xref: /freebsd/crypto/krb5/src/lib/kdb/kdb_cpw.c (revision f1c4c3daccbaf3820f0e2224de53df12fc952fcc)

/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/* lib/kdb/kdb_cpw.c */
/*
 * Copyright 1995, 2009, 2014 by the Massachusetts Institute of Technology.
 * All Rights Reserved.
 *
 * Export of this software from the United States of America may
 *   require a specific license from the United States Government.
 *   It is the responsibility of any person or organization contemplating
 *   export to obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  Furthermore if you modify this software you must label
 * your software as modified software and not distribute it in such a
 * fashion that it might be confused with the original M.I.T. software.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 */
/*
 * Copyright (C) 1998 by the FundsXpress, INC.
 *
 * All rights reserved.
 *
 * Export of this software from the United States of America may require
 * a specific license from the United States Government.  It is the
 * responsibility of any person or organization contemplating export to
 * obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of FundsXpress. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  FundsXpress makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#include "k5-int.h"
#include "kdb.h"
#include <stdio.h>
#include <errno.h>

int
krb5_db_get_key_data_kvno(krb5_context context, int count, krb5_key_data *data)
{
    int i, kvno;
    /* Find last key version number */
    for (kvno = i = 0; i < count; i++) {
        if (kvno < data[i].key_data_kvno) {
            kvno = data[i].key_data_kvno;
        }
    }
    return(kvno);
}

static void
cleanup_key_data(krb5_context context, int count, krb5_key_data *data)
{
    int i;

    /* If data is NULL, count is always 0 */
    if (data == NULL) return;

    for (i = 0; i < count; i++)
        krb5_dbe_free_key_data_contents(context, &data[i]);
    free(data);
}

/* Transfer key data from old_kd to new_kd, making sure that new_kd is
 * encrypted with mkey.  May steal from old_kd and zero it out. */
static krb5_error_code
preserve_one_old_key(krb5_context context, krb5_keyblock *mkey,
                     krb5_db_entry *dbent, krb5_key_data *old_kd,
                     krb5_key_data *new_kd)
{
    krb5_error_code ret;
    krb5_keyblock kb;
    krb5_keysalt salt;

    memset(new_kd, 0, sizeof(*new_kd));

    ret = krb5_dbe_decrypt_key_data(context, mkey, old_kd, &kb, NULL);
    if (ret == 0) {
        /* old_kd is already encrypted in mkey, so just move it. */
        *new_kd = *old_kd;
        memset(old_kd, 0, sizeof(*old_kd));
        krb5_free_keyblock_contents(context, &kb);
        return 0;
    }

    /* Decrypt and re-encrypt old_kd using mkey. */
    ret = krb5_dbe_decrypt_key_data(context, NULL, old_kd, &kb, &salt);
    if (ret)
        return ret;
    ret = krb5_dbe_encrypt_key_data(context, mkey, &kb, &salt,
                                    old_kd->key_data_kvno, new_kd);
    krb5_free_keyblock_contents(context, &kb);
    krb5_free_data_contents(context, &salt.data);
    return ret;
}

/*
 * Add key_data to dbent, making sure that each entry is encrypted in mkey.  If
 * keepold is greater than 1, preserve only the first (keepold-1) key versions,
 * so that the total number of key versions including the new key set is
 * keepold.  May steal some elements from key_data and zero them out.
 */
static krb5_error_code
preserve_old_keys(krb5_context context, krb5_keyblock *mkey,
                  krb5_db_entry *dbent, unsigned int keepold, int n_key_data,
                  krb5_key_data *key_data)
{
    krb5_error_code ret;
    krb5_kvno last_kvno = 0, kvno_changes = 0;
    int i;

    for (i = 0; i < n_key_data; i++) {
        if (keepold > 1) {
            if (i > 0 && key_data[i].key_data_kvno != last_kvno)
                kvno_changes++;
            if (kvno_changes >= keepold - 1)
                break;
            last_kvno = key_data[i].key_data_kvno;
        }

        ret = krb5_dbe_create_key_data(context, dbent);
        if (ret)
            return ret;
        ret = preserve_one_old_key(context, mkey, dbent, &key_data[i],
                                   &dbent->key_data[dbent->n_key_data - 1]);
        if (ret)
            return ret;
    }
    return 0;
}

static krb5_error_code
add_key_rnd(krb5_context context, krb5_keyblock *master_key,
            krb5_key_salt_tuple *ks_tuple, int ks_tuple_count,
            krb5_db_entry *db_entry, int kvno)
{
    krb5_keyblock         key;
    int                   i, j;
    krb5_error_code       retval;
    krb5_key_data        *kd_slot;

    for (i = 0; i < ks_tuple_count; i++) {
        krb5_boolean similar;

        similar = 0;

        /*
         * We could use krb5_keysalt_iterate to replace this loop, or use
         * krb5_keysalt_is_present for the loop below, but we want to avoid
         * circular library dependencies.
         */
        for (j = 0; j < i; j++) {
            if ((retval = krb5_c_enctype_compare(context,
                                                 ks_tuple[i].ks_enctype,
                                                 ks_tuple[j].ks_enctype,
                                                 &similar)))
                return(retval);

            if (similar)
                break;
        }

        if (similar)
            continue;

        if ((retval = krb5_dbe_create_key_data(context, db_entry)))
            return retval;
        kd_slot = &db_entry->key_data[db_entry->n_key_data - 1];

        /* there used to be code here to extract the old key, and derive
           a new key from it.  Now that there's a unified prng, that isn't
           necessary. */

        /* make new key */
        if ((retval = krb5_c_make_random_key(context, ks_tuple[i].ks_enctype,
                                             &key)))
            return retval;

        retval = krb5_dbe_encrypt_key_data(context, master_key, &key, NULL,
                                           kvno, kd_slot);

        krb5_free_keyblock_contents(context, &key);
        if( retval )
            return retval;
    }

    return 0;
}

/* Construct a random explicit salt. */
static krb5_error_code
make_random_salt(krb5_context context, krb5_keysalt *salt_out)
{
    krb5_error_code retval;
    unsigned char rndbuf[8];
    krb5_data salt, rnd = make_data(rndbuf, sizeof(rndbuf));
    unsigned int i;

    /*
     * Salts are limited by RFC 4120 to 7-bit ASCII.  For ease of examination
     * and to avoid certain folding issues for older enctypes, we use printable
     * characters with four fixed bits and four random bits, encoding 64
     * psuedo-random bits into 16 bytes.
     */
    retval = krb5_c_random_make_octets(context, &rnd);
    if (retval)
        return retval;
    retval = alloc_data(&salt, sizeof(rndbuf) * 2);
    if (retval)
        return retval;
    for (i = 0; i < sizeof(rndbuf); i++) {
        salt.data[i * 2] = 0x40 | (rndbuf[i] >> 4);
        salt.data[i * 2 + 1] = 0x40 | (rndbuf[i] & 0xf);
    }

    salt_out->type = KRB5_KDB_SALTTYPE_SPECIAL;
    salt_out->data = salt;
    return 0;
}

/*
 * Add key_data for a krb5_db_entry
 * If passwd is NULL the assumes that the caller wants a random password.
 */
static krb5_error_code
add_key_pwd(krb5_context context, krb5_keyblock *master_key,
            krb5_key_salt_tuple *ks_tuple, int ks_tuple_count,
            const char *passwd, krb5_db_entry *db_entry, int kvno)
{
    krb5_error_code       retval;
    krb5_keysalt          key_salt;
    krb5_keyblock         key;
    krb5_data             pwd;
    int                   i, j;
    krb5_key_data        *kd_slot;

    for (i = 0; i < ks_tuple_count; i++) {
        krb5_boolean similar;

        similar = 0;

        /*
         * We could use krb5_keysalt_iterate to replace this loop, or use
         * krb5_keysalt_is_present for the loop below, but we want to avoid
         * circular library dependencies.
         */
        for (j = 0; j < i; j++) {
            if ((retval = krb5_c_enctype_compare(context,
                                                 ks_tuple[i].ks_enctype,
                                                 ks_tuple[j].ks_enctype,
                                                 &similar)))
                return(retval);

            if (similar)
                break;
        }

        if (j < i)
            continue;

        if ((retval = krb5_dbe_create_key_data(context, db_entry)))
            return(retval);
        kd_slot = &db_entry->key_data[db_entry->n_key_data - 1];

        /* Convert password string to key using appropriate salt */
        switch (key_salt.type = ks_tuple[i].ks_salttype) {
        case KRB5_KDB_SALTTYPE_ONLYREALM: {
            krb5_data * saltdata;
            if ((retval = krb5_copy_data(context, krb5_princ_realm(context,
                                                                   db_entry->princ), &saltdata)))
                return(retval);

            key_salt.data = *saltdata;
            free(saltdata);
        }
            break;
        case KRB5_KDB_SALTTYPE_NOREALM:
            if ((retval=krb5_principal2salt_norealm(context, db_entry->princ,
                                                    &key_salt.data)))
                return(retval);
            break;
        case KRB5_KDB_SALTTYPE_NORMAL:
            if ((retval = krb5_principal2salt(context, db_entry->princ,
                                              &key_salt.data)))
                return(retval);
            break;
        case KRB5_KDB_SALTTYPE_SPECIAL:
            retval = make_random_salt(context, &key_salt);
            if (retval)
                return retval;
            break;
        default:
            return(KRB5_KDB_BAD_SALTTYPE);
        }

        pwd = string2data((char *)passwd);

        retval = krb5_c_string_to_key_with_params(context,
                                                  ks_tuple[i].ks_enctype,
                                                  &pwd, &key_salt.data,
                                                  NULL, &key);
        if (retval) {
            free(key_salt.data.data);
            return retval;
        }

        retval = krb5_dbe_encrypt_key_data(context, master_key, &key,
                                           (const krb5_keysalt *)&key_salt,
                                           kvno, kd_slot);
        if (key_salt.data.data)
            free(key_salt.data.data);
        free(key.contents);

        if( retval )
            return retval;
    }

    return 0;
}

static krb5_error_code
rekey(krb5_context context, krb5_keyblock *mkey, krb5_key_salt_tuple *ks_tuple,
      int ks_tuple_count, const char *password, int new_kvno,
      unsigned int keepold, krb5_db_entry *db_entry)
{
    krb5_error_code ret;
    krb5_key_data *key_data;
    int n_key_data, old_kvno;

    /* Save aside the old key data. */
    n_key_data = db_entry->n_key_data;
    key_data = db_entry->key_data;
    db_entry->n_key_data = 0;
    db_entry->key_data = NULL;

    /* Make sure the new kvno is greater than the old largest kvno. */
    old_kvno = krb5_db_get_key_data_kvno(context, n_key_data, key_data);
    if (new_kvno < old_kvno + 1)
        new_kvno = old_kvno + 1;
    /* Wrap from 65535 to 1; we can only store 16-bit kvno values in key_data,
     * and we assign special meaning to kvno 0. */
    if (new_kvno == (1 << 16))
        new_kvno = 1;

    /* Add new keys to the front of the list. */
    if (password != NULL) {
        ret = add_key_pwd(context, mkey, ks_tuple, ks_tuple_count, password,
                          db_entry, new_kvno);
    } else {
        ret = add_key_rnd(context, mkey, ks_tuple, ks_tuple_count, db_entry,
                          new_kvno);
    }
    if (ret) {
        cleanup_key_data(context, db_entry->n_key_data, db_entry->key_data);
        db_entry->n_key_data = n_key_data;
        db_entry->key_data = key_data;
        return ret;
    }

    /* Possibly add some or all of the old keys to the back of the list.  May
     * steal from and zero out some of the old key data entries. */
    if (keepold > 0) {
        ret = preserve_old_keys(context, mkey, db_entry, keepold, n_key_data,
                                key_data);
    }

    /* Free any old key data entries not stolen and zeroed out above. */
    cleanup_key_data(context, n_key_data, key_data);
    return ret;
}

/*
 * Change random key for a krb5_db_entry
 * Assumes the max kvno
 *
 * As a side effect all old keys are nuked if keepold is false.
 */
krb5_error_code
krb5_dbe_crk(krb5_context context, krb5_keyblock *mkey,
             krb5_key_salt_tuple *ks_tuple, int ks_tuple_count,
             unsigned int keepold, krb5_db_entry *dbent)
{
    return rekey(context, mkey, ks_tuple, ks_tuple_count, NULL, 0, keepold,
                 dbent);
}

/*
 * Add random key for a krb5_db_entry
 * Assumes the max kvno
 *
 * As a side effect all old keys older than the max kvno are nuked.
 */
krb5_error_code
krb5_dbe_ark(krb5_context context, krb5_keyblock *mkey,
             krb5_key_salt_tuple *ks_tuple, int ks_tuple_count,
             krb5_db_entry *dbent)
{
    return rekey(context, mkey, ks_tuple, ks_tuple_count, NULL, 0, 2, dbent);
}

/*
 * Change password for a krb5_db_entry
 * Assumes the max kvno
 *
 * As a side effect all old keys are nuked if keepold is false.
 */
krb5_error_code
krb5_dbe_def_cpw(krb5_context context, krb5_keyblock *mkey,
                 krb5_key_salt_tuple *ks_tuple, int ks_tuple_count,
                 char *password, int new_kvno, unsigned int keepold,
                 krb5_db_entry *dbent)
{
    return rekey(context, mkey, ks_tuple, ks_tuple_count, password, new_kvno,
                 keepold, dbent);
}

/*
 * Add password for a krb5_db_entry
 * Assumes the max kvno
 *
 * As a side effect all old keys older than the max kvno are nuked.
 */
krb5_error_code
krb5_dbe_apw(krb5_context context, krb5_keyblock *mkey,
             krb5_key_salt_tuple *ks_tuple, int ks_tuple_count, char *password,
             krb5_db_entry *dbent)
{
    return rekey(context, mkey, ks_tuple, ks_tuple_count, password, 0, 2,
                 dbent);
}