source3/libads/kerberos.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Nalin Dahyabhai <nalin@redhat.com> 2004.
   7    Copyright (C) Jeremy Allison 2004.
   8    Copyright (C) Gerald Carter 2006.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25
  26 #ifdef HAVE_KRB5
  27
  28 #define LIBADS_CCACHE_NAME "MEMORY:libads"
  29
  30 /*
  31   we use a prompter to avoid a crash bug in the kerberos libs when
  32   dealing with empty passwords
  33   this prompter is just a string copy ...
  34 */
  35 static krb5_error_code
  36 kerb_prompter(krb5_context ctx, void *data,
  37                const char *name,
  38                const char *banner,
  39                int num_prompts,
  40                krb5_prompt prompts[])
  41 {
  42         if (num_prompts == 0) return 0;
  43
  44         memset(prompts[0].reply->data, '\0', prompts[0].reply->length);
  45         if (prompts[0].reply->length > 0) {
  46                 if (data) {
  47                         strncpy(prompts[0].reply->data, (const char *)data,
  48                                 prompts[0].reply->length-1);
  49                         prompts[0].reply->length = strlen(prompts[0].reply->data);
  50                 } else {
  51                         prompts[0].reply->length = 0;
  52                 }
  53         }
  54         return 0;
  55 }
  56
  57 static bool smb_krb5_err_io_nstatus(TALLOC_CTX *mem_ctx,
  58                                     DATA_BLOB *edata_blob,
  59                                     KRB5_EDATA_NTSTATUS *edata)
  60 {
  61         bool ret = False;
  62         prs_struct ps;
  63
  64         if (!mem_ctx || !edata_blob || !edata)
  65                 return False;
  66
  67         if (!prs_init(&ps, edata_blob->length, mem_ctx, UNMARSHALL))
  68                 return False;
  69
  70         if (!prs_copy_data_in(&ps, (char *)edata_blob->data, edata_blob->length))
  71                 goto out;
  72
  73         prs_set_offset(&ps, 0);
  74
  75         if (!prs_ntstatus("ntstatus", &ps, 1, &edata->ntstatus))
  76                 goto out;
  77
  78         if (!prs_uint32("unknown1", &ps, 1, &edata->unknown1))
  79                 goto out;
  80
  81         if (!prs_uint32("unknown2", &ps, 1, &edata->unknown2)) /* only seen 00000001 here */
  82                 goto out;
  83
  84         ret = True;
  85  out:
  86         prs_mem_free(&ps);
  87
  88         return ret;
  89 }
  90
  91  static bool smb_krb5_get_ntstatus_from_krb5_error(krb5_error *error,
  92                                                    NTSTATUS *nt_status)
  93 {
  94         DATA_BLOB edata;
  95         DATA_BLOB unwrapped_edata;
  96         TALLOC_CTX *mem_ctx;
  97         KRB5_EDATA_NTSTATUS parsed_edata;
  98
  99 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 100         edata = data_blob(error->e_data->data, error->e_data->length);
 101 #else
 102         edata = data_blob(error->e_data.data, error->e_data.length);
 103 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 104
 105 #ifdef DEVELOPER
 106         dump_data(10, edata.data, edata.length);
 107 #endif /* DEVELOPER */
 108
 109         mem_ctx = talloc_init("smb_krb5_get_ntstatus_from_krb5_error");
 110         if (mem_ctx == NULL) {
 111                 data_blob_free(&edata);
 112                 return False;
 113         }
 114
 115         if (!unwrap_edata_ntstatus(mem_ctx, &edata, &unwrapped_edata)) {
 116                 data_blob_free(&edata);
 117                 TALLOC_FREE(mem_ctx);
 118                 return False;
 119         }
 120
 121         data_blob_free(&edata);
 122
 123         if (!smb_krb5_err_io_nstatus(mem_ctx, &unwrapped_edata, &parsed_edata)) {
 124                 data_blob_free(&unwrapped_edata);
 125                 TALLOC_FREE(mem_ctx);
 126                 return False;
 127         }
 128
 129         data_blob_free(&unwrapped_edata);
 130
 131         if (nt_status) {
 132                 *nt_status = parsed_edata.ntstatus;
 133         }
 134
 135         TALLOC_FREE(mem_ctx);
 136
 137         return True;
 138 }
 139
 140  static bool smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(krb5_context ctx,
 141                                                                   krb5_get_init_creds_opt *opt,
 142                                                                   NTSTATUS *nt_status)
 143 {
 144         bool ret = False;
 145         krb5_error *error = NULL;
 146
 147 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR
 148         ret = krb5_get_init_creds_opt_get_error(ctx, opt, &error);
 149         if (ret) {
 150                 DEBUG(1,("krb5_get_init_creds_opt_get_error gave: %s\n",
 151                         error_message(ret)));
 152                 return False;
 153         }
 154 #endif /* HAVE_KRB5_GET_INIT_CREDS_OPT_GET_ERROR */
 155
 156         if (!error) {
 157                 DEBUG(1,("no krb5_error\n"));
 158                 return False;
 159         }
 160
 161 #ifdef HAVE_E_DATA_POINTER_IN_KRB5_ERROR
 162         if (!error->e_data) {
 163 #else
 164         if (error->e_data.data == NULL) {
 165 #endif /* HAVE_E_DATA_POINTER_IN_KRB5_ERROR */
 166                 DEBUG(1,("no edata in krb5_error\n"));
 167                 krb5_free_error(ctx, error);
 168                 return False;
 169         }
 170
 171         ret = smb_krb5_get_ntstatus_from_krb5_error(error, nt_status);
 172
 173         krb5_free_error(ctx, error);
 174
 175         return ret;
 176 }
 177
 178 /*
 179   simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL
 180   place in default cache location.
 181   remus@snapserver.com
 182 */
 183 int kerberos_kinit_password_ext(const char *principal,
 184                                 const char *password,
 185                                 int time_offset,
 186                                 time_t *expire_time,
 187                                 time_t *renew_till_time,
 188                                 const char *cache_name,
 189                                 bool request_pac,
 190                                 bool add_netbios_addr,
 191                                 time_t renewable_time,
 192                                 NTSTATUS *ntstatus)
 193 {
 194         krb5_context ctx = NULL;
 195         krb5_error_code code = 0;
 196         krb5_ccache cc = NULL;
 197         krb5_principal me = NULL;
 198         krb5_creds my_creds;
 199         krb5_get_init_creds_opt *opt = NULL;
 200         smb_krb5_addresses *addr = NULL;
 201
 202         ZERO_STRUCT(my_creds);
 203
 204         initialize_krb5_error_table();
 205         if ((code = krb5_init_context(&ctx)))
 206                 goto out;
 207
 208         if (time_offset != 0) {
 209                 krb5_set_real_time(ctx, time(NULL) + time_offset, 0);
 210         }
 211
 212         DEBUG(10,("kerberos_kinit_password: using [%s] as ccache and config [%s]\n",
 213                         cache_name ? cache_name: krb5_cc_default_name(ctx),
 214                         getenv("KRB5_CONFIG")));
 215
 216         if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
 217                 goto out;
 218         }
 219
 220         if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
 221                 goto out;
 222         }
 223
 224         if ((code = smb_krb5_get_init_creds_opt_alloc(ctx, &opt))) {
 225                 goto out;
 226         }
 227
 228         krb5_get_init_creds_opt_set_renew_life(opt, renewable_time);
 229         krb5_get_init_creds_opt_set_forwardable(opt, True);
 230 #if 0
 231         /* insane testing */
 232         krb5_get_init_creds_opt_set_tkt_life(opt, 60);
 233 #endif
 234
 235 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST
 236         if (request_pac) {
 237                 if ((code = krb5_get_init_creds_opt_set_pac_request(ctx, opt, (krb5_boolean)request_pac))) {
 238                         goto out;
 239                 }
 240         }
 241 #endif
 242         if (add_netbios_addr) {
 243                 if ((code = smb_krb5_gen_netbios_krb5_address(&addr))) {
 244                         goto out;
 245                 }
 246                 krb5_get_init_creds_opt_set_address_list(opt, addr->addrs);
 247         }
 248
 249         if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password),
 250                                                  kerb_prompter, CONST_DISCARD(char *,password),
 251                                                  0, NULL, opt))) {
 252                 goto out;
 253         }
 254
 255         if ((code = krb5_cc_initialize(ctx, cc, me))) {
 256                 goto out;
 257         }
 258
 259         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
 260                 goto out;
 261         }
 262
 263         if (expire_time) {
 264                 *expire_time = (time_t) my_creds.times.endtime;
 265         }
 266
 267         if (renew_till_time) {
 268                 *renew_till_time = (time_t) my_creds.times.renew_till;
 269         }
 270  out:
 271         if (ntstatus) {
 272
 273                 NTSTATUS status;
 274
 275                 /* fast path */
 276                 if (code == 0) {
 277                         *ntstatus = NT_STATUS_OK;
 278                         goto cleanup;
 279                 }
 280
 281                 /* try to get ntstatus code out of krb5_error when we have it
 282                  * inside the krb5_get_init_creds_opt - gd */
 283
 284                 if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) {
 285                         *ntstatus = status;
 286                         goto cleanup;
 287                 }
 288
 289                 /* fall back to self-made-mapping */
 290                 *ntstatus = krb5_to_nt_status(code);
 291         }
 292
 293  cleanup:
 294         krb5_free_cred_contents(ctx, &my_creds);
 295         if (me) {
 296                 krb5_free_principal(ctx, me);
 297         }
 298         if (addr) {
 299                 smb_krb5_free_addresses(ctx, addr);
 300         }
 301         if (opt) {
 302                 smb_krb5_get_init_creds_opt_free(ctx, opt);
 303         }
 304         if (cc) {
 305                 krb5_cc_close(ctx, cc);
 306         }
 307         if (ctx) {
 308                 krb5_free_context(ctx);
 309         }
 310         return code;
 311 }
 312
 313
 314
 315 /* run kinit to setup our ccache */
 316 int ads_kinit_password(ADS_STRUCT *ads)
 317 {
 318         char *s;
 319         int ret;
 320         const char *account_name;
 321         fstring acct_name;
 322
 323         if ( IS_DC ) {
 324                 /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
 325                 account_name = lp_workgroup();
 326         } else {
 327                 /* always use the sAMAccountName for security = domain */
 328                 /* global_myname()$@REA.LM */
 329                 if ( lp_security() == SEC_DOMAIN ) {
 330                         fstr_sprintf( acct_name, "%s$", global_myname() );
 331                         account_name = acct_name;
 332                 }
 333                 else
 334                         /* This looks like host/global_myname()@REA.LM */
 335                         account_name = ads->auth.user_name;
 336         }
 337
 338         if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
 339                 return KRB5_CC_NOMEM;
 340         }
 341
 342         if (!ads->auth.password) {
 343                 SAFE_FREE(s);
 344                 return KRB5_LIBOS_CANTREADPWD;
 345         }
 346
 347         ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
 348                         &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable,
 349                         NULL);
 350
 351         if (ret) {
 352                 DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
 353                          s, error_message(ret)));
 354         }
 355         SAFE_FREE(s);
 356         return ret;
 357 }
 358
 359 int ads_kdestroy(const char *cc_name)
 360 {
 361         krb5_error_code code;
 362         krb5_context ctx = NULL;
 363         krb5_ccache cc = NULL;
 364
 365         initialize_krb5_error_table();
 366         if ((code = krb5_init_context (&ctx))) {
 367                 DEBUG(3, ("ads_kdestroy: kdb5_init_context failed: %s\n",
 368                         error_message(code)));
 369                 return code;
 370         }
 371
 372         if (!cc_name) {
 373                 if ((code = krb5_cc_default(ctx, &cc))) {
 374                         krb5_free_context(ctx);
 375                         return code;
 376                 }
 377         } else {
 378                 if ((code = krb5_cc_resolve(ctx, cc_name, &cc))) {
 379                         DEBUG(3, ("ads_kdestroy: krb5_cc_resolve failed: %s\n",
 380                                   error_message(code)));
 381                         krb5_free_context(ctx);
 382                         return code;
 383                 }
 384         }
 385
 386         if ((code = krb5_cc_destroy (ctx, cc))) {
 387                 DEBUG(3, ("ads_kdestroy: krb5_cc_destroy failed: %s\n",
 388                         error_message(code)));
 389         }
 390
 391         krb5_free_context (ctx);
 392         return code;
 393 }
 394
 395 /************************************************************************
 396  Routine to fetch the salting principal for a service.  Active
 397  Directory may use a non-obvious principal name to generate the salt
 398  when it determines the key to use for encrypting tickets for a service,
 399  and hopefully we detected that when we joined the domain.
 400  ************************************************************************/
 401
 402 static char *kerberos_secrets_fetch_salting_principal(const char *service, int enctype)
 403 {
 404         char *key = NULL;
 405         char *ret = NULL;
 406
 407         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, service, enctype);
 408         if (!key) {
 409                 return NULL;
 410         }
 411         ret = (char *)secrets_fetch(key, NULL);
 412         SAFE_FREE(key);
 413         return ret;
 414 }
 415
 416 /************************************************************************
 417  Return the standard DES salt key
 418 ************************************************************************/
 419
 420 char* kerberos_standard_des_salt( void )
 421 {
 422         fstring salt;
 423
 424         fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
 425         strlower_m( salt );
 426         fstrcat( salt, lp_realm() );
 427
 428         return SMB_STRDUP( salt );
 429 }
 430
 431 /************************************************************************
 432 ************************************************************************/
 433
 434 static char* des_salt_key( void )
 435 {
 436         char *key;
 437
 438         asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, lp_realm());
 439
 440         return key;
 441 }
 442
 443 /************************************************************************
 444 ************************************************************************/
 445
 446 bool kerberos_secrets_store_des_salt( const char* salt )
 447 {
 448         char* key;
 449         bool ret;
 450
 451         if ( (key = des_salt_key()) == NULL ) {
 452                 DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
 453                 return False;
 454         }
 455
 456         if ( !salt ) {
 457                 DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
 458                 secrets_delete( key );
 459                 return True;
 460         }
 461
 462         DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
 463
 464         ret = secrets_store( key, salt, strlen(salt)+1 );
 465
 466         SAFE_FREE( key );
 467
 468         return ret;
 469 }
 470
 471 /************************************************************************
 472 ************************************************************************/
 473
 474 char* kerberos_secrets_fetch_des_salt( void )
 475 {
 476         char *salt, *key;
 477
 478         if ( (key = des_salt_key()) == NULL ) {
 479                 DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
 480                 return False;
 481         }
 482
 483         salt = (char*)secrets_fetch( key, NULL );
 484
 485         SAFE_FREE( key );
 486
 487         return salt;
 488 }
 489
 490
 491 /************************************************************************
 492  Routine to get the salting principal for this service.  This is
 493  maintained for backwards compatibilty with releases prior to 3.0.24.
 494  Since we store the salting principal string only at join, we may have
 495  to look for the older tdb keys.  Caller must free if return is not null.
 496  ************************************************************************/
 497
 498 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 499                                                         krb5_principal host_princ,
 500                                                         int enctype)
 501 {
 502         char *unparsed_name = NULL, *salt_princ_s = NULL;
 503         krb5_principal ret_princ = NULL;
 504
 505         /* lookup new key first */
 506
 507         if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
 508
 509                 /* look under the old key.  If this fails, just use the standard key */
 510
 511                 if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
 512                         return (krb5_principal)NULL;
 513                 }
 514                 if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
 515                         /* fall back to host/machine.realm@REALM */
 516                         salt_princ_s = kerberos_standard_des_salt();
 517                 }
 518         }
 519
 520         if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
 521                 ret_princ = NULL;
 522         }
 523
 524         SAFE_FREE(unparsed_name);
 525         SAFE_FREE(salt_princ_s);
 526
 527         return ret_princ;
 528 }
 529
 530 /************************************************************************
 531  Routine to set the salting principal for this service.  Active
 532  Directory may use a non-obvious principal name to generate the salt
 533  when it determines the key to use for encrypting tickets for a service,
 534  and hopefully we detected that when we joined the domain.
 535  Setting principal to NULL deletes this entry.
 536  ************************************************************************/
 537
 538 bool kerberos_secrets_store_salting_principal(const char *service,
 539                                               int enctype,
 540                                               const char *principal)
 541 {
 542         char *key = NULL;
 543         bool ret = False;
 544         krb5_context context = NULL;
 545         krb5_principal princ = NULL;
 546         char *princ_s = NULL;
 547         char *unparsed_name = NULL;
 548
 549         krb5_init_context(&context);
 550         if (!context) {
 551                 return False;
 552         }
 553         if (strchr_m(service, '@')) {
 554                 asprintf(&princ_s, "%s", service);
 555         } else {
 556                 asprintf(&princ_s, "%s@%s", service, lp_realm());
 557         }
 558
 559         if (smb_krb5_parse_name(context, princ_s, &princ) != 0) {
 560                 goto out;
 561
 562         }
 563         if (smb_krb5_unparse_name(context, princ, &unparsed_name) != 0) {
 564                 goto out;
 565         }
 566
 567         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, unparsed_name, enctype);
 568         if (!key)  {
 569                 goto out;
 570         }
 571
 572         if ((principal != NULL) && (strlen(principal) > 0)) {
 573                 ret = secrets_store(key, principal, strlen(principal) + 1);
 574         } else {
 575                 ret = secrets_delete(key);
 576         }
 577
 578  out:
 579
 580         SAFE_FREE(key);
 581         SAFE_FREE(princ_s);
 582         SAFE_FREE(unparsed_name);
 583
 584         if (context) {
 585                 krb5_free_context(context);
 586         }
 587
 588         return ret;
 589 }
 590
 591
 592 /************************************************************************
 593 ************************************************************************/
 594
 595 int kerberos_kinit_password(const char *principal,
 596                             const char *password,
 597                             int time_offset,
 598                             const char *cache_name)
 599 {
 600         return kerberos_kinit_password_ext(principal,
 601                                            password,
 602                                            time_offset,
 603                                            0,
 604                                            0,
 605                                            cache_name,
 606                                            False,
 607                                            False,
 608                                            0,
 609                                            NULL);
 610 }
 611
 612 /************************************************************************
 613  Create a string list of available kdc's, possibly searching by sitename.
 614  Does DNS queries.
 615 ************************************************************************/
 616
 617 static char *get_kdc_ip_string(char *mem_ctx,
 618                 const char *realm,
 619                 const char *sitename,
 620                 struct sockaddr_storage *pss)
 621 {
 622         int i;
 623         struct ip_service *ip_srv_site = NULL;
 624         struct ip_service *ip_srv_nonsite;
 625         int count_site = 0;
 626         int count_nonsite;
 627         char *kdc_str = talloc_asprintf(mem_ctx, "\tkdc = %s\n",
 628                                         print_canonical_sockaddr(mem_ctx,
 629                                                         pss));
 630
 631         if (kdc_str == NULL) {
 632                 return NULL;
 633         }
 634
 635         /* Get the KDC's only in this site. */
 636
 637         if (sitename) {
 638
 639                 get_kdc_list(realm, sitename, &ip_srv_site, &count_site);
 640
 641                 for (i = 0; i < count_site; i++) {
 642                         if (addr_equal(&ip_srv_site[i].ss, pss)) {
 643                                 continue;
 644                         }
 645                         /* Append to the string - inefficient
 646                          * but not done often. */
 647                         kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 648                                 kdc_str,
 649                                 print_canonical_sockaddr(mem_ctx,
 650                                                         &ip_srv_site[i].ss));
 651                         if (!kdc_str) {
 652                                 SAFE_FREE(ip_srv_site);
 653                                 return NULL;
 654                         }
 655                 }
 656         }
 657
 658         /* Get all KDC's. */
 659
 660         get_kdc_list(realm, NULL, &ip_srv_nonsite, &count_nonsite);
 661
 662         for (i = 0; i < count_nonsite; i++) {
 663                 int j;
 664
 665                 if (addr_equal(&ip_srv_nonsite[i].ss, pss)) {
 666                         continue;
 667                 }
 668
 669                 /* Ensure this isn't an IP already seen (YUK! this is n*n....) */
 670                 for (j = 0; j < count_site; j++) {
 671                         if (addr_equal(&ip_srv_nonsite[i].ss,
 672                                                 &ip_srv_site[j].ss)) {
 673                                 break;
 674                         }
 675                         /* As the lists are sorted we can break early if nonsite > site. */
 676                         if (ip_service_compare(&ip_srv_nonsite[i], &ip_srv_site[j]) > 0) {
 677                                 break;
 678                         }
 679                 }
 680                 if (j != i) {
 681                         continue;
 682                 }
 683
 684                 /* Append to the string - inefficient but not done often. */
 685                 kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 686                                 kdc_str,
 687                                 print_canonical_sockaddr(mem_ctx,
 688                                                 &ip_srv_nonsite[i].ss));
 689                 if (!kdc_str) {
 690                         SAFE_FREE(ip_srv_site);
 691                         SAFE_FREE(ip_srv_nonsite);
 692                         return NULL;
 693                 }
 694         }
 695
 696
 697         SAFE_FREE(ip_srv_site);
 698         SAFE_FREE(ip_srv_nonsite);
 699
 700         DEBUG(10,("get_kdc_ip_string: Returning %s\n",
 701                 kdc_str ));
 702
 703         return kdc_str;
 704 }
 705
 706 /************************************************************************
 707  Create  a specific krb5.conf file in the private directory pointing
 708  at a specific kdc for a realm. Keyed off domain name. Sets
 709  KRB5_CONFIG environment variable to point to this file. Must be
 710  run as root or will fail (which is a good thing :-).
 711 ************************************************************************/
 712
 713 bool create_local_private_krb5_conf_for_domain(const char *realm,
 714                                                 const char *domain,
 715                                                 const char *sitename,
 716                                                 struct sockaddr_storage *pss)
 717 {
 718         char *dname = talloc_asprintf(NULL, "%s/smb_krb5", lp_lockdir());
 719         char *tmpname = NULL;
 720         char *fname = NULL;
 721         char *file_contents = NULL;
 722         char *kdc_ip_string = NULL;
 723         size_t flen = 0;
 724         ssize_t ret;
 725         int fd;
 726         char *realm_upper = NULL;
 727
 728         if (!dname) {
 729                 return False;
 730         }
 731         if ((mkdir(dname, 0755)==-1) && (errno != EEXIST)) {
 732                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 733                         "failed to create directory %s. Error was %s\n",
 734                         dname, strerror(errno) ));
 735                 TALLOC_FREE(dname);
 736                 return False;
 737         }
 738
 739         tmpname = talloc_asprintf(dname, "%s/smb_tmp_krb5.XXXXXX", lp_lockdir());
 740         if (!tmpname) {
 741                 TALLOC_FREE(dname);
 742                 return False;
 743         }
 744
 745         fname = talloc_asprintf(dname, "%s/krb5.conf.%s", dname, domain);
 746         if (!fname) {
 747                 TALLOC_FREE(dname);
 748                 return False;
 749         }
 750
 751         DEBUG(10,("create_local_private_krb5_conf_for_domain: fname = %s, realm = %s, domain = %s\n",
 752                 fname, realm, domain ));
 753
 754         realm_upper = talloc_strdup(fname, realm);
 755         strupper_m(realm_upper);
 756
 757         kdc_ip_string = get_kdc_ip_string(dname, realm, sitename, pss);
 758         if (!kdc_ip_string) {
 759                 TALLOC_FREE(dname);
 760                 return False;
 761         }
 762
 763         file_contents = talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n\n"
 764                                 "[realms]\n\t%s = {\n"
 765                                 "\t%s\t}\n",
 766                                 realm_upper, realm_upper, kdc_ip_string);
 767
 768         if (!file_contents) {
 769                 TALLOC_FREE(dname);
 770                 return False;
 771         }
 772
 773         flen = strlen(file_contents);
 774
 775         fd = smb_mkstemp(tmpname);
 776         if (fd == -1) {
 777                 DEBUG(0,("create_local_private_krb5_conf_for_domain: smb_mkstemp failed,"
 778                         " for file %s. Errno %s\n",
 779                         tmpname, strerror(errno) ));
 780         }
 781
 782         if (fchmod(fd, 0644)==-1) {
 783                 DEBUG(0,("create_local_private_krb5_conf_for_domain: fchmod failed for %s."
 784                         " Errno %s\n",
 785                         tmpname, strerror(errno) ));
 786                 unlink(tmpname);
 787                 close(fd);
 788                 TALLOC_FREE(dname);
 789                 return False;
 790         }
 791
 792         ret = write(fd, file_contents, flen);
 793         if (flen != ret) {
 794                 DEBUG(0,("create_local_private_krb5_conf_for_domain: write failed,"
 795                         " returned %d (should be %u). Errno %s\n",
 796                         (int)ret, (unsigned int)flen, strerror(errno) ));
 797                 unlink(tmpname);
 798                 close(fd);
 799                 TALLOC_FREE(dname);
 800                 return False;
 801         }
 802         if (close(fd)==-1) {
 803                 DEBUG(0,("create_local_private_krb5_conf_for_domain: close failed."
 804                         " Errno %s\n", strerror(errno) ));
 805                 unlink(tmpname);
 806                 TALLOC_FREE(dname);
 807                 return False;
 808         }
 809
 810         if (rename(tmpname, fname) == -1) {
 811                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 812                         "of %s to %s failed. Errno %s\n",
 813                         tmpname, fname, strerror(errno) ));
 814                 unlink(tmpname);
 815                 TALLOC_FREE(dname);
 816                 return False;
 817         }
 818
 819         DEBUG(5,("create_local_private_krb5_conf_for_domain: wrote "
 820                 "file %s with realm %s KDC = %s\n",
 821                 fname, realm_upper, print_canonical_sockaddr(dname, pss) ));
 822
 823         /* Set the environment variable to this file. */
 824         setenv("KRB5_CONFIG", fname, 1);
 825
 826 #if defined(OVERWRITE_SYSTEM_KRB5_CONF)
 827
 828 #define SYSTEM_KRB5_CONF_PATH "/etc/krb5.conf"
 829         /* Insanity, sheer insanity..... */
 830
 831         if (strequal(realm, lp_realm())) {
 832                 char linkpath[PATH_MAX+1];
 833                 int lret;
 834
 835                 lret = readlink(SYSTEM_KRB5_CONF_PATH, linkpath, sizeof(linkpath)-1);
 836                 if (lret != -1) {
 837                         linkpath[lret] = '\0';
 838                 }
 839
 840                 if (lret != -1 || strcmp(linkpath, fname) == 0) {
 841                         /* Symlink already exists. */
 842                         TALLOC_FREE(dname);
 843                         return True;
 844                 }
 845
 846                 /* Try and replace with a symlink. */
 847                 if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 848                         const char *newpath = SYSTEM_KRB5_CONF_PATH ## ".saved";
 849                         if (errno != EEXIST) {
 850                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: symlink "
 851                                         "of %s to %s failed. Errno %s\n",
 852                                         fname, SYSTEM_KRB5_CONF_PATH, strerror(errno) ));
 853                                 TALLOC_FREE(dname);
 854                                 return True; /* Not a fatal error. */
 855                         }
 856
 857                         /* Yes, this is a race conditon... too bad. */
 858                         if (rename(SYSTEM_KRB5_CONF_PATH, newpath) == -1) {
 859                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 860                                         "of %s to %s failed. Errno %s\n",
 861                                         SYSTEM_KRB5_CONF_PATH, newpath,
 862                                         strerror(errno) ));
 863                                 TALLOC_FREE(dname);
 864                                 return True; /* Not a fatal error. */
 865                         }
 866
 867                         if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 868                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 869                                         "forced symlink of %s to /etc/krb5.conf failed. Errno %s\n",
 870                                         fname, strerror(errno) ));
 871                                 TALLOC_FREE(dname);
 872                                 return True; /* Not a fatal error. */
 873                         }
 874                 }
 875         }
 876 #endif
 877
 878         TALLOC_FREE(dname);
 879
 880         return True;
 881 }
 882 #endif