1 /* $NetBSD: kimpersonate.c,v 1.1.1.2 2014/04/24 12:45:28 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 2000 - 2007 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include "kuser_locl.h" 37 #include <krb5/parse_units.h> 38 39 static char *client_principal_str = NULL; 40 static krb5_principal client_principal; 41 static char *server_principal_str = NULL; 42 static krb5_principal server_principal; 43 44 static char *ccache_str = NULL; 45 46 static char *ticket_flags_str = NULL; 47 static TicketFlags ticket_flags; 48 static char *keytab_file = NULL; 49 static char *enctype_string = NULL; 50 static char *session_enctype_string = NULL; 51 static int expiration_time = 3600; 52 static struct getarg_strings client_addresses; 53 static int version_flag = 0; 54 static int help_flag = 0; 55 static int use_krb5 = 1; 56 57 static const char *enc_type = "aes256-cts-hmac-sha1-96"; 58 static const char *session_enc_type = NULL; 59 60 static void 61 encode_ticket (krb5_context context, 62 EncryptionKey *skey, 63 krb5_enctype etype, 64 int skvno, 65 krb5_creds *cred) 66 { 67 size_t len, size; 68 char *buf; 69 krb5_error_code ret; 70 krb5_crypto crypto; 71 EncryptedData enc_part; 72 EncTicketPart et; 73 Ticket ticket; 74 75 memset (&enc_part, 0, sizeof(enc_part)); 76 memset (&ticket, 0, sizeof(ticket)); 77 78 /* 79 * Set up `enc_part' 80 */ 81 82 et.flags = cred->flags.b; 83 et.key = cred->session; 84 et.crealm = cred->client->realm; 85 copy_PrincipalName(&cred->client->name, &et.cname); 86 { 87 krb5_data empty_string; 88 89 krb5_data_zero(&empty_string); 90 et.transited.tr_type = DOMAIN_X500_COMPRESS; 91 et.transited.contents = empty_string; 92 } 93 et.authtime = cred->times.authtime; 94 et.starttime = NULL; 95 et.endtime = cred->times.endtime; 96 et.renew_till = NULL; 97 et.caddr = &cred->addresses; 98 et.authorization_data = NULL; /* XXX allow random authorization_data */ 99 100 /* 101 * Encrypt `enc_part' of ticket with service key 102 */ 103 104 ASN1_MALLOC_ENCODE(EncTicketPart, buf, len, &et, &size, ret); 105 if (ret) 106 krb5_err(context, 1, ret, "EncTicketPart"); 107 108 ret = krb5_crypto_init(context, skey, etype, &crypto); 109 if (ret) 110 krb5_err(context, 1, ret, "krb5_crypto_init"); 111 ret = krb5_encrypt_EncryptedData (context, 112 crypto, 113 KRB5_KU_TICKET, 114 buf, 115 len, 116 skvno, 117 &ticket.enc_part); 118 if (ret) 119 krb5_err(context, 1, ret, "krb5_encrypt_EncryptedData"); 120 121 free(buf); 122 krb5_crypto_destroy(context, crypto); 123 124 /* 125 * Encode ticket 126 */ 127 128 ticket.tkt_vno = 5; 129 ticket.realm = cred->server->realm; 130 copy_PrincipalName(&cred->server->name, &ticket.sname); 131 132 ASN1_MALLOC_ENCODE(Ticket, buf, len, &ticket, &size, ret); 133 if(ret) 134 krb5_err (context, 1, ret, "encode_Ticket"); 135 136 krb5_data_copy(&cred->ticket, buf, len); 137 free(buf); 138 } 139 140 /* 141 * 142 */ 143 144 static int 145 create_krb5_tickets (krb5_context context, krb5_keytab kt) 146 { 147 krb5_error_code ret; 148 krb5_keytab_entry entry; 149 krb5_creds cred; 150 krb5_enctype etype; 151 krb5_enctype session_etype; 152 krb5_ccache ccache; 153 154 memset (&cred, 0, sizeof(cred)); 155 156 ret = krb5_string_to_enctype (context, enc_type, &etype); 157 if (ret) 158 krb5_err (context, 1, ret, "krb5_string_to_enctype (enc-type)"); 159 ret = krb5_string_to_enctype (context, session_enc_type, &session_etype); 160 if (ret) 161 krb5_err (context, 1, ret, "krb5_string_to_enctype (session-enc-type)"); 162 ret = krb5_kt_get_entry (context, kt, server_principal, 163 0, etype, &entry); 164 if (ret) 165 krb5_err (context, 1, ret, "krb5_kt_get_entry"); 166 167 /* 168 * setup cred 169 */ 170 171 172 ret = krb5_copy_principal (context, client_principal, &cred.client); 173 if (ret) 174 krb5_err (context, 1, ret, "krb5_copy_principal"); 175 ret = krb5_copy_principal (context, server_principal, &cred.server); 176 if (ret) 177 krb5_err (context, 1, ret, "krb5_copy_principal"); 178 krb5_generate_random_keyblock(context, session_etype, &cred.session); 179 180 cred.times.authtime = time(NULL); 181 cred.times.starttime = time(NULL); 182 cred.times.endtime = time(NULL) + expiration_time; 183 cred.times.renew_till = 0; 184 krb5_data_zero(&cred.second_ticket); 185 186 ret = krb5_get_all_client_addrs (context, &cred.addresses); 187 if (ret) 188 krb5_err (context, 1, ret, "krb5_get_all_client_addrs"); 189 cred.flags.b = ticket_flags; 190 191 192 /* 193 * Encode encrypted part of ticket 194 */ 195 196 encode_ticket (context, &entry.keyblock, etype, entry.vno, &cred); 197 198 /* 199 * Write to cc 200 */ 201 202 if (ccache_str) { 203 ret = krb5_cc_resolve(context, ccache_str, &ccache); 204 if (ret) 205 krb5_err (context, 1, ret, "krb5_cc_resolve"); 206 } else { 207 ret = krb5_cc_default (context, &ccache); 208 if (ret) 209 krb5_err (context, 1, ret, "krb5_cc_default"); 210 } 211 212 ret = krb5_cc_initialize (context, ccache, cred.client); 213 if (ret) 214 krb5_err (context, 1, ret, "krb5_cc_initialize"); 215 216 ret = krb5_cc_store_cred (context, ccache, &cred); 217 if (ret) 218 krb5_err (context, 1, ret, "krb5_cc_store_cred"); 219 220 krb5_free_cred_contents (context, &cred); 221 krb5_cc_close (context, ccache); 222 223 return 0; 224 } 225 226 /* 227 * 228 */ 229 230 static void 231 setup_env (krb5_context context, krb5_keytab *kt) 232 { 233 krb5_error_code ret; 234 235 if (keytab_file) 236 ret = krb5_kt_resolve (context, keytab_file, kt); 237 else 238 ret = krb5_kt_default (context, kt); 239 if (ret) 240 krb5_err (context, 1, ret, "resolving keytab"); 241 242 if (client_principal_str == NULL) 243 krb5_errx (context, 1, "missing client principal"); 244 ret = krb5_parse_name (context, client_principal_str, &client_principal); 245 if (ret) 246 krb5_err (context, 1, ret, "resolvning client name"); 247 248 if (server_principal_str == NULL) 249 krb5_errx (context, 1, "missing server principal"); 250 ret = krb5_parse_name (context, server_principal_str, &server_principal); 251 if (ret) 252 krb5_err (context, 1, ret, "resolvning server name"); 253 254 /* If no session-enc-type specified on command line and this is an afs */ 255 /* service ticket, change default of session_enc_type to DES. */ 256 if (session_enctype_string == NULL 257 && strcmp("afs", *server_principal->name.name_string.val) == 0) 258 session_enc_type = "des-cbc-crc"; 259 260 if (ticket_flags_str) { 261 int ticket_flags_int; 262 263 ticket_flags_int = parse_flags(ticket_flags_str, 264 asn1_TicketFlags_units(), 0); 265 if (ticket_flags_int <= 0) { 266 krb5_warnx (context, "bad ticket flags: `%s'", ticket_flags_str); 267 print_flags_table (asn1_TicketFlags_units(), stderr); 268 exit (1); 269 } 270 if (ticket_flags_int) 271 ticket_flags = int2TicketFlags (ticket_flags_int); 272 } 273 } 274 275 /* 276 * 277 */ 278 279 struct getargs args[] = { 280 { "ccache", 0, arg_string, &ccache_str, 281 "name of kerberos 5 credential cache", "cache-name"}, 282 { "server", 's', arg_string, &server_principal_str, 283 "name of server principal", NULL }, 284 { "client", 'c', arg_string, &client_principal_str, 285 "name of client principal", NULL }, 286 { "keytab", 'k', arg_string, &keytab_file, 287 "name of keytab file", NULL }, 288 { "krb5", '5', arg_flag, &use_krb5, 289 "create a kerberos 5 ticket", NULL }, 290 { "expire-time", 'e', arg_integer, &expiration_time, 291 "lifetime of ticket in seconds", NULL }, 292 { "client-addresses", 'a', arg_strings, &client_addresses, 293 "addresses of client", NULL }, 294 { "enc-type", 't', arg_string, &enctype_string, 295 "encryption type", NULL }, 296 { "session-enc-type", 0, arg_string,&session_enctype_string, 297 "encryption type", NULL }, 298 { "ticket-flags", 'f', arg_string, &ticket_flags_str, 299 "ticket flags for krb5 ticket", NULL }, 300 { "version", 0, arg_flag, &version_flag, "Print version", 301 NULL }, 302 { "help", 0, arg_flag, &help_flag, NULL, 303 NULL } 304 }; 305 306 static void 307 usage (int ret) 308 { 309 arg_printusage (args, 310 sizeof(args) / sizeof(args[0]), 311 NULL, 312 ""); 313 exit (ret); 314 } 315 316 int 317 main (int argc, char **argv) 318 { 319 int optidx = 0; 320 krb5_error_code ret; 321 krb5_context context; 322 krb5_keytab kt; 323 324 setprogname (argv[0]); 325 326 ret = krb5_init_context (&context); 327 if (ret) 328 errx(1, "krb5_init_context failed: %u", ret); 329 330 if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx)) 331 usage(1); 332 333 if (help_flag) 334 usage(0); 335 336 if (version_flag) { 337 print_version(NULL); 338 return 0; 339 } 340 341 if (enctype_string) 342 enc_type = enctype_string; 343 if (session_enctype_string) 344 session_enc_type = session_enctype_string; 345 else 346 session_enc_type = enc_type; 347 348 setup_env(context, &kt); 349 350 if (use_krb5) 351 create_krb5_tickets(context, kt); 352 353 krb5_kt_close(context, kt); 354 355 return 0; 356 } 357