crypto/external/bsd/heimdal/dist/lib/krb5/verify_init.c

   1 /*      $NetBSD: verify_init.c,v 1.1.1.2 2014/04/24 12:45:51 pettai Exp $       */
   2
   3 /*
   4  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   5  * (Royal Institute of Technology, Stockholm, Sweden).
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "krb5_locl.h"
  37
  38 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
  39 krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options)
  40 {
  41     memset (options, 0, sizeof(*options));
  42 }
  43
  44 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
  45 krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options,
  46                                              int ap_req_nofail)
  47 {
  48     options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
  49     options->ap_req_nofail = ap_req_nofail;
  50 }
  51
  52 /*
  53  *
  54  */
  55
  56 static krb5_boolean
  57 fail_verify_is_ok (krb5_context context,
  58                    krb5_verify_init_creds_opt *options)
  59 {
  60     if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
  61          && options->ap_req_nofail != 0)
  62         || krb5_config_get_bool (context,
  63                                  NULL,
  64                                  "libdefaults",
  65                                  "verify_ap_req_nofail",
  66                                  NULL))
  67         return FALSE;
  68     else
  69         return TRUE;
  70 }
  71
  72 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
  73 krb5_verify_init_creds(krb5_context context,
  74                        krb5_creds *creds,
  75                        krb5_principal ap_req_server,
  76                        krb5_keytab ap_req_keytab,
  77                        krb5_ccache *ccache,
  78                        krb5_verify_init_creds_opt *options)
  79 {
  80     krb5_error_code ret;
  81     krb5_data req;
  82     krb5_ccache local_ccache = NULL;
  83     krb5_creds *new_creds = NULL;
  84     krb5_auth_context auth_context = NULL;
  85     krb5_principal server = NULL;
  86     krb5_keytab keytab = NULL;
  87
  88     krb5_data_zero (&req);
  89
  90     if (ap_req_server == NULL) {
  91         char local_hostname[MAXHOSTNAMELEN];
  92
  93         if (gethostname (local_hostname, sizeof(local_hostname)) < 0) {
  94             ret = errno;
  95             krb5_set_error_message (context, ret, "gethostname: %s",
  96                                     strerror(ret));
  97             return ret;
  98         }
  99
 100         ret = krb5_sname_to_principal (context,
 101                                        local_hostname,
 102                                        "host",
 103                                        KRB5_NT_SRV_HST,
 104                                        &server);
 105         if (ret)
 106             goto cleanup;
 107     } else
 108         server = ap_req_server;
 109
 110     if (ap_req_keytab == NULL) {
 111         ret = krb5_kt_default (context, &keytab);
 112         if (ret)
 113             goto cleanup;
 114     } else
 115         keytab = ap_req_keytab;
 116
 117     if (ccache && *ccache)
 118         local_ccache = *ccache;
 119     else {
 120         ret = krb5_cc_new_unique(context, krb5_cc_type_memory,
 121                                  NULL, &local_ccache);
 122         if (ret)
 123             goto cleanup;
 124         ret = krb5_cc_initialize (context,
 125                                   local_ccache,
 126                                   creds->client);
 127         if (ret)
 128             goto cleanup;
 129         ret = krb5_cc_store_cred (context,
 130                                   local_ccache,
 131                                   creds);
 132         if (ret)
 133             goto cleanup;
 134     }
 135
 136     if (!krb5_principal_compare (context, server, creds->server)) {
 137         krb5_creds match_cred;
 138
 139         memset (&match_cred, 0, sizeof(match_cred));
 140
 141         match_cred.client = creds->client;
 142         match_cred.server = server;
 143
 144         ret = krb5_get_credentials (context,
 145                                     0,
 146                                     local_ccache,
 147                                     &match_cred,
 148                                     &new_creds);
 149         if (ret) {
 150             if (fail_verify_is_ok (context, options))
 151                 ret = 0;
 152             goto cleanup;
 153         }
 154         creds = new_creds;
 155     }
 156
 157     ret = krb5_mk_req_extended (context,
 158                                 &auth_context,
 159                                 0,
 160                                 NULL,
 161                                 creds,
 162                                 &req);
 163
 164     krb5_auth_con_free (context, auth_context);
 165     auth_context = NULL;
 166
 167     if (ret)
 168         goto cleanup;
 169
 170     ret = krb5_rd_req (context,
 171                        &auth_context,
 172                        &req,
 173                        server,
 174                        keytab,
 175                        0,
 176                        NULL);
 177
 178     if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options))
 179         ret = 0;
 180 cleanup:
 181     if (auth_context)
 182         krb5_auth_con_free (context, auth_context);
 183     krb5_data_free (&req);
 184     if (new_creds != NULL)
 185         krb5_free_creds (context, new_creds);
 186     if (ap_req_server == NULL && server)
 187         krb5_free_principal (context, server);
 188     if (ap_req_keytab == NULL && keytab)
 189         krb5_kt_close (context, keytab);
 190     if (local_ccache != NULL
 191         &&
 192         (ccache == NULL
 193          || (ret != 0 && *ccache == NULL)))
 194         krb5_cc_destroy (context, local_ccache);
 195
 196     if (ret == 0 && ccache != NULL && *ccache == NULL)
 197         *ccache = local_ccache;
 198
 199     return ret;
 200 }
 201
 202 /**
 203  * Validate the newly fetch credential, see also krb5_verify_init_creds().
 204  *
 205  * @param context a Kerberos 5 context
 206  * @param creds the credentials to verify
 207  * @param client the client name to match up
 208  * @param ccache the credential cache to use
 209  * @param service a service name to use, used with
 210  *        krb5_sname_to_principal() to build a hostname to use to
 211  *        verify.
 212  *
 213  * @ingroup krb5_ccache
 214  */
 215
 216 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 217 krb5_get_validated_creds(krb5_context context,
 218                          krb5_creds *creds,
 219                          krb5_principal client,
 220                          krb5_ccache ccache,
 221                          char *service)
 222 {
 223     krb5_verify_init_creds_opt vopt;
 224     krb5_principal server;
 225     krb5_error_code ret;
 226
 227     if (krb5_principal_compare(context, creds->client, client) != TRUE) {
 228         krb5_set_error_message(context, KRB5_PRINC_NOMATCH,
 229                                N_("Validation credentials and client "
 230                                   "doesn't match", ""));
 231         return KRB5_PRINC_NOMATCH;
 232     }
 233
 234     ret = krb5_sname_to_principal (context, NULL, service,
 235                                    KRB5_NT_SRV_HST, &server);
 236     if(ret)
 237         return ret;
 238
 239     krb5_verify_init_creds_opt_init(&vopt);
 240
 241     ret = krb5_verify_init_creds(context, creds, server, NULL, NULL, &vopt);
 242     krb5_free_principal(context, server);
 243
 244     return ret;
 245 }