source4/auth/kerberos/kerberos_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos utility functions for GENSEC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/kerberos.h"
  25 #include "auth/kerberos/kerberos.h"
  26 #include "auth/credentials/credentials.h"
  27 #include "auth/credentials/credentials_proto.h"
  28 #include "auth/credentials/credentials_krb5.h"
  29
  30 struct principal_container {
  31         struct smb_krb5_context *smb_krb5_context;
  32         krb5_principal principal;
  33 };
  34
  35 static krb5_error_code free_principal(struct principal_container *pc)
  36 {
  37         /* current heimdal - 0.6.3, which we need anyway, fixes segfaults here */
  38         krb5_free_principal(pc->smb_krb5_context->krb5_context, pc->principal);
  39
  40         return 0;
  41 }
  42
  43
  44 static krb5_error_code parse_principal(TALLOC_CTX *parent_ctx,
  45                                        const char *princ_string,
  46                                        struct smb_krb5_context *smb_krb5_context,
  47                                        krb5_principal *princ,
  48                                        const char **error_string)
  49 {
  50         int ret;
  51         struct principal_container *mem_ctx;
  52         if (princ_string == NULL) {
  53                  *princ = NULL;
  54                  return 0;
  55         }
  56
  57         ret = krb5_parse_name(smb_krb5_context->krb5_context,
  58                               princ_string, princ);
  59
  60         if (ret) {
  61                 (*error_string) = smb_get_krb5_error_message(smb_krb5_context->krb5_context, ret, parent_ctx);
  62                 return ret;
  63         }
  64
  65         mem_ctx = talloc(parent_ctx, struct principal_container);
  66         if (!mem_ctx) {
  67                 (*error_string) = error_message(ENOMEM);
  68                 return ENOMEM;
  69         }
  70
  71         /* This song-and-dance effectivly puts the principal
  72          * into talloc, so we can't loose it. */
  73         mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
  74         mem_ctx->principal = *princ;
  75         talloc_set_destructor(mem_ctx, free_principal);
  76         return 0;
  77 }
  78
  79 static krb5_error_code salt_principal_from_credentials(TALLOC_CTX *parent_ctx,
  80                                                        struct cli_credentials *machine_account,
  81                                                        struct smb_krb5_context *smb_krb5_context,
  82                                                        krb5_principal *salt_princ)
  83 {
  84         krb5_error_code ret;
  85         char *machine_username;
  86         char *salt_body;
  87         char *lower_realm;
  88         const char *salt_principal;
  89         const char *error_string;
  90         struct principal_container *mem_ctx = talloc(parent_ctx, struct principal_container);
  91         if (!mem_ctx) {
  92                 return ENOMEM;
  93         }
  94
  95         salt_principal = cli_credentials_get_salt_principal(machine_account);
  96         if (salt_principal) {
  97                 ret = parse_principal(parent_ctx, salt_principal, smb_krb5_context, salt_princ, &error_string);
  98         } else {
  99                 machine_username = talloc_strdup(mem_ctx, cli_credentials_get_username(machine_account));
 100
 101                 if (!machine_username) {
 102                         talloc_free(mem_ctx);
 103                         return ENOMEM;
 104                 }
 105
 106                 if (machine_username[strlen(machine_username)-1] == '$') {
 107                         machine_username[strlen(machine_username)-1] = '\0';
 108                 }
 109                 lower_realm = strlower_talloc(mem_ctx, cli_credentials_get_realm(machine_account));
 110                 if (!lower_realm) {
 111                         talloc_free(mem_ctx);
 112                         return ENOMEM;
 113                 }
 114
 115                 salt_body = talloc_asprintf(mem_ctx, "%s.%s", machine_username,
 116                                             lower_realm);
 117                 if (!salt_body) {
 118                         talloc_free(mem_ctx);
 119                 return ENOMEM;
 120                 }
 121
 122                 ret = krb5_make_principal(smb_krb5_context->krb5_context, salt_princ,
 123                                           cli_credentials_get_realm(machine_account),
 124                                           "host", salt_body, NULL);
 125                 if (ret == 0) {
 126                         /* This song-and-dance effectivly puts the principal
 127                          * into talloc, so we can't loose it. */
 128                         mem_ctx->smb_krb5_context = talloc_reference(mem_ctx, smb_krb5_context);
 129                         mem_ctx->principal = *salt_princ;
 130                         talloc_set_destructor(mem_ctx, free_principal);
 131                 }
 132         }
 133
 134         return ret;
 135 }
 136
 137 /* Obtain the principal set on this context.  Requires a
 138  * smb_krb5_context because we are doing krb5 principal parsing with
 139  * the library routines.  The returned princ is placed in the talloc
 140  * system by means of a destructor (do *not* free). */
 141
 142  krb5_error_code principal_from_credentials(TALLOC_CTX *parent_ctx,
 143                                             struct cli_credentials *credentials,
 144                                             struct smb_krb5_context *smb_krb5_context,
 145                                             krb5_principal *princ,
 146                                             const char **error_string)
 147 {
 148         krb5_error_code ret;
 149         const char *princ_string;
 150         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 151         if (!mem_ctx) {
 152                 (*error_string) = error_message(ENOMEM);
 153                 return ENOMEM;
 154         }
 155         princ_string = cli_credentials_get_principal(credentials, mem_ctx);
 156         if (!princ_string) {
 157                 (*error_string) = error_message(ENOMEM);
 158                 return ENOMEM;
 159         }
 160
 161         ret = parse_principal(parent_ctx, princ_string,
 162                               smb_krb5_context, princ, error_string);
 163         talloc_free(mem_ctx);
 164         return ret;
 165 }
 166
 167 /* Obtain the principal set on this context.  Requires a
 168  * smb_krb5_context because we are doing krb5 principal parsing with
 169  * the library routines.  The returned princ is placed in the talloc
 170  * system by means of a destructor (do *not* free). */
 171
 172  krb5_error_code impersonate_principal_from_credentials(TALLOC_CTX *parent_ctx,
 173                                                         struct cli_credentials *credentials,
 174                                                         struct smb_krb5_context *smb_krb5_context,
 175                                                         krb5_principal *princ,
 176                                                         const char **error_string)
 177 {
 178         return parse_principal(parent_ctx, cli_credentials_get_impersonate_principal(credentials),
 179                                smb_krb5_context, princ, error_string);
 180 }
 181
 182 /**
 183  * Return a freshly allocated ccache (destroyed by destructor on child
 184  * of parent_ctx), for a given set of client credentials
 185  */
 186
 187  krb5_error_code kinit_to_ccache(TALLOC_CTX *parent_ctx,
 188                                  struct cli_credentials *credentials,
 189                                  struct smb_krb5_context *smb_krb5_context,
 190                                  krb5_ccache ccache,
 191                                  const char **error_string)
 192 {
 193         krb5_error_code ret;
 194         const char *password, *target_service;
 195         time_t kdc_time = 0;
 196         krb5_principal princ;
 197         krb5_principal impersonate_principal;
 198         int tries;
 199         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 200
 201         if (!mem_ctx) {
 202                 (*error_string) = strerror(ENOMEM);
 203                 return ENOMEM;
 204         }
 205
 206         ret = principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &princ, error_string);
 207         if (ret) {
 208                 talloc_free(mem_ctx);
 209                 return ret;
 210         }
 211
 212         ret = impersonate_principal_from_credentials(mem_ctx, credentials, smb_krb5_context, &impersonate_principal, error_string);
 213         if (ret) {
 214                 talloc_free(mem_ctx);
 215                 return ret;
 216         }
 217
 218         target_service = cli_credentials_get_target_service(credentials);
 219
 220         password = cli_credentials_get_password(credentials);
 221
 222         tries = 2;
 223         while (tries--) {
 224                 if (password) {
 225                         ret = kerberos_kinit_password_cc(smb_krb5_context->krb5_context, ccache,
 226                                                          princ, password,
 227                                                          impersonate_principal, target_service,
 228                                                          NULL, &kdc_time);
 229                 } else if (impersonate_principal) {
 230                         (*error_string) = "INTERNAL error: Cannot impersonate principal with just a keyblock.  A password must be specified in the credentials";
 231                         return EINVAL;
 232                 } else {
 233                         /* No password available, try to use a keyblock instead */
 234
 235                         krb5_keyblock keyblock;
 236                         const struct samr_Password *mach_pwd;
 237                         mach_pwd = cli_credentials_get_nt_hash(credentials, mem_ctx);
 238                         if (!mach_pwd) {
 239                                 talloc_free(mem_ctx);
 240                                 (*error_string) = "kinit_to_ccache: No password available for kinit\n";
 241                                 return EINVAL;
 242                         }
 243                         ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
 244                                                  ENCTYPE_ARCFOUR_HMAC,
 245                                                  mach_pwd->hash, sizeof(mach_pwd->hash),
 246                                                  &keyblock);
 247
 248                         if (ret == 0) {
 249                                 ret = kerberos_kinit_keyblock_cc(smb_krb5_context->krb5_context, ccache,
 250                                                                  princ, &keyblock,
 251                                                                  target_service,
 252                                                                  NULL, &kdc_time);
 253                                 krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &keyblock);
 254                         }
 255                 }
 256
 257                 if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
 258                         /* Perhaps we have been given an invalid skew, so try again without it */
 259                         time_t t = time(NULL);
 260                         krb5_set_real_time(smb_krb5_context->krb5_context, t, 0);
 261                 } else {
 262                         /* not a skew problem */
 263                         break;
 264                 }
 265         }
 266
 267         if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
 268                 (*error_string) = talloc_asprintf(credentials, "kinit for %s failed (%s)\n",
 269                                                   cli_credentials_get_principal(credentials, mem_ctx),
 270                                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 271                                                                              ret, mem_ctx));
 272                 talloc_free(mem_ctx);
 273                 return ret;
 274         }
 275
 276         /* cope with ticket being in the future due to clock skew */
 277         if ((unsigned)kdc_time > time(NULL)) {
 278                 time_t t = time(NULL);
 279                 int time_offset =(unsigned)kdc_time-t;
 280                 DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
 281                 krb5_set_real_time(smb_krb5_context->krb5_context, t + time_offset + 1, 0);
 282         }
 283
 284         if (ret == KRB5KDC_ERR_PREAUTH_FAILED && cli_credentials_wrong_password(credentials)) {
 285                 ret = kinit_to_ccache(parent_ctx,
 286                                       credentials,
 287                                       smb_krb5_context,
 288                                       ccache, error_string);
 289         }
 290         if (ret) {
 291                 (*error_string) = talloc_asprintf(credentials, "kinit for %s failed (%s)\n",
 292                                                   cli_credentials_get_principal(credentials, mem_ctx),
 293                                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 294                                                                              ret, mem_ctx));
 295                 talloc_free(mem_ctx);
 296                 return ret;
 297         }
 298         talloc_free(mem_ctx);
 299         return 0;
 300 }
 301
 302 static krb5_error_code free_keytab(struct keytab_container *ktc)
 303 {
 304         return krb5_kt_close(ktc->smb_krb5_context->krb5_context, ktc->keytab);
 305 }
 306
 307 krb5_error_code smb_krb5_open_keytab(TALLOC_CTX *mem_ctx,
 308                          struct smb_krb5_context *smb_krb5_context,
 309                          const char *keytab_name, struct keytab_container **ktc)
 310 {
 311         krb5_keytab keytab;
 312         krb5_error_code ret;
 313         ret = krb5_kt_resolve(smb_krb5_context->krb5_context, keytab_name, &keytab);
 314         if (ret) {
 315                 DEBUG(1,("failed to open krb5 keytab: %s\n",
 316                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 317                                                     ret, mem_ctx)));
 318                 return ret;
 319         }
 320
 321         *ktc = talloc(mem_ctx, struct keytab_container);
 322         if (!*ktc) {
 323                 return ENOMEM;
 324         }
 325
 326         (*ktc)->smb_krb5_context = talloc_reference(*ktc, smb_krb5_context);
 327         (*ktc)->keytab = keytab;
 328         talloc_set_destructor(*ktc, free_keytab);
 329
 330         return 0;
 331 }
 332
 333 static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
 334                                        const char *princ_string,
 335                                        krb5_principal princ,
 336                                        krb5_principal salt_princ,
 337                                        int kvno,
 338                                        const char *password_s,
 339                                        struct smb_krb5_context *smb_krb5_context,
 340                                        const char **enctype_strings,
 341                                        krb5_keytab keytab)
 342 {
 343         int i;
 344         krb5_error_code ret;
 345         krb5_data password;
 346         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 347         if (!mem_ctx) {
 348                 return ENOMEM;
 349         }
 350
 351         password.data = discard_const_p(char *, password_s);
 352         password.length = strlen(password_s);
 353
 354         for (i=0; enctype_strings[i]; i++) {
 355                 krb5_keytab_entry entry;
 356                 krb5_enctype enctype;
 357                 ret = krb5_string_to_enctype(smb_krb5_context->krb5_context, enctype_strings[i], &enctype);
 358                 if (ret != 0) {
 359                         DEBUG(1, ("Failed to interpret %s as a krb5 encryption type: %s\n",
 360                                   enctype_strings[i],
 361                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 362                                                              ret, mem_ctx)));
 363                         talloc_free(mem_ctx);
 364                         return ret;
 365                 }
 366                 ret = create_kerberos_key_from_string(smb_krb5_context->krb5_context,
 367                                                       salt_princ, &password, &entry.keyblock, enctype);
 368                 if (ret != 0) {
 369                         talloc_free(mem_ctx);
 370                         return ret;
 371                 }
 372
 373                 entry.principal = princ;
 374                 entry.vno       = kvno;
 375                 ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, keytab, &entry);
 376                 if (ret != 0) {
 377                         DEBUG(1, ("Failed to add %s entry for %s(kvno %d) to keytab: %s\n",
 378                                   enctype_strings[i],
 379                                   princ_string,
 380                                   kvno,
 381                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 382                                                              ret, mem_ctx)));
 383                         talloc_free(mem_ctx);
 384                         krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
 385                         return ret;
 386                 }
 387
 388                 DEBUG(5, ("Added %s(kvno %d) to keytab (%s)\n",
 389                           princ_string, kvno,
 390                           enctype_strings[i]));
 391
 392                 krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
 393         }
 394         talloc_free(mem_ctx);
 395         return 0;
 396 }
 397
 398 static krb5_error_code create_keytab(TALLOC_CTX *parent_ctx,
 399                          struct cli_credentials *machine_account,
 400                          struct smb_krb5_context *smb_krb5_context,
 401                          const char **enctype_strings,
 402                          krb5_keytab keytab,
 403                          bool add_old)
 404 {
 405         krb5_error_code ret;
 406         const char *password_s;
 407         const char *old_secret;
 408         int kvno;
 409         krb5_principal salt_princ;
 410         krb5_principal princ;
 411         const char *princ_string;
 412         const char *error_string;
 413
 414         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 415         if (!mem_ctx) {
 416                 return ENOMEM;
 417         }
 418
 419         princ_string = cli_credentials_get_principal(machine_account, mem_ctx);
 420         /* Get the principal we will store the new keytab entries under */
 421         ret = principal_from_credentials(mem_ctx, machine_account, smb_krb5_context, &princ, &error_string);
 422         if (ret) {
 423                 DEBUG(1,("create_keytab: makeing krb5 principal failed (%s)\n", error_string));
 424                 talloc_free(mem_ctx);
 425                 return ret;
 426         }
 427
 428         /* The salt used to generate these entries may be different however, fetch that */
 429         ret = salt_principal_from_credentials(mem_ctx, machine_account,
 430                                               smb_krb5_context,
 431                                               &salt_princ);
 432         if (ret) {
 433                 DEBUG(1,("create_keytab: makeing salt principal failed (%s)\n",
 434                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 435                                                     ret, mem_ctx)));
 436                 talloc_free(mem_ctx);
 437                 return ret;
 438         }
 439
 440         /* Finally, do the dance to get the password to put in the entry */
 441         password_s = cli_credentials_get_password(machine_account);
 442         if (!password_s) {
 443                 krb5_keytab_entry entry;
 444                 const struct samr_Password *mach_pwd;
 445
 446                 if (!str_list_check(enctype_strings, "arcfour-hmac-md5")) {
 447                         DEBUG(1, ("Asked to create keytab, but with only an NT hash supplied, "
 448                                   "but not listing arcfour-hmac-md5 as an enc type to include in the keytab!\n"));
 449                         talloc_free(mem_ctx);
 450                         return EINVAL;
 451                 }
 452
 453                 /* If we don't have the plaintext password, try for
 454                  * the MD4 password hash */
 455                 mach_pwd = cli_credentials_get_nt_hash(machine_account, mem_ctx);
 456                 if (!mach_pwd) {
 457                         /* OK, nothing to do here */
 458                         talloc_free(mem_ctx);
 459                         return 0;
 460                 }
 461                 ret = krb5_keyblock_init(smb_krb5_context->krb5_context,
 462                                          ETYPE_ARCFOUR_HMAC_MD5,
 463                                          mach_pwd->hash, sizeof(mach_pwd->hash),
 464                                          &entry.keyblock);
 465                 if (ret) {
 466                         DEBUG(1, ("create_keytab: krb5_keyblock_init failed: %s\n",
 467                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 468                                                              ret, mem_ctx)));
 469                         talloc_free(mem_ctx);
 470                         return ret;
 471                 }
 472
 473                 entry.principal = princ;
 474                 entry.vno       = cli_credentials_get_kvno(machine_account);
 475                 ret = krb5_kt_add_entry(smb_krb5_context->krb5_context, keytab, &entry);
 476                 if (ret) {
 477                         DEBUG(1, ("Failed to add ARCFOUR_HMAC (only) entry for %s to keytab: %s",
 478                                   cli_credentials_get_principal(machine_account, mem_ctx),
 479                                   smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 480                                                              ret, mem_ctx)));
 481                         talloc_free(mem_ctx);
 482                         krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
 483                         return ret;
 484                 }
 485
 486                 DEBUG(5, ("Added %s(kvno %d) to keytab (arcfour-hmac-md5)\n",
 487                           cli_credentials_get_principal(machine_account, mem_ctx),
 488                           cli_credentials_get_kvno(machine_account)));
 489
 490                 krb5_free_keyblock_contents(smb_krb5_context->krb5_context, &entry.keyblock);
 491
 492                 /* Can't go any further, we only have this one key */
 493                 talloc_free(mem_ctx);
 494                 return 0;
 495         }
 496
 497         kvno = cli_credentials_get_kvno(machine_account);
 498         /* good, we actually have the real plaintext */
 499         ret = keytab_add_keys(mem_ctx, princ_string, princ, salt_princ,
 500                               kvno, password_s, smb_krb5_context,
 501                               enctype_strings, keytab);
 502         if (!ret) {
 503                 talloc_free(mem_ctx);
 504                 return ret;
 505         }
 506
 507         if (!add_old || kvno == 0) {
 508                 talloc_free(mem_ctx);
 509                 return 0;
 510         }
 511
 512         old_secret = cli_credentials_get_old_password(machine_account);
 513         if (!old_secret) {
 514                 talloc_free(mem_ctx);
 515                 return 0;
 516         }
 517
 518         ret = keytab_add_keys(mem_ctx, princ_string, princ, salt_princ,
 519                               kvno - 1, old_secret, smb_krb5_context,
 520                               enctype_strings, keytab);
 521         if (!ret) {
 522                 talloc_free(mem_ctx);
 523                 return ret;
 524         }
 525
 526         talloc_free(mem_ctx);
 527         return 0;
 528 }
 529
 530
 531 /*
 532  * Walk the keytab, looking for entries of this principal name, with KVNO other than current kvno -1.
 533  *
 534  * These entries are now stale, we only keep the current, and previous entries around.
 535  *
 536  * Inspired by the code in Samba3 for 'use kerberos keytab'.
 537  *
 538  */
 539
 540 static krb5_error_code remove_old_entries(TALLOC_CTX *parent_ctx,
 541                                           struct cli_credentials *machine_account,
 542                                           struct smb_krb5_context *smb_krb5_context,
 543                                           krb5_keytab keytab, bool *found_previous)
 544 {
 545         krb5_error_code ret, ret2;
 546         krb5_kt_cursor cursor;
 547         krb5_principal princ;
 548         int kvno;
 549         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 550         const char *princ_string;
 551         const char *error_string;
 552
 553         if (!mem_ctx) {
 554                 return ENOMEM;
 555         }
 556
 557         *found_previous = false;
 558         princ_string = cli_credentials_get_principal(machine_account, mem_ctx);
 559
 560         /* Get the principal we will store the new keytab entries under */
 561         ret = principal_from_credentials(mem_ctx, machine_account, smb_krb5_context, &princ, &error_string);
 562         if (ret) {
 563                 DEBUG(1,("update_keytab: makeing krb5 principal failed (%s)\n", error_string));
 564                 talloc_free(mem_ctx);
 565                 return ret;
 566         }
 567
 568         kvno = cli_credentials_get_kvno(machine_account);
 569
 570         /* for each entry in the keytab */
 571         ret = krb5_kt_start_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
 572         switch (ret) {
 573         case 0:
 574                 break;
 575         case HEIM_ERR_OPNOTSUPP:
 576         case ENOENT:
 577         case KRB5_KT_END:
 578                 /* no point enumerating if there isn't anything here */
 579                 talloc_free(mem_ctx);
 580                 return 0;
 581         default:
 582                 DEBUG(1,("failed to open keytab for read of old entries: %s\n",
 583                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 584                                                     ret, mem_ctx)));
 585                 talloc_free(mem_ctx);
 586                 return ret;
 587         }
 588
 589         while (!ret) {
 590                 krb5_keytab_entry entry;
 591                 ret = krb5_kt_next_entry(smb_krb5_context->krb5_context, keytab, &entry, &cursor);
 592                 if (ret) {
 593                         break;
 594                 }
 595                 /* if it matches our principal */
 596                 if (!krb5_kt_compare(smb_krb5_context->krb5_context, &entry, princ, 0, 0)) {
 597                         /* Free the entry, it wasn't the one we were looking for anyway */
 598                         krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
 599                         continue;
 600                 }
 601
 602                 /* delete it, if it is not kvno -1 */
 603                 if (entry.vno != (kvno - 1 )) {
 604                         /* Release the enumeration.  We are going to
 605                          * have to start this from the top again,
 606                          * because deletes during enumeration may not
 607                          * always be consistant.
 608                          *
 609                          * Also, the enumeration locks a FILE: keytab
 610                          */
 611
 612                         krb5_kt_end_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
 613
 614                         ret = krb5_kt_remove_entry(smb_krb5_context->krb5_context, keytab, &entry);
 615                         krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
 616
 617                         /* Deleted: Restart from the top */
 618                         ret2 = krb5_kt_start_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
 619                         if (ret2) {
 620                                 krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
 621                                 DEBUG(1,("failed to restart enumeration of keytab: %s\n",
 622                                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 623                                                                     ret, mem_ctx)));
 624
 625                                 talloc_free(mem_ctx);
 626                                 return ret2;
 627                         }
 628
 629                         if (ret) {
 630                                 break;
 631                         }
 632
 633                 } else {
 634                         *found_previous = true;
 635                 }
 636
 637                 /* Free the entry, we don't need it any more */
 638                 krb5_kt_free_entry(smb_krb5_context->krb5_context, &entry);
 639
 640
 641         }
 642         krb5_kt_end_seq_get(smb_krb5_context->krb5_context, keytab, &cursor);
 643
 644         switch (ret) {
 645         case 0:
 646                 break;
 647         case ENOENT:
 648         case KRB5_KT_END:
 649                 ret = 0;
 650                 break;
 651         default:
 652                 DEBUG(1,("failed in deleting old entries for principal: %s: %s\n",
 653                          princ_string,
 654                          smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 655                                                     ret, mem_ctx)));
 656         }
 657         talloc_free(mem_ctx);
 658         return ret;
 659 }
 660
 661 krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
 662                            struct cli_credentials *machine_account,
 663                            struct smb_krb5_context *smb_krb5_context,
 664                            const char **enctype_strings,
 665                            struct keytab_container *keytab_container)
 666 {
 667         krb5_error_code ret;
 668         bool found_previous;
 669         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 670         if (!mem_ctx) {
 671                 return ENOMEM;
 672         }
 673
 674         ret = remove_old_entries(mem_ctx, machine_account,
 675                                  smb_krb5_context, keytab_container->keytab, &found_previous);
 676         if (ret != 0) {
 677                 talloc_free(mem_ctx);
 678                 return ret;
 679         }
 680
 681         /* Create a new keytab.  If during the cleanout we found
 682          * entires for kvno -1, then don't try and duplicate them.
 683          * Otherwise, add kvno, and kvno -1 */
 684
 685         ret = create_keytab(mem_ctx, machine_account, smb_krb5_context,
 686                             enctype_strings,
 687                             keytab_container->keytab,
 688                             found_previous ? false : true);
 689         talloc_free(mem_ctx);
 690         return ret;
 691 }
 692
 693 krb5_error_code smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
 694                                            struct cli_credentials *machine_account,
 695                                            struct smb_krb5_context *smb_krb5_context,
 696                                            const char **enctype_strings,
 697                                            struct keytab_container **keytab_container)
 698 {
 699         krb5_error_code ret;
 700         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 701         const char *rand_string;
 702         const char *keytab_name;
 703         if (!mem_ctx) {
 704                 return ENOMEM;
 705         }
 706
 707         *keytab_container = talloc(mem_ctx, struct keytab_container);
 708
 709         rand_string = generate_random_str(mem_ctx, 16);
 710         if (!rand_string) {
 711                 talloc_free(mem_ctx);
 712                 return ENOMEM;
 713         }
 714
 715         keytab_name = talloc_asprintf(mem_ctx, "MEMORY:%s",
 716                                       rand_string);
 717         if (!keytab_name) {
 718                 talloc_free(mem_ctx);
 719                 return ENOMEM;
 720         }
 721
 722         ret = smb_krb5_open_keytab(mem_ctx, smb_krb5_context, keytab_name, keytab_container);
 723         if (ret) {
 724                 return ret;
 725         }
 726
 727         ret = smb_krb5_update_keytab(mem_ctx, machine_account, smb_krb5_context, enctype_strings, *keytab_container);
 728         if (ret == 0) {
 729                 talloc_steal(parent_ctx, *keytab_container);
 730         } else {
 731                 *keytab_container = NULL;
 732         }
 733         talloc_free(mem_ctx);
 734         return ret;
 735 }
 736