source3/libads/kerberos.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Nalin Dahyabhai <nalin@redhat.com> 2004.
   7    Copyright (C) Jeremy Allison 2004.
   8    Copyright (C) Gerald Carter 2006.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25
  26 #ifdef HAVE_KRB5
  27
  28 #define DEFAULT_KRB5_PORT 88
  29
  30 #define LIBADS_CCACHE_NAME "MEMORY:libads"
  31
  32 /*
  33   we use a prompter to avoid a crash bug in the kerberos libs when
  34   dealing with empty passwords
  35   this prompter is just a string copy ...
  36 */
  37 static krb5_error_code
  38 kerb_prompter(krb5_context ctx, void *data,
  39                const char *name,
  40                const char *banner,
  41                int num_prompts,
  42                krb5_prompt prompts[])
  43 {
  44         if (num_prompts == 0) return 0;
  45
  46         memset(prompts[0].reply->data, '\0', prompts[0].reply->length);
  47         if (prompts[0].reply->length > 0) {
  48                 if (data) {
  49                         strncpy(prompts[0].reply->data, (const char *)data,
  50                                 prompts[0].reply->length-1);
  51                         prompts[0].reply->length = strlen(prompts[0].reply->data);
  52                 } else {
  53                         prompts[0].reply->length = 0;
  54                 }
  55         }
  56         return 0;
  57 }
  58
  59 static bool smb_krb5_err_io_nstatus(TALLOC_CTX *mem_ctx,
  60                                     DATA_BLOB *edata_blob,
  61                                     KRB5_EDATA_NTSTATUS *edata)
  62 {
  63         bool ret = False;
  64         prs_struct ps;
  65
  66         if (!mem_ctx || !edata_blob || !edata)
  67                 return False;
  68
  69         if (!prs_init(&ps, edata_blob->length, mem_ctx, UNMARSHALL))
  70                 return False;
  71
  72         if (!prs_copy_data_in(&ps, (char *)edata_blob->data, edata_blob->length))
  73                 goto out;
  74
  75         prs_set_offset(&ps, 0);
  76
  77         if (!prs_ntstatus("ntstatus", &ps, 1, &edata->ntstatus))
  78                 goto out;
  79
  80         if (!prs_uint32("unknown1", &ps, 1, &edata->unknown1))
  81                 goto out;
  82
  83         if (!prs_uint32("unknown2", &ps, 1, &edata->unknown2)) /* only seen 00000001 here */
  84                 goto out;
  85
  86         ret = True;
  87  out:
  88         prs_mem_free(&ps);
  89
  90         return ret;
  91 }
  92
  93  static bool smb_krb5_get_ntstatus_from_krb5_error(krb5_error *error,
  94                                                    NTSTATUS *nt_status)
  95 {
  96         DATA_BLOB edata;
  97         DATA_BLOB unwrapped_edata;
  98         TALLOC_CTX *mem_ctx;
  99         KRB5_EDATA_NTSTATUS parsed_edata;
 100
 101 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 102         edata = data_blob(error->e_data->data, error->e_data->length);
 103 #else
 104         edata = data_blob(error->e_data.data, error->e_data.length);
 105 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 106
 107 #ifdef DEVELOPER
 108         dump_data(10, edata.data, edata.length);
 109 #endif /* DEVELOPER */
 110
 111         mem_ctx = talloc_init("smb_krb5_get_ntstatus_from_krb5_error");
 112         if (mem_ctx == NULL) {
 113                 data_blob_free(&edata);
 114                 return False;
 115         }
 116
 117         if (!unwrap_edata_ntstatus(mem_ctx, &edata, &unwrapped_edata)) {
 118                 data_blob_free(&edata);
 119                 TALLOC_FREE(mem_ctx);
 120                 return False;
 121         }
 122
 123         data_blob_free(&edata);
 124
 125         if (!smb_krb5_err_io_nstatus(mem_ctx, &unwrapped_edata, &parsed_edata)) {
 126                 data_blob_free(&unwrapped_edata);
 127                 TALLOC_FREE(mem_ctx);
 128                 return False;
 129         }
 130
 131         data_blob_free(&unwrapped_edata);
 132
 133         if (nt_status) {
 134                 *nt_status = parsed_edata.ntstatus;
 135         }
 136
 137         TALLOC_FREE(mem_ctx);
 138
 139         return True;
 140 }
 141
 142  static bool smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(krb5_context ctx,
 143                                                                   krb5_get_init_creds_opt *opt,
 144                                                                   NTSTATUS *nt_status)
 145 {
 146         bool ret = False;
 147         krb5_error *error = NULL;
 148
 149 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR
 150         ret = krb5_get_init_creds_opt_get_error(ctx, opt, &error);
 151         if (ret) {
 152                 DEBUG(1,("krb5_get_init_creds_opt_get_error gave: %s\n",
 153                         error_message(ret)));
 154                 return False;
 155         }
 156 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR */
 157
 158         if (!error) {
 159                 DEBUG(1,("no krb5_error\n"));
 160                 return False;
 161         }
 162
 163 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 164         if (!error->e_data) {
 165 #else
 166         if (error->e_data.data == NULL) {
 167 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 168                 DEBUG(1,("no edata in krb5_error\n"));
 169                 krb5_free_error(ctx, error);
 170                 return False;
 171         }
 172
 173         ret = smb_krb5_get_ntstatus_from_krb5_error(error, nt_status);
 174
 175         krb5_free_error(ctx, error);
 176
 177         return ret;
 178 }
 179
 180 /*
 181   simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL
 182   place in default cache location.
 183   remus@snapserver.com
 184 */
 185 int kerberos_kinit_password_ext(const char *principal,
 186                                 const char *password,
 187                                 int time_offset,
 188                                 time_t *expire_time,
 189                                 time_t *renew_till_time,
 190                                 const char *cache_name,
 191                                 bool request_pac,
 192                                 bool add_netbios_addr,
 193                                 time_t renewable_time,
 194                                 NTSTATUS *ntstatus)
 195 {
 196         krb5_context ctx = NULL;
 197         krb5_error_code code = 0;
 198         krb5_ccache cc = NULL;
 199         krb5_principal me = NULL;
 200         krb5_creds my_creds;
 201         krb5_get_init_creds_opt *opt = NULL;
 202         smb_krb5_addresses *addr = NULL;
 203
 204         ZERO_STRUCT(my_creds);
 205
 206         initialize_krb5_error_table();
 207         if ((code = krb5_init_context(&ctx)))
 208                 goto out;
 209
 210         if (time_offset != 0) {
 211                 krb5_set_real_time(ctx, time(NULL) + time_offset, 0);
 212         }
 213
 214         DEBUG(10,("kerberos_kinit_password: as %s using [%s] as ccache and config [%s]\n",
 215                         principal,
 216                         cache_name ? cache_name: krb5_cc_default_name(ctx),
 217                         getenv("KRB5_CONFIG")));
 218
 219         if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
 220                 goto out;
 221         }
 222
 223         if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
 224                 goto out;
 225         }
 226
 227         if ((code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt))) {
 228                 goto out;
 229         }
 230
 231         krb5_get_init_creds_opt_set_renew_life(opt, renewable_time);
 232         krb5_get_init_creds_opt_set_forwardable(opt, True);
 233 #if 0
 234         /* insane testing */
 235         krb5_get_init_creds_opt_set_tkt_life(opt, 60);
 236 #endif
 237
 238 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST
 239         if (request_pac) {
 240                 if ((code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac))) {
 241                         goto out;
 242                 }
 243         }
 244 #endif
 245         if (add_netbios_addr) {
 246                 if ((code = smb_krb5_gen_netbios_krb5_address(&addr))) {
 247                         goto out;
 248                 }
 249                 krb5_get_init_creds_opt_set_address_list(opt, addr->addrs);
 250         }
 251
 252         if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password),
 253                                                  kerb_prompter, CONST_DISCARD(char *,password),
 254                                                  0, NULL, opt))) {
 255                 goto out;
 256         }
 257
 258         if ((code = krb5_cc_initialize(ctx, cc, me))) {
 259                 goto out;
 260         }
 261
 262         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
 263                 goto out;
 264         }
 265
 266         if (expire_time) {
 267                 *expire_time = (time_t) my_creds.times.endtime;
 268         }
 269
 270         if (renew_till_time) {
 271                 *renew_till_time = (time_t) my_creds.times.renew_till;
 272         }
 273  out:
 274         if (ntstatus) {
 275
 276                 NTSTATUS status;
 277
 278                 /* fast path */
 279                 if (code == 0) {
 280                         *ntstatus = NT_STATUS_OK;
 281                         goto cleanup;
 282                 }
 283
 284                 /* try to get ntstatus code out of krb5_error when we have it
 285                  * inside the krb5_get_init_creds_opt - gd */
 286
 287                 if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) {
 288                         *ntstatus = status;
 289                         goto cleanup;
 290                 }
 291
 292                 /* fall back to self-made-mapping */
 293                 *ntstatus = krb5_to_nt_status(code);
 294         }
 295
 296  cleanup:
 297         krb5_free_cred_contents(ctx, &my_creds);
 298         if (me) {
 299                 krb5_free_principal(ctx, me);
 300         }
 301         if (addr) {
 302                 smb_krb5_free_addresses(ctx, addr);
 303         }
 304         if (opt) {
 305                 smb_krb5_get_init_creds_opt_free(ctx, opt);
 306         }
 307         if (cc) {
 308                 krb5_cc_close(ctx, cc);
 309         }
 310         if (ctx) {
 311                 krb5_free_context(ctx);
 312         }
 313         return code;
 314 }
 315
 316
 317
 318 /* run kinit to setup our ccache */
 319 int ads_kinit_password(ADS_STRUCT *ads)
 320 {
 321         char *s;
 322         int ret;
 323         const char *account_name;
 324         fstring acct_name;
 325
 326         if ( IS_DC ) {
 327                 /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
 328                 account_name = lp_workgroup();
 329         } else {
 330                 /* always use the sAMAccountName for security = domain */
 331                 /* global_myname()$@REA.LM */
 332                 if ( lp_security() == SEC_DOMAIN ) {
 333                         fstr_sprintf( acct_name, "%s$", global_myname() );
 334                         account_name = acct_name;
 335                 }
 336                 else
 337                         /* This looks like host/global_myname()@REA.LM */
 338                         account_name = ads->auth.user_name;
 339         }
 340
 341         if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
 342                 return KRB5_CC_NOMEM;
 343         }
 344
 345         if (!ads->auth.password) {
 346                 SAFE_FREE(s);
 347                 return KRB5_LIBOS_CANTREADPWD;
 348         }
 349
 350         ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
 351                         &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable,
 352                         NULL);
 353
 354         if (ret) {
 355                 DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
 356                          s, error_message(ret)));
 357         }
 358         SAFE_FREE(s);
 359         return ret;
 360 }
 361
 362 int ads_kdestroy(const char *cc_name)
 363 {
 364         krb5_error_code code;
 365         krb5_context ctx = NULL;
 366         krb5_ccache cc = NULL;
 367
 368         initialize_krb5_error_table();
 369         if ((code = krb5_init_context (&ctx))) {
 370                 DEBUG(3, ("ads_kdestroy: kdb5_init_context failed: %s\n",
 371                         error_message(code)));
 372                 return code;
 373         }
 374
 375         if (!cc_name) {
 376                 if ((code = krb5_cc_default(ctx, &cc))) {
 377                         krb5_free_context(ctx);
 378                         return code;
 379                 }
 380         } else {
 381                 if ((code = krb5_cc_resolve(ctx, cc_name, &cc))) {
 382                         DEBUG(3, ("ads_kdestroy: krb5_cc_resolve failed: %s\n",
 383                                   error_message(code)));
 384                         krb5_free_context(ctx);
 385                         return code;
 386                 }
 387         }
 388
 389         if ((code = krb5_cc_destroy (ctx, cc))) {
 390                 DEBUG(3, ("ads_kdestroy: krb5_cc_destroy failed: %s\n",
 391                         error_message(code)));
 392         }
 393
 394         krb5_free_context (ctx);
 395         return code;
 396 }
 397
 398 /************************************************************************
 399  Routine to fetch the salting principal for a service.  Active
 400  Directory may use a non-obvious principal name to generate the salt
 401  when it determines the key to use for encrypting tickets for a service,
 402  and hopefully we detected that when we joined the domain.
 403  ************************************************************************/
 404
 405 static char *kerberos_secrets_fetch_salting_principal(const char *service, int enctype)
 406 {
 407         char *key = NULL;
 408         char *ret = NULL;
 409
 410         if (asprintf(&key, "%s/%s/enctype=%d",
 411                      SECRETS_SALTING_PRINCIPAL, service, enctype) == -1) {
 412                 return NULL;
 413         }
 414         ret = (char *)secrets_fetch(key, NULL);
 415         SAFE_FREE(key);
 416         return ret;
 417 }
 418
 419 /************************************************************************
 420  Return the standard DES salt key
 421 ************************************************************************/
 422
 423 char* kerberos_standard_des_salt( void )
 424 {
 425         fstring salt;
 426
 427         fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
 428         strlower_m( salt );
 429         fstrcat( salt, lp_realm() );
 430
 431         return SMB_STRDUP( salt );
 432 }
 433
 434 /************************************************************************
 435 ************************************************************************/
 436
 437 static char* des_salt_key( void )
 438 {
 439         char *key;
 440
 441         if (asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL,
 442                      lp_realm()) == -1) {
 443                 return NULL;
 444         }
 445
 446         return key;
 447 }
 448
 449 /************************************************************************
 450 ************************************************************************/
 451
 452 bool kerberos_secrets_store_des_salt( const char* salt )
 453 {
 454         char* key;
 455         bool ret;
 456
 457         if ( (key = des_salt_key()) == NULL ) {
 458                 DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
 459                 return False;
 460         }
 461
 462         if ( !salt ) {
 463                 DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
 464                 secrets_delete( key );
 465                 return True;
 466         }
 467
 468         DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
 469
 470         ret = secrets_store( key, salt, strlen(salt)+1 );
 471
 472         SAFE_FREE( key );
 473
 474         return ret;
 475 }
 476
 477 /************************************************************************
 478 ************************************************************************/
 479
 480 char* kerberos_secrets_fetch_des_salt( void )
 481 {
 482         char *salt, *key;
 483
 484         if ( (key = des_salt_key()) == NULL ) {
 485                 DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
 486                 return False;
 487         }
 488
 489         salt = (char*)secrets_fetch( key, NULL );
 490
 491         SAFE_FREE( key );
 492
 493         return salt;
 494 }
 495
 496 /************************************************************************
 497  Routine to get the default realm from the kerberos credentials cache.
 498  Caller must free if the return value is not NULL.
 499 ************************************************************************/
 500
 501 char *kerberos_get_default_realm_from_ccache( void )
 502 {
 503         char *realm = NULL;
 504         krb5_context ctx = NULL;
 505         krb5_ccache cc = NULL;
 506         krb5_principal princ = NULL;
 507
 508         initialize_krb5_error_table();
 509         if (krb5_init_context(&ctx)) {
 510                 return NULL;
 511         }
 512
 513         DEBUG(5,("kerberos_get_default_realm_from_ccache: "
 514                 "Trying to read krb5 cache: %s\n",
 515                 krb5_cc_default_name(ctx)));
 516         if (krb5_cc_default(ctx, &cc)) {
 517                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
 518                         "failed to read default cache\n"));
 519                 goto out;
 520         }
 521         if (krb5_cc_get_principal(ctx, cc, &princ)) {
 522                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
 523                         "failed to get default principal\n"));
 524                 goto out;
 525         }
 526
 527 #if defined(HAVE_KRB5_PRINCIPAL_GET_REALM)
 528         realm = SMB_STRDUP(krb5_principal_get_realm(ctx, princ));
 529 #elif defined(HAVE_KRB5_PRINC_REALM)
 530         {
 531                 krb5_data *realm_data = krb5_princ_realm(ctx, princ);
 532                 realm = SMB_STRNDUP(realm_data->data, realm_data->length);
 533         }
 534 #endif
 535
 536   out:
 537
 538         if (princ) {
 539                 krb5_free_principal(ctx, princ);
 540         }
 541         if (cc) {
 542                 krb5_cc_close(ctx, cc);
 543         }
 544         if (ctx) {
 545                 krb5_free_context(ctx);
 546         }
 547
 548         return realm;
 549 }
 550
 551
 552 /************************************************************************
 553  Routine to get the salting principal for this service.  This is
 554  maintained for backwards compatibilty with releases prior to 3.0.24.
 555  Since we store the salting principal string only at join, we may have
 556  to look for the older tdb keys.  Caller must free if return is not null.
 557  ************************************************************************/
 558
 559 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 560                                                         krb5_principal host_princ,
 561                                                         int enctype)
 562 {
 563         char *unparsed_name = NULL, *salt_princ_s = NULL;
 564         krb5_principal ret_princ = NULL;
 565
 566         /* lookup new key first */
 567
 568         if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
 569
 570                 /* look under the old key.  If this fails, just use the standard key */
 571
 572                 if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
 573                         return (krb5_principal)NULL;
 574                 }
 575                 if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
 576                         /* fall back to host/machine.realm@REALM */
 577                         salt_princ_s = kerberos_standard_des_salt();
 578                 }
 579         }
 580
 581         if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
 582                 ret_princ = NULL;
 583         }
 584
 585         SAFE_FREE(unparsed_name);
 586         SAFE_FREE(salt_princ_s);
 587
 588         return ret_princ;
 589 }
 590
 591 /************************************************************************
 592  Routine to set the salting principal for this service.  Active
 593  Directory may use a non-obvious principal name to generate the salt
 594  when it determines the key to use for encrypting tickets for a service,
 595  and hopefully we detected that when we joined the domain.
 596  Setting principal to NULL deletes this entry.
 597  ************************************************************************/
 598
 599 bool kerberos_secrets_store_salting_principal(const char *service,
 600                                               int enctype,
 601                                               const char *principal)
 602 {
 603         char *key = NULL;
 604         bool ret = False;
 605         krb5_context context = NULL;
 606         krb5_principal princ = NULL;
 607         char *princ_s = NULL;
 608         char *unparsed_name = NULL;
 609         krb5_error_code code;
 610
 611         if (((code = krb5_init_context(&context)) != 0) || (context == NULL)) {
 612                 DEBUG(5, ("kerberos_secrets_store_salting_pricipal: kdb5_init_context failed: %s\n",
 613                           error_message(code)));
 614                 return False;
 615         }
 616         if (strchr_m(service, '@')) {
 617                 if (asprintf(&princ_s, "%s", service) == -1) {
 618                         goto out;
 619                 }
 620         } else {
 621                 if (asprintf(&princ_s, "%s@%s", service, lp_realm()) == -1) {
 622                         goto out;
 623                 }
 624         }
 625
 626         if (smb_krb5_parse_name(context, princ_s, &princ) != 0) {
 627                 goto out;
 628
 629         }
 630         if (smb_krb5_unparse_name(context, princ, &unparsed_name) != 0) {
 631                 goto out;
 632         }
 633
 634         if (asprintf(&key, "%s/%s/enctype=%d",
 635                      SECRETS_SALTING_PRINCIPAL, unparsed_name, enctype)
 636             == -1) {
 637                 goto out;
 638         }
 639
 640         if ((principal != NULL) && (strlen(principal) > 0)) {
 641                 ret = secrets_store(key, principal, strlen(principal) + 1);
 642         } else {
 643                 ret = secrets_delete(key);
 644         }
 645
 646  out:
 647
 648         SAFE_FREE(key);
 649         SAFE_FREE(princ_s);
 650         SAFE_FREE(unparsed_name);
 651
 652         if (context) {
 653                 krb5_free_context(context);
 654         }
 655
 656         return ret;
 657 }
 658
 659
 660 /************************************************************************
 661 ************************************************************************/
 662
 663 int kerberos_kinit_password(const char *principal,
 664                             const char *password,
 665                             int time_offset,
 666                             const char *cache_name)
 667 {
 668         return kerberos_kinit_password_ext(principal,
 669                                            password,
 670                                            time_offset,
 671                                            0,
 672                                            0,
 673                                            cache_name,
 674                                            False,
 675                                            False,
 676                                            0,
 677                                            NULL);
 678 }
 679
 680 /************************************************************************
 681 ************************************************************************/
 682
 683 static char *print_kdc_line(char *mem_ctx,
 684                         const char *prev_line,
 685                         const struct sockaddr_storage *pss)
 686 {
 687         char *kdc_str = NULL;
 688
 689         if (pss->ss_family == AF_INET) {
 690                 kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 691                                         prev_line,
 692                                         print_canonical_sockaddr(mem_ctx, pss));
 693         } else {
 694                 char addr[INET6_ADDRSTRLEN];
 695                 uint16_t port = get_sockaddr_port(pss);
 696
 697                 if (port != 0 && port != DEFAULT_KRB5_PORT) {
 698                         /* Currently for IPv6 we can't specify a non-default
 699                            krb5 port with an address, as this requires a ':'.
 700                            Resolve to a name. */
 701                         char hostname[MAX_DNS_NAME_LENGTH];
 702                         int ret = sys_getnameinfo((const struct sockaddr *)pss,
 703                                         sizeof(*pss),
 704                                         hostname, sizeof(hostname),
 705                                         NULL, 0,
 706                                         NI_NAMEREQD);
 707                         if (ret) {
 708                                 DEBUG(0,("print_kdc_line: can't resolve name "
 709                                         "for kdc with non-default port %s. "
 710                                         "Error %s\n.",
 711                                         print_canonical_sockaddr(mem_ctx, pss),
 712                                         gai_strerror(ret)));
 713                         }
 714                         /* Success, use host:port */
 715                         kdc_str = talloc_asprintf(mem_ctx,
 716                                         "%s\tkdc = %s:%u\n",
 717                                         prev_line,
 718                                         hostname,
 719                                         (unsigned int)port);
 720                 } else {
 721                         kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 722                                         prev_line,
 723                                         print_sockaddr(addr,
 724                                                 sizeof(addr),
 725                                                 pss));
 726                 }
 727         }
 728         return kdc_str;
 729 }
 730
 731 /************************************************************************
 732  Create a string list of available kdc's, possibly searching by sitename.
 733  Does DNS queries.
 734 ************************************************************************/
 735
 736 static char *get_kdc_ip_string(char *mem_ctx,
 737                 const char *realm,
 738                 const char *sitename,
 739                 struct sockaddr_storage *pss)
 740 {
 741         int i;
 742         struct ip_service *ip_srv_site = NULL;
 743         struct ip_service *ip_srv_nonsite = NULL;
 744         int count_site = 0;
 745         int count_nonsite;
 746         char *kdc_str = print_kdc_line(mem_ctx, "", pss);
 747
 748         if (kdc_str == NULL) {
 749                 return NULL;
 750         }
 751
 752         /* Get the KDC's only in this site. */
 753
 754         if (sitename) {
 755
 756                 get_kdc_list(realm, sitename, &ip_srv_site, &count_site);
 757
 758                 for (i = 0; i < count_site; i++) {
 759                         if (addr_equal(&ip_srv_site[i].ss, pss)) {
 760                                 continue;
 761                         }
 762                         /* Append to the string - inefficient
 763                          * but not done often. */
 764                         kdc_str = print_kdc_line(mem_ctx,
 765                                                 kdc_str,
 766                                                 &ip_srv_site[i].ss);
 767                         if (!kdc_str) {
 768                                 SAFE_FREE(ip_srv_site);
 769                                 return NULL;
 770                         }
 771                 }
 772         }
 773
 774         /* Get all KDC's. */
 775
 776         get_kdc_list(realm, NULL, &ip_srv_nonsite, &count_nonsite);
 777
 778         for (i = 0; i < count_nonsite; i++) {
 779                 int j;
 780
 781                 if (addr_equal(&ip_srv_nonsite[i].ss, pss)) {
 782                         continue;
 783                 }
 784
 785                 /* Ensure this isn't an IP already seen (YUK! this is n*n....) */
 786                 for (j = 0; j < count_site; j++) {
 787                         if (addr_equal(&ip_srv_nonsite[i].ss,
 788                                                 &ip_srv_site[j].ss)) {
 789                                 break;
 790                         }
 791                         /* As the lists are sorted we can break early if nonsite > site. */
 792                         if (ip_service_compare(&ip_srv_nonsite[i], &ip_srv_site[j]) > 0) {
 793                                 break;
 794                         }
 795                 }
 796                 if (j != i) {
 797                         continue;
 798                 }
 799
 800                 /* Append to the string - inefficient but not done often. */
 801                 kdc_str = print_kdc_line(mem_ctx,
 802                                 kdc_str,
 803                                 &ip_srv_nonsite[i].ss);
 804                 if (!kdc_str) {
 805                         SAFE_FREE(ip_srv_site);
 806                         SAFE_FREE(ip_srv_nonsite);
 807                         return NULL;
 808                 }
 809         }
 810
 811
 812         SAFE_FREE(ip_srv_site);
 813         SAFE_FREE(ip_srv_nonsite);
 814
 815         DEBUG(10,("get_kdc_ip_string: Returning %s\n",
 816                 kdc_str ));
 817
 818         return kdc_str;
 819 }
 820
 821 /************************************************************************
 822  Create  a specific krb5.conf file in the private directory pointing
 823  at a specific kdc for a realm. Keyed off domain name. Sets
 824  KRB5_CONFIG environment variable to point to this file. Must be
 825  run as root or will fail (which is a good thing :-).
 826 ************************************************************************/
 827
 828 bool create_local_private_krb5_conf_for_domain(const char *realm,
 829                                                 const char *domain,
 830                                                 const char *sitename,
 831                                                 struct sockaddr_storage *pss)
 832 {
 833         char *dname = talloc_asprintf(NULL, "%s/smb_krb5", lp_lockdir());
 834         char *tmpname = NULL;
 835         char *fname = NULL;
 836         char *file_contents = NULL;
 837         char *kdc_ip_string = NULL;
 838         size_t flen = 0;
 839         ssize_t ret;
 840         int fd;
 841         char *realm_upper = NULL;
 842
 843         if (!dname) {
 844                 return False;
 845         }
 846         if ((mkdir(dname, 0755)==-1) && (errno != EEXIST)) {
 847                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 848                         "failed to create directory %s. Error was %s\n",
 849                         dname, strerror(errno) ));
 850                 TALLOC_FREE(dname);
 851                 return False;
 852         }
 853
 854         tmpname = talloc_asprintf(dname, "%s/smb_tmp_krb5.XXXXXX", lp_lockdir());
 855         if (!tmpname) {
 856                 TALLOC_FREE(dname);
 857                 return False;
 858         }
 859
 860         fname = talloc_asprintf(dname, "%s/krb5.conf.%s", dname, domain);
 861         if (!fname) {
 862                 TALLOC_FREE(dname);
 863                 return False;
 864         }
 865
 866         DEBUG(10,("create_local_private_krb5_conf_for_domain: fname = %s, realm = %s, domain = %s\n",
 867                 fname, realm, domain ));
 868
 869         realm_upper = talloc_strdup(fname, realm);
 870         strupper_m(realm_upper);
 871
 872         kdc_ip_string = get_kdc_ip_string(dname, realm, sitename, pss);
 873         if (!kdc_ip_string) {
 874                 TALLOC_FREE(dname);
 875                 return False;
 876         }
 877
 878         file_contents = talloc_asprintf(fname,
 879                                         "[libdefaults]\n\tdefault_realm = %s\n"
 880                                         "default_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
 881                                         "default_tkt_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
 882                                         "preferred_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n\n"
 883                                         "[realms]\n\t%s = {\n"
 884                                         "\t%s\t}\n",
 885                                         realm_upper, realm_upper, kdc_ip_string);
 886
 887         if (!file_contents) {
 888                 TALLOC_FREE(dname);
 889                 return False;
 890         }
 891
 892         flen = strlen(file_contents);
 893
 894         fd = smb_mkstemp(tmpname);
 895         if (fd == -1) {
 896                 DEBUG(0,("create_local_private_krb5_conf_for_domain: smb_mkstemp failed,"
 897                         " for file %s. Errno %s\n",
 898                         tmpname, strerror(errno) ));
 899                 TALLOC_FREE(dname);
 900                 return false;
 901         }
 902
 903         if (fchmod(fd, 0644)==-1) {
 904                 DEBUG(0,("create_local_private_krb5_conf_for_domain: fchmod failed for %s."
 905                         " Errno %s\n",
 906                         tmpname, strerror(errno) ));
 907                 unlink(tmpname);
 908                 close(fd);
 909                 TALLOC_FREE(dname);
 910                 return False;
 911         }
 912
 913         ret = write(fd, file_contents, flen);
 914         if (flen != ret) {
 915                 DEBUG(0,("create_local_private_krb5_conf_for_domain: write failed,"
 916                         " returned %d (should be %u). Errno %s\n",
 917                         (int)ret, (unsigned int)flen, strerror(errno) ));
 918                 unlink(tmpname);
 919                 close(fd);
 920                 TALLOC_FREE(dname);
 921                 return False;
 922         }
 923         if (close(fd)==-1) {
 924                 DEBUG(0,("create_local_private_krb5_conf_for_domain: close failed."
 925                         " Errno %s\n", strerror(errno) ));
 926                 unlink(tmpname);
 927                 TALLOC_FREE(dname);
 928                 return False;
 929         }
 930
 931         if (rename(tmpname, fname) == -1) {
 932                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 933                         "of %s to %s failed. Errno %s\n",
 934                         tmpname, fname, strerror(errno) ));
 935                 unlink(tmpname);
 936                 TALLOC_FREE(dname);
 937                 return False;
 938         }
 939
 940         DEBUG(5,("create_local_private_krb5_conf_for_domain: wrote "
 941                 "file %s with realm %s KDC list = %s\n",
 942                 fname, realm_upper, kdc_ip_string));
 943
 944         /* Set the environment variable to this file. */
 945         setenv("KRB5_CONFIG", fname, 1);
 946
 947 #if defined(OVERWRITE_SYSTEM_KRB5_CONF)
 948
 949 #define SYSTEM_KRB5_CONF_PATH "/etc/krb5.conf"
 950         /* Insanity, sheer insanity..... */
 951
 952         if (strequal(realm, lp_realm())) {
 953                 char linkpath[PATH_MAX+1];
 954                 int lret;
 955
 956                 lret = readlink(SYSTEM_KRB5_CONF_PATH, linkpath, sizeof(linkpath)-1);
 957                 if (lret != -1) {
 958                         linkpath[lret] = '\0';
 959                 }
 960
 961                 if (lret != -1 || strcmp(linkpath, fname) == 0) {
 962                         /* Symlink already exists. */
 963                         TALLOC_FREE(dname);
 964                         return True;
 965                 }
 966
 967                 /* Try and replace with a symlink. */
 968                 if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 969                         const char *newpath = SYSTEM_KRB5_CONF_PATH ## ".saved";
 970                         if (errno != EEXIST) {
 971                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: symlink "
 972                                         "of %s to %s failed. Errno %s\n",
 973                                         fname, SYSTEM_KRB5_CONF_PATH, strerror(errno) ));
 974                                 TALLOC_FREE(dname);
 975                                 return True; /* Not a fatal error. */
 976                         }
 977
 978                         /* Yes, this is a race conditon... too bad. */
 979                         if (rename(SYSTEM_KRB5_CONF_PATH, newpath) == -1) {
 980                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 981                                         "of %s to %s failed. Errno %s\n",
 982                                         SYSTEM_KRB5_CONF_PATH, newpath,
 983                                         strerror(errno) ));
 984                                 TALLOC_FREE(dname);
 985                                 return True; /* Not a fatal error. */
 986                         }
 987
 988                         if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 989                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 990                                         "forced symlink of %s to /etc/krb5.conf failed. Errno %s\n",
 991                                         fname, strerror(errno) ));
 992                                 TALLOC_FREE(dname);
 993                                 return True; /* Not a fatal error. */
 994                         }
 995                 }
 996         }
 997 #endif
 998
 999         TALLOC_FREE(dname);
1000
1001         return True;
1002 }
1003 #endif