2 Unix SMB/CIFS implementation.
3 dump the remote SAM using rpc samsync operations
5 Copyright (C) Guenther Deschner 2008.
6 Copyright (C) Michael Adam 2008
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "libnet/libnet_keytab.h"
30 /****************************************************************
31 ****************************************************************/
33 static int keytab_close(struct libnet_keytab_context
*ctx
)
39 if (ctx
->keytab
&& ctx
->context
) {
40 krb5_kt_close(ctx
->context
, ctx
->keytab
);
44 krb5_free_context(ctx
->context
);
48 ads_destroy(&ctx
->ads
);
56 /****************************************************************
57 ****************************************************************/
59 krb5_error_code
libnet_keytab_init(TALLOC_CTX
*mem_ctx
,
60 const char *keytab_name
,
61 struct libnet_keytab_context
**ctx
)
63 krb5_error_code ret
= 0;
64 krb5_context context
= NULL
;
65 krb5_keytab keytab
= NULL
;
66 const char *keytab_string
= NULL
;
68 struct libnet_keytab_context
*r
;
70 r
= talloc_zero(mem_ctx
, struct libnet_keytab_context
);
75 talloc_set_destructor(r
, keytab_close
);
77 initialize_krb5_error_table();
78 ret
= krb5_init_context(&context
);
80 DEBUG(1,("keytab_init: could not krb5_init_context: %s\n",
85 ret
= smb_krb5_kt_open_relative(context
,
87 true, /* write_access */
90 DEBUG(1,("keytab_init: smb_krb5_open_keytab failed (%s)\n",
92 krb5_free_context(context
);
96 ret
= smb_krb5_kt_get_name(mem_ctx
, context
, keytab
, &keytab_string
);
98 krb5_kt_close(context
, keytab
);
99 krb5_free_context(context
);
103 r
->context
= context
;
105 r
->keytab_name
= keytab_string
;
106 r
->clean_old_entries
= false;
113 /****************************************************************
114 ****************************************************************/
117 * Remove all entries that have the given principal, kvno and enctype.
119 static krb5_error_code
libnet_keytab_remove_entries(krb5_context context
,
121 const char *principal
,
123 const krb5_enctype enctype
,
127 krb5_kt_cursor cursor
;
128 krb5_keytab_entry kt_entry
;
130 ZERO_STRUCT(kt_entry
);
133 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
138 while (krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
) == 0)
141 char *princ_s
= NULL
;
143 if (kt_entry
.vno
!= kvno
&& !ignore_kvno
) {
147 keyp
= KRB5_KT_KEY(&kt_entry
);
149 if (KRB5_KEY_TYPE(keyp
) != enctype
) {
153 ret
= smb_krb5_unparse_name(talloc_tos(), context
, kt_entry
.principal
,
156 DEBUG(5, ("smb_krb5_unparse_name failed (%s)\n",
157 error_message(ret
)));
161 if (strcmp(principal
, princ_s
) != 0) {
165 /* match found - remove */
167 DEBUG(10, ("found entry for principal %s, kvno %d, "
168 "enctype %d - trying to remove it\n",
169 princ_s
, kt_entry
.vno
, KRB5_KEY_TYPE(keyp
)));
171 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
174 DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
175 error_message(ret
)));
179 ret
= krb5_kt_remove_entry(context
, keytab
,
182 DEBUG(5, ("krb5_kt_remove_entry failed (%s)\n",
183 error_message(ret
)));
186 DEBUG(10, ("removed entry for principal %s, kvno %d, "
187 "enctype %d\n", princ_s
, kt_entry
.vno
,
188 KRB5_KEY_TYPE(keyp
)));
190 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
192 DEBUG(5, ("krb5_kt_start_seq_get failed (%s)\n",
193 error_message(ret
)));
198 smb_krb5_kt_free_entry(context
, &kt_entry
);
199 TALLOC_FREE(princ_s
);
202 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
204 DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
205 error_message(ret
)));
211 static krb5_error_code
libnet_keytab_add_entry(krb5_context context
,
215 krb5_enctype enctype
,
219 krb5_keytab_entry kt_entry
;
221 krb5_principal salt_princ
= NULL
;
224 /* remove duplicates first ... */
225 ret
= libnet_keytab_remove_entries(context
, keytab
, princ_s
, kvno
,
228 DEBUG(1, ("libnet_keytab_remove_entries failed: %s\n",
229 error_message(ret
)));
232 ZERO_STRUCT(kt_entry
);
236 ret
= smb_krb5_parse_name(context
, princ_s
, &kt_entry
.principal
);
238 DEBUG(1, ("smb_krb5_parse_name(%s) failed (%s)\n",
239 princ_s
, error_message(ret
)));
243 keyp
= KRB5_KT_KEY(&kt_entry
);
245 salt_princ_s
= kerberos_secrets_fetch_salt_princ();
246 if (salt_princ_s
== NULL
) {
247 ret
= KRB5KRB_ERR_GENERIC
;
251 ret
= krb5_parse_name(context
, salt_princ_s
, &salt_princ
);
252 SAFE_FREE(salt_princ_s
);
254 ret
= KRB5KRB_ERR_GENERIC
;
258 ret
= create_kerberos_key_from_string(context
,
265 krb5_free_principal(context
, salt_princ
);
267 ret
= KRB5KRB_ERR_GENERIC
;
271 ret
= krb5_kt_add_entry(context
, keytab
, &kt_entry
);
273 DEBUG(1, ("adding entry to keytab failed (%s)\n",
274 error_message(ret
)));
278 krb5_free_keyblock_contents(context
, keyp
);
279 krb5_free_principal(context
, kt_entry
.principal
);
280 ZERO_STRUCT(kt_entry
);
281 smb_krb5_kt_free_entry(context
, &kt_entry
);
286 krb5_error_code
libnet_keytab_add(struct libnet_keytab_context
*ctx
)
288 krb5_error_code ret
= 0;
292 if (ctx
->clean_old_entries
) {
293 DEBUG(0, ("cleaning old entries...\n"));
294 for (i
=0; i
< ctx
->count
; i
++) {
295 struct libnet_keytab_entry
*entry
= &ctx
->entries
[i
];
297 ret
= libnet_keytab_remove_entries(ctx
->context
,
304 DEBUG(1,("libnet_keytab_add: Failed to remove "
305 "old entries for %s (enctype %u): %s\n",
306 entry
->principal
, entry
->enctype
,
307 error_message(ret
)));
313 for (i
=0; i
<ctx
->count
; i
++) {
315 struct libnet_keytab_entry
*entry
= &ctx
->entries
[i
];
318 ZERO_STRUCT(password
);
319 password
.data
= (char *)entry
->password
.data
;
320 password
.length
= entry
->password
.length
;
322 ret
= libnet_keytab_add_entry(ctx
->context
,
329 DEBUG(1,("libnet_keytab_add: "
330 "Failed to add entry to keytab file\n"));
338 struct libnet_keytab_entry
*libnet_keytab_search(struct libnet_keytab_context
*ctx
,
339 const char *principal
,
341 const krb5_enctype enctype
,
344 krb5_error_code ret
= 0;
345 krb5_kt_cursor cursor
;
346 krb5_keytab_entry kt_entry
;
347 struct libnet_keytab_entry
*entry
= NULL
;
349 ZERO_STRUCT(kt_entry
);
352 ret
= krb5_kt_start_seq_get(ctx
->context
, ctx
->keytab
, &cursor
);
354 DEBUG(10, ("krb5_kt_start_seq_get failed: %s\n",
355 error_message(ret
)));
359 while (krb5_kt_next_entry(ctx
->context
, ctx
->keytab
, &kt_entry
, &cursor
) == 0)
362 char *princ_s
= NULL
;
366 if (kt_entry
.vno
!= kvno
) {
370 keyp
= KRB5_KT_KEY(&kt_entry
);
372 if (KRB5_KEY_TYPE(keyp
) != enctype
) {
376 entry
= talloc_zero(mem_ctx
, struct libnet_keytab_entry
);
378 DEBUG(3, ("talloc failed\n"));
382 ret
= smb_krb5_unparse_name(entry
, ctx
->context
, kt_entry
.principal
,
388 if (strcmp(principal
, princ_s
) != 0) {
392 entry
->principal
= talloc_strdup(entry
, princ_s
);
393 if (!entry
->principal
) {
394 DEBUG(3, ("talloc_strdup_failed\n"));
398 entry
->name
= talloc_move(entry
, &princ_s
);
400 entry
->password
= data_blob_talloc(entry
, KRB5_KEY_DATA(keyp
),
401 KRB5_KEY_LENGTH(keyp
));
402 if (!entry
->password
.data
) {
403 DEBUG(3, ("data_blob_talloc failed\n"));
407 DEBUG(10, ("found entry\n"));
409 smb_krb5_kt_free_entry(ctx
->context
, &kt_entry
);
413 smb_krb5_kt_free_entry(ctx
->context
, &kt_entry
);
418 smb_krb5_kt_free_entry(ctx
->context
, &kt_entry
);
423 krb5_kt_end_seq_get(ctx
->context
, ctx
->keytab
, &cursor
);
428 * Helper function to add data to the list
429 * of keytab entries. It builds the prefix from the input.
431 NTSTATUS
libnet_keytab_add_to_keytab_entries(TALLOC_CTX
*mem_ctx
,
432 struct libnet_keytab_context
*ctx
,
436 const krb5_enctype enctype
,
439 struct libnet_keytab_entry entry
;
442 entry
.name
= talloc_strdup(mem_ctx
, name
);
443 entry
.principal
= talloc_asprintf(mem_ctx
, "%s%s%s@%s",
444 prefix
? prefix
: "",
446 name
, ctx
->dns_domain_name
);
447 entry
.enctype
= enctype
;
448 entry
.password
= blob
;
449 NT_STATUS_HAVE_NO_MEMORY(entry
.name
);
450 NT_STATUS_HAVE_NO_MEMORY(entry
.principal
);
451 NT_STATUS_HAVE_NO_MEMORY(entry
.password
.data
);
453 ADD_TO_ARRAY(mem_ctx
, struct libnet_keytab_entry
, entry
,
454 &ctx
->entries
, &ctx
->count
);
455 NT_STATUS_HAVE_NO_MEMORY(ctx
->entries
);
460 #endif /* HAVE_KRB5 */