source3/libads/kerberos.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Nalin Dahyabhai <nalin@redhat.com> 2004.
   7    Copyright (C) Jeremy Allison 2004.
   8    Copyright (C) Gerald Carter 2006.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25
  26 #ifdef HAVE_KRB5
  27
  28 #define DEFAULT_KRB5_PORT 88
  29
  30 #define LIBADS_CCACHE_NAME "MEMORY:libads"
  31
  32 /*
  33   we use a prompter to avoid a crash bug in the kerberos libs when
  34   dealing with empty passwords
  35   this prompter is just a string copy ...
  36 */
  37 static krb5_error_code
  38 kerb_prompter(krb5_context ctx, void *data,
  39                const char *name,
  40                const char *banner,
  41                int num_prompts,
  42                krb5_prompt prompts[])
  43 {
  44         if (num_prompts == 0) return 0;
  45
  46         memset(prompts[0].reply->data, '\0', prompts[0].reply->length);
  47         if (prompts[0].reply->length > 0) {
  48                 if (data) {
  49                         strncpy(prompts[0].reply->data, (const char *)data,
  50                                 prompts[0].reply->length-1);
  51                         prompts[0].reply->length = strlen(prompts[0].reply->data);
  52                 } else {
  53                         prompts[0].reply->length = 0;
  54                 }
  55         }
  56         return 0;
  57 }
  58
  59 static bool smb_krb5_err_io_nstatus(TALLOC_CTX *mem_ctx,
  60                                     DATA_BLOB *edata_blob,
  61                                     KRB5_EDATA_NTSTATUS *edata)
  62 {
  63         bool ret = False;
  64         prs_struct ps;
  65
  66         if (!mem_ctx || !edata_blob || !edata)
  67                 return False;
  68
  69         if (!prs_init(&ps, edata_blob->length, mem_ctx, UNMARSHALL))
  70                 return False;
  71
  72         if (!prs_copy_data_in(&ps, (char *)edata_blob->data, edata_blob->length))
  73                 goto out;
  74
  75         prs_set_offset(&ps, 0);
  76
  77         if (!prs_ntstatus("ntstatus", &ps, 1, &edata->ntstatus))
  78                 goto out;
  79
  80         if (!prs_uint32("unknown1", &ps, 1, &edata->unknown1))
  81                 goto out;
  82
  83         if (!prs_uint32("unknown2", &ps, 1, &edata->unknown2)) /* only seen 00000001 here */
  84                 goto out;
  85
  86         ret = True;
  87  out:
  88         prs_mem_free(&ps);
  89
  90         return ret;
  91 }
  92
  93  static bool smb_krb5_get_ntstatus_from_krb5_error(krb5_error *error,
  94                                                    NTSTATUS *nt_status)
  95 {
  96         DATA_BLOB edata;
  97         DATA_BLOB unwrapped_edata;
  98         TALLOC_CTX *mem_ctx;
  99         KRB5_EDATA_NTSTATUS parsed_edata;
 100
 101 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 102         edata = data_blob(error->e_data->data, error->e_data->length);
 103 #else
 104         edata = data_blob(error->e_data.data, error->e_data.length);
 105 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 106
 107 #ifdef DEVELOPER
 108         dump_data(10, edata.data, edata.length);
 109 #endif /* DEVELOPER */
 110
 111         mem_ctx = talloc_init("smb_krb5_get_ntstatus_from_krb5_error");
 112         if (mem_ctx == NULL) {
 113                 data_blob_free(&edata);
 114                 return False;
 115         }
 116
 117         if (!unwrap_edata_ntstatus(mem_ctx, &edata, &unwrapped_edata)) {
 118                 data_blob_free(&edata);
 119                 TALLOC_FREE(mem_ctx);
 120                 return False;
 121         }
 122
 123         data_blob_free(&edata);
 124
 125         if (!smb_krb5_err_io_nstatus(mem_ctx, &unwrapped_edata, &parsed_edata)) {
 126                 data_blob_free(&unwrapped_edata);
 127                 TALLOC_FREE(mem_ctx);
 128                 return False;
 129         }
 130
 131         data_blob_free(&unwrapped_edata);
 132
 133         if (nt_status) {
 134                 *nt_status = parsed_edata.ntstatus;
 135         }
 136
 137         TALLOC_FREE(mem_ctx);
 138
 139         return True;
 140 }
 141
 142  static bool smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(krb5_context ctx,
 143                                                                   krb5_get_init_creds_opt *opt,
 144                                                                   NTSTATUS *nt_status)
 145 {
 146         bool ret = False;
 147         krb5_error *error = NULL;
 148
 149 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR
 150         ret = krb5_get_init_creds_opt_get_error(ctx, opt, &error);
 151         if (ret) {
 152                 DEBUG(1,("krb5_get_init_creds_opt_get_error gave: %s\n",
 153                         error_message(ret)));
 154                 return False;
 155         }
 156 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR */
 157
 158         if (!error) {
 159                 DEBUG(1,("no krb5_error\n"));
 160                 return False;
 161         }
 162
 163 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 164         if (!error->e_data) {
 165 #else
 166         if (error->e_data.data == NULL) {
 167 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 168                 DEBUG(1,("no edata in krb5_error\n"));
 169                 krb5_free_error(ctx, error);
 170                 return False;
 171         }
 172
 173         ret = smb_krb5_get_ntstatus_from_krb5_error(error, nt_status);
 174
 175         krb5_free_error(ctx, error);
 176
 177         return ret;
 178 }
 179
 180 /*
 181   simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL
 182   place in default cache location.
 183   remus@snapserver.com
 184 */
 185 int kerberos_kinit_password_ext(const char *principal,
 186                                 const char *password,
 187                                 int time_offset,
 188                                 time_t *expire_time,
 189                                 time_t *renew_till_time,
 190                                 const char *cache_name,
 191                                 bool request_pac,
 192                                 bool add_netbios_addr,
 193                                 time_t renewable_time,
 194                                 NTSTATUS *ntstatus)
 195 {
 196         krb5_context ctx = NULL;
 197         krb5_error_code code = 0;
 198         krb5_ccache cc = NULL;
 199         krb5_principal me = NULL;
 200         krb5_creds my_creds;
 201         krb5_get_init_creds_opt *opt = NULL;
 202         smb_krb5_addresses *addr = NULL;
 203
 204         ZERO_STRUCT(my_creds);
 205
 206         initialize_krb5_error_table();
 207         if ((code = krb5_init_context(&ctx)))
 208                 goto out;
 209
 210         if (time_offset != 0) {
 211                 krb5_set_real_time(ctx, time(NULL) + time_offset, 0);
 212         }
 213
 214         DEBUG(10,("kerberos_kinit_password: as %s using [%s] as ccache and config [%s]\n",
 215                         principal,
 216                         cache_name ? cache_name: krb5_cc_default_name(ctx),
 217                         getenv("KRB5_CONFIG")));
 218
 219         if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
 220                 goto out;
 221         }
 222
 223         if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
 224                 goto out;
 225         }
 226
 227         if ((code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt))) {
 228                 goto out;
 229         }
 230
 231         krb5_get_init_creds_opt_set_renew_life(opt, renewable_time);
 232         krb5_get_init_creds_opt_set_forwardable(opt, True);
 233 #if 0
 234         /* insane testing */
 235         krb5_get_init_creds_opt_set_tkt_life(opt, 60);
 236 #endif
 237
 238 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST
 239         if (request_pac) {
 240                 if ((code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac))) {
 241                         goto out;
 242                 }
 243         }
 244 #endif
 245         if (add_netbios_addr) {
 246                 if ((code = smb_krb5_gen_netbios_krb5_address(&addr))) {
 247                         goto out;
 248                 }
 249                 krb5_get_init_creds_opt_set_address_list(opt, addr->addrs);
 250         }
 251
 252         if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password),
 253                                                  kerb_prompter, CONST_DISCARD(char *,password),
 254                                                  0, NULL, opt))) {
 255                 goto out;
 256         }
 257
 258         if ((code = krb5_cc_initialize(ctx, cc, me))) {
 259                 goto out;
 260         }
 261
 262         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
 263                 goto out;
 264         }
 265
 266         if (expire_time) {
 267                 *expire_time = (time_t) my_creds.times.endtime;
 268         }
 269
 270         if (renew_till_time) {
 271                 *renew_till_time = (time_t) my_creds.times.renew_till;
 272         }
 273  out:
 274         if (ntstatus) {
 275
 276                 NTSTATUS status;
 277
 278                 /* fast path */
 279                 if (code == 0) {
 280                         *ntstatus = NT_STATUS_OK;
 281                         goto cleanup;
 282                 }
 283
 284                 /* try to get ntstatus code out of krb5_error when we have it
 285                  * inside the krb5_get_init_creds_opt - gd */
 286
 287                 if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) {
 288                         *ntstatus = status;
 289                         goto cleanup;
 290                 }
 291
 292                 /* fall back to self-made-mapping */
 293                 *ntstatus = krb5_to_nt_status(code);
 294         }
 295
 296  cleanup:
 297         krb5_free_cred_contents(ctx, &my_creds);
 298         if (me) {
 299                 krb5_free_principal(ctx, me);
 300         }
 301         if (addr) {
 302                 smb_krb5_free_addresses(ctx, addr);
 303         }
 304         if (opt) {
 305                 smb_krb5_get_init_creds_opt_free(ctx, opt);
 306         }
 307         if (cc) {
 308                 krb5_cc_close(ctx, cc);
 309         }
 310         if (ctx) {
 311                 krb5_free_context(ctx);
 312         }
 313         return code;
 314 }
 315
 316
 317
 318 /* run kinit to setup our ccache */
 319 int ads_kinit_password(ADS_STRUCT *ads)
 320 {
 321         char *s;
 322         int ret;
 323         const char *account_name;
 324         fstring acct_name;
 325
 326         if ( IS_DC ) {
 327                 /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
 328                 account_name = lp_workgroup();
 329         } else {
 330                 /* always use the sAMAccountName for security = domain */
 331                 /* global_myname()$@REA.LM */
 332                 if ( lp_security() == SEC_DOMAIN ) {
 333                         fstr_sprintf( acct_name, "%s$", global_myname() );
 334                         account_name = acct_name;
 335                 }
 336                 else
 337                         /* This looks like host/global_myname()@REA.LM */
 338                         account_name = ads->auth.user_name;
 339         }
 340
 341         if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
 342                 return KRB5_CC_NOMEM;
 343         }
 344
 345         if (!ads->auth.password) {
 346                 SAFE_FREE(s);
 347                 return KRB5_LIBOS_CANTREADPWD;
 348         }
 349
 350         ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
 351                         &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable,
 352                         NULL);
 353
 354         if (ret) {
 355                 DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
 356                          s, error_message(ret)));
 357         }
 358         SAFE_FREE(s);
 359         return ret;
 360 }
 361
 362 int ads_kdestroy(const char *cc_name)
 363 {
 364         krb5_error_code code;
 365         krb5_context ctx = NULL;
 366         krb5_ccache cc = NULL;
 367
 368         initialize_krb5_error_table();
 369         if ((code = krb5_init_context (&ctx))) {
 370                 DEBUG(3, ("ads_kdestroy: kdb5_init_context failed: %s\n",
 371                         error_message(code)));
 372                 return code;
 373         }
 374
 375         if (!cc_name) {
 376                 if ((code = krb5_cc_default(ctx, &cc))) {
 377                         krb5_free_context(ctx);
 378                         return code;
 379                 }
 380         } else {
 381                 if ((code = krb5_cc_resolve(ctx, cc_name, &cc))) {
 382                         DEBUG(3, ("ads_kdestroy: krb5_cc_resolve failed: %s\n",
 383                                   error_message(code)));
 384                         krb5_free_context(ctx);
 385                         return code;
 386                 }
 387         }
 388
 389         if ((code = krb5_cc_destroy (ctx, cc))) {
 390                 DEBUG(3, ("ads_kdestroy: krb5_cc_destroy failed: %s\n",
 391                         error_message(code)));
 392         }
 393
 394         krb5_free_context (ctx);
 395         return code;
 396 }
 397
 398 /************************************************************************
 399  Routine to fetch the salting principal for a service.  Active
 400  Directory may use a non-obvious principal name to generate the salt
 401  when it determines the key to use for encrypting tickets for a service,
 402  and hopefully we detected that when we joined the domain.
 403  ************************************************************************/
 404
 405 static char *kerberos_secrets_fetch_salting_principal(const char *service, int enctype)
 406 {
 407         char *key = NULL;
 408         char *ret = NULL;
 409
 410         if (asprintf(&key, "%s/%s/enctype=%d",
 411                      SECRETS_SALTING_PRINCIPAL, service, enctype) == -1) {
 412                 return NULL;
 413         }
 414         ret = (char *)secrets_fetch(key, NULL);
 415         SAFE_FREE(key);
 416         return ret;
 417 }
 418
 419 /************************************************************************
 420  Return the standard DES salt key
 421 ************************************************************************/
 422
 423 char* kerberos_standard_des_salt( void )
 424 {
 425         fstring salt;
 426
 427         fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
 428         strlower_m( salt );
 429         fstrcat( salt, lp_realm() );
 430
 431         return SMB_STRDUP( salt );
 432 }
 433
 434 /************************************************************************
 435 ************************************************************************/
 436
 437 static char* des_salt_key( void )
 438 {
 439         char *key;
 440
 441         if (asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL,
 442                      lp_realm()) == -1) {
 443                 return NULL;
 444         }
 445
 446         return key;
 447 }
 448
 449 /************************************************************************
 450 ************************************************************************/
 451
 452 bool kerberos_secrets_store_des_salt( const char* salt )
 453 {
 454         char* key;
 455         bool ret;
 456
 457         if ( (key = des_salt_key()) == NULL ) {
 458                 DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
 459                 return False;
 460         }
 461
 462         if ( !salt ) {
 463                 DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
 464                 secrets_delete( key );
 465                 return True;
 466         }
 467
 468         DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
 469
 470         ret = secrets_store( key, salt, strlen(salt)+1 );
 471
 472         SAFE_FREE( key );
 473
 474         return ret;
 475 }
 476
 477 /************************************************************************
 478 ************************************************************************/
 479
 480 char* kerberos_secrets_fetch_des_salt( void )
 481 {
 482         char *salt, *key;
 483
 484         if ( (key = des_salt_key()) == NULL ) {
 485                 DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
 486                 return False;
 487         }
 488
 489         salt = (char*)secrets_fetch( key, NULL );
 490
 491         SAFE_FREE( key );
 492
 493         return salt;
 494 }
 495
 496 /************************************************************************
 497  Routine to get the default realm from the kerberos credentials cache.
 498  Caller must free if the return value is not NULL.
 499 ************************************************************************/
 500
 501 char *kerberos_get_default_realm_from_ccache( void )
 502 {
 503         char *realm = NULL;
 504         krb5_context ctx = NULL;
 505         krb5_ccache cc = NULL;
 506         krb5_principal princ = NULL;
 507
 508         initialize_krb5_error_table();
 509         if (krb5_init_context(&ctx)) {
 510                 return NULL;
 511         }
 512
 513         DEBUG(5,("kerberos_get_default_realm_from_ccache: "
 514                 "Trying to read krb5 cache: %s\n",
 515                 krb5_cc_default_name(ctx)));
 516         if (krb5_cc_default(ctx, &cc)) {
 517                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
 518                         "failed to read default cache\n"));
 519                 goto out;
 520         }
 521         if (krb5_cc_get_principal(ctx, cc, &princ)) {
 522                 DEBUG(0,("kerberos_get_default_realm_from_ccache: "
 523                         "failed to get default principal\n"));
 524                 goto out;
 525         }
 526
 527 #if defined(HAVE_KRB5_PRINCIPAL_GET_REALM)
 528         realm = SMB_STRDUP(krb5_principal_get_realm(ctx, princ));
 529 #elif defined(HAVE_KRB5_PRINC_REALM)
 530         {
 531                 krb5_data *realm_data = krb5_princ_realm(ctx, princ);
 532                 realm = SMB_STRNDUP(realm_data->data, realm_data->length);
 533         }
 534 #endif
 535
 536   out:
 537
 538         if (princ) {
 539                 krb5_free_principal(ctx, princ);
 540         }
 541         if (cc) {
 542                 krb5_cc_close(ctx, cc);
 543         }
 544         if (ctx) {
 545                 krb5_free_context(ctx);
 546         }
 547
 548         return realm;
 549 }
 550
 551
 552 /************************************************************************
 553  Routine to get the salting principal for this service.  This is
 554  maintained for backwards compatibilty with releases prior to 3.0.24.
 555  Since we store the salting principal string only at join, we may have
 556  to look for the older tdb keys.  Caller must free if return is not null.
 557  ************************************************************************/
 558
 559 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 560                                                         krb5_principal host_princ,
 561                                                         int enctype)
 562 {
 563         char *unparsed_name = NULL, *salt_princ_s = NULL;
 564         krb5_principal ret_princ = NULL;
 565
 566         /* lookup new key first */
 567
 568         if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
 569
 570                 /* look under the old key.  If this fails, just use the standard key */
 571
 572                 if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
 573                         return (krb5_principal)NULL;
 574                 }
 575                 if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
 576                         /* fall back to host/machine.realm@REALM */
 577                         salt_princ_s = kerberos_standard_des_salt();
 578                 }
 579         }
 580
 581         if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
 582                 ret_princ = NULL;
 583         }
 584
 585         SAFE_FREE(unparsed_name);
 586         SAFE_FREE(salt_princ_s);
 587
 588         return ret_princ;
 589 }
 590
 591 /************************************************************************
 592  Routine to set the salting principal for this service.  Active
 593  Directory may use a non-obvious principal name to generate the salt
 594  when it determines the key to use for encrypting tickets for a service,
 595  and hopefully we detected that when we joined the domain.
 596  Setting principal to NULL deletes this entry.
 597  ************************************************************************/
 598
 599 bool kerberos_secrets_store_salting_principal(const char *service,
 600                                               int enctype,
 601                                               const char *principal)
 602 {
 603         char *key = NULL;
 604         bool ret = False;
 605         krb5_context context = NULL;
 606         krb5_principal princ = NULL;
 607         char *princ_s = NULL;
 608         char *unparsed_name = NULL;
 609
 610         krb5_init_context(&context);
 611         if (!context) {
 612                 return False;
 613         }
 614         if (strchr_m(service, '@')) {
 615                 if (asprintf(&princ_s, "%s", service) == -1) {
 616                         goto out;
 617                 }
 618         } else {
 619                 if (asprintf(&princ_s, "%s@%s", service, lp_realm()) == -1) {
 620                         goto out;
 621                 }
 622         }
 623
 624         if (smb_krb5_parse_name(context, princ_s, &princ) != 0) {
 625                 goto out;
 626
 627         }
 628         if (smb_krb5_unparse_name(context, princ, &unparsed_name) != 0) {
 629                 goto out;
 630         }
 631
 632         if (asprintf(&key, "%s/%s/enctype=%d",
 633                      SECRETS_SALTING_PRINCIPAL, unparsed_name, enctype)
 634             == -1) {
 635                 goto out;
 636         }
 637
 638         if ((principal != NULL) && (strlen(principal) > 0)) {
 639                 ret = secrets_store(key, principal, strlen(principal) + 1);
 640         } else {
 641                 ret = secrets_delete(key);
 642         }
 643
 644  out:
 645
 646         SAFE_FREE(key);
 647         SAFE_FREE(princ_s);
 648         SAFE_FREE(unparsed_name);
 649
 650         if (context) {
 651                 krb5_free_context(context);
 652         }
 653
 654         return ret;
 655 }
 656
 657
 658 /************************************************************************
 659 ************************************************************************/
 660
 661 int kerberos_kinit_password(const char *principal,
 662                             const char *password,
 663                             int time_offset,
 664                             const char *cache_name)
 665 {
 666         return kerberos_kinit_password_ext(principal,
 667                                            password,
 668                                            time_offset,
 669                                            0,
 670                                            0,
 671                                            cache_name,
 672                                            False,
 673                                            False,
 674                                            0,
 675                                            NULL);
 676 }
 677
 678 /************************************************************************
 679 ************************************************************************/
 680
 681 static char *print_kdc_line(char *mem_ctx,
 682                         const char *prev_line,
 683                         const struct sockaddr_storage *pss)
 684 {
 685         char *kdc_str = NULL;
 686
 687         if (pss->ss_family == AF_INET) {
 688                 kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 689                                         prev_line,
 690                                         print_canonical_sockaddr(mem_ctx, pss));
 691         } else {
 692                 char addr[INET6_ADDRSTRLEN];
 693                 uint16_t port = get_sockaddr_port(pss);
 694
 695                 if (port != 0 && port != DEFAULT_KRB5_PORT) {
 696                         /* Currently for IPv6 we can't specify a non-default
 697                            krb5 port with an address, as this requires a ':'.
 698                            Resolve to a name. */
 699                         char hostname[MAX_DNS_NAME_LENGTH];
 700                         int ret = sys_getnameinfo((const struct sockaddr *)pss,
 701                                         sizeof(*pss),
 702                                         hostname, sizeof(hostname),
 703                                         NULL, 0,
 704                                         NI_NAMEREQD);
 705                         if (ret) {
 706                                 DEBUG(0,("print_kdc_line: can't resolve name "
 707                                         "for kdc with non-default port %s. "
 708                                         "Error %s\n.",
 709                                         print_canonical_sockaddr(mem_ctx, pss),
 710                                         gai_strerror(ret)));
 711                         }
 712                         /* Success, use host:port */
 713                         kdc_str = talloc_asprintf(mem_ctx,
 714                                         "%s\tkdc = %s:%u\n",
 715                                         prev_line,
 716                                         hostname,
 717                                         (unsigned int)port);
 718                 } else {
 719                         kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 720                                         prev_line,
 721                                         print_sockaddr(addr,
 722                                                 sizeof(addr),
 723                                                 pss));
 724                 }
 725         }
 726         return kdc_str;
 727 }
 728
 729 /************************************************************************
 730  Create a string list of available kdc's, possibly searching by sitename.
 731  Does DNS queries.
 732 ************************************************************************/
 733
 734 static char *get_kdc_ip_string(char *mem_ctx,
 735                 const char *realm,
 736                 const char *sitename,
 737                 struct sockaddr_storage *pss)
 738 {
 739         int i;
 740         struct ip_service *ip_srv_site = NULL;
 741         struct ip_service *ip_srv_nonsite = NULL;
 742         int count_site = 0;
 743         int count_nonsite;
 744         char *kdc_str = print_kdc_line(mem_ctx, "", pss);
 745
 746         if (kdc_str == NULL) {
 747                 return NULL;
 748         }
 749
 750         /* Get the KDC's only in this site. */
 751
 752         if (sitename) {
 753
 754                 get_kdc_list(realm, sitename, &ip_srv_site, &count_site);
 755
 756                 for (i = 0; i < count_site; i++) {
 757                         if (addr_equal(&ip_srv_site[i].ss, pss)) {
 758                                 continue;
 759                         }
 760                         /* Append to the string - inefficient
 761                          * but not done often. */
 762                         kdc_str = print_kdc_line(mem_ctx,
 763                                                 kdc_str,
 764                                                 &ip_srv_site[i].ss);
 765                         if (!kdc_str) {
 766                                 SAFE_FREE(ip_srv_site);
 767                                 return NULL;
 768                         }
 769                 }
 770         }
 771
 772         /* Get all KDC's. */
 773
 774         get_kdc_list(realm, NULL, &ip_srv_nonsite, &count_nonsite);
 775
 776         for (i = 0; i < count_nonsite; i++) {
 777                 int j;
 778
 779                 if (addr_equal(&ip_srv_nonsite[i].ss, pss)) {
 780                         continue;
 781                 }
 782
 783                 /* Ensure this isn't an IP already seen (YUK! this is n*n....) */
 784                 for (j = 0; j < count_site; j++) {
 785                         if (addr_equal(&ip_srv_nonsite[i].ss,
 786                                                 &ip_srv_site[j].ss)) {
 787                                 break;
 788                         }
 789                         /* As the lists are sorted we can break early if nonsite > site. */
 790                         if (ip_service_compare(&ip_srv_nonsite[i], &ip_srv_site[j]) > 0) {
 791                                 break;
 792                         }
 793                 }
 794                 if (j != i) {
 795                         continue;
 796                 }
 797
 798                 /* Append to the string - inefficient but not done often. */
 799                 kdc_str = print_kdc_line(mem_ctx,
 800                                 kdc_str,
 801                                 &ip_srv_nonsite[i].ss);
 802                 if (!kdc_str) {
 803                         SAFE_FREE(ip_srv_site);
 804                         SAFE_FREE(ip_srv_nonsite);
 805                         return NULL;
 806                 }
 807         }
 808
 809
 810         SAFE_FREE(ip_srv_site);
 811         SAFE_FREE(ip_srv_nonsite);
 812
 813         DEBUG(10,("get_kdc_ip_string: Returning %s\n",
 814                 kdc_str ));
 815
 816         return kdc_str;
 817 }
 818
 819 /************************************************************************
 820  Create  a specific krb5.conf file in the private directory pointing
 821  at a specific kdc for a realm. Keyed off domain name. Sets
 822  KRB5_CONFIG environment variable to point to this file. Must be
 823  run as root or will fail (which is a good thing :-).
 824 ************************************************************************/
 825
 826 bool create_local_private_krb5_conf_for_domain(const char *realm,
 827                                                 const char *domain,
 828                                                 const char *sitename,
 829                                                 struct sockaddr_storage *pss)
 830 {
 831         char *dname = talloc_asprintf(NULL, "%s/smb_krb5", lp_lockdir());
 832         char *tmpname = NULL;
 833         char *fname = NULL;
 834         char *file_contents = NULL;
 835         char *kdc_ip_string = NULL;
 836         size_t flen = 0;
 837         ssize_t ret;
 838         int fd;
 839         char *realm_upper = NULL;
 840
 841         if (!dname) {
 842                 return False;
 843         }
 844         if ((mkdir(dname, 0755)==-1) && (errno != EEXIST)) {
 845                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 846                         "failed to create directory %s. Error was %s\n",
 847                         dname, strerror(errno) ));
 848                 TALLOC_FREE(dname);
 849                 return False;
 850         }
 851
 852         tmpname = talloc_asprintf(dname, "%s/smb_tmp_krb5.XXXXXX", lp_lockdir());
 853         if (!tmpname) {
 854                 TALLOC_FREE(dname);
 855                 return False;
 856         }
 857
 858         fname = talloc_asprintf(dname, "%s/krb5.conf.%s", dname, domain);
 859         if (!fname) {
 860                 TALLOC_FREE(dname);
 861                 return False;
 862         }
 863
 864         DEBUG(10,("create_local_private_krb5_conf_for_domain: fname = %s, realm = %s, domain = %s\n",
 865                 fname, realm, domain ));
 866
 867         realm_upper = talloc_strdup(fname, realm);
 868         strupper_m(realm_upper);
 869
 870         kdc_ip_string = get_kdc_ip_string(dname, realm, sitename, pss);
 871         if (!kdc_ip_string) {
 872                 TALLOC_FREE(dname);
 873                 return False;
 874         }
 875
 876         file_contents = talloc_asprintf(fname,
 877                                         "[libdefaults]\n\tdefault_realm = %s\n"
 878                                         "default_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
 879                                         "default_tkt_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
 880                                         "preferred_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n\n"
 881                                         "[realms]\n\t%s = {\n"
 882                                         "\t%s\t}\n",
 883                                         realm_upper, realm_upper, kdc_ip_string);
 884
 885         if (!file_contents) {
 886                 TALLOC_FREE(dname);
 887                 return False;
 888         }
 889
 890         flen = strlen(file_contents);
 891
 892         fd = smb_mkstemp(tmpname);
 893         if (fd == -1) {
 894                 DEBUG(0,("create_local_private_krb5_conf_for_domain: smb_mkstemp failed,"
 895                         " for file %s. Errno %s\n",
 896                         tmpname, strerror(errno) ));
 897         }
 898
 899         if (fchmod(fd, 0644)==-1) {
 900                 DEBUG(0,("create_local_private_krb5_conf_for_domain: fchmod failed for %s."
 901                         " Errno %s\n",
 902                         tmpname, strerror(errno) ));
 903                 unlink(tmpname);
 904                 close(fd);
 905                 TALLOC_FREE(dname);
 906                 return False;
 907         }
 908
 909         ret = write(fd, file_contents, flen);
 910         if (flen != ret) {
 911                 DEBUG(0,("create_local_private_krb5_conf_for_domain: write failed,"
 912                         " returned %d (should be %u). Errno %s\n",
 913                         (int)ret, (unsigned int)flen, strerror(errno) ));
 914                 unlink(tmpname);
 915                 close(fd);
 916                 TALLOC_FREE(dname);
 917                 return False;
 918         }
 919         if (close(fd)==-1) {
 920                 DEBUG(0,("create_local_private_krb5_conf_for_domain: close failed."
 921                         " Errno %s\n", strerror(errno) ));
 922                 unlink(tmpname);
 923                 TALLOC_FREE(dname);
 924                 return False;
 925         }
 926
 927         if (rename(tmpname, fname) == -1) {
 928                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 929                         "of %s to %s failed. Errno %s\n",
 930                         tmpname, fname, strerror(errno) ));
 931                 unlink(tmpname);
 932                 TALLOC_FREE(dname);
 933                 return False;
 934         }
 935
 936         DEBUG(5,("create_local_private_krb5_conf_for_domain: wrote "
 937                 "file %s with realm %s KDC list = %s\n",
 938                 fname, realm_upper, kdc_ip_string));
 939
 940         /* Set the environment variable to this file. */
 941         setenv("KRB5_CONFIG", fname, 1);
 942
 943 #if defined(OVERWRITE_SYSTEM_KRB5_CONF)
 944
 945 #define SYSTEM_KRB5_CONF_PATH "/etc/krb5.conf"
 946         /* Insanity, sheer insanity..... */
 947
 948         if (strequal(realm, lp_realm())) {
 949                 char linkpath[PATH_MAX+1];
 950                 int lret;
 951
 952                 lret = readlink(SYSTEM_KRB5_CONF_PATH, linkpath, sizeof(linkpath)-1);
 953                 if (lret != -1) {
 954                         linkpath[lret] = '\0';
 955                 }
 956
 957                 if (lret != -1 || strcmp(linkpath, fname) == 0) {
 958                         /* Symlink already exists. */
 959                         TALLOC_FREE(dname);
 960                         return True;
 961                 }
 962
 963                 /* Try and replace with a symlink. */
 964                 if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 965                         const char *newpath = SYSTEM_KRB5_CONF_PATH ## ".saved";
 966                         if (errno != EEXIST) {
 967                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: symlink "
 968                                         "of %s to %s failed. Errno %s\n",
 969                                         fname, SYSTEM_KRB5_CONF_PATH, strerror(errno) ));
 970                                 TALLOC_FREE(dname);
 971                                 return True; /* Not a fatal error. */
 972                         }
 973
 974                         /* Yes, this is a race conditon... too bad. */
 975                         if (rename(SYSTEM_KRB5_CONF_PATH, newpath) == -1) {
 976                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 977                                         "of %s to %s failed. Errno %s\n",
 978                                         SYSTEM_KRB5_CONF_PATH, newpath,
 979                                         strerror(errno) ));
 980                                 TALLOC_FREE(dname);
 981                                 return True; /* Not a fatal error. */
 982                         }
 983
 984                         if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 985                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 986                                         "forced symlink of %s to /etc/krb5.conf failed. Errno %s\n",
 987                                         fname, strerror(errno) ));
 988                                 TALLOC_FREE(dname);
 989                                 return True; /* Not a fatal error. */
 990                         }
 991                 }
 992         }
 993 #endif
 994
 995         TALLOC_FREE(dname);
 996
 997         return True;
 998 }
 999 #endif