17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * kadmin/v5server/keytab.c
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * Copyright 1995 by the Massachusetts Institute of Technology.
57c478bd9Sstevel@tonic-gate * All Rights Reserved.
67c478bd9Sstevel@tonic-gate *
77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
87c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
97c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
107c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
11*55fea89dSDan Cross *
127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
177c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
197c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
207c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
217c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
227c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
237c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
247c478bd9Sstevel@tonic-gate * or implied warranty.
25*55fea89dSDan Cross *
267c478bd9Sstevel@tonic-gate */
277c478bd9Sstevel@tonic-gate #include <string.h>
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate #include "k5-int.h"
3056a424ccSmp #include "kdb_kt.h"
317c478bd9Sstevel@tonic-gate
327c478bd9Sstevel@tonic-gate static int
337c478bd9Sstevel@tonic-gate is_xrealm_tgt(krb5_context, krb5_const_principal);
347c478bd9Sstevel@tonic-gate
357c478bd9Sstevel@tonic-gate krb5_error_code krb5_ktkdb_close (krb5_context, krb5_keytab);
367c478bd9Sstevel@tonic-gate
377c478bd9Sstevel@tonic-gate krb5_error_code krb5_ktkdb_get_entry (krb5_context, krb5_keytab, krb5_const_principal,
387c478bd9Sstevel@tonic-gate krb5_kvno, krb5_enctype, krb5_keytab_entry *);
397c478bd9Sstevel@tonic-gate
4056a424ccSmp static krb5_error_code
krb5_ktkdb_get_name(krb5_context context,krb5_keytab keytab,char * name,unsigned int namelen)4156a424ccSmp krb5_ktkdb_get_name(krb5_context context, krb5_keytab keytab,
4256a424ccSmp char *name, unsigned int namelen)
4356a424ccSmp {
4456a424ccSmp if (namelen < sizeof("KDB:"))
4556a424ccSmp return KRB5_KT_NAME_TOOLONG;
4656a424ccSmp strcpy(name, "KDB:");
4756a424ccSmp return 0;
4856a424ccSmp }
497c478bd9Sstevel@tonic-gate
507c478bd9Sstevel@tonic-gate krb5_kt_ops krb5_kt_kdb_ops = {
517c478bd9Sstevel@tonic-gate 0,
527c478bd9Sstevel@tonic-gate "KDB", /* Prefix -- this string should not appear anywhere else! */
537c478bd9Sstevel@tonic-gate krb5_ktkdb_resolve, /* resolve */
5456a424ccSmp krb5_ktkdb_get_name, /* get_name */
557c478bd9Sstevel@tonic-gate krb5_ktkdb_close, /* close */
567c478bd9Sstevel@tonic-gate krb5_ktkdb_get_entry, /* get */
577c478bd9Sstevel@tonic-gate NULL, /* start_seq_get */
587c478bd9Sstevel@tonic-gate NULL, /* get_next */
597c478bd9Sstevel@tonic-gate NULL, /* end_get */
607c478bd9Sstevel@tonic-gate NULL, /* add (extended) */
617c478bd9Sstevel@tonic-gate NULL, /* remove (extended) */
627c478bd9Sstevel@tonic-gate NULL, /* (void *) &krb5_ktfile_ser_entry */
637c478bd9Sstevel@tonic-gate };
647c478bd9Sstevel@tonic-gate
657c478bd9Sstevel@tonic-gate typedef struct krb5_ktkdb_data {
667c478bd9Sstevel@tonic-gate char * name;
677c478bd9Sstevel@tonic-gate } krb5_ktkdb_data;
687c478bd9Sstevel@tonic-gate
697c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_resolve(context,name,id)707c478bd9Sstevel@tonic-gate krb5_ktkdb_resolve(context, name, id)
717c478bd9Sstevel@tonic-gate krb5_context context;
727c478bd9Sstevel@tonic-gate const char * name;
737c478bd9Sstevel@tonic-gate krb5_keytab * id;
747c478bd9Sstevel@tonic-gate {
757c478bd9Sstevel@tonic-gate if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL)
767c478bd9Sstevel@tonic-gate return(ENOMEM);
777c478bd9Sstevel@tonic-gate (*id)->ops = &krb5_kt_kdb_ops;
787c478bd9Sstevel@tonic-gate (*id)->magic = KV5M_KEYTAB;
797c478bd9Sstevel@tonic-gate return(0);
807c478bd9Sstevel@tonic-gate }
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_close(context,kt)837c478bd9Sstevel@tonic-gate krb5_ktkdb_close(context, kt)
847c478bd9Sstevel@tonic-gate krb5_context context;
857c478bd9Sstevel@tonic-gate krb5_keytab kt;
867c478bd9Sstevel@tonic-gate {
877c478bd9Sstevel@tonic-gate /*
88*55fea89dSDan Cross * This routine is responsible for freeing all memory allocated
897c478bd9Sstevel@tonic-gate * for this keytab. There are no system resources that need
907c478bd9Sstevel@tonic-gate * to be freed nor are there any open files.
917c478bd9Sstevel@tonic-gate *
927c478bd9Sstevel@tonic-gate * This routine should undo anything done by krb5_ktkdb_resolve().
937c478bd9Sstevel@tonic-gate */
947c478bd9Sstevel@tonic-gate
957c478bd9Sstevel@tonic-gate kt->ops = NULL;
967c478bd9Sstevel@tonic-gate krb5_xfree(kt);
977c478bd9Sstevel@tonic-gate
987c478bd9Sstevel@tonic-gate return 0;
997c478bd9Sstevel@tonic-gate }
1007c478bd9Sstevel@tonic-gate
1017c478bd9Sstevel@tonic-gate static krb5_context ktkdb_ctx = NULL;
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate /*
1047c478bd9Sstevel@tonic-gate * Set a different context for use with ktkdb_get_entry(). This is
1057c478bd9Sstevel@tonic-gate * primarily useful for kadmind, where the gssapi library context,
1067c478bd9Sstevel@tonic-gate * which will be used for the keytab, will necessarily have a
1077c478bd9Sstevel@tonic-gate * different context than that used by the kadm5 library to access the
1087c478bd9Sstevel@tonic-gate * database for its own purposes.
1097c478bd9Sstevel@tonic-gate */
1107c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_set_context(krb5_context ctx)1117c478bd9Sstevel@tonic-gate krb5_ktkdb_set_context(krb5_context ctx)
1127c478bd9Sstevel@tonic-gate {
1137c478bd9Sstevel@tonic-gate ktkdb_ctx = ctx;
1147c478bd9Sstevel@tonic-gate return 0;
1157c478bd9Sstevel@tonic-gate }
1167c478bd9Sstevel@tonic-gate
1177c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_get_entry(in_context,id,principal,kvno,enctype,entry)1187c478bd9Sstevel@tonic-gate krb5_ktkdb_get_entry(in_context, id, principal, kvno, enctype, entry)
1197c478bd9Sstevel@tonic-gate krb5_context in_context;
1207c478bd9Sstevel@tonic-gate krb5_keytab id;
1217c478bd9Sstevel@tonic-gate krb5_const_principal principal;
1227c478bd9Sstevel@tonic-gate krb5_kvno kvno;
1237c478bd9Sstevel@tonic-gate krb5_enctype enctype;
1247c478bd9Sstevel@tonic-gate krb5_keytab_entry * entry;
1257c478bd9Sstevel@tonic-gate {
1267c478bd9Sstevel@tonic-gate krb5_context context;
1277c478bd9Sstevel@tonic-gate krb5_keyblock * master_key;
1287c478bd9Sstevel@tonic-gate krb5_error_code kerror = 0;
1297c478bd9Sstevel@tonic-gate krb5_key_data * key_data;
1307c478bd9Sstevel@tonic-gate krb5_db_entry db_entry;
1317c478bd9Sstevel@tonic-gate krb5_boolean more = 0;
1327c478bd9Sstevel@tonic-gate int n = 0;
13356a424ccSmp int xrealm_tgt;
13456a424ccSmp krb5_boolean similar;
1357c478bd9Sstevel@tonic-gate
1367c478bd9Sstevel@tonic-gate if (ktkdb_ctx)
1377c478bd9Sstevel@tonic-gate context = ktkdb_ctx;
1387c478bd9Sstevel@tonic-gate else
1397c478bd9Sstevel@tonic-gate context = in_context;
1407c478bd9Sstevel@tonic-gate
14156a424ccSmp xrealm_tgt = is_xrealm_tgt(context, principal);
14256a424ccSmp
1437c478bd9Sstevel@tonic-gate /* Open database */
1447c478bd9Sstevel@tonic-gate /* krb5_db_init(context); */
14554925bf6Swillf if ((kerror = krb5_db_inited(context)))
1467c478bd9Sstevel@tonic-gate return(kerror);
1477c478bd9Sstevel@tonic-gate
1487c478bd9Sstevel@tonic-gate /* get_principal */
1497c478bd9Sstevel@tonic-gate kerror = krb5_db_get_principal(context, principal, &
1507c478bd9Sstevel@tonic-gate db_entry, &n, &more);
1517c478bd9Sstevel@tonic-gate if (kerror) {
152159d09a2SMark Phalan /* krb5_db_close_database(context); */
1537c478bd9Sstevel@tonic-gate return(kerror);
1547c478bd9Sstevel@tonic-gate }
1557c478bd9Sstevel@tonic-gate if (n != 1) {
156159d09a2SMark Phalan /* krb5_db_close_database(context); */
1577c478bd9Sstevel@tonic-gate return KRB5_KT_NOTFOUND;
1587c478bd9Sstevel@tonic-gate }
1597c478bd9Sstevel@tonic-gate
1607c478bd9Sstevel@tonic-gate if (db_entry.attributes & KRB5_KDB_DISALLOW_SVR
1617c478bd9Sstevel@tonic-gate || db_entry.attributes & KRB5_KDB_DISALLOW_ALL_TIX) {
1627c478bd9Sstevel@tonic-gate kerror = KRB5_KT_NOTFOUND;
1637c478bd9Sstevel@tonic-gate goto error;
1647c478bd9Sstevel@tonic-gate }
1657c478bd9Sstevel@tonic-gate
1667c478bd9Sstevel@tonic-gate /* match key */
1677c478bd9Sstevel@tonic-gate kerror = krb5_db_get_mkey(context, &master_key);
1687c478bd9Sstevel@tonic-gate if (kerror)
1697c478bd9Sstevel@tonic-gate goto error;
1707c478bd9Sstevel@tonic-gate
1717c478bd9Sstevel@tonic-gate /* For cross realm tgts, we match whatever enctype is provided;
1727c478bd9Sstevel@tonic-gate * for other principals, we only match the first enctype that is
1737c478bd9Sstevel@tonic-gate * found. Since the TGS and AS code do the same thing, then we
1747c478bd9Sstevel@tonic-gate * will only successfully decrypt tickets we have issued.*/
1757c478bd9Sstevel@tonic-gate kerror = krb5_dbe_find_enctype(context, &db_entry,
1767c478bd9Sstevel@tonic-gate xrealm_tgt?enctype:-1,
1777c478bd9Sstevel@tonic-gate -1, kvno, &key_data);
1787c478bd9Sstevel@tonic-gate if (kerror)
1797c478bd9Sstevel@tonic-gate goto error;
1807c478bd9Sstevel@tonic-gate
1817c478bd9Sstevel@tonic-gate
1827c478bd9Sstevel@tonic-gate kerror = krb5_dbekd_decrypt_key_data(context, master_key,
1837c478bd9Sstevel@tonic-gate key_data, &entry->key, NULL);
1847c478bd9Sstevel@tonic-gate if (kerror)
1857c478bd9Sstevel@tonic-gate goto error;
1867c478bd9Sstevel@tonic-gate
187*55fea89dSDan Cross if (enctype > 0) {
1887c478bd9Sstevel@tonic-gate kerror = krb5_c_enctype_compare(context, enctype,
1897c478bd9Sstevel@tonic-gate entry->key.enctype, &similar);
1907c478bd9Sstevel@tonic-gate if (kerror)
1917c478bd9Sstevel@tonic-gate goto error;
1927c478bd9Sstevel@tonic-gate
1937c478bd9Sstevel@tonic-gate if (!similar) {
1947c478bd9Sstevel@tonic-gate kerror = KRB5_KDB_NO_PERMITTED_KEY;
1957c478bd9Sstevel@tonic-gate goto error;
1967c478bd9Sstevel@tonic-gate }
1977c478bd9Sstevel@tonic-gate }
1987c478bd9Sstevel@tonic-gate /*
1997c478bd9Sstevel@tonic-gate * Coerce the enctype of the output keyblock in case we got an
2007c478bd9Sstevel@tonic-gate * inexact match on the enctype.
2017c478bd9Sstevel@tonic-gate */
2027c478bd9Sstevel@tonic-gate entry->key.enctype = enctype;
2037c478bd9Sstevel@tonic-gate
2047c478bd9Sstevel@tonic-gate kerror = krb5_copy_principal(context, principal, &entry->principal);
2057c478bd9Sstevel@tonic-gate if (kerror)
2067c478bd9Sstevel@tonic-gate goto error;
2077c478bd9Sstevel@tonic-gate
2087c478bd9Sstevel@tonic-gate /* Close database */
2097c478bd9Sstevel@tonic-gate error:
21054925bf6Swillf krb5_db_free_principal(context, &db_entry, 1);
211159d09a2SMark Phalan /* krb5_db_close_database(context); */
2127c478bd9Sstevel@tonic-gate return(kerror);
2137c478bd9Sstevel@tonic-gate }
2147c478bd9Sstevel@tonic-gate
2157c478bd9Sstevel@tonic-gate /*
2167c478bd9Sstevel@tonic-gate * is_xrealm_tgt: Returns true if the principal is a cross-realm TGT
2177c478bd9Sstevel@tonic-gate * principal-- a principal with first component krbtgt and second
2187c478bd9Sstevel@tonic-gate * component not equal to realm.
2197c478bd9Sstevel@tonic-gate */
2207c478bd9Sstevel@tonic-gate static int
is_xrealm_tgt(krb5_context context,krb5_const_principal princ)2217c478bd9Sstevel@tonic-gate is_xrealm_tgt(krb5_context context, krb5_const_principal princ)
2227c478bd9Sstevel@tonic-gate {
2237c478bd9Sstevel@tonic-gate krb5_data *dat;
2247c478bd9Sstevel@tonic-gate if (krb5_princ_size(context, princ) != 2)
2257c478bd9Sstevel@tonic-gate return 0;
2267c478bd9Sstevel@tonic-gate dat = krb5_princ_component(context, princ, 0);
2277c478bd9Sstevel@tonic-gate if (strncmp("krbtgt", dat->data, dat->length) != 0)
2287c478bd9Sstevel@tonic-gate return 0;
2297c478bd9Sstevel@tonic-gate dat = krb5_princ_component(context, princ, 1);
2307c478bd9Sstevel@tonic-gate if (dat->length != princ->realm.length)
2317c478bd9Sstevel@tonic-gate return 1;
2327c478bd9Sstevel@tonic-gate if (strncmp(dat->data, princ->realm.data, dat->length) == 0)
2337c478bd9Sstevel@tonic-gate return 0;
2347c478bd9Sstevel@tonic-gate return 1;
2357c478bd9Sstevel@tonic-gate
2367c478bd9Sstevel@tonic-gate }
2377c478bd9Sstevel@tonic-gate
238