crypto/dist/heimdal/lib/krb5/rd_req.c

   1 /*
   2  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include <krb5_locl.h>
  35
  36 __RCSID("$Heimdal: rd_req.c 22235 2007-12-08 21:52:07Z lha $"
  37         "$NetBSD$");
  38
  39 static krb5_error_code
  40 decrypt_tkt_enc_part (krb5_context context,
  41                       krb5_keyblock *key,
  42                       EncryptedData *enc_part,
  43                       EncTicketPart *decr_part)
  44 {
  45     krb5_error_code ret;
  46     krb5_data plain;
  47     size_t len;
  48     krb5_crypto crypto;
  49
  50     ret = krb5_crypto_init(context, key, 0, &crypto);
  51     if (ret)
  52         return ret;
  53     ret = krb5_decrypt_EncryptedData (context,
  54                                       crypto,
  55                                       KRB5_KU_TICKET,
  56                                       enc_part,
  57                                       &plain);
  58     krb5_crypto_destroy(context, crypto);
  59     if (ret)
  60         return ret;
  61
  62     ret = krb5_decode_EncTicketPart(context, plain.data, plain.length,
  63                                     decr_part, &len);
  64     krb5_data_free (&plain);
  65     return ret;
  66 }
  67
  68 static krb5_error_code
  69 decrypt_authenticator (krb5_context context,
  70                        EncryptionKey *key,
  71                        EncryptedData *enc_part,
  72                        Authenticator *authenticator,
  73                        krb5_key_usage usage)
  74 {
  75     krb5_error_code ret;
  76     krb5_data plain;
  77     size_t len;
  78     krb5_crypto crypto;
  79
  80     ret = krb5_crypto_init(context, key, 0, &crypto);
  81     if (ret)
  82         return ret;
  83     ret = krb5_decrypt_EncryptedData (context,
  84                                       crypto,
  85                                       usage /* KRB5_KU_AP_REQ_AUTH */,
  86                                       enc_part,
  87                                       &plain);
  88     /* for backwards compatibility, also try the old usage */
  89     if (ret && usage == KRB5_KU_TGS_REQ_AUTH)
  90         ret = krb5_decrypt_EncryptedData (context,
  91                                           crypto,
  92                                           KRB5_KU_AP_REQ_AUTH,
  93                                           enc_part,
  94                                           &plain);
  95     krb5_crypto_destroy(context, crypto);
  96     if (ret)
  97         return ret;
  98
  99     ret = krb5_decode_Authenticator(context, plain.data, plain.length,
 100                                     authenticator, &len);
 101     krb5_data_free (&plain);
 102     return ret;
 103 }
 104
 105 krb5_error_code KRB5_LIB_FUNCTION
 106 krb5_decode_ap_req(krb5_context context,
 107                    const krb5_data *inbuf,
 108                    krb5_ap_req *ap_req)
 109 {
 110     krb5_error_code ret;
 111     size_t len;
 112     ret = decode_AP_REQ(inbuf->data, inbuf->length, ap_req, &len);
 113     if (ret)
 114         return ret;
 115     if (ap_req->pvno != 5){
 116         free_AP_REQ(ap_req);
 117         krb5_clear_error_string (context);
 118         return KRB5KRB_AP_ERR_BADVERSION;
 119     }
 120     if (ap_req->msg_type != krb_ap_req){
 121         free_AP_REQ(ap_req);
 122         krb5_clear_error_string (context);
 123         return KRB5KRB_AP_ERR_MSG_TYPE;
 124     }
 125     if (ap_req->ticket.tkt_vno != 5){
 126         free_AP_REQ(ap_req);
 127         krb5_clear_error_string (context);
 128         return KRB5KRB_AP_ERR_BADVERSION;
 129     }
 130     return 0;
 131 }
 132
 133 static krb5_error_code
 134 check_transited(krb5_context context, Ticket *ticket, EncTicketPart *enc)
 135 {
 136     char **realms;
 137     int num_realms;
 138     krb5_error_code ret;
 139
 140     /*
 141      * Windows 2000 and 2003 uses this inside their TGT so it's normaly
 142      * not seen by others, however, samba4 joined with a Windows AD as
 143      * a Domain Controller gets exposed to this.
 144      */
 145     if(enc->transited.tr_type == 0 && enc->transited.contents.length == 0)
 146         return 0;
 147
 148     if(enc->transited.tr_type != DOMAIN_X500_COMPRESS)
 149         return KRB5KDC_ERR_TRTYPE_NOSUPP;
 150
 151     if(enc->transited.contents.length == 0)
 152         return 0;
 153
 154     ret = krb5_domain_x500_decode(context, enc->transited.contents,
 155                                   &realms, &num_realms,
 156                                   enc->crealm,
 157                                   ticket->realm);
 158     if(ret)
 159         return ret;
 160     ret = krb5_check_transited(context, enc->crealm,
 161                                ticket->realm,
 162                                realms, num_realms, NULL);
 163     free(realms);
 164     return ret;
 165 }
 166
 167 static krb5_error_code
 168 find_etypelist(krb5_context context,
 169                krb5_auth_context auth_context,
 170                EtypeList *etypes)
 171 {
 172     krb5_error_code ret;
 173     krb5_authdata *ad;
 174     krb5_authdata adIfRelevant;
 175     unsigned i;
 176
 177     adIfRelevant.len = 0;
 178
 179     etypes->len = 0;
 180     etypes->val = NULL;
 181
 182     ad = auth_context->authenticator->authorization_data;
 183     if (ad == NULL)
 184         return 0;
 185
 186     for (i = 0; i < ad->len; i++) {
 187         if (ad->val[i].ad_type == KRB5_AUTHDATA_IF_RELEVANT) {
 188             ret = decode_AD_IF_RELEVANT(ad->val[i].ad_data.data,
 189                                         ad->val[i].ad_data.length,
 190                                         &adIfRelevant,
 191                                         NULL);
 192             if (ret)
 193                 return ret;
 194
 195             if (adIfRelevant.len == 1 &&
 196                 adIfRelevant.val[0].ad_type ==
 197                         KRB5_AUTHDATA_GSS_API_ETYPE_NEGOTIATION) {
 198                 break;
 199             }
 200             free_AD_IF_RELEVANT(&adIfRelevant);
 201             adIfRelevant.len = 0;
 202         }
 203     }
 204
 205     if (adIfRelevant.len == 0)
 206         return 0;
 207
 208     ret = decode_EtypeList(adIfRelevant.val[0].ad_data.data,
 209                            adIfRelevant.val[0].ad_data.length,
 210                            etypes,
 211                            NULL);
 212     if (ret)
 213         krb5_clear_error_string(context);
 214
 215     free_AD_IF_RELEVANT(&adIfRelevant);
 216
 217     return ret;
 218 }
 219
 220 krb5_error_code KRB5_LIB_FUNCTION
 221 krb5_decrypt_ticket(krb5_context context,
 222                     Ticket *ticket,
 223                     krb5_keyblock *key,
 224                     EncTicketPart *out,
 225                     krb5_flags flags)
 226 {
 227     EncTicketPart t;
 228     krb5_error_code ret;
 229     ret = decrypt_tkt_enc_part (context, key, &ticket->enc_part, &t);
 230     if (ret)
 231         return ret;
 232
 233     {
 234         krb5_timestamp now;
 235         time_t start = t.authtime;
 236
 237         krb5_timeofday (context, &now);
 238         if(t.starttime)
 239             start = *t.starttime;
 240         if(start - now > context->max_skew
 241            || (t.flags.invalid
 242                && !(flags & KRB5_VERIFY_AP_REQ_IGNORE_INVALID))) {
 243             free_EncTicketPart(&t);
 244             krb5_clear_error_string (context);
 245             return KRB5KRB_AP_ERR_TKT_NYV;
 246         }
 247         if(now - t.endtime > context->max_skew) {
 248             free_EncTicketPart(&t);
 249             krb5_clear_error_string (context);
 250             return KRB5KRB_AP_ERR_TKT_EXPIRED;
 251         }
 252
 253         if(!t.flags.transited_policy_checked) {
 254             ret = check_transited(context, ticket, &t);
 255             if(ret) {
 256                 free_EncTicketPart(&t);
 257                 return ret;
 258             }
 259         }
 260     }
 261
 262     if(out)
 263         *out = t;
 264     else
 265         free_EncTicketPart(&t);
 266     return 0;
 267 }
 268
 269 krb5_error_code KRB5_LIB_FUNCTION
 270 krb5_verify_authenticator_checksum(krb5_context context,
 271                                    krb5_auth_context ac,
 272                                    void *data,
 273                                    size_t len)
 274 {
 275     krb5_error_code ret;
 276     krb5_keyblock *key;
 277     krb5_authenticator authenticator;
 278     krb5_crypto crypto;
 279
 280     ret = krb5_auth_con_getauthenticator (context,
 281                                       ac,
 282                                       &authenticator);
 283     if(ret)
 284         return ret;
 285     if(authenticator->cksum == NULL) {
 286         krb5_free_authenticator(context, &authenticator);
 287         return -17;
 288     }
 289     ret = krb5_auth_con_getkey(context, ac, &key);
 290     if(ret) {
 291         krb5_free_authenticator(context, &authenticator);
 292         return ret;
 293     }
 294     ret = krb5_crypto_init(context, key, 0, &crypto);
 295     if(ret)
 296         goto out;
 297     ret = krb5_verify_checksum (context,
 298                                 crypto,
 299                                 KRB5_KU_AP_REQ_AUTH_CKSUM,
 300                                 data,
 301                                 len,
 302                                 authenticator->cksum);
 303     krb5_crypto_destroy(context, crypto);
 304 out:
 305     krb5_free_authenticator(context, &authenticator);
 306     krb5_free_keyblock(context, key);
 307     return ret;
 308 }
 309
 310
 311 krb5_error_code KRB5_LIB_FUNCTION
 312 krb5_verify_ap_req(krb5_context context,
 313                    krb5_auth_context *auth_context,
 314                    krb5_ap_req *ap_req,
 315                    krb5_const_principal server,
 316                    krb5_keyblock *keyblock,
 317                    krb5_flags flags,
 318                    krb5_flags *ap_req_options,
 319                    krb5_ticket **ticket)
 320 {
 321     return krb5_verify_ap_req2 (context,
 322                                 auth_context,
 323                                 ap_req,
 324                                 server,
 325                                 keyblock,
 326                                 flags,
 327                                 ap_req_options,
 328                                 ticket,
 329                                 KRB5_KU_AP_REQ_AUTH);
 330 }
 331
 332 krb5_error_code KRB5_LIB_FUNCTION
 333 krb5_verify_ap_req2(krb5_context context,
 334                     krb5_auth_context *auth_context,
 335                     krb5_ap_req *ap_req,
 336                     krb5_const_principal server,
 337                     krb5_keyblock *keyblock,
 338                     krb5_flags flags,
 339                     krb5_flags *ap_req_options,
 340                     krb5_ticket **ticket,
 341                     krb5_key_usage usage)
 342 {
 343     krb5_ticket *t;
 344     krb5_auth_context ac;
 345     krb5_error_code ret;
 346     EtypeList etypes;
 347
 348     if (ticket)
 349         *ticket = NULL;
 350
 351     if (auth_context && *auth_context) {
 352         ac = *auth_context;
 353     } else {
 354         ret = krb5_auth_con_init (context, &ac);
 355         if (ret)
 356             return ret;
 357     }
 358
 359     t = calloc(1, sizeof(*t));
 360     if (t == NULL) {
 361         ret = ENOMEM;
 362         krb5_clear_error_string (context);
 363         goto out;
 364     }
 365
 366     if (ap_req->ap_options.use_session_key && ac->keyblock){
 367         ret = krb5_decrypt_ticket(context, &ap_req->ticket,
 368                                   ac->keyblock,
 369                                   &t->ticket,
 370                                   flags);
 371         krb5_free_keyblock(context, ac->keyblock);
 372         ac->keyblock = NULL;
 373     }else
 374         ret = krb5_decrypt_ticket(context, &ap_req->ticket,
 375                                   keyblock,
 376                                   &t->ticket,
 377                                   flags);
 378
 379     if(ret)
 380         goto out;
 381
 382     ret = _krb5_principalname2krb5_principal(context,
 383                                              &t->server,
 384                                              ap_req->ticket.sname,
 385                                              ap_req->ticket.realm);
 386     if (ret) goto out;
 387     ret = _krb5_principalname2krb5_principal(context,
 388                                              &t->client,
 389                                              t->ticket.cname,
 390                                              t->ticket.crealm);
 391     if (ret) goto out;
 392
 393     /* save key */
 394
 395     ret = krb5_copy_keyblock(context, &t->ticket.key, &ac->keyblock);
 396     if (ret) goto out;
 397
 398     ret = decrypt_authenticator (context,
 399                                  &t->ticket.key,
 400                                  &ap_req->authenticator,
 401                                  ac->authenticator,
 402                                  usage);
 403     if (ret)
 404         goto out;
 405
 406     {
 407         krb5_principal p1, p2;
 408         krb5_boolean res;
 409
 410         _krb5_principalname2krb5_principal(context,
 411                                            &p1,
 412                                            ac->authenticator->cname,
 413                                            ac->authenticator->crealm);
 414         _krb5_principalname2krb5_principal(context,
 415                                            &p2,
 416                                            t->ticket.cname,
 417                                            t->ticket.crealm);
 418         res = krb5_principal_compare (context, p1, p2);
 419         krb5_free_principal (context, p1);
 420         krb5_free_principal (context, p2);
 421         if (!res) {
 422             ret = KRB5KRB_AP_ERR_BADMATCH;
 423             krb5_clear_error_string (context);
 424             goto out;
 425         }
 426     }
 427
 428     /* check addresses */
 429
 430     if (t->ticket.caddr
 431         && ac->remote_address
 432         && !krb5_address_search (context,
 433                                  ac->remote_address,
 434                                  t->ticket.caddr)) {
 435         ret = KRB5KRB_AP_ERR_BADADDR;
 436         krb5_clear_error_string (context);
 437         goto out;
 438     }
 439
 440     /* check timestamp in authenticator */
 441     {
 442         krb5_timestamp now;
 443
 444         krb5_timeofday (context, &now);
 445
 446         if (abs(ac->authenticator->ctime - now) > context->max_skew) {
 447             ret = KRB5KRB_AP_ERR_SKEW;
 448             krb5_clear_error_string (context);
 449             goto out;
 450         }
 451     }
 452
 453     if (ac->authenticator->seq_number)
 454         krb5_auth_con_setremoteseqnumber(context, ac,
 455                                          *ac->authenticator->seq_number);
 456
 457     /* XXX - Xor sequence numbers */
 458
 459     if (ac->authenticator->subkey) {
 460         ret = krb5_auth_con_setremotesubkey(context, ac,
 461                                             ac->authenticator->subkey);
 462         if (ret)
 463             goto out;
 464     }
 465
 466     ret = find_etypelist(context, ac, &etypes);
 467     if (ret)
 468         goto out;
 469
 470     ac->keytype = ETYPE_NULL;
 471
 472     if (etypes.val) {
 473         int i;
 474
 475         for (i = 0; i < etypes.len; i++) {
 476             if (krb5_enctype_valid(context, etypes.val[i]) == 0) {
 477                 ac->keytype = etypes.val[i];
 478                 break;
 479             }
 480         }
 481     }
 482
 483     if (ap_req_options) {
 484         *ap_req_options = 0;
 485         if (ac->keytype != ETYPE_NULL)
 486             *ap_req_options |= AP_OPTS_USE_SUBKEY;
 487         if (ap_req->ap_options.use_session_key)
 488             *ap_req_options |= AP_OPTS_USE_SESSION_KEY;
 489         if (ap_req->ap_options.mutual_required)
 490             *ap_req_options |= AP_OPTS_MUTUAL_REQUIRED;
 491     }
 492
 493     if(ticket)
 494         *ticket = t;
 495     else
 496         krb5_free_ticket (context, t);
 497     if (auth_context) {
 498         if (*auth_context == NULL)
 499             *auth_context = ac;
 500     } else
 501         krb5_auth_con_free (context, ac);
 502     free_EtypeList(&etypes);
 503     return 0;
 504  out:
 505     if (t)
 506         krb5_free_ticket (context, t);
 507     if (auth_context == NULL || *auth_context == NULL)
 508         krb5_auth_con_free (context, ac);
 509     return ret;
 510 }
 511
 512 /*
 513  *
 514  */
 515
 516 struct krb5_rd_req_in_ctx_data {
 517     krb5_keytab keytab;
 518     krb5_keyblock *keyblock;
 519     krb5_boolean check_pac;
 520 };
 521
 522 struct krb5_rd_req_out_ctx_data {
 523     krb5_keyblock *keyblock;
 524     krb5_flags ap_req_options;
 525     krb5_ticket *ticket;
 526 };
 527
 528 /*
 529  *
 530  */
 531
 532 krb5_error_code KRB5_LIB_FUNCTION
 533 krb5_rd_req_in_ctx_alloc(krb5_context context, krb5_rd_req_in_ctx *ctx)
 534 {
 535     *ctx = calloc(1, sizeof(**ctx));
 536     if (*ctx == NULL) {
 537         krb5_set_error_string(context, "out of memory");
 538         return ENOMEM;
 539     }
 540     (*ctx)->check_pac = (context->flags & KRB5_CTX_F_CHECK_PAC) ? 1 : 0;
 541     return 0;
 542 }
 543
 544 krb5_error_code KRB5_LIB_FUNCTION
 545 krb5_rd_req_in_set_keytab(krb5_context context,
 546                           krb5_rd_req_in_ctx in,
 547                           krb5_keytab keytab)
 548 {
 549     in->keytab = keytab; /* XXX should make copy */
 550     return 0;
 551 }
 552
 553 /**
 554  * Set if krb5_rq_red() is going to check the Windows PAC or not
 555  *
 556  * @param context Keberos 5 context.
 557  * @param in krb5_rd_req_in_ctx to check the option on.
 558  * @param flag flag to select if to check the pac (TRUE) or not (FALSE).
 559  *
 560  * @return Kerberos 5 error code, see krb5_get_error_message().
 561  *
 562  * @ingroup krb5
 563  */
 564
 565 krb5_error_code KRB5_LIB_FUNCTION
 566 krb5_rd_req_in_set_pac_check(krb5_context context,
 567                              krb5_rd_req_in_ctx in,
 568                              krb5_boolean flag)
 569 {
 570     in->check_pac = flag;
 571     return 0;
 572 }
 573
 574
 575 krb5_error_code KRB5_LIB_FUNCTION
 576 krb5_rd_req_in_set_keyblock(krb5_context context,
 577                             krb5_rd_req_in_ctx in,
 578                             krb5_keyblock *keyblock)
 579 {
 580     in->keyblock = keyblock; /* XXX should make copy */
 581     return 0;
 582 }
 583
 584 krb5_error_code KRB5_LIB_FUNCTION
 585 krb5_rd_req_out_get_ap_req_options(krb5_context context,
 586                                    krb5_rd_req_out_ctx out,
 587                                    krb5_flags *ap_req_options)
 588 {
 589     *ap_req_options = out->ap_req_options;
 590     return 0;
 591 }
 592
 593 krb5_error_code KRB5_LIB_FUNCTION
 594 krb5_rd_req_out_get_ticket(krb5_context context,
 595                             krb5_rd_req_out_ctx out,
 596                             krb5_ticket **ticket)
 597 {
 598     return krb5_copy_ticket(context, out->ticket, ticket);
 599 }
 600
 601 krb5_error_code KRB5_LIB_FUNCTION
 602 krb5_rd_req_out_get_keyblock(krb5_context context,
 603                             krb5_rd_req_out_ctx out,
 604                             krb5_keyblock **keyblock)
 605 {
 606     return krb5_copy_keyblock(context, out->keyblock, keyblock);
 607 }
 608
 609 void  KRB5_LIB_FUNCTION
 610 krb5_rd_req_in_ctx_free(krb5_context context, krb5_rd_req_in_ctx ctx)
 611 {
 612     free(ctx);
 613 }
 614
 615 krb5_error_code KRB5_LIB_FUNCTION
 616 _krb5_rd_req_out_ctx_alloc(krb5_context context, krb5_rd_req_out_ctx *ctx)
 617 {
 618     *ctx = calloc(1, sizeof(**ctx));
 619     if (*ctx == NULL) {
 620         krb5_set_error_string(context, "out of memory");
 621         return ENOMEM;
 622     }
 623     return 0;
 624 }
 625
 626 void  KRB5_LIB_FUNCTION
 627 krb5_rd_req_out_ctx_free(krb5_context context, krb5_rd_req_out_ctx ctx)
 628 {
 629     krb5_free_keyblock(context, ctx->keyblock);
 630     free(ctx);
 631 }
 632
 633 /*
 634  *
 635  */
 636
 637 krb5_error_code KRB5_LIB_FUNCTION
 638 krb5_rd_req(krb5_context context,
 639             krb5_auth_context *auth_context,
 640             const krb5_data *inbuf,
 641             krb5_const_principal server,
 642             krb5_keytab keytab,
 643             krb5_flags *ap_req_options,
 644             krb5_ticket **ticket)
 645 {
 646     krb5_error_code ret;
 647     krb5_rd_req_in_ctx in;
 648     krb5_rd_req_out_ctx out;
 649
 650     ret = krb5_rd_req_in_ctx_alloc(context, &in);
 651     if (ret)
 652         return ret;
 653
 654     ret = krb5_rd_req_in_set_keytab(context, in, keytab);
 655     if (ret) {
 656         krb5_rd_req_in_ctx_free(context, in);
 657         return ret;
 658     }
 659
 660     ret = krb5_rd_req_ctx(context, auth_context, inbuf, server, in, &out);
 661     krb5_rd_req_in_ctx_free(context, in);
 662     if (ret)
 663         return ret;
 664
 665     if (ap_req_options)
 666         *ap_req_options = out->ap_req_options;
 667     if (ticket) {
 668         ret = krb5_copy_ticket(context, out->ticket, ticket);
 669         if (ret)
 670             goto out;
 671     }
 672
 673 out:
 674     krb5_rd_req_out_ctx_free(context, out);
 675     return ret;
 676 }
 677
 678 /*
 679  *
 680  */
 681
 682 krb5_error_code KRB5_LIB_FUNCTION
 683 krb5_rd_req_with_keyblock(krb5_context context,
 684                           krb5_auth_context *auth_context,
 685                           const krb5_data *inbuf,
 686                           krb5_const_principal server,
 687                           krb5_keyblock *keyblock,
 688                           krb5_flags *ap_req_options,
 689                           krb5_ticket **ticket)
 690 {
 691     krb5_error_code ret;
 692     krb5_rd_req_in_ctx in;
 693     krb5_rd_req_out_ctx out;
 694
 695     ret = krb5_rd_req_in_ctx_alloc(context, &in);
 696     if (ret)
 697         return ret;
 698
 699     ret = krb5_rd_req_in_set_keyblock(context, in, keyblock);
 700     if (ret) {
 701         krb5_rd_req_in_ctx_free(context, in);
 702         return ret;
 703     }
 704
 705     ret = krb5_rd_req_ctx(context, auth_context, inbuf, server, in, &out);
 706     krb5_rd_req_in_ctx_free(context, in);
 707     if (ret)
 708         return ret;
 709
 710     if (ap_req_options)
 711         *ap_req_options = out->ap_req_options;
 712     if (ticket) {
 713         ret = krb5_copy_ticket(context, out->ticket, ticket);
 714         if (ret)
 715             goto out;
 716     }
 717
 718 out:
 719     krb5_rd_req_out_ctx_free(context, out);
 720     return ret;
 721 }
 722
 723 /*
 724  *
 725  */
 726
 727 static krb5_error_code
 728 get_key_from_keytab(krb5_context context,
 729                     krb5_auth_context *auth_context,
 730                     krb5_ap_req *ap_req,
 731                     krb5_const_principal server,
 732                     krb5_keytab keytab,
 733                     krb5_keyblock **out_key)
 734 {
 735     krb5_keytab_entry entry;
 736     krb5_error_code ret;
 737     int kvno;
 738     krb5_keytab real_keytab;
 739
 740     if(keytab == NULL)
 741         krb5_kt_default(context, &real_keytab);
 742     else
 743         real_keytab = keytab;
 744
 745     if (ap_req->ticket.enc_part.kvno)
 746         kvno = *ap_req->ticket.enc_part.kvno;
 747     else
 748         kvno = 0;
 749
 750     ret = krb5_kt_get_entry (context,
 751                              real_keytab,
 752                              server,
 753                              kvno,
 754                              ap_req->ticket.enc_part.etype,
 755                              &entry);
 756     if(ret)
 757         goto out;
 758     ret = krb5_copy_keyblock(context, &entry.keyblock, out_key);
 759     krb5_kt_free_entry (context, &entry);
 760 out:
 761     if(keytab == NULL)
 762         krb5_kt_close(context, real_keytab);
 763
 764     return ret;
 765 }
 766
 767 /*
 768  *
 769  */
 770
 771 krb5_error_code KRB5_LIB_FUNCTION
 772 krb5_rd_req_ctx(krb5_context context,
 773                 krb5_auth_context *auth_context,
 774                 const krb5_data *inbuf,
 775                 krb5_const_principal server,
 776                 krb5_rd_req_in_ctx inctx,
 777                 krb5_rd_req_out_ctx *outctx)
 778 {
 779     krb5_error_code ret;
 780     krb5_ap_req ap_req;
 781     krb5_principal service = NULL;
 782     krb5_rd_req_out_ctx o = NULL;
 783
 784     ret = _krb5_rd_req_out_ctx_alloc(context, &o);
 785     if (ret)
 786         goto out;
 787
 788     if (*auth_context == NULL) {
 789         ret = krb5_auth_con_init(context, auth_context);
 790         if (ret)
 791             goto out;
 792     }
 793
 794     ret = krb5_decode_ap_req(context, inbuf, &ap_req);
 795     if(ret)
 796         goto out;
 797
 798     if(server == NULL){
 799         ret = _krb5_principalname2krb5_principal(context,
 800                                                  &service,
 801                                                  ap_req.ticket.sname,
 802                                                  ap_req.ticket.realm);
 803         if (ret)
 804             goto out;
 805         server = service;
 806     }
 807     if (ap_req.ap_options.use_session_key &&
 808         (*auth_context)->keyblock == NULL) {
 809         krb5_set_error_string(context, "krb5_rd_req: user to user auth "
 810                               "without session key given");
 811         ret = KRB5KRB_AP_ERR_NOKEY;
 812         goto out;
 813     }
 814
 815     if((*auth_context)->keyblock){
 816         ret = krb5_copy_keyblock(context,
 817                                  (*auth_context)->keyblock,
 818                                  &o->keyblock);
 819         if (ret)
 820             goto out;
 821     } else if(inctx->keyblock){
 822         ret = krb5_copy_keyblock(context,
 823                                  inctx->keyblock,
 824                                  &o->keyblock);
 825         if (ret)
 826             goto out;
 827     } else {
 828         krb5_keytab keytab = NULL;
 829
 830         if (inctx && inctx->keytab)
 831             keytab = inctx->keytab;
 832
 833         ret = get_key_from_keytab(context,
 834                                   auth_context,
 835                                   &ap_req,
 836                                   server,
 837                                   keytab,
 838                                   &o->keyblock);
 839         if(ret)
 840             goto out;
 841     }
 842
 843     ret = krb5_verify_ap_req2(context,
 844                               auth_context,
 845                               &ap_req,
 846                               server,
 847                               o->keyblock,
 848                               0,
 849                               &o->ap_req_options,
 850                               &o->ticket,
 851                               KRB5_KU_AP_REQ_AUTH);
 852
 853     if (ret)
 854         goto out;
 855
 856     /* If there is a PAC, verify its server signature */
 857     if (inctx->check_pac) {
 858         krb5_pac pac;
 859         krb5_data data;
 860
 861         ret = krb5_ticket_get_authorization_data_type(context,
 862                                                       o->ticket,
 863                                                       KRB5_AUTHDATA_WIN2K_PAC,
 864                                                       &data);
 865         if (ret == 0) {
 866             ret = krb5_pac_parse(context, data.data, data.length, &pac);
 867             krb5_data_free(&data);
 868             if (ret)
 869                 goto out;
 870
 871             ret = krb5_pac_verify(context,
 872                                   pac,
 873                                   o->ticket->ticket.authtime,
 874                                   o->ticket->client,
 875                                   o->keyblock,
 876                                   NULL);
 877             krb5_pac_free(context, pac);
 878             if (ret)
 879                 goto out;
 880         }
 881         ret = 0;
 882     }
 883 out:
 884     if (ret || outctx == NULL) {
 885         krb5_rd_req_out_ctx_free(context, o);
 886     } else
 887         *outctx = o;
 888
 889     free_AP_REQ(&ap_req);
 890     if(service)
 891         krb5_free_principal(context, service);
 892     return ret;
 893 }