43 #if defined(LDAP_USE_GSSAPI)
52 #define KRB_DEFAULT_KEYTAB "FILE:/etc/dhcp/dhcp.keytab"
53 #define KRB_MIN_TIME 300
55 #define CHECK_KRB5(ctx, err, msg, ...) \
58 const char * errmsg = krb5_get_error_message(ctx, err); \
59 log_error("Err: %s -> %s\n", msg, errmsg); \
60 result = ISC_R_FAILURE; \
65 #define CHECK(ret_code, msg) \
66 if (ret_code != 0) { \
67 log_error("Error, %i %s\n", ret_code, msg); \
72 check_credentials(krb5_context context, krb5_ccache ccache, krb5_principal service)
77 krb5_error_code krberr;
79 isc_result_t result = ISC_R_FAILURE;
81 memset(&mcreds, 0,
sizeof(mcreds));
82 memset(&creds, 0,
sizeof(creds));
84 krberr = krb5_get_default_realm(context, &realm);
85 CHECK_KRB5(context, krberr,
"Failed to retrieve default realm");
87 krberr = krb5_build_principal(context, &mcreds.server,
89 "krbtgt", realm, NULL);
90 CHECK_KRB5(context, krberr,
"Failed to build 'krbtgt/REALM' principal");
92 mcreds.client = service;
94 krberr = krb5_cc_retrieve_cred(context, ccache, 0, &mcreds, &creds);
97 const char * errmsg = krb5_get_error_message(context, krberr);
98 log_error(
"Credentials are not present in cache (%s)\n", errmsg);
99 krb5_free_error_message(context, errmsg);
100 result = ISC_R_FAILURE;
103 CHECK_KRB5(context, krberr,
"Credentials are not present in cache ");
105 krberr = krb5_timeofday(context, &now);
106 CHECK_KRB5(context, krberr,
"Failed to get time of day");
109 if (now > (creds.times.endtime + KRB_MIN_TIME)) {
111 result = ISC_R_FAILURE;
116 krb5_timestamp_to_sfstring(creds.times.endtime, buf, 16, &fill);
117 log_info(
"Credentials valid til %s\n", buf);
120 result = ISC_R_SUCCESS;
123 krb5_free_cred_contents(context, &creds);
124 if (mcreds.server) krb5_free_principal(context, mcreds.server);
125 if (realm) krb5_free_default_realm(context, realm);
130 krb5_get_tgt(
const char *principal,
const char *keyfile)
132 isc_result_t result = ISC_R_FAILURE;
134 krb5_context context = NULL;
135 krb5_error_code krberr;
136 krb5_ccache ccache = NULL;
137 krb5_principal kprincpw = NULL;
139 krb5_creds * my_creds_ptr = NULL;
140 krb5_get_init_creds_opt options;
141 krb5_keytab keytab = NULL;
144 if (keyfile == NULL || keyfile[0] ==
'\0') {
145 keyfile = KRB_DEFAULT_KEYTAB;
146 log_info(
"Using default keytab %s\n", keyfile);
148 if (strncmp(keyfile,
"FILE:", 5) != 0) {
149 log_error(
"Unknown keytab path format: Does it start with FILE:?\n");
150 return ISC_R_FAILURE;
154 krberr = krb5_init_context(&context);
155 CHECK_KRB5(NULL, krberr,
"Kerberos context initialization failed");
157 result = ISC_R_SUCCESS;
159 ccname =
"MEMORY:dhcp_ld_krb5_cc";
160 log_info(
"Using ccache %s\n" , ccname);
162 ret = setenv(
"KRB5CCNAME", ccname, 1);
164 log_error(
"Failed to setup environment\n");
165 result = ISC_R_FAILURE;
169 krberr = krb5_cc_resolve(context, ccname, &ccache);
170 CHECK_KRB5(context, krberr,
"Couldnt resolve ccache '%s'", ccname);
172 krberr = krb5_parse_name(context, principal, &kprincpw);
173 CHECK_KRB5(context, krberr,
"Failed to parse princ '%s'", princpal);
175 result = check_credentials(context, ccache, kprincpw);
176 if (result == ISC_R_SUCCESS) {
177 log_info(
"Found valid kerberos credentials\n");
180 log_error(
"No valid krb5 credentials\n");
183 krberr = krb5_kt_resolve(context, keyfile, &keytab);
184 CHECK_KRB5(context, krberr,
185 "Failed to resolve kt files '%s'\n", keyfile);
187 memset(&my_creds, 0,
sizeof(my_creds));
188 memset(&options, 0,
sizeof(options));
190 krb5_get_init_creds_opt_set_tkt_life(&options, KRB_MIN_TIME * 2);
191 krb5_get_init_creds_opt_set_address_list(&options, NULL);
192 krb5_get_init_creds_opt_set_forwardable(&options, 0);
193 krb5_get_init_creds_opt_set_proxiable(&options, 0);
195 krberr = krb5_get_init_creds_keytab(context, &my_creds, kprincpw,
196 keytab, 0, NULL, &options);
197 CHECK_KRB5(context, krberr,
"Failed to get initial credentials TGT\n");
199 my_creds_ptr = &my_creds;
201 krberr = krb5_cc_initialize(context, ccache, kprincpw);
202 CHECK_KRB5(context, krberr,
"Failed to init ccache\n");
204 krberr = krb5_cc_store_cred(context, ccache, &my_creds);
205 CHECK_KRB5(context, krberr,
"Failed to store credentials\n");
207 result = ISC_R_SUCCESS;
208 log_info(
"Successfully init krb tgt %s", principal);
211 if (ccache) krb5_cc_close(context, ccache);
212 if (keytab) krb5_kt_close(context, keytab);
213 if (kprincpw) krb5_free_principal(context, kprincpw);
214 if (my_creds_ptr) krb5_free_cred_contents(context, &my_creds);
215 if (context) krb5_free_context(context);
int log_error(const char *,...) __attribute__((__format__(__printf__
isc_result_t krb5_get_tgt(const char *, const char *)
int int log_info(const char *,...) __attribute__((__format__(__printf__