1/*
2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35
36KRB5_LIB_FUNCTION void KRB5_LIB_CALL
37krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options)
38{
39    memset (options, 0, sizeof(*options));
40}
41
42KRB5_LIB_FUNCTION void KRB5_LIB_CALL
43krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options,
44					     int ap_req_nofail)
45{
46    options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
47    options->ap_req_nofail = ap_req_nofail;
48}
49
50KRB5_LIB_FUNCTION void KRB5_LIB_CALL
51krb5_verify_init_creds_opt_set_service(krb5_verify_init_creds_opt *options,
52				       const char *service)
53{
54    options->service = service;
55}
56
57/*
58 *
59 */
60
61static krb5_boolean
62fail_verify_is_ok (krb5_context context,
63		   krb5_verify_init_creds_opt *options)
64{
65    if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
66	 && options->ap_req_nofail != 0)
67	|| krb5_config_get_bool (context,
68				 NULL,
69				 "libdefaults",
70				 "verify_ap_req_nofail",
71				 NULL))
72	return FALSE;
73    else
74	return TRUE;
75}
76
77KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
78krb5_verify_init_creds(krb5_context context,
79		       krb5_creds *creds,
80		       krb5_principal ap_req_server,
81		       krb5_keytab ap_req_keytab,
82		       krb5_ccache *ccache,
83		       krb5_verify_init_creds_opt *options)
84{
85    krb5_error_code ret;
86    krb5_data req;
87    krb5_ccache local_ccache = NULL;
88    krb5_creds *new_creds = NULL;
89    krb5_auth_context auth_context = NULL;
90    krb5_principal server = NULL;
91    krb5_keytab keytab = NULL;
92    const char *service = "host";
93
94    if (options && options->service)
95	service = options->service;
96
97    krb5_data_zero (&req);
98
99    if (ap_req_server == NULL) {
100	char local_hostname[MAXHOSTNAMELEN];
101
102	if (gethostname (local_hostname, sizeof(local_hostname)) < 0) {
103	    ret = errno;
104	    krb5_set_error_message (context, ret, "gethostname: %s",
105				    strerror(ret));
106	    return ret;
107	}
108
109	ret = krb5_sname_to_principal (context,
110				       local_hostname,
111				       service,
112				       KRB5_NT_SRV_HST,
113				       &server);
114	if (ret) {
115	    if (fail_verify_is_ok(context, options))
116		ret = 0;
117	    goto cleanup;
118	}
119    } else
120	server = ap_req_server;
121
122    if (ap_req_keytab == NULL) {
123	ret = krb5_kt_default (context, &keytab);
124	if (ret)
125	    goto cleanup;
126    } else
127	keytab = ap_req_keytab;
128
129    if (ccache && *ccache)
130	local_ccache = *ccache;
131    else {
132	ret = krb5_cc_new_unique(context, krb5_cc_type_memory,
133				 NULL, &local_ccache);
134	if (ret)
135	    goto cleanup;
136	ret = krb5_cc_initialize (context,
137				  local_ccache,
138				  creds->client);
139	if (ret)
140	    goto cleanup;
141	ret = krb5_cc_store_cred (context,
142				  local_ccache,
143				  creds);
144	if (ret)
145	    goto cleanup;
146    }
147
148    if (!krb5_principal_compare (context, server, creds->server)) {
149	krb5_creds match_cred;
150
151	memset (&match_cred, 0, sizeof(match_cred));
152
153	match_cred.client = creds->client;
154	match_cred.server = server;
155
156	ret = krb5_get_credentials (context,
157				    0,
158				    local_ccache,
159				    &match_cred,
160				    &new_creds);
161	if (ret) {
162	    if (fail_verify_is_ok (context, options))
163		ret = 0;
164	    goto cleanup;
165	}
166	creds = new_creds;
167    }
168
169    ret = krb5_mk_req_extended (context,
170				&auth_context,
171				0,
172				NULL,
173				creds,
174				&req);
175
176    krb5_auth_con_free (context, auth_context);
177    auth_context = NULL;
178
179    if (ret)
180	goto cleanup;
181
182    ret = krb5_rd_req (context,
183		       &auth_context,
184		       &req,
185		       server,
186		       keytab,
187		       0,
188		       NULL);
189
190    if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options))
191	ret = 0;
192cleanup:
193    if (auth_context)
194	krb5_auth_con_free (context, auth_context);
195    krb5_data_free (&req);
196    if (new_creds != NULL)
197	krb5_free_creds (context, new_creds);
198    if (ap_req_server == NULL && server)
199	krb5_free_principal (context, server);
200    if (ap_req_keytab == NULL && keytab)
201	krb5_kt_close (context, keytab);
202    if (local_ccache != NULL
203	&&
204	(ccache == NULL
205	 || (ret != 0 && *ccache == NULL)))
206	krb5_cc_destroy (context, local_ccache);
207
208    if (ret == 0 && ccache != NULL && *ccache == NULL)
209	*ccache = local_ccache;
210
211    return ret;
212}
213
214/**
215 * Validate the newly fetch credential, see also krb5_verify_init_creds().
216 *
217 * @param context a Kerberos 5 context
218 * @param creds the credentials to verify
219 * @param client the client name to match up
220 * @param ccache the credential cache to use
221 * @param service a service name to use, used with
222 *        krb5_sname_to_principal() to build a hostname to use to
223 *        verify.
224 *
225 * @ingroup krb5_ccache
226 */
227
228KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
229krb5_get_validated_creds(krb5_context context,
230			 krb5_creds *creds,
231			 krb5_principal client,
232			 krb5_ccache ccache,
233			 char *service)
234{
235    krb5_verify_init_creds_opt vopt;
236    krb5_principal server;
237    krb5_error_code ret;
238
239    if (krb5_principal_compare(context, creds->client, client) != TRUE) {
240	krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
241			       N_("Validation credentials and client "
242				  "doesn't match", ""));
243	return KRB5_PRINC_NOMATCH;
244    }
245
246    ret = krb5_sname_to_principal (context, NULL, service,
247				   KRB5_NT_SRV_HST, &server);
248    if(ret)
249	return ret;
250
251    krb5_verify_init_creds_opt_init(&vopt);
252
253    ret = krb5_verify_init_creds(context, creds, server, NULL, NULL, &vopt);
254    krb5_free_principal(context, server);
255
256    return ret;
257}
258