libads/kerberos_verify.c

ソースコードを見る。

関数
const krb5_data *	krb5_princ_component (krb5_context, krb5_principal, int)
static BOOL	ads_keytab_verify_ticket (krb5_context context, krb5_auth_context auth_context, const DATA_BLOB *ticket, krb5_ticket **pp_tkt, krb5_keyblock **keyblock, krb5_error_code *perr)
static krb5_error_code	ads_secrets_verify_ticket (krb5_context context, krb5_auth_context auth_context, krb5_principal host_princ, const DATA_BLOB *ticket, krb5_ticket **pp_tkt, krb5_keyblock **keyblock, krb5_error_code *perr)
NTSTATUS	ads_verify_ticket (TALLOC_CTX *mem_ctx, const char *realm, time_t time_offset, const DATA_BLOB *ticket, char **principal, PAC_DATA **pac_data, DATA_BLOB *ap_rep, DATA_BLOB *session_key)

---

関数

const krb5_data * krb5_princ_component	(	krb5_context	,
		krb5_principal	,
		int
	)

clikrb5.c の 753 行で定義されています。

参照元 ads_verify_ticket()・smb_krb5_principal_compare_any_realm().

{
        static krb5_data kdata;

        kdata.data = (char *)krb5_principal_get_comp_string(context, principal, i);
        kdata.length = strlen((const char *)kdata.data);
        return &kdata;
}

static BOOL ads_keytab_verify_ticket	(	krb5_context	context,
		krb5_auth_context	auth_context,
		const DATA_BLOB *	ticket,
		krb5_ticket **	pp_tkt,
		krb5_keyblock **	keyblock,
		krb5_error_code *	perr
	)			[static]

kerberos_verify.c の 41 行で定義されています。

参照先 asprintf()・data_blob_::data・global_myname・krb5_rd_req_return_keyblock_from_keytab()・data_blob_::length・name_to_fqdn()・packet・smb_krb5_kt_free_entry()・smb_krb5_unparse_name()・strequal().

参照元 ads_verify_ticket().

{
        krb5_error_code ret = 0;
        BOOL auth_ok = False;
        krb5_keytab keytab = NULL;
        krb5_kt_cursor kt_cursor;
        krb5_keytab_entry kt_entry;
        char *valid_princ_formats[7] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL };
        char *entry_princ_s = NULL;
        fstring my_name, my_fqdn;
        int i;
        int number_matched_principals = 0;
        krb5_data packet;

        *pp_tkt = NULL;
        *keyblock = NULL;
        *perr = 0;

        /* Generate the list of principal names which we expect
         * clients might want to use for authenticating to the file
         * service.  We allow name$,{host,cifs}/{name,fqdn,name.REALM}. */

        fstrcpy(my_name, global_myname());

        my_fqdn[0] = '\0';
        name_to_fqdn(my_fqdn, global_myname());

        asprintf(&valid_princ_formats[0], "%s$@%s", my_name, lp_realm());
        asprintf(&valid_princ_formats[1], "host/%s@%s", my_name, lp_realm());
        asprintf(&valid_princ_formats[2], "host/%s@%s", my_fqdn, lp_realm());
        asprintf(&valid_princ_formats[3], "host/%s.%s@%s", my_name, lp_realm(), lp_realm());
        asprintf(&valid_princ_formats[4], "cifs/%s@%s", my_name, lp_realm());
        asprintf(&valid_princ_formats[5], "cifs/%s@%s", my_fqdn, lp_realm());
        asprintf(&valid_princ_formats[6], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm());

        ZERO_STRUCT(kt_entry);
        ZERO_STRUCT(kt_cursor);

        ret = krb5_kt_default(context, &keytab);
        if (ret) {
                DEBUG(1, ("ads_keytab_verify_ticket: krb5_kt_default failed (%s)\n", error_message(ret)));
                goto out;
        }

        /* Iterate through the keytab.  For each key, if the principal
         * name case-insensitively matches one of the allowed formats,
         * try verifying the ticket using that principal. */

        ret = krb5_kt_start_seq_get(context, keytab, &kt_cursor);
        if (ret) {
                DEBUG(1, ("ads_keytab_verify_ticket: krb5_kt_start_seq_get failed (%s)\n", error_message(ret)));
                goto out;
        }
  
        while (!auth_ok && (krb5_kt_next_entry(context, keytab, &kt_entry, &kt_cursor) == 0)) {
                ret = smb_krb5_unparse_name(context, kt_entry.principal, &entry_princ_s);
                if (ret) {
                        DEBUG(1, ("ads_keytab_verify_ticket: smb_krb5_unparse_name failed (%s)\n",
                                error_message(ret)));
                        goto out;
                }

                for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {

                        if (!strequal(entry_princ_s, valid_princ_formats[i])) {
                                continue;
                        }

                        number_matched_principals++;
                        packet.length = ticket->length;
                        packet.data = (char *)ticket->data;
                        *pp_tkt = NULL;

                        ret = krb5_rd_req_return_keyblock_from_keytab(context, &auth_context, &packet,
                                                                      kt_entry.principal, keytab,
                                                                      NULL, pp_tkt, keyblock);

                        if (ret) {
                                DEBUG(10,("ads_keytab_verify_ticket: "
                                        "krb5_rd_req_return_keyblock_from_keytab(%s) failed: %s\n",
                                        entry_princ_s, error_message(ret)));

                                /* workaround for MIT: 
                                * as krb5_ktfile_get_entry will explicitly
                                * close the krb5_keytab as soon as krb5_rd_req
                                * has successfully decrypted the ticket but the
                                * ticket is not valid yet (due to clockskew)
                                * there is no point in querying more keytab
                                * entries - Guenther */
                                        
                                if (ret == KRB5KRB_AP_ERR_TKT_NYV || 
                                    ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
                                    ret == KRB5KRB_AP_ERR_SKEW) {
                                        break;
                                }
                        } else {
                                DEBUG(3,("ads_keytab_verify_ticket: "
                                        "krb5_rd_req_return_keyblock_from_keytab succeeded for principal %s\n",
                                        entry_princ_s));
                                auth_ok = True;
                                break;
                        }
                }

                /* Free the name we parsed. */
                SAFE_FREE(entry_princ_s);

                /* Free the entry we just read. */
                smb_krb5_kt_free_entry(context, &kt_entry);
                ZERO_STRUCT(kt_entry);
        }
        krb5_kt_end_seq_get(context, keytab, &kt_cursor);

        ZERO_STRUCT(kt_cursor);

  out:
        
        for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
                SAFE_FREE(valid_princ_formats[i]);
        }
        
        if (!auth_ok) {
                if (!number_matched_principals) {
                        DEBUG(3, ("ads_keytab_verify_ticket: no keytab principals matched expected file service name.\n"));
                } else {
                        DEBUG(3, ("ads_keytab_verify_ticket: krb5_rd_req failed for all %d matched keytab principals\n",
                                number_matched_principals));
                }
        }

        SAFE_FREE(entry_princ_s);

        {
                krb5_keytab_entry zero_kt_entry;
                ZERO_STRUCT(zero_kt_entry);
                if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
                        smb_krb5_kt_free_entry(context, &kt_entry);
                }
        }

        {
                krb5_kt_cursor zero_csr;
                ZERO_STRUCT(zero_csr);
                if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
                        krb5_kt_end_seq_get(context, keytab, &kt_cursor);
                }
        }

        if (keytab) {
                krb5_kt_close(context, keytab);
        }
        *perr = ret;
        return auth_ok;
}

static krb5_error_code ads_secrets_verify_ticket	(	krb5_context	context,
		krb5_auth_context	auth_context,
		krb5_principal	host_princ,
		const DATA_BLOB *	ticket,
		krb5_ticket **	pp_tkt,
		krb5_keyblock **	keyblock,
		krb5_error_code *	perr
	)			[static]

kerberos_verify.c の 205 行で定義されています。

参照先 create_kerberos_key_from_string()・data_blob_::data・krb5_auth_con_setuseruserkey()・data_blob_::length・lp_workgroup()・packet・password・secrets_fetch_machine_password()・secrets_init().

参照元 ads_verify_ticket().

{
        krb5_error_code ret = 0;
        BOOL auth_ok = False;
        char *password_s = NULL;
        krb5_data password;
        krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
        krb5_data packet;
        int i;

        *pp_tkt = NULL;
        *keyblock = NULL;
        *perr = 0;

#if defined(ENCTYPE_ARCFOUR_HMAC)
        enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
#endif

        if (!secrets_init()) {
                DEBUG(1,("ads_secrets_verify_ticket: secrets_init failed\n"));
                *perr = KRB5_CONFIG_CANTOPEN;
                return False;
        }

        password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
        if (!password_s) {
                DEBUG(1,("ads_secrets_verify_ticket: failed to fetch machine password\n"));
                *perr = KRB5_LIBOS_CANTREADPWD;
                return False;
        }

        password.data = password_s;
        password.length = strlen(password_s);

        /* CIFS doesn't use addresses in tickets. This would break NAT. JRA */

        packet.length = ticket->length;
        packet.data = (char *)ticket->data;

        /* We need to setup a auth context with each possible encoding type in turn. */
        for (i=0;enctypes[i];i++) {
                krb5_keyblock *key = NULL;

                if (!(key = SMB_MALLOC_P(krb5_keyblock))) {
                        ret = ENOMEM;
                        goto out;
                }
        
                if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) {
                        SAFE_FREE(key);
                        continue;
                }

                krb5_auth_con_setuseruserkey(context, auth_context, key);

                if (!(ret = krb5_rd_req(context, &auth_context, &packet, 
                                        NULL,
                                        NULL, NULL, pp_tkt))) {
                        DEBUG(10,("ads_secrets_verify_ticket: enc type [%u] decrypted message !\n",
                                (unsigned int)enctypes[i] ));
                        auth_ok = True;
                        krb5_copy_keyblock(context, key, keyblock);
                        krb5_free_keyblock(context, key);
                        break;
                }

                DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
                                ("ads_secrets_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
                                (unsigned int)enctypes[i], error_message(ret)));

                /* successfully decrypted but ticket is just not valid at the moment */
                if (ret == KRB5KRB_AP_ERR_TKT_NYV || 
                    ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
                    ret == KRB5KRB_AP_ERR_SKEW) {
                        break;
                }

                krb5_free_keyblock(context, key);

        }

 out:
        SAFE_FREE(password_s);
        *perr = ret;
        return auth_ok;
}

NTSTATUS ads_verify_ticket	(	TALLOC_CTX *	mem_ctx,
		const char *	realm,
		time_t	time_offset,
		const DATA_BLOB *	ticket,
		char **	principal,
		PAC_DATA **	pac_data,
		DATA_BLOB *	ap_rep,
		DATA_BLOB *	session_key
	)

kerberos_verify.c の 303 行で定義されています。

参照先 ads_keytab_verify_ticket()・ads_secrets_verify_ticket()・asprintf()・data_blob_::data・data_blob()・data_blob_free()・decode_pac_data()・dump_data_pw()・file_save()・get_auth_data_from_tkt()・get_authtime_from_tkt()・get_krb5_smb_session_key()・get_principal_from_tkt()・global_myname・grab_server_mutex()・kerberos_free_data_contents()・krb5_princ_component()・krb5_set_real_time()・krb5_to_nt_status()・data_blob_::length・nt_errstr()・packet・release_server_mutex()・smb_krb5_parse_name()・smb_krb5_unparse_name()・strlower_m().

参照元 manage_gss_spnego_request()・reply_spnego_kerberos()・winbindd_raw_kerberos_login().

{
        NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
        NTSTATUS pac_ret;
        DATA_BLOB auth_data;
        krb5_context context = NULL;
        krb5_auth_context auth_context = NULL;
        krb5_data packet;
        krb5_ticket *tkt = NULL;
        krb5_rcache rcache = NULL;
        krb5_keyblock *keyblock = NULL;
        time_t authtime;
        krb5_error_code ret = 0;
        
        krb5_principal host_princ = NULL;
        krb5_const_principal client_principal = NULL;
        char *host_princ_s = NULL;
        BOOL auth_ok = False;
        BOOL got_replay_mutex = False;
        BOOL got_auth_data = False;

        ZERO_STRUCT(packet);
        ZERO_STRUCT(auth_data);

        *principal = NULL;
        *pac_data = NULL;
        *ap_rep = data_blob(NULL,0);
        *session_key = data_blob(NULL,0);

        initialize_krb5_error_table();
        ret = krb5_init_context(&context);
        if (ret) {
                DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
                return NT_STATUS_LOGON_FAILURE;
        }

        if (time_offset != 0) {
                krb5_set_real_time(context, time(NULL) + time_offset, 0);
        }

        ret = krb5_set_default_realm(context, realm);
        if (ret) {
                DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
                goto out;
        }

        /* This whole process is far more complex than I would
           like. We have to go through all this to allow us to store
           the secret internally, instead of using /etc/krb5.keytab */

        ret = krb5_auth_con_init(context, &auth_context);
        if (ret) {
                DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
                goto out;
        }

        asprintf(&host_princ_s, "%s$", global_myname());
        if (!host_princ_s) {
                goto out;
        }

        strlower_m(host_princ_s);
        ret = smb_krb5_parse_name(context, host_princ_s, &host_princ);
        if (ret) {
                DEBUG(1,("ads_verify_ticket: smb_krb5_parse_name(%s) failed (%s)\n",
                                        host_princ_s, error_message(ret)));
                goto out;
        }


        /* Lock a mutex surrounding the replay as there is no locking in the MIT krb5
         * code surrounding the replay cache... */

        if (!grab_server_mutex("replay cache mutex")) {
                DEBUG(1,("ads_verify_ticket: unable to protect replay cache with mutex.\n"));
                ret = KRB5_CC_IO;
                goto out;
        }

        got_replay_mutex = True;

        /*
         * JRA. We must set the rcache here. This will prevent replay attacks.
         */

        ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache);
        if (ret) {
                DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache failed (%s)\n", error_message(ret)));
                goto out;
        }

        ret = krb5_auth_con_setrcache(context, auth_context, rcache);
        if (ret) {
                DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache failed (%s)\n", error_message(ret)));
                goto out;
        }

        if (lp_use_kerberos_keytab()) {
                auth_ok = ads_keytab_verify_ticket(context, auth_context, ticket, &tkt, &keyblock, &ret);
        }
        if (!auth_ok) {
                auth_ok = ads_secrets_verify_ticket(context, auth_context, host_princ,
                                                    ticket, &tkt, &keyblock, &ret);
        }

        release_server_mutex();
        got_replay_mutex = False;

#if 0
        /* Heimdal leaks here, if we fix the leak, MIT crashes */
        if (rcache) {
                krb5_rc_close(context, rcache);
        }
#endif

        if (!auth_ok) {
                DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n", 
                         error_message(ret)));
                /* Try map the error return in case it's something like
                 * a clock skew error.
                 */
                sret = krb5_to_nt_status(ret);
                if (NT_STATUS_IS_OK(sret) || NT_STATUS_EQUAL(sret,NT_STATUS_UNSUCCESSFUL)) {
                        sret = NT_STATUS_LOGON_FAILURE;
                }
                DEBUG(10,("ads_verify_ticket: returning error %s\n",
                        nt_errstr(sret) ));
                goto out;
        } 
        
        authtime = get_authtime_from_tkt(tkt);
        client_principal = get_principal_from_tkt(tkt);

        ret = krb5_mk_rep(context, auth_context, &packet);
        if (ret) {
                DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
                        error_message(ret)));
                goto out;
        }

        *ap_rep = data_blob(packet.data, packet.length);
        if (packet.data) {
                kerberos_free_data_contents(context, &packet);
                ZERO_STRUCT(packet);
        }

        get_krb5_smb_session_key(context, auth_context, session_key, True);
        dump_data_pw("SMB session key (from ticket)\n", session_key->data, session_key->length);

#if 0
        file_save("/tmp/ticket.dat", ticket->data, ticket->length);
#endif

        /* continue when no PAC is retrieved or we couldn't decode the PAC 
           (like accounts that have the UF_NO_AUTH_DATA_REQUIRED flag set, or
           Kerberos tickets encrypted using a DES key) - Guenther */

        got_auth_data = get_auth_data_from_tkt(mem_ctx, &auth_data, tkt);
        if (!got_auth_data) {
                DEBUG(3,("ads_verify_ticket: did not retrieve auth data. continuing without PAC\n"));
        }

        if (got_auth_data && pac_data != NULL) {

                pac_ret = decode_pac_data(mem_ctx, &auth_data, context, keyblock, client_principal, authtime, pac_data);
                if (!NT_STATUS_IS_OK(pac_ret)) {
                        DEBUG(3,("ads_verify_ticket: failed to decode PAC_DATA: %s\n", nt_errstr(pac_ret)));
                        *pac_data = NULL;
                }
                data_blob_free(&auth_data);
        }

#if 0
#if defined(HAVE_KRB5_TKT_ENC_PART2)
        /* MIT */
        if (tkt->enc_part2) {
                file_save("/tmp/authdata.dat",
                          tkt->enc_part2->authorization_data[0]->contents,
                          tkt->enc_part2->authorization_data[0]->length);
        }
#else
        /* Heimdal */
        if (tkt->ticket.authorization_data) {
                file_save("/tmp/authdata.dat",
                          tkt->ticket.authorization_data->val->ad_data.data,
                          tkt->ticket.authorization_data->val->ad_data.length);
        }
#endif
#endif

        if ((ret = smb_krb5_unparse_name(context, client_principal, principal))) {
                DEBUG(3,("ads_verify_ticket: smb_krb5_unparse_name failed (%s)\n", 
                         error_message(ret)));
                sret = NT_STATUS_LOGON_FAILURE;
                goto out;
        }

        sret = NT_STATUS_OK;

 out:

        if (got_replay_mutex) {
                release_server_mutex();
        }

        if (!NT_STATUS_IS_OK(sret)) {
                data_blob_free(&auth_data);
        }

        if (!NT_STATUS_IS_OK(sret)) {
                data_blob_free(ap_rep);
        }

        if (host_princ) {
                krb5_free_principal(context, host_princ);
        }

        if (keyblock) {
                krb5_free_keyblock(context, keyblock);
        }

        if (tkt != NULL) {
                krb5_free_ticket(context, tkt);
        }

        SAFE_FREE(host_princ_s);

        if (auth_context) {
                krb5_auth_con_free(context, auth_context);
        }

        if (context) {
                krb5_free_context(context);
        }

        return sret;
}

---