source3/libads/kerberos_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos keytab utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Luke Howard 2003
   7    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
   8    Copyright (C) Guenther Deschner 2003
   9    Copyright (C) Rakesh Patel 2004
  10    Copyright (C) Dan Perry 2004
  11    Copyright (C) Jeremy Allison 2004
  12    Copyright (C) Gerald Carter 2006
  13
  14    This program is free software; you can redistribute it and/or modify
  15    it under the terms of the GNU General Public License as published by
  16    the Free Software Foundation; either version 3 of the License, or
  17    (at your option) any later version.
  18
  19    This program is distributed in the hope that it will be useful,
  20    but WITHOUT ANY WARRANTY; without even the implied warranty of
  21    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22    GNU General Public License for more details.
  23
  24    You should have received a copy of the GNU General Public License
  25    along with this program; if not, write to the Free Software
  26    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  27 */
  28
  29 #include "includes.h"
  30
  31 #ifdef HAVE_KRB5
  32
  33 /**********************************************************************
  34 **********************************************************************/
  35
  36 static int smb_krb5_kt_add_entry( krb5_context context, krb5_keytab keytab,
  37                                   krb5_kvno kvno, const char *princ_s,
  38                                   krb5_enctype *enctypes, krb5_data password )
  39 {
  40         krb5_error_code ret = 0;
  41         krb5_kt_cursor cursor;
  42         krb5_keytab_entry kt_entry;
  43         krb5_principal princ = NULL;
  44         int i;
  45         char *ktprinc = NULL;
  46
  47         ZERO_STRUCT(kt_entry);
  48         ZERO_STRUCT(cursor);
  49
  50         ret = smb_krb5_parse_name(context, princ_s, &princ);
  51         if (ret) {
  52                 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret)));
  53                 goto out;
  54         }
  55
  56         /* Seek and delete old keytab entries */
  57         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
  58         if (ret != KRB5_KT_END && ret != ENOENT ) {
  59                 DEBUG(3,("smb_krb5_kt_add_entry: Will try to delete old keytab entries\n"));
  60                 while(!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
  61                         BOOL compare_name_ok = False;
  62
  63                         ret = smb_krb5_unparse_name(context, kt_entry.principal, &ktprinc);
  64                         if (ret) {
  65                                 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_unparse_name failed (%s)\n",
  66                                         error_message(ret)));
  67                                 goto out;
  68                         }
  69
  70                         /*---------------------------------------------------------------------------
  71                          * Save the entries with kvno - 1.   This is what microsoft does
  72                          * to allow people with existing sessions that have kvno - 1 to still
  73                          * work.   Otherwise, when the password for the machine changes, all
  74                          * kerberizied sessions will 'break' until either the client reboots or
  75                          * the client's session key expires and they get a new session ticket
  76                          * with the new kvno.
  77                          */
  78
  79 #ifdef HAVE_KRB5_KT_COMPARE
  80                         compare_name_ok = (krb5_kt_compare(context, &kt_entry, princ, 0, 0) == True);
  81 #else
  82                         compare_name_ok = (strcmp(ktprinc, princ_s) == 0);
  83 #endif
  84
  85                         if (!compare_name_ok) {
  86                                 DEBUG(10,("smb_krb5_kt_add_entry: ignoring keytab entry principal %s, kvno = %d\n",
  87                                         ktprinc, kt_entry.vno));
  88                         }
  89
  90                         SAFE_FREE(ktprinc);
  91
  92                         if (compare_name_ok) {
  93                                 if (kt_entry.vno == kvno - 1) {
  94                                         DEBUG(5,("smb_krb5_kt_add_entry: Saving previous (kvno %d) entry for principal: %s.\n",
  95                                                 kvno - 1, princ_s));
  96                                 } else {
  97
  98                                         DEBUG(5,("smb_krb5_kt_add_entry: Found old entry for principal: %s (kvno %d) - trying to remove it.\n",
  99                                                 princ_s, kt_entry.vno));
 100                                         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 101                                         ZERO_STRUCT(cursor);
 102                                         if (ret) {
 103                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_end_seq_get() failed (%s)\n",
 104                                                         error_message(ret)));
 105                                                 goto out;
 106                                         }
 107                                         ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
 108                                         if (ret) {
 109                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_remove_entry failed (%s)\n",
 110                                                         error_message(ret)));
 111                                                 goto out;
 112                                         }
 113
 114                                         DEBUG(5,("smb_krb5_kt_add_entry: removed old entry for principal: %s (kvno %d).\n",
 115                                                 princ_s, kt_entry.vno));
 116
 117                                         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 118                                         if (ret) {
 119                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_start_seq failed (%s)\n",
 120                                                         error_message(ret)));
 121                                                 goto out;
 122                                         }
 123                                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
 124                                         ZERO_STRUCT(kt_entry);
 125                                         if (ret) {
 126                                                 DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_remove_entry failed (%s)\n",
 127                                                         error_message(ret)));
 128                                                 goto out;
 129                                         }
 130                                         continue;
 131                                 }
 132                         }
 133
 134                         /* Not a match, just free this entry and continue. */
 135                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
 136                         ZERO_STRUCT(kt_entry);
 137                         if (ret) {
 138                                 DEBUG(1,("smb_krb5_kt_add_entry: smb_krb5_kt_free_entry failed (%s)\n", error_message(ret)));
 139                                 goto out;
 140                         }
 141                 }
 142
 143                 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 144                 ZERO_STRUCT(cursor);
 145                 if (ret) {
 146                         DEBUG(1,("smb_krb5_kt_add_entry: krb5_kt_end_seq_get failed (%s)\n",error_message(ret)));
 147                         goto out;
 148                 }
 149         }
 150
 151         /* Ensure we don't double free. */
 152         ZERO_STRUCT(kt_entry);
 153         ZERO_STRUCT(cursor);
 154
 155         /* If we get here, we have deleted all the old entries with kvno's not equal to the current kvno-1. */
 156
 157         /* Now add keytab entries for all encryption types */
 158         for (i = 0; enctypes[i]; i++) {
 159                 krb5_keyblock *keyp;
 160
 161 #if !defined(HAVE_KRB5_KEYTAB_ENTRY_KEY) && !defined(HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK)
 162 #error krb5_keytab_entry has no key or keyblock member
 163 #endif
 164 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEY               /* MIT */
 165                 keyp = &kt_entry.key;
 166 #endif
 167 #ifdef HAVE_KRB5_KEYTAB_ENTRY_KEYBLOCK          /* Heimdal */
 168                 keyp = &kt_entry.keyblock;
 169 #endif
 170                 if (create_kerberos_key_from_string(context, princ, &password, keyp, enctypes[i])) {
 171                         continue;
 172                 }
 173
 174                 kt_entry.principal = princ;
 175                 kt_entry.vno       = kvno;
 176
 177                 DEBUG(3,("smb_krb5_kt_add_entry: adding keytab entry for (%s) with encryption type (%d) and version (%d)\n",
 178                         princ_s, enctypes[i], kt_entry.vno));
 179                 ret = krb5_kt_add_entry(context, keytab, &kt_entry);
 180                 krb5_free_keyblock_contents(context, keyp);
 181                 ZERO_STRUCT(kt_entry);
 182                 if (ret) {
 183                         DEBUG(1,("smb_krb5_kt_add_entry: adding entry to keytab failed (%s)\n", error_message(ret)));
 184                         goto out;
 185                 }
 186         }
 187
 188
 189 out:
 190         {
 191                 krb5_keytab_entry zero_kt_entry;
 192                 ZERO_STRUCT(zero_kt_entry);
 193                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 194                         smb_krb5_kt_free_entry(context, &kt_entry);
 195                 }
 196         }
 197         if (princ) {
 198                 krb5_free_principal(context, princ);
 199         }
 200
 201         {
 202                 krb5_kt_cursor zero_csr;
 203                 ZERO_STRUCT(zero_csr);
 204                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 205                         krb5_kt_end_seq_get(context, keytab, &cursor);
 206                 }
 207         }
 208
 209         return (int)ret;
 210 }
 211
 212
 213 /**********************************************************************
 214  Adds a single service principal, i.e. 'host' to the system keytab
 215 ***********************************************************************/
 216
 217 int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
 218 {
 219         krb5_error_code ret = 0;
 220         krb5_context context = NULL;
 221         krb5_keytab keytab = NULL;
 222         krb5_data password;
 223         krb5_kvno kvno;
 224         krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
 225         char *princ_s = NULL, *short_princ_s = NULL;
 226         char *password_s = NULL;
 227         char *my_fqdn;
 228         TALLOC_CTX *ctx = NULL;
 229         char *machine_name;
 230
 231 #if defined(ENCTYPE_ARCFOUR_HMAC)
 232         enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
 233 #endif
 234
 235         initialize_krb5_error_table();
 236         ret = krb5_init_context(&context);
 237         if (ret) {
 238                 DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
 239                 return -1;
 240         }
 241
 242         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
 243         if (ret) {
 244                 DEBUG(1,("ads_keytab_add_entry: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 245                 goto out;
 246         }
 247
 248         /* retrieve the password */
 249         if (!secrets_init()) {
 250                 DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
 251                 ret = -1;
 252                 goto out;
 253         }
 254         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 255         if (!password_s) {
 256                 DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
 257                 ret = -1;
 258                 goto out;
 259         }
 260         password.data = password_s;
 261         password.length = strlen(password_s);
 262
 263         /* we need the dNSHostName value here */
 264
 265         if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) {
 266                 DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
 267                 ret = -1;
 268                 goto out;
 269         }
 270
 271         if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) {
 272                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
 273                 ret = -1;
 274                 goto out;
 275         }
 276
 277         if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) {
 278                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
 279                 ret = -1;
 280                 goto out;
 281         }
 282         /*strip the trailing '$' */
 283         machine_name[strlen(machine_name)-1] = '\0';
 284
 285         /* Construct our principal */
 286
 287         if (strchr_m(srvPrinc, '@')) {
 288                 /* It's a fully-named principal. */
 289                 asprintf(&princ_s, "%s", srvPrinc);
 290         } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
 291                 /* It's the machine account, as used by smbclient clients. */
 292                 asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm());
 293         } else {
 294                 /* It's a normal service principal.  Add the SPN now so that we
 295                  * can obtain credentials for it and double-check the salt value
 296                  * used to generate the service's keys. */
 297
 298                 asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm());
 299                 asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm());
 300
 301                 /* According to http://support.microsoft.com/kb/326985/en-us,
 302                    certain principal names are automatically mapped to the host/...
 303                    principal in the AD account.  So only create these in the
 304                    keytab, not in AD.  --jerry */
 305
 306                 if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) {
 307                         DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
 308
 309                         if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) {
 310                                 DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
 311                                 goto out;
 312                         }
 313                 }
 314         }
 315
 316         kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
 317         if (kvno == -1) {       /* -1 indicates failure, everything else is OK */
 318                 DEBUG(1,("ads_keytab_add_entry: ads_get_kvno failed to determine the system's kvno.\n"));
 319                 ret = -1;
 320                 goto out;
 321         }
 322
 323         /* add the fqdn principal to the keytab */
 324
 325         ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password );
 326         if ( ret ) {
 327                 DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
 328                 goto out;
 329         }
 330
 331         /* add the short principal name if we have one */
 332
 333         if ( short_princ_s ) {
 334                 ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password );
 335                 if ( ret ) {
 336                         DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
 337                         goto out;
 338                 }
 339         }
 340
 341 out:
 342         SAFE_FREE( princ_s );
 343         SAFE_FREE( short_princ_s );
 344         TALLOC_FREE( ctx );
 345
 346         if (keytab) {
 347                 krb5_kt_close(context, keytab);
 348         }
 349         if (context) {
 350                 krb5_free_context(context);
 351         }
 352         return (int)ret;
 353 }
 354
 355 /**********************************************************************
 356  Flushes all entries from the system keytab.
 357 ***********************************************************************/
 358
 359 int ads_keytab_flush(ADS_STRUCT *ads)
 360 {
 361         krb5_error_code ret = 0;
 362         krb5_context context = NULL;
 363         krb5_keytab keytab = NULL;
 364         krb5_kt_cursor cursor;
 365         krb5_keytab_entry kt_entry;
 366         krb5_kvno kvno;
 367
 368         ZERO_STRUCT(kt_entry);
 369         ZERO_STRUCT(cursor);
 370
 371         initialize_krb5_error_table();
 372         ret = krb5_init_context(&context);
 373         if (ret) {
 374                 DEBUG(1,("ads_keytab_flush: could not krb5_init_context: %s\n",error_message(ret)));
 375                 return ret;
 376         }
 377
 378         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
 379         if (ret) {
 380                 DEBUG(1,("ads_keytab_flush: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 381                 goto out;
 382         }
 383
 384         kvno = (krb5_kvno) ads_get_kvno(ads, global_myname());
 385         if (kvno == -1) {       /* -1 indicates a failure */
 386                 DEBUG(1,("ads_keytab_flush: Error determining the system's kvno.\n"));
 387                 goto out;
 388         }
 389
 390         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 391         if (ret != KRB5_KT_END && ret != ENOENT) {
 392                 while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
 393                         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 394                         ZERO_STRUCT(cursor);
 395                         if (ret) {
 396                                 DEBUG(1,("ads_keytab_flush: krb5_kt_end_seq_get() failed (%s)\n",error_message(ret)));
 397                                 goto out;
 398                         }
 399                         ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
 400                         if (ret) {
 401                                 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
 402                                 goto out;
 403                         }
 404                         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 405                         if (ret) {
 406                                 DEBUG(1,("ads_keytab_flush: krb5_kt_start_seq failed (%s)\n",error_message(ret)));
 407                                 goto out;
 408                         }
 409                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
 410                         ZERO_STRUCT(kt_entry);
 411                         if (ret) {
 412                                 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
 413                                 goto out;
 414                         }
 415                 }
 416         }
 417
 418         /* Ensure we don't double free. */
 419         ZERO_STRUCT(kt_entry);
 420         ZERO_STRUCT(cursor);
 421
 422         if (!ADS_ERR_OK(ads_clear_service_principal_names(ads, global_myname()))) {
 423                 DEBUG(1,("ads_keytab_flush: Error while clearing service principal listings in LDAP.\n"));
 424                 goto out;
 425         }
 426
 427 out:
 428
 429         {
 430                 krb5_keytab_entry zero_kt_entry;
 431                 ZERO_STRUCT(zero_kt_entry);
 432                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 433                         smb_krb5_kt_free_entry(context, &kt_entry);
 434                 }
 435         }
 436         {
 437                 krb5_kt_cursor zero_csr;
 438                 ZERO_STRUCT(zero_csr);
 439                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 440                         krb5_kt_end_seq_get(context, keytab, &cursor);
 441                 }
 442         }
 443         if (keytab) {
 444                 krb5_kt_close(context, keytab);
 445         }
 446         if (context) {
 447                 krb5_free_context(context);
 448         }
 449         return ret;
 450 }
 451
 452 /**********************************************************************
 453  Adds all the required service principals to the system keytab.
 454 ***********************************************************************/
 455
 456 int ads_keytab_create_default(ADS_STRUCT *ads)
 457 {
 458         krb5_error_code ret = 0;
 459         krb5_context context = NULL;
 460         krb5_keytab keytab = NULL;
 461         krb5_kt_cursor cursor;
 462         krb5_keytab_entry kt_entry;
 463         krb5_kvno kvno;
 464         int i, found = 0;
 465         char *sam_account_name, *upn;
 466         char **oldEntries = NULL, *princ_s[26];
 467         TALLOC_CTX *ctx = NULL;
 468         fstring machine_name;
 469
 470         memset(princ_s, '\0', sizeof(princ_s));
 471
 472         fstrcpy( machine_name, global_myname() );
 473
 474         /* these are the main ones we need */
 475
 476         if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) {
 477                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
 478                 return ret;
 479         }
 480
 481
 482 #if 0   /* don't create the CIFS/... keytab entries since no one except smbd
 483            really needs them and we will fall back to verifying against secrets.tdb */
 484
 485         if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) {
 486                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
 487                 return ret;
 488         }
 489 #endif
 490
 491         if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) {
 492                 DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
 493                 return -1;
 494         }
 495
 496         /* now add the userPrincipalName and sAMAccountName entries */
 497
 498         if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) {
 499                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
 500                 TALLOC_FREE( ctx );
 501                 return -1;
 502         }
 503
 504         /* upper case the sAMAccountName to make it easier for apps to
 505            know what case to use in the keytab file */
 506
 507         strupper_m( sam_account_name );
 508
 509         if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) {
 510                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
 511                         sam_account_name));
 512                 return ret;
 513         }
 514
 515         /* remember that not every machine account will have a upn */
 516
 517         upn = ads_get_upn( ads, ctx, machine_name);
 518         if ( upn ) {
 519                 if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) {
 520                         DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
 521                                 upn));
 522                         TALLOC_FREE( ctx );
 523                         return ret;
 524                 }
 525         }
 526
 527         TALLOC_FREE( ctx );
 528
 529         /* Now loop through the keytab and update any other existing entries... */
 530
 531         kvno = (krb5_kvno) ads_get_kvno(ads, machine_name);
 532         if (kvno == -1) {
 533                 DEBUG(1,("ads_keytab_create_default: ads_get_kvno failed to determine the system's kvno.\n"));
 534                 return -1;
 535         }
 536
 537         DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
 538                 "preserve and update.\n"));
 539
 540         ZERO_STRUCT(kt_entry);
 541         ZERO_STRUCT(cursor);
 542
 543         initialize_krb5_error_table();
 544         ret = krb5_init_context(&context);
 545         if (ret) {
 546                 DEBUG(1,("ads_keytab_create_default: could not krb5_init_context: %s\n",error_message(ret)));
 547                 return ret;
 548         }
 549
 550         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
 551         if (ret) {
 552                 DEBUG(1,("ads_keytab_create_default: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 553                 goto done;
 554         }
 555
 556         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 557         if (ret != KRB5_KT_END && ret != ENOENT ) {
 558                 while ((ret = krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) == 0) {
 559                         smb_krb5_kt_free_entry(context, &kt_entry);
 560                         ZERO_STRUCT(kt_entry);
 561                         found++;
 562                 }
 563         }
 564         krb5_kt_end_seq_get(context, keytab, &cursor);
 565         ZERO_STRUCT(cursor);
 566
 567         /*
 568          * Hmmm. There is no "rewind" function for the keytab. This means we have a race condition
 569          * where someone else could add entries after we've counted them. Re-open asap to minimise
 570          * the race. JRA.
 571          */
 572
 573         DEBUG(3, ("ads_keytab_create_default: Found %d entries in the keytab.\n", found));
 574         if (!found) {
 575                 goto done;
 576         }
 577         oldEntries = SMB_MALLOC_ARRAY(char *, found );
 578         if (!oldEntries) {
 579                 DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));
 580                 ret = -1;
 581                 goto done;
 582         }
 583         memset(oldEntries, '\0', found * sizeof(char *));
 584
 585         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 586         if (ret != KRB5_KT_END && ret != ENOENT ) {
 587                 while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
 588                         if (kt_entry.vno != kvno) {
 589                                 char *ktprinc = NULL;
 590                                 char *p;
 591
 592                                 /* This returns a malloc'ed string in ktprinc. */
 593                                 ret = smb_krb5_unparse_name(context, kt_entry.principal, &ktprinc);
 594                                 if (ret) {
 595                                         DEBUG(1,("smb_krb5_unparse_name failed (%s)\n", error_message(ret)));
 596                                         goto done;
 597                                 }
 598                                 /*
 599                                  * From looking at the krb5 source they don't seem to take locale
 600                                  * or mb strings into account. Maybe this is because they assume utf8 ?
 601                                  * In this case we may need to convert from utf8 to mb charset here ? JRA.
 602                                  */
 603                                 p = strchr_m(ktprinc, '@');
 604                                 if (p) {
 605                                         *p = '\0';
 606                                 }
 607
 608                                 p = strchr_m(ktprinc, '/');
 609                                 if (p) {
 610                                         *p = '\0';
 611                                 }
 612                                 for (i = 0; i < found; i++) {
 613                                         if (!oldEntries[i]) {
 614                                                 oldEntries[i] = ktprinc;
 615                                                 break;
 616                                         }
 617                                         if (!strcmp(oldEntries[i], ktprinc)) {
 618                                                 SAFE_FREE(ktprinc);
 619                                                 break;
 620                                         }
 621                                 }
 622                                 if (i == found) {
 623                                         SAFE_FREE(ktprinc);
 624                                 }
 625                         }
 626                         smb_krb5_kt_free_entry(context, &kt_entry);
 627                         ZERO_STRUCT(kt_entry);
 628                 }
 629                 ret = 0;
 630                 for (i = 0; oldEntries[i]; i++) {
 631                         ret |= ads_keytab_add_entry(ads, oldEntries[i]);
 632                         SAFE_FREE(oldEntries[i]);
 633                 }
 634                 krb5_kt_end_seq_get(context, keytab, &cursor);
 635         }
 636         ZERO_STRUCT(cursor);
 637
 638 done:
 639
 640         SAFE_FREE(oldEntries);
 641
 642         {
 643                 krb5_keytab_entry zero_kt_entry;
 644                 ZERO_STRUCT(zero_kt_entry);
 645                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 646                         smb_krb5_kt_free_entry(context, &kt_entry);
 647                 }
 648         }
 649         {
 650                 krb5_kt_cursor zero_csr;
 651                 ZERO_STRUCT(zero_csr);
 652                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 653                         krb5_kt_end_seq_get(context, keytab, &cursor);
 654                 }
 655         }
 656         if (keytab) {
 657                 krb5_kt_close(context, keytab);
 658         }
 659         if (context) {
 660                 krb5_free_context(context);
 661         }
 662         return ret;
 663 }
 664
 665 /**********************************************************************
 666  List system keytab.
 667 ***********************************************************************/
 668
 669 int ads_keytab_list(const char *keytab_name)
 670 {
 671         krb5_error_code ret = 0;
 672         krb5_context context = NULL;
 673         krb5_keytab keytab = NULL;
 674         krb5_kt_cursor cursor;
 675         krb5_keytab_entry kt_entry;
 676
 677         ZERO_STRUCT(kt_entry);
 678         ZERO_STRUCT(cursor);
 679
 680         initialize_krb5_error_table();
 681         ret = krb5_init_context(&context);
 682         if (ret) {
 683                 DEBUG(1,("ads_keytab_list: could not krb5_init_context: %s\n",error_message(ret)));
 684                 return ret;
 685         }
 686
 687         ret = smb_krb5_open_keytab(context, keytab_name, False, &keytab);
 688         if (ret) {
 689                 DEBUG(1,("ads_keytab_list: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 690                 goto out;
 691         }
 692
 693         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 694         if (ret) {
 695                 goto out;
 696         }
 697
 698         printf("Vno  Type        Principal\n");
 699
 700         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
 701
 702                 char *princ_s = NULL;
 703                 char *etype_s = NULL;
 704                 krb5_enctype enctype = 0;
 705
 706                 ret = smb_krb5_unparse_name(context, kt_entry.principal, &princ_s);
 707                 if (ret) {
 708                         goto out;
 709                 }
 710
 711                 enctype = smb_get_enctype_from_kt_entry(&kt_entry);
 712
 713                 ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
 714                 if (ret) {
 715                         SAFE_FREE(princ_s);
 716                         goto out;
 717                 }
 718
 719                 printf("%3d  %s\t\t %s\n", kt_entry.vno, etype_s, princ_s);
 720
 721                 SAFE_FREE(princ_s);
 722                 SAFE_FREE(etype_s);
 723
 724                 ret = smb_krb5_kt_free_entry(context, &kt_entry);
 725                 if (ret) {
 726                         goto out;
 727                 }
 728         }
 729
 730         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 731         if (ret) {
 732                 goto out;
 733         }
 734
 735         /* Ensure we don't double free. */
 736         ZERO_STRUCT(kt_entry);
 737         ZERO_STRUCT(cursor);
 738 out:
 739
 740         {
 741                 krb5_keytab_entry zero_kt_entry;
 742                 ZERO_STRUCT(zero_kt_entry);
 743                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 744                         smb_krb5_kt_free_entry(context, &kt_entry);
 745                 }
 746         }
 747         {
 748                 krb5_kt_cursor zero_csr;
 749                 ZERO_STRUCT(zero_csr);
 750                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 751                         krb5_kt_end_seq_get(context, keytab, &cursor);
 752                 }
 753         }
 754
 755         if (keytab) {
 756                 krb5_kt_close(context, keytab);
 757         }
 758         if (context) {
 759                 krb5_free_context(context);
 760         }
 761         return ret;
 762 }
 763
 764 #endif /* HAVE_KRB5 */