source: branches/samba-3.3.x/source/libads/kerberos_verify.c@ 259

Last change on this file since 259 was 206, checked in by Herwig Bauernfeind, 17 years ago

Import Samba 3.3 branch at 3.0.0 level (psmedley's port)
File size: 16.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 kerberos utility library
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001
6 Copyright (C) Luke Howard 2003
7 Copyright (C) Guenther Deschner 2003, 2005
8 Copyright (C) Jim McDonough ([email protected]) 2003
9 Copyright (C) Andrew Bartlett <[email protected]> 2004-2005
10 Copyright (C) Jeremy Allison 2007
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24*/
25
26#include "includes.h"
27
28#ifdef HAVE_KRB5
29
30#if !defined(HAVE_KRB5_PRINC_COMPONENT)
31const krb5_data *krb5_princ_component(krb5_context, krb5_principal, int );
32#endif
33
34/**********************************************************************************
35 Try to verify a ticket using the system keytab... the system keytab has kvno -1 entries, so
36 it's more like what microsoft does... see comment in utils/net_ads.c in the
37 ads_keytab_add_entry function for details.
38***********************************************************************************/
39
40static bool ads_keytab_verify_ticket(krb5_context context,
41 krb5_auth_context auth_context,
42 const DATA_BLOB *ticket,
43 krb5_ticket **pp_tkt,
44 krb5_keyblock **keyblock,
45 krb5_error_code *perr)
46{
47 krb5_error_code ret = 0;
48 bool auth_ok = False;
49 krb5_keytab keytab = NULL;
50 krb5_kt_cursor kt_cursor;
51 krb5_keytab_entry kt_entry;
52 char *valid_princ_formats[7] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL };
53 char *entry_princ_s = NULL;
54 fstring my_name, my_fqdn;
55 int i;
56 int number_matched_principals = 0;
57 krb5_data packet;
58
59 *pp_tkt = NULL;
60 *keyblock = NULL;
61 *perr = 0;
62
63 /* Generate the list of principal names which we expect
64 * clients might want to use for authenticating to the file
65 * service. We allow name$,{host,cifs}/{name,fqdn,name.REALM}. */
66
67 fstrcpy(my_name, global_myname());
68
69 my_fqdn[0] = '\0';
70 name_to_fqdn(my_fqdn, global_myname());
71
72 if (asprintf(&valid_princ_formats[0], "%s$@%s", my_name, lp_realm()) == -1) {
73 goto out;
74 }
75 if (asprintf(&valid_princ_formats[1], "host/%s@%s", my_name, lp_realm()) == -1) {
76 goto out;
77 }
78 if (asprintf(&valid_princ_formats[2], "host/%s@%s", my_fqdn, lp_realm()) == -1) {
79 goto out;
80 }
81 if (asprintf(&valid_princ_formats[3], "host/%s.%s@%s", my_name, lp_realm(), lp_realm()) == -1) {
82 goto out;
83 }
84 if (asprintf(&valid_princ_formats[4], "cifs/%s@%s", my_name, lp_realm()) == -1) {
85 goto out;
86 }
87 if (asprintf(&valid_princ_formats[5], "cifs/%s@%s", my_fqdn, lp_realm()) == -1) {
88 goto out;
89 }
90 if (asprintf(&valid_princ_formats[6], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm()) == -1) {
91 goto out;
92 }
93
94 ZERO_STRUCT(kt_entry);
95 ZERO_STRUCT(kt_cursor);
96
97 ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
98 if (ret) {
99 DEBUG(1, ("ads_keytab_verify_ticket: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
100 goto out;
101 }
102
103 /* Iterate through the keytab. For each key, if the principal
104 * name case-insensitively matches one of the allowed formats,
105 * try verifying the ticket using that principal. */
106
107 ret = krb5_kt_start_seq_get(context, keytab, &kt_cursor);
108 if (ret) {
109 DEBUG(1, ("ads_keytab_verify_ticket: krb5_kt_start_seq_get failed (%s)\n", error_message(ret)));
110 goto out;
111 }
112
113 while (!auth_ok && (krb5_kt_next_entry(context, keytab, &kt_entry, &kt_cursor) == 0)) {
114 ret = smb_krb5_unparse_name(context, kt_entry.principal, &entry_princ_s);
115 if (ret) {
116 DEBUG(1, ("ads_keytab_verify_ticket: smb_krb5_unparse_name failed (%s)\n",
117 error_message(ret)));
118 goto out;
119 }
120
121 for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
122
123 if (!strequal(entry_princ_s, valid_princ_formats[i])) {
124 continue;
125 }
126
127 number_matched_principals++;
128 packet.length = ticket->length;
129 packet.data = (char *)ticket->data;
130 *pp_tkt = NULL;
131
132 ret = krb5_rd_req_return_keyblock_from_keytab(context, &auth_context, &packet,
133 kt_entry.principal, keytab,
134 NULL, pp_tkt, keyblock);
135
136 if (ret) {
137 DEBUG(10,("ads_keytab_verify_ticket: "
138 "krb5_rd_req_return_keyblock_from_keytab(%s) failed: %s\n",
139 entry_princ_s, error_message(ret)));
140
141 /* workaround for MIT:
142 * as krb5_ktfile_get_entry will explicitly
143 * close the krb5_keytab as soon as krb5_rd_req
144 * has successfully decrypted the ticket but the
145 * ticket is not valid yet (due to clockskew)
146 * there is no point in querying more keytab
147 * entries - Guenther */
148
149 if (ret == KRB5KRB_AP_ERR_TKT_NYV ||
150 ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
151 ret == KRB5KRB_AP_ERR_SKEW) {
152 break;
153 }
154 } else {
155 DEBUG(3,("ads_keytab_verify_ticket: "
156 "krb5_rd_req_return_keyblock_from_keytab succeeded for principal %s\n",
157 entry_princ_s));
158 auth_ok = True;
159 break;
160 }
161 }
162
163 /* Free the name we parsed. */
164 SAFE_FREE(entry_princ_s);
165
166 /* Free the entry we just read. */
167 smb_krb5_kt_free_entry(context, &kt_entry);
168 ZERO_STRUCT(kt_entry);
169 }
170 krb5_kt_end_seq_get(context, keytab, &kt_cursor);
171
172 ZERO_STRUCT(kt_cursor);
173
174 out:
175
176 for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
177 SAFE_FREE(valid_princ_formats[i]);
178 }
179
180 if (!auth_ok) {
181 if (!number_matched_principals) {
182 DEBUG(3, ("ads_keytab_verify_ticket: no keytab principals matched expected file service name.\n"));
183 } else {
184 DEBUG(3, ("ads_keytab_verify_ticket: krb5_rd_req failed for all %d matched keytab principals\n",
185 number_matched_principals));
186 }
187 }
188
189 SAFE_FREE(entry_princ_s);
190
191 {
192 krb5_keytab_entry zero_kt_entry;
193 ZERO_STRUCT(zero_kt_entry);
194 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
195 smb_krb5_kt_free_entry(context, &kt_entry);
196 }
197 }
198
199 {
200 krb5_kt_cursor zero_csr;
201 ZERO_STRUCT(zero_csr);
202 if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
203 krb5_kt_end_seq_get(context, keytab, &kt_cursor);
204 }
205 }
206
207 if (keytab) {
208 krb5_kt_close(context, keytab);
209 }
210 *perr = ret;
211 return auth_ok;
212}
213
214/**********************************************************************************
215 Try to verify a ticket using the secrets.tdb.
216***********************************************************************************/
217
218static krb5_error_code ads_secrets_verify_ticket(krb5_context context,
219 krb5_auth_context auth_context,
220 krb5_principal host_princ,
221 const DATA_BLOB *ticket,
222 krb5_ticket **pp_tkt,
223 krb5_keyblock **keyblock,
224 krb5_error_code *perr)
225{
226 krb5_error_code ret = 0;
227 bool auth_ok = False;
228 char *password_s = NULL;
229 krb5_data password;
230 krb5_enctype enctypes[] = {
231#if defined(ENCTYPE_ARCFOUR_HMAC)
232 ENCTYPE_ARCFOUR_HMAC,
233#endif
234 ENCTYPE_DES_CBC_CRC,
235 ENCTYPE_DES_CBC_MD5,
236 ENCTYPE_NULL
237 };
238 krb5_data packet;
239 int i;
240
241 *pp_tkt = NULL;
242 *keyblock = NULL;
243 *perr = 0;
244
245
246 if (!secrets_init()) {
247 DEBUG(1,("ads_secrets_verify_ticket: secrets_init failed\n"));
248 *perr = KRB5_CONFIG_CANTOPEN;
249 return False;
250 }
251
252 password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
253 if (!password_s) {
254 DEBUG(1,("ads_secrets_verify_ticket: failed to fetch machine password\n"));
255 *perr = KRB5_LIBOS_CANTREADPWD;
256 return False;
257 }
258
259 password.data = password_s;
260 password.length = strlen(password_s);
261
262 /* CIFS doesn't use addresses in tickets. This would break NAT. JRA */
263
264 packet.length = ticket->length;
265 packet.data = (char *)ticket->data;
266
267 /* We need to setup a auth context with each possible encoding type in turn. */
268 for (i=0;enctypes[i];i++) {
269 krb5_keyblock *key = NULL;
270
271 if (!(key = SMB_MALLOC_P(krb5_keyblock))) {
272 ret = ENOMEM;
273 goto out;
274 }
275
276 if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i], false)) {
277 SAFE_FREE(key);
278 continue;
279 }
280
281 krb5_auth_con_setuseruserkey(context, auth_context, key);
282
283 if (!(ret = krb5_rd_req(context, &auth_context, &packet,
284 NULL,
285 NULL, NULL, pp_tkt))) {
286 DEBUG(10,("ads_secrets_verify_ticket: enc type [%u] decrypted message !\n",
287 (unsigned int)enctypes[i] ));
288 auth_ok = True;
289 krb5_copy_keyblock(context, key, keyblock);
290 krb5_free_keyblock(context, key);
291 break;
292 }
293
294 DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
295 ("ads_secrets_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
296 (unsigned int)enctypes[i], error_message(ret)));
297
298 /* successfully decrypted but ticket is just not valid at the moment */
299 if (ret == KRB5KRB_AP_ERR_TKT_NYV ||
300 ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
301 ret == KRB5KRB_AP_ERR_SKEW) {
302 krb5_free_keyblock(context, key);
303 break;
304 }
305
306 krb5_free_keyblock(context, key);
307
308 }
309
310 out:
311 SAFE_FREE(password_s);
312 *perr = ret;
313 return auth_ok;
314}
315
316/**********************************************************************************
317 Verify an incoming ticket and parse out the principal name and
318 authorization_data if available.
319***********************************************************************************/
320
321NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
322 const char *realm,
323 time_t time_offset,
324 const DATA_BLOB *ticket,
325 char **principal,
326 struct PAC_DATA **pac_data,
327 DATA_BLOB *ap_rep,
328 DATA_BLOB *session_key,
329 bool use_replay_cache)
330{
331 NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
332 NTSTATUS pac_ret;
333 DATA_BLOB auth_data;
334 krb5_context context = NULL;
335 krb5_auth_context auth_context = NULL;
336 krb5_data packet;
337 krb5_ticket *tkt = NULL;
338 krb5_rcache rcache = NULL;
339 krb5_keyblock *keyblock = NULL;
340 time_t authtime;
341 krb5_error_code ret = 0;
342 int flags = 0;
343 krb5_principal host_princ = NULL;
344 krb5_const_principal client_principal = NULL;
345 char *host_princ_s = NULL;
346 bool auth_ok = False;
347 bool got_auth_data = False;
348 struct named_mutex *mutex = NULL;
349
350 ZERO_STRUCT(packet);
351 ZERO_STRUCT(auth_data);
352
353 *principal = NULL;
354 *pac_data = NULL;
355 *ap_rep = data_blob_null;
356 *session_key = data_blob_null;
357
358 initialize_krb5_error_table();
359 ret = krb5_init_context(&context);
360 if (ret) {
361 DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
362 return NT_STATUS_LOGON_FAILURE;
363 }
364
365 if (time_offset != 0) {
366 krb5_set_real_time(context, time(NULL) + time_offset, 0);
367 }
368
369 ret = krb5_set_default_realm(context, realm);
370 if (ret) {
371 DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
372 goto out;
373 }
374
375 /* This whole process is far more complex than I would
376 like. We have to go through all this to allow us to store
377 the secret internally, instead of using /etc/krb5.keytab */
378
379 ret = krb5_auth_con_init(context, &auth_context);
380 if (ret) {
381 DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
382 goto out;
383 }
384
385 krb5_auth_con_getflags( context, auth_context, &flags );
386 if ( !use_replay_cache ) {
387 /* Disable default use of a replay cache */
388 flags &= ~KRB5_AUTH_CONTEXT_DO_TIME;
389 krb5_auth_con_setflags( context, auth_context, flags );
390 }
391
392 if (asprintf(&host_princ_s, "%s$", global_myname()) == -1) {
393 goto out;
394 }
395
396 strlower_m(host_princ_s);
397 ret = smb_krb5_parse_name(context, host_princ_s, &host_princ);
398 if (ret) {
399 DEBUG(1,("ads_verify_ticket: smb_krb5_parse_name(%s) failed (%s)\n",
400 host_princ_s, error_message(ret)));
401 goto out;
402 }
403
404
405 if ( use_replay_cache ) {
406
407 /* Lock a mutex surrounding the replay as there is no
408 locking in the MIT krb5 code surrounding the replay
409 cache... */
410
411 mutex = grab_named_mutex(talloc_tos(), "replay cache mutex",
412 10);
413 if (mutex == NULL) {
414 DEBUG(1,("ads_verify_ticket: unable to protect "
415 "replay cache with mutex.\n"));
416 ret = KRB5_CC_IO;
417 goto out;
418 }
419
420 /* JRA. We must set the rcache here. This will prevent
421 replay attacks. */
422
423 ret = krb5_get_server_rcache(context,
424 krb5_princ_component(context, host_princ, 0),
425 &rcache);
426 if (ret) {
427 DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache "
428 "failed (%s)\n", error_message(ret)));
429 goto out;
430 }
431
432 ret = krb5_auth_con_setrcache(context, auth_context, rcache);
433 if (ret) {
434 DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache "
435 "failed (%s)\n", error_message(ret)));
436 goto out;
437 }
438 }
439
440 /* Try secrets.tdb first and fallback to the krb5.keytab if
441 necessary */
442
443 auth_ok = ads_secrets_verify_ticket(context, auth_context, host_princ,
444 ticket, &tkt, &keyblock, &ret);
445
446 if (!auth_ok &&
447 (ret == KRB5KRB_AP_ERR_TKT_NYV ||
448 ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
449 ret == KRB5KRB_AP_ERR_SKEW)) {
450 goto auth_failed;
451 }
452
453 if (!auth_ok && lp_use_kerberos_keytab()) {
454 auth_ok = ads_keytab_verify_ticket(context, auth_context,
455 ticket, &tkt, &keyblock, &ret);
456 }
457
458 if ( use_replay_cache ) {
459 TALLOC_FREE(mutex);
460#if 0
461 /* Heimdal leaks here, if we fix the leak, MIT crashes */
462 if (rcache) {
463 krb5_rc_close(context, rcache);
464 }
465#endif
466 }
467
468 auth_failed:
469 if (!auth_ok) {
470 DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n",
471 error_message(ret)));
472 /* Try map the error return in case it's something like
473 * a clock skew error.
474 */
475 sret = krb5_to_nt_status(ret);
476 if (NT_STATUS_IS_OK(sret) || NT_STATUS_EQUAL(sret,NT_STATUS_UNSUCCESSFUL)) {
477 sret = NT_STATUS_LOGON_FAILURE;