2 * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * Copyright (c) 2011 Andrew Bartlett
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 #include "system/kerberos.h"
38 #include "auth/kerberos/kerberos.h"
41 compare_keyblock(const krb5_keyblock
*a
, const krb5_keyblock
*b
)
43 if (KRB5_KEY_TYPE(a
) != KRB5_KEY_TYPE(b
) ||
44 KRB5_KEY_LENGTH(a
) != KRB5_KEY_LENGTH(b
) ||
45 memcmp(KRB5_KEY_DATA(a
), KRB5_KEY_DATA(b
), KRB5_KEY_LENGTH(a
)) != 0)
50 static krb5_error_code
copy_one_entry(krb5_context context
,
51 krb5_keytab src_keytab
,
52 krb5_keytab dst_keytab
,
53 krb5_keytab_entry entry
)
56 krb5_keytab_entry dummy
;
60 ret
= krb5_unparse_name (context
, entry
.principal
, &name_str
);
62 krb5_set_error_message(context
, ret
, "krb5_unparse_name");
63 name_str
= NULL
; /* XXX */
66 ret
= smb_krb5_enctype_to_string(context
,
67 KRB5_KEY_TYPE(KRB5_KT_KEY(&entry
)),
70 krb5_set_error_message(context
, ret
, "krb5_enctype_to_string");
71 etype_str
= NULL
; /* XXX */
74 ret
= krb5_kt_get_entry(context
, dst_keytab
,
77 KRB5_KEY_TYPE(KRB5_KT_KEY(&entry
)),
80 /* this entry is already in the new keytab, so no need to
81 copy it; if the keyblocks are not the same, something
82 is weird, so complain about that */
83 if (!compare_keyblock(KRB5_KT_KEY(&entry
), KRB5_KT_KEY(&dummy
))) {
84 DEBUG(2, ("copy_one_entry: entry with different keyvalue "
85 "already exists for %s, keytype %s, kvno %d",
86 name_str
, etype_str
, entry
.vno
));
88 krb5_kt_free_entry(context
, &dummy
);
89 krb5_kt_free_entry (context
, &entry
);
93 } else if(ret
!= KRB5_KT_NOTFOUND
) {
94 krb5_set_error_message (context
, ret
, "fetching %s/%s/%u",
95 name_str
, etype_str
, entry
.vno
);
96 krb5_kt_free_entry (context
, &entry
);
101 ret
= krb5_kt_add_entry (context
, dst_keytab
, &entry
);
102 krb5_kt_free_entry (context
, &entry
);
104 krb5_set_error_message (context
, ret
, "adding %s/%s/%u",
105 name_str
, etype_str
, entry
.vno
);
115 krb5_error_code
kt_copy(krb5_context context
, const char *from
, const char *to
)
118 krb5_keytab src_keytab
, dst_keytab
;
119 krb5_kt_cursor cursor
;
120 krb5_keytab_entry entry
;
122 ret
= krb5_kt_resolve (context
, from
, &src_keytab
);
124 krb5_set_error_message (context
, ret
, "resolving src keytab `%s'", from
);
128 ret
= krb5_kt_resolve (context
, to
, &dst_keytab
);
130 krb5_kt_close (context
, src_keytab
);
131 krb5_set_error_message (context
, ret
, "resolving dst keytab `%s'", to
);
135 ret
= krb5_kt_start_seq_get (context
, src_keytab
, &cursor
);
137 krb5_set_error_message (context
, ret
, "krb5_kt_start_seq_get %s", from
);
141 while((ret
= krb5_kt_next_entry(context
, src_keytab
,
142 &entry
, &cursor
)) == 0) {
143 ret
= copy_one_entry(context
, src_keytab
, dst_keytab
, entry
);
148 krb5_kt_end_seq_get (context
, src_keytab
, &cursor
);
151 krb5_kt_close (context
, src_keytab
);
152 krb5_kt_close (context
, dst_keytab
);
153 if (ret
== KRB5_KT_END
) {
155 } else if (ret
== 0) {
161 krb5_error_code
kt_copy_one_principal(krb5_context context
,
164 const char *principal
,
166 krb5_enctype
*enctypes
)
169 krb5_keytab src_keytab
, dst_keytab
;
170 krb5_keytab_entry entry
;
171 krb5_principal princ
;
173 bool found_one
= false;
175 ret
= krb5_parse_name (context
, principal
, &princ
);
177 krb5_set_error_message(context
, ret
, "krb5_unparse_name");
181 ret
= krb5_kt_resolve (context
, from
, &src_keytab
);
183 krb5_set_error_message(context
, ret
, "resolving src keytab `%s'", from
);
187 ret
= krb5_kt_resolve (context
, to
, &dst_keytab
);
189 krb5_kt_close (context
, src_keytab
);
190 krb5_set_error_message(context
, ret
, "resolving dst keytab `%s'", to
);
194 for (i
=0; enctypes
[i
]; i
++) {
195 ret
= krb5_kt_get_entry(context
, src_keytab
,
200 if (ret
== KRB5_KT_NOTFOUND
) {
206 ret
= copy_one_entry(context
, src_keytab
, dst_keytab
, entry
);
211 if (ret
== KRB5_KT_NOTFOUND
) {
214 int ret2
= krb5_unparse_name (context
, princ
, &princ_string
);
216 krb5_set_error_message(context
, ret
,
217 "failed to fetch principal %s",
221 /* Not finding an enc type is not an error,
222 * as long as we copied one for the principal */
227 krb5_kt_close (context
, src_keytab
);
228 krb5_kt_close (context
, dst_keytab
);