1/* 2 * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36#include "kadm5_locl.h" 37 38RCSID("$Id$"); 39 40#define set_value(X, V) do { if((X) == NULL) (X) = malloc(sizeof(*(X))); *(X) = V; } while(0) 41#define set_null(X) do { if((X) != NULL) free((X)); (X) = NULL; } while (0) 42 43static void 44attr_to_flags(unsigned attr, HDBFlags *flags) 45{ 46 flags->postdate = !(attr & KRB5_KDB_DISALLOW_POSTDATED); 47 flags->forwardable = !(attr & KRB5_KDB_DISALLOW_FORWARDABLE); 48 flags->initial = !!(attr & KRB5_KDB_DISALLOW_TGT_BASED); 49 flags->renewable = !(attr & KRB5_KDB_DISALLOW_RENEWABLE); 50 flags->proxiable = !(attr & KRB5_KDB_DISALLOW_PROXIABLE); 51 /* DUP_SKEY */ 52 flags->invalid = !!(attr & KRB5_KDB_DISALLOW_ALL_TIX); 53 flags->require_preauth = !!(attr & KRB5_KDB_REQUIRES_PRE_AUTH); 54 /* HW_AUTH */ 55 flags->server = !(attr & KRB5_KDB_DISALLOW_SVR); 56 flags->change_pw = !!(attr & KRB5_KDB_PWCHANGE_SERVICE); 57 flags->client = 1; /* XXX */ 58 flags->ok_as_delegate = !!(attr & KRB5_KDB_OK_AS_DELEGATE); 59 flags->trusted_for_delegation = !!(attr & KRB5_KDB_TRUSTED_FOR_DELEGATION); 60 flags->allow_kerberos4 = !!(attr & KRB5_KDB_ALLOW_KERBEROS4); 61 flags->allow_digest = !!(attr & KRB5_KDB_ALLOW_DIGEST); 62} 63 64/* 65 * Modify the `ent' according to `tl_data'. 66 */ 67 68static kadm5_ret_t 69perform_tl_data(krb5_context context, 70 HDB *db, 71 hdb_entry_ex *ent, 72 const krb5_tl_data *tl_data) 73{ 74 kadm5_ret_t ret = 0; 75 76 if (tl_data->tl_data_type == KRB5_TL_PASSWORD) { 77 heim_utf8_string pw = tl_data->tl_data_contents; 78 79 if (pw[tl_data->tl_data_length] != '\0') 80 return KADM5_BAD_TL_TYPE; 81 82 ret = hdb_entry_set_password(context, db, &ent->entry, pw); 83 84 } else if (tl_data->tl_data_type == KRB5_TL_LAST_PWD_CHANGE) { 85 unsigned char *s; 86 time_t t; 87 88 if (tl_data->tl_data_length != 4) 89 return KADM5_BAD_TL_TYPE; 90 91 s = tl_data->tl_data_contents; 92 93 t = s[0] | (s[1] << 8) | (s[2] << 16) | (s[3] << 24); 94 95 ret = hdb_entry_set_pw_change_time(context, &ent->entry, t); 96 97 } else if (tl_data->tl_data_type == KRB5_TL_EXTENSION) { 98 HDB_extension ext; 99 100 ret = decode_HDB_extension(tl_data->tl_data_contents, 101 tl_data->tl_data_length, 102 &ext, 103 NULL); 104 if (ret) 105 return KADM5_BAD_TL_TYPE; 106 107 ret = hdb_replace_extension(context, &ent->entry, &ext); 108 free_HDB_extension(&ext); 109 } else { 110 return KADM5_BAD_TL_TYPE; 111 } 112 return ret; 113} 114 115static void 116default_flags(hdb_entry_ex *ent) 117{ 118 memset(&ent->entry.flags, 0, sizeof(ent->entry.flags)); 119 ent->entry.flags.client = 1; 120 ent->entry.flags.server = 1; 121 ent->entry.flags.forwardable = 1; 122 ent->entry.flags.proxiable = 1; 123 ent->entry.flags.renewable = 1; 124 ent->entry.flags.postdate = 1; 125} 126 127 128/* 129 * Create the hdb entry `ent' based on data from `princ' with 130 * `princ_mask' specifying what fields to be gotten from there and 131 * `mask' specifying what fields we want filled in. 132 */ 133 134kadm5_ret_t 135_kadm5_setup_entry(kadm5_server_context *context, 136 hdb_entry_ex *ent, 137 uint32_t mask, 138 kadm5_principal_ent_t princ, 139 uint32_t princ_mask, 140 kadm5_principal_ent_t def, 141 uint32_t def_mask) 142{ 143 if(mask & KADM5_PRINC_EXPIRE_TIME 144 && princ_mask & KADM5_PRINC_EXPIRE_TIME) { 145 if (princ->princ_expire_time) 146 set_value(ent->entry.valid_end, princ->princ_expire_time); 147 else 148 set_null(ent->entry.valid_end); 149 } 150 if(mask & KADM5_PW_EXPIRATION 151 && princ_mask & KADM5_PW_EXPIRATION) { 152 if (princ->pw_expiration) 153 set_value(ent->entry.pw_end, princ->pw_expiration); 154 else 155 set_null(ent->entry.pw_end); 156 } 157 if(mask & KADM5_ATTRIBUTES) { 158 if (princ_mask & KADM5_ATTRIBUTES) { 159 attr_to_flags(princ->attributes, &ent->entry.flags); 160 } else if(def_mask & KADM5_ATTRIBUTES) { 161 attr_to_flags(def->attributes, &ent->entry.flags); 162 ent->entry.flags.invalid = 0; 163 } else { 164 default_flags(ent); 165 } 166 } else 167 default_flags(ent); 168 169 if(mask & KADM5_MAX_LIFE) { 170 if(princ_mask & KADM5_MAX_LIFE) { 171 if(princ->max_life) 172 set_value(ent->entry.max_life, (unsigned int)princ->max_life); 173 else 174 set_null(ent->entry.max_life); 175 } else if(def_mask & KADM5_MAX_LIFE) { 176 if(def->max_life) 177 set_value(ent->entry.max_life, (unsigned int)def->max_life); 178 else 179 set_null(ent->entry.max_life); 180 } 181 } 182 if(mask & KADM5_KVNO 183 && (princ_mask & KADM5_KVNO)) { 184 krb5_error_code ret; 185 186 ret = hdb_change_kvno(context->context, princ->kvno, &ent->entry); 187 if (ret && ret != HDB_ERR_KVNO_NOT_FOUND) 188 return ret; 189 ent->entry.kvno = princ->kvno; /* force it */ 190 } 191 if(mask & KADM5_MAX_RLIFE) { 192 if(princ_mask & KADM5_MAX_RLIFE) { 193 if(princ->max_renewable_life) 194 set_value(ent->entry.max_renew, (unsigned int)princ->max_renewable_life); 195 else 196 set_null(ent->entry.max_renew); 197 } else if(def_mask & KADM5_MAX_RLIFE) { 198 if(def->max_renewable_life) 199 set_value(ent->entry.max_renew, (unsigned int)def->max_renewable_life); 200 else 201 set_null(ent->entry.max_renew); 202 } 203 } 204 if(mask & KADM5_KEY_DATA 205 && princ_mask & KADM5_KEY_DATA) { 206 _kadm5_set_keys2(context, &ent->entry, 207 princ->n_key_data, princ->key_data); 208 } 209 if(mask & KADM5_TL_DATA) { 210 krb5_tl_data *tl; 211 212 for (tl = princ->tl_data; tl != NULL; tl = tl->tl_data_next) { 213 kadm5_ret_t ret; 214 ret = perform_tl_data(context->context, context->db, ent, tl); 215 if (ret) 216 return ret; 217 } 218 } 219 if(mask & KADM5_FAIL_AUTH_COUNT) { 220 /* XXX */ 221 } 222 return 0; 223} 224