17c478bd9Sstevel@tonic-gate /* 2*6cf54e34Sbugbomb * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 37c478bd9Sstevel@tonic-gate * Use is subject to license terms. 47c478bd9Sstevel@tonic-gate */ 57c478bd9Sstevel@tonic-gate 67c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 77c478bd9Sstevel@tonic-gate 87c478bd9Sstevel@tonic-gate /* 97c478bd9Sstevel@tonic-gate * kdc/do_tgs_req.c 107c478bd9Sstevel@tonic-gate * 117c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology. 127c478bd9Sstevel@tonic-gate * All Rights Reserved. 137c478bd9Sstevel@tonic-gate * 147c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 157c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 167c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 177c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 207c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 217c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 227c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 237c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 247c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 257c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 267c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 277c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 287c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 297c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 307c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 317c478bd9Sstevel@tonic-gate * or implied warranty. 327c478bd9Sstevel@tonic-gate * 337c478bd9Sstevel@tonic-gate * 347c478bd9Sstevel@tonic-gate * KDC Routines to deal with TGS_REQ's 357c478bd9Sstevel@tonic-gate */ 367c478bd9Sstevel@tonic-gate 377c478bd9Sstevel@tonic-gate #include "k5-int.h" 387c478bd9Sstevel@tonic-gate #include "com_err.h" 397c478bd9Sstevel@tonic-gate 407c478bd9Sstevel@tonic-gate #include <syslog.h> 417c478bd9Sstevel@tonic-gate #ifdef HAVE_NETINET_IN_H 427c478bd9Sstevel@tonic-gate #include <sys/types.h> 437c478bd9Sstevel@tonic-gate #include <netinet/in.h> 447c478bd9Sstevel@tonic-gate #ifndef hpux 457c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 467c478bd9Sstevel@tonic-gate #endif 477c478bd9Sstevel@tonic-gate #endif 487c478bd9Sstevel@tonic-gate 497c478bd9Sstevel@tonic-gate #include "kdc_util.h" 507c478bd9Sstevel@tonic-gate #include "policy.h" 517c478bd9Sstevel@tonic-gate #include "extern.h" 527c478bd9Sstevel@tonic-gate #include "adm_proto.h" 537c478bd9Sstevel@tonic-gate 547c478bd9Sstevel@tonic-gate extern krb5_error_code setup_server_realm(krb5_principal); 557c478bd9Sstevel@tonic-gate 567c478bd9Sstevel@tonic-gate static void find_alternate_tgs PROTOTYPE((krb5_kdc_req *, 577c478bd9Sstevel@tonic-gate krb5_db_entry *, 587c478bd9Sstevel@tonic-gate krb5_boolean *, 597c478bd9Sstevel@tonic-gate int *, 607c478bd9Sstevel@tonic-gate const krb5_fulladdr *, 617c478bd9Sstevel@tonic-gate int, 627c478bd9Sstevel@tonic-gate char *)); 637c478bd9Sstevel@tonic-gate 647c478bd9Sstevel@tonic-gate static krb5_error_code prepare_error_tgs PROTOTYPE((krb5_kdc_req *, 657c478bd9Sstevel@tonic-gate krb5_ticket *, 667c478bd9Sstevel@tonic-gate int, 677c478bd9Sstevel@tonic-gate const char *, 687c478bd9Sstevel@tonic-gate krb5_data **)); 697c478bd9Sstevel@tonic-gate 707c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 717c478bd9Sstevel@tonic-gate krb5_error_code 727c478bd9Sstevel@tonic-gate process_tgs_req(pkt, from, portnum, response) 737c478bd9Sstevel@tonic-gate krb5_data *pkt; 747c478bd9Sstevel@tonic-gate const krb5_fulladdr *from; /* who sent it ? */ 757c478bd9Sstevel@tonic-gate int portnum; 767c478bd9Sstevel@tonic-gate krb5_data **response; /* filled in with a response packet */ 777c478bd9Sstevel@tonic-gate { 787c478bd9Sstevel@tonic-gate krb5_keyblock * subkey; 797c478bd9Sstevel@tonic-gate krb5_kdc_req *request = 0; 807c478bd9Sstevel@tonic-gate krb5_db_entry server; 817c478bd9Sstevel@tonic-gate krb5_kdc_rep reply; 827c478bd9Sstevel@tonic-gate krb5_enc_kdc_rep_part reply_encpart; 837c478bd9Sstevel@tonic-gate krb5_ticket ticket_reply, *header_ticket = 0; 847c478bd9Sstevel@tonic-gate int st_idx = 0; 857c478bd9Sstevel@tonic-gate krb5_enc_tkt_part enc_tkt_reply; 867c478bd9Sstevel@tonic-gate krb5_transited enc_tkt_transited; 877c478bd9Sstevel@tonic-gate int newtransited = 0; 887c478bd9Sstevel@tonic-gate krb5_error_code retval = 0; 897c478bd9Sstevel@tonic-gate int nprincs = 0; 907c478bd9Sstevel@tonic-gate krb5_boolean more; 917c478bd9Sstevel@tonic-gate krb5_timestamp kdc_time, authtime=0; 927c478bd9Sstevel@tonic-gate krb5_keyblock session_key; 937c478bd9Sstevel@tonic-gate krb5_timestamp until, rtime; 947c478bd9Sstevel@tonic-gate krb5_keyblock encrypting_key; 957c478bd9Sstevel@tonic-gate krb5_key_data *server_key; 967c478bd9Sstevel@tonic-gate char *cname = 0, *sname = 0, *tmp = 0, *fromstring = 0; 977c478bd9Sstevel@tonic-gate krb5_last_req_entry *nolrarray[2], nolrentry; 987c478bd9Sstevel@tonic-gate /* krb5_address *noaddrarray[1]; */ 997c478bd9Sstevel@tonic-gate krb5_enctype useenctype; 1007c478bd9Sstevel@tonic-gate int errcode, errcode2; 1017c478bd9Sstevel@tonic-gate register int i; 1027c478bd9Sstevel@tonic-gate int firstpass = 1; 1037c478bd9Sstevel@tonic-gate const char *status = 0; 1047c478bd9Sstevel@tonic-gate long long tmp_server_times, tmp_realm_times; 1057c478bd9Sstevel@tonic-gate 1067c478bd9Sstevel@tonic-gate (void) memset(&encrypting_key, 0, sizeof(krb5_keyblock)); 1077c478bd9Sstevel@tonic-gate (void) memset(&session_key, 0, sizeof(krb5_keyblock)); 1087c478bd9Sstevel@tonic-gate 1097c478bd9Sstevel@tonic-gate retval = decode_krb5_tgs_req(pkt, &request); 1107c478bd9Sstevel@tonic-gate if (retval) 1117c478bd9Sstevel@tonic-gate return retval; 1127c478bd9Sstevel@tonic-gate 1137c478bd9Sstevel@tonic-gate /* 1147c478bd9Sstevel@tonic-gate * setup_server_realm() sets up the global realm-specific data pointer. 1157c478bd9Sstevel@tonic-gate */ 1167c478bd9Sstevel@tonic-gate if ((retval = setup_server_realm(request->server))) 1177c478bd9Sstevel@tonic-gate return retval; 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate #ifdef HAVE_NETINET_IN_H 1207c478bd9Sstevel@tonic-gate if (from->address->addrtype == ADDRTYPE_INET) 1217c478bd9Sstevel@tonic-gate fromstring = 1227c478bd9Sstevel@tonic-gate (char *) inet_ntoa(*(struct in_addr *)from->address->contents); 1237c478bd9Sstevel@tonic-gate #endif 1247c478bd9Sstevel@tonic-gate if (!fromstring) 1257c478bd9Sstevel@tonic-gate fromstring = "<unknown>"; 1267c478bd9Sstevel@tonic-gate 1277c478bd9Sstevel@tonic-gate if ((errcode = krb5_unparse_name(kdc_context, request->server, &sname))) { 1287c478bd9Sstevel@tonic-gate status = "UNPARSING SERVER"; 1297c478bd9Sstevel@tonic-gate goto cleanup; 1307c478bd9Sstevel@tonic-gate } 1317c478bd9Sstevel@tonic-gate limit_string(sname); 1327c478bd9Sstevel@tonic-gate 1337c478bd9Sstevel@tonic-gate /* errcode = kdc_process_tgs_req(request, from, pkt, &req_authdat); */ 1347c478bd9Sstevel@tonic-gate errcode = kdc_process_tgs_req(request, from, pkt, &header_ticket, &subkey); 1357c478bd9Sstevel@tonic-gate 1367c478bd9Sstevel@tonic-gate if (header_ticket && header_ticket->enc_part2 && 1377c478bd9Sstevel@tonic-gate (errcode2 = krb5_unparse_name(kdc_context, 1387c478bd9Sstevel@tonic-gate header_ticket->enc_part2->client, 1397c478bd9Sstevel@tonic-gate &cname))) { 1407c478bd9Sstevel@tonic-gate status = "UNPARSING CLIENT"; 1417c478bd9Sstevel@tonic-gate errcode = errcode2; 1427c478bd9Sstevel@tonic-gate goto cleanup; 1437c478bd9Sstevel@tonic-gate } 1447c478bd9Sstevel@tonic-gate limit_string(cname); 1457c478bd9Sstevel@tonic-gate 1467c478bd9Sstevel@tonic-gate if (errcode) { 1477c478bd9Sstevel@tonic-gate status = "PROCESS_TGS"; 1487c478bd9Sstevel@tonic-gate goto cleanup; 1497c478bd9Sstevel@tonic-gate } 1507c478bd9Sstevel@tonic-gate 1517c478bd9Sstevel@tonic-gate if (!header_ticket) { 1527c478bd9Sstevel@tonic-gate errcode = KRB5_NO_TKT_SUPPLIED; /* XXX? */ 1537c478bd9Sstevel@tonic-gate status="UNEXPECTED NULL in header_ticket"; 1547c478bd9Sstevel@tonic-gate goto cleanup; 1557c478bd9Sstevel@tonic-gate } 1567c478bd9Sstevel@tonic-gate 1577c478bd9Sstevel@tonic-gate /* 1587c478bd9Sstevel@tonic-gate * We've already dealt with the AP_REQ authentication, so we can 1597c478bd9Sstevel@tonic-gate * use header_ticket freely. The encrypted part (if any) has been 1607c478bd9Sstevel@tonic-gate * decrypted with the session key. 1617c478bd9Sstevel@tonic-gate */ 1627c478bd9Sstevel@tonic-gate 1637c478bd9Sstevel@tonic-gate authtime = header_ticket->enc_part2->times.authtime; 1647c478bd9Sstevel@tonic-gate 1657c478bd9Sstevel@tonic-gate /* XXX make sure server here has the proper realm...taken from AP_REQ 1667c478bd9Sstevel@tonic-gate header? */ 1677c478bd9Sstevel@tonic-gate 1687c478bd9Sstevel@tonic-gate nprincs = 1; 1697c478bd9Sstevel@tonic-gate if ((errcode = krb5_db_get_principal(kdc_context, request->server, &server, 1707c478bd9Sstevel@tonic-gate &nprincs, &more))) { 1717c478bd9Sstevel@tonic-gate status = "LOOKING_UP_SERVER"; 1727c478bd9Sstevel@tonic-gate nprincs = 0; 1737c478bd9Sstevel@tonic-gate goto cleanup; 1747c478bd9Sstevel@tonic-gate } 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate tgt_again: 1777c478bd9Sstevel@tonic-gate if (more) { 1787c478bd9Sstevel@tonic-gate status = "NON_UNIQUE_PRINCIPAL"; 1797c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE; 1807c478bd9Sstevel@tonic-gate goto cleanup; 1817c478bd9Sstevel@tonic-gate } else if (nprincs != 1) { 1827c478bd9Sstevel@tonic-gate /* 1837c478bd9Sstevel@tonic-gate * might be a request for a TGT for some other realm; we 1847c478bd9Sstevel@tonic-gate * should do our best to find such a TGS in this db 1857c478bd9Sstevel@tonic-gate */ 1867c478bd9Sstevel@tonic-gate if (firstpass && krb5_is_tgs_principal(request->server) == TRUE) { 1877c478bd9Sstevel@tonic-gate if (krb5_princ_size(kdc_context, request->server) == 2) { 1887c478bd9Sstevel@tonic-gate krb5_data *server_1 = 1897c478bd9Sstevel@tonic-gate krb5_princ_component(kdc_context, request->server, 1); 1907c478bd9Sstevel@tonic-gate krb5_data *tgs_1 = 1917c478bd9Sstevel@tonic-gate krb5_princ_component(kdc_context, tgs_server, 1); 1927c478bd9Sstevel@tonic-gate 1937c478bd9Sstevel@tonic-gate if (server_1->length != tgs_1->length || 1947c478bd9Sstevel@tonic-gate memcmp(server_1->data, tgs_1->data, tgs_1->length)) { 1957c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, &server, nprincs); 1967c478bd9Sstevel@tonic-gate find_alternate_tgs(request, &server, &more, &nprincs, 1977c478bd9Sstevel@tonic-gate from, portnum, cname); /* SUNW */ 1987c478bd9Sstevel@tonic-gate firstpass = 0; 1997c478bd9Sstevel@tonic-gate goto tgt_again; 2007c478bd9Sstevel@tonic-gate } 2017c478bd9Sstevel@tonic-gate } 2027c478bd9Sstevel@tonic-gate } 2037c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, &server, nprincs); 2047c478bd9Sstevel@tonic-gate status = "UNKNOWN_SERVER"; 2057c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; 2067c478bd9Sstevel@tonic-gate goto cleanup; 2077c478bd9Sstevel@tonic-gate } 2087c478bd9Sstevel@tonic-gate 2097c478bd9Sstevel@tonic-gate if ((errcode = krb5_timeofday(kdc_context, &kdc_time))) { 2107c478bd9Sstevel@tonic-gate status = "TIME_OF_DAY"; 2117c478bd9Sstevel@tonic-gate goto cleanup; 2127c478bd9Sstevel@tonic-gate } 2137c478bd9Sstevel@tonic-gate 2147c478bd9Sstevel@tonic-gate if ((retval = validate_tgs_request(request, server, header_ticket, 2157c478bd9Sstevel@tonic-gate kdc_time, &status))) { 2167c478bd9Sstevel@tonic-gate if (!status) 2177c478bd9Sstevel@tonic-gate status = "UNKNOWN_REASON"; 2187c478bd9Sstevel@tonic-gate errcode = retval + ERROR_TABLE_BASE_krb5; 2197c478bd9Sstevel@tonic-gate goto cleanup; 2207c478bd9Sstevel@tonic-gate } 2217c478bd9Sstevel@tonic-gate 2227c478bd9Sstevel@tonic-gate /* 2237c478bd9Sstevel@tonic-gate * We pick the session keytype here.... 2247c478bd9Sstevel@tonic-gate * 2257c478bd9Sstevel@tonic-gate * Some special care needs to be taken in the user-to-user 2267c478bd9Sstevel@tonic-gate * case, since we don't know what keytypes the application server 2277c478bd9Sstevel@tonic-gate * which is doing user-to-user authentication can support. We 2287c478bd9Sstevel@tonic-gate * know that it at least must be able to support the encryption 2297c478bd9Sstevel@tonic-gate * type of the session key in the TGT, since otherwise it won't be 2307c478bd9Sstevel@tonic-gate * able to decrypt the U2U ticket! So we use that in preference 2317c478bd9Sstevel@tonic-gate * to anything else. 2327c478bd9Sstevel@tonic-gate */ 2337c478bd9Sstevel@tonic-gate useenctype = 0; 2347c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) { 2357c478bd9Sstevel@tonic-gate krb5_keyblock * st_sealing_key; 2367c478bd9Sstevel@tonic-gate krb5_kvno st_srv_kvno; 2377c478bd9Sstevel@tonic-gate krb5_enctype etype; 2387c478bd9Sstevel@tonic-gate 2397c478bd9Sstevel@tonic-gate /* 2407c478bd9Sstevel@tonic-gate * Get the key for the second ticket, and decrypt it. 2417c478bd9Sstevel@tonic-gate */ 2427c478bd9Sstevel@tonic-gate if ((errcode = kdc_get_server_key(request->second_ticket[st_idx], 2437c478bd9Sstevel@tonic-gate &st_sealing_key, 2447c478bd9Sstevel@tonic-gate &st_srv_kvno))) { 2457c478bd9Sstevel@tonic-gate status = "2ND_TKT_SERVER"; 2467c478bd9Sstevel@tonic-gate goto cleanup; 2477c478bd9Sstevel@tonic-gate } 2487c478bd9Sstevel@tonic-gate errcode = krb5_decrypt_tkt_part(kdc_context, st_sealing_key, 2497c478bd9Sstevel@tonic-gate request->second_ticket[st_idx]); 2507c478bd9Sstevel@tonic-gate krb5_free_keyblock(kdc_context, st_sealing_key); 2517c478bd9Sstevel@tonic-gate if (errcode) { 2527c478bd9Sstevel@tonic-gate status = "2ND_TKT_DECRYPT"; 2537c478bd9Sstevel@tonic-gate goto cleanup; 2547c478bd9Sstevel@tonic-gate } 2557c478bd9Sstevel@tonic-gate 2567c478bd9Sstevel@tonic-gate etype = request->second_ticket[st_idx]->enc_part2->session->enctype; 2577c478bd9Sstevel@tonic-gate if (!valid_enctype(etype)) { 2587c478bd9Sstevel@tonic-gate status = "BAD_ETYPE_IN_2ND_TKT"; 2597c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_ETYPE_NOSUPP; 2607c478bd9Sstevel@tonic-gate goto cleanup; 2617c478bd9Sstevel@tonic-gate } 2627c478bd9Sstevel@tonic-gate 2637c478bd9Sstevel@tonic-gate for (i = 0; i < request->nktypes; i++) { 2647c478bd9Sstevel@tonic-gate if (request->ktype[i] == etype) { 2657c478bd9Sstevel@tonic-gate useenctype = etype; 2667c478bd9Sstevel@tonic-gate break; 2677c478bd9Sstevel@tonic-gate } 2687c478bd9Sstevel@tonic-gate } 2697c478bd9Sstevel@tonic-gate } 2707c478bd9Sstevel@tonic-gate 2717c478bd9Sstevel@tonic-gate /* 2727c478bd9Sstevel@tonic-gate * Select the keytype for the ticket session key. 2737c478bd9Sstevel@tonic-gate */ 2747c478bd9Sstevel@tonic-gate if ((useenctype == 0) && 2757c478bd9Sstevel@tonic-gate (useenctype = select_session_keytype(kdc_context, &server, 2767c478bd9Sstevel@tonic-gate request->nktypes, 2777c478bd9Sstevel@tonic-gate request->ktype)) == 0) { 2787c478bd9Sstevel@tonic-gate /* unsupported ktype */ 2797c478bd9Sstevel@tonic-gate status = "BAD_ENCRYPTION_TYPE"; 2807c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_ETYPE_NOSUPP; 2817c478bd9Sstevel@tonic-gate goto cleanup; 2827c478bd9Sstevel@tonic-gate } 2837c478bd9Sstevel@tonic-gate 2847c478bd9Sstevel@tonic-gate errcode = krb5_c_make_random_key(kdc_context, useenctype, &session_key); 2857c478bd9Sstevel@tonic-gate 2867c478bd9Sstevel@tonic-gate if (errcode) { 2877c478bd9Sstevel@tonic-gate /* random key failed */ 2887c478bd9Sstevel@tonic-gate status = "RANDOM_KEY_FAILED"; 2897c478bd9Sstevel@tonic-gate goto cleanup; 2907c478bd9Sstevel@tonic-gate } 2917c478bd9Sstevel@tonic-gate 2927c478bd9Sstevel@tonic-gate ticket_reply.server = request->server; /* XXX careful for realm... */ 2937c478bd9Sstevel@tonic-gate 2947c478bd9Sstevel@tonic-gate enc_tkt_reply.flags = 0; 2957c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = 0; 2967c478bd9Sstevel@tonic-gate 2977c478bd9Sstevel@tonic-gate /* 2987c478bd9Sstevel@tonic-gate * Fix header_ticket's starttime; if it's zero, fill in the 2997c478bd9Sstevel@tonic-gate * authtime's value. 3007c478bd9Sstevel@tonic-gate */ 3017c478bd9Sstevel@tonic-gate if (!(header_ticket->enc_part2->times.starttime)) 3027c478bd9Sstevel@tonic-gate header_ticket->enc_part2->times.starttime = 3037c478bd9Sstevel@tonic-gate header_ticket->enc_part2->times.authtime; 3047c478bd9Sstevel@tonic-gate 3057c478bd9Sstevel@tonic-gate /* don't use new addresses unless forwarded, see below */ 3067c478bd9Sstevel@tonic-gate 3077c478bd9Sstevel@tonic-gate enc_tkt_reply.caddrs = header_ticket->enc_part2->caddrs; 3087c478bd9Sstevel@tonic-gate /* noaddrarray[0] = 0; */ 3097c478bd9Sstevel@tonic-gate reply_encpart.caddrs = 0; /* optional...don't put it in */ 3107c478bd9Sstevel@tonic-gate 3117c478bd9Sstevel@tonic-gate /* It should be noted that local policy may affect the */ 3127c478bd9Sstevel@tonic-gate /* processing of any of these flags. For example, some */ 3137c478bd9Sstevel@tonic-gate /* realms may refuse to issue renewable tickets */ 3147c478bd9Sstevel@tonic-gate 3157c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE)) 3167c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_FORWARDABLE); 3177c478bd9Sstevel@tonic-gate 3187c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) { 3197c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_FORWARDED); 3207c478bd9Sstevel@tonic-gate 3217c478bd9Sstevel@tonic-gate /* include new addresses in ticket & reply */ 3227c478bd9Sstevel@tonic-gate 3237c478bd9Sstevel@tonic-gate enc_tkt_reply.caddrs = request->addresses; 3247c478bd9Sstevel@tonic-gate reply_encpart.caddrs = request->addresses; 3257c478bd9Sstevel@tonic-gate } 3267c478bd9Sstevel@tonic-gate if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_FORWARDED)) 3277c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_FORWARDED); 3287c478bd9Sstevel@tonic-gate 3297c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE)) 3307c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_PROXIABLE); 3317c478bd9Sstevel@tonic-gate 3327c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_PROXY)) { 3337c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_PROXY); 3347c478bd9Sstevel@tonic-gate 3357c478bd9Sstevel@tonic-gate /* include new addresses in ticket & reply */ 3367c478bd9Sstevel@tonic-gate 3377c478bd9Sstevel@tonic-gate enc_tkt_reply.caddrs = request->addresses; 3387c478bd9Sstevel@tonic-gate reply_encpart.caddrs = request->addresses; 3397c478bd9Sstevel@tonic-gate } 3407c478bd9Sstevel@tonic-gate 3417c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE)) 3427c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_MAY_POSTDATE); 3437c478bd9Sstevel@tonic-gate 3447c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_POSTDATED)) { 3457c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_POSTDATED); 3467c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_INVALID); 3477c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = request->from; 3487c478bd9Sstevel@tonic-gate } else 3497c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = kdc_time; 3507c478bd9Sstevel@tonic-gate 3517c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_VALIDATE)) { 3527c478bd9Sstevel@tonic-gate /* BEWARE of allocation hanging off of ticket & enc_part2, it belongs 3537c478bd9Sstevel@tonic-gate to the caller */ 3547c478bd9Sstevel@tonic-gate ticket_reply = *(header_ticket); 3557c478bd9Sstevel@tonic-gate enc_tkt_reply = *(header_ticket->enc_part2); 3567c478bd9Sstevel@tonic-gate clear(enc_tkt_reply.flags, TKT_FLG_INVALID); 3577c478bd9Sstevel@tonic-gate } 3587c478bd9Sstevel@tonic-gate 3597c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_RENEW)) { 3607c478bd9Sstevel@tonic-gate krb5_deltat old_life; 3617c478bd9Sstevel@tonic-gate 3627c478bd9Sstevel@tonic-gate /* BEWARE of allocation hanging off of ticket & enc_part2, it belongs 3637c478bd9Sstevel@tonic-gate to the caller */ 3647c478bd9Sstevel@tonic-gate ticket_reply = *(header_ticket); 3657c478bd9Sstevel@tonic-gate enc_tkt_reply = *(header_ticket->enc_part2); 3667c478bd9Sstevel@tonic-gate 3677c478bd9Sstevel@tonic-gate old_life = enc_tkt_reply.times.endtime - enc_tkt_reply.times.starttime; 3687c478bd9Sstevel@tonic-gate 3697c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = kdc_time; 3707c478bd9Sstevel@tonic-gate enc_tkt_reply.times.endtime = 3717c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.renew_till, 3727c478bd9Sstevel@tonic-gate kdc_time + old_life); 3737c478bd9Sstevel@tonic-gate } else { 3747c478bd9Sstevel@tonic-gate /* not a renew request */ 3757c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = kdc_time; 3767c478bd9Sstevel@tonic-gate until = (request->till == 0) ? kdc_infinity : request->till; 3777c478bd9Sstevel@tonic-gate 3787c478bd9Sstevel@tonic-gate /* SUNW */ 3797c478bd9Sstevel@tonic-gate tmp_server_times = (long long) enc_tkt_reply.times.starttime 3807c478bd9Sstevel@tonic-gate + server.max_life; 3817c478bd9Sstevel@tonic-gate 3827c478bd9Sstevel@tonic-gate tmp_realm_times = (long long) enc_tkt_reply.times.starttime 3837c478bd9Sstevel@tonic-gate + max_life_for_realm; 3847c478bd9Sstevel@tonic-gate 3857c478bd9Sstevel@tonic-gate enc_tkt_reply.times.endtime = 3867c478bd9Sstevel@tonic-gate min(until, 3877c478bd9Sstevel@tonic-gate min(tmp_server_times, 3887c478bd9Sstevel@tonic-gate min(tmp_realm_times, 3897c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.endtime, 3907c478bd9Sstevel@tonic-gate KRB5_KDB_EXPIRATION)))); /* SUNW */ 3917c478bd9Sstevel@tonic-gate /* 3927c478bd9Sstevel@tonic-gate enc_tkt_reply.times.endtime = 3937c478bd9Sstevel@tonic-gate min(until, min(enc_tkt_reply.times.starttime + server.max_life, 3947c478bd9Sstevel@tonic-gate min(enc_tkt_reply.times.starttime + max_life_for_realm, 3957c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.endtime))); 3967c478bd9Sstevel@tonic-gate */ 3977c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE_OK) && 3987c478bd9Sstevel@tonic-gate (enc_tkt_reply.times.endtime < request->till) && 3997c478bd9Sstevel@tonic-gate isflagset(header_ticket->enc_part2->flags, 4007c478bd9Sstevel@tonic-gate TKT_FLG_RENEWABLE)) { 4017c478bd9Sstevel@tonic-gate setflag(request->kdc_options, KDC_OPT_RENEWABLE); 4027c478bd9Sstevel@tonic-gate request->rtime = 4037c478bd9Sstevel@tonic-gate min(request->till, 4047c478bd9Sstevel@tonic-gate min(KRB5_KDB_EXPIRATION, 4057c478bd9Sstevel@tonic-gate header_ticket->enc_part2->times.renew_till)); 4067c478bd9Sstevel@tonic-gate } 4077c478bd9Sstevel@tonic-gate } 4087c478bd9Sstevel@tonic-gate rtime = (request->rtime == 0) ? kdc_infinity : request->rtime; 4097c478bd9Sstevel@tonic-gate 4107c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE)) { 4117c478bd9Sstevel@tonic-gate /* already checked above in policy check to reject request for a 4127c478bd9Sstevel@tonic-gate renewable ticket using a non-renewable ticket */ 4137c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_RENEWABLE); 4147c478bd9Sstevel@tonic-gate tmp_realm_times = (long long) enc_tkt_reply.times.starttime + 4157c478bd9Sstevel@tonic-gate min(server.max_renewable_life,max_renewable_life_for_realm); 4167c478bd9Sstevel@tonic-gate enc_tkt_reply.times.renew_till = 4177c478bd9Sstevel@tonic-gate min(rtime, 4187c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.renew_till, 4197c478bd9Sstevel@tonic-gate min (tmp_realm_times, KRB5_KDB_EXPIRATION))); 4207c478bd9Sstevel@tonic-gate } else { 4217c478bd9Sstevel@tonic-gate enc_tkt_reply.times.renew_till = 0; 4227c478bd9Sstevel@tonic-gate } 4237c478bd9Sstevel@tonic-gate 4247c478bd9Sstevel@tonic-gate /* 4257c478bd9Sstevel@tonic-gate * Set authtime to be the same as header_ticket's 4267c478bd9Sstevel@tonic-gate */ 4277c478bd9Sstevel@tonic-gate enc_tkt_reply.times.authtime = header_ticket->enc_part2->times.authtime; 4287c478bd9Sstevel@tonic-gate 4297c478bd9Sstevel@tonic-gate /* 4307c478bd9Sstevel@tonic-gate * Propagate the preauthentication flags through to the returned ticket. 4317c478bd9Sstevel@tonic-gate */ 4327c478bd9Sstevel@tonic-gate if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_PRE_AUTH)) 4337c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_PRE_AUTH); 4347c478bd9Sstevel@tonic-gate 4357c478bd9Sstevel@tonic-gate if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_HW_AUTH)) 4367c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_HW_AUTH); 4377c478bd9Sstevel@tonic-gate 4387c478bd9Sstevel@tonic-gate /* starttime is optional, and treated as authtime if not present. 4397c478bd9Sstevel@tonic-gate so we can nuke it if it matches */ 4407c478bd9Sstevel@tonic-gate if (enc_tkt_reply.times.starttime == enc_tkt_reply.times.authtime) 4417c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = 0; 4427c478bd9Sstevel@tonic-gate 4437c478bd9Sstevel@tonic-gate /* assemble any authorization data */ 4447c478bd9Sstevel@tonic-gate if (request->authorization_data.ciphertext.data) { 4457c478bd9Sstevel@tonic-gate krb5_data scratch; 4467c478bd9Sstevel@tonic-gate 4477c478bd9Sstevel@tonic-gate scratch.length = request->authorization_data.ciphertext.length; 4487c478bd9Sstevel@tonic-gate if (!(scratch.data = 4497c478bd9Sstevel@tonic-gate malloc(request->authorization_data.ciphertext.length))) { 4507c478bd9Sstevel@tonic-gate status = "AUTH_NOMEM"; 4517c478bd9Sstevel@tonic-gate errcode = ENOMEM; 4527c478bd9Sstevel@tonic-gate goto cleanup; 4537c478bd9Sstevel@tonic-gate } 4547c478bd9Sstevel@tonic-gate 4557c478bd9Sstevel@tonic-gate if ((errcode = krb5_c_decrypt(kdc_context, 4567c478bd9Sstevel@tonic-gate header_ticket->enc_part2->session, 4577c478bd9Sstevel@tonic-gate KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY, 4587c478bd9Sstevel@tonic-gate 0, &request->authorization_data, 4597c478bd9Sstevel@tonic-gate &scratch))) { 4607c478bd9Sstevel@tonic-gate status = "AUTH_ENCRYPT_FAIL"; 4617c478bd9Sstevel@tonic-gate free(scratch.data); 4627c478bd9Sstevel@tonic-gate goto cleanup; 4637c478bd9Sstevel@tonic-gate } 4647c478bd9Sstevel@tonic-gate 4657c478bd9Sstevel@tonic-gate /* scratch now has the authorization data, so we decode it */ 4667c478bd9Sstevel@tonic-gate errcode = decode_krb5_authdata(&scratch, &(request->unenc_authdata)); 4677c478bd9Sstevel@tonic-gate free(scratch.data); 4687c478bd9Sstevel@tonic-gate if (errcode) { 4697c478bd9Sstevel@tonic-gate status = "AUTH_DECODE"; 4707c478bd9Sstevel@tonic-gate goto cleanup; 4717c478bd9Sstevel@tonic-gate } 4727c478bd9Sstevel@tonic-gate 4737c478bd9Sstevel@tonic-gate if ((errcode = 4747c478bd9Sstevel@tonic-gate concat_authorization_data(request->unenc_authdata, 4757c478bd9Sstevel@tonic-gate header_ticket->enc_part2->authorization_data, 4767c478bd9Sstevel@tonic-gate &enc_tkt_reply.authorization_data))) { 4777c478bd9Sstevel@tonic-gate status = "CONCAT_AUTH"; 4787c478bd9Sstevel@tonic-gate goto cleanup; 4797c478bd9Sstevel@tonic-gate } 4807c478bd9Sstevel@tonic-gate } else 4817c478bd9Sstevel@tonic-gate enc_tkt_reply.authorization_data = 4827c478bd9Sstevel@tonic-gate header_ticket->enc_part2->authorization_data; 4837c478bd9Sstevel@tonic-gate 4847c478bd9Sstevel@tonic-gate enc_tkt_reply.session = &session_key; 4857c478bd9Sstevel@tonic-gate enc_tkt_reply.client = header_ticket->enc_part2->client; 4867c478bd9Sstevel@tonic-gate enc_tkt_reply.transited.tr_type = KRB5_DOMAIN_X500_COMPRESS; 4877c478bd9Sstevel@tonic-gate enc_tkt_reply.transited.tr_contents = empty_string; /* equivalent of "" */ 4887c478bd9Sstevel@tonic-gate 4897c478bd9Sstevel@tonic-gate /* 4907c478bd9Sstevel@tonic-gate * Only add the realm of the presented tgt to the transited list if 4917c478bd9Sstevel@tonic-gate * it is different than the local realm (cross-realm) and it is different 4927c478bd9Sstevel@tonic-gate * than the realm of the client (since the realm of the client is already 4937c478bd9Sstevel@tonic-gate * implicitly part of the transited list and should not be explicitly 4947c478bd9Sstevel@tonic-gate * listed). 4957c478bd9Sstevel@tonic-gate */ 4967c478bd9Sstevel@tonic-gate 4977c478bd9Sstevel@tonic-gate /* realm compare is like strcmp, but knows how to deal with these args */ 4987c478bd9Sstevel@tonic-gate if (realm_compare(header_ticket->server, tgs_server) || 4997c478bd9Sstevel@tonic-gate realm_compare(header_ticket->server, enc_tkt_reply.client)) { 5007c478bd9Sstevel@tonic-gate /* tgt issued by local realm or issued by realm of client */ 5017c478bd9Sstevel@tonic-gate enc_tkt_reply.transited = header_ticket->enc_part2->transited; 5027c478bd9Sstevel@tonic-gate } else { 5037c478bd9Sstevel@tonic-gate /* tgt issued by some other realm and not the realm of the client */ 5047c478bd9Sstevel@tonic-gate /* assemble new transited field into allocated storage */ 5057c478bd9Sstevel@tonic-gate if (header_ticket->enc_part2->transited.tr_type != 5067c478bd9Sstevel@tonic-gate KRB5_DOMAIN_X500_COMPRESS) { 5077c478bd9Sstevel@tonic-gate status = "BAD_TRTYPE"; 5087c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_TRTYPE_NOSUPP; 5097c478bd9Sstevel@tonic-gate goto cleanup; 5107c478bd9Sstevel@tonic-gate } 5117c478bd9Sstevel@tonic-gate enc_tkt_transited.tr_type = KRB5_DOMAIN_X500_COMPRESS; 5127c478bd9Sstevel@tonic-gate enc_tkt_transited.tr_contents.data = 0; 5137c478bd9Sstevel@tonic-gate enc_tkt_transited.tr_contents.length = 0; 5147c478bd9Sstevel@tonic-gate enc_tkt_reply.transited = enc_tkt_transited; 5157c478bd9Sstevel@tonic-gate if ((errcode = 5167c478bd9Sstevel@tonic-gate add_to_transited(&header_ticket->enc_part2->transited.tr_contents, 5177c478bd9Sstevel@tonic-gate &enc_tkt_reply.transited.tr_contents, 5187c478bd9Sstevel@tonic-gate header_ticket->server, 5197c478bd9Sstevel@tonic-gate enc_tkt_reply.client, 5207c478bd9Sstevel@tonic-gate request->server))) { 5217c478bd9Sstevel@tonic-gate status = "ADD_TR_FAIL"; 5227c478bd9Sstevel@tonic-gate goto cleanup; 5237c478bd9Sstevel@tonic-gate } 5247c478bd9Sstevel@tonic-gate newtransited = 1; 5257c478bd9Sstevel@tonic-gate } 5267c478bd9Sstevel@tonic-gate 5277c478bd9Sstevel@tonic-gate ticket_reply.enc_part2 = &enc_tkt_reply; 5287c478bd9Sstevel@tonic-gate 5297c478bd9Sstevel@tonic-gate /* 5307c478bd9Sstevel@tonic-gate * If we are doing user-to-user authentication, then make sure 5317c478bd9Sstevel@tonic-gate * that the client for the second ticket matches the request 5327c478bd9Sstevel@tonic-gate * server, and then encrypt the ticket using the session key of 5337c478bd9Sstevel@tonic-gate * the second ticket. 5347c478bd9Sstevel@tonic-gate */ 5357c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) { 5367c478bd9Sstevel@tonic-gate /* 5377c478bd9Sstevel@tonic-gate * Make sure the client for the second ticket matches 5387c478bd9Sstevel@tonic-gate * requested server. 5397c478bd9Sstevel@tonic-gate */ 5407c478bd9Sstevel@tonic-gate if (!krb5_principal_compare(kdc_context, request->server, 5417c478bd9Sstevel@tonic-gate request->second_ticket[st_idx]->enc_part2->client)) { 5427c478bd9Sstevel@tonic-gate if ((errcode = krb5_unparse_name(kdc_context, 5437c478bd9Sstevel@tonic-gate request->second_ticket[st_idx]->enc_part2->client, 5447c478bd9Sstevel@tonic-gate &tmp))) 5457c478bd9Sstevel@tonic-gate tmp = 0; 5467c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_2ndtktmm( 5477c478bd9Sstevel@tonic-gate (struct in_addr *)from->address->contents, 5487c478bd9Sstevel@tonic-gate (in_port_t)from->port, 5497c478bd9Sstevel@tonic-gate (in_port_t)portnum, cname, sname); 5507c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO, "TGS_REQ %s(%d): 2ND_TKT_MISMATCH: authtime %d, %s for %s, 2nd tkt client %s", 5517c478bd9Sstevel@tonic-gate fromstring, portnum, authtime, 5527c478bd9Sstevel@tonic-gate cname ? cname : "<unknown client>", 5537c478bd9Sstevel@tonic-gate sname ? sname : "<unknown server>", 5547c478bd9Sstevel@tonic-gate tmp ? tmp : "<unknown>"); 5557c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_SERVER_NOMATCH; 5567c478bd9Sstevel@tonic-gate goto cleanup; 5577c478bd9Sstevel@tonic-gate } 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate ticket_reply.enc_part.kvno = 0; 5607c478bd9Sstevel@tonic-gate ticket_reply.enc_part.enctype = 5617c478bd9Sstevel@tonic-gate request->second_ticket[st_idx]->enc_part2->session->enctype; 5627c478bd9Sstevel@tonic-gate if ((errcode = krb5_encrypt_tkt_part(kdc_context, 5637c478bd9Sstevel@tonic-gate request->second_ticket[st_idx]->enc_part2->session, 5647c478bd9Sstevel@tonic-gate &ticket_reply))) { 5657c478bd9Sstevel@tonic-gate status = "2ND_TKT_ENCRYPT"; 5667c478bd9Sstevel@tonic-gate goto cleanup; 5677c478bd9Sstevel@tonic-gate } 5687c478bd9Sstevel@tonic-gate st_idx++; 5697c478bd9Sstevel@tonic-gate } else { 5707c478bd9Sstevel@tonic-gate /* 5717c478bd9Sstevel@tonic-gate * Find the server key 5727c478bd9Sstevel@tonic-gate */ 5737c478bd9Sstevel@tonic-gate if ((errcode = krb5_dbe_find_enctype(kdc_context, &server, 5747c478bd9Sstevel@tonic-gate -1, /* ignore keytype */ 5757c478bd9Sstevel@tonic-gate -1, /* Ignore salttype */ 5767c478bd9Sstevel@tonic-gate 0, /* Get highest kvno */ 5777c478bd9Sstevel@tonic-gate &server_key))) { 5787c478bd9Sstevel@tonic-gate status = "FINDING_SERVER_KEY"; 5797c478bd9Sstevel@tonic-gate goto cleanup; 5807c478bd9Sstevel@tonic-gate } 5817c478bd9Sstevel@tonic-gate /* convert server.key into a real key (it may be encrypted 5827c478bd9Sstevel@tonic-gate * in the database) */ 5837c478bd9Sstevel@tonic-gate if ((errcode = krb5_dbekd_decrypt_key_data(kdc_context, 5847c478bd9Sstevel@tonic-gate &master_keyblock, 5857c478bd9Sstevel@tonic-gate server_key, &encrypting_key, 5867c478bd9Sstevel@tonic-gate NULL))) { 5877c478bd9Sstevel@tonic-gate status = "DECRYPT_SERVER_KEY"; 5887c478bd9Sstevel@tonic-gate goto cleanup; 5897c478bd9Sstevel@tonic-gate } 5907c478bd9Sstevel@tonic-gate if ((encrypting_key.enctype == ENCTYPE_DES_CBC_CRC) && 5917c478bd9Sstevel@tonic-gate (isflagset(server.attributes, KRB5_KDB_SUPPORT_DESMD5))) 5927c478bd9Sstevel@tonic-gate encrypting_key.enctype = ENCTYPE_DES_CBC_MD5; 5937c478bd9Sstevel@tonic-gate errcode = krb5_encrypt_tkt_part(kdc_context, &encrypting_key, 5947c478bd9Sstevel@tonic-gate &ticket_reply); 5957c478bd9Sstevel@tonic-gate krb5_free_keyblock_contents(kdc_context, &encrypting_key); 5967c478bd9Sstevel@tonic-gate if (errcode) { 5977c478bd9Sstevel@tonic-gate status = "TKT_ENCRYPT"; 5987c478bd9Sstevel@tonic-gate goto cleanup; 5997c478bd9Sstevel@tonic-gate } 6007c478bd9Sstevel@tonic-gate ticket_reply.enc_part.kvno = server_key->key_data_kvno; 6017c478bd9Sstevel@tonic-gate } 6027c478bd9Sstevel@tonic-gate 6037c478bd9Sstevel@tonic-gate /* Start assembling the response */ 6047c478bd9Sstevel@tonic-gate reply.msg_type = KRB5_TGS_REP; 6057c478bd9Sstevel@tonic-gate reply.padata = 0; /* always */ 6067c478bd9Sstevel@tonic-gate reply.client = header_ticket->enc_part2->client; 6077c478bd9Sstevel@tonic-gate reply.enc_part.kvno = 0; /* We are using the session key */ 6087c478bd9Sstevel@tonic-gate reply.ticket = &ticket_reply; 6097c478bd9Sstevel@tonic-gate 6107c478bd9Sstevel@tonic-gate reply_encpart.session = &session_key; 6117c478bd9Sstevel@tonic-gate reply_encpart.nonce = request->nonce; 6127c478bd9Sstevel@tonic-gate 6137c478bd9Sstevel@tonic-gate /* copy the time fields EXCEPT for authtime; its location 6147c478bd9Sstevel@tonic-gate is used for ktime */ 6157c478bd9Sstevel@tonic-gate reply_encpart.times = enc_tkt_reply.times; 6167c478bd9Sstevel@tonic-gate reply_encpart.times.authtime = header_ticket->enc_part2->times.authtime; 6177c478bd9Sstevel@tonic-gate 6187c478bd9Sstevel@tonic-gate /* starttime is optional, and treated as authtime if not present. 6197c478bd9Sstevel@tonic-gate so we can nuke it if it matches */ 6207c478bd9Sstevel@tonic-gate if (enc_tkt_reply.times.starttime == enc_tkt_reply.times.authtime) 6217c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = 0; 6227c478bd9Sstevel@tonic-gate 6237c478bd9Sstevel@tonic-gate nolrentry.lr_type = KRB5_LRQ_NONE; 6247c478bd9Sstevel@tonic-gate nolrentry.value = 0; 6257c478bd9Sstevel@tonic-gate nolrarray[0] = &nolrentry; 6267c478bd9Sstevel@tonic-gate nolrarray[1] = 0; 6277c478bd9Sstevel@tonic-gate reply_encpart.last_req = nolrarray; /* not available for TGS reqs */ 6287c478bd9Sstevel@tonic-gate reply_encpart.key_exp = 0; /* ditto */ 6297c478bd9Sstevel@tonic-gate reply_encpart.flags = enc_tkt_reply.flags; 6307c478bd9Sstevel@tonic-gate reply_encpart.server = ticket_reply.server; 6317c478bd9Sstevel@tonic-gate 6327c478bd9Sstevel@tonic-gate /* use the session key in the ticket, unless there's a subsession key 6337c478bd9Sstevel@tonic-gate in the AP_REQ */ 6347c478bd9Sstevel@tonic-gate 6357c478bd9Sstevel@tonic-gate reply.enc_part.enctype = subkey ? subkey->enctype : 6367c478bd9Sstevel@tonic-gate header_ticket->enc_part2->session->enctype; 6377c478bd9Sstevel@tonic-gate errcode = krb5_encode_kdc_rep(kdc_context, KRB5_TGS_REP, &reply_encpart, 6387c478bd9Sstevel@tonic-gate subkey ? 1 : 0, 6397c478bd9Sstevel@tonic-gate subkey ? subkey : 6407c478bd9Sstevel@tonic-gate header_ticket->enc_part2->session, 6417c478bd9Sstevel@tonic-gate &reply, response); 6427c478bd9Sstevel@tonic-gate if (errcode) { 6437c478bd9Sstevel@tonic-gate status = "ENCODE_KDC_REP"; 6447c478bd9Sstevel@tonic-gate } else { 6457c478bd9Sstevel@tonic-gate status = "ISSUE"; 6467c478bd9Sstevel@tonic-gate } 6477c478bd9Sstevel@tonic-gate 6487c478bd9Sstevel@tonic-gate if (ticket_reply.enc_part.ciphertext.data) { 6497c478bd9Sstevel@tonic-gate memset(ticket_reply.enc_part.ciphertext.data, 0, 6507c478bd9Sstevel@tonic-gate ticket_reply.enc_part.ciphertext.length); 6517c478bd9Sstevel@tonic-gate free(ticket_reply.enc_part.ciphertext.data); 6527c478bd9Sstevel@tonic-gate ticket_reply.enc_part.ciphertext.data = NULL; 6537c478bd9Sstevel@tonic-gate } 6547c478bd9Sstevel@tonic-gate /* these parts are left on as a courtesy from krb5_encode_kdc_rep so we 6557c478bd9Sstevel@tonic-gate can use them in raw form if needed. But, we don't... */ 6567c478bd9Sstevel@tonic-gate if (reply.enc_part.ciphertext.data) { 6577c478bd9Sstevel@tonic-gate memset(reply.enc_part.ciphertext.data, 0, 6587c478bd9Sstevel@tonic-gate reply.enc_part.ciphertext.length); 6597c478bd9Sstevel@tonic-gate free(reply.enc_part.ciphertext.data); 6607c478bd9Sstevel@tonic-gate reply.enc_part.ciphertext.data = NULL; 6617c478bd9Sstevel@tonic-gate } 6627c478bd9Sstevel@tonic-gate 6637c478bd9Sstevel@tonic-gate cleanup: 6647c478bd9Sstevel@tonic-gate if (status) { 6657c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req((struct in_addr *)from->address->contents, 6667c478bd9Sstevel@tonic-gate (in_port_t)from->port, (in_port_t)portnum, 6677c478bd9Sstevel@tonic-gate cname ? cname : "<unknown client>", 6687c478bd9Sstevel@tonic-gate sname ? sname : "<unknown client>", 6697c478bd9Sstevel@tonic-gate errcode); 6707c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO, 6717c478bd9Sstevel@tonic-gate "TGS_REQ %s(%d): %s: authtime %d, %s for %s%s%s", 6727c478bd9Sstevel@tonic-gate fromstring, portnum, status, authtime, 6737c478bd9Sstevel@tonic-gate cname ? cname : "<unknown client>", 6747c478bd9Sstevel@tonic-gate sname ? sname : "<unknown server>", 6757c478bd9Sstevel@tonic-gate errcode ? ", " : "", 6767c478bd9Sstevel@tonic-gate errcode ? error_message(errcode) : ""); 6777c478bd9Sstevel@tonic-gate } 6787c478bd9Sstevel@tonic-gate if (errcode) { 6797c478bd9Sstevel@tonic-gate errcode -= ERROR_TABLE_BASE_krb5; 6807c478bd9Sstevel@tonic-gate if (errcode < 0 || errcode > 128) 6817c478bd9Sstevel@tonic-gate errcode = KRB_ERR_GENERIC; 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate retval = prepare_error_tgs(request, header_ticket, errcode, 6847c478bd9Sstevel@tonic-gate fromstring, response); 6857c478bd9Sstevel@tonic-gate } 6867c478bd9Sstevel@tonic-gate 6877c478bd9Sstevel@tonic-gate if (header_ticket) 6887c478bd9Sstevel@tonic-gate krb5_free_ticket(kdc_context, header_ticket); 6897c478bd9Sstevel@tonic-gate if (request) 6907c478bd9Sstevel@tonic-gate krb5_free_kdc_req(kdc_context, request); 6917c478bd9Sstevel@tonic-gate if (cname) 6927c478bd9Sstevel@tonic-gate free(cname); 6937c478bd9Sstevel@tonic-gate if (sname) 6947c478bd9Sstevel@tonic-gate free(sname); 6957c478bd9Sstevel@tonic-gate if (nprincs) 6967c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, &server, 1); 6977c478bd9Sstevel@tonic-gate if (session_key.contents) 6987c478bd9Sstevel@tonic-gate krb5_free_keyblock_contents(kdc_context, &session_key); 6997c478bd9Sstevel@tonic-gate if (newtransited) 7007c478bd9Sstevel@tonic-gate free(enc_tkt_reply.transited.tr_contents.data); 7017c478bd9Sstevel@tonic-gate 7027c478bd9Sstevel@tonic-gate return retval; 7037c478bd9Sstevel@tonic-gate } 7047c478bd9Sstevel@tonic-gate 7057c478bd9Sstevel@tonic-gate static krb5_error_code 7067c478bd9Sstevel@tonic-gate prepare_error_tgs (request, ticket, error, ident, response) 7077c478bd9Sstevel@tonic-gate register krb5_kdc_req *request; 7087c478bd9Sstevel@tonic-gate krb5_ticket *ticket; 7097c478bd9Sstevel@tonic-gate int error; 7107c478bd9Sstevel@tonic-gate const char *ident; 7117c478bd9Sstevel@tonic-gate krb5_data **response; 7127c478bd9Sstevel@tonic-gate { 7137c478bd9Sstevel@tonic-gate krb5_error errpkt; 7147c478bd9Sstevel@tonic-gate krb5_error_code retval; 7157c478bd9Sstevel@tonic-gate krb5_data *scratch; 7167c478bd9Sstevel@tonic-gate 7177c478bd9Sstevel@tonic-gate errpkt.ctime = request->nonce; 7187c478bd9Sstevel@tonic-gate errpkt.cusec = 0; 7197c478bd9Sstevel@tonic-gate 7207c478bd9Sstevel@tonic-gate if ((retval = krb5_us_timeofday(kdc_context, &errpkt.stime, 7217c478bd9Sstevel@tonic-gate &errpkt.susec))) 7227c478bd9Sstevel@tonic-gate return(retval); 7237c478bd9Sstevel@tonic-gate errpkt.error = error; 7247c478bd9Sstevel@tonic-gate errpkt.server = request->server; 7257c478bd9Sstevel@tonic-gate if (ticket && ticket->enc_part2) 7267c478bd9Sstevel@tonic-gate errpkt.client = ticket->enc_part2->client; 7277c478bd9Sstevel@tonic-gate else 7287c478bd9Sstevel@tonic-gate errpkt.client = 0; 7297c478bd9Sstevel@tonic-gate errpkt.text.length = strlen(error_message(error+KRB5KDC_ERR_NONE))+1; 7307c478bd9Sstevel@tonic-gate if (!(errpkt.text.data = malloc(errpkt.text.length))) 7317c478bd9Sstevel@tonic-gate return ENOMEM; 7327c478bd9Sstevel@tonic-gate (void) strcpy(errpkt.text.data, error_message(error+KRB5KDC_ERR_NONE)); 7337c478bd9Sstevel@tonic-gate 7347c478bd9Sstevel@tonic-gate if (!(scratch = (krb5_data *)malloc(sizeof(*scratch)))) { 7357c478bd9Sstevel@tonic-gate free(errpkt.text.data); 7367c478bd9Sstevel@tonic-gate return ENOMEM; 7377c478bd9Sstevel@tonic-gate } 7387c478bd9Sstevel@tonic-gate errpkt.e_data.length = 0; 7397c478bd9Sstevel@tonic-gate errpkt.e_data.data = 0; 7407c478bd9Sstevel@tonic-gate 7417c478bd9Sstevel@tonic-gate retval = krb5_mk_error(kdc_context, &errpkt, scratch); 7427c478bd9Sstevel@tonic-gate free(errpkt.text.data); 743*6cf54e34Sbugbomb if (retval) 744*6cf54e34Sbugbomb free(scratch); 745*6cf54e34Sbugbomb else 7467c478bd9Sstevel@tonic-gate *response = scratch; 747*6cf54e34Sbugbomb 7487c478bd9Sstevel@tonic-gate return retval; 7497c478bd9Sstevel@tonic-gate } 7507c478bd9Sstevel@tonic-gate 7517c478bd9Sstevel@tonic-gate /* 7527c478bd9Sstevel@tonic-gate * The request seems to be for a ticket-granting service somewhere else, 7537c478bd9Sstevel@tonic-gate * but we don't have a ticket for the final TGS. Try to give the requestor 7547c478bd9Sstevel@tonic-gate * some intermediate realm. 7557c478bd9Sstevel@tonic-gate */ 7567c478bd9Sstevel@tonic-gate static void 7577c478bd9Sstevel@tonic-gate find_alternate_tgs(request, server, more, nprincs, from, portnum, cname) 7587c478bd9Sstevel@tonic-gate krb5_kdc_req *request; 7597c478bd9Sstevel@tonic-gate krb5_db_entry *server; 7607c478bd9Sstevel@tonic-gate krb5_boolean *more; 7617c478bd9Sstevel@tonic-gate int *nprincs; 7627c478bd9Sstevel@tonic-gate const krb5_fulladdr *from; /* who sent it ? */ 7637c478bd9Sstevel@tonic-gate int portnum; 7647c478bd9Sstevel@tonic-gate char *cname; 7657c478bd9Sstevel@tonic-gate 7667c478bd9Sstevel@tonic-gate { 7677c478bd9Sstevel@tonic-gate krb5_error_code retval; 7687c478bd9Sstevel@tonic-gate krb5_principal *plist, *pl2; 7697c478bd9Sstevel@tonic-gate krb5_data tmp; 7707c478bd9Sstevel@tonic-gate 7717c478bd9Sstevel@tonic-gate *nprincs = 0; 7727c478bd9Sstevel@tonic-gate *more = FALSE; 7737c478bd9Sstevel@tonic-gate 7747c478bd9Sstevel@tonic-gate /* 7757c478bd9Sstevel@tonic-gate * Call to krb5_princ_component is normally not safe but is so 7767c478bd9Sstevel@tonic-gate * here only because find_alternate_tgs() is only called from 7777c478bd9Sstevel@tonic-gate * somewhere that has already checked the number of components in 7787c478bd9Sstevel@tonic-gate * the principal. 7797c478bd9Sstevel@tonic-gate */ 7807c478bd9Sstevel@tonic-gate if ((retval = krb5_walk_realm_tree(kdc_context, 7817c478bd9Sstevel@tonic-gate krb5_princ_realm(kdc_context, request->server), 7827c478bd9Sstevel@tonic-gate krb5_princ_component(kdc_context, request->server, 1), 7837c478bd9Sstevel@tonic-gate &plist, KRB5_REALM_BRANCH_CHAR))) 7847c478bd9Sstevel@tonic-gate return; 7857c478bd9Sstevel@tonic-gate 7867c478bd9Sstevel@tonic-gate /* move to the end */ 7877c478bd9Sstevel@tonic-gate for (pl2 = plist; *pl2; pl2++); 7887c478bd9Sstevel@tonic-gate 7897c478bd9Sstevel@tonic-gate /* the first entry in this array is for krbtgt/local@local, so we 7907c478bd9Sstevel@tonic-gate ignore it */ 7917c478bd9Sstevel@tonic-gate while (--pl2 > plist) { 7927c478bd9Sstevel@tonic-gate *nprincs = 1; 7937c478bd9Sstevel@tonic-gate tmp = *krb5_princ_realm(kdc_context, *pl2); 7947c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, 7957c478bd9Sstevel@tonic-gate krb5_princ_realm(kdc_context, tgs_server)); 7967c478bd9Sstevel@tonic-gate retval = krb5_db_get_principal(kdc_context, *pl2, server, nprincs, more); 7977c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, &tmp); 7987c478bd9Sstevel@tonic-gate if (retval) { 7997c478bd9Sstevel@tonic-gate *nprincs = 0; 8007c478bd9Sstevel@tonic-gate *more = FALSE; 8017c478bd9Sstevel@tonic-gate krb5_free_realm_tree(kdc_context, plist); 8027c478bd9Sstevel@tonic-gate return; 8037c478bd9Sstevel@tonic-gate } 8047c478bd9Sstevel@tonic-gate if (*more) { 8057c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, server, *nprincs); 8067c478bd9Sstevel@tonic-gate continue; 8077c478bd9Sstevel@tonic-gate } else if (*nprincs == 1) { 8087c478bd9Sstevel@tonic-gate /* Found it! */ 8097c478bd9Sstevel@tonic-gate krb5_principal tmpprinc; 8107c478bd9Sstevel@tonic-gate char *sname; 8117c478bd9Sstevel@tonic-gate 8127c478bd9Sstevel@tonic-gate tmp = *krb5_princ_realm(kdc_context, *pl2); 8137c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, 8147c478bd9Sstevel@tonic-gate krb5_princ_realm(kdc_context, tgs_server)); 8157c478bd9Sstevel@tonic-gate if ((retval = krb5_copy_principal(kdc_context, *pl2, &tmpprinc))) { 8167c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, server, *nprincs); 8177c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, &tmp); 8187c478bd9Sstevel@tonic-gate continue; 8197c478bd9Sstevel@tonic-gate } 8207c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, &tmp); 8217c478bd9Sstevel@tonic-gate 8227c478bd9Sstevel@tonic-gate krb5_free_principal(kdc_context, request->server); 8237c478bd9Sstevel@tonic-gate request->server = tmpprinc; 8247c478bd9Sstevel@tonic-gate if (krb5_unparse_name(kdc_context, request->server, &sname)) { 8257c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_alt_tgt( 8267c478bd9Sstevel@tonic-gate (struct in_addr *)from->address->contents, 8277c478bd9Sstevel@tonic-gate (in_port_t)from->port, 8287c478bd9Sstevel@tonic-gate (in_port_t)portnum, cname, "<unparseable>", 0); 8297c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO, 8307c478bd9Sstevel@tonic-gate "TGS_REQ: issuing alternate <un-unparseable> TGT"); 8317c478bd9Sstevel@tonic-gate } else { 8327c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_alt_tgt( 8337c478bd9Sstevel@tonic-gate (struct in_addr *)from->address->contents, 8347c478bd9Sstevel@tonic-gate (in_port_t)from->port, 8357c478bd9Sstevel@tonic-gate (in_port_t)portnum, cname, sname, 0); 8367c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO, 8377c478bd9Sstevel@tonic-gate "TGS_REQ: issuing TGT %s", sname); 8387c478bd9Sstevel@tonic-gate free(sname); 8397c478bd9Sstevel@tonic-gate } 8407c478bd9Sstevel@tonic-gate return; 8417c478bd9Sstevel@tonic-gate } 8427c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, server, *nprincs); 8437c478bd9Sstevel@tonic-gate continue; 8447c478bd9Sstevel@tonic-gate } 8457c478bd9Sstevel@tonic-gate 8467c478bd9Sstevel@tonic-gate *nprincs = 0; 8477c478bd9Sstevel@tonic-gate *more = FALSE; 8487c478bd9Sstevel@tonic-gate krb5_free_realm_tree(kdc_context, plist); 8497c478bd9Sstevel@tonic-gate return; 8507c478bd9Sstevel@tonic-gate } 8517c478bd9Sstevel@tonic-gate 852