155682Smarkm/* 2102644Snectar * Copyright (c) 1997 - 2002 Kungliga Tekniska H�gskolan 355682Smarkm * (Royal Institute of Technology, Stockholm, Sweden). 455682Smarkm * All rights reserved. 555682Smarkm * 655682Smarkm * Redistribution and use in source and binary forms, with or without 755682Smarkm * modification, are permitted provided that the following conditions 855682Smarkm * are met: 955682Smarkm * 1055682Smarkm * 1. Redistributions of source code must retain the above copyright 1155682Smarkm * notice, this list of conditions and the following disclaimer. 1255682Smarkm * 1355682Smarkm * 2. Redistributions in binary form must reproduce the above copyright 1455682Smarkm * notice, this list of conditions and the following disclaimer in the 1555682Smarkm * documentation and/or other materials provided with the distribution. 1655682Smarkm * 1755682Smarkm * 3. Neither the name of the Institute nor the names of its contributors 1855682Smarkm * may be used to endorse or promote products derived from this software 1955682Smarkm * without specific prior written permission. 2055682Smarkm * 2155682Smarkm * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 2255682Smarkm * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2355682Smarkm * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2455682Smarkm * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 2555682Smarkm * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2655682Smarkm * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2755682Smarkm * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2855682Smarkm * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2955682Smarkm * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3055682Smarkm * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3155682Smarkm * SUCH DAMAGE. 3255682Smarkm */ 3355682Smarkm 3455682Smarkm#include "krb5_locl.h" 3555682Smarkm 36178825SdfrRCSID("$Id: verify_init.c 15555 2005-07-06 00:48:16Z lha $"); 3755682Smarkm 38178825Sdfrvoid KRB5_LIB_FUNCTION 3955682Smarkmkrb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options) 4055682Smarkm{ 4155682Smarkm memset (options, 0, sizeof(*options)); 4255682Smarkm} 4355682Smarkm 44178825Sdfrvoid KRB5_LIB_FUNCTION 4555682Smarkmkrb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options, 4655682Smarkm int ap_req_nofail) 4755682Smarkm{ 4855682Smarkm options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL; 4955682Smarkm options->ap_req_nofail = ap_req_nofail; 5055682Smarkm} 5155682Smarkm 5255682Smarkm/* 5355682Smarkm * 5455682Smarkm */ 5555682Smarkm 5655682Smarkmstatic krb5_boolean 5755682Smarkmfail_verify_is_ok (krb5_context context, 5855682Smarkm krb5_verify_init_creds_opt *options) 5955682Smarkm{ 6055682Smarkm if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL 61102644Snectar && options->ap_req_nofail != 0) 6255682Smarkm || krb5_config_get_bool (context, 6355682Smarkm NULL, 6455682Smarkm "libdefaults", 6555682Smarkm "verify_ap_req_nofail", 6655682Smarkm NULL)) 6755682Smarkm return FALSE; 6855682Smarkm else 6955682Smarkm return TRUE; 7055682Smarkm} 7155682Smarkm 72178825Sdfrkrb5_error_code KRB5_LIB_FUNCTION 7355682Smarkmkrb5_verify_init_creds(krb5_context context, 7455682Smarkm krb5_creds *creds, 7555682Smarkm krb5_principal ap_req_server, 7655682Smarkm krb5_keytab ap_req_keytab, 7755682Smarkm krb5_ccache *ccache, 7855682Smarkm krb5_verify_init_creds_opt *options) 7955682Smarkm{ 8055682Smarkm krb5_error_code ret; 8155682Smarkm krb5_data req; 8278527Sassar krb5_ccache local_ccache = NULL; 8355682Smarkm krb5_creds *new_creds = NULL; 8455682Smarkm krb5_auth_context auth_context = NULL; 8555682Smarkm krb5_principal server = NULL; 8655682Smarkm krb5_keytab keytab = NULL; 8755682Smarkm 8855682Smarkm krb5_data_zero (&req); 8955682Smarkm 9055682Smarkm if (ap_req_server == NULL) { 9155682Smarkm char local_hostname[MAXHOSTNAMELEN]; 9255682Smarkm 9378527Sassar if (gethostname (local_hostname, sizeof(local_hostname)) < 0) { 9478527Sassar ret = errno; 95102644Snectar krb5_set_error_string (context, "gethostname: %s", 9678527Sassar strerror(ret)); 9778527Sassar return ret; 9878527Sassar } 9955682Smarkm 10055682Smarkm ret = krb5_sname_to_principal (context, 10155682Smarkm local_hostname, 10255682Smarkm "host", 10355682Smarkm KRB5_NT_SRV_HST, 10455682Smarkm &server); 10555682Smarkm if (ret) 10655682Smarkm goto cleanup; 10755682Smarkm } else 10855682Smarkm server = ap_req_server; 10955682Smarkm 11055682Smarkm if (ap_req_keytab == NULL) { 11155682Smarkm ret = krb5_kt_default (context, &keytab); 11255682Smarkm if (ret) 11355682Smarkm goto cleanup; 11455682Smarkm } else 11555682Smarkm keytab = ap_req_keytab; 11655682Smarkm 11755682Smarkm if (ccache && *ccache) 11855682Smarkm local_ccache = *ccache; 11955682Smarkm else { 12055682Smarkm ret = krb5_cc_gen_new (context, &krb5_mcc_ops, &local_ccache); 12155682Smarkm if (ret) 12255682Smarkm goto cleanup; 12355682Smarkm ret = krb5_cc_initialize (context, 12455682Smarkm local_ccache, 12555682Smarkm creds->client); 12655682Smarkm if (ret) 12755682Smarkm goto cleanup; 12855682Smarkm ret = krb5_cc_store_cred (context, 12955682Smarkm local_ccache, 13055682Smarkm creds); 13155682Smarkm if (ret) 13255682Smarkm goto cleanup; 13355682Smarkm } 13455682Smarkm 13555682Smarkm if (!krb5_principal_compare (context, server, creds->server)) { 13655682Smarkm krb5_creds match_cred; 13755682Smarkm 13855682Smarkm memset (&match_cred, 0, sizeof(match_cred)); 13955682Smarkm 14055682Smarkm match_cred.client = creds->client; 14155682Smarkm match_cred.server = server; 14255682Smarkm 14355682Smarkm ret = krb5_get_credentials (context, 14455682Smarkm 0, 14555682Smarkm local_ccache, 14655682Smarkm &match_cred, 14755682Smarkm &new_creds); 14855682Smarkm if (ret) { 14955682Smarkm if (fail_verify_is_ok (context, options)) 15055682Smarkm ret = 0; 15155682Smarkm goto cleanup; 15255682Smarkm } 15357416Smarkm creds = new_creds; 15457416Smarkm } 15555682Smarkm 15655682Smarkm ret = krb5_mk_req_extended (context, 15755682Smarkm &auth_context, 15855682Smarkm 0, 15955682Smarkm NULL, 16057416Smarkm creds, 16155682Smarkm &req); 16255682Smarkm 16355682Smarkm krb5_auth_con_free (context, auth_context); 16455682Smarkm auth_context = NULL; 16555682Smarkm 16655682Smarkm if (ret) 16755682Smarkm goto cleanup; 16855682Smarkm 16955682Smarkm ret = krb5_rd_req (context, 17055682Smarkm &auth_context, 17155682Smarkm &req, 17255682Smarkm server, 17355682Smarkm keytab, 17455682Smarkm 0, 17555682Smarkm NULL); 17655682Smarkm 17755682Smarkm if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options)) 17855682Smarkm ret = 0; 17955682Smarkmcleanup: 18055682Smarkm if (auth_context) 18155682Smarkm krb5_auth_con_free (context, auth_context); 18255682Smarkm krb5_data_free (&req); 18357416Smarkm if (new_creds != NULL) 18455682Smarkm krb5_free_creds (context, new_creds); 18555682Smarkm if (ap_req_server == NULL && server) 18655682Smarkm krb5_free_principal (context, server); 18755682Smarkm if (ap_req_keytab == NULL && keytab) 18855682Smarkm krb5_kt_close (context, keytab); 18978527Sassar if (local_ccache != NULL 19078527Sassar && 19178527Sassar (ccache == NULL 19278527Sassar || (ret != 0 && *ccache == NULL))) 19355682Smarkm krb5_cc_destroy (context, local_ccache); 19455682Smarkm 19555682Smarkm if (ret == 0 && ccache != NULL && *ccache == NULL) 19655682Smarkm *ccache = local_ccache; 19755682Smarkm 19855682Smarkm return ret; 19955682Smarkm} 200