source3/libads/kerberos_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos keytab utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Luke Howard 2003
   7    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
   8    Copyright (C) Guenther Deschner 2003
   9    Copyright (C) Rakesh Patel 2004
  10    Copyright (C) Dan Perry 2004
  11    Copyright (C) Jeremy Allison 2004
  12    Copyright (C) Gerald Carter 2006
  13
  14    This program is free software; you can redistribute it and/or modify
  15    it under the terms of the GNU General Public License as published by
  16    the Free Software Foundation; either version 3 of the License, or
  17    (at your option) any later version.
  18
  19    This program is distributed in the hope that it will be useful,
  20    but WITHOUT ANY WARRANTY; without even the implied warranty of
  21    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22    GNU General Public License for more details.
  23
  24    You should have received a copy of the GNU General Public License
  25    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  26 */
  27
  28 #include "includes.h"
  29 #include "smb_krb5.h"
  30 #include "ads.h"
  31
  32 #ifdef HAVE_KRB5
  33
  34 /**********************************************************************
  35 **********************************************************************/
  36
  37 int smb_krb5_kt_add_entry_ext(krb5_context context,
  38                               krb5_keytab keytab,
  39                               krb5_kvno kvno,
  40                               const char *princ_s,
  41                               krb5_enctype *enctypes,
  42                               krb5_data password,
  43                               bool no_salt,
  44                               bool keep_old_entries)
  45 {
  46         krb5_error_code ret = 0;
  47         krb5_kt_cursor cursor;
  48         krb5_keytab_entry kt_entry;
  49         krb5_principal princ = NULL;
  50         int i;
  51         char *ktprinc = NULL;
  52
  53         ZERO_STRUCT(kt_entry);
  54         ZERO_STRUCT(cursor);
  55
  56         ret = smb_krb5_parse_name(context, princ_s, &princ);
  57         if (ret) {
  58                 DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_parse_name(%s) failed (%s)\n", princ_s, error_message(ret)));
  59                 goto out;
  60         }
  61
  62         /* Seek and delete old keytab entries */
  63         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
  64         if (ret != KRB5_KT_END && ret != ENOENT ) {
  65                 DEBUG(3,("smb_krb5_kt_add_entry_ext: Will try to delete old keytab entries\n"));
  66                 while(!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
  67                         bool compare_name_ok = False;
  68
  69                         ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal, &ktprinc);
  70                         if (ret) {
  71                                 DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_unparse_name failed (%s)\n",
  72                                         error_message(ret)));
  73                                 goto out;
  74                         }
  75
  76                         /*---------------------------------------------------------------------------
  77                          * Save the entries with kvno - 1.   This is what microsoft does
  78                          * to allow people with existing sessions that have kvno - 1 to still
  79                          * work.   Otherwise, when the password for the machine changes, all
  80                          * kerberizied sessions will 'break' until either the client reboots or
  81                          * the client's session key expires and they get a new session ticket
  82                          * with the new kvno.
  83                          */
  84
  85 #ifdef HAVE_KRB5_KT_COMPARE
  86                         compare_name_ok = (krb5_kt_compare(context, &kt_entry, princ, 0, 0) == True);
  87 #else
  88                         compare_name_ok = (strcmp(ktprinc, princ_s) == 0);
  89 #endif
  90
  91                         if (!compare_name_ok) {
  92                                 DEBUG(10,("smb_krb5_kt_add_entry_ext: ignoring keytab entry principal %s, kvno = %d\n",
  93                                         ktprinc, kt_entry.vno));
  94                         }
  95
  96                         TALLOC_FREE(ktprinc);
  97
  98                         if (compare_name_ok) {
  99                                 if (kt_entry.vno == kvno - 1) {
 100                                         DEBUG(5,("smb_krb5_kt_add_entry_ext: Saving previous (kvno %d) entry for principal: %s.\n",
 101                                                 kvno - 1, princ_s));
 102                                 } else if (!keep_old_entries) {
 103                                         DEBUG(5,("smb_krb5_kt_add_entry_ext: Found old entry for principal: %s (kvno %d) - trying to remove it.\n",
 104                                                 princ_s, kt_entry.vno));
 105                                         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 106                                         ZERO_STRUCT(cursor);
 107                                         if (ret) {
 108                                                 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_end_seq_get() failed (%s)\n",
 109                                                         error_message(ret)));
 110                                                 goto out;
 111                                         }
 112                                         ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
 113                                         if (ret) {
 114                                                 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_remove_entry failed (%s)\n",
 115                                                         error_message(ret)));
 116                                                 goto out;
 117                                         }
 118
 119                                         DEBUG(5,("smb_krb5_kt_add_entry_ext: removed old entry for principal: %s (kvno %d).\n",
 120                                                 princ_s, kt_entry.vno));
 121
 122                                         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 123                                         if (ret) {
 124                                                 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_start_seq failed (%s)\n",
 125                                                         error_message(ret)));
 126                                                 goto out;
 127                                         }
 128                                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
 129                                         ZERO_STRUCT(kt_entry);
 130                                         if (ret) {
 131                                                 DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_remove_entry failed (%s)\n",
 132                                                         error_message(ret)));
 133                                                 goto out;
 134                                         }
 135                                         continue;
 136                                 }
 137                         }
 138
 139                         /* Not a match, just free this entry and continue. */
 140                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
 141                         ZERO_STRUCT(kt_entry);
 142                         if (ret) {
 143                                 DEBUG(1,("smb_krb5_kt_add_entry_ext: smb_krb5_kt_free_entry failed (%s)\n", error_message(ret)));
 144                                 goto out;
 145                         }
 146                 }
 147
 148                 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 149                 ZERO_STRUCT(cursor);
 150                 if (ret) {
 151                         DEBUG(1,("smb_krb5_kt_add_entry_ext: krb5_kt_end_seq_get failed (%s)\n",error_message(ret)));
 152                         goto out;
 153                 }
 154         }
 155
 156         /* Ensure we don't double free. */
 157         ZERO_STRUCT(kt_entry);
 158         ZERO_STRUCT(cursor);
 159
 160         /* If we get here, we have deleted all the old entries with kvno's not equal to the current kvno-1. */
 161
 162         /* Now add keytab entries for all encryption types */
 163         for (i = 0; enctypes[i]; i++) {
 164                 krb5_keyblock *keyp;
 165
 166                 keyp = KRB5_KT_KEY(&kt_entry);
 167
 168                 if (create_kerberos_key_from_string(context, princ, &password, keyp, enctypes[i], no_salt)) {
 169                         continue;
 170                 }
 171
 172                 kt_entry.principal = princ;
 173                 kt_entry.vno       = kvno;
 174
 175                 DEBUG(3,("smb_krb5_kt_add_entry_ext: adding keytab entry for (%s) with encryption type (%d) and version (%d)\n",
 176                         princ_s, enctypes[i], kt_entry.vno));
 177                 ret = krb5_kt_add_entry(context, keytab, &kt_entry);
 178                 krb5_free_keyblock_contents(context, keyp);
 179                 ZERO_STRUCT(kt_entry);
 180                 if (ret) {
 181                         DEBUG(1,("smb_krb5_kt_add_entry_ext: adding entry to keytab failed (%s)\n", error_message(ret)));
 182                         goto out;
 183                 }
 184         }
 185
 186
 187 out:
 188         {
 189                 krb5_keytab_entry zero_kt_entry;
 190                 ZERO_STRUCT(zero_kt_entry);
 191                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 192                         smb_krb5_kt_free_entry(context, &kt_entry);
 193                 }
 194         }
 195         if (princ) {
 196                 krb5_free_principal(context, princ);
 197         }
 198
 199         {
 200                 krb5_kt_cursor zero_csr;
 201                 ZERO_STRUCT(zero_csr);
 202                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 203                         krb5_kt_end_seq_get(context, keytab, &cursor);
 204                 }
 205         }
 206
 207         return (int)ret;
 208 }
 209
 210 static int smb_krb5_kt_add_entry(krb5_context context,
 211                                  krb5_keytab keytab,
 212                                  krb5_kvno kvno,
 213                                  const char *princ_s,
 214                                  krb5_enctype *enctypes,
 215                                  krb5_data password)
 216 {
 217         return smb_krb5_kt_add_entry_ext(context,
 218                                          keytab,
 219                                          kvno,
 220                                          princ_s,
 221                                          enctypes,
 222                                          password,
 223                                          false,
 224                                          false);
 225 }
 226
 227 /**********************************************************************
 228  Adds a single service principal, i.e. 'host' to the system keytab
 229 ***********************************************************************/
 230
 231 int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
 232 {
 233         krb5_error_code ret = 0;
 234         krb5_context context = NULL;
 235         krb5_keytab keytab = NULL;
 236         krb5_data password;
 237         krb5_kvno kvno;
 238         krb5_enctype enctypes[4] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, 0, 0 };
 239         char *princ_s = NULL, *short_princ_s = NULL;
 240         char *password_s = NULL;
 241         char *my_fqdn;
 242         TALLOC_CTX *ctx = NULL;
 243         char *machine_name;
 244
 245 #if defined(ENCTYPE_ARCFOUR_HMAC)
 246         enctypes[2] = ENCTYPE_ARCFOUR_HMAC;
 247 #endif
 248
 249         initialize_krb5_error_table();
 250         ret = krb5_init_context(&context);
 251         if (ret) {
 252                 DEBUG(1,("ads_keytab_add_entry: could not krb5_init_context: %s\n",error_message(ret)));
 253                 return -1;
 254         }
 255
 256         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
 257         if (ret) {
 258                 DEBUG(1,("ads_keytab_add_entry: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 259                 goto out;
 260         }
 261
 262         /* retrieve the password */
 263         if (!secrets_init()) {
 264                 DEBUG(1,("ads_keytab_add_entry: secrets_init failed\n"));
 265                 ret = -1;
 266                 goto out;
 267         }
 268         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 269         if (!password_s) {
 270                 DEBUG(1,("ads_keytab_add_entry: failed to fetch machine password\n"));
 271                 ret = -1;
 272                 goto out;
 273         }
 274         ZERO_STRUCT(password);
 275         password.data = password_s;
 276         password.length = strlen(password_s);
 277
 278         /* we need the dNSHostName value here */
 279
 280         if ( (ctx = talloc_init("ads_keytab_add_entry")) == NULL ) {
 281                 DEBUG(0,("ads_keytab_add_entry: talloc() failed!\n"));
 282                 ret = -1;
 283                 goto out;
 284         }
 285
 286         if ( (my_fqdn = ads_get_dnshostname( ads, ctx, global_myname())) == NULL ) {
 287                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's dns name in AD!\n"));
 288                 ret = -1;
 289                 goto out;
 290         }
 291
 292         if ( (machine_name = ads_get_samaccountname( ads, ctx, global_myname())) == NULL ) {
 293                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's short name in AD!\n"));
 294                 ret = -1;
 295                 goto out;
 296         }
 297         /*strip the trailing '$' */
 298         machine_name[strlen(machine_name)-1] = '\0';
 299
 300         /* Construct our principal */
 301
 302         if (strchr_m(srvPrinc, '@')) {
 303                 /* It's a fully-named principal. */
 304                 if (asprintf(&princ_s, "%s", srvPrinc) == -1) {
 305                         ret = -1;
 306                         goto out;
 307                 }
 308         } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
 309                 /* It's the machine account, as used by smbclient clients. */
 310                 if (asprintf(&princ_s, "%s@%s", srvPrinc, lp_realm()) == -1) {
 311                         ret = -1;
 312                         goto out;
 313                 }
 314         } else {
 315                 /* It's a normal service principal.  Add the SPN now so that we
 316                  * can obtain credentials for it and double-check the salt value
 317                  * used to generate the service's keys. */
 318
 319                 if (asprintf(&princ_s, "%s/%s@%s", srvPrinc, my_fqdn, lp_realm()) == -1) {
 320                         ret = -1;
 321                         goto out;
 322                 }
 323                 if (asprintf(&short_princ_s, "%s/%s@%s", srvPrinc, machine_name, lp_realm()) == -1) {
 324                         ret = -1;
 325                         goto out;
 326                 }
 327
 328                 /* According to http://support.microsoft.com/kb/326985/en-us,
 329                    certain principal names are automatically mapped to the host/...
 330                    principal in the AD account.  So only create these in the
 331                    keytab, not in AD.  --jerry */
 332
 333                 if ( !strequal( srvPrinc, "cifs" ) && !strequal(srvPrinc, "host" ) ) {
 334                         DEBUG(3,("ads_keytab_add_entry: Attempting to add/update '%s'\n", princ_s));
 335
 336                         if (!ADS_ERR_OK(ads_add_service_principal_name(ads, global_myname(), my_fqdn, srvPrinc))) {
 337                                 DEBUG(1,("ads_keytab_add_entry: ads_add_service_principal_name failed.\n"));
 338                                 goto out;
 339                         }
 340                 }
 341         }
 342
 343         kvno = (krb5_kvno) ads_get_machine_kvno(ads, global_myname());
 344         if (kvno == -1) {       /* -1 indicates failure, everything else is OK */
 345                 DEBUG(1,("ads_keytab_add_entry: ads_get_machine_kvno failed to determine the system's kvno.\n"));
 346                 ret = -1;
 347                 goto out;
 348         }
 349
 350         /* add the fqdn principal to the keytab */
 351
 352         ret = smb_krb5_kt_add_entry( context, keytab, kvno, princ_s, enctypes, password );
 353         if ( ret ) {
 354                 DEBUG(1,("ads_keytab_add_entry: Failed to add entry to keytab file\n"));
 355                 goto out;
 356         }
 357
 358         /* add the short principal name if we have one */
 359
 360         if ( short_princ_s ) {
 361                 ret = smb_krb5_kt_add_entry( context, keytab, kvno, short_princ_s, enctypes, password );
 362                 if ( ret ) {
 363                         DEBUG(1,("ads_keytab_add_entry: Failed to add short entry to keytab file\n"));
 364                         goto out;
 365                 }
 366         }
 367
 368 out:
 369         SAFE_FREE( princ_s );
 370         SAFE_FREE( short_princ_s );
 371         TALLOC_FREE( ctx );
 372
 373         if (keytab) {
 374                 krb5_kt_close(context, keytab);
 375         }
 376         if (context) {
 377                 krb5_free_context(context);
 378         }
 379         return (int)ret;
 380 }
 381
 382 /**********************************************************************
 383  Flushes all entries from the system keytab.
 384 ***********************************************************************/
 385
 386 int ads_keytab_flush(ADS_STRUCT *ads)
 387 {
 388         krb5_error_code ret = 0;
 389         krb5_context context = NULL;
 390         krb5_keytab keytab = NULL;
 391         krb5_kt_cursor cursor;
 392         krb5_keytab_entry kt_entry;
 393         krb5_kvno kvno;
 394
 395         ZERO_STRUCT(kt_entry);
 396         ZERO_STRUCT(cursor);
 397
 398         initialize_krb5_error_table();
 399         ret = krb5_init_context(&context);
 400         if (ret) {
 401                 DEBUG(1,("ads_keytab_flush: could not krb5_init_context: %s\n",error_message(ret)));
 402                 return ret;
 403         }
 404
 405         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
 406         if (ret) {
 407                 DEBUG(1,("ads_keytab_flush: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 408                 goto out;
 409         }
 410
 411         kvno = (krb5_kvno) ads_get_machine_kvno(ads, global_myname());
 412         if (kvno == -1) {       /* -1 indicates a failure */
 413                 DEBUG(1,("ads_keytab_flush: Error determining the system's kvno.\n"));
 414                 goto out;
 415         }
 416
 417         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 418         if (ret != KRB5_KT_END && ret != ENOENT) {
 419                 while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
 420                         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 421                         ZERO_STRUCT(cursor);
 422                         if (ret) {
 423                                 DEBUG(1,("ads_keytab_flush: krb5_kt_end_seq_get() failed (%s)\n",error_message(ret)));
 424                                 goto out;
 425                         }
 426                         ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
 427                         if (ret) {
 428                                 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
 429                                 goto out;
 430                         }
 431                         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 432                         if (ret) {
 433                                 DEBUG(1,("ads_keytab_flush: krb5_kt_start_seq failed (%s)\n",error_message(ret)));
 434                                 goto out;
 435                         }
 436                         ret = smb_krb5_kt_free_entry(context, &kt_entry);
 437                         ZERO_STRUCT(kt_entry);
 438                         if (ret) {
 439                                 DEBUG(1,("ads_keytab_flush: krb5_kt_remove_entry failed (%s)\n",error_message(ret)));
 440                                 goto out;
 441                         }
 442                 }
 443         }
 444
 445         /* Ensure we don't double free. */
 446         ZERO_STRUCT(kt_entry);
 447         ZERO_STRUCT(cursor);
 448
 449         if (!ADS_ERR_OK(ads_clear_service_principal_names(ads, global_myname()))) {
 450                 DEBUG(1,("ads_keytab_flush: Error while clearing service principal listings in LDAP.\n"));
 451                 goto out;
 452         }
 453
 454 out:
 455
 456         {
 457                 krb5_keytab_entry zero_kt_entry;
 458                 ZERO_STRUCT(zero_kt_entry);
 459                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 460                         smb_krb5_kt_free_entry(context, &kt_entry);
 461                 }
 462         }
 463         {
 464                 krb5_kt_cursor zero_csr;
 465                 ZERO_STRUCT(zero_csr);
 466                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 467                         krb5_kt_end_seq_get(context, keytab, &cursor);
 468                 }
 469         }
 470         if (keytab) {
 471                 krb5_kt_close(context, keytab);
 472         }
 473         if (context) {
 474                 krb5_free_context(context);
 475         }
 476         return ret;
 477 }
 478
 479 /**********************************************************************
 480  Adds all the required service principals to the system keytab.
 481 ***********************************************************************/
 482
 483 int ads_keytab_create_default(ADS_STRUCT *ads)
 484 {
 485         krb5_error_code ret = 0;
 486         krb5_context context = NULL;
 487         krb5_keytab keytab = NULL;
 488         krb5_kt_cursor cursor;
 489         krb5_keytab_entry kt_entry;
 490         krb5_kvno kvno;
 491         int i, found = 0;
 492         char *sam_account_name, *upn;
 493         char **oldEntries = NULL, *princ_s[26];
 494         TALLOC_CTX *ctx = NULL;
 495         fstring machine_name;
 496
 497         memset(princ_s, '\0', sizeof(princ_s));
 498
 499         fstrcpy( machine_name, global_myname() );
 500
 501         /* these are the main ones we need */
 502
 503         if ( (ret = ads_keytab_add_entry(ads, "host") ) != 0 ) {
 504                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'host'.\n"));
 505                 return ret;
 506         }
 507
 508
 509 #if 0   /* don't create the CIFS/... keytab entries since no one except smbd
 510            really needs them and we will fall back to verifying against secrets.tdb */
 511
 512         if ( (ret = ads_keytab_add_entry(ads, "cifs")) != 0 ) {
 513                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding 'cifs'.\n"));
 514                 return ret;
 515         }
 516 #endif
 517
 518         if ( (ctx = talloc_init("ads_keytab_create_default")) == NULL ) {
 519                 DEBUG(0,("ads_keytab_create_default: talloc() failed!\n"));
 520                 return -1;
 521         }
 522
 523         /* now add the userPrincipalName and sAMAccountName entries */
 524
 525         if ( (sam_account_name = ads_get_samaccountname( ads, ctx, machine_name)) == NULL ) {
 526                 DEBUG(0,("ads_keytab_add_entry: unable to determine machine account's name in AD!\n"));
 527                 TALLOC_FREE( ctx );
 528                 return -1;
 529         }
 530
 531         /* upper case the sAMAccountName to make it easier for apps to
 532            know what case to use in the keytab file */
 533
 534         strupper_m( sam_account_name );
 535
 536         if ( (ret = ads_keytab_add_entry(ads, sam_account_name )) != 0 ) {
 537                 DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding sAMAccountName (%s)\n",
 538                         sam_account_name));
 539                 return ret;
 540         }
 541
 542         /* remember that not every machine account will have a upn */
 543
 544         upn = ads_get_upn( ads, ctx, machine_name);
 545         if ( upn ) {
 546                 if ( (ret = ads_keytab_add_entry(ads, upn)) != 0 ) {
 547                         DEBUG(1,("ads_keytab_create_default: ads_keytab_add_entry failed while adding UPN (%s)\n",
 548                                 upn));
 549                         TALLOC_FREE( ctx );
 550                         return ret;
 551                 }
 552         }
 553
 554         /* Now loop through the keytab and update any other existing entries... */
 555
 556         kvno = (krb5_kvno) ads_get_machine_kvno(ads, machine_name);
 557         if (kvno == -1) {
 558                 DEBUG(1,("ads_keytab_create_default: ads_get_machine_kvno failed to determine the system's kvno.\n"));
 559                 TALLOC_FREE(ctx);
 560                 return -1;
 561         }
 562
 563         DEBUG(3,("ads_keytab_create_default: Searching for keytab entries to "
 564                 "preserve and update.\n"));
 565
 566         ZERO_STRUCT(kt_entry);
 567         ZERO_STRUCT(cursor);
 568
 569         initialize_krb5_error_table();
 570         ret = krb5_init_context(&context);
 571         if (ret) {
 572                 DEBUG(1,("ads_keytab_create_default: could not krb5_init_context: %s\n",error_message(ret)));
 573                 TALLOC_FREE(ctx);
 574                 return ret;
 575         }
 576
 577         ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
 578         if (ret) {
 579                 DEBUG(1,("ads_keytab_create_default: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 580                 goto done;
 581         }
 582
 583         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 584         if (ret != KRB5_KT_END && ret != ENOENT ) {
 585                 while ((ret = krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) == 0) {
 586                         smb_krb5_kt_free_entry(context, &kt_entry);
 587                         ZERO_STRUCT(kt_entry);
 588                         found++;
 589                 }
 590         }
 591         krb5_kt_end_seq_get(context, keytab, &cursor);
 592         ZERO_STRUCT(cursor);
 593
 594         /*
 595          * Hmmm. There is no "rewind" function for the keytab. This means we have a race condition
 596          * where someone else could add entries after we've counted them. Re-open asap to minimise
 597          * the race. JRA.
 598          */
 599
 600         DEBUG(3, ("ads_keytab_create_default: Found %d entries in the keytab.\n", found));
 601         if (!found) {
 602                 goto done;
 603         }
 604         oldEntries = talloc_array(ctx, char *, found );
 605         if (!oldEntries) {
 606                 DEBUG(1,("ads_keytab_create_default: Failed to allocate space to store the old keytab entries (malloc failed?).\n"));
 607                 ret = -1;
 608                 goto done;
 609         }
 610         memset(oldEntries, '\0', found * sizeof(char *));
 611
 612         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 613         if (ret != KRB5_KT_END && ret != ENOENT ) {
 614                 while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
 615                         if (kt_entry.vno != kvno) {
 616                                 char *ktprinc = NULL;
 617                                 char *p;
 618
 619                                 /* This returns a malloc'ed string in ktprinc. */
 620                                 ret = smb_krb5_unparse_name(oldEntries, context, kt_entry.principal, &ktprinc);
 621                                 if (ret) {
 622                                         DEBUG(1,("smb_krb5_unparse_name failed (%s)\n", error_message(ret)));
 623                                         goto done;
 624                                 }
 625                                 /*
 626                                  * From looking at the krb5 source they don't seem to take locale
 627                                  * or mb strings into account. Maybe this is because they assume utf8 ?
 628                                  * In this case we may need to convert from utf8 to mb charset here ? JRA.
 629                                  */
 630                                 p = strchr_m(ktprinc, '@');
 631                                 if (p) {
 632                                         *p = '\0';
 633                                 }
 634
 635                                 p = strchr_m(ktprinc, '/');
 636                                 if (p) {
 637                                         *p = '\0';
 638                                 }
 639                                 for (i = 0; i < found; i++) {
 640                                         if (!oldEntries[i]) {
 641                                                 oldEntries[i] = ktprinc;
 642                                                 break;
 643                                         }
 644                                         if (!strcmp(oldEntries[i], ktprinc)) {
 645                                                 TALLOC_FREE(ktprinc);
 646                                                 break;
 647                                         }
 648                                 }
 649                                 if (i == found) {
 650                                         TALLOC_FREE(ktprinc);
 651                                 }
 652                         }
 653                         smb_krb5_kt_free_entry(context, &kt_entry);
 654                         ZERO_STRUCT(kt_entry);
 655                 }
 656                 ret = 0;
 657                 for (i = 0; oldEntries[i]; i++) {
 658                         ret |= ads_keytab_add_entry(ads, oldEntries[i]);
 659                         TALLOC_FREE(oldEntries[i]);
 660                 }
 661                 krb5_kt_end_seq_get(context, keytab, &cursor);
 662         }
 663         ZERO_STRUCT(cursor);
 664
 665 done:
 666
 667         TALLOC_FREE(oldEntries);
 668         TALLOC_FREE(ctx);
 669
 670         {
 671                 krb5_keytab_entry zero_kt_entry;
 672                 ZERO_STRUCT(zero_kt_entry);
 673                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 674                         smb_krb5_kt_free_entry(context, &kt_entry);
 675                 }
 676         }
 677         {
 678                 krb5_kt_cursor zero_csr;
 679                 ZERO_STRUCT(zero_csr);
 680                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 681                         krb5_kt_end_seq_get(context, keytab, &cursor);
 682                 }
 683         }
 684         if (keytab) {
 685                 krb5_kt_close(context, keytab);
 686         }
 687         if (context) {
 688                 krb5_free_context(context);
 689         }
 690         return ret;
 691 }
 692
 693 /**********************************************************************
 694  List system keytab.
 695 ***********************************************************************/
 696
 697 int ads_keytab_list(const char *keytab_name)
 698 {
 699         krb5_error_code ret = 0;
 700         krb5_context context = NULL;
 701         krb5_keytab keytab = NULL;
 702         krb5_kt_cursor cursor;
 703         krb5_keytab_entry kt_entry;
 704
 705         ZERO_STRUCT(kt_entry);
 706         ZERO_STRUCT(cursor);
 707
 708         initialize_krb5_error_table();
 709         ret = krb5_init_context(&context);
 710         if (ret) {
 711                 DEBUG(1,("ads_keytab_list: could not krb5_init_context: %s\n",error_message(ret)));
 712                 return ret;
 713         }
 714
 715         ret = smb_krb5_open_keytab(context, keytab_name, False, &keytab);
 716         if (ret) {
 717                 DEBUG(1,("ads_keytab_list: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 718                 goto out;
 719         }
 720
 721         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 722         if (ret) {
 723                 goto out;
 724         }
 725
 726         printf("Vno  Type        Principal\n");
 727
 728         while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
 729
 730                 char *princ_s = NULL;
 731                 char *etype_s = NULL;
 732                 krb5_enctype enctype = 0;
 733
 734                 ret = smb_krb5_unparse_name(talloc_tos(), context, kt_entry.principal, &princ_s);
 735                 if (ret) {
 736                         goto out;
 737                 }
 738
 739                 enctype = smb_get_enctype_from_kt_entry(&kt_entry);
 740
 741                 ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
 742                 if (ret) {
 743                         if (asprintf(&etype_s, "UNKNOWN: %d\n", enctype) == -1)
 744                         {
 745                                 TALLOC_FREE(princ_s);
 746                                 goto out;
 747                         }
 748                 }
 749
 750                 printf("%3d  %s\t\t %s\n", kt_entry.vno, etype_s, princ_s);
 751
 752                 TALLOC_FREE(princ_s);
 753                 SAFE_FREE(etype_s);
 754
 755                 ret = smb_krb5_kt_free_entry(context, &kt_entry);
 756                 if (ret) {
 757                         goto out;
 758                 }
 759         }
 760
 761         ret = krb5_kt_end_seq_get(context, keytab, &cursor);
 762         if (ret) {
 763                 goto out;
 764         }
 765
 766         /* Ensure we don't double free. */
 767         ZERO_STRUCT(kt_entry);
 768         ZERO_STRUCT(cursor);
 769 out:
 770
 771         {
 772                 krb5_keytab_entry zero_kt_entry;
 773                 ZERO_STRUCT(zero_kt_entry);
 774                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 775                         smb_krb5_kt_free_entry(context, &kt_entry);
 776                 }
 777         }
 778         {
 779                 krb5_kt_cursor zero_csr;
 780                 ZERO_STRUCT(zero_csr);
 781                 if ((memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 782                         krb5_kt_end_seq_get(context, keytab, &cursor);
 783                 }
 784         }
 785
 786         if (keytab) {
 787                 krb5_kt_close(context, keytab);
 788         }
 789         if (context) {
 790                 krb5_free_context(context);
 791         }
 792         return ret;
 793 }
 794
 795 #endif /* HAVE_KRB5 */