1 /* ssl/kssl.c -*- mode: C; c-file-style: "eay" -*- */ 2 /* Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project 2000. 3 */ 4 /* ==================================================================== 5 * Copyright (c) 2000 The OpenSSL Project. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the 17 * distribution. 18 * 19 * 3. All advertising materials mentioning features or use of this 20 * software must display the following acknowledgment: 21 * "This product includes software developed by the OpenSSL Project 22 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 23 * 24 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 25 * endorse or promote products derived from this software without 26 * prior written permission. For written permission, please contact 27 * licensing@OpenSSL.org. 28 * 29 * 5. Products derived from this software may not be called "OpenSSL" 30 * nor may "OpenSSL" appear in their names without prior written 31 * permission of the OpenSSL Project. 32 * 33 * 6. Redistributions of any form whatsoever must retain the following 34 * acknowledgment: 35 * "This product includes software developed by the OpenSSL Project 36 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 37 * 38 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 39 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 40 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 41 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 42 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 43 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 44 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 45 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 46 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 47 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 48 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 49 * OF THE POSSIBILITY OF SUCH DAMAGE. 50 * ==================================================================== 51 * 52 * This product includes cryptographic software written by Eric Young 53 * (eay@cryptsoft.com). This product includes software written by Tim 54 * Hudson (tjh@cryptsoft.com). 55 * 56 */ 57 58 59 /* ssl/kssl.c -- Routines to support (& debug) Kerberos5 auth for openssl 60 ** 61 ** 19990701 VRS Started. 62 ** 200011?? Jeffrey Altman, Richard Levitte 63 ** Generalized for Heimdal, Newer MIT, & Win32. 64 ** Integrated into main OpenSSL 0.9.7 snapshots. 65 ** 20010413 Simon Wilkinson, VRS 66 ** Real RFC2712 KerberosWrapper replaces AP_REQ. 67 */ 68 69 #include <openssl/opensslconf.h> 70 71 #include <string.h> 72 73 #define KRB5_PRIVATE 1 74 75 #include <openssl/ssl.h> 76 #include <openssl/evp.h> 77 #include <openssl/objects.h> 78 #include <openssl/krb5_asn.h> 79 #include "kssl_lcl.h" 80 81 #ifndef OPENSSL_NO_KRB5 82 83 #ifndef ENOMEM 84 #define ENOMEM KRB5KRB_ERR_GENERIC 85 #endif 86 87 /* 88 * When OpenSSL is built on Windows, we do not want to require that 89 * the Kerberos DLLs be available in order for the OpenSSL DLLs to 90 * work. Therefore, all Kerberos routines are loaded at run time 91 * and we do not link to a .LIB file. 92 */ 93 94 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) 95 /* 96 * The purpose of the following pre-processor statements is to provide 97 * compatibility with different releases of MIT Kerberos for Windows. 98 * All versions up to 1.2 used macros. But macros do not allow for 99 * a binary compatible interface for DLLs. Therefore, all macros are 100 * being replaced by function calls. The following code will allow 101 * an OpenSSL DLL built on Windows to work whether or not the macro 102 * or function form of the routines are utilized. 103 */ 104 #ifdef krb5_cc_get_principal 105 #define NO_DEF_KRB5_CCACHE 106 #undef krb5_cc_get_principal 107 #endif 108 #define krb5_cc_get_principal kssl_krb5_cc_get_principal 109 110 #define krb5_free_data_contents kssl_krb5_free_data_contents 111 #define krb5_free_context kssl_krb5_free_context 112 #define krb5_auth_con_free kssl_krb5_auth_con_free 113 #define krb5_free_principal kssl_krb5_free_principal 114 #define krb5_mk_req_extended kssl_krb5_mk_req_extended 115 #define krb5_get_credentials kssl_krb5_get_credentials 116 #define krb5_cc_default kssl_krb5_cc_default 117 #define krb5_sname_to_principal kssl_krb5_sname_to_principal 118 #define krb5_init_context kssl_krb5_init_context 119 #define krb5_free_ticket kssl_krb5_free_ticket 120 #define krb5_rd_req kssl_krb5_rd_req 121 #define krb5_kt_default kssl_krb5_kt_default 122 #define krb5_kt_resolve kssl_krb5_kt_resolve 123 /* macros in mit 1.2.2 and earlier; functions in mit 1.2.3 and greater */ 124 #ifndef krb5_kt_close 125 #define krb5_kt_close kssl_krb5_kt_close 126 #endif /* krb5_kt_close */ 127 #ifndef krb5_kt_get_entry 128 #define krb5_kt_get_entry kssl_krb5_kt_get_entry 129 #endif /* krb5_kt_get_entry */ 130 #define krb5_auth_con_init kssl_krb5_auth_con_init 131 132 #define krb5_principal_compare kssl_krb5_principal_compare 133 #define krb5_decrypt_tkt_part kssl_krb5_decrypt_tkt_part 134 #define krb5_timeofday kssl_krb5_timeofday 135 #define krb5_rc_default kssl_krb5_rc_default 136 137 #ifdef krb5_rc_initialize 138 #undef krb5_rc_initialize 139 #endif 140 #define krb5_rc_initialize kssl_krb5_rc_initialize 141 142 #ifdef krb5_rc_get_lifespan 143 #undef krb5_rc_get_lifespan 144 #endif 145 #define krb5_rc_get_lifespan kssl_krb5_rc_get_lifespan 146 147 #ifdef krb5_rc_destroy 148 #undef krb5_rc_destroy 149 #endif 150 #define krb5_rc_destroy kssl_krb5_rc_destroy 151 152 #define valid_cksumtype kssl_valid_cksumtype 153 #define krb5_checksum_size kssl_krb5_checksum_size 154 #define krb5_kt_free_entry kssl_krb5_kt_free_entry 155 #define krb5_auth_con_setrcache kssl_krb5_auth_con_setrcache 156 #define krb5_auth_con_getrcache kssl_krb5_auth_con_getrcache 157 #define krb5_get_server_rcache kssl_krb5_get_server_rcache 158 159 /* Prototypes for built in stubs */ 160 void kssl_krb5_free_data_contents(krb5_context, krb5_data *); 161 void kssl_krb5_free_principal(krb5_context, krb5_principal ); 162 krb5_error_code kssl_krb5_kt_resolve(krb5_context, 163 krb5_const char *, 164 krb5_keytab *); 165 krb5_error_code kssl_krb5_kt_default(krb5_context, 166 krb5_keytab *); 167 krb5_error_code kssl_krb5_free_ticket(krb5_context, krb5_ticket *); 168 krb5_error_code kssl_krb5_rd_req(krb5_context, krb5_auth_context *, 169 krb5_const krb5_data *, 170 krb5_const_principal, krb5_keytab, 171 krb5_flags *,krb5_ticket **); 172 173 krb5_boolean kssl_krb5_principal_compare(krb5_context, krb5_const_principal, 174 krb5_const_principal); 175 krb5_error_code kssl_krb5_mk_req_extended(krb5_context, 176 krb5_auth_context *, 177 krb5_const krb5_flags, 178 krb5_data *, 179 krb5_creds *, 180 krb5_data * ); 181 krb5_error_code kssl_krb5_init_context(krb5_context *); 182 void kssl_krb5_free_context(krb5_context); 183 krb5_error_code kssl_krb5_cc_default(krb5_context,krb5_ccache *); 184 krb5_error_code kssl_krb5_sname_to_principal(krb5_context, 185 krb5_const char *, 186 krb5_const char *, 187 krb5_int32, 188 krb5_principal *); 189 krb5_error_code kssl_krb5_get_credentials(krb5_context, 190 krb5_const krb5_flags, 191 krb5_ccache, 192 krb5_creds *, 193 krb5_creds * *); 194 krb5_error_code kssl_krb5_auth_con_init(krb5_context, 195 krb5_auth_context *); 196 krb5_error_code kssl_krb5_cc_get_principal(krb5_context context, 197 krb5_ccache cache, 198 krb5_principal *principal); 199 krb5_error_code kssl_krb5_auth_con_free(krb5_context,krb5_auth_context); 200 size_t kssl_krb5_checksum_size(krb5_context context,krb5_cksumtype ctype); 201 krb5_boolean kssl_valid_cksumtype(krb5_cksumtype ctype); 202 krb5_error_code krb5_kt_free_entry(krb5_context,krb5_keytab_entry FAR * ); 203 krb5_error_code kssl_krb5_auth_con_setrcache(krb5_context, 204 krb5_auth_context, 205 krb5_rcache); 206 krb5_error_code kssl_krb5_get_server_rcache(krb5_context, 207 krb5_const krb5_data *, 208 krb5_rcache *); 209 krb5_error_code kssl_krb5_auth_con_getrcache(krb5_context, 210 krb5_auth_context, 211 krb5_rcache *); 212 213 /* Function pointers (almost all Kerberos functions are _stdcall) */ 214 static void (_stdcall *p_krb5_free_data_contents)(krb5_context, krb5_data *) 215 =NULL; 216 static void (_stdcall *p_krb5_free_principal)(krb5_context, krb5_principal ) 217 =NULL; 218 static krb5_error_code(_stdcall *p_krb5_kt_resolve) 219 (krb5_context, krb5_const char *, krb5_keytab *)=NULL; 220 static krb5_error_code (_stdcall *p_krb5_kt_default)(krb5_context, 221 krb5_keytab *)=NULL; 222 static krb5_error_code (_stdcall *p_krb5_free_ticket)(krb5_context, 223 krb5_ticket *)=NULL; 224 static krb5_error_code (_stdcall *p_krb5_rd_req)(krb5_context, 225 krb5_auth_context *, 226 krb5_const krb5_data *, 227 krb5_const_principal, 228 krb5_keytab, krb5_flags *, 229 krb5_ticket **)=NULL; 230 static krb5_error_code (_stdcall *p_krb5_mk_req_extended) 231 (krb5_context, krb5_auth_context *, 232 krb5_const krb5_flags, krb5_data *, krb5_creds *, 233 krb5_data * )=NULL; 234 static krb5_error_code (_stdcall *p_krb5_init_context)(krb5_context *)=NULL; 235 static void (_stdcall *p_krb5_free_context)(krb5_context)=NULL; 236 static krb5_error_code (_stdcall *p_krb5_cc_default)(krb5_context, 237 krb5_ccache *)=NULL; 238 static krb5_error_code (_stdcall *p_krb5_sname_to_principal) 239 (krb5_context, krb5_const char *, krb5_const char *, 240 krb5_int32, krb5_principal *)=NULL; 241 static krb5_error_code (_stdcall *p_krb5_get_credentials) 242 (krb5_context, krb5_const krb5_flags, krb5_ccache, 243 krb5_creds *, krb5_creds **)=NULL; 244 static krb5_error_code (_stdcall *p_krb5_auth_con_init) 245 (krb5_context, krb5_auth_context *)=NULL; 246 static krb5_error_code (_stdcall *p_krb5_cc_get_principal) 247 (krb5_context context, krb5_ccache cache, 248 krb5_principal *principal)=NULL; 249 static krb5_error_code (_stdcall *p_krb5_auth_con_free) 250 (krb5_context, krb5_auth_context)=NULL; 251 static krb5_error_code (_stdcall *p_krb5_decrypt_tkt_part) 252 (krb5_context, krb5_const krb5_keyblock *, 253 krb5_ticket *)=NULL; 254 static krb5_error_code (_stdcall *p_krb5_timeofday) 255 (krb5_context context, krb5_int32 *timeret)=NULL; 256 static krb5_error_code (_stdcall *p_krb5_rc_default) 257 (krb5_context context, krb5_rcache *rc)=NULL; 258 static krb5_error_code (_stdcall *p_krb5_rc_initialize) 259 (krb5_context context, krb5_rcache rc, 260 krb5_deltat lifespan)=NULL; 261 static krb5_error_code (_stdcall *p_krb5_rc_get_lifespan) 262 (krb5_context context, krb5_rcache rc, 263 krb5_deltat *lifespan)=NULL; 264 static krb5_error_code (_stdcall *p_krb5_rc_destroy) 265 (krb5_context context, krb5_rcache rc)=NULL; 266 static krb5_boolean (_stdcall *p_krb5_principal_compare) 267 (krb5_context, krb5_const_principal, krb5_const_principal)=NULL; 268 static size_t (_stdcall *p_krb5_checksum_size)(krb5_context context,krb5_cksumtype ctype)=NULL; 269 static krb5_boolean (_stdcall *p_valid_cksumtype)(krb5_cksumtype ctype)=NULL; 270 static krb5_error_code (_stdcall *p_krb5_kt_free_entry) 271 (krb5_context,krb5_keytab_entry * )=NULL; 272 static krb5_error_code (_stdcall * p_krb5_auth_con_setrcache)(krb5_context, 273 krb5_auth_context, 274 krb5_rcache)=NULL; 275 static krb5_error_code (_stdcall * p_krb5_get_server_rcache)(krb5_context, 276 krb5_const krb5_data *, 277 krb5_rcache *)=NULL; 278 static krb5_error_code (* p_krb5_auth_con_getrcache)(krb5_context, 279 krb5_auth_context, 280 krb5_rcache *)=NULL; 281 static krb5_error_code (_stdcall * p_krb5_kt_close)(krb5_context context, 282 krb5_keytab keytab)=NULL; 283 static krb5_error_code (_stdcall * p_krb5_kt_get_entry)(krb5_context context, 284 krb5_keytab keytab, 285 krb5_const_principal principal, krb5_kvno vno, 286 krb5_enctype enctype, krb5_keytab_entry *entry)=NULL; 287 static int krb5_loaded = 0; /* only attempt to initialize func ptrs once */ 288 289 /* Function to Load the Kerberos 5 DLL and initialize function pointers */ 290 void 291 load_krb5_dll(void) 292 { 293 HANDLE hKRB5_32; 294 295 krb5_loaded++; 296 hKRB5_32 = LoadLibrary(TEXT("KRB5_32")); 297 if (!hKRB5_32) 298 return; 299 300 (FARPROC) p_krb5_free_data_contents = 301 GetProcAddress( hKRB5_32, "krb5_free_data_contents" ); 302 (FARPROC) p_krb5_free_context = 303 GetProcAddress( hKRB5_32, "krb5_free_context" ); 304 (FARPROC) p_krb5_auth_con_free = 305 GetProcAddress( hKRB5_32, "krb5_auth_con_free" ); 306 (FARPROC) p_krb5_free_principal = 307 GetProcAddress( hKRB5_32, "krb5_free_principal" ); 308 (FARPROC) p_krb5_mk_req_extended = 309 GetProcAddress( hKRB5_32, "krb5_mk_req_extended" ); 310 (FARPROC) p_krb5_get_credentials = 311 GetProcAddress( hKRB5_32, "krb5_get_credentials" ); 312 (FARPROC) p_krb5_cc_get_principal = 313 GetProcAddress( hKRB5_32, "krb5_cc_get_principal" ); 314 (FARPROC) p_krb5_cc_default = 315 GetProcAddress( hKRB5_32, "krb5_cc_default" ); 316 (FARPROC) p_krb5_sname_to_principal = 317 GetProcAddress( hKRB5_32, "krb5_sname_to_principal" ); 318 (FARPROC) p_krb5_init_context = 319 GetProcAddress( hKRB5_32, "krb5_init_context" ); 320 (FARPROC) p_krb5_free_ticket = 321 GetProcAddress( hKRB5_32, "krb5_free_ticket" ); 322 (FARPROC) p_krb5_rd_req = 323 GetProcAddress( hKRB5_32, "krb5_rd_req" ); 324 (FARPROC) p_krb5_principal_compare = 325 GetProcAddress( hKRB5_32, "krb5_principal_compare" ); 326 (FARPROC) p_krb5_decrypt_tkt_part = 327 GetProcAddress( hKRB5_32, "krb5_decrypt_tkt_part" ); 328 (FARPROC) p_krb5_timeofday = 329 GetProcAddress( hKRB5_32, "krb5_timeofday" ); 330 (FARPROC) p_krb5_rc_default = 331 GetProcAddress( hKRB5_32, "krb5_rc_default" ); 332 (FARPROC) p_krb5_rc_initialize = 333 GetProcAddress( hKRB5_32, "krb5_rc_initialize" ); 334 (FARPROC) p_krb5_rc_get_lifespan = 335 GetProcAddress( hKRB5_32, "krb5_rc_get_lifespan" ); 336 (FARPROC) p_krb5_rc_destroy = 337 GetProcAddress( hKRB5_32, "krb5_rc_destroy" ); 338 (FARPROC) p_krb5_kt_default = 339 GetProcAddress( hKRB5_32, "krb5_kt_default" ); 340 (FARPROC) p_krb5_kt_resolve = 341 GetProcAddress( hKRB5_32, "krb5_kt_resolve" ); 342 (FARPROC) p_krb5_auth_con_init = 343 GetProcAddress( hKRB5_32, "krb5_auth_con_init" ); 344 (FARPROC) p_valid_cksumtype = 345 GetProcAddress( hKRB5_32, "valid_cksumtype" ); 346 (FARPROC) p_krb5_checksum_size = 347 GetProcAddress( hKRB5_32, "krb5_checksum_size" ); 348 (FARPROC) p_krb5_kt_free_entry = 349 GetProcAddress( hKRB5_32, "krb5_kt_free_entry" ); 350 (FARPROC) p_krb5_auth_con_setrcache = 351 GetProcAddress( hKRB5_32, "krb5_auth_con_setrcache" ); 352 (FARPROC) p_krb5_get_server_rcache = 353 GetProcAddress( hKRB5_32, "krb5_get_server_rcache" ); 354 (FARPROC) p_krb5_auth_con_getrcache = 355 GetProcAddress( hKRB5_32, "krb5_auth_con_getrcache" ); 356 (FARPROC) p_krb5_kt_close = 357 GetProcAddress( hKRB5_32, "krb5_kt_close" ); 358 (FARPROC) p_krb5_kt_get_entry = 359 GetProcAddress( hKRB5_32, "krb5_kt_get_entry" ); 360 } 361 362 /* Stubs for each function to be dynamicly loaded */ 363 void 364 kssl_krb5_free_data_contents(krb5_context CO, krb5_data * data) 365 { 366 if (!krb5_loaded) 367 load_krb5_dll(); 368 369 if ( p_krb5_free_data_contents ) 370 p_krb5_free_data_contents(CO,data); 371 } 372 373 krb5_error_code 374 kssl_krb5_mk_req_extended (krb5_context CO, 375 krb5_auth_context * pACO, 376 krb5_const krb5_flags F, 377 krb5_data * pD1, 378 krb5_creds * pC, 379 krb5_data * pD2) 380 { 381 if (!krb5_loaded) 382 load_krb5_dll(); 383 384 if ( p_krb5_mk_req_extended ) 385 return(p_krb5_mk_req_extended(CO,pACO,F,pD1,pC,pD2)); 386 else 387 return KRB5KRB_ERR_GENERIC; 388 } 389 krb5_error_code 390 kssl_krb5_auth_con_init(krb5_context CO, 391 krb5_auth_context * pACO) 392 { 393 if (!krb5_loaded) 394 load_krb5_dll(); 395 396 if ( p_krb5_auth_con_init ) 397 return(p_krb5_auth_con_init(CO,pACO)); 398 else 399 return KRB5KRB_ERR_GENERIC; 400 } 401 krb5_error_code 402 kssl_krb5_auth_con_free (krb5_context CO, 403 krb5_auth_context ACO) 404 { 405 if (!krb5_loaded) 406 load_krb5_dll(); 407 408 if ( p_krb5_auth_con_free ) 409 return(p_krb5_auth_con_free(CO,ACO)); 410 else 411 return KRB5KRB_ERR_GENERIC; 412 } 413 krb5_error_code 414 kssl_krb5_get_credentials(krb5_context CO, 415 krb5_const krb5_flags F, 416 krb5_ccache CC, 417 krb5_creds * pCR, 418 krb5_creds ** ppCR) 419 { 420 if (!krb5_loaded) 421 load_krb5_dll(); 422 423 if ( p_krb5_get_credentials ) 424 return(p_krb5_get_credentials(CO,F,CC,pCR,ppCR)); 425 else 426 return KRB5KRB_ERR_GENERIC; 427 } 428 krb5_error_code 429 kssl_krb5_sname_to_principal(krb5_context CO, 430 krb5_const char * pC1, 431 krb5_const char * pC2, 432 krb5_int32 I, 433 krb5_principal * pPR) 434 { 435 if (!krb5_loaded) 436 load_krb5_dll(); 437 438 if ( p_krb5_sname_to_principal ) 439 return(p_krb5_sname_to_principal(CO,pC1,pC2,I,pPR)); 440 else 441 return KRB5KRB_ERR_GENERIC; 442 } 443 444 krb5_error_code 445 kssl_krb5_cc_default(krb5_context CO, 446 krb5_ccache * pCC) 447 { 448 if (!krb5_loaded) 449 load_krb5_dll(); 450 451 if ( p_krb5_cc_default ) 452 return(p_krb5_cc_default(CO,pCC)); 453 else 454 return KRB5KRB_ERR_GENERIC; 455 } 456 457 krb5_error_code 458 kssl_krb5_init_context(krb5_context * pCO) 459 { 460 if (!krb5_loaded) 461 load_krb5_dll(); 462 463 if ( p_krb5_init_context ) 464 return(p_krb5_init_context(pCO)); 465 else 466 return KRB5KRB_ERR_GENERIC; 467 } 468 469 void 470 kssl_krb5_free_context(krb5_context CO) 471 { 472 if (!krb5_loaded) 473 load_krb5_dll(); 474 475 if ( p_krb5_free_context ) 476 p_krb5_free_context(CO); 477 } 478 479 void 480 kssl_krb5_free_principal(krb5_context c, krb5_principal p) 481 { 482 if (!krb5_loaded) 483 load_krb5_dll(); 484 485 if ( p_krb5_free_principal ) 486 p_krb5_free_principal(c,p); 487 } 488 489 krb5_error_code 490 kssl_krb5_kt_resolve(krb5_context con, 491 krb5_const char * sz, 492 krb5_keytab * kt) 493 { 494 if (!krb5_loaded) 495 load_krb5_dll(); 496 497 if ( p_krb5_kt_resolve ) 498 return(p_krb5_kt_resolve(con,sz,kt)); 499 else 500 return KRB5KRB_ERR_GENERIC; 501 } 502 503 krb5_error_code 504 kssl_krb5_kt_default(krb5_context con, 505 krb5_keytab * kt) 506 { 507 if (!krb5_loaded) 508 load_krb5_dll(); 509 510 if ( p_krb5_kt_default ) 511 return(p_krb5_kt_default(con,kt)); 512 else 513 return KRB5KRB_ERR_GENERIC; 514 } 515 516 krb5_error_code 517 kssl_krb5_free_ticket(krb5_context con, 518 krb5_ticket * kt) 519 { 520 if (!krb5_loaded) 521 load_krb5_dll(); 522 523 if ( p_krb5_free_ticket ) 524 return(p_krb5_free_ticket(con,kt)); 525 else 526 return KRB5KRB_ERR_GENERIC; 527 } 528 529 krb5_error_code 530 kssl_krb5_rd_req(krb5_context con, krb5_auth_context * pacon, 531 krb5_const krb5_data * data, 532 krb5_const_principal princ, krb5_keytab keytab, 533 krb5_flags * flags, krb5_ticket ** pptkt) 534 { 535 if (!krb5_loaded) 536 load_krb5_dll(); 537 538 if ( p_krb5_rd_req ) 539 return(p_krb5_rd_req(con,pacon,data,princ,keytab,flags,pptkt)); 540 else 541 return KRB5KRB_ERR_GENERIC; 542 } 543 544 krb5_boolean 545 krb5_principal_compare(krb5_context con, krb5_const_principal princ1, 546 krb5_const_principal princ2) 547 { 548 if (!krb5_loaded) 549 load_krb5_dll(); 550 551 if ( p_krb5_principal_compare ) 552 return(p_krb5_principal_compare(con,princ1,princ2)); 553 else 554 return KRB5KRB_ERR_GENERIC; 555 } 556 557 krb5_error_code 558 krb5_decrypt_tkt_part(krb5_context con, krb5_const krb5_keyblock *keys, 559 krb5_ticket *ticket) 560 { 561 if (!krb5_loaded) 562 load_krb5_dll(); 563 564 if ( p_krb5_decrypt_tkt_part ) 565 return(p_krb5_decrypt_tkt_part(con,keys,ticket)); 566 else 567 return KRB5KRB_ERR_GENERIC; 568 } 569 570 krb5_error_code 571 krb5_timeofday(krb5_context con, krb5_int32 *timeret) 572 { 573 if (!krb5_loaded) 574 load_krb5_dll(); 575 576 if ( p_krb5_timeofday ) 577 return(p_krb5_timeofday(con,timeret)); 578 else 579 return KRB5KRB_ERR_GENERIC; 580 } 581 582 krb5_error_code 583 krb5_rc_default(krb5_context con, krb5_rcache *rc) 584 { 585 if (!krb5_loaded) 586 load_krb5_dll(); 587 588 if ( p_krb5_rc_default ) 589 return(p_krb5_rc_default(con,rc)); 590 else 591 return KRB5KRB_ERR_GENERIC; 592 } 593 594 krb5_error_code 595 krb5_rc_initialize(krb5_context con, krb5_rcache rc, krb5_deltat lifespan) 596 { 597 if (!krb5_loaded) 598 load_krb5_dll(); 599 600 if ( p_krb5_rc_initialize ) 601 return(p_krb5_rc_initialize(con, rc, lifespan)); 602 else 603 return KRB5KRB_ERR_GENERIC; 604 } 605 606 krb5_error_code 607 krb5_rc_get_lifespan(krb5_context con, krb5_rcache rc, krb5_deltat *lifespanp) 608 { 609 if (!krb5_loaded) 610 load_krb5_dll(); 611 612 if ( p_krb5_rc_get_lifespan ) 613 return(p_krb5_rc_get_lifespan(con, rc, lifespanp)); 614 else 615 return KRB5KRB_ERR_GENERIC; 616 } 617 618 krb5_error_code 619 krb5_rc_destroy(krb5_context con, krb5_rcache rc) 620 { 621 if (!krb5_loaded) 622 load_krb5_dll(); 623 624 if ( p_krb5_rc_destroy ) 625 return(p_krb5_rc_destroy(con, rc)); 626 else 627 return KRB5KRB_ERR_GENERIC; 628 } 629 630 size_t 631 krb5_checksum_size(krb5_context context,krb5_cksumtype ctype) 632 { 633 if (!krb5_loaded) 634 load_krb5_dll(); 635 636 if ( p_krb5_checksum_size ) 637 return(p_krb5_checksum_size(context, ctype)); 638 else 639 return KRB5KRB_ERR_GENERIC; 640 } 641 642 krb5_boolean 643 valid_cksumtype(krb5_cksumtype ctype) 644 { 645 if (!krb5_loaded) 646 load_krb5_dll(); 647 648 if ( p_valid_cksumtype ) 649 return(p_valid_cksumtype(ctype)); 650 else 651 return KRB5KRB_ERR_GENERIC; 652 } 653 654 krb5_error_code 655 krb5_kt_free_entry(krb5_context con,krb5_keytab_entry * entry) 656 { 657 if (!krb5_loaded) 658 load_krb5_dll(); 659 660 if ( p_krb5_kt_free_entry ) 661 return(p_krb5_kt_free_entry(con,entry)); 662 else 663 return KRB5KRB_ERR_GENERIC; 664 } 665 666 /* Structure definitions */ 667 #ifndef NO_DEF_KRB5_CCACHE 668 #ifndef krb5_x 669 #define krb5_x(ptr,args) ((ptr)?((*(ptr)) args):(abort(),1)) 670 #define krb5_xc(ptr,args) ((ptr)?((*(ptr)) args):(abort(),(char*)0)) 671 #endif 672 673 typedef krb5_pointer krb5_cc_cursor; /* cursor for sequential lookup */ 674 675 typedef struct _krb5_ccache 676 { 677 krb5_magic magic; 678 struct _krb5_cc_ops FAR *ops; 679 krb5_pointer data; 680 } *krb5_ccache; 681 682 typedef struct _krb5_cc_ops 683 { 684 krb5_magic magic; 685 char *prefix; 686 char * (KRB5_CALLCONV *get_name) 687 (krb5_context, krb5_ccache); 688 krb5_error_code (KRB5_CALLCONV *resolve) 689 (krb5_context, krb5_ccache *, const char *); 690 krb5_error_code (KRB5_CALLCONV *gen_new) 691 (krb5_context, krb5_ccache *); 692 krb5_error_code (KRB5_CALLCONV *init) 693 (krb5_context, krb5_ccache, krb5_principal); 694 krb5_error_code (KRB5_CALLCONV *destroy) 695 (krb5_context, krb5_ccache); 696 krb5_error_code (KRB5_CALLCONV *close) 697 (krb5_context, krb5_ccache); 698 krb5_error_code (KRB5_CALLCONV *store) 699 (krb5_context, krb5_ccache, krb5_creds *); 700 krb5_error_code (KRB5_CALLCONV *retrieve) 701 (krb5_context, krb5_ccache, 702 krb5_flags, krb5_creds *, krb5_creds *); 703 krb5_error_code (KRB5_CALLCONV *get_princ) 704 (krb5_context, krb5_ccache, krb5_principal *); 705 krb5_error_code (KRB5_CALLCONV *get_first) 706 (krb5_context, krb5_ccache, krb5_cc_cursor *); 707 krb5_error_code (KRB5_CALLCONV *get_next) 708 (krb5_context, krb5_ccache, 709 krb5_cc_cursor *, krb5_creds *); 710 krb5_error_code (KRB5_CALLCONV *end_get) 711 (krb5_context, krb5_ccache, krb5_cc_cursor *); 712 krb5_error_code (KRB5_CALLCONV *remove_cred) 713 (krb5_context, krb5_ccache, 714 krb5_flags, krb5_creds *); 715 krb5_error_code (KRB5_CALLCONV *set_flags) 716 (krb5_context, krb5_ccache, krb5_flags); 717 } krb5_cc_ops; 718 #endif /* NO_DEF_KRB5_CCACHE */ 719 720 krb5_error_code 721 kssl_krb5_cc_get_principal 722 (krb5_context context, krb5_ccache cache, 723 krb5_principal *principal) 724 { 725 if ( p_krb5_cc_get_principal ) 726 return(p_krb5_cc_get_principal(context,cache,principal)); 727 else 728 return(krb5_x 729 ((cache)->ops->get_princ,(context, cache, principal))); 730 } 731 732 krb5_error_code 733 kssl_krb5_auth_con_setrcache(krb5_context con, krb5_auth_context acon, 734 krb5_rcache rcache) 735 { 736 if ( p_krb5_auth_con_setrcache ) 737 return(p_krb5_auth_con_setrcache(con,acon,rcache)); 738 else 739 return KRB5KRB_ERR_GENERIC; 740 } 741 742 krb5_error_code 743 kssl_krb5_get_server_rcache(krb5_context con, krb5_const krb5_data * data, 744 krb5_rcache * rcache) 745 { 746 if ( p_krb5_get_server_rcache ) 747 return(p_krb5_get_server_rcache(con,data,rcache)); 748 else 749 return KRB5KRB_ERR_GENERIC; 750 } 751 752 krb5_error_code 753 kssl_krb5_auth_con_getrcache(krb5_context con, krb5_auth_context acon, 754 krb5_rcache * prcache) 755 { 756 if ( p_krb5_auth_con_getrcache ) 757 return(p_krb5_auth_con_getrcache(con,acon, prcache)); 758 else 759 return KRB5KRB_ERR_GENERIC; 760 } 761 762 krb5_error_code 763 kssl_krb5_kt_close(krb5_context context, krb5_keytab keytab) 764 { 765 if ( p_krb5_kt_close ) 766 return(p_krb5_kt_close(context,keytab)); 767 else 768 return KRB5KRB_ERR_GENERIC; 769 } 770 771 krb5_error_code 772 kssl_krb5_kt_get_entry(krb5_context context, krb5_keytab keytab, 773 krb5_const_principal principal, krb5_kvno vno, 774 krb5_enctype enctype, krb5_keytab_entry *entry) 775 { 776 if ( p_krb5_kt_get_entry ) 777 return(p_krb5_kt_get_entry(context,keytab,principal,vno,enctype,entry)); 778 else 779 return KRB5KRB_ERR_GENERIC; 780 } 781 #endif /* OPENSSL_SYS_WINDOWS || OPENSSL_SYS_WIN32 */ 782 783 784 /* memory allocation functions for non-temporary storage 785 * (e.g. stuff that gets saved into the kssl context) */ 786 static void* kssl_calloc(size_t nmemb, size_t size) 787 { 788 void* p; 789 790 p=OPENSSL_malloc(nmemb*size); 791 if (p){ 792 memset(p, 0, nmemb*size); 793 } 794 return p; 795 } 796 797 #define kssl_malloc(size) OPENSSL_malloc((size)) 798 #define kssl_realloc(ptr, size) OPENSSL_realloc(ptr, size) 799 #define kssl_free(ptr) OPENSSL_free((ptr)) 800 801 802 char 803 *kstring(char *string) 804 { 805 static char *null = "[NULL]"; 806 807 return ((string == NULL)? null: string); 808 } 809 810 /* Given KRB5 enctype (basically DES or 3DES), 811 ** return closest match openssl EVP_ encryption algorithm. 812 ** Return NULL for unknown or problematic (krb5_dk_encrypt) enctypes. 813 ** Assume ENCTYPE_*_RAW (krb5_raw_encrypt) are OK. 814 */ 815 const EVP_CIPHER * 816 kssl_map_enc(krb5_enctype enctype) 817 { 818 switch (enctype) 819 { 820 case ENCTYPE_DES_HMAC_SHA1: /* EVP_des_cbc(); */ 821 case ENCTYPE_DES_CBC_CRC: 822 case ENCTYPE_DES_CBC_MD4: 823 case ENCTYPE_DES_CBC_MD5: 824 case ENCTYPE_DES_CBC_RAW: 825 return EVP_des_cbc(); 826 break; 827 case ENCTYPE_DES3_CBC_SHA1: /* EVP_des_ede3_cbc(); */ 828 case ENCTYPE_DES3_CBC_SHA: 829 case ENCTYPE_DES3_CBC_RAW: 830 return EVP_des_ede3_cbc(); 831 break; 832 default: return NULL; 833 break; 834 } 835 } 836 837 838 /* Return true:1 if p "looks like" the start of the real authenticator 839 ** described in kssl_skip_confound() below. The ASN.1 pattern is 840 ** "62 xx 30 yy" (APPLICATION-2, SEQUENCE), where xx-yy =~ 2, and 841 ** xx and yy are possibly multi-byte length fields. 842 */ 843 static int kssl_test_confound(unsigned char *p) 844 { 845 int len = 2; 846 int xx = 0, yy = 0; 847 848 if (*p++ != 0x62) return 0; 849 if (*p > 0x82) return 0; 850 switch(*p) { 851 case 0x82: p++; xx = (*p++ << 8); xx += *p++; break; 852 case 0x81: p++; xx = *p++; break; 853 case 0x80: return 0; 854 default: xx = *p++; break; 855 } 856 if (*p++ != 0x30) return 0; 857 if (*p > 0x82) return 0; 858 switch(*p) { 859 case 0x82: p++; len+=2; yy = (*p++ << 8); yy += *p++; break; 860 case 0x81: p++; len++; yy = *p++; break; 861 case 0x80: return 0; 862 default: yy = *p++; break; 863 } 864 865 return (xx - len == yy)? 1: 0; 866 } 867 868 /* Allocate, fill, and return cksumlens array of checksum lengths. 869 ** This array holds just the unique elements from the krb5_cksumarray[]. 870 ** array[n] == 0 signals end of data. 871 ** 872 ** The krb5_cksumarray[] was an internal variable that has since been 873 ** replaced by a more general method for storing the data. It should 874 ** not be used. Instead we use real API calls and make a guess for 875 ** what the highest assigned CKSUMTYPE_ constant is. As of 1.2.2 876 ** it is 0x000c (CKSUMTYPE_HMAC_SHA1_DES3). So we will use 0x0010. 877 */ 878 static size_t *populate_cksumlens(void) 879 { 880 int i, j, n; 881 static size_t *cklens = NULL; 882 883 #ifdef KRB5_MIT_OLD11 884 n = krb5_max_cksum; 885 #else 886 n = 0x0010; 887 #endif /* KRB5_MIT_OLD11 */ 888 889 #ifdef KRB5CHECKAUTH 890 if (!cklens && !(cklens = (size_t *) calloc(sizeof(int),n+1))) return NULL; 891 892 for (i=0; i < n; i++) { 893 if (!valid_cksumtype(i)) continue; /* array has holes */ 894 for (j=0; j < n; j++) { 895 if (cklens[j] == 0) { 896 cklens[j] = krb5_checksum_size(NULL,i); 897 break; /* krb5 elem was new: add */ 898 } 899 if (cklens[j] == krb5_checksum_size(NULL,i)) { 900 break; /* ignore duplicate elements */ 901 } 902 } 903 } 904 #endif /* KRB5CHECKAUTH */ 905 906 return cklens; 907 } 908 909 /* Return pointer to start of real authenticator within authenticator, or 910 ** return NULL on error. 911 ** Decrypted authenticator looks like this: 912 ** [0 or 8 byte confounder] [4-24 byte checksum] [real authent'r] 913 ** This hackery wouldn't be necessary if MIT KRB5 1.0.6 had the 914 ** krb5_auth_con_getcksumtype() function advertised in its krb5.h. 915 */ 916 unsigned char *kssl_skip_confound(krb5_enctype etype, unsigned char *a) 917 { 918 int i, conlen; 919 size_t cklen; 920 static size_t *cksumlens = NULL; 921 unsigned char *test_auth; 922 923 conlen = (etype)? 8: 0; 924 925 if (!cksumlens && !(cksumlens = populate_cksumlens())) return NULL; 926 for (i=0; (cklen = cksumlens[i]) != 0; i++) 927 { 928 test_auth = a + conlen + cklen; 929 if (kssl_test_confound(test_auth)) return test_auth; 930 } 931 932 return NULL; 933 } 934 935 936 /* Set kssl_err error info when reason text is a simple string 937 ** kssl_err = struct { int reason; char text[KSSL_ERR_MAX+1]; } 938 */ 939 void 940 kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text) 941 { 942 if (kssl_err == NULL) return; 943 944 kssl_err->reason = reason; 945 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, "%s", text); 946 return; 947 } 948 949 950 /* Display contents of krb5_data struct, for debugging 951 */ 952 void 953 print_krb5_data(char *label, krb5_data *kdata) 954 { 955 int i; 956 957 printf("%s[%d] ", label, kdata->length); 958 for (i=0; i < (int)kdata->length; i++) 959 { 960 if (0 && isprint((int) kdata->data[i])) 961 printf( "%c ", kdata->data[i]); 962 else 963 printf( "%02x ", (unsigned char) kdata->data[i]); 964 } 965 printf("\n"); 966 } 967 968 969 /* Display contents of krb5_authdata struct, for debugging 970 */ 971 void 972 print_krb5_authdata(char *label, krb5_authdata **adata) 973 { 974 if (adata == NULL) 975 { 976 printf("%s, authdata==0\n", label); 977 return; 978 } 979 printf("%s [%p]\n", label, (void *)adata); 980 #if 0 981 { 982 int i; 983 printf("%s[at%d:%d] ", label, adata->ad_type, adata->length); 984 for (i=0; i < adata->length; i++) 985 { 986 printf((isprint(adata->contents[i]))? "%c ": "%02x", 987 adata->contents[i]); 988 } 989 printf("\n"); 990 } 991 #endif 992 } 993 994 995 /* Display contents of krb5_keyblock struct, for debugging 996 */ 997 void 998 print_krb5_keyblock(char *label, krb5_keyblock *keyblk) 999 { 1000 int i; 1001 1002 if (keyblk == NULL) 1003 { 1004 printf("%s, keyblk==0\n", label); 1005 return; 1006 } 1007 #ifdef KRB5_HEIMDAL 1008 printf("%s\n\t[et%d:%d]: ", label, keyblk->keytype, 1009 keyblk->keyvalue->length); 1010 for (i=0; i < (int)keyblk->keyvalue->length; i++) 1011 { 1012 printf("%02x",(unsigned char *)(keyblk->keyvalue->contents)[i]); 1013 } 1014 printf("\n"); 1015 #else 1016 printf("%s\n\t[et%d:%d]: ", label, keyblk->enctype, keyblk->length); 1017 for (i=0; i < (int)keyblk->length; i++) 1018 { 1019 printf("%02x",keyblk->contents[i]); 1020 } 1021 printf("\n"); 1022 #endif 1023 } 1024 1025 1026 /* Display contents of krb5_principal_data struct, for debugging 1027 ** (krb5_principal is typedef'd == krb5_principal_data *) 1028 */ 1029 static void 1030 print_krb5_princ(char *label, krb5_principal_data *princ) 1031 { 1032 int i, ui, uj; 1033 1034 printf("%s principal Realm: ", label); 1035 if (princ == NULL) return; 1036 for (ui=0; ui < (int)princ->realm.length; ui++) putchar(princ->realm.data[ui]); 1037 printf(" (nametype %d) has %d strings:\n", princ->type,princ->length); 1038 for (i=0; i < (int)princ->length; i++) 1039 { 1040 printf("\t%d [%d]: ", i, princ->data[i].length); 1041 for (uj=0; uj < (int)princ->data[i].length; uj++) { 1042 putchar(princ->data[i].data[uj]); 1043 } 1044 printf("\n"); 1045 } 1046 return; 1047 } 1048 1049 1050 /* Given krb5 service (typically "kssl") and hostname in kssl_ctx, 1051 ** Return encrypted Kerberos ticket for service @ hostname. 1052 ** If authenp is non-NULL, also return encrypted authenticator, 1053 ** whose data should be freed by caller. 1054 ** (Originally was: Create Kerberos AP_REQ message for SSL Client.) 1055 ** 1056 ** 19990628 VRS Started; Returns Kerberos AP_REQ message. 1057 ** 20010409 VRS Modified for RFC2712; Returns enc tkt. 1058 ** 20010606 VRS May also return optional authenticator. 1059 */ 1060 krb5_error_code 1061 kssl_cget_tkt( /* UPDATE */ KSSL_CTX *kssl_ctx, 1062 /* OUT */ krb5_data **enc_ticketp, 1063 /* UPDATE */ krb5_data *authenp, 1064 /* OUT */ KSSL_ERR *kssl_err) 1065 { 1066 krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC; 1067 krb5_context krb5context = NULL; 1068 krb5_auth_context krb5auth_context = NULL; 1069 krb5_ccache krb5ccdef = NULL; 1070 krb5_creds krb5creds, *krb5credsp = NULL; 1071 krb5_data krb5_app_req; 1072 1073 kssl_err_set(kssl_err, 0, ""); 1074 memset((char *)&krb5creds, 0, sizeof(krb5creds)); 1075 1076 if (!kssl_ctx) 1077 { 1078 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1079 "No kssl_ctx defined.\n"); 1080 goto err; 1081 } 1082 else if (!kssl_ctx->service_host) 1083 { 1084 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1085 "kssl_ctx service_host undefined.\n"); 1086 goto err; 1087 } 1088 1089 if ((krb5rc = krb5_init_context(&krb5context)) != 0) 1090 { 1091 BIO_snprintf(kssl_err->text,KSSL_ERR_MAX, 1092 "krb5_init_context() fails: %d\n", krb5rc); 1093 kssl_err->reason = SSL_R_KRB5_C_INIT; 1094 goto err; 1095 } 1096 1097 if ((krb5rc = krb5_sname_to_principal(krb5context, 1098 kssl_ctx->service_host, 1099 (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC, 1100 KRB5_NT_SRV_HST, &krb5creds.server)) != 0) 1101 { 1102 BIO_snprintf(kssl_err->text,KSSL_ERR_MAX, 1103 "krb5_sname_to_principal() fails for %s/%s\n", 1104 kssl_ctx->service_host, 1105 (kssl_ctx->service_name)? kssl_ctx->service_name: 1106 KRB5SVC); 1107 kssl_err->reason = SSL_R_KRB5_C_INIT; 1108 goto err; 1109 } 1110 1111 if ((krb5rc = krb5_cc_default(krb5context, &krb5ccdef)) != 0) 1112 { 1113 kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC, 1114 "krb5_cc_default fails.\n"); 1115 goto err; 1116 } 1117 1118 if ((krb5rc = krb5_cc_get_principal(krb5context, krb5ccdef, 1119 &krb5creds.client)) != 0) 1120 { 1121 kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC, 1122 "krb5_cc_get_principal() fails.\n"); 1123 goto err; 1124 } 1125 1126 if ((krb5rc = krb5_get_credentials(krb5context, 0, krb5ccdef, 1127 &krb5creds, &krb5credsp)) != 0) 1128 { 1129 kssl_err_set(kssl_err, SSL_R_KRB5_C_GET_CRED, 1130 "krb5_get_credentials() fails.\n"); 1131 goto err; 1132 } 1133 1134 *enc_ticketp = &krb5credsp->ticket; 1135 #ifdef KRB5_HEIMDAL 1136 kssl_ctx->enctype = krb5credsp->session.keytype; 1137 #else 1138 kssl_ctx->enctype = krb5credsp->keyblock.enctype; 1139 #endif 1140 1141 krb5rc = KRB5KRB_ERR_GENERIC; 1142 /* caller should free data of krb5_app_req */ 1143 /* 20010406 VRS deleted for real KerberosWrapper 1144 ** 20010605 VRS reinstated to offer Authenticator to KerberosWrapper 1145 */ 1146 krb5_app_req.length = 0; 1147 if (authenp) 1148 { 1149 krb5_data krb5in_data; 1150 const unsigned char *p; 1151 long arlen; 1152 KRB5_APREQBODY *ap_req; 1153 1154 authenp->length = 0; 1155 krb5in_data.data = NULL; 1156 krb5in_data.length = 0; 1157 if ((krb5rc = krb5_mk_req_extended(krb5context, 1158 &krb5auth_context, 0, &krb5in_data, krb5credsp, 1159 &krb5_app_req)) != 0) 1160 { 1161 kssl_err_set(kssl_err, SSL_R_KRB5_C_MK_REQ, 1162 "krb5_mk_req_extended() fails.\n"); 1163 goto err; 1164 } 1165 1166 arlen = krb5_app_req.length; 1167 p = (unsigned char *)krb5_app_req.data; 1168 ap_req = (KRB5_APREQBODY *) d2i_KRB5_APREQ(NULL, &p, arlen); 1169 if (ap_req) 1170 { 1171 authenp->length = i2d_KRB5_ENCDATA( 1172 ap_req->authenticator, NULL); 1173 if (authenp->length && 1174 (authenp->data = malloc(authenp->length))) 1175 { 1176 unsigned char *adp = (unsigned char *)authenp->data; 1177 authenp->length = i2d_KRB5_ENCDATA( 1178 ap_req->authenticator, &adp); 1179 } 1180 } 1181 1182 if (ap_req) KRB5_APREQ_free((KRB5_APREQ *) ap_req); 1183 if (krb5_app_req.length) 1184 kssl_krb5_free_data_contents(krb5context,&krb5_app_req); 1185 } 1186 #ifdef KRB5_HEIMDAL 1187 if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->session)) 1188 { 1189 kssl_err_set(kssl_err, SSL_R_KRB5_C_INIT, 1190 "kssl_ctx_setkey() fails.\n"); 1191 } 1192 #else 1193 if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->keyblock)) 1194 { 1195 kssl_err_set(kssl_err, SSL_R_KRB5_C_INIT, 1196 "kssl_ctx_setkey() fails.\n"); 1197 } 1198 #endif 1199 else krb5rc = 0; 1200 1201 err: 1202 #ifdef KSSL_DEBUG 1203 kssl_ctx_show(kssl_ctx); 1204 #endif /* KSSL_DEBUG */ 1205 1206 if (krb5creds.client) krb5_free_principal(krb5context, 1207 krb5creds.client); 1208 if (krb5creds.server) krb5_free_principal(krb5context, 1209 krb5creds.server); 1210 if (krb5auth_context) krb5_auth_con_free(krb5context, 1211 krb5auth_context); 1212 if (krb5context) krb5_free_context(krb5context); 1213 return (krb5rc); 1214 } 1215 1216 1217 /* Given d2i_-decoded asn1ticket, allocate and return a new krb5_ticket. 1218 ** Return Kerberos error code and kssl_err struct on error. 1219 ** Allocates krb5_ticket and krb5_principal; caller should free these. 1220 ** 1221 ** 20010410 VRS Implemented krb5_decode_ticket() as 1222 ** old_krb5_decode_ticket(). Missing from MIT1.0.6. 1223 ** 20010615 VRS Re-cast as openssl/asn1 d2i_*() functions. 1224 ** Re-used some of the old krb5_decode_ticket() 1225 ** code here. This tkt should alloc/free just 1226 ** like the real thing. 1227 */ 1228 static krb5_error_code 1229 kssl_TKT2tkt( /* IN */ krb5_context krb5context, 1230 /* IN */ KRB5_TKTBODY *asn1ticket, 1231 /* OUT */ krb5_ticket **krb5ticket, 1232 /* OUT */ KSSL_ERR *kssl_err ) 1233 { 1234 krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC; 1235 krb5_ticket *new5ticket = NULL; 1236 ASN1_GENERALSTRING *gstr_svc, *gstr_host; 1237 1238 *krb5ticket = NULL; 1239 1240 if (asn1ticket == NULL || asn1ticket->realm == NULL || 1241 asn1ticket->sname == NULL || 1242 sk_ASN1_GENERALSTRING_num(asn1ticket->sname->namestring) < 2) 1243 { 1244 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1245 "Null field in asn1ticket.\n"); 1246 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1247 return KRB5KRB_ERR_GENERIC; 1248 } 1249 1250 if ((new5ticket = (krb5_ticket *) calloc(1, sizeof(krb5_ticket)))==NULL) 1251 { 1252 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1253 "Unable to allocate new krb5_ticket.\n"); 1254 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1255 return ENOMEM; /* or KRB5KRB_ERR_GENERIC; */ 1256 } 1257 1258 gstr_svc = sk_ASN1_GENERALSTRING_value(asn1ticket->sname->namestring, 0); 1259 gstr_host = sk_ASN1_GENERALSTRING_value(asn1ticket->sname->namestring, 1); 1260 1261 if ((krb5rc = kssl_build_principal_2(krb5context, 1262 &new5ticket->server, 1263 asn1ticket->realm->length, (char *)asn1ticket->realm->data, 1264 gstr_svc->length, (char *)gstr_svc->data, 1265 gstr_host->length, (char *)gstr_host->data)) != 0) 1266 { 1267 free(new5ticket); 1268 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1269 "Error building ticket server principal.\n"); 1270 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1271 return krb5rc; /* or KRB5KRB_ERR_GENERIC; */ 1272 } 1273 1274 krb5_princ_type(krb5context, new5ticket->server) = 1275 asn1ticket->sname->nametype->data[0]; 1276 new5ticket->enc_part.enctype = asn1ticket->encdata->etype->data[0]; 1277 new5ticket->enc_part.kvno = asn1ticket->encdata->kvno->data[0]; 1278 new5ticket->enc_part.ciphertext.length = 1279 asn1ticket->encdata->cipher->length; 1280 if ((new5ticket->enc_part.ciphertext.data = 1281 calloc(1, asn1ticket->encdata->cipher->length)) == NULL) 1282 { 1283 free(new5ticket); 1284 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1285 "Error allocating cipher in krb5ticket.\n"); 1286 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1287 return KRB5KRB_ERR_GENERIC; 1288 } 1289 else 1290 { 1291 memcpy(new5ticket->enc_part.ciphertext.data, 1292 asn1ticket->encdata->cipher->data, 1293 asn1ticket->encdata->cipher->length); 1294 } 1295 1296 *krb5ticket = new5ticket; 1297 return 0; 1298 } 1299 1300 1301 /* Given krb5 service name in KSSL_CTX *kssl_ctx (typically "kssl"), 1302 ** and krb5 AP_REQ message & message length, 1303 ** Return Kerberos session key and client principle 1304 ** to SSL Server in KSSL_CTX *kssl_ctx. 1305 ** 1306 ** 19990702 VRS Started. 1307 */ 1308 krb5_error_code 1309 kssl_sget_tkt( /* UPDATE */ KSSL_CTX *kssl_ctx, 1310 /* IN */ krb5_data *indata, 1311 /* OUT */ krb5_ticket_times *ttimes, 1312 /* OUT */ KSSL_ERR *kssl_err ) 1313 { 1314 krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC; 1315 static krb5_context krb5context = NULL; 1316 static krb5_auth_context krb5auth_context = NULL; 1317 krb5_ticket *krb5ticket = NULL; 1318 KRB5_TKTBODY *asn1ticket = NULL; 1319 const unsigned char *p; 1320 krb5_keytab krb5keytab = NULL; 1321 krb5_keytab_entry kt_entry; 1322 krb5_principal krb5server; 1323 krb5_rcache rcache = NULL; 1324 1325 kssl_err_set(kssl_err, 0, ""); 1326 1327 if (!kssl_ctx) 1328 { 1329 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1330 "No kssl_ctx defined.\n"); 1331 goto err; 1332 } 1333 1334 #ifdef KSSL_DEBUG 1335 printf("in kssl_sget_tkt(%s)\n", kstring(kssl_ctx->service_name)); 1336 #endif /* KSSL_DEBUG */ 1337 1338 if (!krb5context && (krb5rc = krb5_init_context(&krb5context))) 1339 { 1340 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1341 "krb5_init_context() fails.\n"); 1342 goto err; 1343 } 1344 if (krb5auth_context && 1345 (krb5rc = krb5_auth_con_free(krb5context, krb5auth_context))) 1346 { 1347 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1348 "krb5_auth_con_free() fails.\n"); 1349 goto err; 1350 } 1351 else krb5auth_context = NULL; 1352 if (!krb5auth_context && 1353 (krb5rc = krb5_auth_con_init(krb5context, &krb5auth_context))) 1354 { 1355 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1356 "krb5_auth_con_init() fails.\n"); 1357 goto err; 1358 } 1359 1360 1361 if ((krb5rc = krb5_auth_con_getrcache(krb5context, krb5auth_context, 1362 &rcache))) 1363 { 1364 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1365 "krb5_auth_con_getrcache() fails.\n"); 1366 goto err; 1367 } 1368 1369 if ((krb5rc = krb5_sname_to_principal(krb5context, NULL, 1370 (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC, 1371 KRB5_NT_SRV_HST, &krb5server)) != 0) 1372 { 1373 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1374 "krb5_sname_to_principal() fails.\n"); 1375 goto err; 1376 } 1377 1378 if (rcache == NULL) 1379 { 1380 if ((krb5rc = krb5_get_server_rcache(krb5context, 1381 krb5_princ_component(krb5context, krb5server, 0), 1382 &rcache))) 1383 { 1384 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1385 "krb5_get_server_rcache() fails.\n"); 1386 goto err; 1387 } 1388 } 1389 1390 if ((krb5rc = krb5_auth_con_setrcache(krb5context, krb5auth_context, rcache))) 1391 { 1392 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1393 "krb5_auth_con_setrcache() fails.\n"); 1394 goto err; 1395 } 1396 1397 1398 /* kssl_ctx->keytab_file == NULL ==> use Kerberos default 1399 */ 1400 if (kssl_ctx->keytab_file) 1401 { 1402 krb5rc = krb5_kt_resolve(krb5context, kssl_ctx->keytab_file, 1403 &krb5keytab); 1404 if (krb5rc) 1405 { 1406 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1407 "krb5_kt_resolve() fails.\n"); 1408 goto err; 1409 } 1410 } 1411 else 1412 { 1413 krb5rc = krb5_kt_default(krb5context,&krb5keytab); 1414 if (krb5rc) 1415 { 1416 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 1417 "krb5_kt_default() fails.\n"); 1418 goto err; 1419 } 1420 } 1421 1422 /* Actual Kerberos5 krb5_recvauth() has initial conversation here 1423 ** o check KRB5_SENDAUTH_BADAUTHVERS 1424 ** unless KRB5_RECVAUTH_SKIP_VERSION 1425 ** o check KRB5_SENDAUTH_BADAPPLVERS 1426 ** o send "0" msg if all OK 1427 */ 1428 1429 /* 20010411 was using AP_REQ instead of true KerberosWrapper 1430 ** 1431 ** if ((krb5rc = krb5_rd_req(krb5context, &krb5auth_context, 1432 ** &krb5in_data, krb5server, krb5keytab, 1433 ** &ap_option, &krb5ticket)) != 0) { Error } 1434 */ 1435 1436 p = (unsigned char *)indata->data; 1437 if ((asn1ticket = (KRB5_TKTBODY *) d2i_KRB5_TICKET(NULL, &p, 1438 (long) indata->length)) == NULL) 1439 { 1440 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1441 "d2i_KRB5_TICKET() ASN.1 decode failure.\n"); 1442 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1443 goto err; 1444 } 1445 1446 /* Was: krb5rc = krb5_decode_ticket(krb5in_data,&krb5ticket)) != 0) */ 1447 if ((krb5rc = kssl_TKT2tkt(krb5context, asn1ticket, &krb5ticket, 1448 kssl_err)) != 0) 1449 { 1450 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1451 "Error converting ASN.1 ticket to krb5_ticket.\n"); 1452 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1453 goto err; 1454 } 1455 1456 if (! krb5_principal_compare(krb5context, krb5server, 1457 krb5ticket->server)) { 1458 krb5rc = KRB5_PRINC_NOMATCH; 1459 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1460 "server principal != ticket principal\n"); 1461 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1462 goto err; 1463 } 1464 if ((krb5rc = krb5_kt_get_entry(krb5context, krb5keytab, 1465 krb5ticket->server, krb5ticket->enc_part.kvno, 1466 krb5ticket->enc_part.enctype, &kt_entry)) != 0) { 1467 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1468 "krb5_kt_get_entry() fails with %x.\n", krb5rc); 1469 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1470 goto err; 1471 } 1472 if ((krb5rc = krb5_decrypt_tkt_part(krb5context, &kt_entry.key, 1473 krb5ticket)) != 0) { 1474 BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, 1475 "krb5_decrypt_tkt_part() failed.\n"); 1476 kssl_err->reason = SSL_R_KRB5_S_RD_REQ; 1477 goto err; 1478 } 1479 else { 1480 krb5_kt_free_entry(krb5context, &kt_entry); 1481 #ifdef KSSL_DEBUG 1482 { 1483 int i; krb5_address **paddr = krb5ticket->enc_part2->caddrs; 1484 printf("Decrypted ticket fields:\n"); 1485 printf("\tflags: %X, transit-type: %X", 1486 krb5ticket->enc_part2->flags, 1487 krb5ticket->enc_part2->transited.tr_type); 1488 print_krb5_data("\ttransit-data: ", 1489 &(krb5ticket->enc_part2->transited.tr_contents)); 1490 printf("\tcaddrs: %p, authdata: %p\n", 1491 krb5ticket->enc_part2->caddrs, 1492 krb5ticket->enc_part2->authorization_data); 1493 if (paddr) 1494 { 1495 printf("\tcaddrs:\n"); 1496 for (i=0; paddr[i] != NULL; i++) 1497 { 1498 krb5_data d; 1499 d.length=paddr[i]->length; 1500 d.data=paddr[i]->contents; 1501 print_krb5_data("\t\tIP: ", &d); 1502 } 1503 } 1504 printf("\tstart/auth/end times: %d / %d / %d\n", 1505 krb5ticket->enc_part2->times.starttime, 1506 krb5ticket->enc_part2->times.authtime, 1507 krb5ticket->enc_part2->times.endtime); 1508 } 1509 #endif /* KSSL_DEBUG */ 1510 } 1511 1512 krb5rc = KRB5_NO_TKT_SUPPLIED; 1513 if (!krb5ticket || !krb5ticket->enc_part2 || 1514 !krb5ticket->enc_part2->client || 1515 !krb5ticket->enc_part2->client->data || 1516 !krb5ticket->enc_part2->session) 1517 { 1518 kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET, 1519 "bad ticket from krb5_rd_req.\n"); 1520 } 1521 else if (kssl_ctx_setprinc(kssl_ctx, KSSL_CLIENT, 1522 &krb5ticket->enc_part2->client->realm, 1523 krb5ticket->enc_part2->client->data, 1524 krb5ticket->enc_part2->client->length)) 1525 { 1526 kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET, 1527 "kssl_ctx_setprinc() fails.\n"); 1528 } 1529 else if (kssl_ctx_setkey(kssl_ctx, krb5ticket->enc_part2->session)) 1530 { 1531 kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET, 1532 "kssl_ctx_setkey() fails.\n"); 1533 } 1534 else if (krb5ticket->enc_part2->flags & TKT_FLG_INVALID) 1535 { 1536 krb5rc = KRB5KRB_AP_ERR_TKT_INVALID; 1537 kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET, 1538 "invalid ticket from krb5_rd_req.\n"); 1539 } 1540 else krb5rc = 0; 1541 1542 kssl_ctx->enctype = krb5ticket->enc_part.enctype; 1543 ttimes->authtime = krb5ticket->enc_part2->times.authtime; 1544 ttimes->starttime = krb5ticket->enc_part2->times.starttime; 1545 ttimes->endtime = krb5ticket->enc_part2->times.endtime; 1546 ttimes->renew_till = krb5ticket->enc_part2->times.renew_till; 1547 1548 err: 1549 #ifdef KSSL_DEBUG 1550 kssl_ctx_show(kssl_ctx); 1551 #endif /* KSSL_DEBUG */ 1552 1553 if (asn1ticket) KRB5_TICKET_free((KRB5_TICKET *) asn1ticket); 1554 if (krb5keytab) krb5_kt_close(krb5context, krb5keytab); 1555 if (krb5ticket) krb5_free_ticket(krb5context, krb5ticket); 1556 if (krb5server) krb5_free_principal(krb5context, krb5server); 1557 return (krb5rc); 1558 } 1559 1560 1561 /* Allocate & return a new kssl_ctx struct. 1562 */ 1563 KSSL_CTX * 1564 kssl_ctx_new(void) 1565 { 1566 return ((KSSL_CTX *) kssl_calloc(1, sizeof(KSSL_CTX))); 1567 } 1568 1569 1570 /* Frees a kssl_ctx struct and any allocated memory it holds. 1571 ** Returns NULL. 1572 */ 1573 KSSL_CTX * 1574 kssl_ctx_free(KSSL_CTX *kssl_ctx) 1575 { 1576 if (kssl_ctx == NULL) return kssl_ctx; 1577 1578 if (kssl_ctx->key) OPENSSL_cleanse(kssl_ctx->key, 1579 kssl_ctx->length); 1580 if (kssl_ctx->key) kssl_free(kssl_ctx->key); 1581 if (kssl_ctx->client_princ) kssl_free(kssl_ctx->client_princ); 1582 if (kssl_ctx->service_host) kssl_free(kssl_ctx->service_host); 1583 if (kssl_ctx->service_name) kssl_free(kssl_ctx->service_name); 1584 if (kssl_ctx->keytab_file) kssl_free(kssl_ctx->keytab_file); 1585 1586 kssl_free(kssl_ctx); 1587 return (KSSL_CTX *) NULL; 1588 } 1589 1590 1591 /* Given an array of (krb5_data *) entity (and optional realm), 1592 ** set the plain (char *) client_princ or service_host member 1593 ** of the kssl_ctx struct. 1594 */ 1595 krb5_error_code 1596 kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which, 1597 krb5_data *realm, krb5_data *entity, int nentities) 1598 { 1599 char **princ; 1600 int length; 1601 int i; 1602 1603 if (kssl_ctx == NULL || entity == NULL) return KSSL_CTX_ERR; 1604 1605 switch (which) 1606 { 1607 case KSSL_CLIENT: princ = &kssl_ctx->client_princ; break; 1608 case KSSL_SERVER: princ = &kssl_ctx->service_host; break; 1609 default: return KSSL_CTX_ERR; break; 1610 } 1611 if (*princ) kssl_free(*princ); 1612 1613 /* Add up all the entity->lengths */ 1614 length = 0; 1615 for (i=0; i < nentities; i++) 1616 { 1617 length += entity[i].length; 1618 } 1619 /* Add in space for the '/' character(s) (if any) */ 1620 length += nentities-1; 1621 /* Space for the ('@'+realm+NULL | NULL) */ 1622 length += ((realm)? realm->length + 2: 1); 1623 1624 if ((*princ = kssl_calloc(1, length)) == NULL) 1625 return KSSL_CTX_ERR; 1626 else 1627 { 1628 for (i = 0; i < nentities; i++) 1629 { 1630 strncat(*princ, entity[i].data, entity[i].length); 1631 if (i < nentities-1) 1632 { 1633 strcat (*princ, "/"); 1634 } 1635 } 1636 if (realm) 1637 { 1638 strcat (*princ, "@"); 1639 (void) strncat(*princ, realm->data, realm->length); 1640 } 1641 } 1642 1643 return KSSL_CTX_OK; 1644 } 1645 1646 1647 /* Set one of the plain (char *) string members of the kssl_ctx struct. 1648 ** Default values should be: 1649 ** which == KSSL_SERVICE => "khost" (KRB5SVC) 1650 ** which == KSSL_KEYTAB => "/etc/krb5.keytab" (KRB5KEYTAB) 1651 */ 1652 krb5_error_code 1653 kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text) 1654 { 1655 char **string; 1656 1657 if (!kssl_ctx) return KSSL_CTX_ERR; 1658 1659 switch (which) 1660 { 1661 case KSSL_SERVICE: string = &kssl_ctx->service_name; break; 1662 case KSSL_SERVER: string = &kssl_ctx->service_host; break; 1663 case KSSL_CLIENT: string = &kssl_ctx->client_princ; break; 1664 case KSSL_KEYTAB: string = &kssl_ctx->keytab_file; break; 1665 default: return KSSL_CTX_ERR; break; 1666 } 1667 if (*string) kssl_free(*string); 1668 1669 if (!text) 1670 { 1671 *string = '\0'; 1672 return KSSL_CTX_OK; 1673 } 1674 1675 if ((*string = kssl_calloc(1, strlen(text) + 1)) == NULL) 1676 return KSSL_CTX_ERR; 1677 else 1678 strcpy(*string, text); 1679 1680 return KSSL_CTX_OK; 1681 } 1682 1683 1684 /* Copy the Kerberos session key from a (krb5_keyblock *) to a kssl_ctx 1685 ** struct. Clear kssl_ctx->key if Kerberos session key is NULL. 1686 */ 1687 krb5_error_code 1688 kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session) 1689 { 1690 int length; 1691 krb5_enctype enctype; 1692 krb5_octet FAR *contents = NULL; 1693 1694 if (!kssl_ctx) return KSSL_CTX_ERR; 1695 1696 if (kssl_ctx->key) 1697 { 1698 OPENSSL_cleanse(kssl_ctx->key, kssl_ctx->length); 1699 kssl_free(kssl_ctx->key); 1700 } 1701 1702 if (session) 1703 { 1704 1705 #ifdef KRB5_HEIMDAL 1706 length = session->keyvalue->length; 1707 enctype = session->keytype; 1708 contents = session->keyvalue->contents; 1709 #else 1710 length = session->length; 1711 enctype = session->enctype; 1712 contents = session->contents; 1713 #endif 1714 kssl_ctx->enctype = enctype; 1715 kssl_ctx->length = length; 1716 } 1717 else 1718 { 1719 kssl_ctx->enctype = ENCTYPE_UNKNOWN; 1720 kssl_ctx->length = 0; 1721 return KSSL_CTX_OK; 1722 } 1723 1724 if ((kssl_ctx->key = 1725 (krb5_octet FAR *) kssl_calloc(1, kssl_ctx->length)) == NULL) 1726 { 1727 kssl_ctx->length = 0; 1728 return KSSL_CTX_ERR; 1729 } 1730 else 1731 memcpy(kssl_ctx->key, contents, length); 1732 1733 return KSSL_CTX_OK; 1734 } 1735 1736 1737 /* Display contents of kssl_ctx struct 1738 */ 1739 void 1740 kssl_ctx_show(KSSL_CTX *kssl_ctx) 1741 { 1742 int i; 1743 1744 printf("kssl_ctx: "); 1745 if (kssl_ctx == NULL) 1746 { 1747 printf("NULL\n"); 1748 return; 1749 } 1750 else 1751 printf("%p\n", (void *)kssl_ctx); 1752 1753 printf("\tservice:\t%s\n", 1754 (kssl_ctx->service_name)? kssl_ctx->service_name: "NULL"); 1755 printf("\tclient:\t%s\n", 1756 (kssl_ctx->client_princ)? kssl_ctx->client_princ: "NULL"); 1757 printf("\tserver:\t%s\n", 1758 (kssl_ctx->service_host)? kssl_ctx->service_host: "NULL"); 1759 printf("\tkeytab:\t%s\n", 1760 (kssl_ctx->keytab_file)? kssl_ctx->keytab_file: "NULL"); 1761 printf("\tkey [%d:%d]:\t", 1762 kssl_ctx->enctype, kssl_ctx->length); 1763 1764 for (i=0; i < kssl_ctx->length && kssl_ctx->key; i++) 1765 { 1766 printf("%02x", kssl_ctx->key[i]); 1767 } 1768 printf("\n"); 1769 return; 1770 } 1771 1772 int 1773 kssl_keytab_is_available(KSSL_CTX *kssl_ctx) 1774 { 1775 krb5_context krb5context = NULL; 1776 krb5_keytab krb5keytab = NULL; 1777 krb5_keytab_entry entry; 1778 krb5_principal princ = NULL; 1779 krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC; 1780 int rc = 0; 1781 1782 if ((krb5rc = krb5_init_context(&krb5context))) 1783 return(0); 1784 1785 /* kssl_ctx->keytab_file == NULL ==> use Kerberos default 1786 */ 1787 if (kssl_ctx->keytab_file) 1788 { 1789 krb5rc = krb5_kt_resolve(krb5context, kssl_ctx->keytab_file, 1790 &krb5keytab); 1791 if (krb5rc) 1792 goto exit; 1793 } 1794 else 1795 { 1796 krb5rc = krb5_kt_default(krb5context,&krb5keytab); 1797 if (krb5rc) 1798 goto exit; 1799 } 1800 1801 /* the host key we are looking for */ 1802 krb5rc = krb5_sname_to_principal(krb5context, NULL, 1803 kssl_ctx->service_name ? kssl_ctx->service_name: KRB5SVC, 1804 KRB5_NT_SRV_HST, &princ); 1805 1806 if (krb5rc) 1807 goto exit; 1808 1809 krb5rc = krb5_kt_get_entry(krb5context, krb5keytab, 1810 princ, 1811 0 /* IGNORE_VNO */, 1812 0 /* IGNORE_ENCTYPE */, 1813 &entry); 1814 if ( krb5rc == KRB5_KT_NOTFOUND ) { 1815 rc = 1; 1816 goto exit; 1817 } else if ( krb5rc ) 1818 goto exit; 1819 1820 krb5_kt_free_entry(krb5context, &entry); 1821 rc = 1; 1822 1823 exit: 1824 if (krb5keytab) krb5_kt_close(krb5context, krb5keytab); 1825 if (princ) krb5_free_principal(krb5context, princ); 1826 if (krb5context) krb5_free_context(krb5context); 1827 return(rc); 1828 } 1829 1830 int 1831 kssl_tgt_is_available(KSSL_CTX *kssl_ctx) 1832 { 1833 krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC; 1834 krb5_context krb5context = NULL; 1835 krb5_ccache krb5ccdef = NULL; 1836 krb5_creds krb5creds, *krb5credsp = NULL; 1837 int rc = 0; 1838 1839 memset((char *)&krb5creds, 0, sizeof(krb5creds)); 1840 1841 if (!kssl_ctx) 1842 return(0); 1843 1844 if (!kssl_ctx->service_host) 1845 return(0); 1846 1847 if ((krb5rc = krb5_init_context(&krb5context)) != 0) 1848 goto err; 1849 1850 if ((krb5rc = krb5_sname_to_principal(krb5context, 1851 kssl_ctx->service_host, 1852 (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC, 1853 KRB5_NT_SRV_HST, &krb5creds.server)) != 0) 1854 goto err; 1855 1856 if ((krb5rc = krb5_cc_default(krb5context, &krb5ccdef)) != 0) 1857 goto err; 1858 1859 if ((krb5rc = krb5_cc_get_principal(krb5context, krb5ccdef, 1860 &krb5creds.client)) != 0) 1861 goto err; 1862 1863 if ((krb5rc = krb5_get_credentials(krb5context, 0, krb5ccdef, 1864 &krb5creds, &krb5credsp)) != 0) 1865 goto err; 1866 1867 rc = 1; 1868 1869 err: 1870 #ifdef KSSL_DEBUG 1871 kssl_ctx_show(kssl_ctx); 1872 #endif /* KSSL_DEBUG */ 1873 1874 if (krb5creds.client) krb5_free_principal(krb5context, krb5creds.client); 1875 if (krb5creds.server) krb5_free_principal(krb5context, krb5creds.server); 1876 if (krb5context) krb5_free_context(krb5context); 1877 return(rc); 1878 } 1879 1880 #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_WIN32) 1881 void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data) 1882 { 1883 #ifdef KRB5_HEIMDAL 1884 data->length = 0; 1885 if (data->data) 1886 free(data->data); 1887 #elif defined(KRB5_MIT_OLD11) 1888 if (data->data) { 1889 krb5_xfree(data->data); 1890 data->data = 0; 1891 } 1892 #else 1893 krb5_free_data_contents(NULL, data); 1894 #endif 1895 } 1896 #endif /* !OPENSSL_SYS_WINDOWS && !OPENSSL_SYS_WIN32 */ 1897 1898 1899 /* Given pointers to KerberosTime and struct tm structs, convert the 1900 ** KerberosTime string to struct tm. Note that KerberosTime is a 1901 ** ASN1_GENERALIZEDTIME value, constrained to GMT with no fractional 1902 ** seconds as defined in RFC 1510. 1903 ** Return pointer to the (partially) filled in struct tm on success, 1904 ** return NULL on failure. 1905 */ 1906 static struct tm *k_gmtime(ASN1_GENERALIZEDTIME *gtime, struct tm *k_tm) 1907 { 1908 char c, *p; 1909 1910 if (!k_tm) return NULL; 1911 if (gtime == NULL || gtime->length < 14) return NULL; 1912 if (gtime->data == NULL) return NULL; 1913 1914 p = (char *)>ime->data[14]; 1915 1916 c = *p; *p = '\0'; p -= 2; k_tm->tm_sec = atoi(p); *(p+2) = c; 1917 c = *p; *p = '\0'; p -= 2; k_tm->tm_min = atoi(p); *(p+2) = c; 1918 c = *p; *p = '\0'; p -= 2; k_tm->tm_hour = atoi(p); *(p+2) = c; 1919 c = *p; *p = '\0'; p -= 2; k_tm->tm_mday = atoi(p); *(p+2) = c; 1920 c = *p; *p = '\0'; p -= 2; k_tm->tm_mon = atoi(p)-1; *(p+2) = c; 1921 c = *p; *p = '\0'; p -= 4; k_tm->tm_year = atoi(p)-1900; *(p+4) = c; 1922 1923 return k_tm; 1924 } 1925 1926 1927 /* Helper function for kssl_validate_times(). 1928 ** We need context->clockskew, but krb5_context is an opaque struct. 1929 ** So we try to sneek the clockskew out through the replay cache. 1930 ** If that fails just return a likely default (300 seconds). 1931 */ 1932 static krb5_deltat get_rc_clockskew(krb5_context context) 1933 { 1934 krb5_rcache rc; 1935 krb5_deltat clockskew; 1936 1937 if (krb5_rc_default(context, &rc)) return KSSL_CLOCKSKEW; 1938 if (krb5_rc_initialize(context, rc, 0)) return KSSL_CLOCKSKEW; 1939 if (krb5_rc_get_lifespan(context, rc, &clockskew)) { 1940 clockskew = KSSL_CLOCKSKEW; 1941 } 1942 (void) krb5_rc_destroy(context, rc); 1943 return clockskew; 1944 } 1945 1946 1947 /* kssl_validate_times() combines (and more importantly exposes) 1948 ** the MIT KRB5 internal function krb5_validate_times() and the 1949 ** in_clock_skew() macro. The authenticator client time is checked 1950 ** to be within clockskew secs of the current time and the current 1951 ** time is checked to be within the ticket start and expire times. 1952 ** Either check may be omitted by supplying a NULL value. 1953 ** Returns 0 for valid times, SSL_R_KRB5* error codes otherwise. 1954 ** See Also: (Kerberos source)/krb5/lib/krb5/krb/valid_times.c 1955 ** 20010420 VRS 1956 */ 1957 krb5_error_code kssl_validate_times( krb5_timestamp atime, 1958 krb5_ticket_times *ttimes) 1959 { 1960 krb5_deltat skew; 1961 krb5_timestamp start, now; 1962 krb5_error_code rc; 1963 krb5_context context; 1964 1965 if ((rc = krb5_init_context(&context))) return SSL_R_KRB5_S_BAD_TICKET; 1966 skew = get_rc_clockskew(context); 1967 if ((rc = krb5_timeofday(context,&now))) return SSL_R_KRB5_S_BAD_TICKET; 1968 krb5_free_context(context); 1969 1970 if (atime && labs(atime - now) >= skew) return SSL_R_KRB5_S_TKT_SKEW; 1971 1972 if (! ttimes) return 0; 1973 1974 start = (ttimes->starttime != 0)? ttimes->starttime: ttimes->authtime; 1975 if (start - now > skew) return SSL_R_KRB5_S_TKT_NYV; 1976 if ((now - ttimes->endtime) > skew) return SSL_R_KRB5_S_TKT_EXPIRED; 1977 1978 #ifdef KSSL_DEBUG 1979 printf("kssl_validate_times: %d |<- | %d - %d | < %d ->| %d\n", 1980 start, atime, now, skew, ttimes->endtime); 1981 #endif /* KSSL_DEBUG */ 1982 1983 return 0; 1984 } 1985 1986 1987 /* Decode and decrypt given DER-encoded authenticator, then pass 1988 ** authenticator ctime back in *atimep (or 0 if time unavailable). 1989 ** Returns krb5_error_code and kssl_err on error. A NULL 1990 ** authenticator (authentp->length == 0) is not considered an error. 1991 ** Note that kssl_check_authent() makes use of the KRB5 session key; 1992 ** you must call kssl_sget_tkt() to get the key before calling this routine. 1993 */ 1994 krb5_error_code kssl_check_authent( 1995 /* IN */ KSSL_CTX *kssl_ctx, 1996 /* IN */ krb5_data *authentp, 1997 /* OUT */ krb5_timestamp *atimep, 1998 /* OUT */ KSSL_ERR *kssl_err ) 1999 { 2000 krb5_error_code krb5rc = 0; 2001 KRB5_ENCDATA *dec_authent = NULL; 2002 KRB5_AUTHENTBODY *auth = NULL; 2003 krb5_enctype enctype; 2004 EVP_CIPHER_CTX ciph_ctx; 2005 const EVP_CIPHER *enc = NULL; 2006 unsigned char iv[EVP_MAX_IV_LENGTH]; 2007 const unsigned char *p; 2008 unsigned char *unenc_authent; 2009 int outl, unencbufsize; 2010 struct tm tm_time, *tm_l, *tm_g; 2011 time_t now, tl, tg, tr, tz_offset; 2012 2013 EVP_CIPHER_CTX_init(&ciph_ctx); 2014 *atimep = 0; 2015 kssl_err_set(kssl_err, 0, ""); 2016 2017 #ifndef KRB5CHECKAUTH 2018 authentp = NULL; 2019 #else 2020 #if KRB5CHECKAUTH == 0 2021 authentp = NULL; 2022 #endif 2023 #endif /* KRB5CHECKAUTH */ 2024 2025 if (authentp == NULL || authentp->length == 0) return 0; 2026 2027 #ifdef KSSL_DEBUG 2028 { 2029 unsigned int ui; 2030 printf("kssl_check_authent: authenticator[%d]:\n",authentp->length); 2031 p = authentp->data; 2032 for (ui=0; ui < authentp->length; ui++) printf("%02x ",p[ui]); 2033 printf("\n"); 2034 } 2035 #endif /* KSSL_DEBUG */ 2036 2037 unencbufsize = 2 * authentp->length; 2038 if ((unenc_authent = calloc(1, unencbufsize)) == NULL) 2039 { 2040 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 2041 "Unable to allocate authenticator buffer.\n"); 2042 krb5rc = KRB5KRB_ERR_GENERIC; 2043 goto err; 2044 } 2045 2046 p = (unsigned char *)authentp->data; 2047 if ((dec_authent = d2i_KRB5_ENCDATA(NULL, &p, 2048 (long) authentp->length)) == NULL) 2049 { 2050 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 2051 "Error decoding authenticator.\n"); 2052 krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY; 2053 goto err; 2054 } 2055 2056 enctype = dec_authent->etype->data[0]; /* should = kssl_ctx->enctype */ 2057 #if !defined(KRB5_MIT_OLD11) 2058 switch ( enctype ) { 2059 case ENCTYPE_DES3_CBC_SHA1: /* EVP_des_ede3_cbc(); */ 2060 case ENCTYPE_DES3_CBC_SHA: 2061 case ENCTYPE_DES3_CBC_RAW: 2062 krb5rc = 0; /* Skip, can't handle derived keys */ 2063 goto err; 2064 } 2065 #endif 2066 enc = kssl_map_enc(enctype); 2067 memset(iv, 0, sizeof iv); /* per RFC 1510 */ 2068 2069 if (enc == NULL) 2070 { 2071 /* Disable kssl_check_authent for ENCTYPE_DES3_CBC_SHA1. 2072 ** This enctype indicates the authenticator was encrypted 2073 ** using key-usage derived keys which openssl cannot decrypt. 2074 */ 2075 goto err; 2076 } 2077 2078 if (!EVP_CipherInit(&ciph_ctx,enc,kssl_ctx->key,iv,0)) 2079 { 2080 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 2081 "EVP_CipherInit error decrypting authenticator.\n"); 2082 krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY; 2083 goto err; 2084 } 2085 outl = dec_authent->cipher->length; 2086 if (!EVP_Cipher(&ciph_ctx,unenc_authent,dec_authent->cipher->data,outl)) 2087 { 2088 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 2089 "EVP_Cipher error decrypting authenticator.\n"); 2090 krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY; 2091 goto err; 2092 } 2093 EVP_CIPHER_CTX_cleanup(&ciph_ctx); 2094 2095 #ifdef KSSL_DEBUG 2096 { 2097 int padl; 2098 printf("kssl_check_authent: decrypted authenticator[%d] =\n", outl); 2099 for (padl=0; padl < outl; padl++) printf("%02x ",unenc_authent[padl]); 2100 printf("\n"); 2101 } 2102 #endif /* KSSL_DEBUG */ 2103 2104 if ((p = kssl_skip_confound(enctype, unenc_authent)) == NULL) 2105 { 2106 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 2107 "confounded by authenticator.\n"); 2108 krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY; 2109 goto err; 2110 } 2111 outl -= p - unenc_authent; 2112 2113 if ((auth = (KRB5_AUTHENTBODY *) d2i_KRB5_AUTHENT(NULL, &p, 2114 (long) outl))==NULL) 2115 { 2116 kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT, 2117 "Error decoding authenticator body.\n"); 2118 krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY; 2119 goto err; 2120 } 2121 2122 memset(&tm_time,0,sizeof(struct tm)); 2123 if (k_gmtime(auth->ctime, &tm_time) && 2124 ((tr = mktime(&tm_time)) != (time_t)(-1))) 2125 { 2126 now = time(&now); 2127 tm_l = localtime(&now); tl = mktime(tm_l); 2128 tm_g = gmtime(&now); tg = mktime(tm_g); 2129 tz_offset = tg - tl; 2130 2131 *atimep = (krb5_timestamp)(tr - tz_offset); 2132 } 2133 2134 #ifdef KSSL_DEBUG 2135 printf("kssl_check_authent: returns %d for client time ", *atimep); 2136 if (auth && auth->ctime && auth->ctime->length && auth->ctime->data) 2137 printf("%.*s\n", auth->ctime->length, auth->ctime->data); 2138 else printf("NULL\n"); 2139 #endif /* KSSL_DEBUG */ 2140 2141 err: 2142 if (auth) KRB5_AUTHENT_free((KRB5_AUTHENT *) auth); 2143 if (dec_authent) KRB5_ENCDATA_free(dec_authent); 2144 if (unenc_authent) free(unenc_authent); 2145 EVP_CIPHER_CTX_cleanup(&ciph_ctx); 2146 return krb5rc; 2147 } 2148 2149 2150 /* Replaces krb5_build_principal_ext(), with varargs length == 2 (svc, host), 2151 ** because I dont't know how to stub varargs. 2152 ** Returns krb5_error_code == ENOMEM on alloc error, otherwise 2153 ** passes back newly constructed principal, which should be freed by caller. 2154 */ 2155 krb5_error_code kssl_build_principal_2( 2156 /* UPDATE */ krb5_context context, 2157 /* OUT */ krb5_principal *princ, 2158 /* IN */ int rlen, const char *realm, 2159 /* IN */ int slen, const char *svc, 2160 /* IN */ int hlen, const char *host) 2161 { 2162 krb5_data *p_data = NULL; 2163 krb5_principal new_p = NULL; 2164 char *new_r = NULL; 2165 2166 if ((p_data = (krb5_data *) calloc(2, sizeof(krb5_data))) == NULL || 2167 (new_p = (krb5_principal) calloc(1, sizeof(krb5_principal_data))) 2168 == NULL) goto err; 2169 new_p->length = 2; 2170 new_p->data = p_data; 2171 2172 if ((new_r = calloc(1, rlen + 1)) == NULL) goto err; 2173 memcpy(new_r, realm, rlen); 2174 krb5_princ_set_realm_length(context, new_p, rlen); 2175 krb5_princ_set_realm_data(context, new_p, new_r); 2176 2177 if ((new_p->data[0].data = calloc(1, slen + 1)) == NULL) goto err; 2178 memcpy(new_p->data[0].data, svc, slen); 2179 new_p->data[0].length = slen; 2180 2181 if ((new_p->data[1].data = calloc(1, hlen + 1)) == NULL) goto err; 2182 memcpy(new_p->data[1].data, host, hlen); 2183 new_p->data[1].length = hlen; 2184 2185 krb5_princ_type(context, new_p) = KRB5_NT_UNKNOWN; 2186 *princ = new_p; 2187 return 0; 2188 2189 err: 2190 if (new_p && new_p[0].data) free(new_p[0].data); 2191 if (new_p && new_p[1].data) free(new_p[1].data); 2192 if (new_p) free(new_p); 2193 if (new_r) free(new_r); 2194 return ENOMEM; 2195 } 2196 2197 void SSL_set0_kssl_ctx(SSL *s, KSSL_CTX *kctx) 2198 { 2199 s->kssl_ctx = kctx; 2200 } 2201 2202 KSSL_CTX * SSL_get0_kssl_ctx(SSL *s) 2203 { 2204 return s->kssl_ctx; 2205 } 2206 2207 char *kssl_ctx_get0_client_princ(KSSL_CTX *kctx) 2208 { 2209 if (kctx) 2210 return kctx->client_princ; 2211 return NULL; 2212 } 2213 2214 #else /* !OPENSSL_NO_KRB5 */ 2215 2216 #if defined(PEDANTIC) || defined(OPENSSL_SYS_VMS) 2217 static void *dummy=&dummy; 2218 #endif 2219 2220 #endif /* !OPENSSL_NO_KRB5 */ 2221 2222