1/* 2 * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "kadm5_locl.h" 35#include <assert.h> 36 37RCSID("$Id$"); 38 39static kadm5_ret_t 40add_tl_data(kadm5_principal_ent_t ent, int16_t type, 41 const void *data, size_t size) 42{ 43 krb5_tl_data *tl; 44 45 tl = calloc(1, sizeof(*tl)); 46 if (tl == NULL) 47 return _kadm5_error_code(ENOMEM); 48 49 tl->tl_data_type = type; 50 tl->tl_data_length = size; 51 tl->tl_data_contents = malloc(size); 52 if (tl->tl_data_contents == NULL && size != 0) { 53 free(tl); 54 return _kadm5_error_code(ENOMEM); 55 } 56 memcpy(tl->tl_data_contents, data, size); 57 58 tl->tl_data_next = ent->tl_data; 59 ent->tl_data = tl; 60 ent->n_tl_data++; 61 62 return 0; 63} 64 65KRB5_LIB_FUNCTION krb5_ssize_t KRB5_LIB_CALL 66_krb5_put_int(void *buffer, unsigned long value, size_t size); /* XXX */ 67 68static 69krb5_error_code 70copy_keyset_to_kadm5(kadm5_server_context *context, krb5_kvno kvno, 71 size_t n_keys, Key *keys, krb5_salt *salt, 72 kadm5_principal_ent_t out) 73{ 74 size_t i; 75 Key *key; 76 krb5_key_data *kd; 77 krb5_data *sp; 78 krb5_error_code ret = 0; 79 80 for (i = 0; i < n_keys; i++) { 81 key = &keys[i]; 82 kd = &out->key_data[out->n_key_data]; 83 kd->key_data_ver = 2; 84 kd->key_data_kvno = kvno; 85 kd->key_data_type[0] = key->key.keytype; 86 if(key->salt) 87 kd->key_data_type[1] = key->salt->type; 88 else 89 kd->key_data_type[1] = KRB5_PADATA_PW_SALT; 90 /* setup key */ 91 kd->key_data_length[0] = key->key.keyvalue.length; 92 kd->key_data_contents[0] = malloc(kd->key_data_length[0]); 93 if(kd->key_data_contents[0] == NULL && kd->key_data_length[0] != 0){ 94 ret = ENOMEM; 95 break; 96 } 97 memcpy(kd->key_data_contents[0], key->key.keyvalue.data, 98 kd->key_data_length[0]); 99 /* setup salt */ 100 if(key->salt) 101 sp = &key->salt->salt; 102 else 103 sp = &salt->saltvalue; 104 kd->key_data_length[1] = sp->length; 105 kd->key_data_contents[1] = malloc(kd->key_data_length[1]); 106 if(kd->key_data_length[1] != 0 107 && kd->key_data_contents[1] == NULL) { 108 memset(kd->key_data_contents[0], 0, kd->key_data_length[0]); 109 ret = ENOMEM; 110 break; 111 } 112 memcpy(kd->key_data_contents[1], sp->data, kd->key_data_length[1]); 113 out->n_key_data++; 114 } 115 116 return ret; 117} 118 119kadm5_ret_t 120kadm5_s_get_principal(void *server_handle, 121 krb5_principal princ, 122 kadm5_principal_ent_t out, 123 uint32_t mask) 124{ 125 kadm5_server_context *context = server_handle; 126 kadm5_ret_t ret; 127 hdb_entry_ex ent; 128 129 memset(&ent, 0, sizeof(ent)); 130 131 if (!context->keep_open) { 132 ret = context->db->hdb_open(context->context, context->db, O_RDONLY, 0); 133 if(ret) 134 return ret; 135 } 136 ret = context->db->hdb_fetch_kvno(context->context, context->db, princ, 137 HDB_F_DECRYPT|HDB_F_ALL_KVNOS| 138 HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent); 139 if (!context->keep_open) 140 context->db->hdb_close(context->context, context->db); 141 if(ret) 142 return _kadm5_error_code(ret); 143 144 memset(out, 0, sizeof(*out)); 145 if(mask & KADM5_PRINCIPAL) 146 ret = krb5_copy_principal(context->context, ent.entry.principal, 147 &out->principal); 148 if(ret) 149 goto out; 150 if(mask & KADM5_PRINC_EXPIRE_TIME && ent.entry.valid_end) 151 out->princ_expire_time = *ent.entry.valid_end; 152 if(mask & KADM5_PW_EXPIRATION && ent.entry.pw_end) 153 out->pw_expiration = *ent.entry.pw_end; 154 if(mask & KADM5_LAST_PWD_CHANGE) 155 hdb_entry_get_pw_change_time(&ent.entry, &out->last_pwd_change); 156 if(mask & KADM5_ATTRIBUTES){ 157 out->attributes |= ent.entry.flags.postdate ? 0 : KRB5_KDB_DISALLOW_POSTDATED; 158 out->attributes |= ent.entry.flags.forwardable ? 0 : KRB5_KDB_DISALLOW_FORWARDABLE; 159 out->attributes |= ent.entry.flags.initial ? KRB5_KDB_DISALLOW_TGT_BASED : 0; 160 out->attributes |= ent.entry.flags.renewable ? 0 : KRB5_KDB_DISALLOW_RENEWABLE; 161 out->attributes |= ent.entry.flags.proxiable ? 0 : KRB5_KDB_DISALLOW_PROXIABLE; 162 out->attributes |= ent.entry.flags.invalid ? KRB5_KDB_DISALLOW_ALL_TIX : 0; 163 out->attributes |= ent.entry.flags.require_preauth ? KRB5_KDB_REQUIRES_PRE_AUTH : 0; 164 out->attributes |= ent.entry.flags.server ? 0 : KRB5_KDB_DISALLOW_SVR; 165 out->attributes |= ent.entry.flags.change_pw ? KRB5_KDB_PWCHANGE_SERVICE : 0; 166 out->attributes |= ent.entry.flags.ok_as_delegate ? KRB5_KDB_OK_AS_DELEGATE : 0; 167 out->attributes |= ent.entry.flags.trusted_for_delegation ? KRB5_KDB_TRUSTED_FOR_DELEGATION : 0; 168 out->attributes |= ent.entry.flags.allow_kerberos4 ? KRB5_KDB_ALLOW_KERBEROS4 : 0; 169 out->attributes |= ent.entry.flags.allow_digest ? KRB5_KDB_ALLOW_DIGEST : 0; 170 } 171 if(mask & KADM5_MAX_LIFE) { 172 if(ent.entry.max_life) 173 out->max_life = *ent.entry.max_life; 174 else 175 out->max_life = INT_MAX; 176 } 177 if(mask & KADM5_MOD_TIME) { 178 if(ent.entry.modified_by) 179 out->mod_date = ent.entry.modified_by->time; 180 else 181 out->mod_date = ent.entry.created_by.time; 182 } 183 if(mask & KADM5_MOD_NAME) { 184 if(ent.entry.modified_by) { 185 if (ent.entry.modified_by->principal != NULL) 186 ret = krb5_copy_principal(context->context, 187 ent.entry.modified_by->principal, 188 &out->mod_name); 189 } else if(ent.entry.created_by.principal != NULL) 190 ret = krb5_copy_principal(context->context, 191 ent.entry.created_by.principal, 192 &out->mod_name); 193 else 194 out->mod_name = NULL; 195 } 196 if(ret) 197 goto out; 198 199 if(mask & KADM5_KVNO) 200 out->kvno = ent.entry.kvno; 201 if(mask & KADM5_MKVNO) { 202 size_t n; 203 out->mkvno = 0; /* XXX */ 204 for(n = 0; n < ent.entry.keys.len; n++) 205 if(ent.entry.keys.val[n].mkvno) { 206 out->mkvno = *ent.entry.keys.val[n].mkvno; /* XXX this isn't right */ 207 break; 208 } 209 } 210#if 0 /* XXX implement */ 211 if(mask & KADM5_AUX_ATTRIBUTES) 212 ; 213 if(mask & KADM5_LAST_SUCCESS) 214 ; 215 if(mask & KADM5_LAST_FAILED) 216 ; 217 if(mask & KADM5_FAIL_AUTH_COUNT) 218 ; 219#endif 220 if(mask & KADM5_POLICY) { 221 HDB_extension *ext; 222 223 ext = hdb_find_extension(&ent.entry, choice_HDB_extension_data_policy); 224 if (ext == NULL) { 225 out->policy = strdup("default"); 226 /* It's OK if we retun NULL instead of "default" */ 227 } else { 228 out->policy = strdup(ext->data.u.policy); 229 if (out->policy == NULL) { 230 ret = ENOMEM; 231 goto out; 232 } 233 } 234 } 235 if(mask & KADM5_MAX_RLIFE) { 236 if(ent.entry.max_renew) 237 out->max_renewable_life = *ent.entry.max_renew; 238 else 239 out->max_renewable_life = INT_MAX; 240 } 241 if(mask & KADM5_KEY_DATA){ 242 size_t i; 243 size_t n_keys = ent.entry.keys.len; 244 krb5_salt salt; 245 HDB_extension *ext; 246 HDB_Ext_KeySet *hist_keys = NULL; 247 248 ext = hdb_find_extension(&ent.entry, choice_HDB_extension_data_hist_keys); 249 if (ext != NULL) 250 hist_keys = &ext->data.u.hist_keys; 251 252 krb5_get_pw_salt(context->context, ent.entry.principal, &salt); 253 for (i = 0; hist_keys != NULL && i < hist_keys->len; i++) 254 n_keys += hist_keys->val[i].keys.len; 255 out->key_data = malloc(n_keys * sizeof(*out->key_data)); 256 if (out->key_data == NULL && n_keys != 0) { 257 ret = ENOMEM; 258 goto out; 259 } 260 out->n_key_data = 0; 261 ret = copy_keyset_to_kadm5(context, ent.entry.kvno, ent.entry.keys.len, 262 ent.entry.keys.val, &salt, out); 263 if (ret) 264 goto out; 265 for (i = 0; hist_keys != NULL && i < hist_keys->len; i++) { 266 ret = copy_keyset_to_kadm5(context, hist_keys->val[i].kvno, 267 hist_keys->val[i].keys.len, 268 hist_keys->val[i].keys.val, 269 &salt, out); 270 if (ret) 271 goto out; 272 } 273 krb5_free_salt(context->context, salt); 274 assert( (size_t)out->n_key_data == n_keys ); 275 } 276 if(ret){ 277 kadm5_free_principal_ent(context, out); 278 goto out; 279 } 280 if(mask & KADM5_TL_DATA) { 281 time_t last_pw_expire; 282 const HDB_Ext_PKINIT_acl *acl; 283 const HDB_Ext_Aliases *aliases; 284 285 ret = hdb_entry_get_pw_change_time(&ent.entry, &last_pw_expire); 286 if (ret == 0 && last_pw_expire) { 287 unsigned char buf[4]; 288 _krb5_put_int(buf, last_pw_expire, sizeof(buf)); 289 ret = add_tl_data(out, KRB5_TL_LAST_PWD_CHANGE, buf, sizeof(buf)); 290 } 291 if(ret){ 292 kadm5_free_principal_ent(context, out); 293 goto out; 294 } 295 /* 296 * If the client was allowed to get key data, let it have the 297 * password too. 298 */ 299 if(mask & KADM5_KEY_DATA) { 300 heim_utf8_string pw = NULL; 301 302 ret = hdb_entry_get_password(context->context, 303 context->db, &ent.entry, &pw); 304 if (ret == 0 && pw) { 305 ret = add_tl_data(out, KRB5_TL_PASSWORD, pw, strlen(pw) + 1); 306 free(pw); 307 } 308 krb5_clear_error_message(context->context); 309 if (ret) { 310 kadm5_free_principal_ent(context, out); 311 goto out; 312 } 313 } 314 315 ret = hdb_entry_get_pkinit_acl(&ent.entry, &acl); 316 if (ret == 0 && acl) { 317 krb5_data buf; 318 size_t len = 0; 319 320 ASN1_MALLOC_ENCODE(HDB_Ext_PKINIT_acl, buf.data, buf.length, 321 acl, &len, ret); 322 if (ret) { 323 kadm5_free_principal_ent(context, out); 324 goto out; 325 } 326 if (len != buf.length) 327 krb5_abortx(context->context, 328 "internal ASN.1 encoder error"); 329 ret = add_tl_data(out, KRB5_TL_PKINIT_ACL, buf.data, buf.length); 330 free(buf.data); 331 if (ret) { 332 kadm5_free_principal_ent(context, out); 333 goto out; 334 } 335 } 336 if(ret){ 337 kadm5_free_principal_ent(context, out); 338 goto out; 339 } 340 341 ret = hdb_entry_get_aliases(&ent.entry, &aliases); 342 if (ret == 0 && aliases) { 343 krb5_data buf; 344 size_t len = 0; 345 346 ASN1_MALLOC_ENCODE(HDB_Ext_Aliases, buf.data, buf.length, 347 aliases, &len, ret); 348 if (ret) { 349 kadm5_free_principal_ent(context, out); 350 goto out; 351 } 352 if (len != buf.length) 353 krb5_abortx(context->context, 354 "internal ASN.1 encoder error"); 355 ret = add_tl_data(out, KRB5_TL_ALIASES, buf.data, buf.length); 356 free(buf.data); 357 if (ret) { 358 kadm5_free_principal_ent(context, out); 359 goto out; 360 } 361 } 362 if(ret){ 363 kadm5_free_principal_ent(context, out); 364 goto out; 365 } 366 367 } 368out: 369 hdb_free_entry(context->context, &ent); 370 371 return _kadm5_error_code(ret); 372} 373