lib/krb5_wrap/krb5_samba.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5 routines for active directory
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Luke Howard 2002-2003
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Guenther Deschner 2005-2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #ifndef _KRB5_SAMBA_H
  24 #define _KRB5_SAMBA_H
  25
  26 #include "lib/util/data_blob.h"
  27 #include "libcli/util/ntstatus.h"
  28
  29 #ifdef HAVE_KRB5
  30
  31 #define KRB5_PRIVATE    1       /* this file uses PRIVATE interfaces! */
  32 /* this file uses DEPRECATED interfaces! */
  33
  34 #ifdef KRB5_DEPRECATED
  35 #undef KRB5_DEPRECATED
  36 #endif
  37
  38 #if defined(HAVE_KRB5_DEPRECATED_WITH_IDENTIFIER)
  39 #define KRB5_DEPRECATED 1
  40 #else
  41 #define KRB5_DEPRECATED
  42 #endif
  43
  44 #include "system/kerberos.h"
  45 #include "system/network.h"
  46
  47 #ifndef KRB5_ADDR_NETBIOS
  48 #define KRB5_ADDR_NETBIOS 0x14
  49 #endif
  50
  51 #ifndef KRB5KRB_ERR_RESPONSE_TOO_BIG
  52 #define KRB5KRB_ERR_RESPONSE_TOO_BIG (-1765328332L)
  53 #endif
  54
  55 /* Heimdal uses a slightly different name */
  56 #if defined(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5) && !defined(HAVE_ENCTYPE_ARCFOUR_HMAC)
  57 #define ENCTYPE_ARCFOUR_HMAC ENCTYPE_ARCFOUR_HMAC_MD5
  58 #endif
  59 #if defined(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5_56) && !defined(HAVE_ENCTYPE_ARCFOUR_HMAC_EXP)
  60 #define ENCTYPE_ARCFOUR_HMAC_EXP ENCTYPE_ARCFOUR_HMAC_MD5_56
  61 #endif
  62
  63 /* The older versions of heimdal that don't have this
  64    define don't seem to use it anyway.  I'm told they
  65    always use a subkey */
  66 #ifndef HAVE_AP_OPTS_USE_SUBKEY
  67 #define AP_OPTS_USE_SUBKEY 0
  68 #endif
  69
  70 #ifndef KRB5_PW_SALT
  71 #define KRB5_PW_SALT 3
  72 #endif
  73
  74 /* CKSUMTYPE_HMAC_MD5 in Heimdal
  75    CKSUMTYPE_HMAC_MD5_ARCFOUR in MIT */
  76 #if defined(CKSUMTYPE_HMAC_MD5_ARCFOUR) && !defined(CKSUMTYPE_HMAC_MD5)
  77 #define CKSUMTYPE_HMAC_MD5 CKSUMTYPE_HMAC_MD5_ARCFOUR
  78 #endif
  79
  80 /*
  81  * CKSUMTYPE_HMAC_SHA1_96_AES_* in Heimdal
  82  * CKSUMTYPE_HMAC_SHA1_96_AES* in MIT
  83  */
  84 #if defined(CKSUMTYPE_HMAC_SHA1_96_AES128) && !defined(CKSUMTYPE_HMAC_SHA1_96_AES_128)
  85 #define CKSUMTYPE_HMAC_SHA1_96_AES_128 CKSUMTYPE_HMAC_SHA1_96_AES128
  86 #endif
  87 #if defined(CKSUMTYPE_HMAC_SHA1_96_AES256) && !defined(CKSUMTYPE_HMAC_SHA1_96_AES_256)
  88 #define CKSUMTYPE_HMAC_SHA1_96_AES_256 CKSUMTYPE_HMAC_SHA1_96_AES256
  89 #endif
  90
  91 /*
  92  * RFC8009 encryption types' defines have different names:
  93  *
  94  * KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128 in Heimdal
  95  * ENCTYPE_AES128_CTS_HMAC_SHA256_128 in MIT
  96  *
  97  * and
  98  *
  99  * KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192 in Heimdal
 100  * ENCTYPE_AES256_CTS_HMAC_SHA384_192 in MIT
 101  */
 102 #if !defined(ENCTYPE_AES128_CTS_HMAC_SHA256_128)
 103 #define ENCTYPE_AES128_CTS_HMAC_SHA256_128 KRB5_ENCTYPE_AES128_CTS_HMAC_SHA256_128
 104 #endif
 105 #if !defined(ENCTYPE_AES256_CTS_HMAC_SHA384_192)
 106 #define ENCTYPE_AES256_CTS_HMAC_SHA384_192 KRB5_ENCTYPE_AES256_CTS_HMAC_SHA384_192
 107 #endif
 108
 109 /*
 110  * Same for older encryption types, rename to have the same defines
 111  */
 112 #if !defined(ENCTYPE_AES128_CTS_HMAC_SHA1_96)
 113 #define ENCTYPE_AES128_CTS_HMAC_SHA1_96 KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96
 114 #endif
 115 #if !defined(ENCTYPE_AES256_CTS_HMAC_SHA1_96)
 116 #define ENCTYPE_AES256_CTS_HMAC_SHA1_96 KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96
 117 #endif
 118
 119 /*
 120  * KRB5_KU_OTHER_ENCRYPTED in Heimdal
 121  * KRB5_KEYUSAGE_APP_DATA_ENCRYPT in MIT
 122  */
 123 #if defined(KRB5_KEYUSAGE_APP_DATA_ENCRYPT) && !defined(KRB5_KU_OTHER_ENCRYPTED)
 124 #define KRB5_KU_OTHER_ENCRYPTED KRB5_KEYUSAGE_APP_DATA_ENCRYPT
 125 #endif
 126
 127 typedef struct {
 128 #if defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) /* MIT */
 129         krb5_address **addrs;
 130 #elif defined(HAVE_KRB5_ADDRESSES) /* Heimdal */
 131         krb5_addresses *addrs;
 132 #else
 133 #error UNKNOWN_KRB5_ADDRESS_TYPE
 134 #endif /* defined(HAVE_MAGIC_IN_KRB5_ADDRESS) && defined(HAVE_ADDRTYPE_IN_KRB5_ADDRESS) */
 135 } smb_krb5_addresses;
 136
 137 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
 138 #define KRB5_KT_KEY(k)          (&(k)->key)
 139 #elif defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)  /* Heimdal */
 140 #define KRB5_KT_KEY(k)          (&(k)->keyblock)
 141 #else
 142 #error krb5_keytab_entry has no key or keyblock member
 143 #endif /* HAVE_KRB5_KEYTAB_ENTRY_KEY */
 144
 145 /* work around broken krb5.h on sles9 */
 146 #ifdef SIZEOF_LONG
 147 #undef SIZEOF_LONG
 148 #endif
 149
 150 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
 151 #define KRB5_KEY_TYPE(k)        ((k)->keytype)
 152 #define KRB5_KEY_LENGTH(k)      ((k)->keyvalue.length)
 153 #define KRB5_KEY_DATA(k)        ((k)->keyvalue.data)
 154 #define KRB5_KEY_DATA_CAST      void
 155 #else /* MIT */
 156 #define KRB5_KEY_TYPE(k)        ((k)->enctype)
 157 #define KRB5_KEY_LENGTH(k)      ((k)->length)
 158 #define KRB5_KEY_DATA(k)        ((k)->contents)
 159 #define KRB5_KEY_DATA_CAST      krb5_octet
 160 #endif /* HAVE_KRB5_KEYBLOCK_KEYVALUE */
 161
 162 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR /* Heimdal */
 163 #define KRB5_ERROR_CODE(k)      ((k)->error_code)
 164 #else /* MIT */
 165 #define KRB5_ERROR_CODE(k)      ((k)->error)
 166 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 167
 168 #ifndef HAVE_KRB5_CONST_PAC
 169 #ifdef KRB5_CONST_PAC_GET_BUFFER
 170 typedef const struct krb5_pac_data *krb5_const_pac;
 171 #else
 172 /*
 173  * Certain Heimdal versions include a version of krb5_pac_get_buffer() that is
 174  * unusable in certain cases, taking a krb5_pac when a krb5_const_pac may be all
 175  * that we can supply. Furthermore, MIT Kerberos doesn't declare krb5_const_pac
 176  * at all. In such cases, we must declare krb5_const_pac as a non-const typedef
 177  * so that the build can succeed.
 178  */
 179 typedef struct krb5_pac_data *krb5_const_pac;
 180 #endif
 181 #endif
 182
 183 krb5_error_code smb_krb5_parse_name(krb5_context context,
 184                                 const char *name, /* in unix charset */
 185                                 krb5_principal *principal);
 186
 187 krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
 188                                       krb5_context context,
 189                                       krb5_const_principal principal,
 190                                       char **unix_name);
 191
 192 krb5_error_code smb_krb5_init_context_common(krb5_context *_krb5_context);
 193
 194 /*
 195  * This should only be used in code that
 196  * really wants to touch the global default ccache!
 197  */
 198 krb5_error_code smb_force_krb5_cc_default(krb5_context ctx, krb5_ccache *id);
 199 /*
 200  * This should only be used in code that
 201  * really wants to touch the global default ccache!
 202  */
 203 const char *smb_force_krb5_cc_default_name(krb5_context ctx);
 204
 205 krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc);
 206
 207 #if defined(HAVE_KRB5_AUTH_CON_SETKEY) && !defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY)
 208 krb5_error_code krb5_auth_con_setuseruserkey(krb5_context context, krb5_auth_context auth_context, krb5_keyblock *keyblock);
 209 #endif
 210
 211 #ifndef HAVE_KRB5_FREE_UNPARSED_NAME
 212 void krb5_free_unparsed_name(krb5_context ctx, char *val);
 213 #endif
 214
 215 #if !defined(HAVE_KRB5_FREE_ENCTYPES)
 216 void krb5_free_enctypes(krb5_context context, krb5_enctype *val);
 217 #endif
 218
 219 #if !defined(HAVE_KRB5_FREE_STRING)
 220 void krb5_free_string(krb5_context context, char *val);
 221 #endif
 222
 223 /* Stub out initialize_krb5_error_table since it is not present in all
 224  * Kerberos implementations. If it's not present, it's not necessary to
 225  * call it.
 226  */
 227 #ifndef HAVE_INITIALIZE_KRB5_ERROR_TABLE
 228 #define initialize_krb5_error_table()
 229 #endif
 230
 231 /* Samba wrapper functions for krb5 functionality. */
 232 bool smb_krb5_sockaddr_to_kaddr(struct sockaddr_storage *paddr,
 233                                 krb5_address *pkaddr);
 234
 235 krb5_error_code smb_krb5_mk_error(krb5_context context,
 236                                   krb5_error_code error_code,
 237                                   const char *e_text,
 238                                   krb5_data *e_data,
 239                                   const krb5_principal client,
 240                                   const krb5_principal server,
 241                                   krb5_data *enc_err);
 242
 243 krb5_error_code smb_krb5_get_allowed_etypes(krb5_context context,
 244                                             krb5_enctype **enctypes);
 245
 246 bool smb_krb5_get_smb_session_key(TALLOC_CTX *mem_ctx,
 247                                   krb5_context context,
 248                                   krb5_auth_context auth_context,
 249                                   DATA_BLOB *session_key,
 250                                   bool remote);
 251
 252 krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
 253 void smb_krb5_free_data_contents(krb5_context context, krb5_data *pdata);
 254 krb5_error_code smb_krb5_renew_ticket(const char *ccache_string, const char *client_string, const char *service_string, time_t *expire_time);
 255 krb5_error_code smb_krb5_gen_netbios_krb5_address(smb_krb5_addresses **kerb_addr,
 256                                                   const char *netbios_name);
 257 krb5_error_code smb_krb5_free_addresses(krb5_context context, smb_krb5_addresses *addr);
 258 krb5_enctype smb_krb5_kt_get_enctype_from_entry(krb5_keytab_entry *kt_entry);
 259
 260 krb5_error_code smb_krb5_enctype_to_string(krb5_context context,
 261                                             krb5_enctype enctype,
 262                                             char **etype_s);
 263 krb5_error_code smb_krb5_kt_open_relative(krb5_context context,
 264                                           const char *keytab_name_req,
 265                                           bool write_access,
 266                                           krb5_keytab *keytab);
 267 krb5_error_code smb_krb5_kt_open(krb5_context context,
 268                                  const char *keytab_name,
 269                                  bool write_access,
 270                                  krb5_keytab *keytab);
 271 krb5_error_code smb_krb5_kt_get_name(TALLOC_CTX *mem_ctx,
 272                                      krb5_context context,
 273                                      krb5_keytab keytab,
 274                                      const char **keytab_name);
 275 krb5_error_code smb_krb5_kt_seek_and_delete_old_entries(krb5_context context,
 276                                                         krb5_keytab keytab,
 277                                                         bool keep_old_kvno,
 278                                                         krb5_kvno kvno,
 279                                                         bool enctype_only,
 280                                                         krb5_enctype enctype,
 281                                                         const char *princ_s,
 282                                                         krb5_principal princ,
 283                                                         bool flush);
 284 krb5_error_code smb_krb5_kt_add_password(krb5_context context,
 285                                          krb5_keytab keytab,
 286                                          krb5_kvno kvno,
 287                                          const char *princ_s,
 288                                          const char *salt_principal,
 289                                          krb5_enctype enctype,
 290                                          krb5_data *password);
 291
 292 krb5_error_code smb_krb5_get_credentials(krb5_context context,
 293                                          krb5_ccache ccache,
 294                                          krb5_principal me,
 295                                          krb5_principal server,
 296                                          krb5_principal impersonate_princ,
 297                                          krb5_creds **out_creds);
 298 krb5_error_code smb_krb5_keyblock_init_contents(krb5_context context,
 299                                                 krb5_enctype enctype,
 300                                                 const void *data,
 301                                                 size_t length,
 302                                                 krb5_keyblock *key);
 303 krb5_error_code smb_krb5_kinit_keyblock_ccache(krb5_context ctx,
 304                                                krb5_ccache cc,
 305                                                krb5_principal principal,
 306                                                krb5_keyblock *keyblock,
 307                                                const char *target_service,
 308                                                krb5_get_init_creds_opt *krb_options,
 309                                                time_t *expire_time,
 310                                                time_t *kdc_time);
 311 krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
 312                                                krb5_ccache cc,
 313                                                krb5_principal principal,
 314                                                const char *password,
 315                                                const char *target_service,
 316                                                krb5_get_init_creds_opt *krb_options,
 317                                                time_t *expire_time,
 318                                                time_t *kdc_time);
 319 krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
 320                                            krb5_ccache store_cc,
 321                                            krb5_principal init_principal,
 322                                            const char *init_password,
 323                                            krb5_principal impersonate_principal,
 324                                            const char *self_service,
 325                                            const char *target_service,
 326                                            krb5_get_init_creds_opt *krb_options,
 327                                            time_t *expire_time,
 328                                            time_t *kdc_time);
 329
 330 #if defined(HAVE_KRB5_MAKE_PRINCIPAL)
 331 #define smb_krb5_make_principal krb5_make_principal
 332 #elif defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
 333 krb5_error_code smb_krb5_make_principal(krb5_context context,
 334                                         krb5_principal *principal,
 335                                         const char *realm, ...);
 336 #else
 337 #error krb5_make_principal not available
 338 #endif
 339
 340 #if defined(HAVE_KRB5_CC_GET_LIFETIME)
 341 #define smb_krb5_cc_get_lifetime krb5_cc_get_lifetime
 342 #elif defined(HAVE_KRB5_CC_RETRIEVE_CRED)
 343 krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context,
 344                                          krb5_ccache id,
 345                                          time_t *t);
 346 #else
 347 #error krb5_cc_get_lifetime not available
 348 #endif
 349
 350 #if defined(HAVE_KRB5_FREE_CHECKSUM_CONTENTS)
 351 #define smb_krb5_free_checksum_contents krb5_free_checksum_contents
 352 #elif defined (HAVE_FREE_CHECKSUM)
 353 void smb_krb5_free_checksum_contents(krb5_context ctx, krb5_checksum *cksum);
 354 #else
 355 #error krb5_free_checksum_contents/free_Checksum is not available
 356 #endif
 357
 358 krb5_error_code smb_krb5_make_pac_checksum(TALLOC_CTX *mem_ctx,
 359                                            DATA_BLOB *pac_data,
 360                                            krb5_context context,
 361                                            const krb5_keyblock *keyblock,
 362                                            uint32_t *sig_type,
 363                                            DATA_BLOB *sig_blob);
 364
 365 char *smb_krb5_principal_get_realm(TALLOC_CTX *mem_ctx,
 366                                    krb5_context context,
 367                                    krb5_const_principal principal);
 368
 369 void smb_krb5_principal_set_type(krb5_context context,
 370                                  krb5_principal principal,
 371                                  int type);
 372
 373 int smb_krb5_principal_is_tgs(krb5_context context,
 374                               krb5_const_principal principal);
 375
 376 krb5_error_code smb_krb5_principal_set_realm(krb5_context context,
 377                                              krb5_principal principal,
 378                                              const char *realm);
 379
 380 char *smb_krb5_get_realm_from_hostname(TALLOC_CTX *mem_ctx,
 381                                        const char *hostname,
 382                                        const char *client_realm);
 383
 384 char *smb_get_krb5_error_message(krb5_context context,
 385                                  krb5_error_code code,
 386                                  TALLOC_CTX *mem_ctx);
 387
 388 #if defined(HAVE_KRB5_KT_COMPARE)
 389 #define smb_krb5_kt_compare krb5_kt_compare
 390 #else
 391 krb5_boolean smb_krb5_kt_compare(krb5_context context,
 392                                  krb5_keytab_entry *entry,
 393                                  krb5_const_principal principal,
 394                                  krb5_kvno vno,
 395                                  krb5_enctype enctype);
 396 #endif
 397
 398 const krb5_enctype *samba_all_enctypes(void);
 399
 400 uint32_t kerberos_enctype_to_bitmap(krb5_enctype enc_type_enum);
 401 krb5_enctype ms_suptype_to_ietf_enctype(uint32_t enctype_bitmap);
 402 krb5_error_code ms_suptypes_to_ietf_enctypes(TALLOC_CTX *mem_ctx,
 403                                              uint32_t enctype_bitmap,
 404                                              krb5_enctype **enctypes);
 405 int smb_krb5_get_pw_salt(krb5_context context,
 406                          krb5_const_principal host_princ,
 407                          krb5_data *psalt);
 408 int smb_krb5_salt_principal(krb5_context krb5_ctx,
 409                             const char *realm,
 410                             const char *sAMAccountName,
 411                             const char *userPrincipalName,
 412                             uint32_t uac_flags,
 413                             krb5_principal *salt_princ);
 414
 415 int smb_krb5_salt_principal_str(const char *realm,
 416                                 const char *sAMAccountName,
 417                                 const char *userPrincipalName,
 418                                 uint32_t uac_flags,
 419                                 TALLOC_CTX *mem_ctx,
 420                                 char **_salt_principal);
 421 int smb_krb5_salt_principal2data(krb5_context context,
 422                                  const char *salt_principal,
 423                                  TALLOC_CTX *mem_ctx,
 424                                  char **_salt_data);
 425
 426 int smb_krb5_create_key_from_string(krb5_context context,
 427                                     krb5_const_principal host_princ,
 428                                     const krb5_data *salt,
 429                                     const krb5_data *password,
 430                                     krb5_enctype enctype,
 431                                     krb5_keyblock *key);
 432
 433 #ifndef krb5_princ_size
 434 #if defined(HAVE_KRB5_PRINCIPAL_GET_NUM_COMP)
 435 #define krb5_princ_size krb5_principal_get_num_comp
 436 #else
 437 #error krb5_princ_size unavailable
 438 #endif
 439 #endif
 440
 441 krb5_error_code smb_krb5_principal_get_comp_string(TALLOC_CTX *mem_ctx,
 442                                                    krb5_context context,
 443                                                    krb5_const_principal principal,
 444                                                    unsigned int component,
 445                                                    char **out);
 446
 447 krb5_error_code smb_krb5_copy_data_contents(krb5_data *p,
 448                                             const void *data,
 449                                             size_t len);
 450
 451 krb5_data smb_krb5_make_data(void *data,
 452                              size_t len);
 453
 454 krb5_data smb_krb5_data_from_blob(DATA_BLOB blob);
 455
 456 int smb_krb5_principal_get_type(krb5_context context,
 457                                 krb5_const_principal principal);
 458
 459 #if !defined(HAVE_KRB5_WARNX)
 460 krb5_error_code krb5_warnx(krb5_context context, const char *fmt, ...)
 461         PRINTF_ATTRIBUTE(2, 0);
 462 #endif
 463
 464 krb5_error_code smb_krb5_cc_new_unique_memory(krb5_context context,
 465                                               TALLOC_CTX *mem_ctx,
 466                                               char **ccache_name,
 467                                               krb5_ccache *id);
 468
 469 krb5_error_code smb_krb5_cc_copy_creds(krb5_context context,
 470                                        krb5_ccache incc, krb5_ccache outcc);
 471
 472 #endif /* HAVE_KRB5 */
 473
 474 int ads_krb5_cli_get_ticket(TALLOC_CTX *mem_ctx,
 475                             const char *principal,
 476                             time_t time_offset,
 477                             DATA_BLOB *ticket,
 478                             DATA_BLOB *session_key_krb5,
 479                             uint32_t extra_ap_opts, const char *ccname,
 480                             time_t *tgs_expire,
 481                             const char *impersonate_princ_s);
 482
 483 NTSTATUS krb5_to_nt_status(krb5_error_code kerberos_error);
 484 krb5_error_code nt_status_to_krb5(NTSTATUS nt_status);
 485
 486 #endif /* _KRB5_SAMBA_H */