155682Smarkm/* 2233294Sstas * Copyright (c) 1997 - 2008 Kungliga Tekniska H��gskolan 3233294Sstas * (Royal Institute of Technology, Stockholm, Sweden). 4233294Sstas * All rights reserved. 555682Smarkm * 6233294Sstas * Redistribution and use in source and binary forms, with or without 7233294Sstas * modification, are permitted provided that the following conditions 8233294Sstas * are met: 955682Smarkm * 10233294Sstas * 1. Redistributions of source code must retain the above copyright 11233294Sstas * notice, this list of conditions and the following disclaimer. 1255682Smarkm * 13233294Sstas * 2. Redistributions in binary form must reproduce the above copyright 14233294Sstas * notice, this list of conditions and the following disclaimer in the 15233294Sstas * documentation and/or other materials provided with the distribution. 1655682Smarkm * 17233294Sstas * 3. Neither the name of the Institute nor the names of its contributors 18233294Sstas * may be used to endorse or promote products derived from this software 19233294Sstas * without specific prior written permission. 2055682Smarkm * 21233294Sstas * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22233294Sstas * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23233294Sstas * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24233294Sstas * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25233294Sstas * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26233294Sstas * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27233294Sstas * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28233294Sstas * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29233294Sstas * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30233294Sstas * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31233294Sstas * SUCH DAMAGE. 3255682Smarkm */ 3355682Smarkm 3455682Smarkm#include "krb5_locl.h" 3555682Smarkm 36233294SstasKRB5_LIB_FUNCTION void KRB5_LIB_CALL 3755682Smarkmkrb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options) 3855682Smarkm{ 3955682Smarkm memset (options, 0, sizeof(*options)); 4055682Smarkm} 4155682Smarkm 42233294SstasKRB5_LIB_FUNCTION void KRB5_LIB_CALL 4355682Smarkmkrb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options, 4455682Smarkm int ap_req_nofail) 4555682Smarkm{ 4655682Smarkm options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL; 4755682Smarkm options->ap_req_nofail = ap_req_nofail; 4855682Smarkm} 4955682Smarkm 5055682Smarkm/* 5155682Smarkm * 5255682Smarkm */ 5355682Smarkm 5455682Smarkmstatic krb5_boolean 5555682Smarkmfail_verify_is_ok (krb5_context context, 5655682Smarkm krb5_verify_init_creds_opt *options) 5755682Smarkm{ 5855682Smarkm if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL 59102644Snectar && options->ap_req_nofail != 0) 6055682Smarkm || krb5_config_get_bool (context, 6155682Smarkm NULL, 6255682Smarkm "libdefaults", 6355682Smarkm "verify_ap_req_nofail", 6455682Smarkm NULL)) 6555682Smarkm return FALSE; 6655682Smarkm else 6755682Smarkm return TRUE; 6855682Smarkm} 6955682Smarkm 70233294SstasKRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 7155682Smarkmkrb5_verify_init_creds(krb5_context context, 7255682Smarkm krb5_creds *creds, 7355682Smarkm krb5_principal ap_req_server, 7455682Smarkm krb5_keytab ap_req_keytab, 7555682Smarkm krb5_ccache *ccache, 7655682Smarkm krb5_verify_init_creds_opt *options) 7755682Smarkm{ 7855682Smarkm krb5_error_code ret; 7955682Smarkm krb5_data req; 8078527Sassar krb5_ccache local_ccache = NULL; 8155682Smarkm krb5_creds *new_creds = NULL; 8255682Smarkm krb5_auth_context auth_context = NULL; 8355682Smarkm krb5_principal server = NULL; 8455682Smarkm krb5_keytab keytab = NULL; 8555682Smarkm 8655682Smarkm krb5_data_zero (&req); 8755682Smarkm 8855682Smarkm if (ap_req_server == NULL) { 8955682Smarkm char local_hostname[MAXHOSTNAMELEN]; 9055682Smarkm 9178527Sassar if (gethostname (local_hostname, sizeof(local_hostname)) < 0) { 9278527Sassar ret = errno; 93233294Sstas krb5_set_error_message (context, ret, "gethostname: %s", 94233294Sstas strerror(ret)); 9578527Sassar return ret; 9678527Sassar } 9755682Smarkm 9855682Smarkm ret = krb5_sname_to_principal (context, 9955682Smarkm local_hostname, 10055682Smarkm "host", 10155682Smarkm KRB5_NT_SRV_HST, 10255682Smarkm &server); 10355682Smarkm if (ret) 10455682Smarkm goto cleanup; 10555682Smarkm } else 10655682Smarkm server = ap_req_server; 10755682Smarkm 10855682Smarkm if (ap_req_keytab == NULL) { 10955682Smarkm ret = krb5_kt_default (context, &keytab); 11055682Smarkm if (ret) 11155682Smarkm goto cleanup; 11255682Smarkm } else 11355682Smarkm keytab = ap_req_keytab; 11455682Smarkm 11555682Smarkm if (ccache && *ccache) 11655682Smarkm local_ccache = *ccache; 11755682Smarkm else { 118233294Sstas ret = krb5_cc_new_unique(context, krb5_cc_type_memory, 119233294Sstas NULL, &local_ccache); 12055682Smarkm if (ret) 12155682Smarkm goto cleanup; 12255682Smarkm ret = krb5_cc_initialize (context, 12355682Smarkm local_ccache, 12455682Smarkm creds->client); 12555682Smarkm if (ret) 12655682Smarkm goto cleanup; 12755682Smarkm ret = krb5_cc_store_cred (context, 12855682Smarkm local_ccache, 12955682Smarkm creds); 13055682Smarkm if (ret) 13155682Smarkm goto cleanup; 13255682Smarkm } 13355682Smarkm 13455682Smarkm if (!krb5_principal_compare (context, server, creds->server)) { 13555682Smarkm krb5_creds match_cred; 13655682Smarkm 13755682Smarkm memset (&match_cred, 0, sizeof(match_cred)); 13855682Smarkm 13955682Smarkm match_cred.client = creds->client; 14055682Smarkm match_cred.server = server; 14155682Smarkm 14255682Smarkm ret = krb5_get_credentials (context, 14355682Smarkm 0, 14455682Smarkm local_ccache, 14555682Smarkm &match_cred, 14655682Smarkm &new_creds); 14755682Smarkm if (ret) { 14855682Smarkm if (fail_verify_is_ok (context, options)) 14955682Smarkm ret = 0; 15055682Smarkm goto cleanup; 15155682Smarkm } 15257416Smarkm creds = new_creds; 15357416Smarkm } 15455682Smarkm 15555682Smarkm ret = krb5_mk_req_extended (context, 15655682Smarkm &auth_context, 15755682Smarkm 0, 15855682Smarkm NULL, 15957416Smarkm creds, 16055682Smarkm &req); 161233294Sstas 16255682Smarkm krb5_auth_con_free (context, auth_context); 16355682Smarkm auth_context = NULL; 16455682Smarkm 16555682Smarkm if (ret) 16655682Smarkm goto cleanup; 16755682Smarkm 16855682Smarkm ret = krb5_rd_req (context, 16955682Smarkm &auth_context, 17055682Smarkm &req, 17155682Smarkm server, 17255682Smarkm keytab, 17355682Smarkm 0, 17455682Smarkm NULL); 17555682Smarkm 17655682Smarkm if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options)) 17755682Smarkm ret = 0; 17855682Smarkmcleanup: 17955682Smarkm if (auth_context) 18055682Smarkm krb5_auth_con_free (context, auth_context); 18155682Smarkm krb5_data_free (&req); 18257416Smarkm if (new_creds != NULL) 18355682Smarkm krb5_free_creds (context, new_creds); 18455682Smarkm if (ap_req_server == NULL && server) 18555682Smarkm krb5_free_principal (context, server); 18655682Smarkm if (ap_req_keytab == NULL && keytab) 18755682Smarkm krb5_kt_close (context, keytab); 18878527Sassar if (local_ccache != NULL 18978527Sassar && 19078527Sassar (ccache == NULL 19178527Sassar || (ret != 0 && *ccache == NULL))) 19255682Smarkm krb5_cc_destroy (context, local_ccache); 19355682Smarkm 19455682Smarkm if (ret == 0 && ccache != NULL && *ccache == NULL) 19555682Smarkm *ccache = local_ccache; 19655682Smarkm 19755682Smarkm return ret; 19855682Smarkm} 199233294Sstas 200233294Sstas/** 201233294Sstas * Validate the newly fetch credential, see also krb5_verify_init_creds(). 202233294Sstas * 203233294Sstas * @param context a Kerberos 5 context 204233294Sstas * @param creds the credentials to verify 205233294Sstas * @param client the client name to match up 206233294Sstas * @param ccache the credential cache to use 207233294Sstas * @param service a service name to use, used with 208233294Sstas * krb5_sname_to_principal() to build a hostname to use to 209233294Sstas * verify. 210233294Sstas * 211233294Sstas * @ingroup krb5_ccache 212233294Sstas */ 213233294Sstas 214233294SstasKRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 215233294Sstaskrb5_get_validated_creds(krb5_context context, 216233294Sstas krb5_creds *creds, 217233294Sstas krb5_principal client, 218233294Sstas krb5_ccache ccache, 219233294Sstas char *service) 220233294Sstas{ 221233294Sstas krb5_verify_init_creds_opt vopt; 222233294Sstas krb5_principal server; 223233294Sstas krb5_error_code ret; 224233294Sstas 225233294Sstas if (krb5_principal_compare(context, creds->client, client) != TRUE) { 226233294Sstas krb5_set_error_message(context, KRB5_PRINC_NOMATCH, 227233294Sstas N_("Validation credentials and client " 228233294Sstas "doesn't match", "")); 229233294Sstas return KRB5_PRINC_NOMATCH; 230233294Sstas } 231233294Sstas 232233294Sstas ret = krb5_sname_to_principal (context, NULL, service, 233233294Sstas KRB5_NT_SRV_HST, &server); 234233294Sstas if(ret) 235233294Sstas return ret; 236233294Sstas 237233294Sstas krb5_verify_init_creds_opt_init(&vopt); 238233294Sstas 239233294Sstas ret = krb5_verify_init_creds(context, creds, server, NULL, NULL, &vopt); 240233294Sstas krb5_free_principal(context, server); 241233294Sstas 242233294Sstas return ret; 243233294Sstas} 244