kerberos4.c

samba最新软件

			   "old krbtgt kvno used");
	    goto out2;
	}

	ret = _kdc_get_des_key(context, tgt, TRUE, FALSE, &tkey);
	if(ret){
	    kdc_log(context, config, 0, 
		    "no suitable DES key for krbtgt (krb4)");
	    make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, 
			   "no suitable DES key for krbtgt");
	    goto out2;
	}

	RCHECK(krb5_ret_int8(sp, &ticket_len), out2);
	RCHECK(krb5_ret_int8(sp, &req_len), out2);
	
	pos = krb5_storage_seek(sp, ticket_len + req_len, SEEK_CUR);
	
	auth.data = buf;
	auth.length = pos;

	if (config->check_ticket_addresses)
	    address = addr->sin_addr.s_addr;
	else
	    address = 0;

	ret = _krb5_krb_rd_req(context, &auth, "krbtgt", realm, 
			       config->v4_realm,
			       address, &tkey->key, &ad);
	if(ret){
	    kdc_log(context, config, 0, "krb_rd_req: %d", ret);
	    make_err_reply(context, reply, ret, "failed to parse request");
	    goto out2;
	}
	
	RCHECK(krb5_ret_int32(sp, &req_time), out2);
	if(lsb)
	    req_time = swap32(req_time);
	RCHECK(krb5_ret_uint8(sp, &life), out2);
	RCHECK(krb5_ret_stringz(sp, &sname), out2);
	RCHECK(krb5_ret_stringz(sp, &sinst), out2);
	snprintf (server_name, sizeof(server_name),
		  "%s.%s@%s",
		  sname, sinst, config->v4_realm);
	snprintf (client_name, sizeof(client_name),
		  "%s.%s@%s",
		  ad.pname, ad.pinst, ad.prealm);

	kdc_log(context, config, 0, "TGS-REQ (krb4) %s from %s for %s",
		client_name, from, server_name);
	
	if(strcmp(ad.prealm, realm)){
	    kdc_log(context, config, 0, 
		    "Can't hop realms (krb4) %s -> %s", realm, ad.prealm);
	    make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, 
			   "Can't hop realms");
	    goto out2;
	}

	if (!config->enable_v4_cross_realm && strcmp(realm, config->v4_realm) != 0) {
	    kdc_log(context, config, 0, 
		    "krb4 Cross-realm %s -> %s disabled",
		    realm, config->v4_realm);
	    make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN,
			   "Can't hop realms");
	    goto out2;
	}

	if(strcmp(sname, "changepw") == 0){
	    kdc_log(context, config, 0, 
		    "Bad request for changepw ticket (krb4)");
	    make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, 
			   "Can't authorize password change based on TGT");
	    goto out2;
	}
	
	ret = _kdc_db_fetch4(context, config, ad.pname, ad.pinst, ad.prealm,
			     HDB_F_GET_CLIENT, &client);
	if(ret && ret != HDB_ERR_NOENTRY) {
	    char *s;
	    s = kdc_log_msg(context, config, 0,
			    "Client not found in database: (krb4) %s: %s",
			    client_name, krb5_get_err_text(context, ret));
	    make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, s);
	    free(s);
	    goto out2;
	}
	if (client == NULL && strcmp(ad.prealm, config->v4_realm) == 0) {
	    char *s;
	    s = kdc_log_msg(context, config, 0,
			    "Local client not found in database: (krb4) "
			    "%s", client_name);
	    make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, s);
	    free(s);
	    goto out2;
	}

	ret = _kdc_db_fetch4(context, config, sname, sinst, config->v4_realm,
			     HDB_F_GET_SERVER, &server);
	if(ret){
	    char *s;
	    s = kdc_log_msg(context, config, 0,
			    "Server not found in database (krb4): %s: %s",
			    server_name, krb5_get_err_text(context, ret));
	    make_err_reply(context, reply, KRB4ET_KDC_PR_UNKNOWN, s);
	    free(s);
	    goto out2;
	}

	ret = _kdc_check_flags (context, config, 
				client, client_name,
				server, server_name,
				FALSE);
	if (ret) {
	    make_err_reply(context, reply, KRB4ET_KDC_NAME_EXP,
			   "operation not allowed");
	    goto out2;
	}

	ret = _kdc_get_des_key(context, server, TRUE, FALSE, &skey);
	if(ret){
	    kdc_log(context, config, 0, 
		    "no suitable DES key for server (krb4)");
	    make_err_reply(context, reply, KRB4ET_KDC_NULL_KEY, 
			   "no suitable DES key for server");
	    goto out2;
	}

	max_end = _krb5_krb_life_to_time(ad.time_sec, ad.life);
	max_end = min(max_end, _krb5_krb_life_to_time(kdc_time, life));
	if(server->entry.max_life)
	    max_end = min(max_end, kdc_time + *server->entry.max_life);
	if(client && client->entry.max_life)
	    max_end = min(max_end, kdc_time + *client->entry.max_life);
	life = min(life, krb_time_to_life(kdc_time, max_end));
	
	issue_time = kdc_time;
	actual_end = _krb5_krb_life_to_time(issue_time, life);
	while (actual_end > max_end && life > 1) {
	    /* move them into the next earlier lifetime bracket */
	    life--;
	    actual_end = _krb5_krb_life_to_time(issue_time, life);
	}
	if (actual_end > max_end) {
	    /* if life <= 1 and it's still too long, backdate the ticket */
	    issue_time -= actual_end - max_end;
	}

	{
	    krb5_data ticket, cipher;
	    krb5_keyblock session;

	    krb5_data_zero(&ticket);
	    krb5_data_zero(&cipher);

	    ret = krb5_generate_random_keyblock(context,
						ETYPE_DES_PCBC_NONE,
						&session);
	    if (ret) {
		make_err_reply(context, reply, KFAILURE,
			       "Not enough random i KDC");
		goto out2;
	    }
	
	    ret = _krb5_krb_create_ticket(context,
					  0,
					  ad.pname,
					  ad.pinst,
					  ad.prealm,
					  addr->sin_addr.s_addr,
					  &session,
					  life,
					  issue_time,
					  sname,
					  sinst,
					  &skey->key,
					  &ticket);
	    if (ret) {
		krb5_free_keyblock_contents(context, &session);
		make_err_reply(context, reply, KFAILURE,
			       "failed to create v4 ticket");
		goto out2;
	    }

	    ret = _krb5_krb_create_ciph(context,
					&session,
					sname,
					sinst,
					config->v4_realm,
					life,
					server->entry.kvno % 255,
					&ticket,
					issue_time,
					&ad.session,
					&cipher);
	    krb5_free_keyblock_contents(context, &session);
	    if (ret) {
		make_err_reply(context, reply, KFAILURE,
			       "failed to create v4 cipher");
		goto out2;
	    }
	    
	    ret = _krb5_krb_create_auth_reply(context,
					      ad.pname,
					      ad.pinst,
					      ad.prealm,
					      req_time,
					      0,
					      0,
					      0,
					      &cipher,
					      reply);
	    krb5_data_free(&cipher);
	}
    out2:
	_krb5_krb_free_auth_data(context, &ad);
	if(tgt_princ)
	    krb5_free_principal(context, tgt_princ);
	if(tgt)
	    _kdc_free_ent(context, tgt);
	break;
    }
    case AUTH_MSG_ERR_REPLY:
	break;
    default:
	kdc_log(context, config, 0, "Unknown message type (krb4): %d from %s", 
		msg_type, from);
	
	make_err_reply(context, reply, KFAILURE, "Unknown message type");
    }
 out:
    if(name)
	free(name);
    if(inst)
	free(inst);
    if(realm)
	free(realm);
    if(sname)
	free(sname);
    if(sinst)
	free(sinst);
    if(client)
	_kdc_free_ent(context, client);
    if(server)
	_kdc_free_ent(context, server);
    krb5_storage_free(sp);
    return 0;
}

krb5_error_code
_kdc_encode_v4_ticket(krb5_context context, 
		      krb5_kdc_configuration *config,
		      void *buf, size_t len, const EncTicketPart *et,
		      const PrincipalName *service, size_t *size)
{
    krb5_storage *sp;
    krb5_error_code ret;
    char name[40], inst[40], realm[40];
    char sname[40], sinst[40];

    {
	krb5_principal princ;
	_krb5_principalname2krb5_principal(context,
					   &princ,
					   *service,
					   et->crealm);
	ret = krb5_524_conv_principal(context, 
				      princ,
				      sname,
				      sinst,
				      realm);
	krb5_free_principal(context, princ);
	if(ret)
	    return ret;

	_krb5_principalname2krb5_principal(context,
					   &princ,
					   et->cname,
					   et->crealm);
				     
	ret = krb5_524_conv_principal(context, 
				      princ,
				      name,
				      inst,
				      realm);
	krb5_free_principal(context, princ);
    }
    if(ret)
	return ret;

    sp = krb5_storage_emem();
    
    krb5_store_int8(sp, 0); /* flags */
    krb5_store_stringz(sp, name);
    krb5_store_stringz(sp, inst);
    krb5_store_stringz(sp, realm);
    {
	unsigned char tmp[4] = { 0, 0, 0, 0 };
	int i;
	if(et->caddr){
	    for(i = 0; i < et->caddr->len; i++)
		if(et->caddr->val[i].addr_type == AF_INET &&
		   et->caddr->val[i].address.length == 4){
		    memcpy(tmp, et->caddr->val[i].address.data, 4);
		    break;
		}
	}
	krb5_storage_write(sp, tmp, sizeof(tmp));
    }

    if((et->key.keytype != ETYPE_DES_CBC_MD5 &&
	et->key.keytype != ETYPE_DES_CBC_MD4 &&
	et->key.keytype != ETYPE_DES_CBC_CRC) || 
       et->key.keyvalue.length != 8)
	return -1;
    krb5_storage_write(sp, et->key.keyvalue.data, 8);
    
    {
	time_t start = et->starttime ? *et->starttime : et->authtime;
	krb5_store_int8(sp, krb_time_to_life(start, et->endtime));
	krb5_store_int32(sp, start);
    }

    krb5_store_stringz(sp, sname);
    krb5_store_stringz(sp, sinst);
    
    {
	krb5_data data;
	krb5_storage_to_data(sp, &data);
	krb5_storage_free(sp);
	*size = (data.length + 7) & ~7; /* pad to 8 bytes */
	if(*size > len)
	    return -1;
	memset((unsigned char*)buf - *size + 1, 0, *size);
	memcpy((unsigned char*)buf - *size + 1, data.data, data.length);
	krb5_data_free(&data);
    }
    return 0;
}

krb5_error_code
_kdc_get_des_key(krb5_context context, 
		 hdb_entry_ex *principal, krb5_boolean is_server, 
		 krb5_boolean prefer_afs_key, Key **ret_key)
{
    Key *v5_key = NULL, *v4_key = NULL, *afs_key = NULL, *server_key = NULL;
    int i;
    krb5_enctype etypes[] = { ETYPE_DES_CBC_MD5, 
			      ETYPE_DES_CBC_MD4, 
			      ETYPE_DES_CBC_CRC };

    for(i = 0;
	i < sizeof(etypes)/sizeof(etypes[0])
	    && (v5_key == NULL || v4_key == NULL || 
		afs_key == NULL || server_key == NULL);
	++i) {
	Key *key = NULL;
	while(hdb_next_enctype2key(context, &principal->entry, etypes[i], &key) == 0) {
	    if(key->salt == NULL) {
		if(v5_key == NULL)
		    v5_key = key;
	    } else if(key->salt->type == hdb_pw_salt && 
		      key->salt->salt.length == 0) {
		if(v4_key == NULL)
		    v4_key = key;
	    } else if(key->salt->type == hdb_afs3_salt) {
		if(afs_key == NULL)
		    afs_key = key;
	    } else if(server_key == NULL)
		server_key = key;
	}
    }

    if(prefer_afs_key) {
	if(afs_key)
	    *ret_key = afs_key;
	else if(v4_key)
	    *ret_key = v4_key;
	else if(v5_key)
	    *ret_key = v5_key;
	else if(is_server && server_key)
	    *ret_key = server_key;
	else
	    return KRB4ET_KDC_NULL_KEY;
    } else {
	if(v4_key)
	    *ret_key = v4_key;
	else if(afs_key)
	    *ret_key = afs_key;
	else  if(v5_key)
	    *ret_key = v5_key;
	else if(is_server && server_key)
	    *ret_key = server_key;
	else
	    return KRB4ET_KDC_NULL_KEY;
    }

    if((*ret_key)->key.keyvalue.length == 0)
	return KRB4ET_KDC_NULL_KEY;
    return 0;
}