2 Unix SMB/CIFS implementation.
3 kerberos keytab utility library
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001
6 Copyright (C) Luke Howard 2003
7 Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
8 Copyright (C) Guenther Deschner 2003
9 Copyright (C) Rakesh Patel 2004
10 Copyright (C) Dan Perry 2004
11 Copyright (C) Jeremy Allison 2004
12 Copyright (C) Gerald Carter 2006
14 This program is free software; you can redistribute it and/or modify
15 it under the terms of the GNU General Public License as published by
16 the Free Software Foundation; either version 3 of the License, or
17 (at your option) any later version.
19 This program is distributed in the hope that it will be useful,
20 but WITHOUT ANY WARRANTY; without even the implied warranty of
21 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 GNU General Public License for more details.
24 You should have received a copy of the GNU General Public License
25 along with this program. If not, see <http://www.gnu.org/licenses/>.
32 /**********************************************************************
33 **********************************************************************/
35 static int smb_krb5_kt_add_entry( krb5_context context
, krb5_keytab keytab
,
36 krb5_kvno kvno
, const char *princ_s
,
37 krb5_enctype
*enctypes
, krb5_data password
)
39 krb5_error_code ret
= 0;
40 krb5_kt_cursor cursor
;
41 krb5_keytab_entry kt_entry
;
42 krb5_principal princ
= NULL
;
46 ZERO_STRUCT(kt_entry
);
49 ret
= smb_krb5_parse_name(context
, princ_s
, &princ
);
51 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_parse_name(%s) failed (%s)\n", princ_s
, error_message(ret
)));
55 /* Seek and delete old keytab entries */
56 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
57 if (ret
!= KRB5_KT_END
&& ret
!= ENOENT
) {
58 DEBUG(3,("smb_krb5_kt_add_entry: Will try to delete old keytab entries\n"));
59 while(!krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
)) {
60 bool compare_name_ok
= False
;
62 ret
= smb_krb5_unparse_name(context
, kt_entry
.principal
, &ktprinc
);
64 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_unparse_name failed (%s)\n",
69 /*---------------------------------------------------------------------------
70 * Save the entries with kvno - 1. This is what microsoft does
71 * to allow people with existing sessions that have kvno - 1 to still
72 * work. Otherwise, when the password for the machine changes, all
73 * kerberizied sessions will 'break' until either the client reboots or
74 * the client's session key expires and they get a new session ticket
78 #ifdef HAVE_KRB5_KT_COMPARE
79 compare_name_ok
= (krb5_kt_compare(context
, &kt_entry
, princ
, 0, 0) == True
);
81 compare_name_ok
= (strcmp(ktprinc
, princ_s
) == 0);
84 if (!compare_name_ok
) {
85 DEBUG(10,("smb_krb5_kt_add_entry: ignoring keytab entry principal %s, kvno = %d\n",
86 ktprinc
, kt_entry
.vno
));
91 if (compare_name_ok
) {
92 if (kt_entry
.vno
== kvno
- 1) {
93 DEBUG(5,("smb_krb5_kt_add_entry: Saving previous (kvno %d) entry for principal: %s.\n",
97 DEBUG(5,("smb_krb5_kt_add_entry: Found old entry for principal: %s (kvno %d) - trying to remove it.\n",
98 princ_s
, kt_entry
.vno
));
99 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
102 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_end_seq_get() failed (%s)\n",
103 error_message(ret
)));
106 ret
= krb5_kt_remove_entry(context
, keytab
, &kt_entry
);
108 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_remove_entry failed (%s)\n",
109 error_message(ret
)));
113 DEBUG(5,("smb_krb5_kt_add_entry: removed old entry for principal: %s (kvno %d).\n",
114 princ_s
, kt_entry
.vno
));
116 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
118 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_start_seq failed (%s)\n",
119 error_message(ret
)));
122 ret
= smb_krb5_kt_free_entry(context
, &kt_entry
);
123 ZERO_STRUCT(kt_entry
);
125 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_remove_entry failed (%s)\n",
126 error_message(ret
)));
133 /* Not a match, just free this entry and continue. */
134 ret
= smb_krb5_kt_free_entry(context
, &kt_entry
);
135 ZERO_STRUCT(kt_entry
);
137 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_kt_free_entry failed (%s)\n", error_message(ret
)));
142 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
145 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_end_seq_get failed (%s)\n",error_message(ret
)));
150 /* Ensure we don't double free. */
151 ZERO_STRUCT(kt_entry
);
154 /* If we get here, we have deleted all the old entries with kvno's not equal to the current kvno-1. */
156 /* Now add keytab entries for all encryption types */
157 for (i
= 0; enctypes
[i
]; i
++) {
160 #if !defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) && !defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)
161 #error krb5_keytab_entry has no key or keyblock member
163 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY /* MIT */
164 keyp
= &kt_entry
.key
;
166 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK /* Heimdal */
167 keyp
= &kt_entry
.keyblock
;
169 if (create_kerberos_key_from_string(context
, princ
, &password
, keyp
, enctypes
[i
])) {
173 kt_entry
.principal
= princ
;
176 DEBUG(3,("smb_krb5_kt_add_entry: adding keytab entry for (%s) with encryption type (%d) and version (%d)\n",
177 princ_s
, enctypes
[i
], kt_entry
.vno
));
178 ret
= krb5_kt_add_entry(context
, keytab
, &kt_entry
);
179 krb5_free_keyblock_contents(context
, keyp
);
180 ZERO_STRUCT(kt_entry
);
182 DEBUG(1,("smb_krb5_kt_add_entry: adding entry to keytab failed (%s)\n", error_message(ret
)));
190 krb5_keytab_entry zero_kt_entry
;
191 ZERO_STRUCT(zero_kt_entry
);
192 if (memcmp(&zero_kt_entry
, &kt_entry
, sizeof(krb5_keytab_entry
))) {
193 smb_krb5_kt_free_entry(context
, &kt_entry
);
197 krb5_free_principal(context
, princ
);
201 krb5_kt_cursor zero_csr
;
202 ZERO_STRUCT(zero_csr
);
203 if ((memcmp(&cursor
, &zero_csr
, sizeof(krb5_kt_cursor
)) != 0) && keytab
) {
204 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
212 /**********************************************************************
213 Adds a single service principal, i.e. 'host' to the system keytab
214 ***********************************************************************/
216 int ads_keytab_add_entry(ADS_STRUCT
*ads
, const char *srvPrinc
)
218 krb5_error_code ret
= 0;
219 krb5_context context
= NULL
;
220 krb5_keytab keytab
= NULL
;
223 krb5_enctype enctypes
[4] = { ENCTYPE_DES_CBC_CRC
, ENCTYPE_DES_CBC_MD5
, 0, 0 };
224 char *princ_s
= NULL
, *short_princ_s
= NULL
;
225 char *password_s
= NULL
;
227 TALLOC_CTX
*ctx
= NULL
;
230 #if defined(ENCTYPE_ARCFOUR_HMAC)
231 enctypes
[2] = ENCTYPE_ARCFOUR_HMAC
;
234 initialize_krb5_error_table();
235 ret
= krb5_init_context(&context
);
237 DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret
)));
241 ret
= smb_krb5_open_keytab(context
, NULL
, True
, &keytab
);
243 DEBUG(1,("ads_keytab_add_entry: smb_krb5_open_keytab failed (%s)\n", error_message(ret
)));
247 /* retrieve the password */
248 if (!secrets_init()) {
249 DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
253 password_s
= secrets_fetch_machine_password(lp_workgroup(), NULL
, NULL
);
255 DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
259 ZERO_STRUCT(password
);
260 password
.data
= password_s
;
261 password
.length
= strlen(password_s
);
263 /* we need the dNSHostName value here */
265 if ( (ctx
= talloc_init("ads_keytab_add_entry")) == NULL
) {
266 DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
271 if ( (my_fqdn
= ads_get_dnshostname( ads
, ctx
, global_myname())) == NULL
) {
272 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
277 if ( (machine_name
= ads_get_samaccountname( ads
, ctx
, global_myname())) == NULL
) {
278 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
282 /*strip the trailing '$' */
283 machine_name
[strlen(machine_name
)-1] = '\0';
285 /* Construct our principal */
287 if (strchr_m(srvPrinc
, '@')) {
288 /* It's a fully-named principal. */
289 asprintf(&princ_s
, "%s", srvPrinc
);
290 } else if (srvPrinc
[strlen(srvPrinc
)-1] == '$') {
291 /* It's the machine account, as used by smbclient clients. */
292 asprintf(&princ_s
, "%s@%s", srvPrinc
, lp_realm());
294 /* It's a normal service principal. Add the SPN now so that we
295 * can obtain credentials for it and double-check the salt value
296 * used to generate the service's keys. */
298 asprintf(&princ_s
, "%s/%s@%s", srvPrinc
, my_fqdn
, lp_realm());
299 asprintf(&short_princ_s
, "%s/%s@%s", srvPrinc
, machine_name
, lp_realm());
301 /* According to http://support.microsoft.com/kb/326985/en-us,
302 certain principal names are automatically mapped to the host/...
303 principal in the AD account. So only create these in the
304 keytab, not in AD. --jerry */
306 if ( !strequal( srvPrinc
, "cifs" ) && !strequal(srvPrinc
, "host" ) ) {
307 DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s
));
309 if (!ADS_ERR_OK(ads_add_service_principal_name(ads
, global_myname(), my_fqdn
, srvPrinc
))) {
310 DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
316 kvno
= (krb5_kvno
) ads_get_kvno(ads
, global_myname());
317 if (kvno
== -1) { /* -1 indicates failure, everything else is OK */
318 DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n"));
323 /* add the fqdn principal to the keytab */
325 ret
= smb_krb5_kt_add_entry( context
, keytab
, kvno
, princ_s
, enctypes
, password
);
327 DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
331 /* add the short principal name if we have one */
333 if ( short_princ_s
) {
334 ret
= smb_krb5_kt_add_entry( context
, keytab
, kvno
, short_princ_s
, enctypes
, password
);
336 DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
342 SAFE_FREE( princ_s
);
343 SAFE_FREE( short_princ_s
);
347 krb5_kt_close(context
, keytab
);
350 krb5_free_context(context
);
355 /**********************************************************************
356 Flushes all entries from the system keytab.
357 ***********************************************************************/
359 int ads_keytab_flush(ADS_STRUCT
*ads
)
361 krb5_error_code ret
= 0;
362 krb5_context context
= NULL
;
363 krb5_keytab keytab
= NULL
;
364 krb5_kt_cursor cursor
;
365 krb5_keytab_entry kt_entry
;
368 ZERO_STRUCT(kt_entry
);
371 initialize_krb5_error_table();
372 ret
= krb5_init_context(&context
);
374 DEBUG(1,("ads_keytab_flush: could not krb5_init_context: %s\n",error_message(ret
)));
378 ret
= smb_krb5_open_keytab(context
, NULL
, True
, &keytab
);
380 DEBUG(1,("ads_keytab_flush: smb_krb5_open_keytab failed (%s)\n", error_message(ret
)));
384 kvno
= (krb5_kvno
) ads_get_kvno(ads
, global_myname());
385 if (kvno
== -1) { /* -1 indicates a failure */
386 DEBUG(1,("ads_keytab_flush: Error determining the system's kvno.\n"));
390 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
391 if (ret
!= KRB5_KT_END
&& ret
!= ENOENT
) {
392 while (!krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
)) {
393 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
396 DEBUG(1,("ads_keytab_flush: krb5_kt_end_seq_get() failed (%s)\n",error_message(ret
)));
399 ret
= krb5_kt_remove_entry(context
, keytab
, &kt_entry
);
401 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret
)));
404 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
406 DEBUG(1,("ads_keytab_flush: krb5_kt_start_seq failed (%s)\n",error_message(ret
)));
409 ret
= smb_krb5_kt_free_entry(context
, &kt_entry
);
410 ZERO_STRUCT(kt_entry
);
412 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret
)));
418 /* Ensure we don't double free. */
419 ZERO_STRUCT(kt_entry
);
422 if (!ADS_ERR_OK(ads_clear_service_principal_names(ads
, global_myname()))) {
423 DEBUG(1,("ads_keytab_flush: Error while clearing service principal listings in LDAP.\n"));
430 krb5_keytab_entry zero_kt_entry
;
431 ZERO_STRUCT(zero_kt_entry
);
432 if (memcmp(&zero_kt_entry
, &kt_entry
, sizeof(krb5_keytab_entry
))) {
433 smb_krb5_kt_free_entry(context
, &kt_entry
);
437 krb5_kt_cursor zero_csr
;
438 ZERO_STRUCT(zero_csr
);
439 if ((memcmp(&cursor
, &zero_csr
, sizeof(krb5_kt_cursor
)) != 0) && keytab
) {
440 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
444 krb5_kt_close(context
, keytab
);
447 krb5_free_context(context
);
452 /**********************************************************************
453 Adds all the required service principals to the system keytab.
454 ***********************************************************************/
456 int ads_keytab_create_default(ADS_STRUCT
*ads
)
458 krb5_error_code ret
= 0;
459 krb5_context context
= NULL
;
460 krb5_keytab keytab
= NULL
;
461 krb5_kt_cursor cursor
;
462 krb5_keytab_entry kt_entry
;
465 char *sam_account_name
, *upn
;
466 char **oldEntries
= NULL
, *princ_s
[26];
467 TALLOC_CTX
*ctx
= NULL
;
468 fstring machine_name
;
470 memset(princ_s
, '\0', sizeof(princ_s
));
472 fstrcpy( machine_name
, global_myname() );
474 /* these are the main ones we need */
476 if ( (ret
= ads_keytab_add_entry(ads
, "host") ) != 0 ) {
477 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
482 #if 0 /* don't create the CIFS/... keytab entries since no one except smbd
483 really needs them and we will fall back to verifying against secrets.tdb */
485 if ( (ret
= ads_keytab_add_entry(ads
, "cifs")) != 0 ) {
486 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
491 if ( (ctx
= talloc_init("ads_keytab_create_default")) == NULL
) {
492 DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
496 /* now add the userPrincipalName and sAMAccountName entries */
498 if ( (sam_account_name
= ads_get_samaccountname( ads
, ctx
, machine_name
)) == NULL
) {
499 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
504 /* upper case the sAMAccountName to make it easier for apps to
505 know what case to use in the keytab file */
507 strupper_m( sam_account_name
);
509 if ( (ret
= ads_keytab_add_entry(ads
, sam_account_name
)) != 0 ) {
510 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
515 /* remember that not every machine account will have a upn */
517 upn
= ads_get_upn( ads
, ctx
, machine_name
);
519 if ( (ret
= ads_keytab_add_entry(ads
, upn
)) != 0 ) {
520 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
529 /* Now loop through the keytab and update any other existing entries... */
531 kvno
= (krb5_kvno
) ads_get_kvno(ads
, machine_name
);
533 DEBUG(1,("ads_keytab_create_default: ads_get_kvno failed to determine the system's kvno.\n"));
537 DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
538 "preserve and update.\n"));
540 ZERO_STRUCT(kt_entry
);
543 initialize_krb5_error_table();
544 ret
= krb5_init_context(&context
);
546 DEBUG(1,("ads_keytab_create_default: could not krb5_init_context: %s\n",error_message(ret
)));
550 ret
= smb_krb5_open_keytab(context
, NULL
, True
, &keytab
);
552 DEBUG(1,("ads_keytab_create_default: smb_krb5_open_keytab failed (%s)\n", error_message(ret
)));
556 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
557 if (ret
!= KRB5_KT_END
&& ret
!= ENOENT
) {
558 while ((ret
= krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
)) == 0) {
559 smb_krb5_kt_free_entry(context
, &kt_entry
);
560 ZERO_STRUCT(kt_entry
);
564 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
568 * Hmmm. There is no "rewind" function for the keytab. This means we have a race condition
569 * where someone else could add entries after we've counted them. Re-open asap to minimise
573 DEBUG(3, ("ads_keytab_create_default: Found %d entries in the keytab.\n", found
));
577 oldEntries
= SMB_MALLOC_ARRAY(char *, found
);
579 DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));
583 memset(oldEntries
, '\0', found
* sizeof(char *));
585 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
586 if (ret
!= KRB5_KT_END
&& ret
!= ENOENT
) {
587 while (krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
) == 0) {
588 if (kt_entry
.vno
!= kvno
) {
589 char *ktprinc
= NULL
;
592 /* This returns a malloc'ed string in ktprinc. */
593 ret
= smb_krb5_unparse_name(context
, kt_entry
.principal
, &ktprinc
);
595 DEBUG(1,("smb_krb5_unparse_name failed (%s)\n", error_message(ret
)));
599 * From looking at the krb5 source they don't seem to take locale
600 * or mb strings into account. Maybe this is because they assume utf8 ?
601 * In this case we may need to convert from utf8 to mb charset here ? JRA.
603 p
= strchr_m(ktprinc
, '@');
608 p
= strchr_m(ktprinc
, '/');
612 for (i
= 0; i
< found
; i
++) {
613 if (!oldEntries
[i
]) {
614 oldEntries
[i
] = ktprinc
;
617 if (!strcmp(oldEntries
[i
], ktprinc
)) {
626 smb_krb5_kt_free_entry(context
, &kt_entry
);
627 ZERO_STRUCT(kt_entry
);
630 for (i
= 0; oldEntries
[i
]; i
++) {
631 ret
|= ads_keytab_add_entry(ads
, oldEntries
[i
]);
632 SAFE_FREE(oldEntries
[i
]);
634 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
640 SAFE_FREE(oldEntries
);
643 krb5_keytab_entry zero_kt_entry
;
644 ZERO_STRUCT(zero_kt_entry
);
645 if (memcmp(&zero_kt_entry
, &kt_entry
, sizeof(krb5_keytab_entry
))) {
646 smb_krb5_kt_free_entry(context
, &kt_entry
);
650 krb5_kt_cursor zero_csr
;
651 ZERO_STRUCT(zero_csr
);
652 if ((memcmp(&cursor
, &zero_csr
, sizeof(krb5_kt_cursor
)) != 0) && keytab
) {
653 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
657 krb5_kt_close(context
, keytab
);
660 krb5_free_context(context
);
665 /**********************************************************************
667 ***********************************************************************/
669 int ads_keytab_list(const char *keytab_name
)
671 krb5_error_code ret
= 0;
672 krb5_context context
= NULL
;
673 krb5_keytab keytab
= NULL
;
674 krb5_kt_cursor cursor
;
675 krb5_keytab_entry kt_entry
;
677 ZERO_STRUCT(kt_entry
);
680 initialize_krb5_error_table();
681 ret
= krb5_init_context(&context
);
683 DEBUG(1,("ads_keytab_list: could not krb5_init_context: %s\n",error_message(ret
)));
687 ret
= smb_krb5_open_keytab(context
, keytab_name
, False
, &keytab
);
689 DEBUG(1,("ads_keytab_list: smb_krb5_open_keytab failed (%s)\n", error_message(ret
)));
693 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
698 printf("Vno Type Principal\n");
700 while (krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
) == 0) {
702 char *princ_s
= NULL
;
703 char *etype_s
= NULL
;
704 krb5_enctype enctype
= 0;
706 ret
= smb_krb5_unparse_name(context
, kt_entry
.principal
, &princ_s
);
711 enctype
= smb_get_enctype_from_kt_entry(&kt_entry
);
713 ret
= smb_krb5_enctype_to_string(context
, enctype
, &etype_s
);
719 printf("%3d %s\t\t %s\n", kt_entry
.vno
, etype_s
, princ_s
);
724 ret
= smb_krb5_kt_free_entry(context
, &kt_entry
);
730 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
735 /* Ensure we don't double free. */
736 ZERO_STRUCT(kt_entry
);
741 krb5_keytab_entry zero_kt_entry
;
742 ZERO_STRUCT(zero_kt_entry
);
743 if (memcmp(&zero_kt_entry
, &kt_entry
, sizeof(krb5_keytab_entry
))) {
744 smb_krb5_kt_free_entry(context
, &kt_entry
);
748 krb5_kt_cursor zero_csr
;
749 ZERO_STRUCT(zero_csr
);
750 if ((memcmp(&cursor
, &zero_csr
, sizeof(krb5_kt_cursor
)) != 0) && keytab
) {
751 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
756 krb5_kt_close(context
, keytab
);
759 krb5_free_context(context
);
764 #endif /* HAVE_KRB5 */