2 * Copyright (c) 2000 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kuser_locl.h"
35 RCSID("$Id: kimpersonate.c 22117 2007-12-03 21:24:16Z lha $");
36 #include <parse_units.h>
38 static char *client_principal_str = NULL;
39 static krb5_principal client_principal;
40 static char *server_principal_str = NULL;
41 static krb5_principal server_principal;
43 static char *ccache_str = NULL;
45 static char *ticket_flags_str = NULL;
46 static TicketFlags ticket_flags;
47 static char *keytab_file = NULL;
48 static char *enc_type = "des-cbc-md5";
49 static int expiration_time = 3600;
50 static struct getarg_strings client_addresses;
51 static int version_flag = 0;
52 static int help_flag = 0;
53 static int use_krb5 = 1;
60 encode_ticket (krb5_context context,
70 EncryptedData enc_part;
74 memset (&enc_part, 0, sizeof(enc_part));
75 memset (&ticket, 0, sizeof(ticket));
81 et.flags = cred->flags.b;
82 et.key = cred->session;
83 et.crealm = *krb5_princ_realm (context, cred->client);
84 copy_PrincipalName(&cred->client->name, &et.cname);
86 krb5_data empty_string;
88 krb5_data_zero(&empty_string);
89 et.transited.tr_type = DOMAIN_X500_COMPRESS;
90 et.transited.contents = empty_string;
92 et.authtime = cred->times.authtime;
94 et.endtime = cred->times.endtime;
96 et.caddr = &cred->addresses;
97 et.authorization_data = NULL; /* XXX allow random authorization_data */
100 * Encrypt `enc_part' of ticket with service key
103 ASN1_MALLOC_ENCODE(EncTicketPart, buf, len, &et, &size, ret);
105 krb5_err(context, 1, ret, "EncTicketPart");
107 krb5_crypto_init(context, skey, etype, &crypto);
108 krb5_encrypt_EncryptedData (context,
116 krb5_crypto_destroy(context, crypto);
123 ticket.realm = *krb5_princ_realm (context, cred->server);
124 copy_PrincipalName(&cred->server->name, &ticket.sname);
126 ASN1_MALLOC_ENCODE(Ticket, buf, len, &ticket, &size, ret);
128 krb5_err (context, 1, ret, "encode_Ticket");
130 krb5_data_copy(&cred->ticket, buf, len);
138 create_krb5_tickets (krb5_context context, krb5_keytab kt)
141 krb5_keytab_entry entry;
146 memset (&cred, 0, sizeof(cred));
148 ret = krb5_string_to_enctype (context, enc_type, &etype);
150 krb5_err (context, 1, ret, "krb5_string_to_enctype");
151 ret = krb5_kt_get_entry (context, kt, server_principal,
154 krb5_err (context, 1, ret, "krb5_kt_get_entry");
161 ret = krb5_copy_principal (context, client_principal, &cred.client);
163 krb5_err (context, 1, ret, "krb5_copy_principal");
164 ret = krb5_copy_principal (context, server_principal, &cred.server);
166 krb5_err (context, 1, ret, "krb5_copy_principal");
167 krb5_generate_random_keyblock(context, etype, &cred.session);
169 cred.times.authtime = time(NULL);
170 cred.times.starttime = time(NULL);
171 cred.times.endtime = time(NULL) + expiration_time;
172 cred.times.renew_till = 0;
173 krb5_data_zero(&cred.second_ticket);
175 ret = krb5_get_all_client_addrs (context, &cred.addresses);
177 krb5_err (context, 1, ret, "krb5_get_all_client_addrs");
178 cred.flags.b = ticket_flags;
182 * Encode encrypted part of ticket
185 encode_ticket (context, &entry.keyblock, etype, entry.vno, &cred);
192 ret = krb5_cc_resolve(context, ccache_str, &ccache);
194 krb5_err (context, 1, ret, "krb5_cc_resolve");
196 ret = krb5_cc_default (context, &ccache);
198 krb5_err (context, 1, ret, "krb5_cc_default");
201 ret = krb5_cc_initialize (context, ccache, cred.client);
203 krb5_err (context, 1, ret, "krb5_cc_initialize");
205 ret = krb5_cc_store_cred (context, ccache, &cred);
207 krb5_err (context, 1, ret, "krb5_cc_store_cred");
209 krb5_free_cred_contents (context, &cred);
210 krb5_cc_close (context, ccache);
220 setup_env (krb5_context context, krb5_keytab *kt)
225 ret = krb5_kt_resolve (context, keytab_file, kt);
227 ret = krb5_kt_default (context, kt);
229 krb5_err (context, 1, ret, "resolving keytab");
231 if (client_principal_str == NULL)
232 krb5_errx (context, 1, "missing client principal");
233 ret = krb5_parse_name (context, client_principal_str, &client_principal);
235 krb5_err (context, 1, ret, "resolvning client name");
237 if (server_principal_str == NULL)
238 krb5_errx (context, 1, "missing server principal");
239 ret = krb5_parse_name (context, server_principal_str, &server_principal);
241 krb5_err (context, 1, ret, "resolvning client name");
243 if (ticket_flags_str) {
244 int ticket_flags_int;
246 ticket_flags_int = parse_flags(ticket_flags_str,
247 asn1_TicketFlags_units(), 0);
248 if (ticket_flags_int <= 0) {
249 krb5_warnx (context, "bad ticket flags: `%s'", ticket_flags_str);
250 print_flags_table (asn1_TicketFlags_units(), stderr);
253 if (ticket_flags_int)
254 ticket_flags = int2TicketFlags (ticket_flags_int);
262 struct getargs args[] = {
263 { "ccache", 0, arg_string, &ccache_str,
264 "name of kerberos 5 credential cache", "cache-name"},
265 { "server", 's', arg_string, &server_principal_str,
266 "name of server principal" },
267 { "client", 'c', arg_string, &client_principal_str,
268 "name of client principal" },
269 { "keytab", 'k', arg_string, &keytab_file,
270 "name of keytab file" },
271 { "krb5", '5', arg_flag, &use_krb5,
272 "create a kerberos 5 ticket"},
273 { "expire-time", 'e', arg_integer, &expiration_time,
274 "lifetime of ticket in seconds" },
275 { "client-addresses", 'a', arg_strings, &client_addresses,
276 "addresses of client" },
277 { "enc-type", 't', arg_string, &enc_type,
279 { "ticket-flags", 'f', arg_string, &ticket_flags_str,
280 "ticket flags for krb5 ticket" },
281 { "version", 0, arg_flag, &version_flag, "Print version",
283 { "help", 0, arg_flag, &help_flag, NULL,
290 arg_printusage (args,
291 sizeof(args) / sizeof(args[0]),
298 main (int argc, char **argv)
302 krb5_context context;
305 setprogname (argv[0]);
307 ret = krb5_init_context (&context);
309 errx(1, "krb5_init_context failed: %u", ret);
311 if (getarg (args, sizeof(args) / sizeof(args[0]), argc, argv,
323 setup_env (context, &kt);
326 create_krb5_tickets (context, kt);
328 krb5_kt_close (context, kt);