17c478bd9Sstevel@tonic-gate /*
2*159d09a2SMark Phalan * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
37c478bd9Sstevel@tonic-gate * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate */
57c478bd9Sstevel@tonic-gate
67c478bd9Sstevel@tonic-gate
77c478bd9Sstevel@tonic-gate /*
87c478bd9Sstevel@tonic-gate * kdc/do_tgs_req.c
97c478bd9Sstevel@tonic-gate *
1056a424ccSmp153739 * Copyright 1990,1991,2001 by the Massachusetts Institute of Technology.
117c478bd9Sstevel@tonic-gate * All Rights Reserved.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
147c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
157c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
167c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
177c478bd9Sstevel@tonic-gate *
187c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
197c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
207c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
217c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
227c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
237c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
247c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
257c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
267c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
277c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
287c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
297c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
307c478bd9Sstevel@tonic-gate * or implied warranty.
317c478bd9Sstevel@tonic-gate *
327c478bd9Sstevel@tonic-gate *
337c478bd9Sstevel@tonic-gate * KDC Routines to deal with TGS_REQ's
347c478bd9Sstevel@tonic-gate */
357c478bd9Sstevel@tonic-gate
367c478bd9Sstevel@tonic-gate #include "k5-int.h"
377c478bd9Sstevel@tonic-gate #include "com_err.h"
387c478bd9Sstevel@tonic-gate
397c478bd9Sstevel@tonic-gate #include <syslog.h>
407c478bd9Sstevel@tonic-gate #ifdef HAVE_NETINET_IN_H
417c478bd9Sstevel@tonic-gate #include <sys/types.h>
427c478bd9Sstevel@tonic-gate #include <netinet/in.h>
437c478bd9Sstevel@tonic-gate #ifndef hpux
447c478bd9Sstevel@tonic-gate #include <arpa/inet.h>
457c478bd9Sstevel@tonic-gate #endif
467c478bd9Sstevel@tonic-gate #endif
477c478bd9Sstevel@tonic-gate
487c478bd9Sstevel@tonic-gate #include "kdc_util.h"
497c478bd9Sstevel@tonic-gate #include "policy.h"
507c478bd9Sstevel@tonic-gate #include "extern.h"
517c478bd9Sstevel@tonic-gate #include "adm_proto.h"
527c478bd9Sstevel@tonic-gate
537c478bd9Sstevel@tonic-gate extern krb5_error_code setup_server_realm(krb5_principal);
547c478bd9Sstevel@tonic-gate
5556a424ccSmp153739 static void find_alternate_tgs (krb5_kdc_req *, krb5_db_entry *,
5656a424ccSmp153739 krb5_boolean *, int *,
5756a424ccSmp153739 const krb5_fulladdr *from, char *cname);
587c478bd9Sstevel@tonic-gate
5956a424ccSmp153739 static krb5_error_code prepare_error_tgs (krb5_kdc_req *, krb5_ticket *,
6056a424ccSmp153739 int, const char *, krb5_data **,
6156a424ccSmp153739 const char *);
627c478bd9Sstevel@tonic-gate
637c478bd9Sstevel@tonic-gate /*ARGSUSED*/
647c478bd9Sstevel@tonic-gate krb5_error_code
process_tgs_req(krb5_data * pkt,const krb5_fulladdr * from,krb5_data ** response)6556a424ccSmp153739 process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from,
6656a424ccSmp153739 krb5_data **response)
677c478bd9Sstevel@tonic-gate {
687c478bd9Sstevel@tonic-gate krb5_keyblock * subkey;
697c478bd9Sstevel@tonic-gate krb5_kdc_req *request = 0;
707c478bd9Sstevel@tonic-gate krb5_db_entry server;
717c478bd9Sstevel@tonic-gate krb5_kdc_rep reply;
727c478bd9Sstevel@tonic-gate krb5_enc_kdc_rep_part reply_encpart;
737c478bd9Sstevel@tonic-gate krb5_ticket ticket_reply, *header_ticket = 0;
747c478bd9Sstevel@tonic-gate int st_idx = 0;
757c478bd9Sstevel@tonic-gate krb5_enc_tkt_part enc_tkt_reply;
767c478bd9Sstevel@tonic-gate krb5_transited enc_tkt_transited;
777c478bd9Sstevel@tonic-gate int newtransited = 0;
787c478bd9Sstevel@tonic-gate krb5_error_code retval = 0;
797c478bd9Sstevel@tonic-gate int nprincs = 0;
807c478bd9Sstevel@tonic-gate krb5_boolean more;
817c478bd9Sstevel@tonic-gate krb5_timestamp kdc_time, authtime=0;
827c478bd9Sstevel@tonic-gate krb5_keyblock session_key;
837c478bd9Sstevel@tonic-gate krb5_timestamp until, rtime;
847c478bd9Sstevel@tonic-gate krb5_keyblock encrypting_key;
857c478bd9Sstevel@tonic-gate krb5_key_data *server_key;
8656a424ccSmp153739 char *cname = 0, *sname = 0, *tmp = 0;
8756a424ccSmp153739 const char *fromstring = 0;
887c478bd9Sstevel@tonic-gate krb5_last_req_entry *nolrarray[2], nolrentry;
897c478bd9Sstevel@tonic-gate /* krb5_address *noaddrarray[1]; */
907c478bd9Sstevel@tonic-gate krb5_enctype useenctype;
917c478bd9Sstevel@tonic-gate int errcode, errcode2;
927c478bd9Sstevel@tonic-gate register int i;
937c478bd9Sstevel@tonic-gate int firstpass = 1;
947c478bd9Sstevel@tonic-gate const char *status = 0;
9556a424ccSmp153739 char ktypestr[128];
9656a424ccSmp153739 char rep_etypestr[128];
9756a424ccSmp153739 char fromstringbuf[70];
987c478bd9Sstevel@tonic-gate long long tmp_server_times, tmp_realm_times;
997c478bd9Sstevel@tonic-gate
1007c478bd9Sstevel@tonic-gate (void) memset(&encrypting_key, 0, sizeof(krb5_keyblock));
1017c478bd9Sstevel@tonic-gate (void) memset(&session_key, 0, sizeof(krb5_keyblock));
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate retval = decode_krb5_tgs_req(pkt, &request);
1047c478bd9Sstevel@tonic-gate if (retval)
1057c478bd9Sstevel@tonic-gate return retval;
1067c478bd9Sstevel@tonic-gate
10756a424ccSmp153739 ktypes2str(ktypestr, sizeof(ktypestr),
10856a424ccSmp153739 request->nktypes, request->ktype);
1097c478bd9Sstevel@tonic-gate /*
1107c478bd9Sstevel@tonic-gate * setup_server_realm() sets up the global realm-specific data pointer.
1117c478bd9Sstevel@tonic-gate */
1127c478bd9Sstevel@tonic-gate if ((retval = setup_server_realm(request->server)))
1137c478bd9Sstevel@tonic-gate return retval;
1147c478bd9Sstevel@tonic-gate
11556a424ccSmp153739 fromstring = inet_ntop(ADDRTYPE2FAMILY(from->address->addrtype),
11656a424ccSmp153739 from->address->contents,
11756a424ccSmp153739 fromstringbuf, sizeof(fromstringbuf));
1187c478bd9Sstevel@tonic-gate if (!fromstring)
1197c478bd9Sstevel@tonic-gate fromstring = "<unknown>";
1207c478bd9Sstevel@tonic-gate
1217c478bd9Sstevel@tonic-gate if ((errcode = krb5_unparse_name(kdc_context, request->server, &sname))) {
1227c478bd9Sstevel@tonic-gate status = "UNPARSING SERVER";
1237c478bd9Sstevel@tonic-gate goto cleanup;
1247c478bd9Sstevel@tonic-gate }
1257c478bd9Sstevel@tonic-gate limit_string(sname);
1267c478bd9Sstevel@tonic-gate
1277c478bd9Sstevel@tonic-gate /* errcode = kdc_process_tgs_req(request, from, pkt, &req_authdat); */
1287c478bd9Sstevel@tonic-gate errcode = kdc_process_tgs_req(request, from, pkt, &header_ticket, &subkey);
1297c478bd9Sstevel@tonic-gate
1307c478bd9Sstevel@tonic-gate if (header_ticket && header_ticket->enc_part2 &&
1317c478bd9Sstevel@tonic-gate (errcode2 = krb5_unparse_name(kdc_context,
1327c478bd9Sstevel@tonic-gate header_ticket->enc_part2->client,
1337c478bd9Sstevel@tonic-gate &cname))) {
1347c478bd9Sstevel@tonic-gate status = "UNPARSING CLIENT";
1357c478bd9Sstevel@tonic-gate errcode = errcode2;
1367c478bd9Sstevel@tonic-gate goto cleanup;
1377c478bd9Sstevel@tonic-gate }
1387c478bd9Sstevel@tonic-gate limit_string(cname);
1397c478bd9Sstevel@tonic-gate
1407c478bd9Sstevel@tonic-gate if (errcode) {
1417c478bd9Sstevel@tonic-gate status = "PROCESS_TGS";
1427c478bd9Sstevel@tonic-gate goto cleanup;
1437c478bd9Sstevel@tonic-gate }
1447c478bd9Sstevel@tonic-gate
1457c478bd9Sstevel@tonic-gate if (!header_ticket) {
1467c478bd9Sstevel@tonic-gate errcode = KRB5_NO_TKT_SUPPLIED; /* XXX? */
1477c478bd9Sstevel@tonic-gate status="UNEXPECTED NULL in header_ticket";
1487c478bd9Sstevel@tonic-gate goto cleanup;
1497c478bd9Sstevel@tonic-gate }
1507c478bd9Sstevel@tonic-gate
1517c478bd9Sstevel@tonic-gate /*
1527c478bd9Sstevel@tonic-gate * We've already dealt with the AP_REQ authentication, so we can
1537c478bd9Sstevel@tonic-gate * use header_ticket freely. The encrypted part (if any) has been
1547c478bd9Sstevel@tonic-gate * decrypted with the session key.
1557c478bd9Sstevel@tonic-gate */
1567c478bd9Sstevel@tonic-gate
1577c478bd9Sstevel@tonic-gate authtime = header_ticket->enc_part2->times.authtime;
1587c478bd9Sstevel@tonic-gate
1597c478bd9Sstevel@tonic-gate /* XXX make sure server here has the proper realm...taken from AP_REQ
1607c478bd9Sstevel@tonic-gate header? */
1617c478bd9Sstevel@tonic-gate
1627c478bd9Sstevel@tonic-gate nprincs = 1;
1637c478bd9Sstevel@tonic-gate if ((errcode = krb5_db_get_principal(kdc_context, request->server, &server,
1647c478bd9Sstevel@tonic-gate &nprincs, &more))) {
1657c478bd9Sstevel@tonic-gate status = "LOOKING_UP_SERVER";
1667c478bd9Sstevel@tonic-gate nprincs = 0;
1677c478bd9Sstevel@tonic-gate goto cleanup;
1687c478bd9Sstevel@tonic-gate }
1697c478bd9Sstevel@tonic-gate tgt_again:
1707c478bd9Sstevel@tonic-gate if (more) {
1717c478bd9Sstevel@tonic-gate status = "NON_UNIQUE_PRINCIPAL";
1727c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE;
1737c478bd9Sstevel@tonic-gate goto cleanup;
1747c478bd9Sstevel@tonic-gate } else if (nprincs != 1) {
1757c478bd9Sstevel@tonic-gate /*
1767c478bd9Sstevel@tonic-gate * might be a request for a TGT for some other realm; we
1777c478bd9Sstevel@tonic-gate * should do our best to find such a TGS in this db
1787c478bd9Sstevel@tonic-gate */
1797c478bd9Sstevel@tonic-gate if (firstpass && krb5_is_tgs_principal(request->server) == TRUE) {
1807c478bd9Sstevel@tonic-gate if (krb5_princ_size(kdc_context, request->server) == 2) {
1817c478bd9Sstevel@tonic-gate krb5_data *server_1 =
1827c478bd9Sstevel@tonic-gate krb5_princ_component(kdc_context, request->server, 1);
1837c478bd9Sstevel@tonic-gate krb5_data *tgs_1 =
1847c478bd9Sstevel@tonic-gate krb5_princ_component(kdc_context, tgs_server, 1);
1857c478bd9Sstevel@tonic-gate
18656a424ccSmp153739 if (!tgs_1 || server_1->length != tgs_1->length ||
1877c478bd9Sstevel@tonic-gate memcmp(server_1->data, tgs_1->data, tgs_1->length)) {
1887c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, &server, nprincs);
1897c478bd9Sstevel@tonic-gate find_alternate_tgs(request, &server, &more, &nprincs,
19056a424ccSmp153739 from, cname);
1917c478bd9Sstevel@tonic-gate firstpass = 0;
1927c478bd9Sstevel@tonic-gate goto tgt_again;
1937c478bd9Sstevel@tonic-gate }
1947c478bd9Sstevel@tonic-gate }
1957c478bd9Sstevel@tonic-gate }
1967c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, &server, nprincs);
1977c478bd9Sstevel@tonic-gate status = "UNKNOWN_SERVER";
1987c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
1997c478bd9Sstevel@tonic-gate goto cleanup;
2007c478bd9Sstevel@tonic-gate }
2017c478bd9Sstevel@tonic-gate
2027c478bd9Sstevel@tonic-gate if ((errcode = krb5_timeofday(kdc_context, &kdc_time))) {
2037c478bd9Sstevel@tonic-gate status = "TIME_OF_DAY";
2047c478bd9Sstevel@tonic-gate goto cleanup;
2057c478bd9Sstevel@tonic-gate }
2067c478bd9Sstevel@tonic-gate
2077c478bd9Sstevel@tonic-gate if ((retval = validate_tgs_request(request, server, header_ticket,
2087c478bd9Sstevel@tonic-gate kdc_time, &status))) {
2097c478bd9Sstevel@tonic-gate if (!status)
2107c478bd9Sstevel@tonic-gate status = "UNKNOWN_REASON";
2117c478bd9Sstevel@tonic-gate errcode = retval + ERROR_TABLE_BASE_krb5;
2127c478bd9Sstevel@tonic-gate goto cleanup;
2137c478bd9Sstevel@tonic-gate }
2147c478bd9Sstevel@tonic-gate
2157c478bd9Sstevel@tonic-gate /*
2167c478bd9Sstevel@tonic-gate * We pick the session keytype here....
2177c478bd9Sstevel@tonic-gate *
2187c478bd9Sstevel@tonic-gate * Some special care needs to be taken in the user-to-user
2197c478bd9Sstevel@tonic-gate * case, since we don't know what keytypes the application server
2207c478bd9Sstevel@tonic-gate * which is doing user-to-user authentication can support. We
2217c478bd9Sstevel@tonic-gate * know that it at least must be able to support the encryption
2227c478bd9Sstevel@tonic-gate * type of the session key in the TGT, since otherwise it won't be
2237c478bd9Sstevel@tonic-gate * able to decrypt the U2U ticket! So we use that in preference
2247c478bd9Sstevel@tonic-gate * to anything else.
2257c478bd9Sstevel@tonic-gate */
2267c478bd9Sstevel@tonic-gate useenctype = 0;
2277c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) {
2287c478bd9Sstevel@tonic-gate krb5_keyblock * st_sealing_key;
2297c478bd9Sstevel@tonic-gate krb5_kvno st_srv_kvno;
2307c478bd9Sstevel@tonic-gate krb5_enctype etype;
2317c478bd9Sstevel@tonic-gate
2327c478bd9Sstevel@tonic-gate /*
2337c478bd9Sstevel@tonic-gate * Get the key for the second ticket, and decrypt it.
2347c478bd9Sstevel@tonic-gate */
2357c478bd9Sstevel@tonic-gate if ((errcode = kdc_get_server_key(request->second_ticket[st_idx],
2367c478bd9Sstevel@tonic-gate &st_sealing_key,
2377c478bd9Sstevel@tonic-gate &st_srv_kvno))) {
2387c478bd9Sstevel@tonic-gate status = "2ND_TKT_SERVER";
2397c478bd9Sstevel@tonic-gate goto cleanup;
2407c478bd9Sstevel@tonic-gate }
2417c478bd9Sstevel@tonic-gate errcode = krb5_decrypt_tkt_part(kdc_context, st_sealing_key,
2427c478bd9Sstevel@tonic-gate request->second_ticket[st_idx]);
2437c478bd9Sstevel@tonic-gate krb5_free_keyblock(kdc_context, st_sealing_key);
2447c478bd9Sstevel@tonic-gate if (errcode) {
2457c478bd9Sstevel@tonic-gate status = "2ND_TKT_DECRYPT";
2467c478bd9Sstevel@tonic-gate goto cleanup;
2477c478bd9Sstevel@tonic-gate }
2487c478bd9Sstevel@tonic-gate
2497c478bd9Sstevel@tonic-gate etype = request->second_ticket[st_idx]->enc_part2->session->enctype;
250505d05c7Sgtb if (!krb5_c_valid_enctype(etype)) {
2517c478bd9Sstevel@tonic-gate status = "BAD_ETYPE_IN_2ND_TKT";
2527c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_ETYPE_NOSUPP;
2537c478bd9Sstevel@tonic-gate goto cleanup;
2547c478bd9Sstevel@tonic-gate }
2557c478bd9Sstevel@tonic-gate
2567c478bd9Sstevel@tonic-gate for (i = 0; i < request->nktypes; i++) {
2577c478bd9Sstevel@tonic-gate if (request->ktype[i] == etype) {
2587c478bd9Sstevel@tonic-gate useenctype = etype;
2597c478bd9Sstevel@tonic-gate break;
2607c478bd9Sstevel@tonic-gate }
2617c478bd9Sstevel@tonic-gate }
2627c478bd9Sstevel@tonic-gate }
2637c478bd9Sstevel@tonic-gate
2647c478bd9Sstevel@tonic-gate /*
2657c478bd9Sstevel@tonic-gate * Select the keytype for the ticket session key.
2667c478bd9Sstevel@tonic-gate */
2677c478bd9Sstevel@tonic-gate if ((useenctype == 0) &&
2687c478bd9Sstevel@tonic-gate (useenctype = select_session_keytype(kdc_context, &server,
2697c478bd9Sstevel@tonic-gate request->nktypes,
2707c478bd9Sstevel@tonic-gate request->ktype)) == 0) {
2717c478bd9Sstevel@tonic-gate /* unsupported ktype */
2727c478bd9Sstevel@tonic-gate status = "BAD_ENCRYPTION_TYPE";
2737c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_ETYPE_NOSUPP;
2747c478bd9Sstevel@tonic-gate goto cleanup;
2757c478bd9Sstevel@tonic-gate }
2767c478bd9Sstevel@tonic-gate
2777c478bd9Sstevel@tonic-gate errcode = krb5_c_make_random_key(kdc_context, useenctype, &session_key);
2787c478bd9Sstevel@tonic-gate
2797c478bd9Sstevel@tonic-gate if (errcode) {
2807c478bd9Sstevel@tonic-gate /* random key failed */
2817c478bd9Sstevel@tonic-gate status = "RANDOM_KEY_FAILED";
2827c478bd9Sstevel@tonic-gate goto cleanup;
2837c478bd9Sstevel@tonic-gate }
2847c478bd9Sstevel@tonic-gate
2857c478bd9Sstevel@tonic-gate ticket_reply.server = request->server; /* XXX careful for realm... */
2867c478bd9Sstevel@tonic-gate
2877c478bd9Sstevel@tonic-gate enc_tkt_reply.flags = 0;
2887c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = 0;
2897c478bd9Sstevel@tonic-gate
2907c478bd9Sstevel@tonic-gate /*
2917c478bd9Sstevel@tonic-gate * Fix header_ticket's starttime; if it's zero, fill in the
2927c478bd9Sstevel@tonic-gate * authtime's value.
2937c478bd9Sstevel@tonic-gate */
2947c478bd9Sstevel@tonic-gate if (!(header_ticket->enc_part2->times.starttime))
2957c478bd9Sstevel@tonic-gate header_ticket->enc_part2->times.starttime =
2967c478bd9Sstevel@tonic-gate header_ticket->enc_part2->times.authtime;
2977c478bd9Sstevel@tonic-gate
2987c478bd9Sstevel@tonic-gate /* don't use new addresses unless forwarded, see below */
2997c478bd9Sstevel@tonic-gate
3007c478bd9Sstevel@tonic-gate enc_tkt_reply.caddrs = header_ticket->enc_part2->caddrs;
3017c478bd9Sstevel@tonic-gate /* noaddrarray[0] = 0; */
3027c478bd9Sstevel@tonic-gate reply_encpart.caddrs = 0; /* optional...don't put it in */
3037c478bd9Sstevel@tonic-gate
3047c478bd9Sstevel@tonic-gate /* It should be noted that local policy may affect the */
3057c478bd9Sstevel@tonic-gate /* processing of any of these flags. For example, some */
3067c478bd9Sstevel@tonic-gate /* realms may refuse to issue renewable tickets */
3077c478bd9Sstevel@tonic-gate
3087c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE))
3097c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_FORWARDABLE);
3107c478bd9Sstevel@tonic-gate
3117c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) {
3127c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_FORWARDED);
3137c478bd9Sstevel@tonic-gate
3147c478bd9Sstevel@tonic-gate /* include new addresses in ticket & reply */
3157c478bd9Sstevel@tonic-gate
3167c478bd9Sstevel@tonic-gate enc_tkt_reply.caddrs = request->addresses;
3177c478bd9Sstevel@tonic-gate reply_encpart.caddrs = request->addresses;
3187c478bd9Sstevel@tonic-gate }
3197c478bd9Sstevel@tonic-gate if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_FORWARDED))
3207c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_FORWARDED);
3217c478bd9Sstevel@tonic-gate
3227c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE))
3237c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_PROXIABLE);
3247c478bd9Sstevel@tonic-gate
3257c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_PROXY)) {
3267c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_PROXY);
3277c478bd9Sstevel@tonic-gate
3287c478bd9Sstevel@tonic-gate /* include new addresses in ticket & reply */
3297c478bd9Sstevel@tonic-gate
3307c478bd9Sstevel@tonic-gate enc_tkt_reply.caddrs = request->addresses;
3317c478bd9Sstevel@tonic-gate reply_encpart.caddrs = request->addresses;
3327c478bd9Sstevel@tonic-gate }
3337c478bd9Sstevel@tonic-gate
3347c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE))
3357c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_MAY_POSTDATE);
3367c478bd9Sstevel@tonic-gate
3377c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_POSTDATED)) {
3387c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_POSTDATED);
3397c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_INVALID);
3407c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = request->from;
3417c478bd9Sstevel@tonic-gate } else
3427c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = kdc_time;
3437c478bd9Sstevel@tonic-gate
3447c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_VALIDATE)) {
3457c478bd9Sstevel@tonic-gate /* BEWARE of allocation hanging off of ticket & enc_part2, it belongs
3467c478bd9Sstevel@tonic-gate to the caller */
3477c478bd9Sstevel@tonic-gate ticket_reply = *(header_ticket);
3487c478bd9Sstevel@tonic-gate enc_tkt_reply = *(header_ticket->enc_part2);
3497c478bd9Sstevel@tonic-gate clear(enc_tkt_reply.flags, TKT_FLG_INVALID);
3507c478bd9Sstevel@tonic-gate }
3517c478bd9Sstevel@tonic-gate
3527c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_RENEW)) {
3537c478bd9Sstevel@tonic-gate krb5_deltat old_life;
3547c478bd9Sstevel@tonic-gate
3557c478bd9Sstevel@tonic-gate /* BEWARE of allocation hanging off of ticket & enc_part2, it belongs
3567c478bd9Sstevel@tonic-gate to the caller */
3577c478bd9Sstevel@tonic-gate ticket_reply = *(header_ticket);
3587c478bd9Sstevel@tonic-gate enc_tkt_reply = *(header_ticket->enc_part2);
3597c478bd9Sstevel@tonic-gate
3607c478bd9Sstevel@tonic-gate old_life = enc_tkt_reply.times.endtime - enc_tkt_reply.times.starttime;
3617c478bd9Sstevel@tonic-gate
3627c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = kdc_time;
3637c478bd9Sstevel@tonic-gate enc_tkt_reply.times.endtime =
3647c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.renew_till,
3657c478bd9Sstevel@tonic-gate kdc_time + old_life);
3667c478bd9Sstevel@tonic-gate } else {
3677c478bd9Sstevel@tonic-gate /* not a renew request */
3687c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = kdc_time;
3697c478bd9Sstevel@tonic-gate until = (request->till == 0) ? kdc_infinity : request->till;
3707c478bd9Sstevel@tonic-gate
3717c478bd9Sstevel@tonic-gate /* SUNW */
3727c478bd9Sstevel@tonic-gate tmp_server_times = (long long) enc_tkt_reply.times.starttime
3737c478bd9Sstevel@tonic-gate + server.max_life;
3747c478bd9Sstevel@tonic-gate
3757c478bd9Sstevel@tonic-gate tmp_realm_times = (long long) enc_tkt_reply.times.starttime
3767c478bd9Sstevel@tonic-gate + max_life_for_realm;
3777c478bd9Sstevel@tonic-gate
3787c478bd9Sstevel@tonic-gate enc_tkt_reply.times.endtime =
3797c478bd9Sstevel@tonic-gate min(until,
3807c478bd9Sstevel@tonic-gate min(tmp_server_times,
3817c478bd9Sstevel@tonic-gate min(tmp_realm_times,
3827c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.endtime,
3837c478bd9Sstevel@tonic-gate KRB5_KDB_EXPIRATION)))); /* SUNW */
3847c478bd9Sstevel@tonic-gate /*
3857c478bd9Sstevel@tonic-gate enc_tkt_reply.times.endtime =
3867c478bd9Sstevel@tonic-gate min(until, min(enc_tkt_reply.times.starttime + server.max_life,
3877c478bd9Sstevel@tonic-gate min(enc_tkt_reply.times.starttime + max_life_for_realm,
3887c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.endtime)));
3897c478bd9Sstevel@tonic-gate */
3907c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE_OK) &&
3917c478bd9Sstevel@tonic-gate (enc_tkt_reply.times.endtime < request->till) &&
3927c478bd9Sstevel@tonic-gate isflagset(header_ticket->enc_part2->flags,
3937c478bd9Sstevel@tonic-gate TKT_FLG_RENEWABLE)) {
3947c478bd9Sstevel@tonic-gate setflag(request->kdc_options, KDC_OPT_RENEWABLE);
3957c478bd9Sstevel@tonic-gate request->rtime =
3967c478bd9Sstevel@tonic-gate min(request->till,
3977c478bd9Sstevel@tonic-gate min(KRB5_KDB_EXPIRATION,
3987c478bd9Sstevel@tonic-gate header_ticket->enc_part2->times.renew_till));
3997c478bd9Sstevel@tonic-gate }
4007c478bd9Sstevel@tonic-gate }
4017c478bd9Sstevel@tonic-gate rtime = (request->rtime == 0) ? kdc_infinity : request->rtime;
4027c478bd9Sstevel@tonic-gate
4037c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE)) {
4047c478bd9Sstevel@tonic-gate /* already checked above in policy check to reject request for a
4057c478bd9Sstevel@tonic-gate renewable ticket using a non-renewable ticket */
4067c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_RENEWABLE);
4077c478bd9Sstevel@tonic-gate tmp_realm_times = (long long) enc_tkt_reply.times.starttime +
4087c478bd9Sstevel@tonic-gate min(server.max_renewable_life,max_renewable_life_for_realm);
4097c478bd9Sstevel@tonic-gate enc_tkt_reply.times.renew_till =
4107c478bd9Sstevel@tonic-gate min(rtime,
4117c478bd9Sstevel@tonic-gate min(header_ticket->enc_part2->times.renew_till,
4127c478bd9Sstevel@tonic-gate min (tmp_realm_times, KRB5_KDB_EXPIRATION)));
4137c478bd9Sstevel@tonic-gate } else {
4147c478bd9Sstevel@tonic-gate enc_tkt_reply.times.renew_till = 0;
4157c478bd9Sstevel@tonic-gate }
4167c478bd9Sstevel@tonic-gate
4177c478bd9Sstevel@tonic-gate /*
4187c478bd9Sstevel@tonic-gate * Set authtime to be the same as header_ticket's
4197c478bd9Sstevel@tonic-gate */
4207c478bd9Sstevel@tonic-gate enc_tkt_reply.times.authtime = header_ticket->enc_part2->times.authtime;
4217c478bd9Sstevel@tonic-gate
4227c478bd9Sstevel@tonic-gate /*
4237c478bd9Sstevel@tonic-gate * Propagate the preauthentication flags through to the returned ticket.
4247c478bd9Sstevel@tonic-gate */
4257c478bd9Sstevel@tonic-gate if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_PRE_AUTH))
4267c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_PRE_AUTH);
4277c478bd9Sstevel@tonic-gate
4287c478bd9Sstevel@tonic-gate if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_HW_AUTH))
4297c478bd9Sstevel@tonic-gate setflag(enc_tkt_reply.flags, TKT_FLG_HW_AUTH);
4307c478bd9Sstevel@tonic-gate
4317c478bd9Sstevel@tonic-gate /* starttime is optional, and treated as authtime if not present.
4327c478bd9Sstevel@tonic-gate so we can nuke it if it matches */
4337c478bd9Sstevel@tonic-gate if (enc_tkt_reply.times.starttime == enc_tkt_reply.times.authtime)
4347c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = 0;
4357c478bd9Sstevel@tonic-gate
4367c478bd9Sstevel@tonic-gate /* assemble any authorization data */
4377c478bd9Sstevel@tonic-gate if (request->authorization_data.ciphertext.data) {
4387c478bd9Sstevel@tonic-gate krb5_data scratch;
4397c478bd9Sstevel@tonic-gate
4407c478bd9Sstevel@tonic-gate scratch.length = request->authorization_data.ciphertext.length;
4417c478bd9Sstevel@tonic-gate if (!(scratch.data =
4427c478bd9Sstevel@tonic-gate malloc(request->authorization_data.ciphertext.length))) {
4437c478bd9Sstevel@tonic-gate status = "AUTH_NOMEM";
4447c478bd9Sstevel@tonic-gate errcode = ENOMEM;
4457c478bd9Sstevel@tonic-gate goto cleanup;
4467c478bd9Sstevel@tonic-gate }
4477c478bd9Sstevel@tonic-gate
4487c478bd9Sstevel@tonic-gate if ((errcode = krb5_c_decrypt(kdc_context,
4497c478bd9Sstevel@tonic-gate header_ticket->enc_part2->session,
4507c478bd9Sstevel@tonic-gate KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY,
4517c478bd9Sstevel@tonic-gate 0, &request->authorization_data,
4527c478bd9Sstevel@tonic-gate &scratch))) {
4537c478bd9Sstevel@tonic-gate status = "AUTH_ENCRYPT_FAIL";
4547c478bd9Sstevel@tonic-gate free(scratch.data);
4557c478bd9Sstevel@tonic-gate goto cleanup;
4567c478bd9Sstevel@tonic-gate }
4577c478bd9Sstevel@tonic-gate
4587c478bd9Sstevel@tonic-gate /* scratch now has the authorization data, so we decode it */
4597c478bd9Sstevel@tonic-gate errcode = decode_krb5_authdata(&scratch, &(request->unenc_authdata));
4607c478bd9Sstevel@tonic-gate free(scratch.data);
4617c478bd9Sstevel@tonic-gate if (errcode) {
4627c478bd9Sstevel@tonic-gate status = "AUTH_DECODE";
4637c478bd9Sstevel@tonic-gate goto cleanup;
4647c478bd9Sstevel@tonic-gate }
4657c478bd9Sstevel@tonic-gate
4667c478bd9Sstevel@tonic-gate if ((errcode =
4677c478bd9Sstevel@tonic-gate concat_authorization_data(request->unenc_authdata,
4687c478bd9Sstevel@tonic-gate header_ticket->enc_part2->authorization_data,
4697c478bd9Sstevel@tonic-gate &enc_tkt_reply.authorization_data))) {
4707c478bd9Sstevel@tonic-gate status = "CONCAT_AUTH";
4717c478bd9Sstevel@tonic-gate goto cleanup;
4727c478bd9Sstevel@tonic-gate }
4737c478bd9Sstevel@tonic-gate } else
4747c478bd9Sstevel@tonic-gate enc_tkt_reply.authorization_data =
4757c478bd9Sstevel@tonic-gate header_ticket->enc_part2->authorization_data;
4767c478bd9Sstevel@tonic-gate
4777c478bd9Sstevel@tonic-gate enc_tkt_reply.session = &session_key;
4787c478bd9Sstevel@tonic-gate enc_tkt_reply.client = header_ticket->enc_part2->client;
4797c478bd9Sstevel@tonic-gate enc_tkt_reply.transited.tr_type = KRB5_DOMAIN_X500_COMPRESS;
4807c478bd9Sstevel@tonic-gate enc_tkt_reply.transited.tr_contents = empty_string; /* equivalent of "" */
4817c478bd9Sstevel@tonic-gate
4827c478bd9Sstevel@tonic-gate /*
4837c478bd9Sstevel@tonic-gate * Only add the realm of the presented tgt to the transited list if
4847c478bd9Sstevel@tonic-gate * it is different than the local realm (cross-realm) and it is different
4857c478bd9Sstevel@tonic-gate * than the realm of the client (since the realm of the client is already
4867c478bd9Sstevel@tonic-gate * implicitly part of the transited list and should not be explicitly
4877c478bd9Sstevel@tonic-gate * listed).
4887c478bd9Sstevel@tonic-gate */
4897c478bd9Sstevel@tonic-gate
4907c478bd9Sstevel@tonic-gate /* realm compare is like strcmp, but knows how to deal with these args */
4917c478bd9Sstevel@tonic-gate if (realm_compare(header_ticket->server, tgs_server) ||
4927c478bd9Sstevel@tonic-gate realm_compare(header_ticket->server, enc_tkt_reply.client)) {
4937c478bd9Sstevel@tonic-gate /* tgt issued by local realm or issued by realm of client */
4947c478bd9Sstevel@tonic-gate enc_tkt_reply.transited = header_ticket->enc_part2->transited;
4957c478bd9Sstevel@tonic-gate } else {
4967c478bd9Sstevel@tonic-gate /* tgt issued by some other realm and not the realm of the client */
4977c478bd9Sstevel@tonic-gate /* assemble new transited field into allocated storage */
4987c478bd9Sstevel@tonic-gate if (header_ticket->enc_part2->transited.tr_type !=
4997c478bd9Sstevel@tonic-gate KRB5_DOMAIN_X500_COMPRESS) {
5007c478bd9Sstevel@tonic-gate status = "BAD_TRTYPE";
5017c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_TRTYPE_NOSUPP;
5027c478bd9Sstevel@tonic-gate goto cleanup;
5037c478bd9Sstevel@tonic-gate }
5047c478bd9Sstevel@tonic-gate enc_tkt_transited.tr_type = KRB5_DOMAIN_X500_COMPRESS;
505*159d09a2SMark Phalan enc_tkt_transited.magic = 0;
506*159d09a2SMark Phalan enc_tkt_transited.tr_contents.magic = 0;
5077c478bd9Sstevel@tonic-gate enc_tkt_transited.tr_contents.data = 0;
5087c478bd9Sstevel@tonic-gate enc_tkt_transited.tr_contents.length = 0;
5097c478bd9Sstevel@tonic-gate enc_tkt_reply.transited = enc_tkt_transited;
5107c478bd9Sstevel@tonic-gate if ((errcode =
5117c478bd9Sstevel@tonic-gate add_to_transited(&header_ticket->enc_part2->transited.tr_contents,
5127c478bd9Sstevel@tonic-gate &enc_tkt_reply.transited.tr_contents,
5137c478bd9Sstevel@tonic-gate header_ticket->server,
5147c478bd9Sstevel@tonic-gate enc_tkt_reply.client,
5157c478bd9Sstevel@tonic-gate request->server))) {
5167c478bd9Sstevel@tonic-gate status = "ADD_TR_FAIL";
5177c478bd9Sstevel@tonic-gate goto cleanup;
5187c478bd9Sstevel@tonic-gate }
5197c478bd9Sstevel@tonic-gate newtransited = 1;
5207c478bd9Sstevel@tonic-gate }
52156a424ccSmp153739 if (!isflagset (request->kdc_options, KDC_OPT_DISABLE_TRANSITED_CHECK)) {
52246736d35Ssemery unsigned int tlen;
52346736d35Ssemery char *tdots;
52446736d35Ssemery
52556a424ccSmp153739 errcode = krb5_check_transited_list (kdc_context,
52656a424ccSmp153739 &enc_tkt_reply.transited.tr_contents,
52756a424ccSmp153739 krb5_princ_realm (kdc_context, header_ticket->enc_part2->client),
52856a424ccSmp153739 krb5_princ_realm (kdc_context, request->server));
52946736d35Ssemery tlen = enc_tkt_reply.transited.tr_contents.length;
53046736d35Ssemery tdots = tlen > 125 ? "..." : "";
53146736d35Ssemery tlen = tlen > 125 ? 125 : tlen;
53246736d35Ssemery
53356a424ccSmp153739 if (errcode == 0) {
53456a424ccSmp153739 setflag (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED);
53556a424ccSmp153739 } else if (errcode == KRB5KRB_AP_ERR_ILL_CR_TKT)
53656a424ccSmp153739 krb5_klog_syslog (LOG_INFO,
53746736d35Ssemery "bad realm transit path from '%s' to '%s' "
53846736d35Ssemery "via '%.*s%s'",
53956a424ccSmp153739 cname ? cname : "<unknown client>",
54056a424ccSmp153739 sname ? sname : "<unknown server>",
54146736d35Ssemery tlen,
54246736d35Ssemery enc_tkt_reply.transited.tr_contents.data,
54346736d35Ssemery tdots);
544*159d09a2SMark Phalan else {
545*159d09a2SMark Phalan const char *emsg = krb5_get_error_message(kdc_context, errcode);
54656a424ccSmp153739 krb5_klog_syslog (LOG_ERR,
54746736d35Ssemery "unexpected error checking transit from "
54846736d35Ssemery "'%s' to '%s' via '%.*s%s': %s",
54956a424ccSmp153739 cname ? cname : "<unknown client>",
55056a424ccSmp153739 sname ? sname : "<unknown server>",
55146736d35Ssemery tlen,
55256a424ccSmp153739 enc_tkt_reply.transited.tr_contents.data,
553*159d09a2SMark Phalan tdots, emsg);
554*159d09a2SMark Phalan krb5_free_error_message(kdc_context, emsg);
555*159d09a2SMark Phalan }
55656a424ccSmp153739 } else
55756a424ccSmp153739 krb5_klog_syslog (LOG_INFO, "not checking transit path");
55856a424ccSmp153739 if (reject_bad_transit
55956a424ccSmp153739 && !isflagset (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED)) {
56056a424ccSmp153739 errcode = KRB5KDC_ERR_POLICY;
56156a424ccSmp153739 status = "BAD_TRANSIT";
56256a424ccSmp153739 goto cleanup;
56356a424ccSmp153739 }
5647c478bd9Sstevel@tonic-gate
5657c478bd9Sstevel@tonic-gate ticket_reply.enc_part2 = &enc_tkt_reply;
5667c478bd9Sstevel@tonic-gate
5677c478bd9Sstevel@tonic-gate /*
5687c478bd9Sstevel@tonic-gate * If we are doing user-to-user authentication, then make sure
5697c478bd9Sstevel@tonic-gate * that the client for the second ticket matches the request
5707c478bd9Sstevel@tonic-gate * server, and then encrypt the ticket using the session key of
5717c478bd9Sstevel@tonic-gate * the second ticket.
5727c478bd9Sstevel@tonic-gate */
5737c478bd9Sstevel@tonic-gate if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) {
5747c478bd9Sstevel@tonic-gate /*
5757c478bd9Sstevel@tonic-gate * Make sure the client for the second ticket matches
5767c478bd9Sstevel@tonic-gate * requested server.
5777c478bd9Sstevel@tonic-gate */
57856a424ccSmp153739 krb5_enc_tkt_part *t2enc = request->second_ticket[st_idx]->enc_part2;
57956a424ccSmp153739 krb5_principal client2 = t2enc->client;
58056a424ccSmp153739 if (!krb5_principal_compare(kdc_context, request->server, client2)) {
58156a424ccSmp153739 if ((errcode = krb5_unparse_name(kdc_context, client2, &tmp)))
5827c478bd9Sstevel@tonic-gate tmp = 0;
58346736d35Ssemery if (tmp != NULL)
58446736d35Ssemery limit_string(tmp);
5857c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_2ndtktmm(
5867c478bd9Sstevel@tonic-gate (struct in_addr *)from->address->contents,
5877c478bd9Sstevel@tonic-gate (in_port_t)from->port,
58856a424ccSmp153739 0, cname, sname);
58956a424ccSmp153739 krb5_klog_syslog(LOG_INFO,
59056a424ccSmp153739 "TGS_REQ %s: 2ND_TKT_MISMATCH: "
59156a424ccSmp153739 "authtime %d, %s for %s, 2nd tkt client %s",
59256a424ccSmp153739 fromstring, authtime,
5937c478bd9Sstevel@tonic-gate cname ? cname : "<unknown client>",
5947c478bd9Sstevel@tonic-gate sname ? sname : "<unknown server>",
5957c478bd9Sstevel@tonic-gate tmp ? tmp : "<unknown>");
5967c478bd9Sstevel@tonic-gate errcode = KRB5KDC_ERR_SERVER_NOMATCH;
5977c478bd9Sstevel@tonic-gate goto cleanup;
5987c478bd9Sstevel@tonic-gate }
5997c478bd9Sstevel@tonic-gate
6007c478bd9Sstevel@tonic-gate ticket_reply.enc_part.kvno = 0;
60156a424ccSmp153739 ticket_reply.enc_part.enctype = t2enc->session->enctype;
60256a424ccSmp153739 if ((errcode = krb5_encrypt_tkt_part(kdc_context, t2enc->session,
6037c478bd9Sstevel@tonic-gate &ticket_reply))) {
6047c478bd9Sstevel@tonic-gate status = "2ND_TKT_ENCRYPT";
6057c478bd9Sstevel@tonic-gate goto cleanup;
6067c478bd9Sstevel@tonic-gate }
6077c478bd9Sstevel@tonic-gate st_idx++;
6087c478bd9Sstevel@tonic-gate } else {
6097c478bd9Sstevel@tonic-gate /*
6107c478bd9Sstevel@tonic-gate * Find the server key
6117c478bd9Sstevel@tonic-gate */
6127c478bd9Sstevel@tonic-gate if ((errcode = krb5_dbe_find_enctype(kdc_context, &server,
6137c478bd9Sstevel@tonic-gate -1, /* ignore keytype */
6147c478bd9Sstevel@tonic-gate -1, /* Ignore salttype */
6157c478bd9Sstevel@tonic-gate 0, /* Get highest kvno */
6167c478bd9Sstevel@tonic-gate &server_key))) {
6177c478bd9Sstevel@tonic-gate status = "FINDING_SERVER_KEY";
6187c478bd9Sstevel@tonic-gate goto cleanup;
6197c478bd9Sstevel@tonic-gate }
6207c478bd9Sstevel@tonic-gate /* convert server.key into a real key (it may be encrypted
6217c478bd9Sstevel@tonic-gate * in the database) */
6227c478bd9Sstevel@tonic-gate if ((errcode = krb5_dbekd_decrypt_key_data(kdc_context,
6237c478bd9Sstevel@tonic-gate &master_keyblock,
6247c478bd9Sstevel@tonic-gate server_key, &encrypting_key,
6257c478bd9Sstevel@tonic-gate NULL))) {
6267c478bd9Sstevel@tonic-gate status = "DECRYPT_SERVER_KEY";
6277c478bd9Sstevel@tonic-gate goto cleanup;
6287c478bd9Sstevel@tonic-gate }
6297c478bd9Sstevel@tonic-gate errcode = krb5_encrypt_tkt_part(kdc_context, &encrypting_key,
6307c478bd9Sstevel@tonic-gate &ticket_reply);
6317c478bd9Sstevel@tonic-gate krb5_free_keyblock_contents(kdc_context, &encrypting_key);
6327c478bd9Sstevel@tonic-gate if (errcode) {
6337c478bd9Sstevel@tonic-gate status = "TKT_ENCRYPT";
6347c478bd9Sstevel@tonic-gate goto cleanup;
6357c478bd9Sstevel@tonic-gate }
6367c478bd9Sstevel@tonic-gate ticket_reply.enc_part.kvno = server_key->key_data_kvno;
6377c478bd9Sstevel@tonic-gate }
6387c478bd9Sstevel@tonic-gate
6397c478bd9Sstevel@tonic-gate /* Start assembling the response */
6407c478bd9Sstevel@tonic-gate reply.msg_type = KRB5_TGS_REP;
6417c478bd9Sstevel@tonic-gate reply.padata = 0; /* always */
6427c478bd9Sstevel@tonic-gate reply.client = header_ticket->enc_part2->client;
6437c478bd9Sstevel@tonic-gate reply.enc_part.kvno = 0; /* We are using the session key */
6447c478bd9Sstevel@tonic-gate reply.ticket = &ticket_reply;
6457c478bd9Sstevel@tonic-gate
6467c478bd9Sstevel@tonic-gate reply_encpart.session = &session_key;
6477c478bd9Sstevel@tonic-gate reply_encpart.nonce = request->nonce;
6487c478bd9Sstevel@tonic-gate
6497c478bd9Sstevel@tonic-gate /* copy the time fields EXCEPT for authtime; its location
6507c478bd9Sstevel@tonic-gate is used for ktime */
6517c478bd9Sstevel@tonic-gate reply_encpart.times = enc_tkt_reply.times;
6527c478bd9Sstevel@tonic-gate reply_encpart.times.authtime = header_ticket->enc_part2->times.authtime;
6537c478bd9Sstevel@tonic-gate
6547c478bd9Sstevel@tonic-gate /* starttime is optional, and treated as authtime if not present.
6557c478bd9Sstevel@tonic-gate so we can nuke it if it matches */
6567c478bd9Sstevel@tonic-gate if (enc_tkt_reply.times.starttime == enc_tkt_reply.times.authtime)
6577c478bd9Sstevel@tonic-gate enc_tkt_reply.times.starttime = 0;
6587c478bd9Sstevel@tonic-gate
6597c478bd9Sstevel@tonic-gate nolrentry.lr_type = KRB5_LRQ_NONE;
6607c478bd9Sstevel@tonic-gate nolrentry.value = 0;
6617c478bd9Sstevel@tonic-gate nolrarray[0] = &nolrentry;
6627c478bd9Sstevel@tonic-gate nolrarray[1] = 0;
6637c478bd9Sstevel@tonic-gate reply_encpart.last_req = nolrarray; /* not available for TGS reqs */
6647c478bd9Sstevel@tonic-gate reply_encpart.key_exp = 0; /* ditto */
6657c478bd9Sstevel@tonic-gate reply_encpart.flags = enc_tkt_reply.flags;
6667c478bd9Sstevel@tonic-gate reply_encpart.server = ticket_reply.server;
6677c478bd9Sstevel@tonic-gate
6687c478bd9Sstevel@tonic-gate /* use the session key in the ticket, unless there's a subsession key
6697c478bd9Sstevel@tonic-gate in the AP_REQ */
6707c478bd9Sstevel@tonic-gate
6717c478bd9Sstevel@tonic-gate reply.enc_part.enctype = subkey ? subkey->enctype :
6727c478bd9Sstevel@tonic-gate header_ticket->enc_part2->session->enctype;
6737c478bd9Sstevel@tonic-gate errcode = krb5_encode_kdc_rep(kdc_context, KRB5_TGS_REP, &reply_encpart,
6747c478bd9Sstevel@tonic-gate subkey ? 1 : 0,
6757c478bd9Sstevel@tonic-gate subkey ? subkey :
6767c478bd9Sstevel@tonic-gate header_ticket->enc_part2->session,
6777c478bd9Sstevel@tonic-gate &reply, response);
6787c478bd9Sstevel@tonic-gate if (errcode) {
6797c478bd9Sstevel@tonic-gate status = "ENCODE_KDC_REP";
6807c478bd9Sstevel@tonic-gate } else {
6817c478bd9Sstevel@tonic-gate status = "ISSUE";
6827c478bd9Sstevel@tonic-gate }
6837c478bd9Sstevel@tonic-gate
6847c478bd9Sstevel@tonic-gate if (ticket_reply.enc_part.ciphertext.data) {
6857c478bd9Sstevel@tonic-gate memset(ticket_reply.enc_part.ciphertext.data, 0,
6867c478bd9Sstevel@tonic-gate ticket_reply.enc_part.ciphertext.length);
6877c478bd9Sstevel@tonic-gate free(ticket_reply.enc_part.ciphertext.data);
6887c478bd9Sstevel@tonic-gate ticket_reply.enc_part.ciphertext.data = NULL;
6897c478bd9Sstevel@tonic-gate }
6907c478bd9Sstevel@tonic-gate /* these parts are left on as a courtesy from krb5_encode_kdc_rep so we
6917c478bd9Sstevel@tonic-gate can use them in raw form if needed. But, we don't... */
6927c478bd9Sstevel@tonic-gate if (reply.enc_part.ciphertext.data) {
6937c478bd9Sstevel@tonic-gate memset(reply.enc_part.ciphertext.data, 0,
6947c478bd9Sstevel@tonic-gate reply.enc_part.ciphertext.length);
6957c478bd9Sstevel@tonic-gate free(reply.enc_part.ciphertext.data);
6967c478bd9Sstevel@tonic-gate reply.enc_part.ciphertext.data = NULL;
6977c478bd9Sstevel@tonic-gate }
6987c478bd9Sstevel@tonic-gate
6997c478bd9Sstevel@tonic-gate cleanup:
7007c478bd9Sstevel@tonic-gate if (status) {
701*159d09a2SMark Phalan const char * emsg = NULL;
7027c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req((struct in_addr *)from->address->contents,
70356a424ccSmp153739 (in_port_t)from->port, 0,
7047c478bd9Sstevel@tonic-gate cname ? cname : "<unknown client>",
7057c478bd9Sstevel@tonic-gate sname ? sname : "<unknown client>",
7067c478bd9Sstevel@tonic-gate errcode);
70756a424ccSmp153739 if (!errcode)
70856a424ccSmp153739 rep_etypes2str(rep_etypestr, sizeof(rep_etypestr), &reply);
709*159d09a2SMark Phalan if (errcode)
710*159d09a2SMark Phalan emsg = krb5_get_error_message (kdc_context, errcode);
7117c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO,
71256a424ccSmp153739 "TGS_REQ (%s) %s: %s: authtime %d, "
71356a424ccSmp153739 "%s%s %s for %s%s%s",
71456a424ccSmp153739 ktypestr,
71556a424ccSmp153739 fromstring, status, authtime,
71656a424ccSmp153739 !errcode ? rep_etypestr : "",
71756a424ccSmp153739 !errcode ? "," : "",
7187c478bd9Sstevel@tonic-gate cname ? cname : "<unknown client>",
7197c478bd9Sstevel@tonic-gate sname ? sname : "<unknown server>",
7207c478bd9Sstevel@tonic-gate errcode ? ", " : "",
721*159d09a2SMark Phalan errcode ? emsg : "");
722*159d09a2SMark Phalan if (errcode)
723*159d09a2SMark Phalan krb5_free_error_message (kdc_context, emsg);
7247c478bd9Sstevel@tonic-gate }
72556a424ccSmp153739
7267c478bd9Sstevel@tonic-gate if (errcode) {
727*159d09a2SMark Phalan int got_err = 0;
728*159d09a2SMark Phalan if (status == 0) {
729*159d09a2SMark Phalan status = krb5_get_error_message (kdc_context, errcode);
730*159d09a2SMark Phalan got_err = 1;
731*159d09a2SMark Phalan }
7327c478bd9Sstevel@tonic-gate errcode -= ERROR_TABLE_BASE_krb5;
7337c478bd9Sstevel@tonic-gate if (errcode < 0 || errcode > 128)
7347c478bd9Sstevel@tonic-gate errcode = KRB_ERR_GENERIC;
7357c478bd9Sstevel@tonic-gate
7367c478bd9Sstevel@tonic-gate retval = prepare_error_tgs(request, header_ticket, errcode,
73756a424ccSmp153739 fromstring, response, status);
738*159d09a2SMark Phalan if (got_err) {
739*159d09a2SMark Phalan krb5_free_error_message (kdc_context, status);
740*159d09a2SMark Phalan status = 0;
741*159d09a2SMark Phalan }
7427c478bd9Sstevel@tonic-gate }
7437c478bd9Sstevel@tonic-gate
7447c478bd9Sstevel@tonic-gate if (header_ticket)
7457c478bd9Sstevel@tonic-gate krb5_free_ticket(kdc_context, header_ticket);
7467c478bd9Sstevel@tonic-gate if (request)
7477c478bd9Sstevel@tonic-gate krb5_free_kdc_req(kdc_context, request);
7487c478bd9Sstevel@tonic-gate if (cname)
7497c478bd9Sstevel@tonic-gate free(cname);
7507c478bd9Sstevel@tonic-gate if (sname)
7517c478bd9Sstevel@tonic-gate free(sname);
7527c478bd9Sstevel@tonic-gate if (nprincs)
7537c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, &server, 1);
7547c478bd9Sstevel@tonic-gate if (session_key.contents)
7557c478bd9Sstevel@tonic-gate krb5_free_keyblock_contents(kdc_context, &session_key);
7567c478bd9Sstevel@tonic-gate if (newtransited)
7577c478bd9Sstevel@tonic-gate free(enc_tkt_reply.transited.tr_contents.data);
7587c478bd9Sstevel@tonic-gate
7597c478bd9Sstevel@tonic-gate return retval;
7607c478bd9Sstevel@tonic-gate }
7617c478bd9Sstevel@tonic-gate
7627c478bd9Sstevel@tonic-gate static krb5_error_code
prepare_error_tgs(krb5_kdc_req * request,krb5_ticket * ticket,int error,const char * ident,krb5_data ** response,const char * status)76356a424ccSmp153739 prepare_error_tgs (krb5_kdc_req *request, krb5_ticket *ticket, int error,
76456a424ccSmp153739 const char *ident, krb5_data **response, const char *status)
7657c478bd9Sstevel@tonic-gate {
7667c478bd9Sstevel@tonic-gate krb5_error errpkt;
7677c478bd9Sstevel@tonic-gate krb5_error_code retval;
7687c478bd9Sstevel@tonic-gate krb5_data *scratch;
7697c478bd9Sstevel@tonic-gate
7707c478bd9Sstevel@tonic-gate errpkt.ctime = request->nonce;
7717c478bd9Sstevel@tonic-gate errpkt.cusec = 0;
7727c478bd9Sstevel@tonic-gate
7737c478bd9Sstevel@tonic-gate if ((retval = krb5_us_timeofday(kdc_context, &errpkt.stime,
7747c478bd9Sstevel@tonic-gate &errpkt.susec)))
7757c478bd9Sstevel@tonic-gate return(retval);
7767c478bd9Sstevel@tonic-gate errpkt.error = error;
7777c478bd9Sstevel@tonic-gate errpkt.server = request->server;
7787c478bd9Sstevel@tonic-gate if (ticket && ticket->enc_part2)
7797c478bd9Sstevel@tonic-gate errpkt.client = ticket->enc_part2->client;
7807c478bd9Sstevel@tonic-gate else
7817c478bd9Sstevel@tonic-gate errpkt.client = 0;
78256a424ccSmp153739 errpkt.text.length = strlen(status) + 1;
7837c478bd9Sstevel@tonic-gate if (!(errpkt.text.data = malloc(errpkt.text.length)))
7847c478bd9Sstevel@tonic-gate return ENOMEM;
78556a424ccSmp153739 (void) strcpy(errpkt.text.data, status);
7867c478bd9Sstevel@tonic-gate
7877c478bd9Sstevel@tonic-gate if (!(scratch = (krb5_data *)malloc(sizeof(*scratch)))) {
7887c478bd9Sstevel@tonic-gate free(errpkt.text.data);
7897c478bd9Sstevel@tonic-gate return ENOMEM;
7907c478bd9Sstevel@tonic-gate }
7917c478bd9Sstevel@tonic-gate errpkt.e_data.length = 0;
7927c478bd9Sstevel@tonic-gate errpkt.e_data.data = 0;
7937c478bd9Sstevel@tonic-gate
7947c478bd9Sstevel@tonic-gate retval = krb5_mk_error(kdc_context, &errpkt, scratch);
7957c478bd9Sstevel@tonic-gate free(errpkt.text.data);
7966cf54e34Sbugbomb if (retval)
7976cf54e34Sbugbomb free(scratch);
7986cf54e34Sbugbomb else
7997c478bd9Sstevel@tonic-gate *response = scratch;
8006cf54e34Sbugbomb
8017c478bd9Sstevel@tonic-gate return retval;
8027c478bd9Sstevel@tonic-gate }
8037c478bd9Sstevel@tonic-gate
8047c478bd9Sstevel@tonic-gate /*
8057c478bd9Sstevel@tonic-gate * The request seems to be for a ticket-granting service somewhere else,
8067c478bd9Sstevel@tonic-gate * but we don't have a ticket for the final TGS. Try to give the requestor
8077c478bd9Sstevel@tonic-gate * some intermediate realm.
8087c478bd9Sstevel@tonic-gate */
8097c478bd9Sstevel@tonic-gate static void
find_alternate_tgs(krb5_kdc_req * request,krb5_db_entry * server,krb5_boolean * more,int * nprincs,const krb5_fulladdr * from,char * cname)81056a424ccSmp153739 find_alternate_tgs(krb5_kdc_req *request, krb5_db_entry *server,
81156a424ccSmp153739 krb5_boolean *more, int *nprincs,
81256a424ccSmp153739 const krb5_fulladdr *from, char *cname)
8137c478bd9Sstevel@tonic-gate {
8147c478bd9Sstevel@tonic-gate krb5_error_code retval;
8157c478bd9Sstevel@tonic-gate krb5_principal *plist, *pl2;
8167c478bd9Sstevel@tonic-gate krb5_data tmp;
8177c478bd9Sstevel@tonic-gate
8187c478bd9Sstevel@tonic-gate *nprincs = 0;
8197c478bd9Sstevel@tonic-gate *more = FALSE;
8207c478bd9Sstevel@tonic-gate
8217c478bd9Sstevel@tonic-gate /*
8227c478bd9Sstevel@tonic-gate * Call to krb5_princ_component is normally not safe but is so
8237c478bd9Sstevel@tonic-gate * here only because find_alternate_tgs() is only called from
8247c478bd9Sstevel@tonic-gate * somewhere that has already checked the number of components in
8257c478bd9Sstevel@tonic-gate * the principal.
8267c478bd9Sstevel@tonic-gate */
8277c478bd9Sstevel@tonic-gate if ((retval = krb5_walk_realm_tree(kdc_context,
8287c478bd9Sstevel@tonic-gate krb5_princ_realm(kdc_context, request->server),
8297c478bd9Sstevel@tonic-gate krb5_princ_component(kdc_context, request->server, 1),
8307c478bd9Sstevel@tonic-gate &plist, KRB5_REALM_BRANCH_CHAR)))
8317c478bd9Sstevel@tonic-gate return;
8327c478bd9Sstevel@tonic-gate
8337c478bd9Sstevel@tonic-gate /* move to the end */
8347c478bd9Sstevel@tonic-gate for (pl2 = plist; *pl2; pl2++);
8357c478bd9Sstevel@tonic-gate
8367c478bd9Sstevel@tonic-gate /* the first entry in this array is for krbtgt/local@local, so we
8377c478bd9Sstevel@tonic-gate ignore it */
8387c478bd9Sstevel@tonic-gate while (--pl2 > plist) {
8397c478bd9Sstevel@tonic-gate *nprincs = 1;
8407c478bd9Sstevel@tonic-gate tmp = *krb5_princ_realm(kdc_context, *pl2);
8417c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2,
8427c478bd9Sstevel@tonic-gate krb5_princ_realm(kdc_context, tgs_server));
8437c478bd9Sstevel@tonic-gate retval = krb5_db_get_principal(kdc_context, *pl2, server, nprincs, more);
8447c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, &tmp);
8457c478bd9Sstevel@tonic-gate if (retval) {
8467c478bd9Sstevel@tonic-gate *nprincs = 0;
8477c478bd9Sstevel@tonic-gate *more = FALSE;
8487c478bd9Sstevel@tonic-gate krb5_free_realm_tree(kdc_context, plist);
8497c478bd9Sstevel@tonic-gate return;
8507c478bd9Sstevel@tonic-gate }
8517c478bd9Sstevel@tonic-gate if (*more) {
8527c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, server, *nprincs);
8537c478bd9Sstevel@tonic-gate continue;
8547c478bd9Sstevel@tonic-gate } else if (*nprincs == 1) {
8557c478bd9Sstevel@tonic-gate /* Found it! */
8567c478bd9Sstevel@tonic-gate krb5_principal tmpprinc;
8577c478bd9Sstevel@tonic-gate char *sname;
8587c478bd9Sstevel@tonic-gate
8597c478bd9Sstevel@tonic-gate tmp = *krb5_princ_realm(kdc_context, *pl2);
8607c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2,
8617c478bd9Sstevel@tonic-gate krb5_princ_realm(kdc_context, tgs_server));
8627c478bd9Sstevel@tonic-gate if ((retval = krb5_copy_principal(kdc_context, *pl2, &tmpprinc))) {
8637c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, server, *nprincs);
8647c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, &tmp);
8657c478bd9Sstevel@tonic-gate continue;
8667c478bd9Sstevel@tonic-gate }
8677c478bd9Sstevel@tonic-gate krb5_princ_set_realm(kdc_context, *pl2, &tmp);
8687c478bd9Sstevel@tonic-gate
8697c478bd9Sstevel@tonic-gate krb5_free_principal(kdc_context, request->server);
8707c478bd9Sstevel@tonic-gate request->server = tmpprinc;
8717c478bd9Sstevel@tonic-gate if (krb5_unparse_name(kdc_context, request->server, &sname)) {
87256a424ccSmp153739
8737c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_alt_tgt(
8747c478bd9Sstevel@tonic-gate (struct in_addr *)from->address->contents,
8757c478bd9Sstevel@tonic-gate (in_port_t)from->port,
87656a424ccSmp153739 0, cname, "<unparseable>", 0);
8777c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO,
8787c478bd9Sstevel@tonic-gate "TGS_REQ: issuing alternate <un-unparseable> TGT");
8797c478bd9Sstevel@tonic-gate } else {
88046736d35Ssemery limit_string(sname);
8817c478bd9Sstevel@tonic-gate audit_krb5kdc_tgs_req_alt_tgt(
8827c478bd9Sstevel@tonic-gate (struct in_addr *)from->address->contents,
8837c478bd9Sstevel@tonic-gate (in_port_t)from->port,
88456a424ccSmp153739 0, cname, sname, 0);
8857c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO,
8867c478bd9Sstevel@tonic-gate "TGS_REQ: issuing TGT %s", sname);
8877c478bd9Sstevel@tonic-gate free(sname);
8887c478bd9Sstevel@tonic-gate }
8897c478bd9Sstevel@tonic-gate return;
8907c478bd9Sstevel@tonic-gate }
8917c478bd9Sstevel@tonic-gate krb5_db_free_principal(kdc_context, server, *nprincs);
8927c478bd9Sstevel@tonic-gate continue;
8937c478bd9Sstevel@tonic-gate }
8947c478bd9Sstevel@tonic-gate
8957c478bd9Sstevel@tonic-gate *nprincs = 0;
8967c478bd9Sstevel@tonic-gate *more = FALSE;
8977c478bd9Sstevel@tonic-gate krb5_free_realm_tree(kdc_context, plist);
8987c478bd9Sstevel@tonic-gate return;
8997c478bd9Sstevel@tonic-gate }
900