s4:kerberos Add 'net export keytab' command for wireshark decryption

It is much easier to do decryption with wireshark when the keytab is
available for every host in the domain.  Running 'net export keytab
<keytab name>' will export the current (as pointed to by the supplied
smb.conf) local Samba4 doamin.

(This uses Heimdal's 'hdb' keytab and then the existing hdb-samba4,
and so has a good chance of keeping working in the long term).

Andrew Bartlett

1 files changed, 53 insertions, 0 deletions

diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c
new file mode 100644
index 0000000000..a7006b4bf9
--- /dev/null
+++ b/source4/libnet/libnet_export_keytab.c
@@ -0,0 +1,53 @@
+#include "includes.h"
+#include "system/kerberos.h"
+#include "auth/kerberos/kerberos.h"
+#include <hdb.h>
+#include "kdc/hdb-samba4.h"
+#include "libnet/libnet.h"
+
+NTSTATUS libnet_export_keytab(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_export_keytab *r)
+{
+	krb5_error_code ret;
+	struct smb_krb5_context *smb_krb5_context;
+	const char *from_keytab;
+
+	/* Register hdb-samba4 hooks for use as a keytab */
+
+	struct hdb_samba4_context *hdb_samba4_context = talloc(mem_ctx, struct hdb_samba4_context);
+	if (!hdb_samba4_context) {
+		return NT_STATUS_NO_MEMORY; 
+	}
+
+	hdb_samba4_context->ev_ctx = ctx->event_ctx;
+	hdb_samba4_context->lp_ctx = ctx->lp_ctx;
+
+	from_keytab = talloc_asprintf(hdb_samba4_context, "HDB:samba4&%p", hdb_samba4_context);
+	if (!from_keytab) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	ret = smb_krb5_init_context(ctx, ctx->event_ctx, ctx->lp_ctx, &smb_krb5_context);
+	if (ret) {
+		return NT_STATUS_NO_MEMORY; 
+	}
+
+	ret = krb5_plugin_register(smb_krb5_context->krb5_context, 
+				   PLUGIN_TYPE_DATA, "hdb",
+				   &hdb_samba4);
+	if(ret) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	ret = krb5_kt_register(smb_krb5_context->krb5_context, &hdb_kt_ops);
+	if(ret) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	ret = kt_copy(smb_krb5_context->krb5_context, from_keytab, r->in.keytab_name);
+	if(ret) {
+		r->out.error_string = smb_get_krb5_error_message(smb_krb5_context->krb5_context,
+								 ret, mem_ctx);
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+	return NT_STATUS_OK;
+}