source/libads/kerberos.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Nalin Dahyabhai <nalin@redhat.com> 2004.
   7    Copyright (C) Jeremy Allison 2004.
   8    Copyright (C) Gerald Carter 2006.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26
  27 #ifdef HAVE_KRB5
  28
  29 #define LIBADS_CCACHE_NAME "MEMORY:libads"
  30
  31 /*
  32   we use a prompter to avoid a crash bug in the kerberos libs when
  33   dealing with empty passwords
  34   this prompter is just a string copy ...
  35 */
  36 static krb5_error_code
  37 kerb_prompter(krb5_context ctx, void *data,
  38                const char *name,
  39                const char *banner,
  40                int num_prompts,
  41                krb5_prompt prompts[])
  42 {
  43         if (num_prompts == 0) return 0;
  44
  45         memset(prompts[0].reply->data, '\0', prompts[0].reply->length);
  46         if (prompts[0].reply->length > 0) {
  47                 if (data) {
  48                         strncpy(prompts[0].reply->data, (const char *)data,
  49                                 prompts[0].reply->length-1);
  50                         prompts[0].reply->length = strlen(prompts[0].reply->data);
  51                 } else {
  52                         prompts[0].reply->length = 0;
  53                 }
  54         }
  55         return 0;
  56 }
  57
  58 /*
  59   simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL
  60   place in default cache location.
  61   remus@snapserver.com
  62 */
  63 int kerberos_kinit_password_ext(const char *principal,
  64                                 const char *password,
  65                                 int time_offset,
  66                                 time_t *expire_time,
  67                                 time_t *renew_till_time,
  68                                 const char *cache_name,
  69                                 BOOL request_pac,
  70                                 BOOL add_netbios_addr,
  71                                 time_t renewable_time)
  72 {
  73         krb5_context ctx = NULL;
  74         krb5_error_code code = 0;
  75         krb5_ccache cc = NULL;
  76         krb5_principal me;
  77         krb5_creds my_creds;
  78         krb5_get_init_creds_opt opt;
  79         smb_krb5_addresses *addr = NULL;
  80
  81         initialize_krb5_error_table();
  82         if ((code = krb5_init_context(&ctx)))
  83                 return code;
  84
  85         if (time_offset != 0) {
  86                 krb5_set_real_time(ctx, time(NULL) + time_offset, 0);
  87         }
  88
  89         DEBUG(10,("kerberos_kinit_password: using [%s] as ccache and config [%s]\n",
  90                         cache_name ? cache_name: krb5_cc_default_name(ctx),
  91                         getenv("KRB5_CONFIG")));
  92
  93         if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
  94                 krb5_free_context(ctx);
  95                 return code;
  96         }
  97
  98         if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
  99                 krb5_free_context(ctx);
 100                 return code;
 101         }
 102
 103         krb5_get_init_creds_opt_init(&opt);
 104         krb5_get_init_creds_opt_set_renew_life(&opt, renewable_time);
 105         krb5_get_init_creds_opt_set_forwardable(&opt, 1);
 106
 107         if (request_pac) {
 108 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST
 109                 code = krb5_get_init_creds_opt_set_pac_request(ctx, &opt, True);
 110                 if (code) {
 111                         krb5_free_principal(ctx, me);
 112                         krb5_free_context(ctx);
 113                         return code;
 114                 }
 115 #endif
 116         }
 117
 118         if (add_netbios_addr) {
 119                 code = smb_krb5_gen_netbios_krb5_address(&addr);
 120                 if (code) {
 121                         krb5_free_principal(ctx, me);
 122                         krb5_free_context(ctx);
 123                         return code;
 124                 }
 125                 krb5_get_init_creds_opt_set_address_list(&opt, addr->addrs);
 126         }
 127
 128         if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password),
 129                                                  kerb_prompter, NULL, 0, NULL, &opt)))
 130         {
 131                 smb_krb5_free_addresses(ctx, addr);
 132                 krb5_free_principal(ctx, me);
 133                 krb5_free_context(ctx);
 134                 return code;
 135         }
 136
 137         if ((code = krb5_cc_initialize(ctx, cc, me))) {
 138                 smb_krb5_free_addresses(ctx, addr);
 139                 krb5_free_cred_contents(ctx, &my_creds);
 140                 krb5_free_principal(ctx, me);
 141                 krb5_free_context(ctx);
 142                 return code;
 143         }
 144
 145         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
 146                 krb5_cc_close(ctx, cc);
 147                 smb_krb5_free_addresses(ctx, addr);
 148                 krb5_free_cred_contents(ctx, &my_creds);
 149                 krb5_free_principal(ctx, me);
 150                 krb5_free_context(ctx);
 151                 return code;
 152         }
 153
 154         if (expire_time) {
 155                 *expire_time = (time_t) my_creds.times.endtime;
 156         }
 157
 158         if (renew_till_time) {
 159                 *renew_till_time = (time_t) my_creds.times.renew_till;
 160         }
 161
 162         krb5_cc_close(ctx, cc);
 163         smb_krb5_free_addresses(ctx, addr);
 164         krb5_free_cred_contents(ctx, &my_creds);
 165         krb5_free_principal(ctx, me);
 166         krb5_free_context(ctx);
 167
 168         return 0;
 169 }
 170
 171
 172
 173 /* run kinit to setup our ccache */
 174 int ads_kinit_password(ADS_STRUCT *ads)
 175 {
 176         char *s;
 177         int ret;
 178         const char *account_name;
 179         fstring acct_name;
 180
 181         if ( IS_DC ) {
 182                 /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
 183                 account_name = lp_workgroup();
 184         } else {
 185                 /* always use the sAMAccountName for security = domain */
 186                 /* global_myname()$@REA.LM */
 187                 if ( lp_security() == SEC_DOMAIN ) {
 188                         fstr_sprintf( acct_name, "%s$", global_myname() );
 189                         account_name = acct_name;
 190                 }
 191                 else
 192                         /* This looks like host/global_myname()@REA.LM */
 193                         account_name = ads->auth.user_name;
 194         }
 195
 196         if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
 197                 return KRB5_CC_NOMEM;
 198         }
 199
 200         if (!ads->auth.password) {
 201                 SAFE_FREE(s);
 202                 return KRB5_LIBOS_CANTREADPWD;
 203         }
 204
 205         ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
 206                         &ads->auth.expire, NULL, NULL, False, False, ads->auth.renewable);
 207
 208         if (ret) {
 209                 DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
 210                          s, error_message(ret)));
 211         }
 212         SAFE_FREE(s);
 213         return ret;
 214 }
 215
 216 int ads_kdestroy(const char *cc_name)
 217 {
 218         krb5_error_code code;
 219         krb5_context ctx = NULL;
 220         krb5_ccache cc = NULL;
 221
 222         initialize_krb5_error_table();
 223         if ((code = krb5_init_context (&ctx))) {
 224                 DEBUG(3, ("ads_kdestroy: kdb5_init_context failed: %s\n",
 225                         error_message(code)));
 226                 return code;
 227         }
 228
 229         if (!cc_name) {
 230                 if ((code = krb5_cc_default(ctx, &cc))) {
 231                         krb5_free_context(ctx);
 232                         return code;
 233                 }
 234         } else {
 235                 if ((code = krb5_cc_resolve(ctx, cc_name, &cc))) {
 236                         DEBUG(3, ("ads_kdestroy: krb5_cc_resolve failed: %s\n",
 237                                   error_message(code)));
 238                         krb5_free_context(ctx);
 239                         return code;
 240                 }
 241         }
 242
 243         if ((code = krb5_cc_destroy (ctx, cc))) {
 244                 DEBUG(3, ("ads_kdestroy: krb5_cc_destroy failed: %s\n",
 245                         error_message(code)));
 246         }
 247
 248         krb5_free_context (ctx);
 249         return code;
 250 }
 251
 252 /************************************************************************
 253  Routine to fetch the salting principal for a service.  Active
 254  Directory may use a non-obvious principal name to generate the salt
 255  when it determines the key to use for encrypting tickets for a service,
 256  and hopefully we detected that when we joined the domain.
 257  ************************************************************************/
 258
 259 static char *kerberos_secrets_fetch_salting_principal(const char *service, int enctype)
 260 {
 261         char *key = NULL;
 262         char *ret = NULL;
 263
 264         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, service, enctype);
 265         if (!key) {
 266                 return NULL;
 267         }
 268         ret = (char *)secrets_fetch(key, NULL);
 269         SAFE_FREE(key);
 270         return ret;
 271 }
 272
 273 /************************************************************************
 274  Return the standard DES salt key
 275 ************************************************************************/
 276
 277 char* kerberos_standard_des_salt( void )
 278 {
 279         fstring salt;
 280
 281         fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
 282         strlower_m( salt );
 283         fstrcat( salt, lp_realm() );
 284
 285         return SMB_STRDUP( salt );
 286 }
 287
 288 /************************************************************************
 289 ************************************************************************/
 290
 291 static char* des_salt_key( void )
 292 {
 293         char *key;
 294
 295         asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, lp_realm());
 296
 297         return key;
 298 }
 299
 300 /************************************************************************
 301 ************************************************************************/
 302
 303 BOOL kerberos_secrets_store_des_salt( const char* salt )
 304 {
 305         char* key;
 306         BOOL ret;
 307
 308         if ( (key = des_salt_key()) == NULL ) {
 309                 DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
 310                 return False;
 311         }
 312
 313         if ( !salt ) {
 314                 DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
 315                 secrets_delete( key );
 316                 return True;
 317         }
 318
 319         DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
 320
 321         ret = secrets_store( key, salt, strlen(salt)+1 );
 322
 323         SAFE_FREE( key );
 324
 325         return ret;
 326 }
 327
 328 /************************************************************************
 329 ************************************************************************/
 330
 331 char* kerberos_secrets_fetch_des_salt( void )
 332 {
 333         char *salt, *key;
 334
 335         if ( (key = des_salt_key()) == NULL ) {
 336                 DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
 337                 return False;
 338         }
 339
 340         salt = (char*)secrets_fetch( key, NULL );
 341
 342         SAFE_FREE( key );
 343
 344         return salt;
 345 }
 346
 347
 348 /************************************************************************
 349  Routine to get the salting principal for this service.  This is
 350  maintained for backwards compatibilty with releases prior to 3.0.24.
 351  Since we store the salting principal string only at join, we may have
 352  to look for the older tdb keys.  Caller must free if return is not null.
 353  ************************************************************************/
 354
 355 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 356                                                         krb5_principal host_princ,
 357                                                         int enctype)
 358 {
 359         char *unparsed_name = NULL, *salt_princ_s = NULL;
 360         krb5_principal ret_princ = NULL;
 361
 362         /* lookup new key first */
 363
 364         if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
 365
 366                 /* look under the old key.  If this fails, just use the standard key */
 367
 368                 if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
 369                         return (krb5_principal)NULL;
 370                 }
 371                 if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
 372                         /* fall back to host/machine.realm@REALM */
 373                         salt_princ_s = kerberos_standard_des_salt();
 374                 }
 375         }
 376
 377         if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
 378                 ret_princ = NULL;
 379         }
 380
 381         SAFE_FREE(unparsed_name);
 382         SAFE_FREE(salt_princ_s);
 383
 384         return ret_princ;
 385 }
 386
 387 /************************************************************************
 388  Routine to set the salting principal for this service.  Active
 389  Directory may use a non-obvious principal name to generate the salt
 390  when it determines the key to use for encrypting tickets for a service,
 391  and hopefully we detected that when we joined the domain.
 392  Setting principal to NULL deletes this entry.
 393  ************************************************************************/
 394
 395 BOOL kerberos_secrets_store_salting_principal(const char *service,
 396                                               int enctype,
 397                                               const char *principal)
 398 {
 399         char *key = NULL;
 400         BOOL ret = False;
 401         krb5_context context = NULL;
 402         krb5_principal princ = NULL;
 403         char *princ_s = NULL;
 404         char *unparsed_name = NULL;
 405
 406         krb5_init_context(&context);
 407         if (!context) {
 408                 return False;
 409         }
 410         if (strchr_m(service, '@')) {
 411                 asprintf(&princ_s, "%s", service);
 412         } else {
 413                 asprintf(&princ_s, "%s@%s", service, lp_realm());
 414         }
 415
 416         if (smb_krb5_parse_name(context, princ_s, &princ) != 0) {
 417                 goto out;
 418
 419         }
 420         if (smb_krb5_unparse_name(context, princ, &unparsed_name) != 0) {
 421                 goto out;
 422         }
 423
 424         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, unparsed_name, enctype);
 425         if (!key)  {
 426                 goto out;
 427         }
 428
 429         if ((principal != NULL) && (strlen(principal) > 0)) {
 430                 ret = secrets_store(key, principal, strlen(principal) + 1);
 431         } else {
 432                 ret = secrets_delete(key);
 433         }
 434
 435  out:
 436
 437         SAFE_FREE(key);
 438         SAFE_FREE(princ_s);
 439         SAFE_FREE(unparsed_name);
 440
 441         if (context) {
 442                 krb5_free_context(context);
 443         }
 444
 445         return ret;
 446 }
 447
 448
 449 /************************************************************************
 450 ************************************************************************/
 451
 452 int kerberos_kinit_password(const char *principal,
 453                             const char *password,
 454                             int time_offset,
 455                             const char *cache_name)
 456 {
 457         return kerberos_kinit_password_ext(principal,
 458                                            password,
 459                                            time_offset,
 460                                            0,
 461                                            0,
 462                                            cache_name,
 463                                            False,
 464                                            False,
 465                                            0);
 466 }
 467
 468 /************************************************************************
 469  Create a string list of available kdc's, possibly searching by sitename.
 470  Does DNS queries.
 471 ************************************************************************/
 472
 473 static char *get_kdc_ip_string(char *mem_ctx, const char *realm, struct in_addr primary_ip)
 474 {
 475         struct ip_service *ip_srv;
 476         int count, i;
 477         char *kdc_str = talloc_asprintf(mem_ctx, "\tkdc = %s\n",
 478                                         inet_ntoa(primary_ip));
 479
 480         if (kdc_str == NULL) {
 481                 return NULL;
 482         }
 483
 484         if (!NT_STATUS_IS_OK(get_kdc_list(realm, &ip_srv, &count))) {
 485                 DEBUG(10,("get_kdc_ip_string: get_kdc_list failed. Returning %s\n",
 486                         kdc_str ));
 487                 return kdc_str;
 488         }
 489
 490         for (i = 0; i < count; i++) {
 491                 if (ip_equal(ip_srv[i].ip, primary_ip)) {
 492                         continue;
 493                 }
 494                 /* Append to the string - inefficient but not done often. */
 495                 kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 496                         kdc_str, inet_ntoa(ip_srv[i].ip));
 497                 if (!kdc_str) {
 498                         SAFE_FREE(ip_srv);
 499                         return NULL;
 500                 }
 501         }
 502
 503         SAFE_FREE(ip_srv);
 504
 505         DEBUG(10,("get_kdc_ip_string: Returning %s\n",
 506                 kdc_str ));
 507
 508         return kdc_str;
 509 }
 510
 511 /************************************************************************
 512  Create  a specific krb5.conf file in the private directory pointing
 513  at a specific kdc for a realm. Keyed off domain name. Sets
 514  KRB5_CONFIG environment variable to point to this file. Must be
 515  run as root or will fail (which is a good thing :-).
 516 ************************************************************************/
 517
 518 BOOL create_local_private_krb5_conf_for_domain(const char *realm, const char *domain, struct in_addr ip)
 519 {
 520         char *dname = talloc_asprintf(NULL, "%s/smb_krb5", lp_lockdir());
 521         char *tmpname = NULL;
 522         char *fname = NULL;
 523         char *file_contents = NULL;
 524         char *kdc_ip_string = NULL;
 525         size_t flen = 0;
 526         ssize_t ret;
 527         int fd;
 528         char *realm_upper = NULL;
 529
 530         if (!dname) {
 531                 return False;
 532         }
 533         if ((mkdir(dname, 0755)==-1) && (errno != EEXIST)) {
 534                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 535                         "failed to create directory %s. Error was %s\n",
 536                         dname, strerror(errno) ));
 537                 TALLOC_FREE(dname);
 538                 return False;
 539         }
 540
 541         tmpname = talloc_asprintf(dname, "%s/smb_tmp_krb5.XXXXXX", lp_lockdir());
 542         if (!tmpname) {
 543                 TALLOC_FREE(dname);
 544                 return False;
 545         }
 546
 547         fname = talloc_asprintf(dname, "%s/krb5.conf.%s", dname, domain);
 548         if (!fname) {
 549                 TALLOC_FREE(dname);
 550                 return False;
 551         }
 552
 553         DEBUG(10,("create_local_private_krb5_conf_for_domain: fname = %s, realm = %s, domain = %s\n",
 554                 fname, realm, domain ));
 555
 556         realm_upper = talloc_strdup(fname, realm);
 557         strupper_m(realm_upper);
 558
 559         kdc_ip_string = get_kdc_ip_string(dname, realm, ip);
 560         if (!kdc_ip_string) {
 561                 TALLOC_FREE(dname);
 562                 return False;
 563         }
 564
 565         file_contents = talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n\n"
 566                                 "[realms]\n\t%s = {\n"
 567                                 "\t\t%s\t}\n",
 568                                 realm_upper, realm_upper, kdc_ip_string);
 569
 570         if (!file_contents) {
 571                 TALLOC_FREE(dname);
 572                 return False;
 573         }
 574
 575         flen = strlen(file_contents);
 576
 577         fd = smb_mkstemp(tmpname);
 578         if (fd == -1) {
 579                 DEBUG(0,("create_local_private_krb5_conf_for_domain: smb_mkstemp failed,"
 580                         " for file %s. Errno %s\n",
 581                         tmpname, strerror(errno) ));
 582         }
 583
 584         if (fchmod(fd, 0644)==-1) {
 585                 DEBUG(0,("create_local_private_krb5_conf_for_domain: fchmod failed for %s."
 586                         " Errno %s\n",
 587                         tmpname, strerror(errno) ));
 588                 unlink(tmpname);
 589                 close(fd);
 590                 TALLOC_FREE(dname);
 591                 return False;
 592         }
 593
 594         ret = write(fd, file_contents, flen);
 595         if (flen != ret) {
 596                 DEBUG(0,("create_local_private_krb5_conf_for_domain: write failed,"
 597                         " returned %d (should be %u). Errno %s\n",
 598                         (int)ret, (unsigned int)flen, strerror(errno) ));
 599                 unlink(tmpname);
 600                 close(fd);
 601                 TALLOC_FREE(dname);
 602                 return False;
 603         }
 604         if (close(fd)==-1) {
 605                 DEBUG(0,("create_local_private_krb5_conf_for_domain: close failed."
 606                         " Errno %s\n", strerror(errno) ));
 607                 unlink(tmpname);
 608                 TALLOC_FREE(dname);
 609                 return False;
 610         }
 611
 612         if (rename(tmpname, fname) == -1) {
 613                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 614                         "of %s to %s failed. Errno %s\n",
 615                         tmpname, fname, strerror(errno) ));
 616                 unlink(tmpname);
 617                 TALLOC_FREE(dname);
 618                 return False;
 619         }
 620
 621         DEBUG(5,("create_local_private_krb5_conf_for_domain: wrote "
 622                 "file %s with realm %s KDC = %s\n",
 623                 fname, realm_upper, inet_ntoa(ip) ));
 624
 625         /* Set the environment variable to this file. */
 626         setenv("KRB5_CONFIG", fname, 1);
 627
 628 #if defined(OVERWRITE_SYSTEM_KRB5_CONF)
 629
 630 #define SYSTEM_KRB5_CONF_PATH "/etc/krb5.conf"
 631         /* Insanity, sheer insanity..... */
 632
 633         if (strequal(realm, lp_realm())) {
 634                 pstring linkpath;
 635                 int lret;
 636
 637                 lret = readlink(SYSTEM_KRB5_CONF_PATH, linkpath, sizeof(linkpath)-1);
 638                 linkpath[sizeof(pstring)-1] = '\0';
 639
 640                 if (lret == 0 || strcmp(linkpath, fname) == 0) {
 641                         /* Symlink already exists. */
 642                         TALLOC_FREE(dname);
 643                         return True;
 644                 }
 645
 646                 /* Try and replace with a symlink. */
 647                 if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 648                         if (errno != EEXIST) {
 649                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: symlink "
 650                                         "of %s to %s failed. Errno %s\n",
 651                                         fname, SYSTEM_KRB5_CONF_PATH, strerror(errno) ));
 652                                 TALLOC_FREE(dname);
 653                                 return True; /* Not a fatal error. */
 654                         }
 655
 656                         pstrcpy(linkpath, SYSTEM_KRB5_CONF_PATH);
 657                         pstrcat(linkpath, ".saved");
 658
 659                         /* Yes, this is a race conditon... too bad. */
 660                         if (rename(SYSTEM_KRB5_CONF_PATH, linkpath) == -1) {
 661                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 662                                         "of %s to %s failed. Errno %s\n",
 663                                         SYSTEM_KRB5_CONF_PATH, linkpath,
 664                                         strerror(errno) ));
 665                                 TALLOC_FREE(dname);
 666                                 return True; /* Not a fatal error. */
 667                         }
 668
 669                         if (symlink(fname, "/etc/krb5.conf") == -1) {
 670                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 671                                         "forced symlink of %s to /etc/krb5.conf failed. Errno %s\n",
 672                                         fname, strerror(errno) ));
 673                                 TALLOC_FREE(dname);
 674                                 return True; /* Not a fatal error. */
 675                         }
 676                 }
 677         }
 678 #endif
 679
 680         TALLOC_FREE(dname);
 681
 682         return True;
 683 }
 684 #endif