2 Unix SMB/CIFS implementation.
3 dump the remote SAM using rpc samsync operations
5 Copyright (C) Guenther Deschner 2008.
6 Copyright (C) Michael Adam 2008
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "libnet/libnet_keytab.h"
30 /****************************************************************
31 ****************************************************************/
33 static int keytab_close(struct libnet_keytab_context
*ctx
)
39 if (ctx
->keytab
&& ctx
->context
) {
40 krb5_kt_close(ctx
->context
, ctx
->keytab
);
44 krb5_free_context(ctx
->context
);
48 ads_destroy(&ctx
->ads
);
56 /****************************************************************
57 ****************************************************************/
59 krb5_error_code
libnet_keytab_init(TALLOC_CTX
*mem_ctx
,
60 const char *keytab_name
,
61 struct libnet_keytab_context
**ctx
)
63 krb5_error_code ret
= 0;
64 krb5_context context
= NULL
;
65 krb5_keytab keytab
= NULL
;
66 const char *keytab_string
= NULL
;
68 struct libnet_keytab_context
*r
;
70 r
= talloc_zero(mem_ctx
, struct libnet_keytab_context
);
75 talloc_set_destructor(r
, keytab_close
);
77 ret
= smb_krb5_init_context_common(&context
);
79 DBG_ERR("kerberos init context failed (%s)\n",
84 ret
= smb_krb5_kt_open_relative(context
,
86 true, /* write_access */
89 DEBUG(1,("keytab_init: smb_krb5_open_keytab failed (%s)\n",
91 krb5_free_context(context
);
95 ret
= smb_krb5_kt_get_name(mem_ctx
, context
, keytab
, &keytab_string
);
97 krb5_kt_close(context
, keytab
);
98 krb5_free_context(context
);
102 r
->context
= context
;
104 r
->keytab_name
= keytab_string
;
105 r
->clean_old_entries
= false;
112 /****************************************************************
113 ****************************************************************/
116 * Remove all entries that have the given principal, kvno and enctype.
118 static krb5_error_code
libnet_keytab_remove_entries(krb5_context context
,
120 const char *principal
,
122 const krb5_enctype enctype
,
126 krb5_kt_cursor cursor
;
127 krb5_keytab_entry kt_entry
;
129 ZERO_STRUCT(kt_entry
);
132 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
137 while (krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
) == 0)
140 char *princ_s
= NULL
;
142 if (kt_entry
.vno
!= kvno
&& !ignore_kvno
) {
146 keyp
= KRB5_KT_KEY(&kt_entry
);
148 if (KRB5_KEY_TYPE(keyp
) != enctype
) {
152 ret
= smb_krb5_unparse_name(talloc_tos(), context
, kt_entry
.principal
,
155 DEBUG(5, ("smb_krb5_unparse_name failed (%s)\n",
156 error_message(ret
)));
160 if (strcmp(principal
, princ_s
) != 0) {
164 /* match found - remove */
166 DEBUG(10, ("found entry for principal %s, kvno %d, "
167 "enctype %d - trying to remove it\n",
168 princ_s
, kt_entry
.vno
, KRB5_KEY_TYPE(keyp
)));
170 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
173 DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
174 error_message(ret
)));
178 ret
= krb5_kt_remove_entry(context
, keytab
,
181 DEBUG(5, ("krb5_kt_remove_entry failed (%s)\n",
182 error_message(ret
)));
185 DEBUG(10, ("removed entry for principal %s, kvno %d, "
186 "enctype %d\n", princ_s
, kt_entry
.vno
,
187 KRB5_KEY_TYPE(keyp
)));
189 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
191 DEBUG(5, ("krb5_kt_start_seq_get failed (%s)\n",
192 error_message(ret
)));
197 smb_krb5_kt_free_entry(context
, &kt_entry
);
198 TALLOC_FREE(princ_s
);
201 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
203 DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
204 error_message(ret
)));
210 static krb5_error_code
libnet_keytab_add_entry(krb5_context context
,
214 krb5_enctype enctype
,
218 krb5_keytab_entry kt_entry
;
220 krb5_principal salt_princ
= NULL
;
223 /* remove duplicates first ... */
224 ret
= libnet_keytab_remove_entries(context
, keytab
, princ_s
, kvno
,
227 DEBUG(1, ("libnet_keytab_remove_entries failed: %s\n",
228 error_message(ret
)));
231 ZERO_STRUCT(kt_entry
);
235 ret
= smb_krb5_parse_name(context
, princ_s
, &kt_entry
.principal
);
237 DEBUG(1, ("smb_krb5_parse_name(%s) failed (%s)\n",
238 princ_s
, error_message(ret
)));
242 keyp
= KRB5_KT_KEY(&kt_entry
);
244 salt_princ_s
= kerberos_secrets_fetch_salt_princ();
245 if (salt_princ_s
== NULL
) {
246 ret
= KRB5KRB_ERR_GENERIC
;
250 ret
= krb5_parse_name(context
, salt_princ_s
, &salt_princ
);
251 SAFE_FREE(salt_princ_s
);
253 ret
= KRB5KRB_ERR_GENERIC
;
257 ret
= create_kerberos_key_from_string(context
,
264 krb5_free_principal(context
, salt_princ
);
266 ret
= KRB5KRB_ERR_GENERIC
;
270 ret
= krb5_kt_add_entry(context
, keytab
, &kt_entry
);
272 DEBUG(1, ("adding entry to keytab failed (%s)\n",
273 error_message(ret
)));
277 krb5_free_keyblock_contents(context
, keyp
);
278 krb5_free_principal(context
, kt_entry
.principal
);
279 ZERO_STRUCT(kt_entry
);
280 smb_krb5_kt_free_entry(context
, &kt_entry
);
285 krb5_error_code
libnet_keytab_add(struct libnet_keytab_context
*ctx
)
287 krb5_error_code ret
= 0;
291 if (ctx
->clean_old_entries
) {
292 DEBUG(0, ("cleaning old entries...\n"));
293 for (i
=0; i
< ctx
->count
; i
++) {
294 struct libnet_keytab_entry
*entry
= &ctx
->entries
[i
];
296 ret
= libnet_keytab_remove_entries(ctx
->context
,
303 DEBUG(1,("libnet_keytab_add: Failed to remove "
304 "old entries for %s (enctype %u): %s\n",
305 entry
->principal
, entry
->enctype
,
306 error_message(ret
)));
312 for (i
=0; i
<ctx
->count
; i
++) {
314 struct libnet_keytab_entry
*entry
= &ctx
->entries
[i
];
317 ZERO_STRUCT(password
);
318 password
.data
= (char *)entry
->password
.data
;
319 password
.length
= entry
->password
.length
;
321 ret
= libnet_keytab_add_entry(ctx
->context
,
328 DEBUG(1,("libnet_keytab_add: "
329 "Failed to add entry to keytab file\n"));
337 struct libnet_keytab_entry
*libnet_keytab_search(struct libnet_keytab_context
*ctx
,
338 const char *principal
,
340 const krb5_enctype enctype
,
343 krb5_error_code ret
= 0;
344 krb5_kt_cursor cursor
;
345 krb5_keytab_entry kt_entry
;
346 struct libnet_keytab_entry
*entry
= NULL
;
348 ZERO_STRUCT(kt_entry
);
351 ret
= krb5_kt_start_seq_get(ctx
->context
, ctx
->keytab
, &cursor
);
353 DEBUG(10, ("krb5_kt_start_seq_get failed: %s\n",
354 error_message(ret
)));
358 while (krb5_kt_next_entry(ctx
->context
, ctx
->keytab
, &kt_entry
, &cursor
) == 0)
361 char *princ_s
= NULL
;
365 if (kt_entry
.vno
!= kvno
) {
369 keyp
= KRB5_KT_KEY(&kt_entry
);
371 if (KRB5_KEY_TYPE(keyp
) != enctype
) {
375 entry
= talloc_zero(mem_ctx
, struct libnet_keytab_entry
);
377 DEBUG(3, ("talloc failed\n"));
381 ret
= smb_krb5_unparse_name(entry
, ctx
->context
, kt_entry
.principal
,
387 if (strcmp(principal
, princ_s
) != 0) {
391 entry
->principal
= talloc_strdup(entry
, princ_s
);
392 if (!entry
->principal
) {
393 DEBUG(3, ("talloc_strdup_failed\n"));
397 entry
->name
= talloc_move(entry
, &princ_s
);
399 entry
->password
= data_blob_talloc(entry
, KRB5_KEY_DATA(keyp
),
400 KRB5_KEY_LENGTH(keyp
));
401 if (!entry
->password
.data
) {
402 DEBUG(3, ("data_blob_talloc failed\n"));
406 DEBUG(10, ("found entry\n"));
408 smb_krb5_kt_free_entry(ctx
->context
, &kt_entry
);
412 smb_krb5_kt_free_entry(ctx
->context
, &kt_entry
);
417 smb_krb5_kt_free_entry(ctx
->context
, &kt_entry
);
422 krb5_kt_end_seq_get(ctx
->context
, ctx
->keytab
, &cursor
);
427 * Helper function to add data to the list
428 * of keytab entries. It builds the prefix from the input.
430 NTSTATUS
libnet_keytab_add_to_keytab_entries(TALLOC_CTX
*mem_ctx
,
431 struct libnet_keytab_context
*ctx
,
435 const krb5_enctype enctype
,
438 struct libnet_keytab_entry entry
;
441 entry
.name
= talloc_strdup(mem_ctx
, name
);
442 entry
.principal
= talloc_asprintf(mem_ctx
, "%s%s%s@%s",
443 prefix
? prefix
: "",
445 name
, ctx
->dns_domain_name
);
446 entry
.enctype
= enctype
;
447 entry
.password
= blob
;
448 NT_STATUS_HAVE_NO_MEMORY(entry
.name
);
449 NT_STATUS_HAVE_NO_MEMORY(entry
.principal
);
450 NT_STATUS_HAVE_NO_MEMORY(entry
.password
.data
);
452 ADD_TO_ARRAY(mem_ctx
, struct libnet_keytab_entry
, entry
,
453 &ctx
->entries
, &ctx
->count
);
454 NT_STATUS_HAVE_NO_MEMORY(ctx
->entries
);
459 #endif /* HAVE_KRB5 */