Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : PAC Glue between Samba and the KDC
5 :
6 : Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
7 : Copyright (C) Simo Sorce <idra@samba.org> 2010
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 :
20 : You should have received a copy of the GNU General Public License
21 : along with this program. If not, see <http://www.gnu.org/licenses/>.
22 : */
23 :
24 : #include "includes.h"
25 : #include "kdc/kdc-glue.h"
26 : #include "kdc/db-glue.h"
27 : #include "kdc/pac-glue.h"
28 : #include "sdb.h"
29 : #include "sdb_hdb.h"
30 : #include "librpc/gen_ndr/auth.h"
31 : #include <krb5_locl.h>
32 :
33 : #undef DBGC_CLASS
34 : #define DBGC_CLASS DBGC_KERBEROS
35 :
36 55186 : static int samba_wdc_pac_options(astgs_request_t r, PAC_OPTIONS_FLAGS *flags)
37 : {
38 55186 : const KDC_REQ *req = kdc_request_get_req(r);
39 55186 : const PA_DATA *padata_pac_options = NULL;
40 :
41 55186 : ZERO_STRUCTP(flags);
42 :
43 55186 : if (req->padata != NULL) {
44 55186 : int idx = 0;
45 :
46 55186 : padata_pac_options = krb5_find_padata(req->padata->val,
47 55186 : req->padata->len,
48 : KRB5_PADATA_PAC_OPTIONS,
49 : &idx);
50 : }
51 :
52 55186 : if (padata_pac_options != NULL) {
53 65 : PA_PAC_OPTIONS pa_pac_options = {};
54 : int ret;
55 :
56 65 : ret = decode_PA_PAC_OPTIONS(padata_pac_options->padata_value.data,
57 65 : padata_pac_options->padata_value.length,
58 : &pa_pac_options, NULL);
59 65 : if (ret) {
60 0 : return ret;
61 : }
62 65 : *flags = pa_pac_options.flags;
63 : }
64 :
65 55186 : return 0;
66 : }
67 :
68 55186 : static bool samba_wdc_is_s4u2self_req(astgs_request_t r)
69 : {
70 55186 : const KDC_REQ *req = kdc_request_get_req(r);
71 55186 : const PA_DATA *pa_for_user = NULL;
72 :
73 55186 : if (req->msg_type != krb_tgs_req) {
74 18343 : return false;
75 : }
76 :
77 36843 : if (req->padata != NULL) {
78 36843 : int idx = 0;
79 :
80 36843 : pa_for_user = krb5_find_padata(req->padata->val,
81 36843 : req->padata->len,
82 : KRB5_PADATA_FOR_USER,
83 : &idx);
84 : }
85 :
86 36843 : if (pa_for_user != NULL) {
87 1278 : return true;
88 : }
89 :
90 35565 : return false;
91 : }
92 :
93 : /*
94 : * Given the right private pointer from hdb_samba4,
95 : * get a PAC from the attached ldb messages.
96 : *
97 : * For PKINIT we also get pk_reply_key and can add PAC_CREDENTIAL_INFO.
98 : */
99 18979 : static krb5_error_code samba_wdc_get_pac(void *priv,
100 : astgs_request_t r,
101 : hdb_entry *client,
102 : hdb_entry *server,
103 : const krb5_keyblock *pk_reply_key,
104 : uint64_t pac_attributes,
105 : krb5_pac *pac)
106 : {
107 18979 : krb5_context context = kdc_request_get_context((kdc_request_t)r);
108 : TALLOC_CTX *mem_ctx;
109 18979 : DATA_BLOB *logon_blob = NULL;
110 18979 : DATA_BLOB *cred_ndr = NULL;
111 18979 : DATA_BLOB **cred_ndr_ptr = NULL;
112 18979 : DATA_BLOB _cred_blob = data_blob_null;
113 18979 : DATA_BLOB *cred_blob = NULL;
114 18979 : DATA_BLOB *upn_blob = NULL;
115 18979 : DATA_BLOB *pac_attrs_blob = NULL;
116 18979 : DATA_BLOB *requester_sid_blob = NULL;
117 18979 : DATA_BLOB *claims_blob = NULL;
118 : krb5_error_code ret;
119 : NTSTATUS nt_status;
120 : struct samba_kdc_entry *skdc_entry =
121 18979 : talloc_get_type_abort(client->context,
122 : struct samba_kdc_entry);
123 : bool is_krbtgt;
124 18979 : bool is_s4u2self = samba_wdc_is_s4u2self_req(r);
125 18979 : enum samba_asserted_identity asserted_identity =
126 : (is_s4u2self) ?
127 18979 : SAMBA_ASSERTED_IDENTITY_SERVICE :
128 : SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY;
129 18979 : PAC_OPTIONS_FLAGS pac_options = {};
130 :
131 18979 : ret = samba_wdc_pac_options(r, &pac_options);
132 18979 : if (ret != 0) {
133 0 : return ret;
134 : }
135 :
136 18979 : mem_ctx = talloc_named(client->context, 0, "samba_get_pac context");
137 18979 : if (!mem_ctx) {
138 0 : return ENOMEM;
139 : }
140 :
141 18979 : if (pk_reply_key != NULL) {
142 0 : cred_ndr_ptr = &cred_ndr;
143 : }
144 :
145 18979 : is_krbtgt = krb5_principal_is_krbtgt(context, server->principal);
146 :
147 18979 : nt_status = samba_kdc_get_pac_blobs(mem_ctx, skdc_entry,
148 : asserted_identity,
149 : &logon_blob,
150 : cred_ndr_ptr,
151 : &upn_blob,
152 : is_krbtgt ? &pac_attrs_blob : NULL,
153 : pac_attributes,
154 : is_krbtgt ? &requester_sid_blob : NULL,
155 18979 : pac_options.claims ?
156 : &claims_blob : NULL);
157 18979 : if (!NT_STATUS_IS_OK(nt_status)) {
158 0 : talloc_free(mem_ctx);
159 0 : return EINVAL;
160 : }
161 :
162 18979 : if (pk_reply_key != NULL && cred_ndr != NULL) {
163 0 : ret = samba_kdc_encrypt_pac_credentials(context,
164 : pk_reply_key,
165 : cred_ndr,
166 : mem_ctx,
167 : &_cred_blob);
168 0 : if (ret != 0) {
169 0 : talloc_free(mem_ctx);
170 0 : return ret;
171 : }
172 0 : cred_blob = &_cred_blob;
173 : }
174 :
175 18979 : ret = krb5_pac_init(context, pac);
176 18979 : if (ret != 0) {
177 0 : talloc_free(mem_ctx);
178 0 : return ret;
179 : }
180 :
181 18979 : ret = samba_make_krb5_pac(context, logon_blob, cred_blob,
182 : upn_blob, pac_attrs_blob,
183 : requester_sid_blob, NULL,
184 : NULL, NULL, NULL,
185 : *pac);
186 :
187 18979 : talloc_free(mem_ctx);
188 18979 : return ret;
189 : }
190 :
191 36207 : static krb5_error_code samba_wdc_reget_pac2(astgs_request_t r,
192 : const krb5_principal delegated_proxy_principal,
193 : hdb_entry *client,
194 : hdb_entry *server,
195 : hdb_entry *krbtgt,
196 : krb5_pac *pac,
197 : krb5_cksumtype ctype,
198 : const hdb_entry *device,
199 : krb5_const_pac *device_pac)
200 : {
201 36207 : krb5_context context = kdc_request_get_context((kdc_request_t)r);
202 36207 : struct samba_kdc_entry *client_skdc_entry = NULL;
203 : struct samba_kdc_entry *server_skdc_entry =
204 36207 : talloc_get_type_abort(server->context, struct samba_kdc_entry);
205 : struct samba_kdc_entry *krbtgt_skdc_entry =
206 36207 : talloc_get_type_abort(krbtgt->context, struct samba_kdc_entry);
207 36207 : TALLOC_CTX *mem_ctx = NULL;
208 36207 : krb5_pac new_pac = NULL;
209 : krb5_error_code ret;
210 36207 : bool is_s4u2self = samba_wdc_is_s4u2self_req(r);
211 36207 : bool is_in_db = false;
212 36207 : bool is_untrusted = false;
213 36207 : uint32_t flags = 0;
214 36207 : PAC_OPTIONS_FLAGS pac_options = {};
215 :
216 36207 : ret = samba_wdc_pac_options(r, &pac_options);
217 36207 : if (ret != 0) {
218 0 : return ret;
219 : }
220 :
221 36207 : mem_ctx = talloc_named(NULL, 0, "samba_kdc_reget_pac2 context");
222 36207 : if (mem_ctx == NULL) {
223 0 : return ENOMEM;
224 : }
225 :
226 36207 : if (client != NULL) {
227 36158 : client_skdc_entry = talloc_get_type_abort(client->context,
228 : struct samba_kdc_entry);
229 : }
230 :
231 36207 : if (device != NULL) {
232 0 : struct samba_kdc_entry *device_skdc_entry = NULL;
233 :
234 0 : device_skdc_entry = talloc_get_type_abort(device->context,
235 : struct samba_kdc_entry);
236 :
237 : /*
238 : * Check the objectSID of the device and pac data are the same.
239 : * Does a parse and SID check, but no crypto.
240 : */
241 0 : ret = samba_kdc_validate_pac_blob(context,
242 : device_skdc_entry,
243 : *device_pac);
244 0 : if (ret != 0) {
245 0 : talloc_free(mem_ctx);
246 0 : return ret;
247 : }
248 : }
249 :
250 : /*
251 : * If the krbtgt was generated by an RODC, and we are not that
252 : * RODC, then we need to regenerate the PAC - we can't trust
253 : * it, and confirm that the RODC was permitted to print this ticket
254 : *
255 : * Becasue of the samba_kdc_validate_pac_blob() step we can be
256 : * sure that the record in 'client' matches the SID in the
257 : * original PAC.
258 : */
259 36207 : ret = samba_krbtgt_is_in_db(krbtgt_skdc_entry, &is_in_db, &is_untrusted);
260 36207 : if (ret != 0) {
261 0 : goto out;
262 : }
263 :
264 36207 : if (is_s4u2self) {
265 642 : flags |= SAMBA_KDC_FLAG_PROTOCOL_TRANSITION;
266 : }
267 :
268 36207 : if (delegated_proxy_principal != NULL) {
269 : krb5_enctype etype;
270 76 : Key *key = NULL;
271 :
272 76 : if (!is_in_db) {
273 : /*
274 : * The RODC-issued PAC was signed by a KDC entry that we
275 : * don't have a key for. The server signature is not
276 : * trustworthy, since it could have been created by the
277 : * server we got the ticket from. We must not proceed as
278 : * otherwise the ticket signature is unchecked.
279 : */
280 0 : ret = HDB_ERR_NOT_FOUND_HERE;
281 25 : goto out;
282 : }
283 :
284 : /* Fetch the correct key depending on the checksum type. */
285 76 : if (ctype == CKSUMTYPE_HMAC_MD5) {
286 34 : etype = ENCTYPE_ARCFOUR_HMAC;
287 : } else {
288 42 : ret = krb5_cksumtype_to_enctype(context,
289 : ctype,
290 : &etype);
291 42 : if (ret != 0) {
292 4 : goto out;
293 : }
294 : }
295 72 : ret = hdb_enctype2key(context, krbtgt, NULL, etype, &key);
296 72 : if (ret != 0) {
297 1 : goto out;
298 : }
299 :
300 : /* Check the KDC, whole-PAC and ticket signatures. */
301 71 : ret = krb5_pac_verify(context,
302 : *pac,
303 : 0,
304 : NULL,
305 : NULL,
306 71 : &key->key);
307 71 : if (ret != 0) {
308 20 : DEBUG(1, ("PAC KDC signature failed to verify\n"));
309 20 : goto out;
310 : }
311 :
312 51 : flags |= SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION;
313 : }
314 :
315 36182 : if (is_untrusted) {
316 42 : flags |= SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED;
317 : }
318 :
319 36182 : if (is_in_db) {
320 36134 : flags |= SAMBA_KDC_FLAG_KRBTGT_IN_DB;
321 : }
322 :
323 36182 : ret = krb5_pac_init(context, &new_pac);
324 36182 : if (ret != 0) {
325 0 : new_pac = NULL;
326 0 : goto out;
327 : }
328 :
329 36182 : ret = samba_kdc_update_pac(mem_ctx,
330 : context,
331 36182 : krbtgt_skdc_entry->kdc_db_ctx->samdb,
332 : flags,
333 : client_skdc_entry,
334 36182 : server->principal,
335 : server_skdc_entry,
336 : krbtgt_skdc_entry,
337 : delegated_proxy_principal,
338 : *pac,
339 : new_pac);
340 36182 : if (ret != 0) {
341 9 : krb5_pac_free(context, new_pac);
342 9 : if (ret == ENODATA) {
343 9 : krb5_pac_free(context, *pac);
344 9 : *pac = NULL;
345 9 : ret = 0;
346 : }
347 9 : goto out;
348 : }
349 :
350 : /* Replace the pac */
351 36173 : krb5_pac_free(context, *pac);
352 36173 : *pac = new_pac;
353 :
354 36207 : out:
355 36207 : talloc_free(mem_ctx);
356 36207 : return ret;
357 : }
358 :
359 : /* Resign (and reform, including possibly new groups) a PAC */
360 :
361 36209 : static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r,
362 : const krb5_principal client_principal,
363 : const krb5_principal delegated_proxy_principal,
364 : hdb_entry *client,
365 : hdb_entry *server,
366 : hdb_entry *krbtgt,
367 : krb5_pac *pac)
368 : {
369 36209 : krb5_context context = kdc_request_get_context((kdc_request_t)r);
370 36209 : krb5_kdc_configuration *config = kdc_request_get_config((kdc_request_t)r);
371 : struct samba_kdc_entry *krbtgt_skdc_entry =
372 36209 : talloc_get_type_abort(krbtgt->context,
373 : struct samba_kdc_entry);
374 : krb5_error_code ret;
375 36209 : krb5_cksumtype ctype = CKSUMTYPE_NONE;
376 : hdb_entry signing_krbtgt_hdb;
377 : const hdb_entry *explicit_armor_client =
378 36209 : kdc_request_get_explicit_armor_client(r);
379 36209 : krb5_const_pac explicit_armor_pac =
380 36209 : kdc_request_get_explicit_armor_pac(r);
381 :
382 36209 : if (delegated_proxy_principal) {
383 : uint16_t rodc_id;
384 : unsigned int my_krbtgt_number;
385 :
386 : /*
387 : * We're using delegated_proxy_principal for the moment to
388 : * indicate cases where the ticket was encrypted with the server
389 : * key, and not a krbtgt key. This cannot be trusted, so we need
390 : * to find a krbtgt key that signs the PAC in order to trust the
391 : * ticket.
392 : *
393 : * The krbtgt passed in to this function refers to the krbtgt
394 : * used to decrypt the ticket of the server requesting
395 : * S4U2Proxy.
396 : *
397 : * When we implement service ticket renewal, we need to check
398 : * the PAC, and this will need to be updated.
399 : */
400 78 : ret = krb5_pac_get_kdc_checksum_info(context,
401 : *pac,
402 : &ctype,
403 : &rodc_id);
404 78 : if (ret != 0) {
405 2 : DEBUG(1, ("Failed to get PAC checksum info\n"));
406 2 : return ret;
407 : }
408 :
409 : /*
410 : * We need to check the KDC and ticket signatures, fetching the
411 : * correct key based on the enctype.
412 : */
413 :
414 76 : my_krbtgt_number = krbtgt_skdc_entry->kdc_db_ctx->my_krbtgt_number;
415 :
416 76 : if (my_krbtgt_number != 0) {
417 : /*
418 : * If we are an RODC, and we are not the KDC that signed
419 : * the evidence ticket, then we need to proxy the
420 : * request.
421 : */
422 0 : if (rodc_id != my_krbtgt_number) {
423 0 : return HDB_ERR_NOT_FOUND_HERE;
424 : }
425 : } else {
426 : /*
427 : * If we are a DC, the ticket may have been signed by a
428 : * different KDC than the one that issued the header
429 : * ticket.
430 : */
431 76 : if (rodc_id != krbtgt->kvno >> 16) {
432 : struct sdb_entry signing_krbtgt_sdb;
433 :
434 : /*
435 : * If we didn't sign the ticket, then return an
436 : * error.
437 : */
438 0 : if (rodc_id != 0) {
439 0 : return KRB5KRB_AP_ERR_MODIFIED;
440 : }
441 :
442 : /*
443 : * Fetch our key from the database. To support
444 : * key rollover, we're going to need to try
445 : * multiple keys by trial and error. For now,
446 : * krbtgt keys aren't assumed to change.
447 : */
448 0 : ret = samba_kdc_fetch(context,
449 : krbtgt_skdc_entry->kdc_db_ctx,
450 0 : krbtgt->principal,
451 : SDB_F_GET_KRBTGT | SDB_F_CANON,
452 : 0,
453 : &signing_krbtgt_sdb);
454 0 : if (ret != 0) {
455 0 : return ret;
456 : }
457 :
458 0 : ret = sdb_entry_to_hdb_entry(context,
459 : &signing_krbtgt_sdb,
460 : &signing_krbtgt_hdb);
461 0 : sdb_entry_free(&signing_krbtgt_sdb);
462 0 : if (ret != 0) {
463 0 : return ret;
464 : }
465 :
466 : /*
467 : * Replace the krbtgt entry with our own entry
468 : * for further processing.
469 : */
470 0 : krbtgt = &signing_krbtgt_hdb;
471 : }
472 : }
473 36131 : } else if (!krbtgt_skdc_entry->is_trust) {
474 : /*
475 : * We expect to have received a TGT, so check that we haven't
476 : * been given a kpasswd ticket instead. We don't need to do this
477 : * check for an incoming trust, as they use a different secret
478 : * and can't be confused with a normal TGT.
479 : */
480 36083 : krb5_ticket *tgt = kdc_request_get_ticket(r);
481 :
482 36083 : struct timeval now = krb5_kdc_get_time();
483 :
484 : /*
485 : * Check if the ticket is in the last two minutes of its
486 : * life.
487 : */
488 36083 : KerberosTime lifetime = rk_time_sub(tgt->ticket.endtime, now.tv_sec);
489 36083 : if (lifetime <= CHANGEPW_LIFETIME) {
490 : /*
491 : * This ticket has at most two minutes left to live. It
492 : * may be a kpasswd ticket rather than a TGT, so don't
493 : * accept it.
494 : */
495 0 : kdc_audit_addreason((kdc_request_t)r,
496 : "Ticket is not a ticket-granting ticket");
497 0 : return KRB5KRB_AP_ERR_TKT_EXPIRED;
498 : }
499 : }
500 :
501 36207 : ret = samba_wdc_reget_pac2(r,
502 : delegated_proxy_principal,
503 : client,
504 : server,
505 : krbtgt,
506 : pac,
507 : ctype,
508 : explicit_armor_client,
509 : &explicit_armor_pac);
510 :
511 36207 : if (krbtgt == &signing_krbtgt_hdb) {
512 0 : hdb_free_entry(context, config->db[0], &signing_krbtgt_hdb);
513 : }
514 :
515 36207 : return ret;
516 : }
517 :
518 18429 : static char *get_netbios_name(TALLOC_CTX *mem_ctx, HostAddresses *addrs)
519 : {
520 18429 : char *nb_name = NULL;
521 : size_t len;
522 : unsigned int i;
523 :
524 18429 : for (i = 0; addrs && i < addrs->len; i++) {
525 90 : if (addrs->val[i].addr_type != KRB5_ADDRESS_NETBIOS) {
526 0 : continue;
527 : }
528 90 : len = MIN(addrs->val[i].address.length, 15);
529 90 : nb_name = talloc_strndup(mem_ctx,
530 90 : addrs->val[i].address.data, len);
531 90 : if (nb_name) {
532 90 : break;
533 : }
534 : }
535 :
536 18429 : if ((nb_name == NULL) || (nb_name[0] == '\0')) {
537 18339 : return NULL;
538 : }
539 :
540 : /* Strip space padding */
541 90 : for (len = strlen(nb_name) - 1;
542 450 : (len > 0) && (nb_name[len] == ' ');
543 360 : --len) {
544 360 : nb_name[len] = '\0';
545 : }
546 :
547 90 : return nb_name;
548 : }
549 :
550 : /* this function allocates 'data' using malloc.
551 : * The caller is responsible for freeing it */
552 4 : static void samba_kdc_build_edata_reply(NTSTATUS nt_status, krb5_data *e_data)
553 : {
554 4 : e_data->data = malloc(12);
555 4 : if (e_data->data == NULL) {
556 0 : e_data->length = 0;
557 0 : e_data->data = NULL;
558 0 : return;
559 : }
560 4 : e_data->length = 12;
561 :
562 4 : SIVAL(e_data->data, 0, NT_STATUS_V(nt_status));
563 4 : SIVAL(e_data->data, 4, 0);
564 4 : SIVAL(e_data->data, 8, 1);
565 :
566 4 : return;
567 : }
568 :
569 18429 : static krb5_error_code samba_wdc_check_client_access(void *priv,
570 : astgs_request_t r)
571 : {
572 : struct samba_kdc_entry *kdc_entry;
573 : bool password_change;
574 : char *workstation;
575 : NTSTATUS nt_status;
576 :
577 :
578 18429 : kdc_entry = talloc_get_type(kdc_request_get_client(r)->context, struct samba_kdc_entry);
579 18429 : password_change = (kdc_request_get_server(r) && kdc_request_get_server(r)->flags.change_pw);
580 18429 : workstation = get_netbios_name((TALLOC_CTX *)kdc_request_get_client(r)->context,
581 18429 : kdc_request_get_req(r)->req_body.addresses);
582 :
583 18429 : nt_status = samba_kdc_check_client_access(kdc_entry,
584 : kdc_request_get_cname((kdc_request_t)r),
585 : workstation,
586 : password_change);
587 :
588 18429 : if (!NT_STATUS_IS_OK(nt_status)) {
589 4 : if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
590 0 : return ENOMEM;
591 : }
592 :
593 4 : if (kdc_request_get_rep(r)->padata) {
594 : int ret;
595 : krb5_data kd;
596 :
597 4 : samba_kdc_build_edata_reply(nt_status, &kd);
598 4 : ret = krb5_padata_add(kdc_request_get_context((kdc_request_t)r), kdc_request_get_rep(r)->padata,
599 : KRB5_PADATA_PW_SALT,
600 : kd.data, kd.length);
601 4 : if (ret != 0) {
602 : /*
603 : * So we do not leak the allocated
604 : * memory on kd in the error case
605 : */
606 0 : krb5_data_free(&kd);
607 : }
608 : }
609 :
610 4 : return samba_kdc_map_policy_err(nt_status);
611 : }
612 :
613 : /* Now do the standard Heimdal check */
614 18425 : return KRB5_PLUGIN_NO_HANDLE;
615 : }
616 :
617 : /* this function allocates 'data' using malloc.
618 : * The caller is responsible for freeing it */
619 23455 : static krb5_error_code samba_kdc_build_supported_etypes(uint32_t supported_etypes,
620 : krb5_data *e_data)
621 : {
622 23455 : e_data->data = malloc(4);
623 23455 : if (e_data->data == NULL) {
624 0 : return ENOMEM;
625 : }
626 23455 : e_data->length = 4;
627 :
628 23455 : PUSH_LE_U32(e_data->data, 0, supported_etypes);
629 :
630 23455 : return 0;
631 : }
632 :
633 54391 : static krb5_error_code samba_wdc_finalize_reply(void *priv,
634 : astgs_request_t r)
635 : {
636 : struct samba_kdc_entry *server_kdc_entry;
637 : uint32_t supported_enctypes;
638 :
639 54391 : server_kdc_entry = talloc_get_type(kdc_request_get_server(r)->context, struct samba_kdc_entry);
640 :
641 : /*
642 : * If the canonicalize flag is set, add PA-SUPPORTED-ENCTYPES padata
643 : * type to indicate what encryption types the server supports.
644 : */
645 54391 : supported_enctypes = server_kdc_entry->supported_enctypes;
646 54391 : if (kdc_request_get_req(r)->req_body.kdc_options.canonicalize && supported_enctypes != 0) {
647 : krb5_error_code ret;
648 :
649 : PA_DATA md;
650 :
651 23455 : ret = samba_kdc_build_supported_etypes(supported_enctypes, &md.padata_value);
652 23455 : if (ret != 0) {
653 0 : return ret;
654 : }
655 :
656 23455 : md.padata_type = KRB5_PADATA_SUPPORTED_ETYPES;
657 :
658 23455 : ret = kdc_request_add_encrypted_padata(r, &md);
659 23455 : if (ret != 0) {
660 : /*
661 : * So we do not leak the allocated
662 : * memory on kd in the error case
663 : */
664 0 : krb5_data_free(&md.padata_value);
665 : }
666 : }
667 :
668 54391 : return 0;
669 : }
670 :
671 72 : static krb5_error_code samba_wdc_plugin_init(krb5_context context, void **ptr)
672 : {
673 72 : *ptr = NULL;
674 72 : return 0;
675 : }
676 :
677 0 : static void samba_wdc_plugin_fini(void *ptr)
678 : {
679 0 : return;
680 : }
681 :
682 1094 : static krb5_error_code samba_wdc_referral_policy(void *priv,
683 : astgs_request_t r)
684 : {
685 1094 : return kdc_request_get_error_code((kdc_request_t)r);
686 : }
687 :
688 : struct krb5plugin_kdc_ftable kdc_plugin_table = {
689 : .minor_version = KRB5_PLUGIN_KDC_VERSION_10,
690 : .init = samba_wdc_plugin_init,
691 : .fini = samba_wdc_plugin_fini,
692 : .pac_verify = samba_wdc_reget_pac,
693 : .client_access = samba_wdc_check_client_access,
694 : .finalize_reply = samba_wdc_finalize_reply,
695 : .pac_generate = samba_wdc_get_pac,
696 : .referral_policy = samba_wdc_referral_policy,
697 : };
698 :
699 :
|
