1 /* 2 * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "kadm5_locl.h" 35 36 RCSID("$Id: set_keys.c,v 1.18 1999/12/04 23:11:01 assar Exp $"); 37 38 /* 39 * free all the memory used by (len, keys) 40 */ 41 42 static void 43 free_keys (kadm5_server_context *context, 44 int len, Key *keys) 45 { 46 int i; 47 48 for (i = 0; i < len; ++i) { 49 free (keys[i].mkvno); 50 keys[i].mkvno = NULL; 51 if (keys[i].salt != NULL) { 52 free_Salt(keys[i].salt); 53 free(keys[i].salt); 54 keys[i].salt = NULL; 55 } 56 krb5_free_keyblock_contents(context->context, &keys[i].key); 57 } 58 free (keys); 59 } 60 61 /* 62 * null-ify `len', `keys' 63 */ 64 65 static void 66 init_keys (Key *keys, int len) 67 { 68 int i; 69 70 for (i = 0; i < len; ++i) { 71 keys[i].mkvno = NULL; 72 keys[i].salt = NULL; 73 keys[i].key.keyvalue.length = 0; 74 keys[i].key.keyvalue.data = NULL; 75 } 76 } 77 78 /* 79 * the known and used DES enctypes 80 */ 81 82 static krb5_enctype des_types[] = { ETYPE_DES_CBC_CRC, 83 ETYPE_DES_CBC_MD4, 84 ETYPE_DES_CBC_MD5 }; 85 86 static unsigned n_des_types = 3; 87 88 /* 89 * Set the keys of `ent' to the string-to-key of `password' 90 */ 91 92 kadm5_ret_t 93 _kadm5_set_keys(kadm5_server_context *context, 94 hdb_entry *ent, 95 const char *password) 96 { 97 kadm5_ret_t ret = 0; 98 int i; 99 unsigned len; 100 Key *keys; 101 krb5_salt salt; 102 krb5_boolean v4_salt = FALSE; 103 104 len = n_des_types + 1; 105 keys = malloc (len * sizeof(*keys)); 106 if (keys == NULL) 107 return ENOMEM; 108 109 init_keys (keys, len); 110 111 salt.salttype = KRB5_PW_SALT; 112 salt.saltvalue.length = 0; 113 salt.saltvalue.data = NULL; 114 115 if (krb5_config_get_bool (context->context, 116 NULL, "kadmin", "use_v4_salt", NULL)) { 117 v4_salt = TRUE; 118 } else { 119 ret = krb5_get_pw_salt (context->context, ent->principal, &salt); 120 if (ret) 121 goto out; 122 } 123 124 for (i = 0; i < n_des_types; ++i) { 125 ret = krb5_string_to_key_salt (context->context, 126 des_types[i], 127 password, 128 salt, 129 &keys[i].key); 130 if (ret) 131 goto out; 132 if (v4_salt) { 133 keys[i].salt = malloc (sizeof(*keys[i].salt)); 134 if (keys[i].salt == NULL) { 135 ret = ENOMEM; 136 goto out; 137 } 138 keys[i].salt->type = salt.salttype; 139 ret = copy_octet_string (&salt.saltvalue, &keys[i].salt->salt); 140 if (ret) 141 goto out; 142 } 143 } 144 145 ret = krb5_string_to_key (context->context, 146 ETYPE_DES3_CBC_SHA1, 147 password, 148 ent->principal, 149 &keys[n_des_types].key); 150 if (ret) 151 goto out; 152 153 free_keys (context, ent->keys.len, ent->keys.val); 154 ent->keys.len = len; 155 ent->keys.val = keys; 156 ent->kvno++; 157 return ret; 158 out: 159 krb5_data_free (&salt.saltvalue); 160 free_keys (context, len, keys); 161 return ret; 162 } 163 164 /* 165 * Set the keys of `ent' to (`n_key_data', `key_data') 166 */ 167 168 kadm5_ret_t 169 _kadm5_set_keys2(hdb_entry *ent, 170 int16_t n_key_data, 171 krb5_key_data *key_data) 172 { 173 krb5_error_code ret; 174 int i; 175 176 ent->keys.len = n_key_data; 177 ent->keys.val = malloc(ent->keys.len * sizeof(*ent->keys.val)); 178 if(ent->keys.val == NULL) 179 return ENOMEM; 180 for(i = 0; i < n_key_data; i++) { 181 ent->keys.val[i].mkvno = NULL; 182 ent->keys.val[i].key.keytype = key_data[i].key_data_type[0]; 183 ret = krb5_data_copy(&ent->keys.val[i].key.keyvalue, 184 key_data[i].key_data_contents[0], 185 key_data[i].key_data_length[0]); 186 if(ret) 187 return ret; 188 if(key_data[i].key_data_ver == 2) { 189 Salt *salt; 190 salt = malloc(sizeof(*salt)); 191 if(salt == NULL) 192 return ENOMEM; 193 ent->keys.val[i].salt = salt; 194 salt->type = key_data[i].key_data_type[1]; 195 krb5_data_copy(&salt->salt, 196 key_data[i].key_data_contents[1], 197 key_data[i].key_data_length[1]); 198 } else 199 ent->keys.val[i].salt = NULL; 200 } 201 ent->kvno++; 202 return 0; 203 } 204 205 /* 206 * Set the keys of `ent' to random keys and return them in `n_keys' 207 * and `new_keys'. 208 */ 209 210 kadm5_ret_t 211 _kadm5_set_keys_randomly (kadm5_server_context *context, 212 hdb_entry *ent, 213 krb5_keyblock **new_keys, 214 int *n_keys) 215 { 216 kadm5_ret_t ret = 0; 217 int i; 218 unsigned len; 219 krb5_keyblock *keys; 220 Key *hkeys; 221 222 len = n_des_types + 1; 223 keys = malloc (len * sizeof(*keys)); 224 if (keys == NULL) 225 return ENOMEM; 226 227 for (i = 0; i < len; ++i) { 228 keys[i].keyvalue.length = 0; 229 keys[i].keyvalue.data = NULL; 230 } 231 232 hkeys = malloc (len * sizeof(*hkeys)); 233 if (hkeys == NULL) { 234 free (keys); 235 return ENOMEM; 236 } 237 238 init_keys (hkeys, len); 239 240 ret = krb5_generate_random_keyblock (context->context, 241 des_types[0], 242 &keys[0]); 243 if (ret) 244 goto out; 245 246 ret = krb5_copy_keyblock_contents (context->context, 247 &keys[0], 248 &hkeys[0].key); 249 if (ret) 250 goto out; 251 252 for (i = 1; i < n_des_types; ++i) { 253 ret = krb5_copy_keyblock_contents (context->context, 254 &keys[0], 255 &keys[i]); 256 if (ret) 257 goto out; 258 keys[i].keytype = des_types[i]; 259 ret = krb5_copy_keyblock_contents (context->context, 260 &keys[0], 261 &hkeys[i].key); 262 if (ret) 263 goto out; 264 hkeys[i].key.keytype = des_types[i]; 265 } 266 267 ret = krb5_generate_random_keyblock (context->context, 268 ETYPE_DES3_CBC_SHA1, 269 &keys[n_des_types]); 270 if (ret) 271 goto out; 272 273 ret = krb5_copy_keyblock_contents (context->context, 274 &keys[n_des_types], 275 &hkeys[n_des_types].key); 276 if (ret) 277 goto out; 278 279 free_keys (context, ent->keys.len, ent->keys.val); 280 ent->keys.len = len; 281 ent->keys.val = hkeys; 282 ent->kvno++; 283 *new_keys = keys; 284 *n_keys = len; 285 return ret; 286 out: 287 for (i = 0; i < len; ++i) 288 krb5_free_keyblock_contents (context->context, &keys[i]); 289 free (keys); 290 free_keys (context, len, hkeys); 291 return ret; 292 } 293