1 /* 2 * Copyright (c) 1997 - 2001 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "krb5_locl.h" 35 36 RCSID("$Id: keytab.c,v 1.52 2002/01/30 10:09:35 joda Exp $"); 37 38 /* 39 * Register a new keytab in `ops' 40 * Return 0 or an error. 41 */ 42 43 krb5_error_code 44 krb5_kt_register(krb5_context context, 45 const krb5_kt_ops *ops) 46 { 47 struct krb5_keytab_data *tmp; 48 49 tmp = realloc(context->kt_types, 50 (context->num_kt_types + 1) * sizeof(*context->kt_types)); 51 if(tmp == NULL) { 52 krb5_set_error_string(context, "malloc: out of memory"); 53 return ENOMEM; 54 } 55 memcpy(&tmp[context->num_kt_types], ops, 56 sizeof(tmp[context->num_kt_types])); 57 context->kt_types = tmp; 58 context->num_kt_types++; 59 return 0; 60 } 61 62 /* 63 * Resolve the keytab name (of the form `type:residual') in `name' 64 * into a keytab in `id'. 65 * Return 0 or an error 66 */ 67 68 krb5_error_code 69 krb5_kt_resolve(krb5_context context, 70 const char *name, 71 krb5_keytab *id) 72 { 73 krb5_keytab k; 74 int i; 75 const char *type, *residual; 76 size_t type_len; 77 krb5_error_code ret; 78 79 residual = strchr(name, ':'); 80 if(residual == NULL) { 81 type = "FILE"; 82 type_len = strlen(type); 83 residual = name; 84 } else { 85 type = name; 86 type_len = residual - name; 87 residual++; 88 } 89 90 for(i = 0; i < context->num_kt_types; i++) { 91 if(strncasecmp(type, context->kt_types[i].prefix, type_len) == 0) 92 break; 93 } 94 if(i == context->num_kt_types) { 95 krb5_set_error_string(context, "unknown keytab type %.*s", 96 (int)type_len, type); 97 return KRB5_KT_UNKNOWN_TYPE; 98 } 99 100 k = malloc (sizeof(*k)); 101 if (k == NULL) { 102 krb5_set_error_string(context, "malloc: out of memory"); 103 return ENOMEM; 104 } 105 memcpy(k, &context->kt_types[i], sizeof(*k)); 106 k->data = NULL; 107 ret = (*k->resolve)(context, residual, k); 108 if(ret) { 109 free(k); 110 k = NULL; 111 } 112 *id = k; 113 return ret; 114 } 115 116 /* 117 * copy the name of the default keytab into `name'. 118 * Return 0 or KRB5_CONFIG_NOTENUFSPACE if `namesize' is too short. 119 */ 120 121 krb5_error_code 122 krb5_kt_default_name(krb5_context context, char *name, size_t namesize) 123 { 124 if (strlcpy (name, context->default_keytab, namesize) >= namesize) { 125 krb5_clear_error_string (context); 126 return KRB5_CONFIG_NOTENUFSPACE; 127 } 128 return 0; 129 } 130 131 /* 132 * copy the name of the default modify keytab into `name'. 133 * Return 0 or KRB5_CONFIG_NOTENUFSPACE if `namesize' is too short. 134 */ 135 136 krb5_error_code 137 krb5_kt_default_modify_name(krb5_context context, char *name, size_t namesize) 138 { 139 const char *kt = NULL; 140 if(context->default_keytab_modify == NULL) { 141 if(strncasecmp(context->default_keytab, "ANY:", 4) != 0) 142 kt = context->default_keytab; 143 else { 144 size_t len = strcspn(context->default_keytab + 4, ","); 145 if(len >= namesize) { 146 krb5_clear_error_string(context); 147 return KRB5_CONFIG_NOTENUFSPACE; 148 } 149 strlcpy(name, context->default_keytab + 4, namesize); 150 name[len] = '\0'; 151 return 0; 152 } 153 } else 154 kt = context->default_keytab_modify; 155 if (strlcpy (name, kt, namesize) >= namesize) { 156 krb5_clear_error_string (context); 157 return KRB5_CONFIG_NOTENUFSPACE; 158 } 159 return 0; 160 } 161 162 /* 163 * Set `id' to the default keytab. 164 * Return 0 or an error. 165 */ 166 167 krb5_error_code 168 krb5_kt_default(krb5_context context, krb5_keytab *id) 169 { 170 return krb5_kt_resolve (context, context->default_keytab, id); 171 } 172 173 /* 174 * Read the key identified by `(principal, vno, enctype)' from the 175 * keytab in `keyprocarg' (the default if == NULL) into `*key'. 176 * Return 0 or an error. 177 */ 178 179 krb5_error_code 180 krb5_kt_read_service_key(krb5_context context, 181 krb5_pointer keyprocarg, 182 krb5_principal principal, 183 krb5_kvno vno, 184 krb5_enctype enctype, 185 krb5_keyblock **key) 186 { 187 krb5_keytab keytab; 188 krb5_keytab_entry entry; 189 krb5_error_code ret; 190 191 if (keyprocarg) 192 ret = krb5_kt_resolve (context, keyprocarg, &keytab); 193 else 194 ret = krb5_kt_default (context, &keytab); 195 196 if (ret) 197 return ret; 198 199 ret = krb5_kt_get_entry (context, keytab, principal, vno, enctype, &entry); 200 krb5_kt_close (context, keytab); 201 if (ret) 202 return ret; 203 ret = krb5_copy_keyblock (context, &entry.keyblock, key); 204 krb5_kt_free_entry(context, &entry); 205 return ret; 206 } 207 208 /* 209 * Retrieve the name of the keytab `keytab' into `name', `namesize' 210 * Return 0 or an error. 211 */ 212 213 krb5_error_code 214 krb5_kt_get_name(krb5_context context, 215 krb5_keytab keytab, 216 char *name, 217 size_t namesize) 218 { 219 return (*keytab->get_name)(context, keytab, name, namesize); 220 } 221 222 /* 223 * Finish using the keytab in `id'. All resources will be released. 224 * Return 0 or an error. 225 */ 226 227 krb5_error_code 228 krb5_kt_close(krb5_context context, 229 krb5_keytab id) 230 { 231 krb5_error_code ret; 232 233 ret = (*id->close)(context, id); 234 if(ret == 0) 235 free(id); 236 return ret; 237 } 238 239 /* 240 * Compare `entry' against `principal, vno, enctype'. 241 * Any of `principal, vno, enctype' might be 0 which acts as a wildcard. 242 * Return TRUE if they compare the same, FALSE otherwise. 243 */ 244 245 krb5_boolean 246 krb5_kt_compare(krb5_context context, 247 krb5_keytab_entry *entry, 248 krb5_const_principal principal, 249 krb5_kvno vno, 250 krb5_enctype enctype) 251 { 252 if(principal != NULL && 253 !krb5_principal_compare(context, entry->principal, principal)) 254 return FALSE; 255 if(vno && vno != entry->vno) 256 return FALSE; 257 if(enctype && enctype != entry->keyblock.keytype) 258 return FALSE; 259 return TRUE; 260 } 261 262 /* 263 * Retrieve the keytab entry for `principal, kvno, enctype' into `entry' 264 * from the keytab `id'. 265 * Return 0 or an error. 266 */ 267 268 krb5_error_code 269 krb5_kt_get_entry(krb5_context context, 270 krb5_keytab id, 271 krb5_const_principal principal, 272 krb5_kvno kvno, 273 krb5_enctype enctype, 274 krb5_keytab_entry *entry) 275 { 276 krb5_keytab_entry tmp; 277 krb5_error_code ret; 278 krb5_kt_cursor cursor; 279 280 if(id->get) 281 return (*id->get)(context, id, principal, kvno, enctype, entry); 282 283 ret = krb5_kt_start_seq_get (context, id, &cursor); 284 if (ret) 285 return KRB5_KT_NOTFOUND; /* XXX i.e. file not found */ 286 287 entry->vno = 0; 288 while (krb5_kt_next_entry(context, id, &tmp, &cursor) == 0) { 289 if (krb5_kt_compare(context, &tmp, principal, 0, enctype)) { 290 if (kvno == tmp.vno) { 291 krb5_kt_copy_entry_contents (context, &tmp, entry); 292 krb5_kt_free_entry (context, &tmp); 293 krb5_kt_end_seq_get(context, id, &cursor); 294 return 0; 295 } else if (kvno == 0 && tmp.vno > entry->vno) { 296 if (entry->vno) 297 krb5_kt_free_entry (context, entry); 298 krb5_kt_copy_entry_contents (context, &tmp, entry); 299 } 300 } 301 krb5_kt_free_entry(context, &tmp); 302 } 303 krb5_kt_end_seq_get (context, id, &cursor); 304 if (entry->vno) { 305 return 0; 306 } else { 307 char princ[256], kt_name[256]; 308 309 krb5_unparse_name_fixed (context, principal, princ, sizeof(princ)); 310 krb5_kt_get_name (context, id, kt_name, sizeof(kt_name)); 311 312 krb5_set_error_string (context, 313 "failed to find %s in keytab %s", 314 princ, kt_name); 315 return KRB5_KT_NOTFOUND; 316 } 317 } 318 319 /* 320 * Copy the contents of `in' into `out'. 321 * Return 0 or an error. 322 */ 323 324 krb5_error_code 325 krb5_kt_copy_entry_contents(krb5_context context, 326 const krb5_keytab_entry *in, 327 krb5_keytab_entry *out) 328 { 329 krb5_error_code ret; 330 331 memset(out, 0, sizeof(*out)); 332 out->vno = in->vno; 333 334 ret = krb5_copy_principal (context, in->principal, &out->principal); 335 if (ret) 336 goto fail; 337 ret = krb5_copy_keyblock_contents (context, 338 &in->keyblock, 339 &out->keyblock); 340 if (ret) 341 goto fail; 342 out->timestamp = in->timestamp; 343 return 0; 344 fail: 345 krb5_kt_free_entry (context, out); 346 return ret; 347 } 348 349 /* 350 * Free the contents of `entry'. 351 */ 352 353 krb5_error_code 354 krb5_kt_free_entry(krb5_context context, 355 krb5_keytab_entry *entry) 356 { 357 krb5_free_principal (context, entry->principal); 358 krb5_free_keyblock_contents (context, &entry->keyblock); 359 return 0; 360 } 361 362 #if 0 363 static int 364 xxxlock(int fd, int write) 365 { 366 if(flock(fd, (write ? LOCK_EX : LOCK_SH) | LOCK_NB) < 0) { 367 sleep(1); 368 if(flock(fd, (write ? LOCK_EX : LOCK_SH) | LOCK_NB) < 0) 369 return -1; 370 } 371 return 0; 372 } 373 374 static void 375 xxxunlock(int fd) 376 { 377 flock(fd, LOCK_UN); 378 } 379 #endif 380 381 /* 382 * Set `cursor' to point at the beginning of `id'. 383 * Return 0 or an error. 384 */ 385 386 krb5_error_code 387 krb5_kt_start_seq_get(krb5_context context, 388 krb5_keytab id, 389 krb5_kt_cursor *cursor) 390 { 391 if(id->start_seq_get == NULL) { 392 krb5_set_error_string(context, 393 "start_seq_get is not supported in the %s " 394 " keytab", id->prefix); 395 return HEIM_ERR_OPNOTSUPP; 396 } 397 return (*id->start_seq_get)(context, id, cursor); 398 } 399 400 /* 401 * Get the next entry from `id' pointed to by `cursor' and advance the 402 * `cursor'. 403 * Return 0 or an error. 404 */ 405 406 krb5_error_code 407 krb5_kt_next_entry(krb5_context context, 408 krb5_keytab id, 409 krb5_keytab_entry *entry, 410 krb5_kt_cursor *cursor) 411 { 412 if(id->next_entry == NULL) { 413 krb5_set_error_string(context, 414 "next_entry is not supported in the %s " 415 " keytab", id->prefix); 416 return HEIM_ERR_OPNOTSUPP; 417 } 418 return (*id->next_entry)(context, id, entry, cursor); 419 } 420 421 /* 422 * Release all resources associated with `cursor'. 423 */ 424 425 krb5_error_code 426 krb5_kt_end_seq_get(krb5_context context, 427 krb5_keytab id, 428 krb5_kt_cursor *cursor) 429 { 430 if(id->end_seq_get == NULL) { 431 krb5_set_error_string(context, 432 "end_seq_get is not supported in the %s " 433 " keytab", id->prefix); 434 return HEIM_ERR_OPNOTSUPP; 435 } 436 return (*id->end_seq_get)(context, id, cursor); 437 } 438 439 /* 440 * Add the entry in `entry' to the keytab `id'. 441 * Return 0 or an error. 442 */ 443 444 krb5_error_code 445 krb5_kt_add_entry(krb5_context context, 446 krb5_keytab id, 447 krb5_keytab_entry *entry) 448 { 449 if(id->add == NULL) { 450 krb5_set_error_string(context, "Add is not supported in the %s keytab", 451 id->prefix); 452 return KRB5_KT_NOWRITE; 453 } 454 entry->timestamp = time(NULL); 455 return (*id->add)(context, id,entry); 456 } 457 458 /* 459 * Remove the entry `entry' from the keytab `id'. 460 * Return 0 or an error. 461 */ 462 463 krb5_error_code 464 krb5_kt_remove_entry(krb5_context context, 465 krb5_keytab id, 466 krb5_keytab_entry *entry) 467 { 468 if(id->remove == NULL) { 469 krb5_set_error_string(context, 470 "Remove is not supported in the %s keytab", 471 id->prefix); 472 return KRB5_KT_NOWRITE; 473 } 474 return (*id->remove)(context, id, entry); 475 } 476