6e1b7c08fe753eefceb095f38b71aef912e824d4
[kai/samba.git] / source3 / libads / kerberos_keytab.c
1 /*
2    Unix SMB/CIFS implementation.
3    kerberos keytab utility library
4    Copyright (C) Andrew Tridgell 2001
5    Copyright (C) Remus Koos 2001
6    Copyright (C) Luke Howard 2003
7    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
8    Copyright (C) Guenther Deschner 2003
9    Copyright (C) Rakesh Patel 2004
10    Copyright (C) Dan Perry 2004
11    Copyright (C) Jeremy Allison 2004
12    Copyright (C) Gerald Carter 2006
13
14    This program is free software; you can redistribute it and/or modify
15    it under the terms of the GNU General Public License as published by
16    the Free Software Foundation; either version 3 of the License, or
17    (at your option) any later version.
18
19    This program is distributed in the hope that it will be useful,
20    but WITHOUT ANY WARRANTY; without even the implied warranty of
21    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22    GNU General Public License for more details.
23
24    You should have received a copy of the GNU General Public License
25    along with this program.  If not, see <http://www.gnu.org/licenses/>.
26 */
27
28 #include "includes.h"
29 #include "smb_krb5.h"
30 #include "ads.h"
31 #include "secrets.h"
32
33 #ifdef HAVE_KRB5
34
35 /**********************************************************************
36 **********************************************************************/
37
38 static krb5_error_code seek_and_delete_old_entries(krb5_context context,
39                                                    krb5_keytab keytab,
40                                                    krb5_kvno kvno,
41                                                    const char *princ_s,
42                                                    krb5_principal princ,
43                                                    bool flush,
44                                                    bool keep_old_entries)
45 {
46         krb5_error_code ret;
47         krb5_kt_cursor cursor;
48         krb5_kt_cursor zero_csr;
49         krb5_keytab_entry kt_entry;
50         krb5_keytab_entry zero_kt_entry;
51         char *ktprinc = NULL;
52
53         ZERO_STRUCT(cursor);
54         ZERO_STRUCT(zero_csr);
55         ZERO_STRUCT(kt_entry);
56         ZERO_STRUCT(zero_kt_entry);
57
58         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
59         if (ret == KRB5_KT_END || ret == ENOENT ) {
60                 /* no entries */
61                 return 0;
62         }
63
64         DEBUG(3, (__location__ ": Will try to delete old keytab entries\n"));
65         while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
66                 bool name_ok = False;
67
68                 if (!flush && (princ_s != NULL)) {
69                         ret = smb_krb5_unparse_name(talloc_tos(), context,
70                                                     kt_entry.principal,
71                                                     &ktprinc);
72                         if (ret) {
73                                 DEBUG(1, (__location__
74                                           ": smb_krb5_unparse_name failed "
75                                           "(%s)\n", error_message(ret)));
76                                 goto out;
77                         }
78
79 #ifdef HAVE_KRB5_KT_COMPARE
80                         name_ok = krb5_kt_compare(context, &kt_entry,
81                                                   princ, 0, 0);
82 #else
83                         name_ok = (strcmp(ktprinc, princ_s) == 0);
84 #endif
85
86                         if (!name_ok) {
87                                 DEBUG(10, (__location__ ": ignoring keytab "
88                                            "entry principal %s, kvno = %d\n",
89                                            ktprinc, kt_entry.vno));
90
91                                 /* Not a match,
92                                  * just free this entry and continue. */
93                                 ret = smb_krb5_kt_free_entry(context,
94                                                              &kt_entry);
95                                 ZERO_STRUCT(kt_entry);
96                                 if (ret) {
97                                         DEBUG(1, (__location__
98                                                   ": smb_krb5_kt_free_entry "
99                                                   "failed (%s)\n",
100                                                   error_message(ret)));
101                                         goto out;
102                                 }
103
104                                 TALLOC_FREE(ktprinc);
105                                 continue;
106                         }
107
108                         TALLOC_FREE(ktprinc);
109                 }
110
111                 /*------------------------------------------------------------
112                  * Save the entries with kvno - 1. This is what microsoft does
113                  * to allow people with existing sessions that have kvno - 1
114                  * to still work. Otherwise, when the password for the machine
115                  * changes, all kerberizied sessions will 'break' until either
116                  * the client reboots or the client's session key expires and
117                  * they get a new session ticket with the new kvno.
118                  */
119
120                 if (!flush && (kt_entry.vno == kvno - 1)) {
121                         DEBUG(5, (__location__ ": Saving previous (kvno %d) "
122                                   "entry for principal: %s.\n",
123                                   kvno - 1, princ_s));
124                         continue;
125                 }
126
127                 if (keep_old_entries) {
128                         DEBUG(5, (__location__ ": Saving old (kvno %d) "
129                                   "entry for principal: %s.\n",
130                                   kvno, princ_s));
131                         continue;
132                 }
133
134                 DEBUG(5, (__location__ ": Found old entry for principal: %s "
135                           "(kvno %d) - trying to remove it.\n",
136                           princ_s, kt_entry.vno));
137
138                 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
139                 ZERO_STRUCT(cursor);
140                 if (ret) {
141                         DEBUG(1, (__location__ ": krb5_kt_end_seq_get() "
142                                   "failed (%s)\n", error_message(ret)));
143                         goto out;
144                 }
145                 ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
146                 if (ret) {
147                         DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
148                                   "failed (%s)\n", error_message(ret)));
149                         goto out;
150                 }
151
152                 DEBUG(5, (__location__ ": removed old entry for principal: "
153                           "%s (kvno %d).\n", princ_s, kt_entry.vno));
154
155                 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
156                 if (ret) {
157                         DEBUG(1, (__location__ ": krb5_kt_start_seq() failed "
158                                   "(%s)\n", error_message(ret)));
159                         goto out;
160                 }
161                 ret = smb_krb5_kt_free_entry(context, &kt_entry);
162                 ZERO_STRUCT(kt_entry);
163                 if (ret) {
164                         DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
165                                   "failed (%s)\n", error_message(ret)));
166                         goto out;
167                 }
168         }
169
170 out:
171         if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
172                 smb_krb5_kt_free_entry(context, &kt_entry);
173         }
174         if (keytab) {
175                 if (memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) {
176                         krb5_kt_end_seq_get(context, keytab, &cursor);
177                 }
178         }
179
180         return ret;
181 }
182
183 static int smb_krb5_kt_add_entry(krb5_context context,
184                                  krb5_keytab keytab,
185                                  krb5_kvno kvno,
186                                  const char *princ_s,
187                                  krb5_enctype *enctypes,
188                                  krb5_data password,
189                                  bool no_salt,
190                                  bool keep_old_entries)
191 {
192         krb5_error_code ret;
193         krb5_keytab_entry kt_entry;
194         krb5_principal princ = NULL;
195         int i;
196
197         ZERO_STRUCT(kt_entry);
198
199         ret = smb_krb5_parse_name(context, princ_s, &princ);
200         if (ret) {
201                 DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) "
202                           "failed (%s)\n", princ_s, error_message(ret)));
203                 goto out;
204         }
205
206         /* Seek and delete old keytab entries */
207         ret = seek_and_delete_old_entries(context, keytab, kvno,
208                                           princ_s, princ, false,
209                                           keep_old_entries);
210         if (ret) {
211                 goto out;
212         }
213
214         /* If we get here, we have deleted all the old entries with kvno's
215          * not equal to the current kvno-1. */
216
217         /* Now add keytab entries for all encryption types */
218         for (i = 0; enctypes[i]; i++) {
219                 krb5_keyblock *keyp;
220
221                 keyp = KRB5_KT_KEY(&kt_entry);
222
223                 if (create_kerberos_key_from_string(context, princ,
224                                                     &password, keyp,
225                                                     enctypes[i], no_salt)) {
226                         continue;
227                 }
228
229                 kt_entry.principal = princ;
230                 kt_entry.vno       = kvno;
231
232                 DEBUG(3, (__location__ ": adding keytab entry for (%s) with "
233                           "encryption type (%d) and version (%d)\n",
234                           princ_s, enctypes[i], kt_entry.vno));
235                 ret = krb5_kt_add_entry(context, keytab, &kt_entry);
236                 krb5_free_keyblock_contents(context, keyp);
237                 ZERO_STRUCT(kt_entry);
238                 if (ret) {
239                         DEBUG(1, (__location__ ": adding entry to keytab "
240                                   "failed (%s)\n", error_message(ret)));
241                         goto out;
242                 }
243         }
244
245 out:
246         if (princ) {
247                 krb5_free_principal(context, princ);
248         }
249
250         return (int)ret;
251 }
252
253 #ifdef HAVE_ADS
254
255 /**********************************************************************
256  Adds a single service principal, i.e. 'host' to the system keytab
257 ***********************************************************************/
258
259 int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
260 {
261         krb5_error_code ret = 0;
262         krb5_context context = NULL;
263         krb5_keytab keytab = NULL;
264         krb5_data password;
265         krb5_kvno kvno;
266         krb5_enctype enctypes[4] = {
267                 ENCTYPE_DES_CBC_CRC,
268                 ENCTYPE_DES_CBC_MD5,
269                 ENCTYPE_ARCFOUR_HMAC,
270                 0
271         };
272         char *princ_s = NULL;
273         char *short_princ_s = NULL;
274         char *password_s = NULL;
275         char *my_fqdn;
276         TALLOC_CTX *tmpctx = NULL;
277         char *machine_name;
278         ADS_STATUS aderr;
279
280         initialize_krb5_error_table();
281         ret = krb5_init_context(&context);
282         if (ret) {
283                 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
284                           error_message(ret)));
285                 return -1;
286         }
287
288         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
289         if (ret) {
290                 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
291                           error_message(ret)));
292                 goto out;
293         }
294
295         /* retrieve the password */
296         if (!secrets_init()) {
297                 DEBUG(1, (__location__ ": secrets_init failed\n"));
298                 ret = -1;
299                 goto out;
300         }
301         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
302         if (!password_s) {
303                 DEBUG(1, (__location__ ": failed to fetch machine password\n"));
304                 ret = -1;
305                 goto out;
306         }
307         ZERO_STRUCT(password);
308         password.data = password_s;
309         password.length = strlen(password_s);
310
311         /* we need the dNSHostName value here */
312         tmpctx = talloc_init(__location__);
313         if (!tmpctx) {
314                 DEBUG(0, (__location__ ": talloc_init() failed!\n"));
315                 ret = -1;
316                 goto out;
317         }
318
319         my_fqdn = ads_get_dnshostname(ads, tmpctx, global_myname());
320         if (!my_fqdn) {
321                 DEBUG(0, (__location__ ": unable to determine machine "
322                           "account's dns name in AD!\n"));
323                 ret = -1;
324                 goto out;
325         }
326
327         machine_name = ads_get_samaccountname(ads, tmpctx, global_myname());
328         if (!machine_name) {
329                 DEBUG(0, (__location__ ": unable to determine machine "
330                           "account's short name in AD!\n"));
331                 ret = -1;
332                 goto out;
333         }
334         /*strip the trailing '$' */
335         machine_name[strlen(machine_name)-1] = '\0';
336
337         /* Construct our principal */
338         if (strchr_m(srvPrinc, '@')) {
339                 /* It's a fully-named principal. */
340                 princ_s = talloc_asprintf(tmpctx, "%s", srvPrinc);
341                 if (!princ_s) {
342                         ret = -1;
343                         goto out;
344                 }
345         } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
346                 /* It's the machine account, as used by smbclient clients. */
347                 princ_s = talloc_asprintf(tmpctx, "%s@%s",
348                                           srvPrinc, lp_realm());
349                 if (!princ_s) {
350                         ret = -1;
351                         goto out;
352                 }
353         } else {
354                 /* It's a normal service principal.  Add the SPN now so that we
355                  * can obtain credentials for it and double-check the salt value
356                  * used to generate the service's keys. */
357
358                 princ_s = talloc_asprintf(tmpctx, "%s/%s@%s",
359                                           srvPrinc, my_fqdn, lp_realm());
360                 if (!princ_s) {
361                         ret = -1;
362                         goto out;
363                 }
364                 short_princ_s = talloc_asprintf(tmpctx, "%s/%s@%s",
365                                                 srvPrinc, machine_name,
366                                                 lp_realm());
367                 if (!princ_s) {
368                         ret = -1;
369                         goto out;
370                 }
371
372                 /* According to http://support.microsoft.com/kb/326985/en-us,
373                    certain principal names are automatically mapped to the
374                    host/... principal in the AD account.
375                    So only create these in the keytab, not in AD.  --jerry */
376
377                 if (!strequal(srvPrinc, "cifs") &&
378                     !strequal(srvPrinc, "host")) {
379                         DEBUG(3, (__location__ ": Attempting to add/update "
380                                   "'%s'\n", princ_s));
381
382                         aderr = ads_add_service_principal_name(ads,
383                                         global_myname(), my_fqdn, srvPrinc);
384                         if (!ADS_ERR_OK(aderr)) {
385                                 DEBUG(1, (__location__ ": failed to "
386                                          "ads_add_service_principal_name.\n"));
387                                 goto out;
388                         }
389                 }
390         }
391
392         kvno = (krb5_kvno)ads_get_machine_kvno(ads, global_myname());
393         if (kvno == -1) {
394                 /* -1 indicates failure, everything else is OK */
395                 DEBUG(1, (__location__ ": ads_get_machine_kvno failed to "
396                          "determine the system's kvno.\n"));
397                 ret = -1;
398                 goto out;
399         }
400
401         /* add the fqdn principal to the keytab */
402         ret = smb_krb5_kt_add_entry(context, keytab, kvno,
403                                     princ_s, enctypes, password,
404                                     false, false);
405         if (ret) {
406                 DEBUG(1, (__location__ ": Failed to add entry to keytab\n"));
407                 goto out;
408         }
409
410         /* add the short principal name if we have one */
411         if (short_princ_s) {
412                 ret = smb_krb5_kt_add_entry(context, keytab, kvno,
413                                             short_princ_s, enctypes, password,
414                                             false, false);
415                 if (ret) {
416                         DEBUG(1, (__location__
417                                   ": Failed to add short entry to keytab\n"));
418                         goto out;
419                 }
420         }
421
422 out:
423         TALLOC_FREE(tmpctx);
424
425         if (keytab) {
426                 krb5_kt_close(context, keytab);
427         }
428         if (context) {
429                 krb5_free_context(context);
430         }
431         return (int)ret;
432 }
433
434 /**********************************************************************
435  Flushes all entries from the system keytab.
436 ***********************************************************************/
437
438 int ads_keytab_flush(ADS_STRUCT *ads)
439 {
440         krb5_error_code ret = 0;
441         krb5_context context = NULL;
442         krb5_keytab keytab = NULL;
443         krb5_kvno kvno;
444         ADS_STATUS aderr;
445
446         initialize_krb5_error_table();
447         ret = krb5_init_context(&context);
448         if (ret) {
449                 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
450                           error_message(ret)));
451                 return ret;
452         }
453
454         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
455         if (ret) {
456                 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
457                           error_message(ret)));
458                 goto out;
459         }
460
461         kvno = (krb5_kvno)ads_get_machine_kvno(ads, global_myname());
462         if (kvno == -1) {
463                 /* -1 indicates a failure */
464                 DEBUG(1, (__location__ ": Error determining the kvno.\n"));
465                 goto out;
466         }
467
468         /* Seek and delete old keytab entries */
469         ret = seek_and_delete_old_entries(context, keytab, kvno,
470                                           NULL, NULL, true, false);
471         if (ret) {
472                 goto out;
473         }
474
475         aderr = ads_clear_service_principal_names(ads, global_myname());
476         if (!ADS_ERR_OK(aderr)) {
477                 DEBUG(1, (__location__ ": Error while clearing service "
478                           "principal listings in LDAP.\n"));
479                 goto out;
480         }
481
482 out:
483         if (keytab) {
484                 krb5_kt_close(context, keytab);
485         }
486         if (context) {
487                 krb5_free_context(context);
488         }
489         return ret;
490 }
491
492 /**********************************************************************
493  Adds all the required service principals to the system keytab.
494 ***********************************************************************/
495
496 int ads_keytab_create_default(ADS_STRUCT *ads)
497 {
498         krb5_error_code ret = 0;
499         krb5_context context = NULL;
500         krb5_keytab keytab = NULL;
501         krb5_kt_cursor cursor;
502         krb5_keytab_entry kt_entry;
503         krb5_kvno kvno;
504         int i, found = 0;
505         char *sam_account_name, *upn;
506         char **oldEntries = NULL, *princ_s[26];
507         TALLOC_CTX *tmpctx = NULL;
508         char *machine_name;
509
510         /* these are the main ones we need */
511         ret = ads_keytab_add_entry(ads, "host");
512         if (ret != 0) {
513                 DEBUG(1, (__location__ ": ads_keytab_add_entry failed while "
514                           "adding 'host' principal.\n"));
515                 return ret;
516         }
517
518
519 #if 0   /* don't create the CIFS/... keytab entries since no one except smbd
520            really needs them and we will fall back to verifying against
521            secrets.tdb */
522
523         ret = ads_keytab_add_entry(ads, "cifs"));
524         if (ret != 0 ) {
525                 DEBUG(1, (__location__ ": ads_keytab_add_entry failed while "
526                           "adding 'cifs'.\n"));
527                 return ret;
528         }
529 #endif
530
531         memset(princ_s, '\0', sizeof(princ_s));
532         ZERO_STRUCT(kt_entry);
533         ZERO_STRUCT(cursor);
534
535         initialize_krb5_error_table();
536         ret = krb5_init_context(&context);
537         if (ret) {
538                 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
539                           error_message(ret)));
540                 return ret;
541         }
542
543         tmpctx = talloc_init(__location__);
544         if (!tmpctx) {
545                 DEBUG(0, (__location__ ": talloc_init() failed!\n"));
546                 ret = -1;
547                 goto done;
548         }
549
550         machine_name = talloc_strdup(tmpctx, global_myname());
551         if (!machine_name) {
552                 ret = -1;
553                 goto done;
554         }
555
556         /* now add the userPrincipalName and sAMAccountName entries */
557         sam_account_name = ads_get_samaccountname(ads, tmpctx, machine_name);
558         if (!sam_account_name) {
559                 DEBUG(0, (__location__ ": unable to determine machine "
560                           "account's name in AD!\n"));
561                 ret = -1;
562                 goto done;
563         }
564
565         /* upper case the sAMAccountName to make it easier for apps to
566            know what case to use in the keytab file */
567         strupper_m(sam_account_name);
568
569         ret = ads_keytab_add_entry(ads, sam_account_name);
570         if (ret != 0) {
571                 DEBUG(1, (__location__ ": ads_keytab_add_entry() failed "
572                           "while adding sAMAccountName (%s)\n",
573                           sam_account_name));
574                 goto done;
575         }
576
577         /* remember that not every machine account will have a upn */
578         upn = ads_get_upn(ads, tmpctx, machine_name);
579         if (upn) {
580                 ret = ads_keytab_add_entry(ads, upn);
581                 if (ret != 0) {
582                         DEBUG(1, (__location__ ": ads_keytab_add_entry() "
583                                   "failed while adding UPN (%s)\n", upn));
584                         goto done;
585                 }
586         }
587
588         /* Now loop through the keytab and update any other existing entries */
589         kvno = (krb5_kvno)ads_get_machine_kvno(ads, machine_name);
590         if (kvno == -1) {
591                 DEBUG(1, (__location__ ": ads_get_machine_kvno() failed to "
592                           "determine the system's kvno.\n"));
593                 goto done;
594         }
595
596         DEBUG(3, (__location__ ": Searching for keytab entries to preserve "
597                   "and update.\n"));
598
599         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
600         if (ret) {
601                 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
602                           error_message(ret)));
603                 goto done;
604         }
605
606         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
607         if (ret != KRB5_KT_END && ret != ENOENT ) {
608                 while ((ret = krb5_kt_next_entry(context, keytab,
609                                                  &kt_entry, &cursor)) == 0) {
610                         smb_krb5_kt_free_entry(context, &kt_entry);
611                         ZERO_STRUCT(kt_entry);
612                         found++;
613                 }
614         }
615         krb5_kt_end_seq_get(context, keytab, &cursor);
616         ZERO_STRUCT(cursor);
617
618         /*
619          * Hmmm. There is no "rewind" function for the keytab. This means we
620          * have a race condition where someone else could add entries after
621          * we've counted them. Re-open asap to minimise the race. JRA.
622          */
623         DEBUG(3, (__location__ ": Found %d entries in the keytab.\n", found));
624         if (!found) {
625                 goto done;
626         }
627
628         oldEntries = talloc_array(tmpctx, char *, found);
629         if (!oldEntries) {
630                 DEBUG(1, (__location__ ": Failed to allocate space to store "
631                           "the old keytab entries (talloc failed?).\n"));
632                 ret = -1;
633                 goto done;
634         }
635         memset(oldEntries, '\0', found * sizeof(char *));
636
637         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
638         if (ret == KRB5_KT_END || ret == ENOENT) {
639                 krb5_kt_end_seq_get(context, keytab, &cursor);
640                 ZERO_STRUCT(cursor);
641                 goto done;
642         }
643
644         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
645                 if (kt_entry.vno != kvno) {
646                         char *ktprinc = NULL;
647                         char *p;
648
649                         /* This returns a malloc'ed string in ktprinc. */
650                         ret = smb_krb5_unparse_name(oldEntries, context,
651                                                     kt_entry.principal,
652                                                     &ktprinc);
653                         if (ret) {
654                                 DEBUG(1, (__location__
655                                          ": smb_krb5_unparse_name failed "
656                                          "(%s)\n", error_message(ret)));
657                                 goto done;
658                         }
659                         /*
660                          * From looking at the krb5 source they don't seem to
661                          * take locale or mb strings into account.
662                          * Maybe this is because they assume utf8 ?
663                          * In this case we may need to convert from utf8 to
664                          * mb charset here ? JRA.
665                          */
666                         p = strchr_m(ktprinc, '@');
667                         if (p) {
668                                 *p = '\0';
669                         }
670
671                         p = strchr_m(ktprinc, '/');
672                         if (p) {
673                                 *p = '\0';
674                         }
675                         for (i = 0; i < found; i++) {
676                                 if (!oldEntries[i]) {
677                                         oldEntries[i] = ktprinc;
678                                         break;
679                                 }
680                                 if (!strcmp(oldEntries[i], ktprinc)) {
681                                         TALLOC_FREE(ktprinc);
682                                         break;
683                                 }
684                         }
685                         if (i == found) {
686                                 TALLOC_FREE(ktprinc);
687                         }
688                 }
689                 smb_krb5_kt_free_entry(context, &kt_entry);
690                 ZERO_STRUCT(kt_entry);
691         }
692         ret = 0;
693         for (i = 0; oldEntries[i]; i++) {
694                 ret |= ads_keytab_add_entry(ads, oldEntries[i]);
695                 TALLOC_FREE(oldEntries[i]);
696         }
697         krb5_kt_end_seq_get(context, keytab, &cursor);
698         ZERO_STRUCT(cursor);
699
700 done:
701         TALLOC_FREE(oldEntries);
702         TALLOC_FREE(tmpctx);
703
704         {
705                 krb5_keytab_entry zero_kt_entry;
706                 ZERO_STRUCT(zero_kt_entry);
707                 if (memcmp(&zero_kt_entry, &kt_entry,
708                                 sizeof(krb5_keytab_entry))) {
709                         smb_krb5_kt_free_entry(context, &kt_entry);
710                 }
711         }
712         {
713                 krb5_kt_cursor zero_csr;
714                 ZERO_STRUCT(zero_csr);
715                 if ((memcmp(&cursor, &zero_csr,
716                                 sizeof(krb5_kt_cursor)) != 0) && keytab) {
717                         krb5_kt_end_seq_get(context, keytab, &cursor);
718                 }
719         }
720         if (keytab) {
721                 krb5_kt_close(context, keytab);
722         }
723         if (context) {
724                 krb5_free_context(context);
725         }
726         return ret;
727 }
728
729 #endif /* HAVE_ADS */
730
731 /**********************************************************************
732  List system keytab.
733 ***********************************************************************/
734
735 int ads_keytab_list(const char *keytab_name)
736 {
737         krb5_error_code ret = 0;
738         krb5_context context = NULL;
739         krb5_keytab keytab = NULL;
740         krb5_kt_cursor cursor;
741         krb5_keytab_entry kt_entry;
742
743         ZERO_STRUCT(kt_entry);
744         ZERO_STRUCT(cursor);
745
746         initialize_krb5_error_table();
747         ret = krb5_init_context(&context);
748         if (ret) {
749                 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
750                           error_message(ret)));
751                 return ret;
752         }
753
754         ret = smb_krb5_open_keytab(context, keytab_name, False, &keytab);
755         if (ret) {
756                 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
757                           error_message(ret)));
758                 goto out;
759         }
760
761         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
762         if (ret) {
763                 ZERO_STRUCT(cursor);
764                 goto out;
765         }
766
767         printf("Vno  Type        Principal\n");
768
769         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
770
771                 char *princ_s = NULL;
772                 char *etype_s = NULL;
773                 krb5_enctype enctype = 0;
774
775                 ret = smb_krb5_unparse_name(talloc_tos(), context,
776                                             kt_entry.principal, &princ_s);
777                 if (ret) {
778                         goto out;
779                 }
780
781                 enctype = smb_get_enctype_from_kt_entry(&kt_entry);
782
783                 ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
784                 if (ret &&
785                     (asprintf(&etype_s, "UNKNOWN: %d\n", enctype) == -1)) {
786                         TALLOC_FREE(princ_s);
787                         goto out;
788                 }
789
790                 printf("%3d  %s\t\t %s\n", kt_entry.vno, etype_s, princ_s);
791
792                 TALLOC_FREE(princ_s);
793                 SAFE_FREE(etype_s);
794
795                 ret = smb_krb5_kt_free_entry(context, &kt_entry);
796                 if (ret) {
797                         goto out;
798                 }
799         }
800
801         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
802         if (ret) {
803                 goto out;
804         }
805
806         /* Ensure we don't double free. */
807         ZERO_STRUCT(kt_entry);
808         ZERO_STRUCT(cursor);
809 out:
810
811         {
812                 krb5_keytab_entry zero_kt_entry;
813                 ZERO_STRUCT(zero_kt_entry);
814                 if (memcmp(&zero_kt_entry, &kt_entry,
815                                 sizeof(krb5_keytab_entry))) {
816                         smb_krb5_kt_free_entry(context, &kt_entry);
817                 }
818         }
819         {
820                 krb5_kt_cursor zero_csr;
821                 ZERO_STRUCT(zero_csr);
822                 if ((memcmp(&cursor, &zero_csr,
823                                 sizeof(krb5_kt_cursor)) != 0) && keytab) {
824                         krb5_kt_end_seq_get(context, keytab, &cursor);
825                 }
826         }
827
828         if (keytab) {
829                 krb5_kt_close(context, keytab);
830         }
831         if (context) {
832                 krb5_free_context(context);
833         }
834         return ret;
835 }
836
837 #endif /* HAVE_KRB5 */