source4/libnet/libnet_export_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/kerberos.h"
  22 #include "auth/kerberos/kerberos.h"
  23 #include <hdb.h>
  24 #include "kdc/samba_kdc.h"
  25 #include "libnet/libnet_export_keytab.h"
  26
  27 NTSTATUS libnet_export_keytab(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_export_keytab *r)
  28 {
  29         krb5_error_code ret;
  30         struct smb_krb5_context *smb_krb5_context;
  31         const char *from_keytab;
  32
  33         /* Register hdb-samba4 hooks for use as a keytab */
  34
  35         struct samba_kdc_base_context *base_ctx = talloc_zero(mem_ctx, struct samba_kdc_base_context);
  36         if (!base_ctx) {
  37                 return NT_STATUS_NO_MEMORY;
  38         }
  39
  40         base_ctx->ev_ctx = ctx->event_ctx;
  41         base_ctx->lp_ctx = ctx->lp_ctx;
  42
  43         from_keytab = talloc_asprintf(base_ctx, "HDB:samba4&%p", base_ctx);
  44         if (!from_keytab) {
  45                 return NT_STATUS_NO_MEMORY;
  46         }
  47
  48         ret = smb_krb5_init_context(ctx, ctx->event_ctx, ctx->lp_ctx, &smb_krb5_context);
  49         if (ret) {
  50                 return NT_STATUS_NO_MEMORY;
  51         }
  52
  53         ret = krb5_plugin_register(smb_krb5_context->krb5_context,
  54                                    PLUGIN_TYPE_DATA, "hdb",
  55                                    &hdb_samba4_interface);
  56         if(ret) {
  57                 return NT_STATUS_NO_MEMORY;
  58         }
  59
  60         ret = krb5_kt_register(smb_krb5_context->krb5_context, &hdb_kt_ops);
  61         if(ret) {
  62                 return NT_STATUS_NO_MEMORY;
  63         }
  64
  65         if (r->in.principal) {
  66                 /* TODO: Find a way not to have to use a fixed list */
  67                 krb5_enctype enctypes[] = {
  68                         KRB5_ENCTYPE_DES_CBC_CRC,
  69                         KRB5_ENCTYPE_DES_CBC_MD5,
  70                         KRB5_ENCTYPE_AES128_CTS_HMAC_SHA1_96,
  71                         KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1_96,
  72                         KRB5_ENCTYPE_ARCFOUR_HMAC_MD5
  73                 };
  74                 ret = kt_copy_one_principal(smb_krb5_context->krb5_context, from_keytab, r->in.keytab_name, r->in.principal, 0, enctypes);
  75         } else {
  76                 unlink(r->in.keytab_name);
  77                 ret = kt_copy(smb_krb5_context->krb5_context, from_keytab, r->in.keytab_name);
  78         }
  79
  80         if(ret) {
  81                 r->out.error_string = smb_get_krb5_error_message(smb_krb5_context->krb5_context,
  82                                                                  ret, mem_ctx);
  83                 if (ret == KRB5_KT_NOTFOUND) {
  84                         return NT_STATUS_NO_SUCH_USER;
  85                 } else {
  86                         return NT_STATUS_UNSUCCESSFUL;
  87                 }
  88         }
  89         return NT_STATUS_OK;
  90 }