1 /* $NetBSD: verify_init.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $ */
2
3 /*
4 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 #include "krb5_locl.h"
37
38 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt * options)39 krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options)
40 {
41 memset (options, 0, sizeof(*options));
42 }
43
44 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt * options,int ap_req_nofail)45 krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options,
46 int ap_req_nofail)
47 {
48 options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
49 options->ap_req_nofail = ap_req_nofail;
50 }
51
52 /*
53 *
54 */
55
56 static krb5_boolean
fail_verify_is_ok(krb5_context context,krb5_verify_init_creds_opt * options)57 fail_verify_is_ok (krb5_context context,
58 krb5_verify_init_creds_opt *options)
59 {
60 if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
61 && options->ap_req_nofail != 0)
62 || krb5_config_get_bool (context,
63 NULL,
64 "libdefaults",
65 "verify_ap_req_nofail",
66 NULL))
67 return FALSE;
68 else
69 return TRUE;
70 }
71
72 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_verify_init_creds(krb5_context context,krb5_creds * creds,krb5_principal ap_req_server,krb5_keytab ap_req_keytab,krb5_ccache * ccache,krb5_verify_init_creds_opt * options)73 krb5_verify_init_creds(krb5_context context,
74 krb5_creds *creds,
75 krb5_principal ap_req_server,
76 krb5_keytab ap_req_keytab,
77 krb5_ccache *ccache,
78 krb5_verify_init_creds_opt *options)
79 {
80 krb5_error_code ret;
81 krb5_data req;
82 krb5_ccache local_ccache = NULL;
83 krb5_creds *new_creds = NULL;
84 krb5_auth_context auth_context = NULL;
85 krb5_principal server = NULL;
86 krb5_keytab keytab = NULL;
87
88 krb5_data_zero (&req);
89
90 if (ap_req_server == NULL) {
91 char local_hostname[MAXHOSTNAMELEN];
92
93 if (gethostname (local_hostname, sizeof(local_hostname)) < 0) {
94 ret = errno;
95 krb5_set_error_message (context, ret, "gethostname: %s",
96 strerror(ret));
97 return ret;
98 }
99
100 ret = krb5_sname_to_principal (context,
101 local_hostname,
102 "host",
103 KRB5_NT_SRV_HST,
104 &server);
105 if (ret)
106 goto cleanup;
107 } else
108 server = ap_req_server;
109
110 if (ap_req_keytab == NULL) {
111 ret = krb5_kt_default (context, &keytab);
112 if (ret)
113 goto cleanup;
114 } else
115 keytab = ap_req_keytab;
116
117 if (ccache && *ccache)
118 local_ccache = *ccache;
119 else {
120 ret = krb5_cc_new_unique(context, krb5_cc_type_memory,
121 NULL, &local_ccache);
122 if (ret)
123 goto cleanup;
124 ret = krb5_cc_initialize (context,
125 local_ccache,
126 creds->client);
127 if (ret)
128 goto cleanup;
129 ret = krb5_cc_store_cred (context,
130 local_ccache,
131 creds);
132 if (ret)
133 goto cleanup;
134 }
135
136 if (!krb5_principal_compare (context, server, creds->server)) {
137 krb5_creds match_cred;
138
139 memset (&match_cred, 0, sizeof(match_cred));
140
141 match_cred.client = creds->client;
142 match_cred.server = server;
143
144 ret = krb5_get_credentials (context,
145 0,
146 local_ccache,
147 &match_cred,
148 &new_creds);
149 if (ret) {
150 if (fail_verify_is_ok (context, options))
151 ret = 0;
152 goto cleanup;
153 }
154 creds = new_creds;
155 }
156
157 ret = krb5_mk_req_extended (context,
158 &auth_context,
159 0,
160 NULL,
161 creds,
162 &req);
163
164 krb5_auth_con_free (context, auth_context);
165 auth_context = NULL;
166
167 if (ret)
168 goto cleanup;
169
170 ret = krb5_rd_req (context,
171 &auth_context,
172 &req,
173 server,
174 keytab,
175 0,
176 NULL);
177
178 if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options))
179 ret = 0;
180 cleanup:
181 if (auth_context)
182 krb5_auth_con_free (context, auth_context);
183 krb5_data_free (&req);
184 if (new_creds != NULL)
185 krb5_free_creds (context, new_creds);
186 if (ap_req_server == NULL && server)
187 krb5_free_principal (context, server);
188 if (ap_req_keytab == NULL && keytab)
189 krb5_kt_close (context, keytab);
190 if (local_ccache != NULL
191 &&
192 (ccache == NULL
193 || (ret != 0 && *ccache == NULL)))
194 krb5_cc_destroy (context, local_ccache);
195
196 if (ret == 0 && ccache != NULL && *ccache == NULL)
197 *ccache = local_ccache;
198
199 return ret;
200 }
201
202 /**
203 * Validate the newly fetch credential, see also krb5_verify_init_creds().
204 *
205 * @param context a Kerberos 5 context
206 * @param creds the credentials to verify
207 * @param client the client name to match up
208 * @param ccache the credential cache to use
209 * @param service a service name to use, used with
210 * krb5_sname_to_principal() to build a hostname to use to
211 * verify.
212 *
213 * @ingroup krb5_ccache
214 */
215
216 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_validated_creds(krb5_context context,krb5_creds * creds,krb5_principal client,krb5_ccache ccache,char * service)217 krb5_get_validated_creds(krb5_context context,
218 krb5_creds *creds,
219 krb5_principal client,
220 krb5_ccache ccache,
221 char *service)
222 {
223 krb5_verify_init_creds_opt vopt;
224 krb5_principal server;
225 krb5_error_code ret;
226
227 if (krb5_principal_compare(context, creds->client, client) != TRUE) {
228 krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
229 N_("Validation credentials and client "
230 "doesn't match", ""));
231 return KRB5_PRINC_NOMATCH;
232 }
233
234 ret = krb5_sname_to_principal (context, NULL, service,
235 KRB5_NT_SRV_HST, &server);
236 if(ret)
237 return ret;
238
239 krb5_verify_init_creds_opt_init(&vopt);
240
241 ret = krb5_verify_init_creds(context, creds, server, NULL, NULL, &vopt);
242 krb5_free_principal(context, server);
243
244 return ret;
245 }
246