2 Unix SMB/CIFS implementation.
4 Kerberos utility functions
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "auth/credentials/credentials.h"
26 #include "system/kerberos.h"
27 #include "auth/kerberos/kerberos.h"
28 #include "auth/kerberos/kerberos_srv_keytab.h"
29 #include "auth/kerberos/kerberos_util.h"
31 static void keytab_principals_free(krb5_context context, krb5_principal *set)
34 for (i = 0; set[i] != NULL; i++) {
35 krb5_free_principal(context, set[i]);
39 static krb5_error_code principals_from_list(TALLOC_CTX *parent_ctx,
40 const char *samAccountName,
42 const char **SPNs, int num_SPNs,
44 krb5_principal **principals_out,
45 const char **error_string)
51 krb5_principal *principals = NULL;
52 tmp_ctx = talloc_new(parent_ctx);
54 *error_string = "Cannot allocate tmp_ctx";
59 *error_string = "Cannot have a kerberos secret in "
60 "secrets.ldb without a realm";
65 upper_realm = strupper_talloc(tmp_ctx, realm);
67 *error_string = "Cannot allocate full upper case realm";
72 principals = talloc_zero_array(tmp_ctx, krb5_principal,
73 num_SPNs ? (num_SPNs + 2) : 2);
75 for (i = 0; num_SPNs && i < num_SPNs; i++) {
76 ret = krb5_parse_name(context, SPNs[i], &principals[i]);
79 *error_string = smb_get_krb5_error_message(context, ret,
86 ret = krb5_make_principal(context, &principals[i],
87 upper_realm, samAccountName,
90 *error_string = smb_get_krb5_error_message(context, ret,
98 keytab_principals_free(context, principals);
100 *principals_out = talloc_steal(parent_ctx, principals);
102 talloc_free(tmp_ctx);
106 static krb5_error_code salt_principal(TALLOC_CTX *parent_ctx,
107 const char *samAccountName,
109 const char *saltPrincipal,
110 krb5_context context,
111 krb5_principal *salt_princ,
112 const char **error_string)
116 char *machine_username;
124 ret = krb5_parse_name(context, saltPrincipal, salt_princ);
126 *error_string = smb_get_krb5_error_message(
127 context, ret, parent_ctx);
132 if (!samAccountName) {
133 (*error_string) = "Cannot determine salt principal, no "
134 "saltPrincipal or samAccountName specified";
139 *error_string = "Cannot have a kerberos secret in "
140 "secrets.ldb without a realm";
144 tmp_ctx = talloc_new(parent_ctx);
146 *error_string = "Cannot allocate tmp_ctx";
150 machine_username = talloc_strdup(tmp_ctx, samAccountName);
151 if (!machine_username) {
152 *error_string = "Cannot duplicate samAccountName";
153 talloc_free(tmp_ctx);
157 if (machine_username[strlen(machine_username)-1] == '$') {
158 machine_username[strlen(machine_username)-1] = '\0';
161 lower_realm = strlower_talloc(tmp_ctx, realm);
163 *error_string = "Cannot allocate to lower case realm";
164 talloc_free(tmp_ctx);
168 upper_realm = strupper_talloc(tmp_ctx, realm);
170 *error_string = "Cannot allocate to upper case realm";
171 talloc_free(tmp_ctx);
175 salt_body = talloc_asprintf(tmp_ctx, "%s.%s",
176 machine_username, lower_realm);
178 *error_string = "Cannot form salt principal body";
179 talloc_free(tmp_ctx);
183 ret = krb5_make_principal(context, salt_princ, upper_realm,
184 "host", salt_body, NULL);
186 *error_string = smb_get_krb5_error_message(context,
190 talloc_free(tmp_ctx);
194 /* Translate between the Microsoft msDS-SupportedEncryptionTypes values
195 * and the IETF encryption type values */
196 static krb5_enctype ms_suptype_to_ietf_enctype(uint32_t enctype_bitmap)
198 switch (enctype_bitmap) {
200 return ENCTYPE_DES_CBC_CRC;
202 return ENCTYPE_DES_CBC_MD5;
203 case ENC_RC4_HMAC_MD5:
204 return ENCTYPE_ARCFOUR_HMAC_MD5;
205 case ENC_HMAC_SHA1_96_AES128:
206 return ENCTYPE_AES128_CTS_HMAC_SHA1_96;
207 case ENC_HMAC_SHA1_96_AES256:
208 return ENCTYPE_AES256_CTS_HMAC_SHA1_96;
214 /* Return an array of krb5_enctype values */
215 static krb5_error_code ms_suptypes_to_ietf_enctypes(TALLOC_CTX *mem_ctx,
216 uint32_t enctype_bitmap,
217 krb5_enctype **enctypes)
219 unsigned int i, j = 0;
220 *enctypes = talloc_zero_array(mem_ctx, krb5_enctype,
221 (8 * sizeof(enctype_bitmap)) + 1);
225 for (i = 0; i < (8 * sizeof(enctype_bitmap)); i++) {
226 uint32_t bit_value = (1 << i) & enctype_bitmap;
227 if (bit_value & enctype_bitmap) {
228 (*enctypes)[j] = ms_suptype_to_ietf_enctype(bit_value);
229 if (!(*enctypes)[j]) {
239 static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
240 krb5_principal *principals,
241 krb5_principal salt_princ,
243 const char *password_s,
244 krb5_context context,
245 krb5_enctype *enctypes,
247 const char **error_string)
254 password.data = discard_const_p(char *, password_s);
255 password.length = strlen(password_s);
257 for (i = 0; enctypes[i]; i++) {
258 krb5_keytab_entry entry;
262 ret = create_kerberos_key_from_string_direct(context,
263 salt_princ, &password,
264 &entry.keyblock, enctypes[i]);
271 for (p = 0; principals[p]; p++) {
273 entry.principal = principals[p];
274 ret = krb5_kt_add_entry(context, keytab, &entry);
276 char *k5_error_string =
277 smb_get_krb5_error_message(context,
279 krb5_unparse_name(context,
280 principals[p], &unparsed);
281 *error_string = talloc_asprintf(parent_ctx,
282 "Failed to add enctype %d entry for "
283 "%s(kvno %d) to keytab: %s\n",
284 (int)enctypes[i], unparsed,
285 kvno, k5_error_string);
288 talloc_free(k5_error_string);
289 krb5_free_keyblock_contents(context,
294 DEBUG(5, ("Added key (kvno %d) to keytab (enctype %d)\n",
295 kvno, (int)enctypes[i]));
297 krb5_free_keyblock_contents(context, &entry.keyblock);
302 static krb5_error_code create_keytab(TALLOC_CTX *parent_ctx,
303 const char *samAccountName,
305 const char *saltPrincipal,
307 const char *new_secret,
308 const char *old_secret,
309 uint32_t supp_enctypes,
310 krb5_principal *principals,
311 krb5_context context,
314 const char **error_string)
317 krb5_principal salt_princ = NULL;
318 krb5_enctype *enctypes;
322 /* There is no password here, so nothing to do */
326 mem_ctx = talloc_new(parent_ctx);
328 *error_string = "unable to allocate tmp_ctx for create_keytab";
332 /* The salt used to generate these entries may be different however,
334 ret = salt_principal(mem_ctx, samAccountName, realm, saltPrincipal,
335 context, &salt_princ, error_string);
337 talloc_free(mem_ctx);
341 ret = ms_suptypes_to_ietf_enctypes(mem_ctx, supp_enctypes, &enctypes);
343 *error_string = talloc_asprintf(parent_ctx,
344 "create_keytab: generating list of "
345 "encryption types failed (%s)\n",
346 smb_get_krb5_error_message(context,
351 ret = keytab_add_keys(mem_ctx, principals,
352 salt_princ, kvno, new_secret,
353 context, enctypes, keytab, error_string);
358 if (old_secret && add_old && kvno != 0) {
359 ret = keytab_add_keys(mem_ctx, principals,
360 salt_princ, kvno - 1, old_secret,
361 context, enctypes, keytab, error_string);
365 krb5_free_principal(context, salt_princ);
366 talloc_free(mem_ctx);
371 * Walk the keytab, looking for entries of this principal name,
372 * with KVNO other than current kvno -1.
374 * These entries are now stale,
375 * we only keep the current and previous entries around.
377 * Inspired by the code in Samba3 for 'use kerberos keytab'.
380 static krb5_error_code remove_old_entries(TALLOC_CTX *parent_ctx,
382 krb5_principal *principals,
383 bool delete_all_kvno,
384 krb5_context context,
386 bool *found_previous,
387 const char **error_string)
389 krb5_error_code ret, ret2;
390 krb5_kt_cursor cursor;
391 TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
397 *found_previous = false;
399 /* for each entry in the keytab */
400 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
404 case HEIM_ERR_OPNOTSUPP:
407 /* no point enumerating if there isn't anything here */
408 talloc_free(mem_ctx);
411 *error_string = talloc_asprintf(parent_ctx,
412 "failed to open keytab for read of old entries: %s\n",
413 smb_get_krb5_error_message(context, ret, mem_ctx));
414 talloc_free(mem_ctx);
420 bool matched = false;
421 krb5_keytab_entry entry;
422 ret = krb5_kt_next_entry(context, keytab, &entry, &cursor);
426 for (i = 0; principals[i]; i++) {
427 /* if it matches our principal */
428 if (krb5_kt_compare(context, &entry,
429 principals[i], 0, 0)) {
437 * it wasn't the one we were looking for anyway */
438 krb5_kt_free_entry(context, &entry);
442 /* delete it, if it is not kvno -1 */
443 if (entry.vno != (kvno - 1 )) {
444 /* Release the enumeration. We are going to
445 * have to start this from the top again,
446 * because deletes during enumeration may not
447 * always be consistent.
449 * Also, the enumeration locks a FILE: keytab
452 krb5_kt_end_seq_get(context, keytab, &cursor);
454 ret = krb5_kt_remove_entry(context, keytab, &entry);
455 krb5_kt_free_entry(context, &entry);
457 /* Deleted: Restart from the top */
458 ret2 = krb5_kt_start_seq_get(context, keytab, &cursor);
460 krb5_kt_free_entry(context, &entry);
461 DEBUG(1, ("failed to restart enumeration of keytab: %s\n",
462 smb_get_krb5_error_message(context,
465 talloc_free(mem_ctx);
474 *found_previous = true;
477 /* Free the entry, we don't need it any more */
478 krb5_kt_free_entry(context, &entry);
480 krb5_kt_end_seq_get(context, keytab, &cursor);
490 *error_string = talloc_asprintf(parent_ctx,
491 "failed in deleting old entries for principal: %s\n",
492 smb_get_krb5_error_message(context, ret, mem_ctx));
494 talloc_free(mem_ctx);
498 krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
499 struct smb_krb5_context *smb_krb5_context,
500 const char *keytab_name,
501 const char *samAccountName,
505 const char *saltPrincipal,
506 const char *new_secret,
507 const char *old_secret,
509 uint32_t supp_enctypes,
510 bool delete_all_kvno,
511 const char **error_string)
515 TALLOC_CTX *mem_ctx = talloc_new(NULL);
516 struct keytab_container *keytab_container;
517 krb5_principal *principals = NULL;
523 ret = smb_krb5_get_keytab_container(mem_ctx, smb_krb5_context,
524 keytab_name, &keytab_container);
530 DEBUG(5, ("Opened keytab %s\n", keytab_name));
532 /* Get the principal we will store the new keytab entries under */
533 ret = principals_from_list(mem_ctx,
534 samAccountName, realm, SPNs, num_SPNs,
535 smb_krb5_context->krb5_context,
536 &principals, error_string);
539 *error_string = talloc_asprintf(parent_ctx,
540 "Failed to load principals from ldb message: %s\n",
545 ret = remove_old_entries(mem_ctx, kvno, principals, delete_all_kvno,
546 smb_krb5_context->krb5_context,
547 keytab_container->keytab,
548 &found_previous, error_string);
550 *error_string = talloc_asprintf(parent_ctx,
551 "Failed to remove old principals from keytab: %s\n",
556 if (!delete_all_kvno) {
557 /* Create a new keytab. If during the cleanout we found
558 * entires for kvno -1, then don't try and duplicate them.
559 * Otherwise, add kvno, and kvno -1 */
561 ret = create_keytab(mem_ctx,
562 samAccountName, realm, saltPrincipal,
563 kvno, new_secret, old_secret,
564 supp_enctypes, principals,
565 smb_krb5_context->krb5_context,
566 keytab_container->keytab,
567 found_previous ? false : true,
572 keytab_principals_free(smb_krb5_context->krb5_context, principals);
573 talloc_free(mem_ctx);
577 krb5_error_code smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
578 struct cli_credentials *machine_account,
579 struct smb_krb5_context *smb_krb5_context,
580 struct keytab_container **keytab_container)
583 TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
584 const char *rand_string;
585 const char *keytab_name;
586 const char *new_secret;
587 const char *samAccountName;
590 const char *error_string;
595 *keytab_container = talloc(mem_ctx, struct keytab_container);
597 rand_string = generate_random_str(mem_ctx, 16);
599 talloc_free(mem_ctx);
603 keytab_name = talloc_asprintf(mem_ctx, "MEMORY:%s",
606 talloc_free(mem_ctx);
610 ret = smb_krb5_get_keytab_container(mem_ctx, smb_krb5_context,
611 keytab_name, keytab_container);
616 new_secret = cli_credentials_get_password(machine_account);
617 samAccountName = cli_credentials_get_username(machine_account);
618 realm = cli_credentials_get_realm(machine_account);
619 kvno = cli_credentials_get_kvno(machine_account);
621 ret = smb_krb5_update_keytab(mem_ctx, smb_krb5_context,
622 keytab_name, samAccountName, realm,
623 NULL, 0, NULL, new_secret, NULL,
625 false, &error_string);
627 talloc_steal(parent_ctx, *keytab_container);
629 DEBUG(0, ("Failed to create in-memory keytab: %s\n",
631 *keytab_container = NULL;
633 talloc_free(mem_ctx);