?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
WHATSNEW: Update release notes.
[Samba.git] / source3 / libads / kerberos_keytab.c
blobfa2a1261a2823f6d60a211e6bf53de588d51ac9e
1 /*
2 Unix SMB/CIFS implementation.
3 kerberos keytab utility library
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001
6 Copyright (C) Luke Howard 2003
7 Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
8 Copyright (C) Guenther Deschner 2003
9 Copyright (C) Rakesh Patel 2004
10 Copyright (C) Dan Perry 2004
11 Copyright (C) Jeremy Allison 2004
12 Copyright (C) Gerald Carter 2006
13
14 This program is free software; you can redistribute it and/or modify
15 it under the terms of the GNU General Public License as published by
16 the Free Software Foundation; either version 3 of the License, or
17 (at your option) any later version.
18
19 This program is distributed in the hope that it will be useful,
20 but WITHOUT ANY WARRANTY; without even the implied warranty of
21 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 GNU General Public License for more details.
23
24 You should have received a copy of the GNU General Public License
25 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 */
27
28 #include "includes.h"
29 #include "smb_krb5.h"
30
31 #ifdef HAVE_KRB5
32
33 /**********************************************************************
34 **********************************************************************/
35
36 int smb_krb5_kt_add_entry_ext(krb5_context context,
37 krb5_keytab keytab,
38 krb5_kvno kvno,
39 const char *princ_s,
40 krb5_enctype *enctypes,
41 krb5_data password,
42 bool no_salt,
43 bool keep_old_entries)
44 {
45 krb5_error_code ret = 0;
46 krb5_kt_cursor cursor;
47 krb5_keytab_entry kt_entry;
48 krb5_principal princ = NULL;
49 int i;
50 char *ktprinc = NULL;
51
52 ZERO_STRUCT(kt_entry);
53 ZERO_STRUCT(cursor);
54
55 ret = smb_krb5_parse_name(context, princ_s, &princ);
56 if (ret) {
57 DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret)));
58 goto out;
59 }
60
61 /* Seek and delete old keytab entries */
62 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
63 if (ret != KRB5_KT_END && ret != ENOENT ) {
64 DEBUG(3,("smb_krb5_kt_add_entry_ext: Will try to delete old keytab entries\n"));
65 while(!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
66 bool compare_name_ok = False;
67
68 ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal, &ktprinc);
69 if (ret) {
70 DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_unparse_name failed (%s)\n",
71 error_message(ret)));
72 goto out;
73 }
74
75 /*---------------------------------------------------------------------------
76 * Save the entries with kvno - 1. This is what microsoft does
77 * to allow people with existing sessions that have kvno - 1 to still
78 * work. Otherwise, when the password for the machine changes, all
79 * kerberizied sessions will 'break' until either the client reboots or
80 * the client's session key expires and they get a new session ticket
81 * with the new kvno.
82 */
83
84 #ifdef HAVE_KRB5_KT_COMPARE
85 compare_name_ok = (krb5_kt_compare(context, &kt_entry, princ, 0, 0) == True);
86 #else
87 compare_name_ok = (strcmp(ktprinc, princ_s) == 0);
88 #endif
89
90 if (!compare_name_ok) {
91 DEBUG(10,("smb_krb5_kt_add_entry_ext: ignoring keytab entry principal %s, kvno = %d\n",
92 ktprinc, kt_entry.vno));
93 }
94
95 TALLOC_FREE(ktprinc);
96
97 if (compare_name_ok) {
98 if (kt_entry.vno == kvno - 1) {
99 DEBUG(5,("smb_krb5_kt_add_entry_ext: Saving previous (kvno %d) entry for principal: %s.\n",
100 kvno - 1, princ_s));
101 } else if (!keep_old_entries) {
102 DEBUG(5,("smb_krb5_kt_add_entry_ext: Found old entry for principal: %s (kvno %d) - trying to remove it.\n",
103 princ_s, kt_entry.vno));
104 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
105 ZERO_STRUCT(cursor);
106 if (ret) {
107 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_end_seq_get() failed (%s)\n",
108 error_message(ret)));
109 goto out;
110 }
111 ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
112 if (ret) {
113 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_remove_entry failed (%s)\n",
114 error_message(ret)));
115 goto out;
116 }
117
118 DEBUG(5,("smb_krb5_kt_add_entry_ext: removed old entry for principal: %s (kvno %d).\n",
119 princ_s, kt_entry.vno));
120
121 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
122 if (ret) {
123 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_start_seq failed (%s)\n",
124 error_message(ret)));
125 goto out;
126 }
127 ret = smb_krb5_kt_free_entry(context, &kt_entry);
128 ZERO_STRUCT(kt_entry);
129 if (ret) {
130 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_remove_entry failed (%s)\n",
131 error_message(ret)));
132 goto out;
133 }
134 continue;
135 }
136 }
137
138 /* Not a match, just free this entry and continue. */
139 ret = smb_krb5_kt_free_entry(context, &kt_entry);
140 ZERO_STRUCT(kt_entry);
141 if (ret) {
142 DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_kt_free_entry failed (%s)\n", error_message(ret)));
143 goto out;
144 }
145 }
146
147 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
148 ZERO_STRUCT(cursor);
149 if (ret) {
150 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_end_seq_get failed (%s)\n",error_message(ret)));
151 goto out;
152 }
153 }
154
155 /* Ensure we don't double free. */
156 ZERO_STRUCT(kt_entry);
157 ZERO_STRUCT(cursor);
158
159 /* If we get here, we have deleted all the old entries with kvno's not equal to the current kvno-1. */
160
161 /* Now add keytab entries for all encryption types */
162 for (i = 0; enctypes[i]; i++) {
163 krb5_keyblock *keyp;
164
165 keyp = KRB5_KT_KEY(&kt_entry);
166
167 if (create_kerberos_key_from_string(context, princ, &password, keyp, enctypes[i], no_salt)) {
168 continue;
169 }
170
171 kt_entry.principal = princ;
172 kt_entry.vno = kvno;
173
174 DEBUG(3,("smb_krb5_kt_add_entry_ext: adding keytab entry for (%s) with encryption type (%d) and version (%d)\n",
175 princ_s, enctypes[i], kt_entry.vno));
176 ret = krb5_kt_add_entry(context, keytab, &kt_entry);
177 krb5_free_keyblock_contents(context, keyp);
178 ZERO_STRUCT(kt_entry);
179 if (ret) {
180 DEBUG(1,("smb_krb5_kt_add_entry_ext: adding entry to keytab failed (%s)\n", error_message(ret)));
181 goto out;
182 }
183 }
184
185
186 out:
187 {
188 krb5_keytab_entry zero_kt_entry;
189 ZERO_STRUCT(zero_kt_entry);
190 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
191 smb_krb5_kt_free_entry(context, &kt_entry);
192 }
193 }
194 if (princ) {
195 krb5_free_principal(context, princ);
196 }
197
198 {
199 krb5_kt_cursor zero_csr;
200 ZERO_STRUCT(zero_csr);
201 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
202 krb5_kt_end_seq_get(context, keytab, &cursor);
203 }
204 }
205
206 return (int)ret;
207 }
208
209 static int smb_krb5_kt_add_entry(krb5_context context,
210 krb5_keytab keytab,
211 krb5_kvno kvno,
212 const char *princ_s,
213 krb5_enctype *enctypes,
214 krb5_data password)
215 {
216 return smb_krb5_kt_add_entry_ext(context,
217 keytab,
218 kvno,
219 princ_s,
220 enctypes,
221 password,
222 false,
223 false);
224 }
225
226 /**********************************************************************
227 Adds a single service principal, i.e. 'host' to the system keytab
228 ***********************************************************************/
229
230 int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
231 {
232 krb5_error_code ret = 0;
233 krb5_context context = NULL;
234 krb5_keytab keytab = NULL;
235 krb5_data password;
236 krb5_kvno kvno;
237 krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
238 char *princ_s = NULL, *short_princ_s = NULL;
239 char *password_s = NULL;
240 char *my_fqdn;
241 TALLOC_CTX *ctx = NULL;
242 char *machine_name;
243
244 #if defined(ENCTYPE_ARCFOUR_HMAC)
245 enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
246 #endif
247
248 initialize_krb5_error_table();
249 ret = krb5_init_context(&context);
250 if (ret) {
251 DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
252 return -1;
253 }
254
255 ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
256 if (ret) {
257 DEBUG(1,("ads_keytab_add_entry: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
258 goto out;
259 }
260
261 /* retrieve the password */
262 if (!secrets_init()) {
263 DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
264 ret = -1;
265 goto out;
266 }
267 password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
268 if (!password_s) {
269 DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
270 ret = -1;
271 goto out;
272 }
273 ZERO_STRUCT(password);
274 password.data = password_s;
275 password.length = strlen(password_s);
276
277 /* we need the dNSHostName value here */
278
279 if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) {
280 DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
281 ret = -1;
282 goto out;
283 }
284
285 if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) {
286 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
287 ret = -1;
288 goto out;
289 }
290
291 if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) {
292 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
293 ret = -1;
294 goto out;
295 }
296 /*strip the trailing '$' */
297 machine_name[strlen(machine_name)-1] = '\0';
298
299 /* Construct our principal */
300
301 if (strchr_m(srvPrinc, '@')) {
302 /* It's a fully-named principal. */
303 if (asprintf(&princ_s, "%s", srvPrinc) == -1) {
304 ret = -1;
305 goto out;
306 }
307 } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
308 /* It's the machine account, as used by smbclient clients. */
309 if (asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm()) == -1) {
310 ret = -1;
311 goto out;
312 }
313 } else {
314 /* It's a normal service principal. Add the SPN now so that we
315 * can obtain credentials for it and double-check the salt value
316 * used to generate the service's keys. */
317
318 if (asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm()) == -1) {
319 ret = -1;
320 goto out;
321 }
322 if (asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm()) == -1) {
323 ret = -1;
324 goto out;
325 }
326
327 /* According to http://support.microsoft.com/kb/326985/en-us,
328 certain principal names are automatically mapped to the host/...
329 principal in the AD account. So only create these in the
330 keytab, not in AD. --jerry */
331
332 if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) {
333 DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
334
335 if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) {
336 DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
337 goto out;
338 }
339 }
340 }
341
342 kvno = (krb5_kvno) ads_get_machine_kvno(ads, global_myname());
343 if (kvno == -1) { /* -1 indicates failure, everything else is OK */
344 DEBUG(1,("ads_keytab_add_entry: ads_get_machine_kvno failed to determine the system's kvno.\n"));
345 ret = -1;
346 goto out;
347 }
348
349 /* add the fqdn principal to the keytab */
350
351 ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password );
352 if ( ret ) {
353 DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
354 goto out;
355 }
356
357 /* add the short principal name if we have one */
358
359 if ( short_princ_s ) {
360 ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password );
361 if ( ret ) {
362 DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
363 goto out;
364 }
365 }
366
367 out:
368 SAFE_FREE( princ_s );
369 SAFE_FREE( short_princ_s );
370 TALLOC_FREE( ctx );
371
372 if (keytab) {
373 krb5_kt_close(context, keytab);
374 }
375 if (context) {
376 krb5_free_context(context);
377 }
378 return (int)ret;
379 }
380
381 /**********************************************************************
382 Flushes all entries from the system keytab.
383 ***********************************************************************/
384
385 int ads_keytab_flush(ADS_STRUCT *ads)
386 {
387 krb5_error_code ret = 0;
388 krb5_context context = NULL;
389 krb5_keytab keytab = NULL;
390 krb5_kt_cursor cursor;
391 krb5_keytab_entry kt_entry;
392 krb5_kvno kvno;
393
394 ZERO_STRUCT(kt_entry);
395 ZERO_STRUCT(cursor);
396
397 initialize_krb5_error_table();
398 ret = krb5_init_context(&context);
399 if (ret) {
400 DEBUG(1,("ads_keytab_flush: could not krb5_init_context: %s\n",error_message(ret)));
401 return ret;
402 }
403
404 ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
405 if (ret) {
406 DEBUG(1,("ads_keytab_flush: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
407 goto out;
408 }
409
410 kvno = (krb5_kvno) ads_get_machine_kvno(ads, global_myname());
411 if (kvno == -1) { /* -1 indicates a failure */
412 DEBUG(1,("ads_keytab_flush: Error determining the system's kvno.\n"));
413 goto out;
414 }
415
416 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
417 if (ret != KRB5_KT_END && ret != ENOENT) {
418 while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
419 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
420 ZERO_STRUCT(cursor);
421 if (ret) {
422 DEBUG(1,("ads_keytab_flush: krb5_kt_end_seq_get() failed (%s)\n",error_message(ret)));
423 goto out;
424 }
425 ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
426 if (ret) {
427 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
428 goto out;
429 }
430 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
431 if (ret) {
432 DEBUG(1,("ads_keytab_flush: krb5_kt_start_seq failed (%s)\n",error_message(ret)));
433 goto out;
434 }
435 ret = smb_krb5_kt_free_entry(context, &kt_entry);
436 ZERO_STRUCT(kt_entry);
437 if (ret) {
438 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
439 goto out;
440 }
441 }
442 }
443
444 /* Ensure we don't double free. */
445 ZERO_STRUCT(kt_entry);
446 ZERO_STRUCT(cursor);
447
448 if (!ADS_ERR_OK(ads_clear_service_principal_names(ads, global_myname()))) {
449 DEBUG(1,("ads_keytab_flush: Error while clearing service principal listings in LDAP.\n"));
450 goto out;
451 }
452
453 out:
454
455 {
456 krb5_keytab_entry zero_kt_entry;
457 ZERO_STRUCT(zero_kt_entry);
458 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
459 smb_krb5_kt_free_entry(context, &kt_entry);
460 }
461 }
462 {
463 krb5_kt_cursor zero_csr;
464 ZERO_STRUCT(zero_csr);
465 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
466 krb5_kt_end_seq_get(context, keytab, &cursor);
467 }
468 }
469 if (keytab) {
470 krb5_kt_close(context, keytab);
471 }
472 if (context) {
473 krb5_free_context(context);
474 }
475 return ret;
476 }
477
478 /**********************************************************************
479 Adds all the required service principals to the system keytab.
480 ***********************************************************************/
481
482 int ads_keytab_create_default(ADS_STRUCT *ads)
483 {
484 krb5_error_code ret = 0;
485 krb5_context context = NULL;
486 krb5_keytab keytab = NULL;
487 krb5_kt_cursor cursor;
488 krb5_keytab_entry kt_entry;
489 krb5_kvno kvno;
490 int i, found = 0;
491 char *sam_account_name, *upn;
492 char **oldEntries = NULL, *princ_s[26];
493 TALLOC_CTX *ctx = NULL;
494 fstring machine_name;
495
496 memset(princ_s, '\0', sizeof(princ_s));
497
498 fstrcpy( machine_name, global_myname() );
499
500 /* these are the main ones we need */
501
502 if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) {
503 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
504 return ret;
505 }
506
507
508 #if 0 /* don't create the CIFS/... keytab entries since no one except smbd
509 really needs them and we will fall back to verifying against secrets.tdb */
510
511 if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) {
512 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
513 return ret;
514 }
515 #endif
516
517 if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) {
518 DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
519 return -1;
520 }
521
522 /* now add the userPrincipalName and sAMAccountName entries */
523
524 if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) {
525 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
526 TALLOC_FREE( ctx );
527 return -1;
528 }
529
530 /* upper case the sAMAccountName to make it easier for apps to
531 know what case to use in the keytab file */
532
533 strupper_m( sam_account_name );
534
535 if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) {
536 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
537 sam_account_name));
538 return ret;
539 }
540
541 /* remember that not every machine account will have a upn */
542
543 upn = ads_get_upn( ads, ctx, machine_name);
544 if ( upn ) {
545 if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) {
546 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
547 upn));
548 TALLOC_FREE( ctx );
549 return ret;
550 }
551 }
552
553 /* Now loop through the keytab and update any other existing entries... */
554
555 kvno = (krb5_kvno) ads_get_machine_kvno(ads, machine_name);
556 if (kvno == -1) {
557 DEBUG(1,("ads_keytab_create_default: ads_get_machine_kvno failed to determine the system's kvno.\n"));
558 TALLOC_FREE(ctx);
559 return -1;
560 }
561
562 DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
563 "preserve and update.\n"));
564
565 ZERO_STRUCT(kt_entry);
566 ZERO_STRUCT(cursor);
567
568 initialize_krb5_error_table();
569 ret = krb5_init_context(&context);
570 if (ret) {
571 DEBUG(1,("ads_keytab_create_default: could not krb5_init_context: %s\n",error_message(ret)));
572 TALLOC_FREE(ctx);
573 return ret;
574 }
575
576 ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
577 if (ret) {
578 DEBUG(1,("ads_keytab_create_default: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
579 goto done;
580 }
581
582 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
583 if (ret != KRB5_KT_END && ret != ENOENT ) {
584 while ((ret = krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) == 0) {
585 smb_krb5_kt_free_entry(context, &kt_entry);
586 ZERO_STRUCT(kt_entry);
587 found++;
588 }
589 }
590 krb5_kt_end_seq_get(context, keytab, &cursor);
591 ZERO_STRUCT(cursor);
592
593 /*
594 * Hmmm. There is no "rewind" function for the keytab. This means we have a race condition
595 * where someone else could add entries after we've counted them. Re-open asap to minimise
596 * the race. JRA.
597 */
598
599 DEBUG(3, ("ads_keytab_create_default: Found %d entries in the keytab.\n", found));
600 if (!found) {
601 goto done;
602 }
603 oldEntries = talloc_array(ctx, char *, found );
604 if (!oldEntries) {
605 DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));
606 ret = -1;
607 goto done;
608 }
609 memset(oldEntries, '\0', found * sizeof(char *));
610
611 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
612 if (ret != KRB5_KT_END && ret != ENOENT ) {
613 while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
614 if (kt_entry.vno != kvno) {
615 char *ktprinc = NULL;
616 char *p;
617
618 /* This returns a malloc'ed string in ktprinc. */
619 ret = smb_krb5_unparse_name(oldEntries, context, kt_entry.principal, &ktprinc);
620 if (ret) {
621 DEBUG(1,("smb_krb5_unparse_name failed (%s)\n", error_message(ret)));
622 goto done;
623 }
624 /*
625 * From looking at the krb5 source they don't seem to take locale
626 * or mb strings into account. Maybe this is because they assume utf8 ?
627 * In this case we may need to convert from utf8 to mb charset here ? JRA.
628 */
629 p = strchr_m(ktprinc, '@');
630 if (p) {
631 *p = '\0';
632 }
633
634 p = strchr_m(ktprinc, '/');
635 if (p) {
636 *p = '\0';
637 }
638 for (i = 0; i < found; i++) {
639 if (!oldEntries[i]) {
640 oldEntries[i] = ktprinc;
641 break;
642 }
643 if (!strcmp(oldEntries[i], ktprinc)) {
644 TALLOC_FREE(ktprinc);
645 break;
646 }
647 }
648 if (i == found) {
649 TALLOC_FREE(ktprinc);
650 }
651 }
652 smb_krb5_kt_free_entry(context, &kt_entry);
653 ZERO_STRUCT(kt_entry);
654 }
655 ret = 0;
656 for (i = 0; oldEntries[i]; i++) {
657 ret |= ads_keytab_add_entry(ads, oldEntries[i]);
658 TALLOC_FREE(oldEntries[i]);
659 }
660 krb5_kt_end_seq_get(context, keytab, &cursor);
661 }
662 ZERO_STRUCT(cursor);
663
664 done:
665
666 TALLOC_FREE(oldEntries);
667 TALLOC_FREE(ctx);
668
669 {
670 krb5_keytab_entry zero_kt_entry;
671 ZERO_STRUCT(zero_kt_entry);
672 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
673 smb_krb5_kt_free_entry(context, &kt_entry);
674 }
675 }
676 {
677 krb5_kt_cursor zero_csr;
678 ZERO_STRUCT(zero_csr);
679 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
680 krb5_kt_end_seq_get(context, keytab, &cursor);
681 }
682 }
683 if (keytab) {
684 krb5_kt_close(context, keytab);
685 }
686 if (context) {
687 krb5_free_context(context);
688 }
689 return ret;
690 }
691
692 /**********************************************************************
693 List system keytab.
694 ***********************************************************************/
695
696 int ads_keytab_list(const char *keytab_name)
697 {
698 krb5_error_code ret = 0;
699 krb5_context context = NULL;
700 krb5_keytab keytab = NULL;
701 krb5_kt_cursor cursor;
702 krb5_keytab_entry kt_entry;
703
704 ZERO_STRUCT(kt_entry);
705 ZERO_STRUCT(cursor);
706
707 initialize_krb5_error_table();
708 ret = krb5_init_context(&context);
709 if (ret) {
710 DEBUG(1,("ads_keytab_list: could not krb5_init_context: %s\n",error_message(ret)));
711 return ret;
712 }
713
714 ret = smb_krb5_open_keytab(context, keytab_name, False, &keytab);
715 if (ret) {
716 DEBUG(1,("ads_keytab_list: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
717 goto out;
718 }
719
720 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
721 if (ret) {
722 goto out;
723 }
724
725 printf("Vno Type Principal\n");
726
727 while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
728
729 char *princ_s = NULL;
730 char *etype_s = NULL;
731 krb5_enctype enctype = 0;
732
733 ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal, &princ_s);
734 if (ret) {
735 goto out;
736 }
737
738 enctype = smb_get_enctype_from_kt_entry(&kt_entry);
739
740 ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
741 if (ret) {
742 if (asprintf(&etype_s, "UNKNOWN: %d\n", enctype) == -1)
743 {
744 TALLOC_FREE(princ_s);
745 goto out;
746 }
747 }
748
749 printf("%3d %s\t\t %s\n", kt_entry.vno, etype_s, princ_s);
750
751 TALLOC_FREE(princ_s);
752 SAFE_FREE(etype_s);
753
754 ret = smb_krb5_kt_free_entry(context, &kt_entry);
755 if (ret) {
756 goto out;
757 }
758 }
759
760 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
761 if (ret) {
762 goto out;
763 }
764
765 /* Ensure we don't double free. */
766 ZERO_STRUCT(kt_entry);
767 ZERO_STRUCT(cursor);
768 out:
769
770 {
771 krb5_keytab_entry zero_kt_entry;
772 ZERO_STRUCT(zero_kt_entry);
773 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
774 smb_krb5_kt_free_entry(context, &kt_entry);
775 }
776 }
777 {
778 krb5_kt_cursor zero_csr;
779 ZERO_STRUCT(zero_csr);
780 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
781 krb5_kt_end_seq_get(context, keytab, &cursor);
782 }
783 }
784
785 if (keytab) {
786 krb5_kt_close(context, keytab);
787 }
788 if (context) {
789 krb5_free_context(context);
790 }
791 return ret;
792 }
793
794 #endif /* HAVE_KRB5 */
Samba GIT mirror