sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-15 23:24:37 +03:00
Code
samba-mirror/source3/libads/kerberos_verify.c

253 lines
6.9 KiB
C
Raw Normal View History

Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
/*
Unix SMB/CIFS implementation.
kerberos utility library
Copyright (C) Andrew Tridgell 2001
Copyright (C) Remus Koos 2001
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
Copyright (C) Luke Howard 2003
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#ifdef HAVE_KRB5
/*
verify an incoming ticket and parse out the principal name and
authorization_data if available
*/
NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket,
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
char **principal, DATA_BLOB *auth_data,
DATA_BLOB *ap_rep,
uint8 session_key[16])
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
{
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
krb5_context context = NULL;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
krb5_auth_context auth_context = NULL;
krb5_keytab keytab = NULL;
krb5_data packet;
krb5_ticket *tkt = NULL;
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
krb5_rcache rcache = NULL;
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
int ret, i;
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
krb5_keyblock *key = NULL;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
krb5_principal host_princ;
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
char *host_princ_s = NULL;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
fstring myname;
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
char *password_s = NULL;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
krb5_data password;
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
krb5_enctype *enctypes = NULL;
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
#if 0
krb5_address local_addr;
krb5_address remote_addr;
#endif
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
BOOL auth_ok = False;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
ZERO_STRUCT(packet);
ZERO_STRUCT(password);
ZERO_STRUCTP(auth_data);
ZERO_STRUCTP(ap_rep);
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
if (!secrets_init()) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: secrets_init failed\n"));
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
return NT_STATUS_LOGON_FAILURE;
}
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 14:09:03 +00:00
password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
if (!password_s) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: failed to fetch machine password\n"));
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
return NT_STATUS_LOGON_FAILURE;
}
password.data = password_s;
password.length = strlen(password_s);
ret = krb5_init_context(&context);
if (ret) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
return NT_STATUS_LOGON_FAILURE;
}
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 17:00:51 +00:00
ret = krb5_set_default_realm(context, ads->auth.realm);
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
if (ret) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
}
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
/* This whole process is far more complex than I would
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
like. We have to go through all this to allow us to store
the secret internally, instead of using /etc/krb5.keytab */
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
ret = krb5_auth_con_init(context, &auth_context);
if (ret) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
}
Removed global_myworkgroup, global_myname, global_myscope. Added liberal dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit f755711df8f74f9b8e8c1a2b0d07d02a931eeb89)
2002-11-12 23:20:50 +00:00
fstrcpy(myname, global_myname());
Removed strupper/strlower macros that automatically map to strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy. (This used to be commit ff222716a08af65d26ad842ce4c2841cc6540959)
2003-07-03 19:11:31 +00:00
strlower_m(myname);
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
asprintf(&host_princ_s, "HOST/%s@%s", myname, lp_realm());
ret = krb5_parse_name(context, host_princ_s, &host_princ);
if (ret) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: krb5_parse_name(%s) failed (%s)\n",
host_princ_s, error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
}
/*
Put mutex around access of replay cache for krb5 tickets. krb5 replay cache is not multi-process safe. Jeremy. (This used to be commit 9e0534a1b69bbd4f21b4925337cbab127d060fc6)
2003-07-29 21:32:36 +00:00
* JRA. We must set the rcache here. This will prevent replay attacks.
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
*/
ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache);
if (ret) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache failed (%s)\n", error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
}
ret = krb5_auth_con_setrcache(context, auth_context, rcache);
if (ret) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache failed (%s)\n", error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
}
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
/* CIFS doesn't use addresses in tickets. This would breat NAT. JRA */
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) {
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_NO_MEMORY;
goto out;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
}
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(1,("ads_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n",
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
}
Put mutex around access of replay cache for krb5 tickets. krb5 replay cache is not multi-process safe. Jeremy. (This used to be commit 9e0534a1b69bbd4f21b4925337cbab127d060fc6)
2003-07-29 21:32:36 +00:00
/* Lock a mutex surrounding the replay as there is no locking in the MIT krb5
* code surrounding the replay cache... */
if (!grab_server_mutex("replay cache mutex")) {
DEBUG(1,("ads_verify_ticket: unable to protect replay cache with mutex.\n"));
sret = NT_STATUS_LOGON_FAILURE;
goto out;
}
/* We need to setup a auth context with each possible encoding type in turn. */
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
for (i=0;enctypes[i];i++) {
if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) {
continue;
}
Sync of Heimdal kerberos stuff with HEAD. If this breaks I'm blaming the dog again. (This used to be commit 6f89ee2c9dc7f03e3dbe7aa734bf67c6a434d135)
2003-01-30 04:40:12 +00:00
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
krb5_auth_con_setuseruserkey(context, auth_context, key);
packet.length = ticket->length;
packet.data = (krb5_pointer)ticket->data;
Sync of Heimdal kerberos stuff with HEAD. If this breaks I'm blaming the dog again. (This used to be commit 6f89ee2c9dc7f03e3dbe7aa734bf67c6a434d135)
2003-01-30 04:40:12 +00:00
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
if (!(ret = krb5_rd_req(context, &auth_context, &packet,
NULL, keytab, NULL, &tkt))) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(10,("ads_verify_ticket: enc type [%u] decrypted message !\n",
(unsigned int)enctypes[i] ));
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
free_kerberos_etypes(context, enctypes);
auth_ok = True;
break;
}
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
Typo on my part. I typed KRB5_KDB_BAD_ENCTYPE when I meant to type KRB5_BAD_ENCTYPE. Heimdal has the latter, not the former. Jeremy. (This used to be commit e8425df77c2e917c819592d93833a164ee3b5338)
2003-07-29 17:03:51 +00:00
DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
("ads_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
(unsigned int)enctypes[i], error_message(ret)));
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
}
Put mutex around access of replay cache for krb5 tickets. krb5 replay cache is not multi-process safe. Jeremy. (This used to be commit 9e0534a1b69bbd4f21b4925337cbab127d060fc6)
2003-07-29 21:32:36 +00:00
release_server_mutex();
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
if (!auth_ok) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n",
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
}
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
ret = krb5_mk_rep(context, auth_context, &packet);
if (ret) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
}
*ap_rep = data_blob(packet.data, packet.length);
free(packet.data);
W00t! Client smb signing is now working correctly with krb5 and w2k server. Server code *should* also work (I'll check shortly). May be the odd memory leak. Problem was we (a) weren't setting signing on in the client krb5 sessionsetup code (b) we need to ask for a subkey... (c). The client and server need to ask for local and remote subkeys respectively. Thanks to Paul Nelson @ Thursby for some sage advice on this :-). Jeremy. (This used to be commit 3f9e3b60709df5ab755045a093e642510d4cde00)
2003-07-25 23:15:30 +00:00
get_krb5_smb_session_key(context, auth_context, session_key, True);
No matter how special this session key is, it's not worth a level 0. Hide it behind a level 10, with #ifdef DEBUG_PASSWORD instead. Andrew Bartlett (This used to be commit 9d4e327850fb00083241f3e68f866590c44e1823)
2003-06-06 10:22:48 +00:00
#ifdef DEBUG_PASSWORD
DEBUG(10,("SMB session key (from ticket) follows:\n"));
dump_data(10, session_key, 16);
#endif
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
#if 0
file_save("/tmp/ticket.dat", ticket->data, ticket->length);
#endif
Revert tpot's HEAD merge which broke the Heimdal build. Jeremy. (This used to be commit 1298ecd0b8a3a9e0a2de42d0c049856cad65e272)
2003-01-30 18:03:34 +00:00
get_auth_data_from_tkt(auth_data, tkt);
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
Move PAC decoding over from HEAD. (This used to be commit b0fd4e5555dd93c584cd86eaac080663b9e4031f)
2003-04-16 16:57:01 +00:00
{
TALLOC_CTX *ctx = talloc_init("pac data");
decode_pac_data(auth_data, ctx);
talloc_destroy(ctx);
}
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
#if 0
if (tkt->enc_part2) {
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
file_save("/tmp/authdata.dat",
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
tkt->enc_part2->authorization_data[0]->contents,
tkt->enc_part2->authorization_data[0]->length);
#endif
Sync with HEAD for verifying kerberos tickets. (This used to be commit 77e1178a888f0d380a5ef94911a8f07bf04a7ba3)
2003-02-19 15:48:12 +00:00
if ((ret = krb5_unparse_name(context, get_principal_from_tkt(tkt),
principal))) {
Improved debug messages whilst trying to track down kerb issues. Jeremy. (This used to be commit 29dd71ddea480f6163ebbc9d8860a7930ae84066)
2003-07-29 00:31:44 +00:00
DEBUG(3,("ads_verify_ticket: krb5_unparse_name failed (%s)\n",
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
error_message(ret)));
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
sret = NT_STATUS_LOGON_FAILURE;
goto out;
}
sret = NT_STATUS_OK;
out:
if (!NT_STATUS_IS_OK(sret))
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
data_blob_free(auth_data);
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
if (!NT_STATUS_IS_OK(sret))
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
data_blob_free(ap_rep);
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
SAFE_FREE(host_princ_s);
SAFE_FREE(password_s);
if (auth_context)
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
krb5_auth_con_free(context, auth_context);
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
if (context)
krb5_free_context(context);
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
Fixed memory leaks, added krb5 replay cache. Now I need to add code to check the incoming addresses.... Jeremy. (This used to be commit 4e9359a1f67a44b2981579383327ba774e1c31f9)
2003-07-12 00:27:22 +00:00
return sret;
Break up samba's object dependencies, and its prototype includes. Now smbclient, net, and swat use their own proto files - now the global proto.h The change to libads/kerberos.c was to break up the dependency on secrets.c - we want to be able to write an ADS client that doesn't need local secrets. I have other breakups in the works - I will remove the dependency of rpc_parse on passdb (and therefore secrets.c) shortly. (NOTE: This patch does *not* break up includes.h, or other such forbidden actions). Andrew Bartlett (This used to be commit edb41dad2df0ae3db364dbc3896cc75956262edf)
2002-06-25 02:29:09 +00:00
}
The kerberos_verify compoenent of the SessionSetup sync with HEAD. Andrew Bartlett (This used to be commit 64796ed27a3842be1dde52dd4f46698e95961767)
2003-03-17 22:46:12 +00:00
#endif /* HAVE_KRB5 */
Copy Permalink