path: root/src/lib/krb4/g_ad_tkt.c

/*
 * lib/krb4/g_ad_tkt.c
 *
 * Copyright 1986, 1987, 1988, 2000, 2001 by the Massachusetts
 * Institute of Technology.  All Rights Reserved.
 *
 * Export of this software from the United States of America may
 *   require a specific license from the United States Government.
 *   It is the responsibility of any person or organization contemplating
 *   export to obtain such a license before exporting.
 * 
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  Furthermore if you modify this software you must label
 * your software as modified software and not distribute it in such a
 * fashion that it might be confused with the original M.I.T. software.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 */

#include "krb.h"
#include "des.h"
#include "krb4int.h"
#include "prot.h"
#include <string.h>

#include <stdio.h>

extern int krb_debug;
extern int swap_bytes;

/*
 * get_ad_tkt obtains a new service ticket from Kerberos, using
 * the ticket-granting ticket which must be in the ticket file.
 * It is typically called by krb_mk_req() when the client side
 * of an application is creating authentication information to be
 * sent to the server side.
 *
 * get_ad_tkt takes four arguments: three pointers to strings which
 * contain the name, instance, and realm of the service for which the
 * ticket is to be obtained; and an integer indicating the desired
 * lifetime of the ticket.
 *
 * It returns an error status if the ticket couldn't be obtained,
 * or AD_OK if all went well.  The ticket is stored in the ticket
 * cache.
 *
 * The request sent to the Kerberos ticket-granting service looks
 * like this:
 *
 * pkt->dat
 *
 * TEXT			original contents of	authenticator+ticket
 *			pkt->dat		built in krb_mk_req call
 * 
 * 4 bytes		time_ws			always 0 (?)  FIXME!
 * char			lifetime		lifetime argument passed
 * string		service			service name argument
 * string		sinstance		service instance arg.
 *
 * See "prot.h" for the reply packet layout and definitions of the
 * extraction macros like pkt_version(), pkt_msg_type(), etc.
 */

/*
 * g_ad_tk_parse()
 *
 * Parse the returned packet from the KDC.
 *
 * Note that the caller is responsible for clearing the returned
 * session key if there is an error; that makes the error handling
 * code a little less hairy.
 */
static int
g_ad_tkt_parse(KTEXT rpkt, C_Block tgtses, C_Block ses,
	       char *s_name, char *s_instance, char *rlm,
	       char *service, char *sinstance, char *realm,
	       int *lifetime, int *kvno, KTEXT tkt,
	       unsigned KRB4_32 *kdc_time,
	       KRB4_32 *t_local)
{
    unsigned char *ptr;
    unsigned int t_switch;
    int msg_byte_order;
    unsigned long rep_err_code;
    unsigned long cip_len;
    KTEXT_ST cip_st;
    KTEXT cip = &cip_st;	/* Returned Ciphertext */
    Key_schedule key_s;
    int len, i;
    KRB4_32 t_diff;		/* Difference between timestamps */

    ptr = rpkt->dat;
#define RPKT_REMAIN (rpkt->length - (ptr - rpkt->dat))
    if (RPKT_REMAIN < 1 + 1)
	return INTK_PROT;
    /* check packet version of the returned packet */
    if (*ptr++ != KRB_PROT_VERSION)
	return INTK_PROT;

    /* This used to be
         switch (pkt_msg_type(rpkt) & ~1) {
       but SCO 3.2v4 cc compiled that incorrectly.  */
    t_switch = *ptr++;
    /* Check byte order (little-endian == 1) */
    msg_byte_order = t_switch & 1;
    t_switch &= ~1;
    /*
     * Skip over some stuff (3 strings and various integers -- see
     * cr_auth_repl.c for details).  Maybe we should actually verify
     * these?
     */
    for (i = 0; i < 3; i++) {
	len = krb4int_strnlen((char *)ptr, RPKT_REMAIN) + 1;
	if (len <= 0)
	    return INTK_PROT;
	ptr += len;
    }
    switch (t_switch) {
    case AUTH_MSG_KDC_REPLY:
	if (RPKT_REMAIN < 4 + 1 + 4 + 1)
	    return INTK_PROT;
	ptr += 4 + 1 + 4 + 1;
	break;
    case AUTH_MSG_ERR_REPLY:
	if (RPKT_REMAIN < 8)
	    return INTK_PROT;
	ptr += 4;
	KRB4_GET32(rep_err_code, ptr, msg_byte_order);
	return rep_err_code;

    default:
	return INTK_PROT;
    }

    /* Extract the ciphertext */
    if (RPKT_REMAIN < 2)
	return INTK_PROT;
    KRB4_GET16(cip_len, ptr, msg_byte_order);
    if (RPKT_REMAIN < cip_len)
	return INTK_PROT;
    /*
     * RPKT_REMAIN will always be non-negative and at most the maximum
     * possible value of cip->length, so this assignment is safe.
     */
    cip->length = cip_len;
    memcpy(cip->dat, ptr, (size_t)cip->length);
    ptr += cip->length;

#ifndef NOENCRYPTION
    /* Attempt to decrypt it */

    key_sched(tgtses, key_s);
    DEB (("About to do decryption ..."));
    pcbc_encrypt((C_Block *)cip->dat, (C_Block *)cip->dat,
                 (long)cip->length, key_s, (C_Block *)tgtses, 0);
#endif /* !NOENCRYPTION */
    /*
     * Stomp on key schedule.  Caller should stomp on tgtses.
     */
    memset(key_s, 0, sizeof(key_s));

    ptr = cip->dat;
#define CIP_REMAIN (cip->length - (ptr - cip->dat))
    if (CIP_REMAIN < 8)
	return RD_AP_MODIFIED;
    memcpy(ses, ptr, 8);
    /*
     * Stomp on decrypted session key immediately after copying it.
     */
    memset(ptr, 0, 8);
    ptr += 8;

    len = krb4int_strnlen((char *)ptr, CIP_REMAIN) + 1;
    if (len <= 0 || len > SNAME_SZ)
	return RD_AP_MODIFIED;
    memcpy(s_name, ptr, (size_t)len);
    ptr += len;

    len = krb4int_strnlen((char *)ptr, CIP_REMAIN) + 1;
    if (len <= 0 || len > INST_SZ)
	return RD_AP_MODIFIED;
    memcpy(s_instance, ptr, (size_t)len);
    ptr += len;

    len = krb4int_strnlen((char *)ptr, CIP_REMAIN) + 1;
    if (len <= 0 || len > REALM_SZ)
	return RD_AP_MODIFIED;
    memcpy(rlm, ptr, (size_t)len);
    ptr += len;

    if (strcmp(s_name, service) || strcmp(s_instance, sinstance)
	|| strcmp(rlm, realm))	/* not what we asked for */
	return INTK_ERR;	/* we need a better code here XXX */

    if (CIP_REMAIN < 1 + 1 + 1)
	return RD_AP_MODIFIED;
    *lifetime = *ptr++;
    *kvno = *ptr++;
    tkt->length = *ptr++;

    if (CIP_REMAIN < tkt->length)
	return RD_AP_MODIFIED;
    memcpy(tkt->dat, ptr, (size_t)tkt->length);
    ptr += tkt->length;

    /* Time (coarse) */
    if (CIP_REMAIN < 4)
	return RD_AP_MODIFIED;
    KRB4_GET32(*kdc_time, ptr, msg_byte_order);

    /* check KDC time stamp */
    *t_local = TIME_GMT_UNIXSEC;
    t_diff = *t_local - *kdc_time;
    if (t_diff < 0)
	t_diff = -t_diff;	/* Absolute value of difference */
    if (t_diff > CLOCK_SKEW)
	return RD_AP_TIME;	/* XXX should probably be better code */

    return 0;
}

int KRB5_CALLCONV
get_ad_tkt(service, sinstance, realm, lifetime)
    char    *service;
    char    *sinstance;
    char    *realm;
    int     lifetime;
{
    KTEXT_ST pkt_st;
    KTEXT pkt = & pkt_st;	/* Packet to KDC */
    KTEXT_ST rpkt_st;
    KTEXT rpkt = &rpkt_st;	/* Returned packet */
    KTEXT_ST tkt_st;
    KTEXT tkt = &tkt_st;	/* Current ticket */
    C_Block ses;                /* Session key for tkt */
    CREDENTIALS cr;
    int kvno;			/* Kvno for session key */
    int kerror;
    char lrealm[REALM_SZ];
    KRB4_32 time_ws = 0;
    char s_name[SNAME_SZ];
    char s_instance[INST_SZ];
    char rlm[REALM_SZ];
    unsigned char *ptr;
    KRB4_32 t_local;
    struct sockaddr_in laddr;
    socklen_t addrlen;
    unsigned KRB4_32 kdc_time;   /* KDC time */
    size_t snamelen, sinstlen;

    kerror = krb_get_tf_realm(TKT_FILE, lrealm);
#if USE_LOGIN_LIBRARY
    if (kerror == GC_NOTKT) {
        /* No tickets... call krb_get_cred (KLL will prompt) and try again. */
        if ((kerror = krb_get_cred ("krbtgt", realm, realm, &cr)) == KSUCCESS) {
            /* Now get the realm again. */
            kerror = krb_get_tf_realm (TKT_FILE, lrealm);
        }
    }
#endif
    if (kerror != KSUCCESS)
	return kerror;

    /* Create skeleton of packet to be sent */
    pkt->length = 0;

    /*
     * Look for the session key (and other stuff we don't need)
     * in the ticket file for krbtgt.realm@lrealm where "realm" 
     * is the service's realm (passed in "realm" argument) and 
     * "lrealm" is the realm of our initial ticket (the local realm).
     * If that fails, and the server's realm and the local realm are
     * the same thing, give up - no TGT available for local realm.
     *
     * If the server realm and local realm are different, though,
     * try getting a ticket-granting ticket for the server's realm,
     * i.e. a ticket for "krbtgt.alienrealm@lrealm", by calling get_ad_tkt().
     * If that succeeds, the ticket will be in ticket cache, get it
     * into the "cr" structure by calling krb_get_cred().
     */
    kerror = krb_get_cred("krbtgt", realm, lrealm, &cr);
    if (kerror != KSUCCESS) {
	/*
	 * If realm == lrealm, we have no hope, so let's not even try.
	 */
	if (strncmp(realm, lrealm, sizeof(lrealm)) == 0)
	    return AD_NOTGT;
	else {
	    kerror = get_ad_tkt("krbtgt", realm, lrealm, lifetime);
	    if (kerror != KSUCCESS) {
		if (kerror == KDC_PR_UNKNOWN)	/* no cross-realm ticket */
		    return AD_NOTGT;		/* So call it no ticket */
		return kerror;
	    }
	    kerror = krb_get_cred("krbtgt",realm,lrealm,&cr);
	    if (kerror != KSUCCESS)
		return kerror;
	}
    }

    /*
     * Make up a request packet to the "krbtgt.realm@lrealm".
     * Start by calling krb_mk_req() which puts ticket+authenticator
     * into "pkt".  Then tack other stuff on the end.
     */
    kerror = krb_mk_req(pkt, "krbtgt", realm, lrealm, 0L);
    if (kerror) {
	/* stomp stomp stomp */
	memset(cr.session, 0, sizeof(cr.session));
	return AD_NOTGT;
    }

    ptr = pkt->dat + pkt->length;

    snamelen = strlen(service) + 1;
    sinstlen = strlen(sinstance) + 1;
    if (sizeof(pkt->dat) - (ptr - pkt->dat) < (4 + 1
					       + snamelen
					       + sinstlen)) {
	/* stomp stomp stomp */
	memset(cr.session, 0, sizeof(cr.session));
	return INTK_ERR;
    }

    /* timestamp */   /* FIXME -- always 0 now, should we fill it in??? */
    KRB4_PUT32BE(ptr, time_ws);

    *ptr++ = lifetime;

    memcpy(ptr, service, snamelen);
    ptr += snamelen;
    memcpy(ptr, sinstance, sinstlen);
    ptr += sinstlen;

    pkt->length = ptr - pkt->dat;

    /* Send the request to the local ticket-granting server */
    rpkt->length = 0;
    addrlen = sizeof(laddr);
    kerror = krb4int_send_to_kdc_addr(pkt, rpkt, realm,
				      (struct sockaddr *)&laddr, &addrlen);

    if (!kerror) {
	/* No error; parse return packet from KDC. */
	kerror = g_ad_tkt_parse(rpkt, cr.session, ses,
				s_name, s_instance, rlm,
				service, sinstance, realm,
				&lifetime, &kvno, tkt,
				&kdc_time, &t_local);
    }
    /*
     * Unconditionally stomp on cr.session because we don't need it
     * anymore.
     */
    memset(cr.session, 0, sizeof(cr.session));
    if (kerror) {
	/*
	 * Stomp on ses for good measure, since g_ad_tkt_parse()
	 * doesn't do that for us.
	 */
	memset(ses, 0, sizeof(ses));
	return kerror;
    }

    kerror = krb4int_save_credentials_addr(s_name, s_instance, rlm,
					   ses, lifetime, kvno, tkt,
					   t_local,
					   laddr.sin_addr.s_addr);
    /*
     * Unconditionally stomp on ses because we don't need it anymore.
     */
    memset(ses, 0, sizeof(ses));
    if (kerror)
	return kerror;
    return AD_OK;
}