2 Unix SMB/CIFS implementation.
3 kerberos keytab utility library
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001
6 Copyright (C) Luke Howard 2003
7 Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
8 Copyright (C) Guenther Deschner 2003
9 Copyright (C) Rakesh Patel 2004
10 Copyright (C) Dan Perry 2004
11 Copyright (C) Jeremy Allison 2004
12 Copyright (C) Gerald Carter 2006
14 This program is free software; you can redistribute it and/or modify
15 it under the terms of the GNU General Public License as published by
16 the Free Software Foundation; either version 3 of the License, or
17 (at your option) any later version.
19 This program is distributed in the hope that it will be useful,
20 but WITHOUT ANY WARRANTY; without even the implied warranty of
21 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 GNU General Public License for more details.
24 You should have received a copy of the GNU General Public License
25 along with this program. If not, see <http://www.gnu.org/licenses/>.
35 /**********************************************************************
36 **********************************************************************/
38 static krb5_error_code seek_and_delete_old_entries(krb5_context context,
44 bool keep_old_entries)
47 krb5_kt_cursor cursor;
48 krb5_kt_cursor zero_csr;
49 krb5_keytab_entry kt_entry;
50 krb5_keytab_entry zero_kt_entry;
52 krb5_kvno old_kvno = kvno - 1;
55 ZERO_STRUCT(zero_csr);
56 ZERO_STRUCT(kt_entry);
57 ZERO_STRUCT(zero_kt_entry);
59 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
60 if (ret == KRB5_KT_END || ret == ENOENT ) {
65 DEBUG(3, (__location__ ": Will try to delete old keytab entries\n"));
66 while (!krb5_kt_next_entry(context, keytab, &kt_entry, &cursor)) {
69 if (!flush && (princ_s != NULL)) {
70 ret = smb_krb5_unparse_name(talloc_tos(), context,
74 DEBUG(1, (__location__
75 ": smb_krb5_unparse_name failed "
76 "(%s)\n", error_message(ret)));
80 #ifdef HAVE_KRB5_KT_COMPARE
81 name_ok = krb5_kt_compare(context, &kt_entry,
84 name_ok = (strcmp(ktprinc, princ_s) == 0);
88 DEBUG(10, (__location__ ": ignoring keytab "
89 "entry principal %s, kvno = %d\n",
90 ktprinc, kt_entry.vno));
93 * just free this entry and continue. */
94 ret = smb_krb5_kt_free_entry(context,
96 ZERO_STRUCT(kt_entry);
98 DEBUG(1, (__location__
99 ": smb_krb5_kt_free_entry "
101 error_message(ret)));
105 TALLOC_FREE(ktprinc);
109 TALLOC_FREE(ktprinc);
112 /*------------------------------------------------------------
113 * Save the entries with kvno - 1. This is what microsoft does
114 * to allow people with existing sessions that have kvno - 1
115 * to still work. Otherwise, when the password for the machine
116 * changes, all kerberizied sessions will 'break' until either
117 * the client reboots or the client's session key expires and
118 * they get a new session ticket with the new kvno.
119 * Some keytab files only store the kvno in 8bits, limit
120 * the compare accordingly.
123 if (!flush && ((kt_entry.vno & 0xff) == (old_kvno & 0xff))) {
124 DEBUG(5, (__location__ ": Saving previous (kvno %d) "
125 "entry for principal: %s.\n",
130 if (keep_old_entries) {
131 DEBUG(5, (__location__ ": Saving old (kvno %d) "
132 "entry for principal: %s.\n",
137 DEBUG(5, (__location__ ": Found old entry for principal: %s "
138 "(kvno %d) - trying to remove it.\n",
139 princ_s, kt_entry.vno));
141 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
144 DEBUG(1, (__location__ ": krb5_kt_end_seq_get() "
145 "failed (%s)\n", error_message(ret)));
148 ret = krb5_kt_remove_entry(context, keytab, &kt_entry);
150 DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
151 "failed (%s)\n", error_message(ret)));
155 DEBUG(5, (__location__ ": removed old entry for principal: "
156 "%s (kvno %d).\n", princ_s, kt_entry.vno));
158 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
160 DEBUG(1, (__location__ ": krb5_kt_start_seq() failed "
161 "(%s)\n", error_message(ret)));
164 ret = smb_krb5_kt_free_entry(context, &kt_entry);
165 ZERO_STRUCT(kt_entry);
167 DEBUG(1, (__location__ ": krb5_kt_remove_entry() "
168 "failed (%s)\n", error_message(ret)));
174 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
175 smb_krb5_kt_free_entry(context, &kt_entry);
178 if (memcmp(&cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) {
179 krb5_kt_end_seq_get(context, keytab, &cursor);
186 static int smb_krb5_kt_add_entry(krb5_context context,
190 const char *salt_principal,
191 krb5_enctype enctype,
194 bool keep_old_entries)
197 krb5_keytab_entry kt_entry;
198 krb5_principal princ = NULL;
201 ZERO_STRUCT(kt_entry);
203 ret = smb_krb5_parse_name(context, princ_s, &princ);
205 DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) "
206 "failed (%s)\n", princ_s, error_message(ret)));
210 /* Seek and delete old keytab entries */
211 ret = seek_and_delete_old_entries(context, keytab, kvno,
212 princ_s, princ, false,
218 /* If we get here, we have deleted all the old entries with kvno's
219 * not equal to the current kvno-1. */
221 keyp = KRB5_KT_KEY(&kt_entry);
224 KRB5_KEY_DATA(keyp) = (KRB5_KEY_DATA_CAST *)SMB_MALLOC(password->length);
225 if (KRB5_KEY_DATA(keyp) == NULL) {
229 memcpy(KRB5_KEY_DATA(keyp), password->data, password->length);
230 KRB5_KEY_LENGTH(keyp) = password->length;
231 KRB5_KEY_TYPE(keyp) = enctype;
233 krb5_principal salt_princ = NULL;
235 ret = smb_krb5_parse_name(context, salt_principal, &salt_princ);
237 DBG_WARNING("krb5_parse_name(%s) failed (%s)\n",
238 salt_principal, error_message(ret));
242 ret = smb_krb5_create_key_from_string(context,
248 krb5_free_principal(context, salt_princ);
254 kt_entry.principal = princ;
257 DEBUG(3, (__location__ ": adding keytab entry for (%s) with "
258 "encryption type (%d) and version (%d)\n",
259 princ_s, enctype, kt_entry.vno));
260 ret = krb5_kt_add_entry(context, keytab, &kt_entry);
261 krb5_free_keyblock_contents(context, keyp);
262 ZERO_STRUCT(kt_entry);
264 DEBUG(1, (__location__ ": adding entry to keytab "
265 "failed (%s)\n", error_message(ret)));
271 krb5_free_principal(context, princ);
279 /**********************************************************************
280 Adds a single service principal, i.e. 'host' to the system keytab
281 ***********************************************************************/
283 int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc)
285 krb5_error_code ret = 0;
286 krb5_context context = NULL;
287 krb5_keytab keytab = NULL;
290 krb5_enctype enctypes[6] = {
293 #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
294 ENCTYPE_AES128_CTS_HMAC_SHA1_96,
296 #ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
297 ENCTYPE_AES256_CTS_HMAC_SHA1_96,
299 ENCTYPE_ARCFOUR_HMAC,
302 char *princ_s = NULL;
303 char *short_princ_s = NULL;
304 char *salt_princ_s = NULL;
305 char *password_s = NULL;
307 TALLOC_CTX *tmpctx = NULL;
312 initialize_krb5_error_table();
313 ret = krb5_init_context(&context);
315 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
316 error_message(ret)));
320 ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
322 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
323 error_message(ret)));
327 /* retrieve the password */
328 if (!secrets_init()) {
329 DEBUG(1, (__location__ ": secrets_init failed\n"));
333 password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
335 DEBUG(1, (__location__ ": failed to fetch machine password\n"));
339 ZERO_STRUCT(password);
340 password.data = password_s;
341 password.length = strlen(password_s);
343 /* we need the dNSHostName value here */
344 tmpctx = talloc_init(__location__);
346 DEBUG(0, (__location__ ": talloc_init() failed!\n"));
351 my_fqdn = ads_get_dnshostname(ads, tmpctx, lp_netbios_name());
353 DEBUG(0, (__location__ ": unable to determine machine "
354 "account's dns name in AD!\n"));
359 machine_name = ads_get_samaccountname(ads, tmpctx, lp_netbios_name());
361 DEBUG(0, (__location__ ": unable to determine machine "
362 "account's short name in AD!\n"));
366 /*strip the trailing '$' */
367 machine_name[strlen(machine_name)-1] = '\0';
369 /* Construct our principal */
370 if (strchr_m(srvPrinc, '@')) {
371 /* It's a fully-named principal. */
372 princ_s = talloc_asprintf(tmpctx, "%s", srvPrinc);
377 } else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
378 /* It's the machine account, as used by smbclient clients. */
379 princ_s = talloc_asprintf(tmpctx, "%s@%s",
380 srvPrinc, lp_realm());
386 /* It's a normal service principal. Add the SPN now so that we
387 * can obtain credentials for it and double-check the salt value
388 * used to generate the service's keys. */
390 princ_s = talloc_asprintf(tmpctx, "%s/%s@%s",
391 srvPrinc, my_fqdn, lp_realm());
396 short_princ_s = talloc_asprintf(tmpctx, "%s/%s@%s",
397 srvPrinc, machine_name,
399 if (short_princ_s == NULL) {
404 /* According to http://support.microsoft.com/kb/326985/en-us,
405 certain principal names are automatically mapped to the
406 host/... principal in the AD account.
407 So only create these in the keytab, not in AD. --jerry */
409 if (!strequal(srvPrinc, "cifs") &&
410 !strequal(srvPrinc, "host")) {
411 DEBUG(3, (__location__ ": Attempting to add/update "
414 aderr = ads_add_service_principal_name(ads,
415 lp_netbios_name(), my_fqdn, srvPrinc);
416 if (!ADS_ERR_OK(aderr)) {
417 DEBUG(1, (__location__ ": failed to "
418 "ads_add_service_principal_name.\n"));
424 kvno = (krb5_kvno)ads_get_machine_kvno(ads, lp_netbios_name());
426 /* -1 indicates failure, everything else is OK */
427 DEBUG(1, (__location__ ": ads_get_machine_kvno failed to "
428 "determine the system's kvno.\n"));
433 for (i = 0; enctypes[i]; i++) {
434 salt_princ_s = kerberos_fetch_salt_princ_for_host_princ(context,
438 /* add the fqdn principal to the keytab */
439 ret = smb_krb5_kt_add_entry(context,
449 DEBUG(1, (__location__ ": Failed to add entry to keytab\n"));
450 SAFE_FREE(salt_princ_s);
454 /* add the short principal name if we have one */
456 ret = smb_krb5_kt_add_entry(context,
466 DEBUG(1, (__location__
467 ": Failed to add short entry to keytab\n"));
468 SAFE_FREE(salt_princ_s);
472 SAFE_FREE(salt_princ_s);
479 krb5_kt_close(context, keytab);
482 krb5_free_context(context);
487 /**********************************************************************
488 Flushes all entries from the system keytab.
489 ***********************************************************************/
491 int ads_keytab_flush(ADS_STRUCT *ads)
493 krb5_error_code ret = 0;
494 krb5_context context = NULL;
495 krb5_keytab keytab = NULL;
499 initialize_krb5_error_table();
500 ret = krb5_init_context(&context);
502 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
503 error_message(ret)));
507 ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
509 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
510 error_message(ret)));
514 kvno = (krb5_kvno)ads_get_machine_kvno(ads, lp_netbios_name());
516 /* -1 indicates a failure */
517 DEBUG(1, (__location__ ": Error determining the kvno.\n"));
521 /* Seek and delete old keytab entries */
522 ret = seek_and_delete_old_entries(context, keytab, kvno,
523 NULL, NULL, true, false);
528 aderr = ads_clear_service_principal_names(ads, lp_netbios_name());
529 if (!ADS_ERR_OK(aderr)) {
530 DEBUG(1, (__location__ ": Error while clearing service "
531 "principal listings in LDAP.\n"));
537 krb5_kt_close(context, keytab);
540 krb5_free_context(context);
545 /**********************************************************************
546 Adds all the required service principals to the system keytab.
547 ***********************************************************************/
549 int ads_keytab_create_default(ADS_STRUCT *ads)
551 krb5_error_code ret = 0;
552 krb5_context context = NULL;
553 krb5_keytab keytab = NULL;
554 krb5_kt_cursor cursor = {0};
555 krb5_keytab_entry kt_entry = {0};
558 char *sam_account_name, *upn;
559 char **oldEntries = NULL, *princ_s[26];
567 ZERO_STRUCT(kt_entry);
570 frame = talloc_stackframe();
576 status = ads_get_service_principal_names(frame,
581 if (!ADS_ERR_OK(status)) {
586 for (i = 0; i < num_spns; i++) {
590 srv_princ = strlower_talloc(frame, spn_array[i]);
591 if (srv_princ == NULL) {
596 p = strchr_m(srv_princ, '/');
602 /* Add the SPNs found on the DC */
603 ret = ads_keytab_add_entry(ads, srv_princ);
605 DEBUG(1, ("ads_keytab_add_entry failed while "
606 "adding '%s' principal.\n",
612 #if 0 /* don't create the CIFS/... keytab entries since no one except smbd
613 really needs them and we will fall back to verifying against
616 ret = ads_keytab_add_entry(ads, "cifs"));
618 DEBUG(1, (__location__ ": ads_keytab_add_entry failed while "
619 "adding 'cifs'.\n"));
624 memset(princ_s, '\0', sizeof(princ_s));
626 initialize_krb5_error_table();
627 ret = krb5_init_context(&context);
629 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
630 error_message(ret)));
634 machine_name = talloc_strdup(frame, lp_netbios_name());
640 /* now add the userPrincipalName and sAMAccountName entries */
641 sam_account_name = ads_get_samaccountname(ads, frame, machine_name);
642 if (!sam_account_name) {
643 DEBUG(0, (__location__ ": unable to determine machine "
644 "account's name in AD!\n"));
649 /* upper case the sAMAccountName to make it easier for apps to
650 know what case to use in the keytab file */
651 if (!strupper_m(sam_account_name)) {
656 ret = ads_keytab_add_entry(ads, sam_account_name);
658 DEBUG(1, (__location__ ": ads_keytab_add_entry() failed "
659 "while adding sAMAccountName (%s)\n",
664 /* remember that not every machine account will have a upn */
665 upn = ads_get_upn(ads, frame, machine_name);
667 ret = ads_keytab_add_entry(ads, upn);
669 DEBUG(1, (__location__ ": ads_keytab_add_entry() "
670 "failed while adding UPN (%s)\n", upn));
675 /* Now loop through the keytab and update any other existing entries */
676 kvno = (krb5_kvno)ads_get_machine_kvno(ads, machine_name);
677 if (kvno == (krb5_kvno)-1) {
678 DEBUG(1, (__location__ ": ads_get_machine_kvno() failed to "
679 "determine the system's kvno.\n"));
683 DEBUG(3, (__location__ ": Searching for keytab entries to preserve "
686 ret = smb_krb5_open_keytab(context, NULL, True, &keytab);
688 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
689 error_message(ret)));
693 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
694 if (ret != KRB5_KT_END && ret != ENOENT ) {
695 while ((ret = krb5_kt_next_entry(context, keytab,
696 &kt_entry, &cursor)) == 0) {
697 smb_krb5_kt_free_entry(context, &kt_entry);
698 ZERO_STRUCT(kt_entry);
702 krb5_kt_end_seq_get(context, keytab, &cursor);
706 * Hmmm. There is no "rewind" function for the keytab. This means we
707 * have a race condition where someone else could add entries after
708 * we've counted them. Re-open asap to minimise the race. JRA.
710 DEBUG(3, (__location__ ": Found %zd entries in the keytab.\n", found));
715 oldEntries = talloc_zero_array(frame, char *, found + 1);
717 DEBUG(1, (__location__ ": Failed to allocate space to store "
718 "the old keytab entries (talloc failed?).\n"));
723 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
724 if (ret == KRB5_KT_END || ret == ENOENT) {
725 krb5_kt_end_seq_get(context, keytab, &cursor);
730 while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
731 if (kt_entry.vno != kvno) {
732 char *ktprinc = NULL;
735 /* This returns a malloc'ed string in ktprinc. */
736 ret = smb_krb5_unparse_name(oldEntries, context,
740 DEBUG(1, (__location__
741 ": smb_krb5_unparse_name failed "
742 "(%s)\n", error_message(ret)));
746 * From looking at the krb5 source they don't seem to
747 * take locale or mb strings into account.
748 * Maybe this is because they assume utf8 ?
749 * In this case we may need to convert from utf8 to
750 * mb charset here ? JRA.
752 p = strchr_m(ktprinc, '@');
757 p = strchr_m(ktprinc, '/');
761 for (i = 0; i < found; i++) {
762 if (!oldEntries[i]) {
763 oldEntries[i] = ktprinc;
766 if (!strcmp(oldEntries[i], ktprinc)) {
767 TALLOC_FREE(ktprinc);
772 TALLOC_FREE(ktprinc);
775 smb_krb5_kt_free_entry(context, &kt_entry);
776 ZERO_STRUCT(kt_entry);
778 krb5_kt_end_seq_get(context, keytab, &cursor);
782 for (i = 0; oldEntries[i]; i++) {
783 ret |= ads_keytab_add_entry(ads, oldEntries[i]);
784 TALLOC_FREE(oldEntries[i]);
788 TALLOC_FREE(oldEntries);
792 krb5_keytab_entry zero_kt_entry;
793 ZERO_STRUCT(zero_kt_entry);
794 if (memcmp(&zero_kt_entry, &kt_entry,
795 sizeof(krb5_keytab_entry))) {
796 smb_krb5_kt_free_entry(context, &kt_entry);
800 krb5_kt_cursor zero_csr;
801 ZERO_STRUCT(zero_csr);
802 if ((memcmp(&cursor, &zero_csr,
803 sizeof(krb5_kt_cursor)) != 0) && keytab) {
804 krb5_kt_end_seq_get(context, keytab, &cursor);
808 krb5_kt_close(context, keytab);
811 krb5_free_context(context);
816 #endif /* HAVE_ADS */
818 /**********************************************************************
820 ***********************************************************************/
822 int ads_keytab_list(const char *keytab_name)
824 krb5_error_code ret = 0;
825 krb5_context context = NULL;
826 krb5_keytab keytab = NULL;
827 krb5_kt_cursor cursor;
828 krb5_keytab_entry kt_entry;
830 ZERO_STRUCT(kt_entry);
833 initialize_krb5_error_table();
834 ret = krb5_init_context(&context);
836 DEBUG(1, (__location__ ": could not krb5_init_context: %s\n",
837 error_message(ret)));
841 ret = smb_krb5_open_keytab(context, keytab_name, False, &keytab);
843 DEBUG(1, (__location__ ": smb_krb5_open_keytab failed (%s)\n",
844 error_message(ret)));
848 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
854 printf("Vno Type Principal\n");
856 while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
858 char *princ_s = NULL;
859 char *etype_s = NULL;
860 krb5_enctype enctype = 0;
862 ret = smb_krb5_unparse_name(talloc_tos(), context,
863 kt_entry.principal, &princ_s);
868 enctype = smb_get_enctype_from_kt_entry(&kt_entry);
870 ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
872 (asprintf(&etype_s, "UNKNOWN: %d\n", enctype) == -1)) {
873 TALLOC_FREE(princ_s);
877 printf("%3d %-43s %s\n", kt_entry.vno, etype_s, princ_s);
879 TALLOC_FREE(princ_s);
882 ret = smb_krb5_kt_free_entry(context, &kt_entry);
888 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
893 /* Ensure we don't double free. */
894 ZERO_STRUCT(kt_entry);
899 krb5_keytab_entry zero_kt_entry;
900 ZERO_STRUCT(zero_kt_entry);
901 if (memcmp(&zero_kt_entry, &kt_entry,
902 sizeof(krb5_keytab_entry))) {
903 smb_krb5_kt_free_entry(context, &kt_entry);
907 krb5_kt_cursor zero_csr;
908 ZERO_STRUCT(zero_csr);
909 if ((memcmp(&cursor, &zero_csr,
910 sizeof(krb5_kt_cursor)) != 0) && keytab) {
911 krb5_kt_end_seq_get(context, keytab, &cursor);
916 krb5_kt_close(context, keytab);
919 krb5_free_context(context);
924 #endif /* HAVE_KRB5 */