1/* 2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "krb5_locl.h" 35 36KRB5_LIB_FUNCTION void KRB5_LIB_CALL 37krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options) 38{ 39 memset (options, 0, sizeof(*options)); 40} 41 42KRB5_LIB_FUNCTION void KRB5_LIB_CALL 43krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options, 44 int ap_req_nofail) 45{ 46 options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL; 47 options->ap_req_nofail = ap_req_nofail; 48} 49 50KRB5_LIB_FUNCTION void KRB5_LIB_CALL 51krb5_verify_init_creds_opt_set_service(krb5_verify_init_creds_opt *options, 52 const char *service) 53{ 54 options->service = service; 55} 56 57/* 58 * 59 */ 60 61static krb5_boolean 62fail_verify_is_ok (krb5_context context, 63 krb5_verify_init_creds_opt *options) 64{ 65 if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL 66 && options->ap_req_nofail != 0) 67 || krb5_config_get_bool (context, 68 NULL, 69 "libdefaults", 70 "verify_ap_req_nofail", 71 NULL)) 72 return FALSE; 73 else 74 return TRUE; 75} 76 77KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 78krb5_verify_init_creds(krb5_context context, 79 krb5_creds *creds, 80 krb5_principal ap_req_server, 81 krb5_keytab ap_req_keytab, 82 krb5_ccache *ccache, 83 krb5_verify_init_creds_opt *options) 84{ 85 krb5_error_code ret; 86 krb5_data req; 87 krb5_ccache local_ccache = NULL; 88 krb5_creds *new_creds = NULL; 89 krb5_auth_context auth_context = NULL; 90 krb5_principal server = NULL; 91 krb5_keytab keytab = NULL; 92 const char *service = "host"; 93 94 if (options && options->service) 95 service = options->service; 96 97 krb5_data_zero (&req); 98 99 if (ap_req_server == NULL) { 100 char local_hostname[MAXHOSTNAMELEN]; 101 102 if (gethostname (local_hostname, sizeof(local_hostname)) < 0) { 103 ret = errno; 104 krb5_set_error_message (context, ret, "gethostname: %s", 105 strerror(ret)); 106 return ret; 107 } 108 109 ret = krb5_sname_to_principal (context, 110 local_hostname, 111 service, 112 KRB5_NT_SRV_HST, 113 &server); 114 if (ret) { 115 if (fail_verify_is_ok(context, options)) 116 ret = 0; 117 goto cleanup; 118 } 119 } else 120 server = ap_req_server; 121 122 if (ap_req_keytab == NULL) { 123 ret = krb5_kt_default (context, &keytab); 124 if (ret) 125 goto cleanup; 126 } else 127 keytab = ap_req_keytab; 128 129 if (ccache && *ccache) 130 local_ccache = *ccache; 131 else { 132 ret = krb5_cc_new_unique(context, krb5_cc_type_memory, 133 NULL, &local_ccache); 134 if (ret) 135 goto cleanup; 136 ret = krb5_cc_initialize (context, 137 local_ccache, 138 creds->client); 139 if (ret) 140 goto cleanup; 141 ret = krb5_cc_store_cred (context, 142 local_ccache, 143 creds); 144 if (ret) 145 goto cleanup; 146 } 147 148 if (!krb5_principal_compare (context, server, creds->server)) { 149 krb5_creds match_cred; 150 151 memset (&match_cred, 0, sizeof(match_cred)); 152 153 match_cred.client = creds->client; 154 match_cred.server = server; 155 156 ret = krb5_get_credentials (context, 157 0, 158 local_ccache, 159 &match_cred, 160 &new_creds); 161 if (ret) { 162 if (fail_verify_is_ok (context, options)) 163 ret = 0; 164 goto cleanup; 165 } 166 creds = new_creds; 167 } 168 169 ret = krb5_mk_req_extended (context, 170 &auth_context, 171 0, 172 NULL, 173 creds, 174 &req); 175 176 krb5_auth_con_free (context, auth_context); 177 auth_context = NULL; 178 179 if (ret) 180 goto cleanup; 181 182 ret = krb5_rd_req (context, 183 &auth_context, 184 &req, 185 server, 186 keytab, 187 0, 188 NULL); 189 190 if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options)) 191 ret = 0; 192cleanup: 193 if (auth_context) 194 krb5_auth_con_free (context, auth_context); 195 krb5_data_free (&req); 196 if (new_creds != NULL) 197 krb5_free_creds (context, new_creds); 198 if (ap_req_server == NULL && server) 199 krb5_free_principal (context, server); 200 if (ap_req_keytab == NULL && keytab) 201 krb5_kt_close (context, keytab); 202 if (local_ccache != NULL 203 && 204 (ccache == NULL 205 || (ret != 0 && *ccache == NULL))) 206 krb5_cc_destroy (context, local_ccache); 207 208 if (ret == 0 && ccache != NULL && *ccache == NULL) 209 *ccache = local_ccache; 210 211 return ret; 212} 213 214/** 215 * Validate the newly fetch credential, see also krb5_verify_init_creds(). 216 * 217 * @param context a Kerberos 5 context 218 * @param creds the credentials to verify 219 * @param client the client name to match up 220 * @param ccache the credential cache to use 221 * @param service a service name to use, used with 222 * krb5_sname_to_principal() to build a hostname to use to 223 * verify. 224 * 225 * @ingroup krb5_ccache 226 */ 227 228KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 229krb5_get_validated_creds(krb5_context context, 230 krb5_creds *creds, 231 krb5_principal client, 232 krb5_ccache ccache, 233 char *service) 234{ 235 krb5_verify_init_creds_opt vopt; 236 krb5_principal server; 237 krb5_error_code ret; 238 239 if (krb5_principal_compare(context, creds->client, client) != TRUE) { 240 krb5_set_error_message(context, KRB5_PRINC_NOMATCH, 241 N_("Validation credentials and client " 242 "doesn't match", "")); 243 return KRB5_PRINC_NOMATCH; 244 } 245 246 ret = krb5_sname_to_principal (context, NULL, service, 247 KRB5_NT_SRV_HST, &server); 248 if(ret) 249 return ret; 250 251 krb5_verify_init_creds_opt_init(&vopt); 252 253 ret = krb5_verify_init_creds(context, creds, server, NULL, NULL, &vopt); 254 krb5_free_principal(context, server); 255 256 return ret; 257} 258