589d4c2525499e47847925740b4ad6cdcd440eb8
[samba.git] / source3 / libnet / libnet_keytab.c
1 /*
2    Unix SMB/CIFS implementation.
3    dump the remote SAM using rpc samsync operations
4
5    Copyright (C) Guenther Deschner 2008.
6    Copyright (C) Michael Adam 2008
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libnet/libnet.h"
24
25 #ifdef HAVE_KRB5
26
27 /****************************************************************
28 ****************************************************************/
29
30 static int keytab_close(struct libnet_keytab_context *ctx)
31 {
32         if (!ctx) {
33                 return 0;
34         }
35
36         if (ctx->keytab && ctx->context) {
37                 krb5_kt_close(ctx->context, ctx->keytab);
38         }
39
40         if (ctx->context) {
41                 krb5_free_context(ctx->context);
42         }
43
44         if (ctx->ads) {
45                 ads_destroy(&ctx->ads);
46         }
47
48         TALLOC_FREE(ctx);
49
50         return 0;
51 }
52
53 /****************************************************************
54 ****************************************************************/
55
56 krb5_error_code libnet_keytab_init(TALLOC_CTX *mem_ctx,
57                                    const char *keytab_name,
58                                    struct libnet_keytab_context **ctx)
59 {
60         krb5_error_code ret = 0;
61         krb5_context context = NULL;
62         krb5_keytab keytab = NULL;
63         const char *keytab_string = NULL;
64
65         struct libnet_keytab_context *r;
66
67         r = TALLOC_ZERO_P(mem_ctx, struct libnet_keytab_context);
68         if (!r) {
69                 return ENOMEM;
70         }
71
72         talloc_set_destructor(r, keytab_close);
73
74         initialize_krb5_error_table();
75         ret = krb5_init_context(&context);
76         if (ret) {
77                 DEBUG(1,("keytab_init: could not krb5_init_context: %s\n",
78                         error_message(ret)));
79                 return ret;
80         }
81
82         ret = smb_krb5_open_keytab(context, keytab_name, true, &keytab);
83         if (ret) {
84                 DEBUG(1,("keytab_init: smb_krb5_open_keytab failed (%s)\n",
85                         error_message(ret)));
86                 krb5_free_context(context);
87                 return ret;
88         }
89
90         ret = smb_krb5_keytab_name(mem_ctx, context, keytab, &keytab_string);
91         if (ret) {
92                 krb5_kt_close(context, keytab);
93                 krb5_free_context(context);
94                 return ret;
95         }
96
97         r->context = context;
98         r->keytab = keytab;
99         r->keytab_name = keytab_string;
100         r->clean_old_entries = false;
101
102         *ctx = r;
103
104         return 0;
105 }
106
107 /****************************************************************
108 ****************************************************************/
109
110 /**
111  * Remove all entries that have the given principal, kvno and enctype.
112  */
113 static krb5_error_code libnet_keytab_remove_entries(krb5_context context,
114                                                     krb5_keytab keytab,
115                                                     const char *principal,
116                                                     int kvno,
117                                                     const krb5_enctype enctype,
118                                                     bool ignore_kvno)
119 {
120         krb5_error_code ret;
121         krb5_kt_cursor cursor;
122         krb5_keytab_entry kt_entry;
123
124         ZERO_STRUCT(kt_entry);
125         ZERO_STRUCT(cursor);
126
127         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
128         if (ret) {
129                 return 0;
130         }
131
132         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0)
133         {
134                 krb5_keyblock *keyp;
135                 char *princ_s = NULL;
136
137                 if (kt_entry.vno != kvno && !ignore_kvno) {
138                         goto cont;
139                 }
140
141                 keyp = KRB5_KT_KEY(&kt_entry);
142
143                 if (KRB5_KEY_TYPE(keyp) != enctype) {
144                         goto cont;
145                 }
146
147                 ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal,
148                                             &princ_s);
149                 if (ret) {
150                         DEBUG(5, ("smb_krb5_unparse_name failed (%s)\n",
151                                   error_message(ret)));
152                         goto cont;
153                 }
154
155                 if (strcmp(principal, princ_s) != 0) {
156                         goto cont;
157                 }
158
159                 /* match found - remove */
160
161                 DEBUG(10, ("found entry for principal %s, kvno %d, "
162                            "enctype %d - trying to remove it\n",
163                            princ_s, kt_entry.vno, KRB5_KEY_TYPE(keyp)));
164
165                 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
166                 ZERO_STRUCT(cursor);
167                 if (ret) {
168                         DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
169                                   error_message(ret)));
170                         goto cont;
171                 }
172
173                 ret = krb5_kt_remove_entry(context, keytab,
174                                            &kt_entry);
175                 if (ret) {
176                         DEBUG(5, ("krb5_kt_remove_entry failed (%s)\n",
177                                   error_message(ret)));
178                         goto cont;
179                 }
180                 DEBUG(10, ("removed entry for principal %s, kvno %d, "
181                            "enctype %d\n", princ_s, kt_entry.vno,
182                            KRB5_KEY_TYPE(keyp)));
183
184                 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
185                 if (ret) {
186                         DEBUG(5, ("krb5_kt_start_seq_get failed (%s)\n",
187                                   error_message(ret)));
188                         goto cont;
189                 }
190
191 cont:
192                 smb_krb5_kt_free_entry(context, &kt_entry);
193                 TALLOC_FREE(princ_s);
194         }
195
196         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
197         if (ret) {
198                 DEBUG(5, ("krb5_kt_end_seq_get failed (%s)\n",
199                           error_message(ret)));
200         }
201
202         return ret;
203 }
204
205 static krb5_error_code libnet_keytab_add_entry(krb5_context context,
206                                                krb5_keytab keytab,
207                                                krb5_kvno kvno,
208                                                const char *princ_s,
209                                                krb5_enctype enctype,
210                                                krb5_data password)
211 {
212         krb5_keyblock *keyp;
213         krb5_keytab_entry kt_entry;
214         krb5_error_code ret;
215
216         /* remove duplicates first ... */
217         ret = libnet_keytab_remove_entries(context, keytab, princ_s, kvno,
218                                            enctype, false);
219         if (ret) {
220                 DEBUG(1, ("libnet_keytab_remove_entries failed: %s\n",
221                           error_message(ret)));
222         }
223
224         ZERO_STRUCT(kt_entry);
225
226         kt_entry.vno = kvno;
227
228         ret = smb_krb5_parse_name(context, princ_s, &kt_entry.principal);
229         if (ret) {
230                 DEBUG(1, ("smb_krb5_parse_name(%s) failed (%s)\n",
231                           princ_s, error_message(ret)));
232                 return ret;
233         }
234
235         keyp = KRB5_KT_KEY(&kt_entry);
236
237         if (create_kerberos_key_from_string(context, kt_entry.principal,
238                                             &password, keyp, enctype, true))
239         {
240                 ret = KRB5KRB_ERR_GENERIC;
241                 goto done;
242         }
243
244         ret = krb5_kt_add_entry(context, keytab, &kt_entry);
245         if (ret) {
246                 DEBUG(1, ("adding entry to keytab failed (%s)\n",
247                           error_message(ret)));
248         }
249
250 done:
251         krb5_free_keyblock_contents(context, keyp);
252         krb5_free_principal(context, kt_entry.principal);
253         ZERO_STRUCT(kt_entry);
254         smb_krb5_kt_free_entry(context, &kt_entry);
255
256         return ret;
257 }
258
259 krb5_error_code libnet_keytab_add(struct libnet_keytab_context *ctx)
260 {
261         krb5_error_code ret = 0;
262         uint32_t i;
263
264
265         if (ctx->clean_old_entries) {
266                 DEBUG(0, ("cleaning old entries...\n"));
267                 for (i=0; i < ctx->count; i++) {
268                         struct libnet_keytab_entry *entry = &ctx->entries[i];
269
270                         ret = libnet_keytab_remove_entries(ctx->context,
271                                                            ctx->keytab,
272                                                            entry->principal,
273                                                            0,
274                                                            entry->enctype,
275                                                            true);
276                         if (ret) {
277                                 DEBUG(1,("libnet_keytab_add: Failed to remove "
278                                          "old entries for %s (enctype %u): %s\n",
279                                          entry->principal, entry->enctype,
280                                          error_message(ret)));
281                                 return ret;
282                         }
283                 }
284         }
285
286         for (i=0; i<ctx->count; i++) {
287
288                 struct libnet_keytab_entry *entry = &ctx->entries[i];
289                 krb5_data password;
290
291                 ZERO_STRUCT(password);
292                 password.data = (char *)entry->password.data;
293                 password.length = entry->password.length;
294
295                 ret = libnet_keytab_add_entry(ctx->context,
296                                               ctx->keytab,
297                                               entry->kvno,
298                                               entry->principal,
299                                               entry->enctype,
300                                               password);
301                 if (ret) {
302                         DEBUG(1,("libnet_keytab_add: "
303                                 "Failed to add entry to keytab file\n"));
304                         return ret;
305                 }
306         }
307
308         return ret;
309 }
310
311 struct libnet_keytab_entry *libnet_keytab_search(struct libnet_keytab_context *ctx,
312                                                  const char *principal,
313                                                  int kvno,
314                                                  const krb5_enctype enctype,
315                                                  TALLOC_CTX *mem_ctx)
316 {
317         krb5_error_code ret = 0;
318         krb5_kt_cursor cursor;
319         krb5_keytab_entry kt_entry;
320         struct libnet_keytab_entry *entry = NULL;
321
322         ZERO_STRUCT(kt_entry);
323         ZERO_STRUCT(cursor);
324
325         ret = krb5_kt_start_seq_get(ctx->context, ctx->keytab, &cursor);
326         if (ret) {
327                 DEBUG(10, ("krb5_kt_start_seq_get failed: %s\n",
328                           error_message(ret)));
329                 return NULL;
330         }
331
332         while (krb5_kt_next_entry(ctx->context, ctx->keytab, &kt_entry, &cursor) == 0)
333         {
334                 krb5_keyblock *keyp;
335                 char *princ_s = NULL;
336
337                 entry = NULL;
338
339                 if (kt_entry.vno != kvno) {
340                         goto cont;
341                 }
342
343                 keyp = KRB5_KT_KEY(&kt_entry);
344
345                 if (KRB5_KEY_TYPE(keyp) != enctype) {
346                         goto cont;
347                 }
348
349                 entry = talloc_zero(mem_ctx, struct libnet_keytab_entry);
350                 if (!entry) {
351                         DEBUG(3, ("talloc failed\n"));
352                         goto fail;
353                 }
354
355                 ret = smb_krb5_unparse_name(entry, ctx->context, kt_entry.principal,
356                                             &princ_s);
357                 if (ret) {
358                         goto cont;
359                 }
360
361                 if (strcmp(principal, princ_s) != 0) {
362                         goto cont;
363                 }
364
365                 entry->principal = talloc_strdup(entry, princ_s);
366                 if (!entry->principal) {
367                         DEBUG(3, ("talloc_strdup_failed\n"));
368                         goto fail;
369                 }
370
371                 entry->name = talloc_move(entry, &princ_s);
372
373                 entry->password = data_blob_talloc(entry, KRB5_KEY_DATA(keyp),
374                                                    KRB5_KEY_LENGTH(keyp));
375                 if (!entry->password.data) {
376                         DEBUG(3, ("data_blob_talloc failed\n"));
377                         goto fail;
378                 }
379
380                 DEBUG(10, ("found entry\n"));
381
382                 smb_krb5_kt_free_entry(ctx->context, &kt_entry);
383                 break;
384
385 fail:
386                 smb_krb5_kt_free_entry(ctx->context, &kt_entry);
387                 TALLOC_FREE(entry);
388                 break;
389
390 cont:
391                 smb_krb5_kt_free_entry(ctx->context, &kt_entry);
392                 TALLOC_FREE(entry);
393                 continue;
394         }
395
396         krb5_kt_end_seq_get(ctx->context, ctx->keytab, &cursor);
397         return entry;
398 }
399
400 /**
401  * Helper function to add data to the list
402  * of keytab entries. It builds the prefix from the input.
403  */
404 NTSTATUS libnet_keytab_add_to_keytab_entries(TALLOC_CTX *mem_ctx,
405                                              struct libnet_keytab_context *ctx,
406                                              uint32_t kvno,
407                                              const char *name,
408                                              const char *prefix,
409                                              const krb5_enctype enctype,
410                                              DATA_BLOB blob)
411 {
412         struct libnet_keytab_entry entry;
413
414         entry.kvno = kvno;
415         entry.name = talloc_strdup(mem_ctx, name);
416         entry.principal = talloc_asprintf(mem_ctx, "%s%s%s@%s",
417                                           prefix ? prefix : "",
418                                           prefix ? "/" : "",
419                                           name, ctx->dns_domain_name);
420         entry.enctype = enctype;
421         entry.password = blob;
422         NT_STATUS_HAVE_NO_MEMORY(entry.name);
423         NT_STATUS_HAVE_NO_MEMORY(entry.principal);
424         NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
425
426         ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
427                      &ctx->entries, &ctx->count);
428         NT_STATUS_HAVE_NO_MEMORY(ctx->entries);
429
430         return NT_STATUS_OK;
431 }
432
433 #endif /* HAVE_KRB5 */