3baba1427e8ccc186a87546c41af7c4f9fa15597
[kai/samba-autobuild/.git] / source4 / auth / kerberos / srv_keytab.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Kerberos utility functions
5
6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23
24 #include "includes.h"
25 #include "system/kerberos.h"
26 #include "auth/kerberos/kerberos.h"
27 #include "auth/kerberos/kerberos_srv_keytab.h"
28
29 static void keytab_principals_free(krb5_context context, krb5_principal *set)
30 {
31         int i;
32         for (i = 0; set[i] != NULL; i++) {
33                 krb5_free_principal(context, set[i]);
34         }
35 }
36
37 static krb5_error_code principals_from_list(TALLOC_CTX *parent_ctx,
38                                         const char *samAccountName,
39                                         const char *realm,
40                                         const char **SPNs, int num_SPNs,
41                                         krb5_context context,
42                                         krb5_principal **principals_out,
43                                         const char **error_string)
44 {
45         unsigned int i;
46         krb5_error_code ret;
47         char *upper_realm;
48         TALLOC_CTX *tmp_ctx;
49         krb5_principal *principals = NULL;
50         tmp_ctx = talloc_new(parent_ctx);
51         if (!tmp_ctx) {
52                 *error_string = "Cannot allocate tmp_ctx";
53                 return ENOMEM;
54         }
55
56         if (!realm) {
57                 *error_string = "Cannot make principal without a realm";
58                 ret = EINVAL;
59                 goto done;
60         }
61
62         upper_realm = strupper_talloc(tmp_ctx, realm);
63         if (!upper_realm) {
64                 *error_string = "Cannot allocate full upper case realm";
65                 ret = ENOMEM;
66                 goto done;
67         }
68
69         principals = talloc_zero_array(tmp_ctx, krb5_principal,
70                                         num_SPNs ? (num_SPNs + 2) : 2);
71
72         for (i = 0; num_SPNs && i < num_SPNs; i++) {
73                 ret = krb5_parse_name(context, SPNs[i], &principals[i]);
74
75                 if (ret) {
76                         *error_string = smb_get_krb5_error_message(context, ret,
77                                                                    parent_ctx);
78                         goto done;
79                 }
80         }
81
82         if (samAccountName) {
83                 ret = smb_krb5_make_principal(context, &principals[i],
84                                           upper_realm, samAccountName,
85                                           NULL);
86                 if (ret) {
87                         *error_string = smb_get_krb5_error_message(context, ret,
88                                                                    parent_ctx);
89                         goto done;
90                 }
91         }
92
93 done:
94         if (ret) {
95                 keytab_principals_free(context, principals);
96         } else {
97                 *principals_out = talloc_steal(parent_ctx, principals);
98         }
99         talloc_free(tmp_ctx);
100         return ret;
101 }
102
103 static krb5_error_code salt_principal(TALLOC_CTX *parent_ctx,
104                                 const char *samAccountName,
105                                 const char *realm,
106                                 const char *saltPrincipal,
107                                 krb5_context context,
108                                 krb5_principal *salt_princ,
109                                 const char **error_string)
110 {
111
112         krb5_error_code ret;
113         char *machine_username;
114         char *salt_body;
115         char *lower_realm;
116         char *upper_realm;
117
118         TALLOC_CTX *tmp_ctx;
119
120         if (saltPrincipal) {
121                 ret = krb5_parse_name(context, saltPrincipal, salt_princ);
122                 if (ret) {
123                         *error_string = smb_get_krb5_error_message(
124                                                 context, ret, parent_ctx);
125                 }
126                 return ret;
127         }
128
129         if (!samAccountName) {
130                 (*error_string) = "Cannot determine salt principal, no "
131                                 "saltPrincipal or samAccountName specified";
132                 return EINVAL;
133         }
134
135         if (!realm) {
136                 *error_string = "Cannot make principal without a realm";
137                 return EINVAL;
138         }
139
140         tmp_ctx = talloc_new(parent_ctx);
141         if (!tmp_ctx) {
142                 *error_string = "Cannot allocate tmp_ctx";
143                 return ENOMEM;
144         }
145
146         machine_username = strlower_talloc(tmp_ctx, samAccountName);
147         if (!machine_username) {
148                 *error_string = "Cannot duplicate samAccountName";
149                 talloc_free(tmp_ctx);
150                 return ENOMEM;
151         }
152
153         if (machine_username[strlen(machine_username)-1] == '$') {
154                 machine_username[strlen(machine_username)-1] = '\0';
155         }
156
157         lower_realm = strlower_talloc(tmp_ctx, realm);
158         if (!lower_realm) {
159                 *error_string = "Cannot allocate to lower case realm";
160                 talloc_free(tmp_ctx);
161                 return ENOMEM;
162         }
163
164         upper_realm = strupper_talloc(tmp_ctx, realm);
165         if (!upper_realm) {
166                 *error_string = "Cannot allocate to upper case realm";
167                 talloc_free(tmp_ctx);
168                 return ENOMEM;
169         }
170
171         salt_body = talloc_asprintf(tmp_ctx, "%s.%s",
172                                     machine_username, lower_realm);
173         if (!salt_body) {
174                 *error_string = "Cannot form salt principal body";
175                 talloc_free(tmp_ctx);
176                 return ENOMEM;
177         }
178
179         ret = smb_krb5_make_principal(context, salt_princ, upper_realm,
180                                                 "host", salt_body, NULL);
181         if (ret) {
182                 *error_string = smb_get_krb5_error_message(context,
183                                                            ret, parent_ctx);
184         }
185
186         talloc_free(tmp_ctx);
187         return ret;
188 }
189
190 static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
191                                        krb5_principal *principals,
192                                        krb5_principal salt_princ,
193                                        int kvno,
194                                        const char *password_s,
195                                        krb5_context context,
196                                        krb5_enctype *enctypes,
197                                        krb5_keytab keytab,
198                                        const char **error_string)
199 {
200         unsigned int i, p;
201         krb5_error_code ret;
202         krb5_data password;
203         char *unparsed;
204
205         password.data = discard_const_p(char, password_s);
206         password.length = strlen(password_s);
207
208         for (i = 0; enctypes[i]; i++) {
209                 krb5_keytab_entry entry;
210
211                 ZERO_STRUCT(entry);
212
213                 ret = smb_krb5_create_key_from_string(context,
214                                                       &salt_princ,
215                                                       NULL,
216                                                       &password,
217                                                       enctypes[i],
218                                                       KRB5_KT_KEY(&entry));
219                 if (ret != 0) {
220                         return ret;
221                 }
222
223                 entry.vno = kvno;
224
225                 for (p = 0; principals[p]; p++) {
226                         unparsed = NULL;
227                         entry.principal = principals[p];
228                         ret = krb5_kt_add_entry(context, keytab, &entry);
229                         if (ret != 0) {
230                                 char *k5_error_string =
231                                         smb_get_krb5_error_message(context,
232                                                                    ret, NULL);
233                                 krb5_unparse_name(context,
234                                                 principals[p], &unparsed);
235                                 *error_string = talloc_asprintf(parent_ctx,
236                                         "Failed to add enctype %d entry for "
237                                         "%s(kvno %d) to keytab: %s\n",
238                                         (int)enctypes[i], unparsed,
239                                         kvno, k5_error_string);
240
241                                 free(unparsed);
242                                 talloc_free(k5_error_string);
243                                 krb5_free_keyblock_contents(context,
244                                                             KRB5_KT_KEY(&entry));
245                                 return ret;
246                         }
247
248                         DEBUG(5, ("Added key (kvno %d) to keytab (enctype %d)\n",
249                                   kvno, (int)enctypes[i]));
250                 }
251                 krb5_free_keyblock_contents(context, KRB5_KT_KEY(&entry));
252         }
253         return 0;
254 }
255
256 static krb5_error_code create_keytab(TALLOC_CTX *parent_ctx,
257                                      const char *samAccountName,
258                                      const char *realm,
259                                      const char *saltPrincipal,
260                                      int kvno,
261                                      const char *new_secret,
262                                      const char *old_secret,
263                                      uint32_t supp_enctypes,
264                                      krb5_principal *principals,
265                                      krb5_context context,
266                                      krb5_keytab keytab,
267                                      bool add_old,
268                                      const char **error_string)
269 {
270         krb5_error_code ret;
271         krb5_principal salt_princ = NULL;
272         krb5_enctype *enctypes;
273         TALLOC_CTX *mem_ctx;
274
275         if (!new_secret) {
276                 /* There is no password here, so nothing to do */
277                 return 0;
278         }
279
280         mem_ctx = talloc_new(parent_ctx);
281         if (!mem_ctx) {
282                 *error_string = talloc_strdup(parent_ctx,
283                         "unable to allocate tmp_ctx for create_keytab");
284                 return ENOMEM;
285         }
286
287         /* The salt used to generate these entries may be different however,
288          * fetch that */
289         ret = salt_principal(mem_ctx, samAccountName, realm, saltPrincipal,
290                              context, &salt_princ, error_string);
291         if (ret) {
292                 talloc_free(mem_ctx);
293                 return ret;
294         }
295
296         ret = ms_suptypes_to_ietf_enctypes(mem_ctx, supp_enctypes, &enctypes);
297         if (ret) {
298                 *error_string = talloc_asprintf(parent_ctx,
299                                         "create_keytab: generating list of "
300                                         "encryption types failed (%s)\n",
301                                         smb_get_krb5_error_message(context,
302                                                                 ret, mem_ctx));
303                 goto done;
304         }
305
306         ret = keytab_add_keys(mem_ctx, principals,
307                               salt_princ, kvno, new_secret,
308                               context, enctypes, keytab, error_string);
309         if (ret) {
310                 talloc_steal(parent_ctx, *error_string);
311                 goto done;
312         }
313
314         if (old_secret && add_old && kvno != 0) {
315                 ret = keytab_add_keys(mem_ctx, principals,
316                                       salt_princ, kvno - 1, old_secret,
317                                       context, enctypes, keytab, error_string);
318                 if (ret) {
319                         talloc_steal(parent_ctx, *error_string);
320                 }
321         }
322
323 done:
324         krb5_free_principal(context, salt_princ);
325         talloc_free(mem_ctx);
326         return ret;
327 }
328
329 /*
330  * Walk the keytab, looking for entries of this principal name,
331  * with KVNO other than current kvno -1.
332  *
333  * These entries are now stale,
334  * we only keep the current and previous entries around.
335  *
336  * Inspired by the code in Samba3 for 'use kerberos keytab'.
337  */
338
339 static krb5_error_code remove_old_entries(TALLOC_CTX *parent_ctx,
340                                           int kvno,
341                                           krb5_principal *principals,
342                                           bool delete_all_kvno,
343                                           krb5_context context,
344                                           krb5_keytab keytab,
345                                           bool *found_previous,
346                                           const char **error_string)
347 {
348         krb5_error_code ret, ret2;
349         krb5_kt_cursor cursor;
350         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
351
352         if (!mem_ctx) {
353                 return ENOMEM;
354         }
355
356         *found_previous = false;
357
358         /* for each entry in the keytab */
359         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
360         switch (ret) {
361         case 0:
362                 break;
363 #ifdef HEIM_ERR_OPNOTSUPP
364         case HEIM_ERR_OPNOTSUPP:
365 #endif
366         case ENOENT:
367         case KRB5_KT_END:
368                 /* no point enumerating if there isn't anything here */
369                 talloc_free(mem_ctx);
370                 return 0;
371         default:
372                 *error_string = talloc_asprintf(parent_ctx,
373                         "failed to open keytab for read of old entries: %s\n",
374                         smb_get_krb5_error_message(context, ret, mem_ctx));
375                 talloc_free(mem_ctx);
376                 return ret;
377         }
378
379         while (!ret) {
380                 unsigned int i;
381                 bool matched = false;
382                 krb5_keytab_entry entry;
383                 ret = krb5_kt_next_entry(context, keytab, &entry, &cursor);
384                 if (ret) {
385                         break;
386                 }
387                 for (i = 0; principals[i]; i++) {
388                         /* if it matches our principal */
389                         if (smb_krb5_kt_compare(context, &entry,
390                                                 principals[i], 0, 0)) {
391                                 matched = true;
392                                 break;
393                         }
394                 }
395
396                 if (!matched) {
397                         /* Free the entry,
398                          * it wasn't the one we were looking for anyway */
399                         krb5_kt_free_entry(context, &entry);
400                         continue;
401                 }
402
403                 /* delete it, if it is not kvno -1 */
404                 if (entry.vno != (kvno - 1 )) {
405                         /* Release the enumeration.  We are going to
406                          * have to start this from the top again,
407                          * because deletes during enumeration may not
408                          * always be consistent.
409                          *
410                          * Also, the enumeration locks a FILE: keytab
411                          */
412
413                         krb5_kt_end_seq_get(context, keytab, &cursor);
414
415                         ret = krb5_kt_remove_entry(context, keytab, &entry);
416                         krb5_kt_free_entry(context, &entry);
417
418                         /* Deleted: Restart from the top */
419                         ret2 = krb5_kt_start_seq_get(context, keytab, &cursor);
420                         if (ret2) {
421                                 krb5_kt_free_entry(context, &entry);
422                                 DEBUG(1, ("failed to restart enumeration of keytab: %s\n",
423                                           smb_get_krb5_error_message(context,
424                                                                 ret, mem_ctx)));
425
426                                 talloc_free(mem_ctx);
427                                 return ret2;
428                         }
429
430                         if (ret) {
431                                 break;
432                         }
433
434                 } else {
435                         *found_previous = true;
436                 }
437
438                 /* Free the entry, we don't need it any more */
439                 krb5_kt_free_entry(context, &entry);
440         }
441         krb5_kt_end_seq_get(context, keytab, &cursor);
442
443         switch (ret) {
444         case 0:
445                 break;
446         case ENOENT:
447         case KRB5_KT_END:
448                 ret = 0;
449                 break;
450         default:
451                 *error_string = talloc_asprintf(parent_ctx,
452                         "failed in deleting old entries for principal: %s\n",
453                         smb_get_krb5_error_message(context, ret, mem_ctx));
454         }
455         talloc_free(mem_ctx);
456         return ret;
457 }
458
459 krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
460                                 krb5_context context,
461                                 const char *keytab_name,
462                                 const char *samAccountName,
463                                 const char *realm,
464                                 const char **SPNs,
465                                 int num_SPNs,
466                                 const char *saltPrincipal,
467                                 const char *new_secret,
468                                 const char *old_secret,
469                                 int kvno,
470                                 uint32_t supp_enctypes,
471                                 bool delete_all_kvno,
472                                 krb5_keytab *_keytab,
473                                 const char **error_string)
474 {
475         krb5_keytab keytab;
476         krb5_error_code ret;
477         bool found_previous;
478         TALLOC_CTX *tmp_ctx;
479         krb5_principal *principals = NULL;
480
481         if (keytab_name == NULL) {
482                 return ENOENT;
483         }
484
485         ret = krb5_kt_resolve(context, keytab_name, &keytab);
486         if (ret) {
487                 *error_string = smb_get_krb5_error_message(context,
488                                                            ret, parent_ctx);
489                 return ret;
490         }
491
492         DEBUG(5, ("Opened keytab %s\n", keytab_name));
493
494         tmp_ctx = talloc_new(parent_ctx);
495         if (!tmp_ctx) {
496                 return ENOMEM;
497         }
498
499         /* Get the principal we will store the new keytab entries under */
500         ret = principals_from_list(tmp_ctx,
501                                   samAccountName, realm, SPNs, num_SPNs,
502                                   context, &principals, error_string);
503
504         if (ret != 0) {
505                 *error_string = talloc_asprintf(parent_ctx,
506                         "Failed to load principals from ldb message: %s\n",
507                         *error_string);
508                 goto done;
509         }
510
511         ret = remove_old_entries(tmp_ctx, kvno, principals, delete_all_kvno,
512                                  context, keytab, &found_previous, error_string);
513         if (ret != 0) {
514                 *error_string = talloc_asprintf(parent_ctx,
515                         "Failed to remove old principals from keytab: %s\n",
516                         *error_string);
517                 goto done;
518         }
519
520         if (!delete_all_kvno) {
521                 /* Create a new keytab.  If during the cleanout we found
522                  * entires for kvno -1, then don't try and duplicate them.
523                  * Otherwise, add kvno, and kvno -1 */
524
525                 ret = create_keytab(tmp_ctx,
526                                     samAccountName, realm, saltPrincipal,
527                                     kvno, new_secret, old_secret,
528                                     supp_enctypes, principals,
529                                     context, keytab,
530                                     found_previous ? false : true,
531                                     error_string);
532                 if (ret) {
533                         talloc_steal(parent_ctx, *error_string);
534                 }
535         }
536
537         if (ret == 0 && _keytab != NULL) {
538                 /* caller wants the keytab handle back */
539                 *_keytab = keytab;
540         }
541
542 done:
543         keytab_principals_free(context, principals);
544         if (ret != 0 || _keytab == NULL) {
545                 krb5_kt_close(context, keytab);
546         }
547         talloc_free(tmp_ctx);
548         return ret;
549 }
550
551 krb5_error_code smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
552                                 krb5_context context,
553                                 const char *new_secret,
554                                 const char *samAccountName,
555                                 const char *realm,
556                                 int kvno,
557                                 krb5_keytab *keytab,
558                                 const char **keytab_name)
559 {
560         krb5_error_code ret;
561         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
562         const char *rand_string;
563         const char *error_string;
564         if (!mem_ctx) {
565                 return ENOMEM;
566         }
567
568         rand_string = generate_random_str(mem_ctx, 16);
569         if (!rand_string) {
570                 talloc_free(mem_ctx);
571                 return ENOMEM;
572         }
573
574         *keytab_name = talloc_asprintf(mem_ctx, "MEMORY:%s", rand_string);
575         if (*keytab_name == NULL) {
576                 talloc_free(mem_ctx);
577                 return ENOMEM;
578         }
579
580
581         ret = smb_krb5_update_keytab(mem_ctx, context,
582                                      *keytab_name, samAccountName, realm,
583                                      NULL, 0, NULL, new_secret, NULL,
584                                      kvno, ENC_ALL_TYPES,
585                                      false, keytab, &error_string);
586         if (ret == 0) {
587                 talloc_steal(parent_ctx, *keytab_name);
588         } else {
589                 DEBUG(0, ("Failed to create in-memory keytab: %s\n",
590                           error_string));
591                 *keytab_name = NULL;
592         }
593         talloc_free(mem_ctx);
594         return ret;
595 }