keytab.c revision 78527
1193323Sed/* 2193323Sed * Copyright (c) 1997 - 2001 Kungliga Tekniska H�gskolan 3193323Sed * (Royal Institute of Technology, Stockholm, Sweden). 4193323Sed * All rights reserved. 5193323Sed * 6193323Sed * Redistribution and use in source and binary forms, with or without 7193323Sed * modification, are permitted provided that the following conditions 8193323Sed * are met: 9193323Sed * 10193323Sed * 1. Redistributions of source code must retain the above copyright 11193323Sed * notice, this list of conditions and the following disclaimer. 12193323Sed * 13193323Sed * 2. Redistributions in binary form must reproduce the above copyright 14193323Sed * notice, this list of conditions and the following disclaimer in the 15193323Sed * documentation and/or other materials provided with the distribution. 16193323Sed * 17193323Sed * 3. Neither the name of the Institute nor the names of its contributors 18193323Sed * may be used to endorse or promote products derived from this software 19193323Sed * without specific prior written permission. 20193323Sed * 21193323Sed * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22193323Sed * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23193323Sed * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24193323Sed * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25193323Sed * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26193323Sed * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27193323Sed * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28193323Sed * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29193323Sed * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30193323Sed * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31202878Srdivacky * SUCH DAMAGE. 32202878Srdivacky */ 33193323Sed 34206124Srdivacky#include "krb5_locl.h" 35206124Srdivacky 36206124SrdivackyRCSID("$Id: keytab.c,v 1.50 2001/05/14 06:14:48 assar Exp $"); 37206124Srdivacky 38193323Sed/* 39193323Sed * Register a new keytab in `ops' 40193323Sed * Return 0 or an error. 41193323Sed */ 42193323Sed 43193323Sedkrb5_error_code 44193323Sedkrb5_kt_register(krb5_context context, 45193323Sed const krb5_kt_ops *ops) 46193323Sed{ 47193323Sed struct krb5_keytab_data *tmp; 48193323Sed 49193323Sed tmp = realloc(context->kt_types, 50193323Sed (context->num_kt_types + 1) * sizeof(*context->kt_types)); 51193323Sed if(tmp == NULL) { 52193323Sed krb5_set_error_string(context, "malloc: out of memory"); 53193323Sed return ENOMEM; 54193323Sed } 55193323Sed memcpy(&tmp[context->num_kt_types], ops, 56193323Sed sizeof(tmp[context->num_kt_types])); 57193323Sed context->kt_types = tmp; 58193323Sed context->num_kt_types++; 59200581Srdivacky return 0; 60193323Sed} 61193323Sed 62193323Sed/* 63193323Sed * Resolve the keytab name (of the form `type:residual') in `name' 64193323Sed * into a keytab in `id'. 65193323Sed * Return 0 or an error 66193323Sed */ 67193323Sed 68193323Sedkrb5_error_code 69193323Sedkrb5_kt_resolve(krb5_context context, 70193323Sed const char *name, 71193323Sed krb5_keytab *id) 72193323Sed{ 73193323Sed krb5_keytab k; 74193323Sed int i; 75193323Sed const char *type, *residual; 76193323Sed size_t type_len; 77193323Sed krb5_error_code ret; 78193323Sed 79193323Sed residual = strchr(name, ':'); 80200581Srdivacky if(residual == NULL) { 81193323Sed type = "FILE"; 82193323Sed type_len = strlen(type); 83193323Sed residual = name; 84193323Sed } else { 85193323Sed type = name; 86193323Sed type_len = residual - name; 87193323Sed residual++; 88193323Sed } 89193323Sed 90193323Sed for(i = 0; i < context->num_kt_types; i++) { 91193323Sed if(strncmp(type, context->kt_types[i].prefix, type_len) == 0) 92193323Sed break; 93193323Sed } 94193323Sed if(i == context->num_kt_types) { 95193323Sed krb5_set_error_string(context, "unknown keytab type %.*s", 96193323Sed (int)type_len, type); 97193323Sed return KRB5_KT_UNKNOWN_TYPE; 98193323Sed } 99193323Sed 100193323Sed k = malloc (sizeof(*k)); 101202878Srdivacky if (k == NULL) { 102202878Srdivacky krb5_set_error_string(context, "malloc: out of memory"); 103202878Srdivacky return ENOMEM; 104193323Sed } 105193323Sed memcpy(k, &context->kt_types[i], sizeof(*k)); 106193323Sed k->data = NULL; 107193323Sed ret = (*k->resolve)(context, residual, k); 108193323Sed if(ret) { 109193323Sed free(k); 110193323Sed k = NULL; 111193323Sed } 112193323Sed *id = k; 113193323Sed return ret; 114193323Sed} 115193323Sed 116193323Sed/* 117193323Sed * copy the name of the default keytab into `name'. 118193323Sed * Return 0 or KRB5_CONFIG_NOTENUFSPACE if `namesize' is too short. 119193323Sed */ 120193323Sed 121198090Srdivackykrb5_error_code 122198090Srdivackykrb5_kt_default_name(krb5_context context, char *name, size_t namesize) 123193323Sed{ 124193323Sed if (strlcpy (name, context->default_keytab, namesize) >= namesize) { 125198090Srdivacky krb5_clear_error_string (context); 126198090Srdivacky return KRB5_CONFIG_NOTENUFSPACE; 127198090Srdivacky } 128193323Sed return 0; 129193323Sed} 130193323Sed 131193323Sed/* 132193323Sed * copy the name of the default modify keytab into `name'. 133193323Sed * Return 0 or KRB5_CONFIG_NOTENUFSPACE if `namesize' is too short. 134193323Sed */ 135193323Sed 136193323Sedkrb5_error_code 137193323Sedkrb5_kt_default_modify_name(krb5_context context, char *name, size_t namesize) 138193323Sed{ 139193323Sed if (strlcpy (name, context->default_keytab_modify, namesize) >= namesize) { 140193323Sed krb5_clear_error_string (context); 141193323Sed return KRB5_CONFIG_NOTENUFSPACE; 142193323Sed } 143193323Sed return 0; 144193323Sed} 145193323Sed 146193323Sed/* 147193323Sed * Set `id' to the default keytab. 148193323Sed * Return 0 or an error. 149193323Sed */ 150193323Sed 151193323Sedkrb5_error_code 152193323Sedkrb5_kt_default(krb5_context context, krb5_keytab *id) 153193323Sed{ 154193323Sed return krb5_kt_resolve (context, context->default_keytab, id); 155193323Sed} 156193323Sed 157193323Sed/* 158193323Sed * Read the key identified by `(principal, vno, enctype)' from the 159 * keytab in `keyprocarg' (the default if == NULL) into `*key'. 160 * Return 0 or an error. 161 */ 162 163krb5_error_code 164krb5_kt_read_service_key(krb5_context context, 165 krb5_pointer keyprocarg, 166 krb5_principal principal, 167 krb5_kvno vno, 168 krb5_enctype enctype, 169 krb5_keyblock **key) 170{ 171 krb5_keytab keytab; 172 krb5_keytab_entry entry; 173 krb5_error_code ret; 174 175 if (keyprocarg) 176 ret = krb5_kt_resolve (context, keyprocarg, &keytab); 177 else 178 ret = krb5_kt_default (context, &keytab); 179 180 if (ret) 181 return ret; 182 183 ret = krb5_kt_get_entry (context, keytab, principal, vno, enctype, &entry); 184 krb5_kt_close (context, keytab); 185 if (ret) 186 return ret; 187 ret = krb5_copy_keyblock (context, &entry.keyblock, key); 188 krb5_kt_free_entry(context, &entry); 189 return ret; 190} 191 192/* 193 * Retrieve the name of the keytab `keytab' into `name', `namesize' 194 * Return 0 or an error. 195 */ 196 197krb5_error_code 198krb5_kt_get_name(krb5_context context, 199 krb5_keytab keytab, 200 char *name, 201 size_t namesize) 202{ 203 return (*keytab->get_name)(context, keytab, name, namesize); 204} 205 206/* 207 * Finish using the keytab in `id'. All resources will be released. 208 * Return 0 or an error. 209 */ 210 211krb5_error_code 212krb5_kt_close(krb5_context context, 213 krb5_keytab id) 214{ 215 krb5_error_code ret; 216 217 ret = (*id->close)(context, id); 218 if(ret == 0) 219 free(id); 220 return ret; 221} 222 223/* 224 * Compare `entry' against `principal, vno, enctype'. 225 * Any of `principal, vno, enctype' might be 0 which acts as a wildcard. 226 * Return TRUE if they compare the same, FALSE otherwise. 227 */ 228 229krb5_boolean 230krb5_kt_compare(krb5_context context, 231 krb5_keytab_entry *entry, 232 krb5_const_principal principal, 233 krb5_kvno vno, 234 krb5_enctype enctype) 235{ 236 if(principal != NULL && 237 !krb5_principal_compare(context, entry->principal, principal)) 238 return FALSE; 239 if(vno && vno != entry->vno) 240 return FALSE; 241 if(enctype && enctype != entry->keyblock.keytype) 242 return FALSE; 243 return TRUE; 244} 245 246/* 247 * Retrieve the keytab entry for `principal, kvno, enctype' into `entry' 248 * from the keytab `id'. 249 * Return 0 or an error. 250 */ 251 252krb5_error_code 253krb5_kt_get_entry(krb5_context context, 254 krb5_keytab id, 255 krb5_const_principal principal, 256 krb5_kvno kvno, 257 krb5_enctype enctype, 258 krb5_keytab_entry *entry) 259{ 260 krb5_keytab_entry tmp; 261 krb5_error_code ret; 262 krb5_kt_cursor cursor; 263 264 if(id->get) 265 return (*id->get)(context, id, principal, kvno, enctype, entry); 266 267 ret = krb5_kt_start_seq_get (context, id, &cursor); 268 if (ret) 269 return KRB5_KT_NOTFOUND; /* XXX i.e. file not found */ 270 271 entry->vno = 0; 272 while (krb5_kt_next_entry(context, id, &tmp, &cursor) == 0) { 273 if (krb5_kt_compare(context, &tmp, principal, 0, enctype)) { 274 if (kvno == tmp.vno) { 275 krb5_kt_copy_entry_contents (context, &tmp, entry); 276 krb5_kt_free_entry (context, &tmp); 277 krb5_kt_end_seq_get(context, id, &cursor); 278 return 0; 279 } else if (kvno == 0 && tmp.vno > entry->vno) { 280 if (entry->vno) 281 krb5_kt_free_entry (context, entry); 282 krb5_kt_copy_entry_contents (context, &tmp, entry); 283 } 284 } 285 krb5_kt_free_entry(context, &tmp); 286 } 287 krb5_kt_end_seq_get (context, id, &cursor); 288 if (entry->vno) { 289 return 0; 290 } else { 291 char princ[256], kt_name[256]; 292 293 krb5_unparse_name_fixed (context, principal, princ, sizeof(princ)); 294 krb5_kt_get_name (context, id, kt_name, sizeof(kt_name)); 295 296 krb5_set_error_string (context, 297 "failed to find %s in keytab %s", 298 princ, kt_name); 299 return KRB5_KT_NOTFOUND; 300 } 301} 302 303/* 304 * Copy the contents of `in' into `out'. 305 * Return 0 or an error. 306 */ 307 308krb5_error_code 309krb5_kt_copy_entry_contents(krb5_context context, 310 const krb5_keytab_entry *in, 311 krb5_keytab_entry *out) 312{ 313 krb5_error_code ret; 314 315 memset(out, 0, sizeof(*out)); 316 out->vno = in->vno; 317 318 ret = krb5_copy_principal (context, in->principal, &out->principal); 319 if (ret) 320 goto fail; 321 ret = krb5_copy_keyblock_contents (context, 322 &in->keyblock, 323 &out->keyblock); 324 if (ret) 325 goto fail; 326 out->timestamp = in->timestamp; 327 return 0; 328fail: 329 krb5_kt_free_entry (context, out); 330 return ret; 331} 332 333/* 334 * Free the contents of `entry'. 335 */ 336 337krb5_error_code 338krb5_kt_free_entry(krb5_context context, 339 krb5_keytab_entry *entry) 340{ 341 krb5_free_principal (context, entry->principal); 342 krb5_free_keyblock_contents (context, &entry->keyblock); 343 return 0; 344} 345 346#if 0 347static int 348xxxlock(int fd, int write) 349{ 350 if(flock(fd, (write ? LOCK_EX : LOCK_SH) | LOCK_NB) < 0) { 351 sleep(1); 352 if(flock(fd, (write ? LOCK_EX : LOCK_SH) | LOCK_NB) < 0) 353 return -1; 354 } 355 return 0; 356} 357 358static void 359xxxunlock(int fd) 360{ 361 flock(fd, LOCK_UN); 362} 363#endif 364 365/* 366 * Set `cursor' to point at the beginning of `id'. 367 * Return 0 or an error. 368 */ 369 370krb5_error_code 371krb5_kt_start_seq_get(krb5_context context, 372 krb5_keytab id, 373 krb5_kt_cursor *cursor) 374{ 375 if(id->start_seq_get == NULL) { 376 krb5_set_error_string(context, 377 "start_seq_get is not supported in the %s " 378 " keytab", id->prefix); 379 return HEIM_ERR_OPNOTSUPP; 380 } 381 return (*id->start_seq_get)(context, id, cursor); 382} 383 384/* 385 * Get the next entry from `id' pointed to by `cursor' and advance the 386 * `cursor'. 387 * Return 0 or an error. 388 */ 389 390krb5_error_code 391krb5_kt_next_entry(krb5_context context, 392 krb5_keytab id, 393 krb5_keytab_entry *entry, 394 krb5_kt_cursor *cursor) 395{ 396 if(id->next_entry == NULL) { 397 krb5_set_error_string(context, 398 "next_entry is not supported in the %s " 399 " keytab", id->prefix); 400 return HEIM_ERR_OPNOTSUPP; 401 } 402 return (*id->next_entry)(context, id, entry, cursor); 403} 404 405/* 406 * Release all resources associated with `cursor'. 407 */ 408 409krb5_error_code 410krb5_kt_end_seq_get(krb5_context context, 411 krb5_keytab id, 412 krb5_kt_cursor *cursor) 413{ 414 if(id->end_seq_get == NULL) { 415 krb5_set_error_string(context, 416 "end_seq_get is not supported in the %s " 417 " keytab", id->prefix); 418 return HEIM_ERR_OPNOTSUPP; 419 } 420 return (*id->end_seq_get)(context, id, cursor); 421} 422 423/* 424 * Add the entry in `entry' to the keytab `id'. 425 * Return 0 or an error. 426 */ 427 428krb5_error_code 429krb5_kt_add_entry(krb5_context context, 430 krb5_keytab id, 431 krb5_keytab_entry *entry) 432{ 433 if(id->add == NULL) { 434 krb5_set_error_string(context, "Add is not supported in the %s keytab", 435 id->prefix); 436 return KRB5_KT_NOWRITE; 437 } 438 entry->timestamp = time(NULL); 439 return (*id->add)(context, id,entry); 440} 441 442/* 443 * Remove the entry `entry' from the keytab `id'. 444 * Return 0 or an error. 445 */ 446 447krb5_error_code 448krb5_kt_remove_entry(krb5_context context, 449 krb5_keytab id, 450 krb5_keytab_entry *entry) 451{ 452 if(id->remove == NULL) { 453 krb5_set_error_string(context, 454 "Remove is not supported in the %s keytab", 455 id->prefix); 456 return KRB5_KT_NOWRITE; 457 } 458 return (*id->remove)(context, id, entry); 459} 460