source3/libnet/libnet_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    dump the remote SAM using rpc samsync operations
   4
   5    Copyright (C) Guenther Deschner 2008.
   6    Copyright (C) Michael Adam 2008
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smb_krb5.h"
  24 #include "ads.h"
  25 #include "secrets.h"
  26 #include "libnet/libnet_keytab.h"
  27
  28 #ifdef HAVE_KRB5
  29
  30 /****************************************************************
  31 ****************************************************************/
  32
  33 static int keytab_close(struct libnet_keytab_context *ctx)
  34 {
  35         if (!ctx) {
  36                 return 0;
  37         }
  38
  39         if (ctx->keytab && ctx->context) {
  40                 krb5_kt_close(ctx->context, ctx->keytab);
  41         }
  42
  43         if (ctx->context) {
  44                 krb5_free_context(ctx->context);
  45         }
  46
  47         if (ctx->ads) {
  48                 ads_destroy(&ctx->ads);
  49         }
  50
  51         TALLOC_FREE(ctx);
  52
  53         return 0;
  54 }
  55
  56 /****************************************************************
  57 ****************************************************************/
  58
  59 krb5_error_code libnet_keytab_init(TALLOC_CTX *mem_ctx,
  60                                    const char *keytab_name,
  61                                    struct libnet_keytab_context **ctx)
  62 {
  63         krb5_error_code ret = 0;
  64         krb5_context context = NULL;
  65         krb5_keytab keytab = NULL;
  66         const char *keytab_string = NULL;
  67
  68         struct libnet_keytab_context *r;
  69
  70         r = talloc_zero(mem_ctx, struct libnet_keytab_context);
  71         if (!r) {
  72                 return ENOMEM;
  73         }
  74
  75         talloc_set_destructor(r, keytab_close);
  76
  77         initialize_krb5_error_table();
  78         ret = krb5_init_context(&context);
  79         if (ret) {
  80                 DEBUG(1,("keytab_init: could not krb5_init_context: %s\n",
  81                         error_message(ret)));
  82                 return ret;
  83         }
  84
  85         ret = smb_krb5_kt_open_relative(context,
  86                                         keytab_name,
  87                                         true, /* write_access */
  88                                         &keytab);
  89         if (ret) {
  90                 DEBUG(1,("keytab_init: smb_krb5_open_keytab failed (%s)\n",
  91                         error_message(ret)));
  92                 krb5_free_context(context);
  93                 return ret;
  94         }
  95
  96         ret = smb_krb5_kt_get_name(mem_ctx, context, keytab, &keytab_string);
  97         if (ret) {
  98                 krb5_kt_close(context, keytab);
  99                 krb5_free_context(context);
 100                 return ret;
 101         }
 102
 103         r->context = context;
 104         r->keytab = keytab;
 105         r->keytab_name = keytab_string;
 106         r->clean_old_entries = false;
 107
 108         *ctx = r;
 109
 110         return 0;
 111 }
 112
 113 /****************************************************************
 114 ****************************************************************/
 115
 116 /**
 117  * Remove all entries that have the given principal, kvno and enctype.
 118  */
 119 static krb5_error_code libnet_keytab_remove_entries(krb5_context context,
 120                                                     krb5_keytab keytab,
 121                                                     const char *principal,
 122                                                     int kvno,
 123                                                     const krb5_enctype enctype,
 124                                                     bool ignore_kvno)
 125 {
 126         krb5_error_code ret;
 127         krb5_kt_cursor cursor;
 128         krb5_keytab_entry kt_entry;
 129
 130         ZERO_STRUCT(kt_entry);
 131         ZERO_STRUCT(cursor);
 132
 133         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 134         if (ret) {
 135                 return 0;
 136         }
 137
 138         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0)
 139         {
 140                 krb5_keyblock *keyp;
 141                 char *princ_s = NULL;
 142
 143                 if (kt_entry.vno != kvno && !ignore_kvno) {
 144                         goto cont;
 145                 }
 146
 147                 keyp = KRB5_KT_KEY(&kt_entry);
 148
 149                 if (KRB5_KEY_TYPE(keyp) != enctype) {
 150                         goto cont;
 151                 }
 152
 153                 ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal,
 154                                             &princ_s);
 155                 if (ret) {
 156                         DEBUG(5, ("smb_krb5_unparse_name failed (%s)\n",
 157                                   error_message(ret)));
 158                         goto cont;
 159                 }
 160
 161                 if (strcmp(principal, princ_s) != 0) {
 162                         goto cont;
 163                 }
 164
 165                 /* match found - remove */
 166
 167                 DEBUG(10, ("found entry for principal %s, kvno %d, "
 168                            "enctype %d - trying to remove it\n",
 169                            princ_s, kt_entry.vno, KRB5_KEY_TYPE(keyp)));
 170
 171                 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 172                 ZERO_STRUCT(cursor);
 173                 if (ret) {
 174                         DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
 175                                   error_message(ret)));
 176                         goto cont;
 177                 }
 178
 179                 ret = krb5_kt_remove_entry(context, keytab,
 180                                            &kt_entry);
 181                 if (ret) {
 182                         DEBUG(5, ("krb5_kt_remove_entry failed (%s)\n",
 183                                   error_message(ret)));
 184                         goto cont;
 185                 }
 186                 DEBUG(10, ("removed entry for principal %s, kvno %d, "
 187                            "enctype %d\n", princ_s, kt_entry.vno,
 188                            KRB5_KEY_TYPE(keyp)));
 189
 190                 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 191                 if (ret) {
 192                         DEBUG(5, ("krb5_kt_start_seq_get failed (%s)\n",
 193                                   error_message(ret)));
 194                         goto cont;
 195                 }
 196
 197 cont:
 198                 smb_krb5_kt_free_entry(context, &kt_entry);
 199                 TALLOC_FREE(princ_s);
 200         }
 201
 202         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 203         if (ret) {
 204                 DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
 205                           error_message(ret)));
 206         }
 207
 208         return ret;
 209 }
 210
 211 static krb5_error_code libnet_keytab_add_entry(krb5_context context,
 212                                                krb5_keytab keytab,
 213                                                krb5_kvno kvno,
 214                                                const char *princ_s,
 215                                                krb5_enctype enctype,
 216                                                krb5_data password)
 217 {
 218         krb5_keyblock *keyp;
 219         krb5_keytab_entry kt_entry;
 220         krb5_error_code ret;
 221         krb5_principal salt_princ = NULL;
 222         char *salt_princ_s;
 223
 224         /* remove duplicates first ... */
 225         ret = libnet_keytab_remove_entries(context, keytab, princ_s, kvno,
 226                                            enctype, false);
 227         if (ret) {
 228                 DEBUG(1, ("libnet_keytab_remove_entries failed: %s\n",
 229                           error_message(ret)));
 230         }
 231
 232         ZERO_STRUCT(kt_entry);
 233
 234         kt_entry.vno = kvno;
 235
 236         ret = smb_krb5_parse_name(context, princ_s, &kt_entry.principal);
 237         if (ret) {
 238                 DEBUG(1, ("smb_krb5_parse_name(%s) failed (%s)\n",
 239                           princ_s, error_message(ret)));
 240                 return ret;
 241         }
 242
 243         keyp = KRB5_KT_KEY(&kt_entry);
 244
 245         salt_princ_s = kerberos_secrets_fetch_salt_princ();
 246         if (salt_princ_s == NULL) {
 247                 ret = KRB5KRB_ERR_GENERIC;
 248                 goto done;
 249         }
 250
 251         ret = krb5_parse_name(context, salt_princ_s, &salt_princ);
 252         SAFE_FREE(salt_princ_s);
 253         if (ret != 0) {
 254                 ret = KRB5KRB_ERR_GENERIC;
 255                 goto done;
 256         }
 257
 258         ret = create_kerberos_key_from_string(context,
 259                                               kt_entry.principal,
 260                                               salt_princ,
 261                                               &password,
 262                                               keyp,
 263                                               enctype,
 264                                               true);
 265         krb5_free_principal(context, salt_princ);
 266         if (ret != 0) {
 267                 ret = KRB5KRB_ERR_GENERIC;
 268                 goto done;
 269         }
 270
 271         ret = krb5_kt_add_entry(context, keytab, &kt_entry);
 272         if (ret) {
 273                 DEBUG(1, ("adding entry to keytab failed (%s)\n",
 274                           error_message(ret)));
 275         }
 276
 277 done:
 278         krb5_free_keyblock_contents(context, keyp);
 279         krb5_free_principal(context, kt_entry.principal);
 280         ZERO_STRUCT(kt_entry);
 281         smb_krb5_kt_free_entry(context, &kt_entry);
 282
 283         return ret;
 284 }
 285
 286 krb5_error_code libnet_keytab_add(struct libnet_keytab_context *ctx)
 287 {
 288         krb5_error_code ret = 0;
 289         uint32_t i;
 290
 291
 292         if (ctx->clean_old_entries) {
 293                 DEBUG(0, ("cleaning old entries...\n"));
 294                 for (i=0; i < ctx->count; i++) {
 295                         struct libnet_keytab_entry *entry = &ctx->entries[i];
 296
 297                         ret = libnet_keytab_remove_entries(ctx->context,
 298                                                            ctx->keytab,
 299                                                            entry->principal,
 300                                                            0,
 301                                                            entry->enctype,
 302                                                            true);
 303                         if (ret) {
 304                                 DEBUG(1,("libnet_keytab_add: Failed to remove "
 305                                          "old entries for %s (enctype %u): %s\n",
 306                                          entry->principal, entry->enctype,
 307                                          error_message(ret)));
 308                                 return ret;
 309                         }
 310                 }
 311         }
 312
 313         for (i=0; i<ctx->count; i++) {
 314
 315                 struct libnet_keytab_entry *entry = &ctx->entries[i];
 316                 krb5_data password;
 317
 318                 ZERO_STRUCT(password);
 319                 password.data = (char *)entry->password.data;
 320                 password.length = entry->password.length;
 321
 322                 ret = libnet_keytab_add_entry(ctx->context,
 323                                               ctx->keytab,
 324                                               entry->kvno,
 325                                               entry->principal,
 326                                               entry->enctype,
 327                                               password);
 328                 if (ret) {
 329                         DEBUG(1,("libnet_keytab_add: "
 330                                 "Failed to add entry to keytab file\n"));
 331                         return ret;
 332                 }
 333         }
 334
 335         return ret;
 336 }
 337
 338 struct libnet_keytab_entry *libnet_keytab_search(struct libnet_keytab_context *ctx,
 339                                                  const char *principal,
 340                                                  int kvno,
 341                                                  const krb5_enctype enctype,
 342                                                  TALLOC_CTX *mem_ctx)
 343 {
 344         krb5_error_code ret = 0;
 345         krb5_kt_cursor cursor;
 346         krb5_keytab_entry kt_entry;
 347         struct libnet_keytab_entry *entry = NULL;
 348
 349         ZERO_STRUCT(kt_entry);
 350         ZERO_STRUCT(cursor);
 351
 352         ret = krb5_kt_start_seq_get(ctx->context, ctx->keytab, &cursor);
 353         if (ret) {
 354                 DEBUG(10, ("krb5_kt_start_seq_get failed: %s\n",
 355                           error_message(ret)));
 356                 return NULL;
 357         }
 358
 359         while (krb5_kt_next_entry(ctx->context, ctx->keytab, &kt_entry, &cursor) == 0)
 360         {
 361                 krb5_keyblock *keyp;
 362                 char *princ_s = NULL;
 363
 364                 entry = NULL;
 365
 366                 if (kt_entry.vno != kvno) {
 367                         goto cont;
 368                 }
 369
 370                 keyp = KRB5_KT_KEY(&kt_entry);
 371
 372                 if (KRB5_KEY_TYPE(keyp) != enctype) {
 373                         goto cont;
 374                 }
 375
 376                 entry = talloc_zero(mem_ctx, struct libnet_keytab_entry);
 377                 if (!entry) {
 378                         DEBUG(3, ("talloc failed\n"));
 379                         goto fail;
 380                 }
 381
 382                 ret = smb_krb5_unparse_name(entry, ctx->context, kt_entry.principal,
 383                                             &princ_s);
 384                 if (ret) {
 385                         goto cont;
 386                 }
 387
 388                 if (strcmp(principal, princ_s) != 0) {
 389                         goto cont;
 390                 }
 391
 392                 entry->principal = talloc_strdup(entry, princ_s);
 393                 if (!entry->principal) {
 394                         DEBUG(3, ("talloc_strdup_failed\n"));
 395                         goto fail;
 396                 }
 397
 398                 entry->name = talloc_move(entry, &princ_s);
 399
 400                 entry->password = data_blob_talloc(entry, KRB5_KEY_DATA(keyp),
 401                                                    KRB5_KEY_LENGTH(keyp));
 402                 if (!entry->password.data) {
 403                         DEBUG(3, ("data_blob_talloc failed\n"));
 404                         goto fail;
 405                 }
 406
 407                 DEBUG(10, ("found entry\n"));
 408
 409                 smb_krb5_kt_free_entry(ctx->context, &kt_entry);
 410                 break;
 411
 412 fail:
 413                 smb_krb5_kt_free_entry(ctx->context, &kt_entry);
 414                 TALLOC_FREE(entry);
 415                 break;
 416
 417 cont:
 418                 smb_krb5_kt_free_entry(ctx->context, &kt_entry);
 419                 TALLOC_FREE(entry);
 420                 continue;
 421         }
 422
 423         krb5_kt_end_seq_get(ctx->context, ctx->keytab, &cursor);
 424         return entry;
 425 }
 426
 427 /**
 428  * Helper function to add data to the list
 429  * of keytab entries. It builds the prefix from the input.
 430  */
 431 NTSTATUS libnet_keytab_add_to_keytab_entries(TALLOC_CTX *mem_ctx,
 432                                              struct libnet_keytab_context *ctx,
 433                                              uint32_t kvno,
 434                                              const char *name,
 435                                              const char *prefix,
 436                                              const krb5_enctype enctype,
 437                                              DATA_BLOB blob)
 438 {
 439         struct libnet_keytab_entry entry;
 440
 441         entry.kvno = kvno;
 442         entry.name = talloc_strdup(mem_ctx, name);
 443         entry.principal = talloc_asprintf(mem_ctx, "%s%s%s@%s",
 444                                           prefix ? prefix : "",
 445                                           prefix ? "/" : "",
 446                                           name, ctx->dns_domain_name);
 447         entry.enctype = enctype;
 448         entry.password = blob;
 449         NT_STATUS_HAVE_NO_MEMORY(entry.name);
 450         NT_STATUS_HAVE_NO_MEMORY(entry.principal);
 451         NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
 452
 453         ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
 454                      &ctx->entries, &ctx->count);
 455         NT_STATUS_HAVE_NO_MEMORY(ctx->entries);
 456
 457         return NT_STATUS_OK;
 458 }
 459
 460 #endif /* HAVE_KRB5 */