diff options
Diffstat (limited to 'source4/auth/kerberos/kerberos_util.c')
| -rw-r--r-- | source4/auth/kerberos/kerberos_util.c | 117 |
1 files changed, 84 insertions, 33 deletions
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c index 494f36dec7..44d97b7f08 100644 --- a/source4/auth/kerberos/kerberos_util.c +++ b/source4/auth/kerberos/kerberos_util.c @@ -40,6 +40,42 @@ static krb5_error_code free_principal(struct principal_container *pc) return 0; } + +static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx, + const char *princ_string, + struct smb_krb5_context *smb_krb5_context, + krb5_principal *princ, + const char **error_string) +{ + int ret; + struct principal_container *mem_ctx; + if (princ_string == NULL) { + *princ = NULL; + return 0; + } + + ret = krb5_parse_name(smb_krb5_context->krb5_context, + princ_string, princ); + + if (ret) { + (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx); + return ret; + } + + mem_ctx = talloc(parent_ctx, struct principal_container); + if (!mem_ctx) { + (*error_string) = error_message(ENOMEM); + return ENOMEM; + } + + /* This song-and-dance effectivly puts the principal + * into talloc, so we can't loose it. */ + mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); + mem_ctx->principal = *princ; + talloc_set_destructor(mem_ctx, free_principal); + return 0; +} + static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, struct cli_credentials *machine_account, struct smb_krb5_context *smb_krb5_context, @@ -50,6 +86,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, char *salt_body; char *lower_realm; const char *salt_principal; + const char *error_string; struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container); if (!mem_ctx) { return ENOMEM; @@ -57,7 +94,7 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, salt_principal = cli_credentials_get_salt_principal(machine_account); if (salt_principal) { - ret = krb5_parse_name(smb_krb5_context->krb5_context, salt_principal, salt_princ); + ret = parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, &error_string); } else { machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account)); @@ -85,15 +122,15 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ, cli_credentials_get_realm(machine_account), "host", salt_body, NULL); + if (ret == 0) { + /* This song-and-dance effectivly puts the principal + * into talloc, so we can't loose it. */ + mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); + mem_ctx->principal = *salt_princ; + talloc_set_destructor(mem_ctx, free_principal); + } } - if (ret == 0) { - /* This song-and-dance effectivly puts the principal - * into talloc, so we can't loose it. */ - mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); - mem_ctx->principal = *salt_princ; - talloc_set_destructor(mem_ctx, free_principal); - } return ret; } @@ -110,36 +147,36 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, { krb5_error_code ret; const char *princ_string; - struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container); + TALLOC_CTX *mem_ctx = talloc_new(parent_ctx); if (!mem_ctx) { (*error_string) = error_message(ENOMEM); return ENOMEM; } - princ_string = cli_credentials_get_principal(credentials, mem_ctx); - - /* A NULL here has meaning, as the gssapi server case will - * then use the principal from the client */ if (!princ_string) { - talloc_free(mem_ctx); - princ = NULL; - return 0; + (*error_string) = error_message(ENOMEM); + return ENOMEM; } - ret = krb5_parse_name(smb_krb5_context->krb5_context, - princ_string, princ); + ret = parse_principal(parent_ctx, princ_string, + smb_krb5_context, princ, error_string); + talloc_free(mem_ctx); + return ret; +} - if (ret) { - (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx); - return ret; - } +/* Obtain the principal set on this context. Requires a + * smb_krb5_context because we are doing krb5 principal parsing with + * the library routines. The returned princ is placed in the talloc + * system by means of a destructor (do *not* free). */ - /* This song-and-dance effectivly puts the principal - * into talloc, so we can't loose it. */ - mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context); - mem_ctx->principal = *princ; - talloc_set_destructor(mem_ctx, free_principal); - return 0; + krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx, + struct cli_credentials *credentials, + struct smb_krb5_context *smb_krb5_context, + krb5_principal *princ, + const char **error_string) +{ + return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials), + smb_krb5_context, princ, error_string); } /** @@ -154,9 +191,10 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, const char **error_string) { krb5_error_code ret; - const char *password; + const char *password, *target_service; time_t kdc_time = 0; krb5_principal princ; + krb5_principal impersonate_principal; int tries; TALLOC_CTX *mem_ctx = talloc_new(parent_ctx); @@ -171,14 +209,26 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, return ret; } + ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string); + if (ret) { + talloc_free(mem_ctx); + return ret; + } + + target_service = cli_credentials_get_target_service(credentials); + password = cli_credentials_get_password(credentials); tries = 2; while (tries--) { if (password) { ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache, - princ, - password, NULL, &kdc_time); + princ, password, + impersonate_principal, target_service, + NULL, &kdc_time); + } else if (impersonate_principal) { + (*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock. A password must be specified in the credentials"; + return EINVAL; } else { /* No password available, try to use a keyblock instead */ @@ -197,8 +247,9 @@ static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx, if (ret == 0) { ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, ccache, - princ, - &keyblock, NULL, &kdc_time); + princ, &keyblock, + target_service, + NULL, &kdc_time); krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock); } } |