r23651: Always, always, always compile before commit...
[ira/wip.git] / source3 / libads / kerberos_keytab.c
1 /*
2    Unix SMB/CIFS implementation.
3    kerberos keytab utility library
4    Copyright (C) Andrew Tridgell 2001
5    Copyright (C) Remus Koos 2001
6    Copyright (C) Luke Howard 2003
7    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
8    Copyright (C) Guenther Deschner 2003
9    Copyright (C) Rakesh Patel 2004
10    Copyright (C) Dan Perry 2004
11    Copyright (C) Jeremy Allison 2004
12    Copyright (C) Gerald Carter 2006
13
14    This program is free software; you can redistribute it and/or modify
15    it under the terms of the GNU General Public License as published by
16    the Free Software Foundation; either version 2 of the License, or
17    (at your option) any later version.
18
19    This program is distributed in the hope that it will be useful,
20    but WITHOUT ANY WARRANTY; without even the implied warranty of
21    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22    GNU General Public License for more details.
23
24    You should have received a copy of the GNU General Public License
25    along with this program; if not, write to the Free Software
26    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 */
28
29 #include "includes.h"
30
31 #ifdef HAVE_KRB5
32
33 /**********************************************************************
34 **********************************************************************/
35
36 static int smb_krb5_kt_add_entry( krb5_context context, krb5_keytab keytab,
37                                   krb5_kvno kvno, const char *princ_s, 
38                                   krb5_enctype *enctypes, krb5_data password )
39 {
40         krb5_error_code ret = 0;
41         krb5_kt_cursor cursor;
42         krb5_keytab_entry kt_entry;
43         krb5_principal princ = NULL;
44         int i;
45         char *ktprinc = NULL;
46
47         ZERO_STRUCT(kt_entry);
48         ZERO_STRUCT(cursor);
49         
50         ret = smb_krb5_parse_name(context, princ_s, &princ);
51         if (ret) {
52                 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret)));
53                 goto out;
54         }
55
56         /* Seek and delete old keytab entries */
57         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
58         if (ret != KRB5_KT_END && ret != ENOENT ) {
59                 DEBUG(3,("smb_krb5_kt_add_entry: Will try to delete old keytab entries\n"));
60                 while(!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
61                         BOOL compare_name_ok = False;
62
63                         ret = smb_krb5_unparse_name(context, kt_entry.principal, &ktprinc);
64                         if (ret) {
65                                 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_unparse_name failed (%s)\n",
66                                         error_message(ret)));
67                                 goto out;
68                         }
69
70                         /*---------------------------------------------------------------------------
71                          * Save the entries with kvno - 1.   This is what microsoft does
72                          * to allow people with existing sessions that have kvno - 1 to still
73                          * work.   Otherwise, when the password for the machine changes, all
74                          * kerberizied sessions will 'break' until either the client reboots or
75                          * the client's session key expires and they get a new session ticket
76                          * with the new kvno.
77                          */
78
79 #ifdef HAVE_KRB5_KT_COMPARE
80                         compare_name_ok = (krb5_kt_compare(context, &kt_entry, princ, 0, 0) == True);
81 #else
82                         compare_name_ok = (strcmp(ktprinc, princ_s) == 0);
83 #endif
84
85                         if (!compare_name_ok) {
86                                 DEBUG(10,("smb_krb5_kt_add_entry: ignoring keytab entry principal %s, kvno = %d\n",
87                                         ktprinc, kt_entry.vno));
88                         }
89
90                         SAFE_FREE(ktprinc);
91
92                         if (compare_name_ok) {
93                                 if (kt_entry.vno == kvno - 1) {
94                                         DEBUG(5,("smb_krb5_kt_add_entry: Saving previous (kvno %d) entry for principal: %s.\n",
95                                                 kvno - 1, princ_s));
96                                 } else {
97
98                                         DEBUG(5,("smb_krb5_kt_add_entry: Found old entry for principal: %s (kvno %d) - trying to remove it.\n",
99                                                 princ_s, kt_entry.vno));
100                                         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
101                                         ZERO_STRUCT(cursor);
102                                         if (ret) {
103                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_end_seq_get() failed (%s)\n",
104                                                         error_message(ret)));
105                                                 goto out;
106                                         }
107                                         ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
108                                         if (ret) {
109                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_remove_entry failed (%s)\n",
110                                                         error_message(ret)));
111                                                 goto out;
112                                         }
113
114                                         DEBUG(5,("smb_krb5_kt_add_entry: removed old entry for principal: %s (kvno %d).\n",
115                                                 princ_s, kt_entry.vno));
116
117                                         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
118                                         if (ret) {
119                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_start_seq failed (%s)\n",
120                                                         error_message(ret)));
121                                                 goto out;
122                                         }
123                                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
124                                         ZERO_STRUCT(kt_entry);
125                                         if (ret) {
126                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_remove_entry failed (%s)\n",
127                                                         error_message(ret)));
128                                                 goto out;
129                                         }
130                                         continue;
131                                 }
132                         }
133
134                         /* Not a match, just free this entry and continue. */
135                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
136                         ZERO_STRUCT(kt_entry);
137                         if (ret) {
138                                 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_kt_free_entry failed (%s)\n", error_message(ret)));
139                                 goto out;
140                         }
141                 }
142
143                 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
144                 ZERO_STRUCT(cursor);
145                 if (ret) {
146                         DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_end_seq_get failed (%s)\n",error_message(ret)));
147                         goto out;
148                 }
149         }
150
151         /* Ensure we don't double free. */
152         ZERO_STRUCT(kt_entry);
153         ZERO_STRUCT(cursor);
154
155         /* If we get here, we have deleted all the old entries with kvno's not equal to the current kvno-1. */
156
157         /* Now add keytab entries for all encryption types */
158         for (i = 0; enctypes[i]; i++) {
159                 krb5_keyblock *keyp;
160
161 #if !defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) && !defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)
162 #error krb5_keytab_entry has no key or keyblock member
163 #endif
164 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
165                 keyp = &kt_entry.key;
166 #endif
167 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK          /* Heimdal */
168                 keyp = &kt_entry.keyblock;
169 #endif
170                 if (create_kerberos_key_from_string(context, princ, &password, keyp, enctypes[i])) {
171                         continue;
172                 }
173
174                 kt_entry.principal = princ;
175                 kt_entry.vno       = kvno;
176
177                 DEBUG(3,("smb_krb5_kt_add_entry: adding keytab entry for (%s) with encryption type (%d) and version (%d)\n",
178                         princ_s, enctypes[i], kt_entry.vno));
179                 ret = krb5_kt_add_entry(context, keytab, &kt_entry);
180                 krb5_free_keyblock_contents(context, keyp);
181                 ZERO_STRUCT(kt_entry);
182                 if (ret) {
183                         DEBUG(1,("smb_krb5_kt_add_entry: adding entry to keytab failed (%s)\n", error_message(ret)));
184                         goto out;
185                 }
186         }
187
188
189 out:
190         {
191                 krb5_keytab_entry zero_kt_entry;
192                 ZERO_STRUCT(zero_kt_entry);
193                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
194                         smb_krb5_kt_free_entry(context, &kt_entry);
195                 }
196         }
197         if (princ) {
198                 krb5_free_principal(context, princ);
199         }
200         
201         {
202                 krb5_kt_cursor zero_csr;
203                 ZERO_STRUCT(zero_csr);
204                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
205                         krb5_kt_end_seq_get(context, keytab, &cursor);  
206                 }
207         }
208         
209         return (int)ret;
210 }
211
212
213 /**********************************************************************
214  Adds a single service principal, i.e. 'host' to the system keytab
215 ***********************************************************************/
216
217 int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
218 {
219         krb5_error_code ret = 0;
220         krb5_context context = NULL;
221         krb5_keytab keytab = NULL;
222         krb5_data password;
223         krb5_kvno kvno;
224         krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
225         char *princ_s = NULL, *short_princ_s = NULL;
226         char *password_s = NULL;
227         char *my_fqdn;
228         TALLOC_CTX *ctx = NULL;
229         char *machine_name;
230
231 #if defined(ENCTYPE_ARCFOUR_HMAC)
232         enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
233 #endif
234
235         initialize_krb5_error_table();
236         ret = krb5_init_context(&context);
237         if (ret) {
238                 DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
239                 return -1;
240         }
241
242         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
243         if (ret) {
244                 DEBUG(1,("ads_keytab_add_entry: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
245                 goto out;
246         }
247
248         /* retrieve the password */
249         if (!secrets_init()) {
250                 DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
251                 ret = -1;
252                 goto out;
253         }
254         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
255         if (!password_s) {
256                 DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
257                 ret = -1;
258                 goto out;
259         }
260         password.data = password_s;
261         password.length = strlen(password_s);
262
263         /* we need the dNSHostName value here */
264         
265         if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) {
266                 DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
267                 ret = -1;
268                 goto out;
269         }
270         
271         if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) {
272                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
273                 ret = -1;
274                 goto out;       
275         }
276         
277         if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) {
278                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
279                 ret = -1;
280                 goto out;       
281         }
282         /*strip the trailing '$' */
283         machine_name[strlen(machine_name)-1] = '\0';
284                 
285         /* Construct our principal */
286
287         if (strchr_m(srvPrinc, '@')) {
288                 /* It's a fully-named principal. */
289                 asprintf(&princ_s, "%s", srvPrinc);
290         } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
291                 /* It's the machine account, as used by smbclient clients. */
292                 asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm());
293         } else {
294                 /* It's a normal service principal.  Add the SPN now so that we
295                  * can obtain credentials for it and double-check the salt value
296                  * used to generate the service's keys. */
297                  
298                 asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm());
299                 asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm());
300                 
301                 /* According to http://support.microsoft.com/kb/326985/en-us, 
302                    certain principal names are automatically mapped to the host/...
303                    principal in the AD account.  So only create these in the 
304                    keytab, not in AD.  --jerry */
305                    
306                 if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) {
307                         DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
308                         
309                         if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) {
310                                 DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
311                                 goto out;
312                         }
313                 }
314         }
315
316         kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
317         if (kvno == -1) {       /* -1 indicates failure, everything else is OK */
318                 DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n"));
319                 ret = -1;
320                 goto out;
321         }
322         
323         /* add the fqdn principal to the keytab */
324         
325         ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password );
326         if ( ret ) {
327                 DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
328                 goto out;
329         }
330         
331         /* add the short principal name if we have one */
332         
333         if ( short_princ_s ) {
334                 ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password );
335                 if ( ret ) {
336                         DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
337                         goto out;
338                 }
339         }
340
341 out:
342         SAFE_FREE( princ_s );
343         SAFE_FREE( short_princ_s );
344         TALLOC_FREE( ctx );
345         
346         if (keytab) {
347                 krb5_kt_close(context, keytab);
348         }
349         if (context) {
350                 krb5_free_context(context);
351         }
352         return (int)ret;
353 }
354
355 /**********************************************************************
356  Flushes all entries from the system keytab.
357 ***********************************************************************/
358
359 int ads_keytab_flush(ADS_STRUCT *ads)
360 {
361         krb5_error_code ret = 0;
362         krb5_context context = NULL;
363         krb5_keytab keytab = NULL;
364         krb5_kt_cursor cursor;
365         krb5_keytab_entry kt_entry;
366         krb5_kvno kvno;
367
368         ZERO_STRUCT(kt_entry);
369         ZERO_STRUCT(cursor);
370
371         initialize_krb5_error_table();
372         ret = krb5_init_context(&context);
373         if (ret) {
374                 DEBUG(1,("ads_keytab_flush: could not krb5_init_context: %s\n",error_message(ret)));
375                 return ret;
376         }
377
378         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
379         if (ret) {
380                 DEBUG(1,("ads_keytab_flush: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
381                 goto out;
382         }
383
384         kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
385         if (kvno == -1) {       /* -1 indicates a failure */
386                 DEBUG(1,("ads_keytab_flush: Error determining the system's kvno.\n"));
387                 goto out;
388         }
389
390         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
391         if (ret != KRB5_KT_END && ret != ENOENT) {
392                 while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
393                         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
394                         ZERO_STRUCT(cursor);
395                         if (ret) {
396                                 DEBUG(1,("ads_keytab_flush: krb5_kt_end_seq_get() failed (%s)\n",error_message(ret)));
397                                 goto out;
398                         }
399                         ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
400                         if (ret) {
401                                 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
402                                 goto out;
403                         }
404                         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
405                         if (ret) {
406                                 DEBUG(1,("ads_keytab_flush: krb5_kt_start_seq failed (%s)\n",error_message(ret)));
407                                 goto out;
408                         }
409                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
410                         ZERO_STRUCT(kt_entry);
411                         if (ret) {
412                                 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
413                                 goto out;
414                         }
415                 }
416         }
417
418         /* Ensure we don't double free. */
419         ZERO_STRUCT(kt_entry);
420         ZERO_STRUCT(cursor);
421
422         if (!ADS_ERR_OK(ads_clear_service_principal_names(ads, global_myname()))) {
423                 DEBUG(1,("ads_keytab_flush: Error while clearing service principal listings in LDAP.\n"));
424                 goto out;
425         }
426
427 out:
428
429         {
430                 krb5_keytab_entry zero_kt_entry;
431                 ZERO_STRUCT(zero_kt_entry);
432                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
433                         smb_krb5_kt_free_entry(context, &kt_entry);
434                 }
435         }
436         {
437                 krb5_kt_cursor zero_csr;
438                 ZERO_STRUCT(zero_csr);
439                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
440                         krb5_kt_end_seq_get(context, keytab, &cursor);  
441                 }
442         }
443         if (keytab) {
444                 krb5_kt_close(context, keytab);
445         }
446         if (context) {
447                 krb5_free_context(context);
448         }
449         return ret;
450 }
451
452 /**********************************************************************
453  Adds all the required service principals to the system keytab.
454 ***********************************************************************/
455
456 int ads_keytab_create_default(ADS_STRUCT *ads)
457 {
458         krb5_error_code ret = 0;
459         krb5_context context = NULL;
460         krb5_keytab keytab = NULL;
461         krb5_kt_cursor cursor;
462         krb5_keytab_entry kt_entry;
463         krb5_kvno kvno;
464         int i, found = 0;
465         char *sam_account_name, *upn;
466         char **oldEntries = NULL, *princ_s[26];
467         TALLOC_CTX *ctx = NULL;
468         fstring machine_name;
469
470         memset(princ_s, '\0', sizeof(princ_s));
471
472         fstrcpy( machine_name, global_myname() );
473
474         /* these are the main ones we need */
475         
476         if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) {
477                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
478                 return ret;
479         }
480
481
482 #if 0   /* don't create the CIFS/... keytab entries since no one except smbd 
483            really needs them and we will fall back to verifying against secrets.tdb */
484            
485         if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) {
486                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
487                 return ret;
488         }
489 #endif
490
491         if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) {
492                 DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
493                 return -1;
494         }
495
496         /* now add the userPrincipalName and sAMAccountName entries */
497
498         if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) {
499                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
500                 TALLOC_FREE( ctx );
501                 return -1;      
502         }
503
504         /* upper case the sAMAccountName to make it easier for apps to 
505            know what case to use in the keytab file */
506
507         strupper_m( sam_account_name ); 
508
509         if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) {
510                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
511                         sam_account_name));
512                 return ret;
513         }
514         
515         /* remember that not every machine account will have a upn */
516                 
517         upn = ads_get_upn( ads, ctx, machine_name);
518         if ( upn ) {
519                 if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) {
520                         DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
521                                 upn));
522                         TALLOC_FREE( ctx );
523                         return ret;
524                 }
525         }
526
527         TALLOC_FREE( ctx );
528
529         /* Now loop through the keytab and update any other existing entries... */
530         
531         kvno = (krb5_kvno) ads_get_kvno(ads, machine_name);
532         if (kvno == -1) {
533                 DEBUG(1,("ads_keytab_create_default: ads_get_kvno failed to determine the system's kvno.\n"));
534                 return -1;
535         }
536         
537         DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
538                 "preserve and update.\n"));
539
540         ZERO_STRUCT(kt_entry);
541         ZERO_STRUCT(cursor);
542
543         initialize_krb5_error_table();
544         ret = krb5_init_context(&context);
545         if (ret) {
546                 DEBUG(1,("ads_keytab_create_default: could not krb5_init_context: %s\n",error_message(ret)));
547                 return ret;
548         }
549
550         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
551         if (ret) {
552                 DEBUG(1,("ads_keytab_create_default: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
553                 goto done;
554         }
555
556         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
557         if (ret != KRB5_KT_END && ret != ENOENT ) {
558                 while ((ret = krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) == 0) {
559                         smb_krb5_kt_free_entry(context, &kt_entry);
560                         ZERO_STRUCT(kt_entry);
561                         found++;
562                 }
563         }
564         krb5_kt_end_seq_get(context, keytab, &cursor);
565         ZERO_STRUCT(cursor);
566
567         /*
568          * Hmmm. There is no "rewind" function for the keytab. This means we have a race condition
569          * where someone else could add entries after we've counted them. Re-open asap to minimise
570          * the race. JRA.
571          */
572         
573         DEBUG(3, ("ads_keytab_create_default: Found %d entries in the keytab.\n", found));
574         if (!found) {
575                 goto done;
576         }
577         oldEntries = SMB_MALLOC_ARRAY(char *, found );
578         if (!oldEntries) {
579                 DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));
580                 ret = -1;
581                 goto done;
582         }
583         memset(oldEntries, '\0', found * sizeof(char *));
584
585         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
586         if (ret != KRB5_KT_END && ret != ENOENT ) {
587                 while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
588                         if (kt_entry.vno != kvno) {
589                                 char *ktprinc = NULL;
590                                 char *p;
591
592                                 /* This returns a malloc'ed string in ktprinc. */
593                                 ret = smb_krb5_unparse_name(context, kt_entry.principal, &ktprinc);
594                                 if (ret) {
595                                         DEBUG(1,("smb_krb5_unparse_name failed (%s)\n", error_message(ret)));
596                                         goto done;
597                                 }
598                                 /*
599                                  * From looking at the krb5 source they don't seem to take locale
600                                  * or mb strings into account. Maybe this is because they assume utf8 ?
601                                  * In this case we may need to convert from utf8 to mb charset here ? JRA.
602                                  */
603                                 p = strchr_m(ktprinc, '@');
604                                 if (p) {
605                                         *p = '\0';
606                                 }
607
608                                 p = strchr_m(ktprinc, '/');
609                                 if (p) {
610                                         *p = '\0';
611                                 }
612                                 for (i = 0; i < found; i++) {
613                                         if (!oldEntries[i]) {
614                                                 oldEntries[i] = ktprinc;
615                                                 break;
616                                         }
617                                         if (!strcmp(oldEntries[i], ktprinc)) {
618                                                 SAFE_FREE(ktprinc);
619                                                 break;
620                                         }
621                                 }
622                                 if (i == found) {
623                                         SAFE_FREE(ktprinc);
624                                 }
625                         }
626                         smb_krb5_kt_free_entry(context, &kt_entry);
627                         ZERO_STRUCT(kt_entry);
628                 }
629                 ret = 0;
630                 for (i = 0; oldEntries[i]; i++) {
631                         ret |= ads_keytab_add_entry(ads, oldEntries[i]);
632                         SAFE_FREE(oldEntries[i]);
633                 }
634                 krb5_kt_end_seq_get(context, keytab, &cursor);
635         }
636         ZERO_STRUCT(cursor);
637
638 done:
639
640         SAFE_FREE(oldEntries);
641
642         {
643                 krb5_keytab_entry zero_kt_entry;
644                 ZERO_STRUCT(zero_kt_entry);
645                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
646                         smb_krb5_kt_free_entry(context, &kt_entry);
647                 }
648         }
649         {
650                 krb5_kt_cursor zero_csr;
651                 ZERO_STRUCT(zero_csr);
652                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
653                         krb5_kt_end_seq_get(context, keytab, &cursor);  
654                 }
655         }
656         if (keytab) {
657                 krb5_kt_close(context, keytab);
658         }
659         if (context) {
660                 krb5_free_context(context);
661         }
662         return ret;
663 }
664
665 /**********************************************************************
666  List system keytab.
667 ***********************************************************************/
668
669 int ads_keytab_list(const char *keytab_name)
670 {
671         krb5_error_code ret = 0;
672         krb5_context context = NULL;
673         krb5_keytab keytab = NULL;
674         krb5_kt_cursor cursor;
675         krb5_keytab_entry kt_entry;
676
677         ZERO_STRUCT(kt_entry);
678         ZERO_STRUCT(cursor);
679
680         initialize_krb5_error_table();
681         ret = krb5_init_context(&context);
682         if (ret) {
683                 DEBUG(1,("ads_keytab_list: could not krb5_init_context: %s\n",error_message(ret)));
684                 return ret;
685         }
686
687         ret = smb_krb5_open_keytab(context, keytab_name, False, &keytab);
688         if (ret) {
689                 DEBUG(1,("ads_keytab_list: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
690                 goto out;
691         }
692
693         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
694         if (ret) {
695                 goto out;
696         }
697
698         printf("Vno  Type        Principal\n");
699
700         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
701         
702                 char *princ_s = NULL;
703                 char *etype_s = NULL;
704                 krb5_enctype enctype = 0;
705
706                 ret = smb_krb5_unparse_name(context, kt_entry.principal, &princ_s);
707                 if (ret) {
708                         goto out;
709                 }
710
711                 enctype = smb_get_enctype_from_kt_entry(&kt_entry);
712
713                 ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
714                 if (ret) {
715                         SAFE_FREE(princ_s);
716                         goto out;
717                 }
718
719                 printf("%3d  %s\t\t %s\n", kt_entry.vno, etype_s, princ_s);
720
721                 SAFE_FREE(princ_s);
722                 SAFE_FREE(etype_s);
723
724                 ret = smb_krb5_kt_free_entry(context, &kt_entry);
725                 if (ret) {
726                         goto out;
727                 }
728         }
729
730         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
731         if (ret) {
732                 goto out;
733         }
734
735         /* Ensure we don't double free. */
736         ZERO_STRUCT(kt_entry);
737         ZERO_STRUCT(cursor);
738 out:
739
740         {
741                 krb5_keytab_entry zero_kt_entry;
742                 ZERO_STRUCT(zero_kt_entry);
743                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
744                         smb_krb5_kt_free_entry(context, &kt_entry);
745                 }
746         }
747         {
748                 krb5_kt_cursor zero_csr;
749                 ZERO_STRUCT(zero_csr);
750                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
751                         krb5_kt_end_seq_get(context, keytab, &cursor);  
752                 }
753         }
754
755         if (keytab) {
756                 krb5_kt_close(context, keytab);
757         }
758         if (context) {
759                 krb5_free_context(context);
760         }
761         return ret;
762 }
763
764 #endif /* HAVE_KRB5 */