
 529         krb5_creds              * credsp;
 530         krb5_creds                creds;
 531         krb5_data in_data;
 532         BOOL creds_ready = False;
 533         int i = 0, maxtries = 3;
 534
 535         retval = smb_krb5_parse_name(context, principal, &server);
 536         if (retval) {
 537                 DEBUG(1,("ads_krb5_mk_req: Failed to parse principal %s\n", principal));
 538                 return retval;
 539         }
 540
 541         /* obtain ticket & session key */
 542         ZERO_STRUCT(creds);
 543         if ((retval = krb5_copy_principal(context, server, &creds.server))) {
 544                 DEBUG(1,("ads_krb5_mk_req: krb5_copy_principal failed (%s)\n",
 545                          error_message(retval)));
 546                 goto cleanup_princ;
 547         }
 548
 549         if ((retval = krb5_cc_get_principal(context, ccache, &creds.client))) {
 550                 /* This can commonly fail on smbd startup with no ticket in the cache.
 551                  * Report at higher level than 1. */
 552                 DEBUG(3,("ads_krb5_mk_req: krb5_cc_get_principal failed (%s)\n",
 553                          error_message(retval)));
 554                 goto cleanup_creds;
 555         }
 556
 557         while (!creds_ready && (i < maxtries)) {
 558                 if ((retval = krb5_get_credentials(context, 0, ccache,
 559                                                    &creds, &credsp))) {
 560                         DEBUG(1,("ads_krb5_mk_req: krb5_get_credentials failed for %s (%s)\n",
 561                                  principal, error_message(retval)));
 562                         goto cleanup_creds;
 563                 }
 564
 565                 /* cope with ticket being in the future due to clock skew */
 566                 if ((unsigned)credsp->times.starttime > time(NULL)) {
 567                         time_t t = time(NULL);
 568                         int time_offset =(int)((unsigned)credsp->times.starttime-t);
 569                         DEBUG(4,("ads_krb5_mk_req: Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 570                         krb5_set_real_time(context, t + time_offset + 1, 0);
 571                 }
 572
 573                 if (!ads_cleanup_expired_creds(context, ccache, credsp))
 574                         creds_ready = True;
 575
 576                 i++;
 577         }
 578
 579         DEBUG(10,("ads_krb5_mk_req: Ticket (%s) in ccache (%s:%s) is valid until: (%s - %u)\n",
 580                   principal, krb5_cc_get_type(context, ccache), krb5_cc_get_name(context, ccache),
 581                   http_timestring((unsigned)credsp->times.endtime),
 582                   (unsigned)credsp->times.endtime));
 583
 584         in_data.length = 0;
 585         retval = krb5_mk_req_extended(context, auth_context, ap_req_options,
 586                                       &in_data, credsp, outbuf);
 587         if (retval) {
 588                 DEBUG(1,("ads_krb5_mk_req: krb5_mk_req_extended failed (%s)\n",
 589                          error_message(retval)));
 590         }
 591
 592         krb5_free_creds(context, credsp);
 593
 594 cleanup_creds:
 595         krb5_free_cred_contents(context, &creds);
 596
 597 cleanup_princ:
 598         krb5_free_principal(context, server);
 599
 600         return retval;
 601 }
 602
 603 /*
 604   get a kerberos5 ticket for the given service
 605 */
 606 int cli_krb5_get_ticket(const char *principal, time_t time_offset,
 607                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5,
 608                         uint32 extra_ap_opts, const char *ccname)
 609 {
 610         krb5_error_code retval;
 611         krb5_data packet;
 612         krb5_context context = NULL;
 613         krb5_ccache ccdef = NULL;
 614         krb5_auth_context auth_context = NULL;
 615
 616         initialize_krb5_error_table();
 617         retval = krb5_init_context(&context);
 618         if (retval) {
 619                 DEBUG(1,("cli_krb5_get_ticket: krb5_init_context failed (%s)\n",
 620                          error_message(retval)));
 621                 goto failed;
 622         }
 623
 624         if (time_offset != 0) {
 625                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 626         }
 627
 628         if ((retval = krb5_cc_resolve(context, ccname ?
 629                         ccname : krb5_cc_default_name(context), &ccdef))) {
 630                 DEBUG(1,("cli_krb5_get_ticket: krb5_cc_default failed (%s)\n",
 631                          error_message(retval)));
 632                 goto failed;
 633         }
 634
 635         if ((retval = ads_krb5_mk_req(context,
 636                                         &auth_context,
 637                                         AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,
 638                                         principal,
 639                                         ccdef, &packet))) {
 640                 goto failed;
 641         }
 642
 643         get_krb5_smb_session_key(context, auth_context, session_key_krb5, False);
 644
 645         *ticket = data_blob(packet.data, packet.length);
 646
 647         kerberos_free_data_contents(context, &packet);
 648
 649 failed:
 650
 651         if ( context ) {
 652                 if (ccdef)
 653                         krb5_cc_close(context, ccdef);
 654                 if (auth_context)
 655                         krb5_auth_con_free(context, auth_context);
 656                 krb5_free_context(context);
 657         }
 658
 659         return retval;
 660 }
 661
 662  BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, DATA_BLOB *session_key, BOOL remote)
 663  {
 664         krb5_keyblock *skey;
 665         krb5_error_code err;
 666         BOOL ret = False;
 667
 668         if (remote)
 669                 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
 670         else
 671                 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
 672         if (err == 0 && skey != NULL) {
 673                 DEBUG(10, ("Got KRB5 session key of length %d\n",  (int)KRB5_KEY_LENGTH(skey)));
 674                 *session_key = data_blob(KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
 675                 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
 676
 677                 ret = True;
 678
 679                 krb5_free_keyblock(context, skey);
 680         } else {
 681                 DEBUG(10, ("KRB5 error getting session key %d\n", err));
 682         }
 683
 684         return ret;
 685  }
 686
 687
 688 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 689  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i );
 690
 691  const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i )
 692 {
 693         static krb5_data kdata;
 694
 695         kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
 696         kdata.length = strlen((const char *)kdata.data);
 697         return &kdata;
 698 }
 699 #endif
 700
 701  krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry)
 702 {
 703 #if defined(HAVE_KRB5_KT_FREE_ENTRY)
 704         return krb5_kt_free_entry(context, kt_entry);
 705 #elif defined(HAVE_KRB5_FREE_KEYTAB_ENTRY_CONTENTS)
 706         return krb5_free_keytab_entry_contents(context, kt_entry);
 707 #else
 708 #error UNKNOWN_KT_FREE_FUNCTION
 709 #endif
 710 }
 711
 712  void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
 713                                     PAC_SIGNATURE_DATA *sig)
 714 {
 715 #ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
 716         cksum->cksumtype        = (krb5_cksumtype)sig->type;
 717         cksum->checksum.length  = sig->signature.buf_len;
 718         cksum->checksum.data    = sig->signature.buffer;
 719 #else
 720         cksum->checksum_type    = (krb5_cksumtype)sig->type;
 721         cksum->length           = sig->signature.buf_len;
 722         cksum->contents         = sig->signature.buffer;
 723 #endif
 724 }
 725
 726  krb5_error_code smb_krb5_verify_checksum(krb5_context context,
 727                                          krb5_keyblock *keyblock,
 728                                          krb5_keyusage usage,
 729                                          krb5_checksum *cksum,
 730                                          uint8 *data,
 731                                          size_t length)
 732 {
 733         krb5_error_code ret;
 734
 735         /* verify the checksum */
 736
 737         /* welcome to the wonderful world of samba's kerberos abstraction layer:
 738          *
 739          * function                     heimdal 0.6.1rc3        heimdal 0.7     MIT krb 1.4.2
 740          * -----------------------------------------------------------------------------
 741          * krb5_c_verify_checksum       -                       works           works
 742          * krb5_verify_checksum         works (6 args)          works (6 args)  broken (7 args)
 743          */
 744
 745 #if defined(HAVE_KRB5_C_VERIFY_CHECKSUM)
 746         {
 747                 krb5_boolean checksum_valid = False;
 748                 krb5_data input;
 749
 750                 input.data = (char *)data;
 751                 input.length = length;
 752
 753                 ret = krb5_c_verify_checksum(context,
 754                                              keyblock,
 755                                              usage,
 756                                              &input,
 757                                              cksum,
 758                                              &checksum_valid);
 759                 if (ret) {
 760                         DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n",
 761                                 error_message(ret)));
 762                         return ret;
 763                 }
 764
 765                 if (!checksum_valid)
 766                         ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
 767         }
 768
 769 #elif KRB5_VERIFY_CHECKSUM_ARGS == 6 && defined(HAVE_KRB5_CRYPTO_INIT) && defined(HAVE_KRB5_CRYPTO) && defined(HAVE_KRB5_CRYPTO_DESTROY)
 770
 771         /* Warning: MIT's krb5_verify_checksum cannot be used as it will use a key
 772          * without enctype and it ignores any key_usage types - Guenther */
 773
 774         {
 775
 776                 krb5_crypto crypto;
 777                 ret = krb5_crypto_init(context,
 778                                        keyblock,
 779                                        0,
 780                                        &crypto);
 781                 if (ret) {
 782                         DEBUG(0,("smb_krb5_verify_checksum: krb5_crypto_init() failed: %s\n",
 783                                 error_message(ret)));
 784                         return ret;
 785                 }
 786
 787                 ret = krb5_verify_checksum(context,
 788                                            crypto,
 789                                            usage,
 790                                            data,
 791                                            length,
 792                                            cksum);
 793
 794                 krb5_crypto_destroy(context, crypto);
 795         }
 796
 797 #else
 798 #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
 799 #endif
 800
 801         return ret;
 802 }
 803
 804  time_t get_authtime_from_tkt(krb5_ticket *tkt)
 805 {
 806 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 807         return tkt->enc_part2->times.authtime;
 808 #else
 809         return tkt->ticket.authtime;
 810 #endif
 811 }
 812
 813 #ifdef HAVE_KRB5_DECODE_AP_REQ  /* Heimdal */
 814 static int get_kvno_from_ap_req(krb5_ap_req *ap_req)
 815 {
 816 #ifdef HAVE_TICKET_POINTER_IN_KRB5_AP_REQ /* MIT */
 817         if (ap_req->ticket->enc_part.kvno)
 818                 return ap_req->ticket->enc_part.kvno;
 819 #else /* Heimdal */
 820         if (ap_req->ticket.enc_part.kvno)
 821                 return *ap_req->ticket.enc_part.kvno;
 822 #endif
 823         return 0;
 824 }
 825
 826 static krb5_enctype get_enctype_from_ap_req(krb5_ap_req *ap_req)
 827 {
 828 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
 829         return ap_req->ticket.enc_part.etype;
 830 #else /* MIT */
 831         return ap_req->ticket->enc_part.enctype;
 832 #endif
 833 }
 834 #endif  /* HAVE_KRB5_DECODE_AP_REQ */
 835
 836 static krb5_error_code
 837 get_key_from_keytab(krb5_context context,
 838                     krb5_const_principal server,
 839                     krb5_enctype enctype,
 840                     krb5_kvno kvno,
 841                     krb5_keyblock **out_key)
 842 {
 843         krb5_keytab_entry entry;
 844         krb5_error_code ret;
 845         krb5_keytab keytab;
 846         char *name = NULL;
 847
 848         /* We have to open a new keytab handle here, as MIT does
 849            an implicit open/getnext/close on krb5_kt_get_entry. We
 850            may be in the middle of a keytab enumeration when this is
 851            called. JRA. */
 852
 853         ret = krb5_kt_default(context, &keytab);
 854         if (ret) {
 855                 DEBUG(0,("get_key_from_keytab: failed to open keytab: %s\n", error_message(ret)));
 856                 return ret;
 857         }
 858
 859         if ( DEBUGLEVEL >= 10 ) {
 860                 if (smb_krb5_unparse_name(context, server, &name) == 0) {
 861                         DEBUG(10,("get_key_from_keytab: will look for kvno %d, enctype %d and name: %s\n",
 862                                 kvno, enctype, name));
 863                         SAFE_FREE(name);
 864                 }
 865         }
 866
 867         ret = krb5_kt_get_entry(context,
 868                                 keytab,
 869                                 server,
 870                                 kvno,
 871                                 enctype,
 872                                 &entry);
 873
 874         if (ret) {
 875                 DEBUG(0,("get_key_from_keytab: failed to retrieve key: %s\n", error_message(ret)));
 876                 goto out;
 877         }
 878
 879 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
 880         ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
 881 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) /* MIT */
 882         ret = krb5_copy_keyblock(context, &entry.key, out_key);
 883 #else
 884 #error UNKNOWN_KRB5_KEYTAB_ENTRY_FORMAT
 885 #endif
 886
 887         if (ret) {
 888                 DEBUG(0,("get_key_from_keytab: failed to copy key: %s\n", error_message(ret)));
 889                 goto out;
 890         }
 891
 892         smb_krb5_kt_free_entry(context, &entry);
 893
 894 out:
 895         krb5_kt_close(context, keytab);
 896         return ret;
 897 }
 898
 899 /* Prototypes */
 900
 901  krb5_error_code smb_krb5_get_keyinfo_from_ap_req(krb5_context context,
 902                                                  const krb5_data *inbuf,
 903                                                  krb5_kvno *kvno,
 904                                                  krb5_enctype *enctype)
 905 {
 906 #ifdef HAVE_KRB5_DECODE_AP_REQ /* Heimdal */
 907         {
 908                 krb5_error_code ret;
 909                 krb5_ap_req ap_req;
 910
 911                 ret = krb5_decode_ap_req(context, inbuf, &ap_req);
 912                 if (ret)
 913                         return ret;
 914
 915                 *kvno = get_kvno_from_ap_req(&ap_req);
 916                 *enctype = get_enctype_from_ap_req(&ap_req);
 917
 918                 free_AP_REQ(&ap_req);
 919                 return 0;
 920         }
 921 #endif
 922
 923         /* Possibly not an appropriate error code. */
 924         return KRB5KDC_ERR_BADOPTION;
 925 }
 926
 927  krb5_error_code krb5_rd_req_return_keyblock_from_keytab(krb5_context context,
 928                                                         krb5_auth_context *auth_context,
 929                                                         const krb5_data *inbuf,
 930                                                         krb5_const_principal server,
 931                                                         krb5_keytab keytab,
 932                                                         krb5_flags *ap_req_options,
 933                                                         krb5_ticket **ticket,
 934                                                         krb5_keyblock **keyblock)
 935 {
 936         krb5_error_code ret;
 937         krb5_kvno kvno;
 938         krb5_enctype enctype;
 939         krb5_keyblock *local_keyblock;
 940
 941         ret = krb5_rd_req(context,
 942                           auth_context,
 943                           inbuf,
 944                           server,
 945                           keytab,
 946                           ap_req_options,
 947                           ticket);
 948         if (ret) {
 949                 return ret;
 950         }
 951
 952 #ifdef KRB5_TICKET_HAS_KEYINFO
 953         enctype = (*ticket)->enc_part.enctype;
 954         kvno = (*ticket)->enc_part.kvno;
 955 #else
 956         ret = smb_krb5_get_keyinfo_from_ap_req(context, inbuf, &kvno, &enctype);
 957         if (ret) {
 958                 return ret;
 959         }
 960 #endif
 961
 962         ret = get_key_from_keytab(context,
 963                                   server,
 964                                   enctype,
 965                                   kvno,
 966                                   &local_keyblock);
 967         if (ret) {
 968                 DEBUG(0,("krb5_rd_req_return_keyblock_from_keytab: failed to call get_key_from_keytab\n"));
 969                 goto out;
 970         }
 971
 972 out:
 973         if (ret && local_keyblock != NULL) {
 974                 krb5_free_keyblock(context, local_keyblock);
 975         } else {
 976                 *keyblock = local_keyblock;
 977         }
 978
 979         return ret;
 980 }
 981
 982  krb5_error_code smb_krb5_parse_name_norealm(krb5_context context,
 983                                             const char *name,
 984                                             krb5_principal *principal)
 985 {
 986 #ifdef HAVE_KRB5_PARSE_NAME_NOREALM
 987         return smb_krb5_parse_name_norealm_conv(context, name, principal);
 988 #endif
 989
 990         /* we are cheating here because parse_name will in fact set the realm.
 991          * We don't care as the only caller of smb_krb5_parse_name_norealm
 992          * ignores the realm anyway when calling
 993          * smb_krb5_principal_compare_any_realm later - Guenther */
 994
 995         return smb_krb5_parse_name(context, name, principal);
 996 }
 997
 998  BOOL smb_krb5_principal_compare_any_realm(krb5_context context,
 999                                           krb5_const_principal princ1,
1000                                           krb5_const_principal princ2)
1001 {
1002 #ifdef HAVE_KRB5_PRINCIPAL_COMPARE_ANY_REALM
1003
1004         return krb5_principal_compare_any_realm(context, princ1, princ2);
1005
1006 /* krb5_princ_size is a macro in MIT */
1007 #elif defined(HAVE_KRB5_PRINC_SIZE) || defined(krb5_princ_size)
1008
1009         int i, len1, len2;
1010         const krb5_data *p1, *p2;
1011
1012         len1 = krb5_princ_size(context, princ1);
1013         len2 = krb5_princ_size(context, princ2);
1014
1015         if (len1 != len2)
1016                 return False;
1017
1018         for (i = 0; i < len1; i++) {
1019
1020                 p1 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ1), i);
1021                 p2 = krb5_princ_component(context, CONST_DISCARD(krb5_principal, princ2), i);
1022
1023                 if (p1->length != p2->length || memcmp(p1->data, p2->data, p1->length))
1024                         return False;
1025         }
1026
1027         return True;
1028 #else
1029 #error NO_SUITABLE_PRINCIPAL_COMPARE_FUNCTION
1030 #endif
1031 }
1032
1033  krb5_error_code smb_krb5_renew_ticket(const char *ccache_string,       /* FILE:/tmp/krb5cc_0 */
1034                                        const char *client_string,       /* gd@BER.SUSE.DE */
1035                                        const char *service_string,      /* krbtgt/BER.SUSE.DE@BER.SUSE.DE */
1036                                        time_t *new_start_time)
1037 {
1038         krb5_error_code ret;
1039         krb5_context context = NULL;
1040         krb5_ccache ccache = NULL;
1041         krb5_principal client = NULL;
1042
1043         initialize_krb5_error_table();
1044         ret = krb5_init_context(&context);
1045         if (ret) {
1046                 goto done;
1047         }
1048
1049         if (!ccache_string) {
1050                 ccache_string = krb5_cc_default_name(context);
1051         }
1052
1053         DEBUG(10,("smb_krb5_renew_ticket: using %s as ccache\n", ccache_string));
1054
1055         /* FIXME: we should not fall back to defaults */
1056         ret = krb5_cc_resolve(context, CONST_DISCARD(char *, ccache_string), &ccache);
1057         if (ret) {
1058                 goto done;
1059         }
1060
1061 #ifdef HAVE_KRB5_GET_RENEWED_CREDS      /* MIT */
1062         {
1063                 krb5_creds creds;
1064
1065                 if (client_string) {
1066                         ret = smb_krb5_parse_name(context, client_string, &client);
1067                         if (ret) {
1068                                 goto done;
1069                         }
1070                 } else {
1071                         ret = krb5_cc_get_principal(context, ccache, &client);
1072                         if (ret) {
1073                                 goto done;
1074                         }
1075                 }
1076
1077                 ret = krb5_get_renewed_creds(context, &creds, client, ccache, CONST_DISCARD(char *, service_string));
1078                 if (ret) {
1079                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1080                         goto done;
1081                 }
1082
1083                 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1084                 ret = krb5_cc_initialize(context, ccache, client);
1085                 if (ret) {
1086                         goto done;
1087                 }
1088
1089                 ret = krb5_cc_store_cred(context, ccache, &creds);
1090
1091                 if (new_start_time) {
1092                         *new_start_time = (time_t) creds.times.renew_till;
1093                 }
1094
1095                 krb5_free_cred_contents(context, &creds);
1096         }
1097 #elif defined(HAVE_KRB5_GET_KDC_CRED)   /* Heimdal */
1098         {
1099                 krb5_kdc_flags flags;
1100                 krb5_creds creds_in;
1101                 krb5_realm *client_realm;
1102                 krb5_creds *creds;
1103
1104                 memset(&creds_in, 0, sizeof(creds_in));
1105
1106                 if (client_string) {
1107                         ret = smb_krb5_parse_name(context, client_string, &creds_in.client);
1108                         if (ret) {
1109                                 goto done;
1110                         }
1111                 } else {
1112                         ret = krb5_cc_get_principal(context, ccache, &creds_in.client);
1113                         if (ret) {
1114                                 goto done;
1115                         }
1116                 }
1117
1118                 if (service_string) {
1119                         ret = smb_krb5_parse_name(context, service_string, &creds_in.server);
1120                         if (ret) {
1121                                 goto done;
1122                         }
1123                 } else {
1124                         /* build tgt service by default */
1125                         client_realm = krb5_princ_realm(context, client);
1126                         ret = krb5_make_principal(context, &creds_in.server, *client_realm, KRB5_TGS_NAME, *client_realm, NULL);
1127                         if (ret) {
1128                                 goto done;
1129                         }
1130                 }
1131
1132                 flags.i = 0;
1133                 flags.b.renewable = flags.b.renew = True;
1134
1135                 ret = krb5_get_kdc_cred(context, ccache, flags, NULL, NULL, &creds_in, &creds);
1136                 if (ret) {
1137                         DEBUG(10,("smb_krb5_renew_ticket: krb5_get_kdc_cred failed: %s\n", error_message(ret)));
1138                         goto done;
1139                 }
1140
1141                 /* hm, doesn't that create a new one if the old one wasn't there? - Guenther */
1142                 ret = krb5_cc_initialize(context, ccache, creds_in.client);
1143                 if (ret) {
1144                         goto done;
1145                 }
1146
1147                 ret = krb5_cc_store_cred(context, ccache, creds);
1148
1149                 if (new_start_time) {
1150                         *new_start_time = (time_t) creds->times.renew_till;
1151                 }
1152
1153                 krb5_free_cred_contents(context, &creds_in);
1154                 krb5_free_creds(context, creds);
1155         }
1156 #else
1157 #error No suitable krb5 ticket renew function available
1158 #endif
1159
1160
1161 done:
1162         if (client) {
1163                 krb5_free_principal(context, client);
1164         }
1165         if (context) {
1166                 krb5_free_context(context);
1167         }
1168         if (ccache) {
1169                 krb5_cc_close(context, ccache);
1170         }
1171
1172         return ret;
1173
1174 }
1175
1176  krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr)
1177 {
1178         krb5_error_code ret = 0;
1179         if (addr == NULL) {
1180                 return ret;
1181         }
1182 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1183         krb5_free_addresses(context, addr->addrs);
1184 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1185         ret = krb5_free_addresses(context, addr->addrs);
1186         SAFE_FREE(addr->addrs);
1187 #endif
1188         SAFE_FREE(addr);
1189         addr = NULL;
1190         return ret;
1191 }
1192
1193  krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr)
1194 {
1195         krb5_error_code ret = 0;
1196         nstring buf;
1197 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1198         krb5_address **addrs = NULL;
1199 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1200         krb5_addresses *addrs = NULL;
1201 #endif
1202
1203         *kerb_addr = (smb_krb5_addresses *)SMB_MALLOC(sizeof(smb_krb5_addresses));
1204         if (*kerb_addr == NULL) {
1205                 return ENOMEM;
1206         }
1207
1208         put_name(buf, global_myname(), ' ', 0x20);
1209
1210 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
1211         {
1212                 int num_addr = 2;
1213
1214                 addrs = (krb5_address **)SMB_MALLOC(sizeof(krb5_address *) * num_addr);
1215                 if (addrs == NULL) {
1216                         SAFE_FREE(kerb_addr);
1217                         return ENOMEM;
1218                 }
1219
1220                 memset(addrs, 0, sizeof(krb5_address *) * num_addr);
1221
1222                 addrs[0] = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1223                 if (addrs[0] == NULL) {
1224                         SAFE_FREE(addrs);
1225                         SAFE_FREE(kerb_addr);
1226                         return ENOMEM;
1227                 }
1228
1229                 addrs[0]->magic = KV5M_ADDRESS;
1230                 addrs[0]->addrtype = KRB5_ADDR_NETBIOS;
1231                 addrs[0]->length = MAX_NETBIOSNAME_LEN;
1232                 addrs[0]->contents = (unsigned char *)SMB_MALLOC(addrs[0]->length);
1233                 if (addrs[0]->contents == NULL) {
1234                         SAFE_FREE(addrs[0]);
1235                         SAFE_FREE(addrs);
1236                         SAFE_FREE(kerb_addr);
1237                         return ENOMEM;
1238                 }
1239
1240                 memcpy(addrs[0]->contents, buf, addrs[0]->length);
1241
1242                 addrs[1] = NULL;
1243         }
1244 #elif defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS) /* Heimdal */
1245         {
1246                 addrs = (krb5_addresses *)SMB_MALLOC(sizeof(krb5_addresses));
1247                 if (addrs == NULL) {
1248                         SAFE_FREE(kerb_addr);
1249                         return ENOMEM;
1250                 }
1251
1252                 memset(addrs, 0, sizeof(krb5_addresses));
1253
1254                 addrs->len = 1;
1255                 addrs->val = (krb5_address *)SMB_MALLOC(sizeof(krb5_address));
1256                 if (addrs->val == NULL) {
1257                         SAFE_FREE(addrs);
1258                         SAFE_FREE(kerb_addr);
1259                         return ENOMEM;
1260                 }
1261
1262                 addrs->val[0].addr_type = KRB5_ADDR_NETBIOS;
1263                 addrs->val[0].address.length = MAX_NETBIOSNAME_LEN;
1264                 addrs->val[0].address.data = (unsigned char *)SMB_MALLOC(addrs->val[0].address.length);
1265                 if (addrs->val[0].address.data == NULL) {
1266                         SAFE_FREE(addrs->val);
1267                         SAFE_FREE(addrs);
1268                         SAFE_FREE(kerb_addr);
1269                         return ENOMEM;
1270                 }
1271
1272                 memcpy(addrs->val[0].address.data, buf, addrs->val[0].address.length);
1273         }
1274 #else
1275 #error UNKNOWN_KRB5_ADDRESS_FORMAT
1276 #endif
1277         (*kerb_addr)->addrs = addrs;
1278
1279         return ret;
1280 }
1281
1282  void smb_krb5_free_error(krb5_context context, krb5_error *krberror)
1283 {
1284 #ifdef HAVE_KRB5_FREE_ERROR_CONTENTS /* Heimdal */
1285         krb5_free_error_contents(context, krberror);
1286 #else /* MIT */
1287         krb5_free_error(context, krberror);
1288 #endif
1289 }
1290
1291  krb5_error_code handle_krberror_packet(krb5_context context,
1292                                         krb5_data *packet)
1293 {
1294         krb5_error_code ret;
1295         BOOL got_error_code = False;
1296
1297         DEBUG(10,("handle_krberror_packet: got error packet\n"));
1298
1299 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
1300         {
1301                 krb5_error krberror;
1302
1303                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1304                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1305                                 error_message(ret)));
1306                         return ret;
1307                 }
1308
1309                 if (krberror.e_data == NULL || krberror.e_data->data == NULL) {
1310                         ret = (krb5_error_code) krberror.error_code;
1311                         got_error_code = True;
1312                 }
1313
1314                 smb_krb5_free_error(context, &krberror);
1315         }
1316 #else /* MIT */
1317         {
1318                 krb5_error *krberror;
1319
1320                 if ((ret = krb5_rd_error(context, packet, &krberror))) {
1321                         DEBUG(10,("handle_krberror_packet: krb5_rd_error failed with: %s\n",
1322                                 error_message(ret)));
1323                         return ret;
1324                 }
1325
1326                 if (krberror->e_data.data == NULL) {
1327                         ret = ERROR_TABLE_BASE_krb5 + (krb5_error_code) krberror->error;
1328                         got_error_code = True;
1329                 }
1330                 smb_krb5_free_error(context, krberror);
1331         }
1332 #endif
1333         if (got_error_code) {
1334                 DEBUG(5,("handle_krberror_packet: got KERBERR from kpasswd: %s (%d)\n",
1335                         error_message(ret), ret));
1336         }
1337         return ret;
1338 }
1339
1340 #else /* HAVE_KRB5 */
1341  /* this saves a few linking headaches */
1342  int cli_krb5_get_ticket(const char *principal, time_t time_offset,
1343                         DATA_BLOB *ticket, DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
1344                         const char *ccname)
1345 {
1346          DEBUG(0,("NO KERBEROS SUPPORT\n"));
1347          return 1;
1348 }
1349
1350 #endif