lib/krb5_wrap/krb5_samba.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #ifndef _KRB5_SAMBA_H
  24 #define _KRB5_SAMBA_H
  25
  26 #include "lib/util/data_blob.h"
  27 #include "libcli/util/ntstatus.h"
  28 #include "lib/util/talloc_stack.h"
  29 #include "lib/util/debug.h"
  30
  31 #ifdef HAVE_KRB5
  32
  33 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  34 /* this file uses DEPRECATED interfaces! */
  35
  36 #ifdef KRB5_DEPRECATED
  37 #undef KRB5_DEPRECATED
  38 #endif
  39
  40 #if defined(HAVE_KRB5_DEPRECATED_WITH_IDENTIFIER)
  41 #define KRB5_DEPRECATED 1
  42 #else
  43 #define KRB5_DEPRECATED
  44 #endif
  45
  46 #include "system/kerberos.h"
  47 #include "system/network.h"
  48
  49 #ifndef KRB5_ADDR_NETBIOS
  50 #define KRB5_ADDR_NETBIOS 0x14
  51 #endif
  52
  53 #ifndef KRB5KRB_ERR_RESPONSE_TOO_BIG
  54 #define KRB5KRB_ERR_RESPONSE_TOO_BIG (-1765328332L)
  55 #endif
  56
  57 /* Heimdal uses a slightly different name */
  58 #if defined(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5) && !defined(HAVE_ENCTYPE_ARCFOUR_HMAC)
  59 #define ENCTYPE_ARCFOUR_HMAC ENCTYPE_ARCFOUR_HMAC_MD5
  60 #endif
  61 #if defined(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5_56) && !defined(HAVE_ENCTYPE_ARCFOUR_HMAC_EXP)
  62 #define ENCTYPE_ARCFOUR_HMAC_EXP ENCTYPE_ARCFOUR_HMAC_MD5_56
  63 #endif
  64
  65 /* The older versions of heimdal that don't have this
  66    define don't seem to use it anyway.  I'm told they
  67    always use a subkey */
  68 #ifndef HAVE_AP_OPTS_USE_SUBKEY
  69 #define AP_OPTS_USE_SUBKEY 0
  70 #endif
  71
  72 #ifndef KRB5_PW_SALT
  73 #define KRB5_PW_SALT 3
  74 #endif
  75
  76 /* CKSUMTYPE_HMAC_MD5 in Heimdal
  77    CKSUMTYPE_HMAC_MD5_ARCFOUR in MIT */
  78 #if defined(CKSUMTYPE_HMAC_MD5_ARCFOUR) && !defined(CKSUMTYPE_HMAC_MD5)
  79 #define CKSUMTYPE_HMAC_MD5 CKSUMTYPE_HMAC_MD5_ARCFOUR
  80 #endif
  81
  82 /*
  83  * CKSUMTYPE_HMAC_SHA1_96_AES_* in Heimdal
  84  * CKSUMTYPE_HMAC_SHA1_96_AES* in MIT
  85  */
  86 #if defined(CKSUMTYPE_HMAC_SHA1_96_AES128) && !defined(CKSUMTYPE_HMAC_SHA1_96_AES_128)
  87 #define CKSUMTYPE_HMAC_SHA1_96_AES_128 CKSUMTYPE_HMAC_SHA1_96_AES128
  88 #endif
  89 #if defined(CKSUMTYPE_HMAC_SHA1_96_AES256) && !defined(CKSUMTYPE_HMAC_SHA1_96_AES_256)
  90 #define CKSUMTYPE_HMAC_SHA1_96_AES_256 CKSUMTYPE_HMAC_SHA1_96_AES256
  91 #endif
  92
  93 /*
  94  * RFC8009 encryption types' defines have different names:
  95  *
  96  * KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128 in Heimdal
  97  * ENCTYPE_AES128_CTS_HMAC_SHA256_128 in MIT
  98  *
  99  * and
 100  *
 101  * KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192 in Heimdal
 102  * ENCTYPE_AES256_CTS_HMAC_SHA384_192 in MIT
 103  */
 104 #if !defined(ENCTYPE_AES128_CTS_HMAC_SHA256_128)
 105 #define ENCTYPE_AES128_CTS_HMAC_SHA256_128 KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128
 106 #endif
 107 #if !defined(ENCTYPE_AES256_CTS_HMAC_SHA384_192)
 108 #define ENCTYPE_AES256_CTS_HMAC_SHA384_192 KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192
 109 #endif
 110
 111 /*
 112  * Same for older encryption types, rename to have the same defines
 113  */
 114 #if !defined(ENCTYPE_AES128_CTS_HMAC_SHA1_96)
 115 #define ENCTYPE_AES128_CTS_HMAC_SHA1_96 KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96
 116 #endif
 117 #if !defined(ENCTYPE_AES256_CTS_HMAC_SHA1_96)
 118 #define ENCTYPE_AES256_CTS_HMAC_SHA1_96 KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96
 119 #endif
 120
 121 /*
 122  * KRB5_KU_OTHER_ENCRYPTED in Heimdal
 123  * KRB5_KEYUSAGE_APP_DATA_ENCRYPT in MIT
 124  */
 125 #if defined(KRB5_KEYUSAGE_APP_DATA_ENCRYPT) && !defined(KRB5_KU_OTHER_ENCRYPTED)
 126 #define KRB5_KU_OTHER_ENCRYPTED KRB5_KEYUSAGE_APP_DATA_ENCRYPT
 127 #endif
 128
 129 typedef struct {
 130 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
 131         krb5_address **addrs;
 132 #elif defined(HAVE_KRB5_ADDRESSES) /* Heimdal */
 133         krb5_addresses *addrs;
 134 #else
 135 #error UNKNOWN_KRB5_ADDRESS_TYPE
 136 #endif /* defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) */
 137 } smb_krb5_addresses;
 138
 139 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
 140 #define KRB5_KT_KEY(k)          (&(k)->key)
 141 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)  /* Heimdal */
 142 #define KRB5_KT_KEY(k)          (&(k)->keyblock)
 143 #else
 144 #error krb5_keytab_entry has no key or keyblock member
 145 #endif /* HAVE_KRB5_KEYTAB_ENTRY_KEY */
 146
 147 /* work around broken krb5.h on sles9 */
 148 #ifdef SIZEOF_LONG
 149 #undef SIZEOF_LONG
 150 #endif
 151
 152 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
 153 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
 154 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
 155 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
 156 #define KRB5_KEY_DATA_CAST      void
 157 #else /* MIT */
 158 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
 159 #define KRB5_KEY_LENGTH(k)      ((k)->length)
 160 #define KRB5_KEY_DATA(k)        ((k)->contents)
 161 #define KRB5_KEY_DATA_CAST      krb5_octet
 162 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
 163
 164 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
 165 #define KRB5_ERROR_CODE(k)      ((k)->error_code)
 166 #else /* MIT */
 167 #define KRB5_ERROR_CODE(k)      ((k)->error)
 168 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 169
 170 #ifndef HAVE_KRB5_CONST_PAC
 171 #ifdef KRB5_CONST_PAC_GET_BUFFER
 172 typedef const struct krb5_pac_data *krb5_const_pac;
 173 #else
 174 /*
 175  * Certain Heimdal versions include a version of krb5_pac_get_buffer() that is
 176  * unusable in certain cases, taking a krb5_pac when a krb5_const_pac may be all
 177  * that we can supply. Furthermore, MIT Kerberos doesn't declare krb5_const_pac
 178  * at all. In such cases, we must declare krb5_const_pac as a non-const typedef
 179  * so that the build can succeed.
 180  */
 181 typedef struct krb5_pac_data *krb5_const_pac;
 182 #endif
 183 #endif
 184
 185 krb5_error_code smb_krb5_parse_name(krb5_context context,
 186                                 const char *name, /* in unix charset */
 187                                 krb5_principal *principal);
 188
 189 krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
 190                                       krb5_context context,
 191                                       krb5_const_principal principal,
 192                                       char **unix_name);
 193
 194 static inline void samba_trace_keytab_entry(krb5_context context,
 195                               krb5_keytab_entry kt_entry,
 196                               const char *func,
 197                               int line,
 198                               const char *op)
 199 {
 200         char *princ_s = NULL;
 201 #define MAX_KEYLEN 64
 202         char tmp[2 * MAX_KEYLEN + 1] = { 0, };
 203         krb5_enctype enctype = 0;
 204         krb5_keyblock *key = NULL;
 205         TALLOC_CTX *frame = talloc_stackframe();
 206         krb5_error_code code;
 207         const uint8_t *ptr = NULL;
 208         unsigned len, i;
 209
 210         code = smb_krb5_unparse_name(frame,
 211                                      context,
 212                                      kt_entry.principal,
 213                                      &princ_s);
 214         if (code != 0) {
 215                 goto out;
 216         }
 217         enctype = KRB5_KEY_TYPE(KRB5_KT_KEY(&kt_entry));
 218         key = KRB5_KT_KEY(&kt_entry);
 219 #ifdef DEBUG_PASSWORD
 220         ptr = (const uint8_t *) KRB5_KEY_DATA(key);
 221         len = KRB5_KEY_LENGTH(key);
 222
 223         for (i = 0; i < len && i < MAX_KEYLEN; i++) {
 224                 snprintf(&tmp[2 * i], 3, "%02X", ptr[i]);
 225         }
 226 #else
 227         tmp[0] = 0;
 228 #endif
 229         DEBUG(10,("KEYTAB_TRACE %36s:%-4d %3s %78s %3d %2d %s\n",
 230                   func,
 231                   line,
 232                   op,
 233                   princ_s,
 234                   kt_entry.vno,
 235                   enctype,
 236                   tmp));
 237 out:
 238         TALLOC_FREE(frame);
 239 }
 240
 241 #if defined(__GNUC__) && defined(DEVELOPER)
 242 /* http://gcc.gnu.org/onlinedocs/gcc/Statement-Exprs.html */
 243
 244 #define samba_krb5_kt_add_entry(context, id, entry)                          \
 245         ({                                                                   \
 246                 krb5_error_code _code;                                       \
 247                 _code = krb5_kt_add_entry((context), (id), (entry));         \
 248                 if (CHECK_DEBUGLVL(10)) {                                    \
 249                         samba_trace_keytab_entry((context),                  \
 250                                                  *(entry),                   \
 251                                                  __func__,                   \
 252                                                  __LINE__,                   \
 253                                                  _code == 0 ? "add"          \
 254                                                             : "add FAILED"); \
 255                 }                                                            \
 256                 _code;                                                       \
 257         })
 258
 259 #define samba_krb5_kt_remove_entry(context, id, entry)                       \
 260         ({                                                                   \
 261                 krb5_error_code _code;                                       \
 262                 _code = krb5_kt_remove_entry((context), (id), (entry));      \
 263                 if (CHECK_DEBUGLVL(10)) {                                    \
 264                         samba_trace_keytab_entry((context),                  \
 265                                                  *(entry),                   \
 266                                                  __func__,                   \
 267                                                  __LINE__,                   \
 268                                                  _code == 0 ? "rem"          \
 269                                                             : "rem FAILED"); \
 270                 }                                                            \
 271                 _code;                                                       \
 272         })
 273
 274 #define samba_krb5_kt_next_entry(context, id, entry, cursor) \
 275         ({                                                   \
 276                 krb5_error_code _code;                       \
 277                 _code = krb5_kt_next_entry((context),        \
 278                                            (id),             \
 279                                            (entry),          \
 280                                            (cursor));        \
 281                 if (_code == 0 && CHECK_DEBUGLVL(10)) {      \
 282                         samba_trace_keytab_entry((context),  \
 283                                                  *(entry),   \
 284                                                  __func__,   \
 285                                                  __LINE__,   \
 286                                                  "nxt");     \
 287                 }                                            \
 288                 _code;                                       \
 289         })
 290
 291 #else
 292
 293 #define samba_krb5_kt_add_entry(context, id, entry) \
 294         krb5_kt_add_entry((context), (id), (entry))
 295 #define samba_krb5_kt_remove_entry(context, id, entry) \
 296         krb5_kt_remove_entry((context), (id), (entry))
 297 #define samba_krb5_kt_next_entry(context, id, entry, cursor) \
 298         krb5_kt_next_entry((context), (id), (entry), (cursor))
 299
 300 #endif
 301
 302 krb5_error_code smb_krb5_init_context_common(krb5_context *_krb5_context);
 303
 304 /*
 305  * This should only be used in code that
 306  * really wants to touch the global default ccache!
 307  */
 308 krb5_error_code smb_force_krb5_cc_default(krb5_context ctx, krb5_ccache *id);
 309 /*
 310  * This should only be used in code that
 311  * really wants to touch the global default ccache!
 312  */
 313 const char *smb_force_krb5_cc_default_name(krb5_context ctx);
 314
 315 krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc);
 316
 317 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 318 krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context, krb5_auth_context auth_context, krb5_keyblock *keyblock);
 319 #endif
 320
 321 #ifndef HAVE_KRB5_FREE_UNPARSED_NAME
 322 void krb5_free_unparsed_name(krb5_context ctx, char *val);
 323 #endif
 324
 325 #if !defined(HAVE_KRB5_FREE_ENCTYPES)
 326 void krb5_free_enctypes(krb5_context context, krb5_enctype *val);
 327 #endif
 328
 329 #if !defined(HAVE_KRB5_FREE_STRING)
 330 void krb5_free_string(krb5_context context, char *val);
 331 #endif
 332
 333 /* Stub out initialize_krb5_error_table since it is not present in all
 334  * Kerberos implementations. If it's not present, it's not necessary to
 335  * call it.
 336  */
 337 #ifndef HAVE_INITIALIZE_KRB5_ERROR_TABLE
 338 #define initialize_krb5_error_table()
 339 #endif
 340
 341 /* Samba wrapper functions for krb5 functionality. */
 342 bool smb_krb5_sockaddr_to_kaddr(struct sockaddr_storage *paddr,
 343                                 krb5_address *pkaddr);
 344
 345 krb5_error_code smb_krb5_mk_error(krb5_context context,
 346                                   krb5_error_code error_code,
 347                                   const char *e_text,
 348                                   krb5_data *e_data,
 349                                   const krb5_principal client,
 350                                   const krb5_principal server,
 351                                   krb5_data *enc_err);
 352
 353 krb5_error_code smb_krb5_get_allowed_etypes(krb5_context context,
 354                                             krb5_enctype **enctypes);
 355
 356 bool smb_krb5_get_smb_session_key(TALLOC_CTX *mem_ctx,
 357                                   krb5_context context,
 358                                   krb5_auth_context auth_context,
 359                                   DATA_BLOB *session_key,
 360                                   bool remote);
 361
 362 krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
 363 void smb_krb5_free_data_contents(krb5_context context, krb5_data *pdata);
 364 krb5_error_code smb_krb5_renew_ticket(const char *ccache_string, const char *client_string, const char *service_string, time_t *expire_time);
 365 krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr,
 366                                                   const char *netbios_name);
 367 krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr);
 368 krb5_enctype smb_krb5_kt_get_enctype_from_entry(krb5_keytab_entry *kt_entry);
 369
 370 krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
 371                                             krb5_enctype enctype,
 372                                             char **etype_s);
 373 krb5_error_code smb_krb5_kt_open_relative(krb5_context context,
 374                                           const char *keytab_name_req,
 375                                           bool write_access,
 376                                           krb5_keytab *keytab);
 377 krb5_error_code smb_krb5_kt_open(krb5_context context,
 378                                  const char *keytab_name,
 379                                  bool write_access,
 380                                  krb5_keytab *keytab);
 381 krb5_error_code smb_krb5_kt_get_name(TALLOC_CTX *mem_ctx,
 382                                      krb5_context context,
 383                                      krb5_keytab keytab,
 384                                      const char **keytab_name);
 385 krb5_error_code smb_krb5_kt_seek_and_delete_old_entries(krb5_context context,
 386                                                         krb5_keytab keytab,
 387                                                         bool keep_old_kvno,
 388                                                         krb5_kvno kvno,
 389                                                         bool enctype_only,
 390                                                         krb5_enctype enctype,
 391                                                         const char *princ_s,
 392                                                         krb5_principal princ,
 393                                                         bool flush);
 394
 395 krb5_error_code smb_krb5_get_credentials(krb5_context context,
 396                                          krb5_ccache ccache,
 397                                          krb5_principal me,
 398                                          krb5_principal server,
 399                                          krb5_principal impersonate_princ,
 400                                          krb5_creds **out_creds);
 401 krb5_error_code smb_krb5_keyblock_init_contents(krb5_context context,
 402                                                 krb5_enctype enctype,
 403                                                 const void *data,
 404                                                 size_t length,
 405                                                 krb5_keyblock *key);
 406 krb5_error_code smb_krb5_kinit_keyblock_ccache(krb5_context ctx,
 407                                                krb5_ccache cc,
 408                                                krb5_principal principal,
 409                                                krb5_keyblock *keyblock,
 410                                                const char *target_service,
 411                                                krb5_get_init_creds_opt *krb_options,
 412                                                time_t *expire_time,
 413                                                time_t *kdc_time);
 414 krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
 415                                                krb5_ccache cc,
 416                                                krb5_principal principal,
 417                                                const char *password,
 418                                                const char *target_service,
 419                                                krb5_get_init_creds_opt *krb_options,
 420                                                time_t *expire_time,
 421                                                time_t *kdc_time);
 422 krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
 423                                            krb5_ccache store_cc,
 424                                            krb5_principal init_principal,
 425                                            const char *init_password,
 426                                            krb5_principal impersonate_principal,
 427                                            const char *self_service,
 428                                            const char *target_service,
 429                                            krb5_get_init_creds_opt *krb_options,
 430                                            time_t *expire_time,
 431                                            time_t *kdc_time);
 432
 433 #if defined(HAVE_KRB5_MAKE_PRINCIPAL)
 434 #define smb_krb5_make_principal krb5_make_principal
 435 #elif defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
 436 krb5_error_code smb_krb5_make_principal(krb5_context context,
 437                                         krb5_principal *principal,
 438                                         const char *realm, ...);
 439 #else
 440 #error krb5_make_principal not available
 441 #endif
 442
 443 #if defined(HAVE_KRB5_CC_GET_LIFETIME)
 444 #define smb_krb5_cc_get_lifetime krb5_cc_get_lifetime
 445 #elif defined(HAVE_KRB5_CC_RETRIEVE_CRED)
 446 krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context,
 447                                          krb5_ccache id,
 448                                          time_t *t);
 449 #else
 450 #error krb5_cc_get_lifetime not available
 451 #endif
 452
 453 #if defined(HAVE_KRB5_FREE_CHECKSUM_CONTENTS)
 454 #define smb_krb5_free_checksum_contents krb5_free_checksum_contents
 455 #elif defined (HAVE_FREE_CHECKSUM)
 456 void smb_krb5_free_checksum_contents(krb5_context ctx, krb5_checksum *cksum);
 457 #else
 458 #error krb5_free_checksum_contents/free_Checksum is not available
 459 #endif
 460
 461 krb5_error_code smb_krb5_make_pac_checksum(TALLOC_CTX *mem_ctx,
 462                                            DATA_BLOB *pac_data,
 463                                            krb5_context context,
 464                                            const krb5_keyblock *keyblock,
 465                                            uint32_t *sig_type,
 466                                            DATA_BLOB *sig_blob);
 467
 468 char *smb_krb5_principal_get_realm(TALLOC_CTX *mem_ctx,
 469                                    krb5_context context,
 470                                    krb5_const_principal principal);
 471
 472 void smb_krb5_principal_set_type(krb5_context context,
 473                                  krb5_principal principal,
 474                                  int type);
 475
 476 int smb_krb5_principal_is_tgs(krb5_context context,
 477                               krb5_const_principal principal);
 478
 479 krb5_error_code smb_krb5_principal_set_realm(krb5_context context,
 480                                              krb5_principal principal,
 481                                              const char *realm);
 482
 483 char *smb_krb5_get_realm_from_hostname(TALLOC_CTX *mem_ctx,
 484                                        const char *hostname,
 485                                        const char *client_realm);
 486
 487 char *smb_get_krb5_error_message(krb5_context context,
 488                                  krb5_error_code code,
 489                                  TALLOC_CTX *mem_ctx);
 490
 491 #if defined(HAVE_KRB5_KT_COMPARE)
 492 #define smb_krb5_kt_compare krb5_kt_compare
 493 #else
 494 krb5_boolean smb_krb5_kt_compare(krb5_context context,
 495                                  krb5_keytab_entry *entry,
 496                                  krb5_const_principal principal,
 497                                  krb5_kvno vno,
 498                                  krb5_enctype enctype);
 499 #endif
 500
 501 const krb5_enctype *samba_all_enctypes(void);
 502
 503 uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum);
 504 krb5_enctype ms_suptype_to_ietf_enctype(uint32_t enctype_bitmap);
 505 krb5_error_code ms_suptypes_to_ietf_enctypes(TALLOC_CTX *mem_ctx,
 506                                              uint32_t enctype_bitmap,
 507                                              krb5_enctype **enctypes);
 508 int smb_krb5_get_pw_salt(krb5_context context,
 509                          krb5_const_principal host_princ,
 510                          krb5_data *psalt);
 511 int smb_krb5_salt_principal(krb5_context krb5_ctx,
 512                             const char *realm,
 513                             const char *sAMAccountName,
 514                             const char *userPrincipalName,
 515                             uint32_t uac_flags,
 516                             krb5_principal *salt_princ);
 517
 518 int smb_krb5_salt_principal_str(const char *realm,
 519                                 const char *sAMAccountName,
 520                                 const char *userPrincipalName,
 521                                 uint32_t uac_flags,
 522                                 TALLOC_CTX *mem_ctx,
 523                                 char **_salt_principal);
 524 int smb_krb5_salt_principal2data(krb5_context context,
 525                                  const char *salt_principal,
 526                                  TALLOC_CTX *mem_ctx,
 527                                  char **_salt_data);
 528
 529 int smb_krb5_create_key_from_string(krb5_context context,
 530                                     krb5_const_principal host_princ,
 531                                     const krb5_data *salt,
 532                                     const krb5_data *password,
 533                                     krb5_enctype enctype,
 534                                     krb5_keyblock *key);
 535
 536 #ifndef krb5_princ_size
 537 #if defined(HAVE_KRB5_PRINCIPAL_GET_NUM_COMP)
 538 #define krb5_princ_size krb5_principal_get_num_comp
 539 #else
 540 #error krb5_princ_size unavailable
 541 #endif
 542 #endif
 543
 544 krb5_error_code smb_krb5_principal_get_comp_string(TALLOC_CTX *mem_ctx,
 545                                                    krb5_context context,
 546                                                    krb5_const_principal principal,
 547                                                    unsigned int component,
 548                                                    char **out);
 549
 550 krb5_error_code smb_krb5_copy_data_contents(krb5_data *p,
 551                                             const void *data,
 552                                             size_t len);
 553
 554 krb5_data smb_krb5_make_data(void *data,
 555                              size_t len);
 556
 557 krb5_data smb_krb5_data_from_blob(DATA_BLOB blob);
 558
 559 int smb_krb5_principal_get_type(krb5_context context,
 560                                 krb5_const_principal principal);
 561
 562 #if !defined(HAVE_KRB5_WARNX)
 563 krb5_error_code krb5_warnx(krb5_context context, const char *fmt, ...)
 564         PRINTF_ATTRIBUTE(2, 0);
 565 #endif
 566
 567 krb5_error_code smb_krb5_cc_new_unique_memory(krb5_context context,
 568                                               TALLOC_CTX *mem_ctx,
 569                                               char **ccache_name,
 570                                               krb5_ccache *id);
 571
 572 krb5_error_code smb_krb5_cc_copy_creds(krb5_context context,
 573                                        krb5_ccache incc, krb5_ccache outcc);
 574
 575 #endif /* HAVE_KRB5 */
 576
 577 int ads_krb5_cli_get_ticket(TALLOC_CTX *mem_ctx,
 578                             const char *principal,
 579                             time_t time_offset,
 580                             DATA_BLOB *ticket,
 581                             DATA_BLOB *session_key_krb5,
 582                             uint32_t extra_ap_opts, const char *ccname,
 583                             time_t *tgs_expire,
 584                             const char *impersonate_princ_s);
 585
 586 NTSTATUS krb5_to_nt_status(krb5_error_code kerberos_error);
 587 krb5_error_code nt_status_to_krb5(NTSTATUS nt_status);
 588
 589 #endif /* _KRB5_SAMBA_H */