source/libads/kerberos.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Nalin Dahyabhai <nalin@redhat.com> 2004.
   7    Copyright (C) Jeremy Allison 2004.
   8    Copyright (C) Gerald Carter 2006.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25
  26 #ifdef HAVE_KRB5
  27
  28 #define LIBADS_CCACHE_NAME "MEMORY:libads"
  29
  30 /*
  31   we use a prompter to avoid a crash bug in the kerberos libs when
  32   dealing with empty passwords
  33   this prompter is just a string copy ...
  34 */
  35 static krb5_error_code
  36 kerb_prompter(krb5_context ctx, void *data,
  37                const char *name,
  38                const char *banner,
  39                int num_prompts,
  40                krb5_prompt prompts[])
  41 {
  42         if (num_prompts == 0) return 0;
  43
  44         memset(prompts[0].reply->data, '\0', prompts[0].reply->length);
  45         if (prompts[0].reply->length > 0) {
  46                 if (data) {
  47                         strncpy(prompts[0].reply->data, (const char *)data,
  48                                 prompts[0].reply->length-1);
  49                         prompts[0].reply->length = strlen(prompts[0].reply->data);
  50                 } else {
  51                         prompts[0].reply->length = 0;
  52                 }
  53         }
  54         return 0;
  55 }
  56
  57 static bool smb_krb5_err_io_nstatus(TALLOC_CTX *mem_ctx,
  58                                     DATA_BLOB *edata_blob,
  59                                     KRB5_EDATA_NTSTATUS *edata)
  60 {
  61         bool ret = False;
  62         prs_struct ps;
  63
  64         if (!mem_ctx || !edata_blob || !edata)
  65                 return False;
  66
  67         if (!prs_init(&ps, edata_blob->length, mem_ctx, UNMARSHALL))
  68                 return False;
  69
  70         if (!prs_copy_data_in(&ps, (char *)edata_blob->data, edata_blob->length))
  71                 goto out;
  72
  73         prs_set_offset(&ps, 0);
  74
  75         if (!prs_ntstatus("ntstatus", &ps, 1, &edata->ntstatus))
  76                 goto out;
  77
  78         if (!prs_uint32("unknown1", &ps, 1, &edata->unknown1))
  79                 goto out;
  80
  81         if (!prs_uint32("unknown2", &ps, 1, &edata->unknown2)) /* only seen 00000001 here */
  82                 goto out;
  83
  84         ret = True;
  85  out:
  86         prs_mem_free(&ps);
  87
  88         return ret;
  89 }
  90
  91  static bool smb_krb5_get_ntstatus_from_krb5_error(krb5_error *error,
  92                                                    NTSTATUS *nt_status)
  93 {
  94         DATA_BLOB edata;
  95         DATA_BLOB unwrapped_edata;
  96         TALLOC_CTX *mem_ctx;
  97         KRB5_EDATA_NTSTATUS parsed_edata;
  98
  99 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 100         edata = data_blob(error->e_data->data, error->e_data->length);
 101 #else
 102         edata = data_blob(error->e_data.data, error->e_data.length);
 103 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 104
 105 #ifdef DEVELOPER
 106         dump_data(10, edata.data, edata.length);
 107 #endif /* DEVELOPER */
 108
 109         mem_ctx = talloc_init("smb_krb5_get_ntstatus_from_krb5_error");
 110         if (mem_ctx == NULL) {
 111                 data_blob_free(&edata);
 112                 return False;
 113         }
 114
 115         if (!unwrap_edata_ntstatus(mem_ctx, &edata, &unwrapped_edata)) {
 116                 data_blob_free(&edata);
 117                 TALLOC_FREE(mem_ctx);
 118                 return False;
 119         }
 120
 121         data_blob_free(&edata);
 122
 123         if (!smb_krb5_err_io_nstatus(mem_ctx, &unwrapped_edata, &parsed_edata)) {
 124                 data_blob_free(&unwrapped_edata);
 125                 TALLOC_FREE(mem_ctx);
 126                 return False;
 127         }
 128
 129         data_blob_free(&unwrapped_edata);
 130
 131         if (nt_status) {
 132                 *nt_status = parsed_edata.ntstatus;
 133         }
 134
 135         TALLOC_FREE(mem_ctx);
 136
 137         return True;
 138 }
 139
 140  static bool smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(krb5_context ctx,
 141                                                                   krb5_get_init_creds_opt *opt,
 142                                                                   NTSTATUS *nt_status)
 143 {
 144         bool ret = False;
 145         krb5_error *error = NULL;
 146
 147 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR
 148         ret = krb5_get_init_creds_opt_get_error(ctx, opt, &error);
 149         if (ret) {
 150                 DEBUG(1,("krb5_get_init_creds_opt_get_error gave: %s\n",
 151                         error_message(ret)));
 152                 return False;
 153         }
 154 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR */
 155
 156         if (!error) {
 157                 DEBUG(1,("no krb5_error\n"));
 158                 return False;
 159         }
 160
 161 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 162         if (!error->e_data) {
 163 #else
 164         if (error->e_data.data == NULL) {
 165 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 166                 DEBUG(1,("no edata in krb5_error\n"));
 167                 krb5_free_error(ctx, error);
 168                 return False;
 169         }
 170
 171         ret = smb_krb5_get_ntstatus_from_krb5_error(error, nt_status);
 172
 173         krb5_free_error(ctx, error);
 174
 175         return ret;
 176 }
 177
 178 /*
 179   simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL
 180   place in default cache location.
 181   remus@snapserver.com
 182 */
 183 int kerberos_kinit_password_ext(const char *principal,
 184                                 const char *password,
 185                                 int time_offset,
 186                                 time_t *expire_time,
 187                                 time_t *renew_till_time,
 188                                 const char *cache_name,
 189                                 bool request_pac,
 190                                 bool add_netbios_addr,
 191                                 time_t renewable_time,
 192                                 NTSTATUS *ntstatus)
 193 {
 194         krb5_context ctx = NULL;
 195         krb5_error_code code = 0;
 196         krb5_ccache cc = NULL;
 197         krb5_principal me = NULL;
 198         krb5_creds my_creds;
 199         krb5_get_init_creds_opt *opt = NULL;
 200         smb_krb5_addresses *addr = NULL;
 201
 202         ZERO_STRUCT(my_creds);
 203
 204         initialize_krb5_error_table();
 205         if ((code = krb5_init_context(&ctx)))
 206                 goto out;
 207
 208         if (time_offset != 0) {
 209                 krb5_set_real_time(ctx, time(NULL) + time_offset, 0);
 210         }
 211
 212         DEBUG(10,("kerberos_kinit_password: using [%s] as ccache and config [%s]\n",
 213                         cache_name ? cache_name: krb5_cc_default_name(ctx),
 214                         getenv("KRB5_CONFIG")));
 215
 216         if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
 217                 goto out;
 218         }
 219
 220         if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
 221                 goto out;
 222         }
 223
 224         if ((code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt))) {
 225                 goto out;
 226         }
 227
 228         krb5_get_init_creds_opt_set_renew_life(opt, renewable_time);
 229         krb5_get_init_creds_opt_set_forwardable(opt, True);
 230 #if 0
 231         /* insane testing */
 232         krb5_get_init_creds_opt_set_tkt_life(opt, 60);
 233 #endif
 234
 235 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST
 236         if (request_pac) {
 237                 if ((code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac))) {
 238                         goto out;
 239                 }
 240         }
 241 #endif
 242         if (add_netbios_addr) {
 243                 if ((code = smb_krb5_gen_netbios_krb5_address(&addr))) {
 244                         goto out;
 245                 }
 246                 krb5_get_init_creds_opt_set_address_list(opt, addr->addrs);
 247         }
 248
 249         if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password),
 250                                                  kerb_prompter, CONST_DISCARD(char *,password),
 251                                                  0, NULL, opt))) {
 252                 goto out;
 253         }
 254
 255         if ((code = krb5_cc_initialize(ctx, cc, me))) {
 256                 goto out;
 257         }
 258
 259         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
 260                 goto out;
 261         }
 262
 263         if (expire_time) {
 264                 *expire_time = (time_t) my_creds.times.endtime;
 265         }
 266
 267         if (renew_till_time) {
 268                 *renew_till_time = (time_t) my_creds.times.renew_till;
 269         }
 270  out:
 271         if (ntstatus) {
 272
 273                 NTSTATUS status;
 274
 275                 /* fast path */
 276                 if (code == 0) {
 277                         *ntstatus = NT_STATUS_OK;
 278                         goto cleanup;
 279                 }
 280
 281                 /* try to get ntstatus code out of krb5_error when we have it
 282                  * inside the krb5_get_init_creds_opt - gd */
 283
 284                 if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) {
 285                         *ntstatus = status;
 286                         goto cleanup;
 287                 }
 288
 289                 /* fall back to self-made-mapping */
 290                 *ntstatus = krb5_to_nt_status(code);
 291         }
 292
 293  cleanup:
 294         krb5_free_cred_contents(ctx, &my_creds);
 295         if (me) {
 296                 krb5_free_principal(ctx, me);
 297         }
 298         if (addr) {
 299                 smb_krb5_free_addresses(ctx, addr);
 300         }
 301         if (opt) {
 302                 smb_krb5_get_init_creds_opt_free(ctx, opt);
 303         }
 304         if (cc) {
 305                 krb5_cc_close(ctx, cc);
 306         }
 307         if (ctx) {
 308                 krb5_free_context(ctx);
 309         }
 310         return code;
 311 }
 312
 313
 314
 315 /* run kinit to setup our ccache */
 316 int ads_kinit_password(ADS_STRUCT *ads)
 317 {
 318         char *s;
 319         int ret;
 320         const char *account_name;
 321         fstring acct_name;
 322
 323         if ( IS_DC ) {
 324                 /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
 325                 account_name = lp_workgroup();
 326         } else {
 327                 /* always use the sAMAccountName for security = domain */
 328                 /* global_myname()$@REA.LM */
 329                 if ( lp_security() == SEC_DOMAIN ) {
 330                         fstr_sprintf( acct_name, "%s$", global_myname() );
 331                         account_name = acct_name;
 332                 }
 333                 else
 334                         /* This looks like host/global_myname()@REA.LM */
 335                         account_name = ads->auth.user_name;
 336         }
 337
 338         if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
 339                 return KRB5_CC_NOMEM;
 340         }
 341
 342         if (!ads->auth.password) {
 343                 SAFE_FREE(s);
 344                 return KRB5_LIBOS_CANTREADPWD;
 345         }
 346
 347         ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
 348                         &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable,
 349                         NULL);
 350
 351         if (ret) {
 352                 DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
 353                          s, error_message(ret)));
 354         }
 355         SAFE_FREE(s);
 356         return ret;
 357 }
 358
 359 int ads_kdestroy(const char *cc_name)
 360 {
 361         krb5_error_code code;
 362         krb5_context ctx = NULL;
 363         krb5_ccache cc = NULL;
 364
 365         initialize_krb5_error_table();
 366         if ((code = krb5_init_context (&ctx))) {
 367                 DEBUG(3, ("ads_kdestroy: kdb5_init_context failed: %s\n",
 368                         error_message(code)));
 369                 return code;
 370         }
 371
 372         if (!cc_name) {
 373                 if ((code = krb5_cc_default(ctx, &cc))) {
 374                         krb5_free_context(ctx);
 375                         return code;
 376                 }
 377         } else {
 378                 if ((code = krb5_cc_resolve(ctx, cc_name, &cc))) {
 379                         DEBUG(3, ("ads_kdestroy: krb5_cc_resolve failed: %s\n",
 380                                   error_message(code)));
 381                         krb5_free_context(ctx);
 382                         return code;
 383                 }
 384         }
 385
 386         if ((code = krb5_cc_destroy (ctx, cc))) {
 387                 DEBUG(3, ("ads_kdestroy: krb5_cc_destroy failed: %s\n",
 388                         error_message(code)));
 389         }
 390
 391         krb5_free_context (ctx);
 392         return code;
 393 }
 394
 395 /************************************************************************
 396  Routine to fetch the salting principal for a service.  Active
 397  Directory may use a non-obvious principal name to generate the salt
 398  when it determines the key to use for encrypting tickets for a service,
 399  and hopefully we detected that when we joined the domain.
 400  ************************************************************************/
 401
 402 static char *kerberos_secrets_fetch_salting_principal(const char *service, int enctype)
 403 {
 404         char *key = NULL;
 405         char *ret = NULL;
 406
 407         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, service, enctype);
 408         if (!key) {
 409                 return NULL;
 410         }
 411         ret = (char *)secrets_fetch(key, NULL);
 412         SAFE_FREE(key);
 413         return ret;
 414 }
 415
 416 /************************************************************************
 417  Return the standard DES salt key
 418 ************************************************************************/
 419
 420 char* kerberos_standard_des_salt( void )
 421 {
 422         fstring salt;
 423
 424         fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
 425         strlower_m( salt );
 426         fstrcat( salt, lp_realm() );
 427
 428         return SMB_STRDUP( salt );
 429 }
 430
 431 /************************************************************************
 432 ************************************************************************/
 433
 434 static char* des_salt_key( void )
 435 {
 436         char *key;
 437
 438         asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, lp_realm());
 439
 440         return key;
 441 }
 442
 443 /************************************************************************
 444 ************************************************************************/
 445
 446 bool kerberos_secrets_store_des_salt( const char* salt )
 447 {
 448         char* key;
 449         bool ret;
 450
 451         if ( (key = des_salt_key()) == NULL ) {
 452                 DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
 453                 return False;
 454         }
 455
 456         if ( !salt ) {
 457                 DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
 458                 secrets_delete( key );
 459                 return True;
 460         }
 461
 462         DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
 463
 464         ret = secrets_store( key, salt, strlen(salt)+1 );
 465
 466         SAFE_FREE( key );
 467
 468         return ret;
 469 }
 470
 471 /************************************************************************
 472 ************************************************************************/
 473
 474 char* kerberos_secrets_fetch_des_salt( void )
 475 {
 476         char *salt, *key;
 477
 478         if ( (key = des_salt_key()) == NULL ) {
 479                 DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
 480                 return False;
 481         }
 482
 483         salt = (char*)secrets_fetch( key, NULL );
 484
 485         SAFE_FREE( key );
 486
 487         return salt;
 488 }
 489
 490 /************************************************************************
 491  Routine to get the default realm from the kerberos credentials cache.
 492  Caller must free if the return value is not NULL.
 493 ************************************************************************/
 494
 495 char *kerberos_get_default_realm_from_ccache( void )
 496 {
 497         char *realm = NULL;
 498         krb5_context ctx = NULL;
 499         krb5_ccache cc = NULL;
 500         krb5_principal princ = NULL;
 501
 502         initialize_krb5_error_table();
 503         if (krb5_init_context(&ctx)) {
 504                 return NULL;
 505         }
 506
 507         DEBUG(5,("kerberos_get_default_realm_from_ccache: "
 508                 "Trying to read krb5 cache: %s\n",
 509                 krb5_cc_default_name(ctx)));
 510         if (krb5_cc_default(ctx, &cc)) {
 511                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
 512                         "failed to read default cache\n"));
 513                 goto out;
 514         }
 515         if (krb5_cc_get_principal(ctx, cc, &princ)) {
 516                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
 517                         "failed to get default principal\n"));
 518                 goto out;
 519         }
 520
 521 #if defined(HAVE_KRB5_PRINCIPAL_GET_REALM)
 522         realm = SMB_STRDUP(krb5_principal_get_realm(ctx, princ));
 523 #elif defined(HAVE_KRB5_PRINC_REALM)
 524         realm = SMB_STRDUP(krb5_princ_realm(ctx, princ)->data);
 525 #endif
 526
 527   out:
 528
 529         if (princ) {
 530                 krb5_free_principal(ctx, princ);
 531         }
 532         if (cc) {
 533                 krb5_cc_close(ctx, cc);
 534         }
 535         if (ctx) {
 536                 krb5_free_context(ctx);
 537         }
 538
 539         return realm;
 540 }
 541
 542
 543 /************************************************************************
 544  Routine to get the salting principal for this service.  This is
 545  maintained for backwards compatibilty with releases prior to 3.0.24.
 546  Since we store the salting principal string only at join, we may have
 547  to look for the older tdb keys.  Caller must free if return is not null.
 548  ************************************************************************/
 549
 550 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 551                                                         krb5_principal host_princ,
 552                                                         int enctype)
 553 {
 554         char *unparsed_name = NULL, *salt_princ_s = NULL;
 555         krb5_principal ret_princ = NULL;
 556
 557         /* lookup new key first */
 558
 559         if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
 560
 561                 /* look under the old key.  If this fails, just use the standard key */
 562
 563                 if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
 564                         return (krb5_principal)NULL;
 565                 }
 566                 if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
 567                         /* fall back to host/machine.realm@REALM */
 568                         salt_princ_s = kerberos_standard_des_salt();
 569                 }
 570         }
 571
 572         if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
 573                 ret_princ = NULL;
 574         }
 575
 576         SAFE_FREE(unparsed_name);
 577         SAFE_FREE(salt_princ_s);
 578
 579         return ret_princ;
 580 }
 581
 582 /************************************************************************
 583  Routine to set the salting principal for this service.  Active
 584  Directory may use a non-obvious principal name to generate the salt
 585  when it determines the key to use for encrypting tickets for a service,
 586  and hopefully we detected that when we joined the domain.
 587  Setting principal to NULL deletes this entry.
 588  ************************************************************************/
 589
 590 bool kerberos_secrets_store_salting_principal(const char *service,
 591                                               int enctype,
 592                                               const char *principal)
 593 {
 594         char *key = NULL;
 595         bool ret = False;
 596         krb5_context context = NULL;
 597         krb5_principal princ = NULL;
 598         char *princ_s = NULL;
 599         char *unparsed_name = NULL;
 600
 601         krb5_init_context(&context);
 602         if (!context) {
 603                 return False;
 604         }
 605         if (strchr_m(service, '@')) {
 606                 asprintf(&princ_s, "%s", service);
 607         } else {
 608                 asprintf(&princ_s, "%s@%s", service, lp_realm());
 609         }
 610
 611         if (smb_krb5_parse_name(context, princ_s, &princ) != 0) {
 612                 goto out;
 613
 614         }
 615         if (smb_krb5_unparse_name(context, princ, &unparsed_name) != 0) {
 616                 goto out;
 617         }
 618
 619         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, unparsed_name, enctype);
 620         if (!key)  {
 621                 goto out;
 622         }
 623
 624         if ((principal != NULL) && (strlen(principal) > 0)) {
 625                 ret = secrets_store(key, principal, strlen(principal) + 1);
 626         } else {
 627                 ret = secrets_delete(key);
 628         }
 629
 630  out:
 631
 632         SAFE_FREE(key);
 633         SAFE_FREE(princ_s);
 634         SAFE_FREE(unparsed_name);
 635
 636         if (context) {
 637                 krb5_free_context(context);
 638         }
 639
 640         return ret;
 641 }
 642
 643
 644 /************************************************************************
 645 ************************************************************************/
 646
 647 int kerberos_kinit_password(const char *principal,
 648                             const char *password,
 649                             int time_offset,
 650                             const char *cache_name)
 651 {
 652         return kerberos_kinit_password_ext(principal,
 653                                            password,
 654                                            time_offset,
 655                                            0,
 656                                            0,
 657                                            cache_name,
 658                                            False,
 659                                            False,
 660                                            0,
 661                                            NULL);
 662 }
 663
 664 /************************************************************************
 665  Create a string list of available kdc's, possibly searching by sitename.
 666  Does DNS queries.
 667 ************************************************************************/
 668
 669 static char *get_kdc_ip_string(char *mem_ctx,
 670                 const char *realm,
 671                 const char *sitename,
 672                 struct sockaddr_storage *pss)
 673 {
 674         int i;
 675         struct ip_service *ip_srv_site = NULL;
 676         struct ip_service *ip_srv_nonsite;
 677         int count_site = 0;
 678         int count_nonsite;
 679         char *kdc_str = talloc_asprintf(mem_ctx, "\tkdc = %s\n",
 680                                         print_canonical_sockaddr(mem_ctx,
 681                                                         pss));
 682
 683         if (kdc_str == NULL) {
 684                 return NULL;
 685         }
 686
 687         /* Get the KDC's only in this site. */
 688
 689         if (sitename) {
 690
 691                 get_kdc_list(realm, sitename, &ip_srv_site, &count_site);
 692
 693                 for (i = 0; i < count_site; i++) {
 694                         if (addr_equal(&ip_srv_site[i].ss, pss)) {
 695                                 continue;
 696                         }
 697                         /* Append to the string - inefficient
 698                          * but not done often. */
 699                         kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 700                                 kdc_str,
 701                                 print_canonical_sockaddr(mem_ctx,
 702                                                         &ip_srv_site[i].ss));
 703                         if (!kdc_str) {
 704                                 SAFE_FREE(ip_srv_site);
 705                                 return NULL;
 706                         }
 707                 }
 708         }
 709
 710         /* Get all KDC's. */
 711
 712         get_kdc_list(realm, NULL, &ip_srv_nonsite, &count_nonsite);
 713
 714         for (i = 0; i < count_nonsite; i++) {
 715                 int j;
 716
 717                 if (addr_equal(&ip_srv_nonsite[i].ss, pss)) {
 718                         continue;
 719                 }
 720
 721                 /* Ensure this isn't an IP already seen (YUK! this is n*n....) */
 722                 for (j = 0; j < count_site; j++) {
 723                         if (addr_equal(&ip_srv_nonsite[i].ss,
 724                                                 &ip_srv_site[j].ss)) {
 725                                 break;
 726                         }
 727                         /* As the lists are sorted we can break early if nonsite > site. */
 728                         if (ip_service_compare(&ip_srv_nonsite[i], &ip_srv_site[j]) > 0) {
 729                                 break;
 730                         }
 731                 }
 732                 if (j != i) {
 733                         continue;
 734                 }
 735
 736                 /* Append to the string - inefficient but not done often. */
 737                 kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 738                                 kdc_str,
 739                                 print_canonical_sockaddr(mem_ctx,
 740                                                 &ip_srv_nonsite[i].ss));
 741                 if (!kdc_str) {
 742                         SAFE_FREE(ip_srv_site);
 743                         SAFE_FREE(ip_srv_nonsite);
 744                         return NULL;
 745                 }
 746         }
 747
 748
 749         SAFE_FREE(ip_srv_site);
 750         SAFE_FREE(ip_srv_nonsite);
 751
 752         DEBUG(10,("get_kdc_ip_string: Returning %s\n",
 753                 kdc_str ));
 754
 755         return kdc_str;
 756 }
 757
 758 /************************************************************************
 759  Create  a specific krb5.conf file in the private directory pointing
 760  at a specific kdc for a realm. Keyed off domain name. Sets
 761  KRB5_CONFIG environment variable to point to this file. Must be
 762  run as root or will fail (which is a good thing :-).
 763 ************************************************************************/
 764
 765 bool create_local_private_krb5_conf_for_domain(const char *realm,
 766                                                 const char *domain,
 767                                                 const char *sitename,
 768                                                 struct sockaddr_storage *pss)
 769 {
 770         char *dname = talloc_asprintf(NULL, "%s/smb_krb5", lp_lockdir());
 771         char *tmpname = NULL;
 772         char *fname = NULL;
 773         char *file_contents = NULL;
 774         char *kdc_ip_string = NULL;
 775         size_t flen = 0;
 776         ssize_t ret;
 777         int fd;
 778         char *realm_upper = NULL;
 779
 780         if (!dname) {
 781                 return False;
 782         }
 783         if ((mkdir(dname, 0755)==-1) && (errno != EEXIST)) {
 784                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 785                         "failed to create directory %s. Error was %s\n",
 786                         dname, strerror(errno) ));
 787                 TALLOC_FREE(dname);
 788                 return False;
 789         }
 790
 791         tmpname = talloc_asprintf(dname, "%s/smb_tmp_krb5.XXXXXX", lp_lockdir());
 792         if (!tmpname) {
 793                 TALLOC_FREE(dname);
 794                 return False;
 795         }
 796
 797         fname = talloc_asprintf(dname, "%s/krb5.conf.%s", dname, domain);
 798         if (!fname) {
 799                 TALLOC_FREE(dname);
 800                 return False;
 801         }
 802
 803         DEBUG(10,("create_local_private_krb5_conf_for_domain: fname = %s, realm = %s, domain = %s\n",
 804                 fname, realm, domain ));
 805
 806         realm_upper = talloc_strdup(fname, realm);
 807         strupper_m(realm_upper);
 808
 809         kdc_ip_string = get_kdc_ip_string(dname, realm, sitename, pss);
 810         if (!kdc_ip_string) {
 811                 TALLOC_FREE(dname);
 812                 return False;
 813         }
 814
 815         file_contents = talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n\n"
 816                                 "[realms]\n\t%s = {\n"
 817                                 "\t%s\t}\n",
 818                                 realm_upper, realm_upper, kdc_ip_string);
 819
 820         if (!file_contents) {
 821                 TALLOC_FREE(dname);
 822                 return False;
 823         }
 824
 825         flen = strlen(file_contents);
 826
 827         fd = smb_mkstemp(tmpname);
 828         if (fd == -1) {
 829                 DEBUG(0,("create_local_private_krb5_conf_for_domain: smb_mkstemp failed,"
 830                         " for file %s. Errno %s\n",
 831                         tmpname, strerror(errno) ));
 832         }
 833
 834         if (fchmod(fd, 0644)==-1) {
 835                 DEBUG(0,("create_local_private_krb5_conf_for_domain: fchmod failed for %s."
 836                         " Errno %s\n",
 837                         tmpname, strerror(errno) ));
 838                 unlink(tmpname);
 839                 close(fd);
 840                 TALLOC_FREE(dname);
 841                 return False;
 842         }
 843
 844         ret = write(fd, file_contents, flen);
 845         if (flen != ret) {
 846                 DEBUG(0,("create_local_private_krb5_conf_for_domain: write failed,"
 847                         " returned %d (should be %u). Errno %s\n",
 848                         (int)ret, (unsigned int)flen, strerror(errno) ));
 849                 unlink(tmpname);
 850                 close(fd);
 851                 TALLOC_FREE(dname);
 852                 return False;
 853         }
 854         if (close(fd)==-1) {
 855                 DEBUG(0,("create_local_private_krb5_conf_for_domain: close failed."
 856                         " Errno %s\n", strerror(errno) ));
 857                 unlink(tmpname);
 858                 TALLOC_FREE(dname);
 859                 return False;
 860         }
 861
 862         if (rename(tmpname, fname) == -1) {
 863                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 864                         "of %s to %s failed. Errno %s\n",
 865                         tmpname, fname, strerror(errno) ));
 866                 unlink(tmpname);
 867                 TALLOC_FREE(dname);
 868                 return False;
 869         }
 870
 871         DEBUG(5,("create_local_private_krb5_conf_for_domain: wrote "
 872                 "file %s with realm %s KDC = %s\n",
 873                 fname, realm_upper, print_canonical_sockaddr(dname, pss) ));
 874
 875         /* Set the environment variable to this file. */
 876         setenv("KRB5_CONFIG", fname, 1);
 877
 878 #if defined(OVERWRITE_SYSTEM_KRB5_CONF)
 879
 880 #define SYSTEM_KRB5_CONF_PATH "/etc/krb5.conf"
 881         /* Insanity, sheer insanity..... */
 882
 883         if (strequal(realm, lp_realm())) {
 884                 char linkpath[PATH_MAX+1];
 885                 int lret;
 886
 887                 lret = readlink(SYSTEM_KRB5_CONF_PATH, linkpath, sizeof(linkpath)-1);
 888                 if (lret != -1) {
 889                         linkpath[lret] = '\0';
 890                 }
 891
 892                 if (lret != -1 || strcmp(linkpath, fname) == 0) {
 893                         /* Symlink already exists. */
 894                         TALLOC_FREE(dname);
 895                         return True;
 896                 }
 897
 898                 /* Try and replace with a symlink. */
 899                 if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 900                         const char *newpath = SYSTEM_KRB5_CONF_PATH ## ".saved";
 901                         if (errno != EEXIST) {
 902                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: symlink "
 903                                         "of %s to %s failed. Errno %s\n",
 904                                         fname, SYSTEM_KRB5_CONF_PATH, strerror(errno) ));
 905                                 TALLOC_FREE(dname);
 906                                 return True; /* Not a fatal error. */
 907                         }
 908
 909                         /* Yes, this is a race conditon... too bad. */
 910                         if (rename(SYSTEM_KRB5_CONF_PATH, newpath) == -1) {
 911                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 912                                         "of %s to %s failed. Errno %s\n",
 913                                         SYSTEM_KRB5_CONF_PATH, newpath,
 914                                         strerror(errno) ));
 915                                 TALLOC_FREE(dname);
 916                                 return True; /* Not a fatal error. */
 917                         }
 918
 919                         if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 920                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 921                                         "forced symlink of %s to /etc/krb5.conf failed. Errno %s\n",
 922                                         fname, strerror(errno) ));
 923                                 TALLOC_FREE(dname);
 924                                 return True; /* Not a fatal error. */
 925                         }
 926                 }
 927         }
 928 #endif
 929
 930         TALLOC_FREE(dname);
 931
 932         return True;
 933 }
 934 #endif