2 Unix SMB/CIFS implementation.
4 Kerberos backend for GENSEC
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
7 Copyright (C) Andrew Tridgell 2001
8 Copyright (C) Luke Howard 2002-2003
9 Copyright (C) Stefan Metzmacher 2004-2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "system/kerberos.h"
28 #include "auth/kerberos/kerberos.h"
29 #include "auth/auth.h"
30 #include "lib/socket/socket.h"
31 #include "lib/tsocket/tsocket.h"
32 #include "librpc/rpc/dcerpc.h"
33 #include "auth/credentials/credentials.h"
34 #include "auth/credentials/credentials_krb5.h"
35 #include "auth/kerberos/kerberos_credentials.h"
36 #include "auth/gensec/gensec.h"
37 #include "auth/gensec/gensec_proto.h"
38 #include "auth/gensec/gensec_toplevel_proto.h"
39 #include "param/param.h"
40 #include "auth/auth_sam_reply.h"
41 #include "lib/util/util_net.h"
42 #include "../lib/util/asn1.h"
43 #include "auth/kerberos/pac_utils.h"
45 _PUBLIC_ NTSTATUS gensec_krb5_init(void);
47 enum GENSEC_KRB5_STATE {
48 GENSEC_KRB5_SERVER_START,
49 GENSEC_KRB5_CLIENT_START,
50 GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
54 struct gensec_krb5_state {
55 enum GENSEC_KRB5_STATE state_position;
56 struct smb_krb5_context *smb_krb5_context;
57 krb5_auth_context auth_context;
59 krb5_keyblock *keyblock;
62 krb5_flags ap_req_options;
65 static int gensec_krb5_destroy(struct gensec_krb5_state *gensec_krb5_state)
67 if (!gensec_krb5_state->smb_krb5_context) {
68 /* We can't clean anything else up unless we started up this far */
71 if (gensec_krb5_state->enc_ticket.length) {
72 kerberos_free_data_contents(gensec_krb5_state->smb_krb5_context->krb5_context,
73 &gensec_krb5_state->enc_ticket);
76 if (gensec_krb5_state->ticket) {
77 krb5_free_ticket(gensec_krb5_state->smb_krb5_context->krb5_context,
78 gensec_krb5_state->ticket);
81 /* ccache freed in a child destructor */
83 krb5_free_keyblock(gensec_krb5_state->smb_krb5_context->krb5_context,
84 gensec_krb5_state->keyblock);
86 if (gensec_krb5_state->auth_context) {
87 krb5_auth_con_free(gensec_krb5_state->smb_krb5_context->krb5_context,
88 gensec_krb5_state->auth_context);
94 static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security, bool gssapi)
97 struct gensec_krb5_state *gensec_krb5_state;
98 struct cli_credentials *creds;
99 const struct tsocket_address *tlocal_addr, *tremote_addr;
100 krb5_address my_krb5_addr, peer_krb5_addr;
102 creds = gensec_get_credentials(gensec_security);
104 return NT_STATUS_INVALID_PARAMETER;
107 gensec_krb5_state = talloc(gensec_security, struct gensec_krb5_state);
108 if (!gensec_krb5_state) {
109 return NT_STATUS_NO_MEMORY;
112 gensec_security->private_data = gensec_krb5_state;
113 gensec_krb5_state->smb_krb5_context = NULL;
114 gensec_krb5_state->auth_context = NULL;
115 gensec_krb5_state->ticket = NULL;
116 ZERO_STRUCT(gensec_krb5_state->enc_ticket);
117 gensec_krb5_state->keyblock = NULL;
118 gensec_krb5_state->gssapi = gssapi;
120 talloc_set_destructor(gensec_krb5_state, gensec_krb5_destroy);
122 if (cli_credentials_get_krb5_context(creds,
123 gensec_security->settings->lp_ctx, &gensec_krb5_state->smb_krb5_context)) {
124 talloc_free(gensec_krb5_state);
125 return NT_STATUS_INTERNAL_ERROR;
128 ret = krb5_auth_con_init(gensec_krb5_state->smb_krb5_context->krb5_context, &gensec_krb5_state->auth_context);
130 DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n",
131 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
132 ret, gensec_krb5_state)));
133 talloc_free(gensec_krb5_state);
134 return NT_STATUS_INTERNAL_ERROR;
137 ret = krb5_auth_con_setflags(gensec_krb5_state->smb_krb5_context->krb5_context,
138 gensec_krb5_state->auth_context,
139 KRB5_AUTH_CONTEXT_DO_SEQUENCE);
141 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setflags failed (%s)\n",
142 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
143 ret, gensec_krb5_state)));
144 talloc_free(gensec_krb5_state);
145 return NT_STATUS_INTERNAL_ERROR;
148 tlocal_addr = gensec_get_local_address(gensec_security);
151 struct sockaddr_storage ss;
153 socklen = tsocket_address_bsd_sockaddr(tlocal_addr,
154 (struct sockaddr *) &ss,
155 sizeof(struct sockaddr_storage));
157 talloc_free(gensec_krb5_state);
158 return NT_STATUS_INTERNAL_ERROR;
160 ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
161 (const struct sockaddr *) &ss, &my_krb5_addr);
163 DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
164 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
165 ret, gensec_krb5_state)));
166 talloc_free(gensec_krb5_state);
167 return NT_STATUS_INTERNAL_ERROR;
171 tremote_addr = gensec_get_remote_address(gensec_security);
174 struct sockaddr_storage ss;
176 socklen = tsocket_address_bsd_sockaddr(tremote_addr,
177 (struct sockaddr *) &ss,
178 sizeof(struct sockaddr_storage));
180 talloc_free(gensec_krb5_state);
181 return NT_STATUS_INTERNAL_ERROR;
183 ret = krb5_sockaddr2address(gensec_krb5_state->smb_krb5_context->krb5_context,
184 (const struct sockaddr *) &ss, &peer_krb5_addr);
186 DEBUG(1,("gensec_krb5_start: krb5_sockaddr2address (local) failed (%s)\n",
187 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
188 ret, gensec_krb5_state)));
189 talloc_free(gensec_krb5_state);
190 return NT_STATUS_INTERNAL_ERROR;
194 ret = krb5_auth_con_setaddrs(gensec_krb5_state->smb_krb5_context->krb5_context,
195 gensec_krb5_state->auth_context,
196 tlocal_addr ? &my_krb5_addr : NULL,
197 tremote_addr ? &peer_krb5_addr : NULL);
199 DEBUG(1,("gensec_krb5_start: krb5_auth_con_setaddrs failed (%s)\n",
200 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
201 ret, gensec_krb5_state)));
202 talloc_free(gensec_krb5_state);
203 return NT_STATUS_INTERNAL_ERROR;
209 static NTSTATUS gensec_krb5_common_server_start(struct gensec_security *gensec_security, bool gssapi)
212 struct gensec_krb5_state *gensec_krb5_state;
214 nt_status = gensec_krb5_start(gensec_security, gssapi);
215 if (!NT_STATUS_IS_OK(nt_status)) {
219 gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
220 gensec_krb5_state->state_position = GENSEC_KRB5_SERVER_START;
225 static NTSTATUS gensec_krb5_server_start(struct gensec_security *gensec_security)
227 return gensec_krb5_common_server_start(gensec_security, false);
230 static NTSTATUS gensec_fake_gssapi_krb5_server_start(struct gensec_security *gensec_security)
232 return gensec_krb5_common_server_start(gensec_security, true);
235 static NTSTATUS gensec_krb5_common_client_start(struct gensec_security *gensec_security, bool gssapi)
237 const char *hostname;
238 struct gensec_krb5_state *gensec_krb5_state;
240 hostname = gensec_get_target_hostname(gensec_security);
242 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
243 return NT_STATUS_INVALID_PARAMETER;
245 if (is_ipaddress(hostname)) {
246 DEBUG(2, ("Cannot do krb5 to an IP address"));
247 return NT_STATUS_INVALID_PARAMETER;
249 if (strcmp(hostname, "localhost") == 0) {
250 DEBUG(2, ("krb5 to 'localhost' does not make sense"));
251 return NT_STATUS_INVALID_PARAMETER;
254 nt_status = gensec_krb5_start(gensec_security, gssapi);
255 if (!NT_STATUS_IS_OK(nt_status)) {
259 gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
260 gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_START;
261 gensec_krb5_state->ap_req_options = AP_OPTS_USE_SUBKEY;
263 if (gensec_krb5_state->gssapi) {
264 /* The Fake GSSAPI modal emulates Samba3, which does not do mutual authentication */
265 if (gensec_setting_bool(gensec_security->settings, "gensec_fake_gssapi_krb5", "mutual", false)) {
266 gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
269 /* The wrapping for KPASSWD (a user of the raw KRB5 API) should be mutually authenticated */
270 if (gensec_setting_bool(gensec_security->settings, "gensec_krb5", "mutual", true)) {
271 gensec_krb5_state->ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
277 static NTSTATUS gensec_krb5_common_client_creds(struct gensec_security *gensec_security,
278 struct tevent_context *ev,
281 struct gensec_krb5_state *gensec_krb5_state;
283 struct ccache_container *ccache_container;
284 const char *error_string;
285 const char *principal;
286 const char *hostname;
288 struct tevent_context *previous_ev;
290 gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
292 principal = gensec_get_target_principal(gensec_security);
293 hostname = gensec_get_target_hostname(gensec_security);
295 ret = cli_credentials_get_ccache(gensec_get_credentials(gensec_security),
297 gensec_security->settings->lp_ctx, &ccache_container, &error_string);
301 case KRB5KDC_ERR_PREAUTH_FAILED:
302 case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:
303 return NT_STATUS_LOGON_FAILURE;
304 case KRB5_KDC_UNREACH:
305 DEBUG(3, ("Cannot reach a KDC we require to contact %s: %s\n", principal, error_string));
306 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
307 case KRB5_CC_NOTFOUND:
309 DEBUG(3, ("Error preparing credentials we require to contact %s : %s\n", principal, error_string));
310 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
312 DEBUG(1, ("gensec_krb5_start: Aquiring initiator credentials failed: %s\n", error_string));
313 return NT_STATUS_UNSUCCESSFUL;
317 /* Do this every time, in case we have weird recursive issues here */
318 ret = smb_krb5_context_set_event_ctx(gensec_krb5_state->smb_krb5_context, ev, &previous_ev);
320 DEBUG(1, ("gensec_krb5_start: Setting event context failed\n"));
321 return NT_STATUS_NO_MEMORY;
324 krb5_principal target_principal;
325 ret = krb5_parse_name(gensec_krb5_state->smb_krb5_context->krb5_context, principal,
328 ret = krb5_mk_req_exact(gensec_krb5_state->smb_krb5_context->krb5_context,
329 &gensec_krb5_state->auth_context,
330 gensec_krb5_state->ap_req_options,
332 &in_data, ccache_container->ccache,
333 &gensec_krb5_state->enc_ticket);
334 krb5_free_principal(gensec_krb5_state->smb_krb5_context->krb5_context,
338 ret = krb5_mk_req(gensec_krb5_state->smb_krb5_context->krb5_context,
339 &gensec_krb5_state->auth_context,
340 gensec_krb5_state->ap_req_options,
341 gensec_get_target_service(gensec_security),
343 &in_data, ccache_container->ccache,
344 &gensec_krb5_state->enc_ticket);
347 smb_krb5_context_remove_event_ctx(gensec_krb5_state->smb_krb5_context, previous_ev, ev);
352 case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
353 DEBUG(3, ("Server [%s] is not registered with our KDC: %s\n",
354 hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
355 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
356 case KRB5_KDC_UNREACH:
357 DEBUG(3, ("Cannot reach a KDC we require to contact host [%s]: %s\n",
358 hostname, smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
359 return NT_STATUS_INVALID_PARAMETER; /* Make SPNEGO ignore us, we can't go any further here */
360 case KRB5KDC_ERR_PREAUTH_FAILED:
361 case KRB5KRB_AP_ERR_TKT_EXPIRED:
363 /* Too much clock skew - we will need to kinit to re-skew the clock */
364 case KRB5KRB_AP_ERR_SKEW:
365 case KRB5_KDCREP_SKEW:
367 DEBUG(3, ("kerberos (mk_req) failed: %s\n",
368 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
372 /* just don't print a message for these really ordinary messages */
373 case KRB5_FCC_NOFILE:
374 case KRB5_CC_NOTFOUND:
377 return NT_STATUS_UNSUCCESSFUL;
381 DEBUG(0, ("kerberos: %s\n",
382 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, gensec_krb5_state)));
383 return NT_STATUS_UNSUCCESSFUL;
387 static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security)
389 return gensec_krb5_common_client_start(gensec_security, false);
392 static NTSTATUS gensec_fake_gssapi_krb5_client_start(struct gensec_security *gensec_security)
394 return gensec_krb5_common_client_start(gensec_security, true);
399 generate a krb5 GSS-API wrapper packet given a ticket
401 static DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2])
403 struct asn1_data *data;
406 data = asn1_init(mem_ctx);
407 if (!data || !ticket->data) {
408 return data_blob(NULL,0);
411 asn1_push_tag(data, ASN1_APPLICATION(0));
412 asn1_write_OID(data, GENSEC_OID_KERBEROS5);
414 asn1_write(data, tok_id, 2);
415 asn1_write(data, ticket->data, ticket->length);
418 if (data->has_error) {
419 DEBUG(1,("Failed to build krb5 wrapper at offset %d\n", (int)data->ofs));
421 return data_blob(NULL,0);
424 ret = data_blob_talloc(mem_ctx, data->data, data->length);
431 parse a krb5 GSS-API wrapper packet giving a ticket
433 static bool gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2])
436 struct asn1_data *data = asn1_init(mem_ctx);
443 asn1_load(data, *blob);
444 asn1_start_tag(data, ASN1_APPLICATION(0));
445 asn1_check_OID(data, GENSEC_OID_KERBEROS5);
447 data_remaining = asn1_tag_remaining(data);
449 if (data_remaining < 3) {
450 data->has_error = true;
452 asn1_read(data, tok_id, 2);
454 *ticket = data_blob_talloc(mem_ctx, NULL, data_remaining);
455 asn1_read(data, ticket->data, ticket->length);
460 ret = !data->has_error;
468 * Next state function for the Krb5 GENSEC mechanism
470 * @param gensec_krb5_state KRB5 State
471 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
472 * @param in The request, as a DATA_BLOB
473 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
474 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
475 * or NT_STATUS_OK if the user is authenticated.
478 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
479 TALLOC_CTX *out_mem_ctx,
480 struct tevent_context *ev,
481 const DATA_BLOB in, DATA_BLOB *out)
483 struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
484 krb5_error_code ret = 0;
487 switch (gensec_krb5_state->state_position) {
488 case GENSEC_KRB5_CLIENT_START:
490 DATA_BLOB unwrapped_out;
492 nt_status = gensec_krb5_common_client_creds(gensec_security, ev, gensec_krb5_state->gssapi);
493 if (!NT_STATUS_IS_OK(nt_status)) {
497 if (gensec_krb5_state->gssapi) {
498 unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
500 /* wrap that up in a nice GSS-API wrapping */
501 *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REQ);
503 *out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->enc_ticket.data, gensec_krb5_state->enc_ticket.length);
505 if (gensec_krb5_state->ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
506 gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_MUTUAL_AUTH;
507 nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
509 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
510 nt_status = NT_STATUS_OK;
515 case GENSEC_KRB5_CLIENT_MUTUAL_AUTH:
517 DATA_BLOB unwrapped_in;
519 krb5_ap_rep_enc_part *repl = NULL;
522 if (gensec_krb5_state->gssapi) {
523 if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
524 DEBUG(1,("gensec_gssapi_parse_krb5_wrap(mutual authentication) failed to parse\n"));
525 dump_data_pw("Mutual authentication message:\n", in.data, in.length);
526 return NT_STATUS_INVALID_PARAMETER;
531 /* TODO: check the tok_id */
533 inbuf.data = unwrapped_in.data;
534 inbuf.length = unwrapped_in.length;
535 ret = krb5_rd_rep(gensec_krb5_state->smb_krb5_context->krb5_context,
536 gensec_krb5_state->auth_context,
539 DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
540 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context, ret, out_mem_ctx)));
541 dump_data_pw("Mutual authentication message:\n", (uint8_t *)inbuf.data, inbuf.length);
542 nt_status = NT_STATUS_ACCESS_DENIED;
544 *out = data_blob(NULL, 0);
545 nt_status = NT_STATUS_OK;
546 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
549 krb5_free_ap_rep_enc_part(gensec_krb5_state->smb_krb5_context->krb5_context, repl);
554 case GENSEC_KRB5_SERVER_START:
556 DATA_BLOB unwrapped_in;
557 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
558 krb5_data inbuf, outbuf;
560 struct keytab_container *keytab;
561 krb5_principal server_in_keytab;
562 const char *error_string;
563 enum credentials_obtained obtained;
566 return NT_STATUS_INVALID_PARAMETER;
569 /* Grab the keytab, however generated */
570 ret = cli_credentials_get_keytab(gensec_get_credentials(gensec_security),
571 gensec_security->settings->lp_ctx, &keytab);
573 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
576 /* This ensures we lookup the correct entry in that
577 * keytab. A NULL principal is acceptable, and means
578 * that the krb5 libs should search the keytab at
579 * accept time for any matching key */
580 ret = principal_from_credentials(out_mem_ctx, gensec_get_credentials(gensec_security),
581 gensec_krb5_state->smb_krb5_context,
582 &server_in_keytab, &obtained, &error_string);
585 DEBUG(2,("Failed to make credentials from principal: %s\n", error_string));
586 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
589 /* Parse the GSSAPI wrapping, if it's there... (win2k3 allows it to be omited) */
590 if (gensec_krb5_state->gssapi
591 && gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
592 inbuf.data = unwrapped_in.data;
593 inbuf.length = unwrapped_in.length;
595 inbuf.data = in.data;
596 inbuf.length = in.length;
599 ret = smb_rd_req_return_stuff(gensec_krb5_state->smb_krb5_context->krb5_context,
600 &gensec_krb5_state->auth_context,
601 &inbuf, keytab->keytab, server_in_keytab,
603 &gensec_krb5_state->ticket,
604 &gensec_krb5_state->keyblock);
607 return NT_STATUS_LOGON_FAILURE;
609 unwrapped_out.data = (uint8_t *)outbuf.data;
610 unwrapped_out.length = outbuf.length;
611 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
612 /* wrap that up in a nice GSS-API wrapping */
613 if (gensec_krb5_state->gssapi) {
614 *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REP);
616 *out = data_blob_talloc(out_mem_ctx, outbuf.data, outbuf.length);
618 krb5_data_free(&outbuf);
622 case GENSEC_KRB5_DONE:
624 /* Asking too many times... */
625 return NT_STATUS_INVALID_PARAMETER;
629 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security,
631 DATA_BLOB *session_key)
633 struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
634 krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
635 krb5_auth_context auth_context = gensec_krb5_state->auth_context;
637 krb5_error_code err = -1;
639 if (gensec_krb5_state->state_position != GENSEC_KRB5_DONE) {
640 return NT_STATUS_NO_USER_SESSION_KEY;
643 switch (gensec_security->gensec_role) {
645 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
648 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
651 if (err == 0 && skey != NULL) {
652 DEBUG(10, ("Got KRB5 session key of length %d\n",
653 (int)KRB5_KEY_LENGTH(skey)));
654 *session_key = data_blob_talloc(mem_ctx,
655 KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
656 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
658 krb5_free_keyblock(context, skey);
661 DEBUG(10, ("KRB5 error getting session key %d\n", err));
662 return NT_STATUS_NO_USER_SESSION_KEY;
666 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
668 struct auth_session_info **_session_info)
670 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
671 struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
672 krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
673 struct auth_session_info *session_info = NULL;
675 krb5_principal client_principal;
676 char *principal_string;
678 DATA_BLOB pac_blob, *pac_blob_ptr = NULL;
683 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
685 return NT_STATUS_NO_MEMORY;
688 ret = krb5_ticket_get_client(context, gensec_krb5_state->ticket, &client_principal);
690 DEBUG(5, ("krb5_ticket_get_client failed to get cleint principal: %s\n",
691 smb_get_krb5_error_message(context,
693 talloc_free(tmp_ctx);
694 return NT_STATUS_NO_MEMORY;
697 ret = krb5_unparse_name(gensec_krb5_state->smb_krb5_context->krb5_context,
698 client_principal, &principal_string);
700 DEBUG(1, ("Unable to parse client principal: %s\n",
701 smb_get_krb5_error_message(context,
703 krb5_free_principal(context, client_principal);
704 talloc_free(tmp_ctx);
705 return NT_STATUS_NO_MEMORY;
708 ret = krb5_ticket_get_authorization_data_type(context, gensec_krb5_state->ticket,
709 KRB5_AUTHDATA_WIN2K_PAC,
714 DEBUG(5, ("krb5_ticket_get_authorization_data_type failed to find PAC: %s\n",
715 smb_get_krb5_error_message(context,
719 pac_blob = data_blob_talloc(tmp_ctx, pac_data.data, pac_data.length);
720 if (!pac_blob.data) {
721 free(principal_string);
722 krb5_free_principal(context, client_principal);
723 talloc_free(tmp_ctx);
724 return NT_STATUS_NO_MEMORY;
727 /* decode and verify the pac */
728 nt_status = kerberos_decode_pac(gensec_krb5_state,
730 gensec_krb5_state->smb_krb5_context->krb5_context,
731 NULL, gensec_krb5_state->keyblock,
733 gensec_krb5_state->ticket->ticket.authtime, NULL);
735 if (!NT_STATUS_IS_OK(nt_status)) {
736 free(principal_string);
737 krb5_free_principal(context, client_principal);
738 talloc_free(tmp_ctx);
742 pac_blob_ptr = &pac_blob;
745 nt_status = gensec_generate_session_info_pac(tmp_ctx,
747 gensec_krb5_state->smb_krb5_context,
748 pac_blob_ptr, principal_string,
749 gensec_get_remote_address(gensec_security),
752 free(principal_string);
753 krb5_free_principal(context, client_principal);
755 if (!NT_STATUS_IS_OK(nt_status)) {
756 talloc_free(tmp_ctx);
760 nt_status = gensec_krb5_session_key(gensec_security, session_info, &session_info->session_key);
762 if (!NT_STATUS_IS_OK(nt_status)) {
763 talloc_free(tmp_ctx);
767 *_session_info = talloc_steal(mem_ctx, session_info);
769 talloc_free(tmp_ctx);
773 static NTSTATUS gensec_krb5_wrap(struct gensec_security *gensec_security,
778 struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
779 krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
780 krb5_auth_context auth_context = gensec_krb5_state->auth_context;
782 krb5_data input, output;
783 input.length = in->length;
784 input.data = in->data;
786 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
787 ret = krb5_mk_priv(context, auth_context, &input, &output, NULL);
789 DEBUG(1, ("krb5_mk_priv failed: %s\n",
790 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
792 return NT_STATUS_ACCESS_DENIED;
794 *out = data_blob_talloc(mem_ctx, output.data, output.length);
796 krb5_data_free(&output);
798 return NT_STATUS_ACCESS_DENIED;
803 static NTSTATUS gensec_krb5_unwrap(struct gensec_security *gensec_security,
808 struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
809 krb5_context context = gensec_krb5_state->smb_krb5_context->krb5_context;
810 krb5_auth_context auth_context = gensec_krb5_state->auth_context;
812 krb5_data input, output;
813 krb5_replay_data replay;
814 input.length = in->length;
815 input.data = in->data;
817 if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
818 ret = krb5_rd_priv(context, auth_context, &input, &output, &replay);
820 DEBUG(1, ("krb5_rd_priv failed: %s\n",
821 smb_get_krb5_error_message(gensec_krb5_state->smb_krb5_context->krb5_context,
823 return NT_STATUS_ACCESS_DENIED;
825 *out = data_blob_talloc(mem_ctx, output.data, output.length);
827 krb5_data_free(&output);
829 return NT_STATUS_ACCESS_DENIED;
834 static bool gensec_krb5_have_feature(struct gensec_security *gensec_security,
837 struct gensec_krb5_state *gensec_krb5_state = (struct gensec_krb5_state *)gensec_security->private_data;
838 if (feature & GENSEC_FEATURE_SESSION_KEY) {
841 if (!gensec_krb5_state->gssapi &&
842 (feature & GENSEC_FEATURE_SEAL)) {
849 static const char *gensec_krb5_oids[] = {
850 GENSEC_OID_KERBEROS5,
851 GENSEC_OID_KERBEROS5_OLD,
855 static const struct gensec_security_ops gensec_fake_gssapi_krb5_security_ops = {
856 .name = "fake_gssapi_krb5",
857 .auth_type = DCERPC_AUTH_TYPE_KRB5,
858 .oid = gensec_krb5_oids,
859 .client_start = gensec_fake_gssapi_krb5_client_start,
860 .server_start = gensec_fake_gssapi_krb5_server_start,
861 .update = gensec_krb5_update,
862 .magic = gensec_magic_check_krb5_oid,
863 .session_key = gensec_krb5_session_key,
864 .session_info = gensec_krb5_session_info,
865 .have_feature = gensec_krb5_have_feature,
868 .priority = GENSEC_KRB5
871 static const struct gensec_security_ops gensec_krb5_security_ops = {
873 .client_start = gensec_krb5_client_start,
874 .server_start = gensec_krb5_server_start,
875 .update = gensec_krb5_update,
876 .session_key = gensec_krb5_session_key,
877 .session_info = gensec_krb5_session_info,
878 .have_feature = gensec_krb5_have_feature,
879 .wrap = gensec_krb5_wrap,
880 .unwrap = gensec_krb5_unwrap,
883 .priority = GENSEC_KRB5
886 _PUBLIC_ NTSTATUS gensec_krb5_init(void)
890 ret = gensec_register(&gensec_krb5_security_ops);
891 if (!NT_STATUS_IS_OK(ret)) {
892 DEBUG(0,("Failed to register '%s' gensec backend!\n",
893 gensec_krb5_security_ops.name));
897 ret = gensec_register(&gensec_fake_gssapi_krb5_security_ops);
898 if (!NT_STATUS_IS_OK(ret)) {
899 DEBUG(0,("Failed to register '%s' gensec backend!\n",
900 gensec_krb5_security_ops.name));