17c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 27c478bd9Sstevel@tonic-gate /* 37c478bd9Sstevel@tonic-gate * kadmin/v5server/keytab.c 47c478bd9Sstevel@tonic-gate * 57c478bd9Sstevel@tonic-gate * Copyright 1995 by the Massachusetts Institute of Technology. 67c478bd9Sstevel@tonic-gate * All Rights Reserved. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 97c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 107c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 117c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 147c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 157c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 167c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 177c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 187c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 197c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 207c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 217c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 227c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 237c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 247c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 257c478bd9Sstevel@tonic-gate * or implied warranty. 267c478bd9Sstevel@tonic-gate * 277c478bd9Sstevel@tonic-gate */ 287c478bd9Sstevel@tonic-gate #include <string.h> 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate #include "k5-int.h" 31*56a424ccSmp #include "kdb_kt.h" 327c478bd9Sstevel@tonic-gate 337c478bd9Sstevel@tonic-gate static int 347c478bd9Sstevel@tonic-gate is_xrealm_tgt(krb5_context, krb5_const_principal); 357c478bd9Sstevel@tonic-gate 367c478bd9Sstevel@tonic-gate krb5_error_code krb5_ktkdb_close (krb5_context, krb5_keytab); 377c478bd9Sstevel@tonic-gate 387c478bd9Sstevel@tonic-gate krb5_error_code krb5_ktkdb_get_entry (krb5_context, krb5_keytab, krb5_const_principal, 397c478bd9Sstevel@tonic-gate krb5_kvno, krb5_enctype, krb5_keytab_entry *); 407c478bd9Sstevel@tonic-gate 41*56a424ccSmp static krb5_error_code 42*56a424ccSmp krb5_ktkdb_get_name(krb5_context context, krb5_keytab keytab, 43*56a424ccSmp char *name, unsigned int namelen) 44*56a424ccSmp { 45*56a424ccSmp if (namelen < sizeof("KDB:")) 46*56a424ccSmp return KRB5_KT_NAME_TOOLONG; 47*56a424ccSmp strcpy(name, "KDB:"); 48*56a424ccSmp return 0; 49*56a424ccSmp } 507c478bd9Sstevel@tonic-gate 517c478bd9Sstevel@tonic-gate krb5_kt_ops krb5_kt_kdb_ops = { 527c478bd9Sstevel@tonic-gate 0, 537c478bd9Sstevel@tonic-gate "KDB", /* Prefix -- this string should not appear anywhere else! */ 547c478bd9Sstevel@tonic-gate krb5_ktkdb_resolve, /* resolve */ 55*56a424ccSmp krb5_ktkdb_get_name, /* get_name */ 567c478bd9Sstevel@tonic-gate krb5_ktkdb_close, /* close */ 577c478bd9Sstevel@tonic-gate krb5_ktkdb_get_entry, /* get */ 587c478bd9Sstevel@tonic-gate NULL, /* start_seq_get */ 597c478bd9Sstevel@tonic-gate NULL, /* get_next */ 607c478bd9Sstevel@tonic-gate NULL, /* end_get */ 617c478bd9Sstevel@tonic-gate NULL, /* add (extended) */ 627c478bd9Sstevel@tonic-gate NULL, /* remove (extended) */ 637c478bd9Sstevel@tonic-gate NULL, /* (void *) &krb5_ktfile_ser_entry */ 647c478bd9Sstevel@tonic-gate }; 657c478bd9Sstevel@tonic-gate 667c478bd9Sstevel@tonic-gate typedef struct krb5_ktkdb_data { 677c478bd9Sstevel@tonic-gate char * name; 687c478bd9Sstevel@tonic-gate } krb5_ktkdb_data; 697c478bd9Sstevel@tonic-gate 707c478bd9Sstevel@tonic-gate krb5_error_code 717c478bd9Sstevel@tonic-gate krb5_ktkdb_resolve(context, name, id) 727c478bd9Sstevel@tonic-gate krb5_context context; 737c478bd9Sstevel@tonic-gate const char * name; 747c478bd9Sstevel@tonic-gate krb5_keytab * id; 757c478bd9Sstevel@tonic-gate { 767c478bd9Sstevel@tonic-gate if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL) 777c478bd9Sstevel@tonic-gate return(ENOMEM); 787c478bd9Sstevel@tonic-gate (*id)->ops = &krb5_kt_kdb_ops; 797c478bd9Sstevel@tonic-gate (*id)->magic = KV5M_KEYTAB; 807c478bd9Sstevel@tonic-gate return(0); 817c478bd9Sstevel@tonic-gate } 827c478bd9Sstevel@tonic-gate 837c478bd9Sstevel@tonic-gate krb5_error_code 847c478bd9Sstevel@tonic-gate krb5_ktkdb_close(context, kt) 857c478bd9Sstevel@tonic-gate krb5_context context; 867c478bd9Sstevel@tonic-gate krb5_keytab kt; 877c478bd9Sstevel@tonic-gate { 887c478bd9Sstevel@tonic-gate /* 897c478bd9Sstevel@tonic-gate * This routine is responsible for freeing all memory allocated 907c478bd9Sstevel@tonic-gate * for this keytab. There are no system resources that need 917c478bd9Sstevel@tonic-gate * to be freed nor are there any open files. 927c478bd9Sstevel@tonic-gate * 937c478bd9Sstevel@tonic-gate * This routine should undo anything done by krb5_ktkdb_resolve(). 947c478bd9Sstevel@tonic-gate */ 957c478bd9Sstevel@tonic-gate 967c478bd9Sstevel@tonic-gate kt->ops = NULL; 977c478bd9Sstevel@tonic-gate krb5_xfree(kt); 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate return 0; 1007c478bd9Sstevel@tonic-gate } 1017c478bd9Sstevel@tonic-gate 1027c478bd9Sstevel@tonic-gate static krb5_context ktkdb_ctx = NULL; 1037c478bd9Sstevel@tonic-gate 1047c478bd9Sstevel@tonic-gate /* 1057c478bd9Sstevel@tonic-gate * Set a different context for use with ktkdb_get_entry(). This is 1067c478bd9Sstevel@tonic-gate * primarily useful for kadmind, where the gssapi library context, 1077c478bd9Sstevel@tonic-gate * which will be used for the keytab, will necessarily have a 1087c478bd9Sstevel@tonic-gate * different context than that used by the kadm5 library to access the 1097c478bd9Sstevel@tonic-gate * database for its own purposes. 1107c478bd9Sstevel@tonic-gate */ 1117c478bd9Sstevel@tonic-gate krb5_error_code 1127c478bd9Sstevel@tonic-gate krb5_ktkdb_set_context(krb5_context ctx) 1137c478bd9Sstevel@tonic-gate { 1147c478bd9Sstevel@tonic-gate ktkdb_ctx = ctx; 1157c478bd9Sstevel@tonic-gate return 0; 1167c478bd9Sstevel@tonic-gate } 1177c478bd9Sstevel@tonic-gate 1187c478bd9Sstevel@tonic-gate krb5_error_code 1197c478bd9Sstevel@tonic-gate krb5_ktkdb_get_entry(in_context, id, principal, kvno, enctype, entry) 1207c478bd9Sstevel@tonic-gate krb5_context in_context; 1217c478bd9Sstevel@tonic-gate krb5_keytab id; 1227c478bd9Sstevel@tonic-gate krb5_const_principal principal; 1237c478bd9Sstevel@tonic-gate krb5_kvno kvno; 1247c478bd9Sstevel@tonic-gate krb5_enctype enctype; 1257c478bd9Sstevel@tonic-gate krb5_keytab_entry * entry; 1267c478bd9Sstevel@tonic-gate { 1277c478bd9Sstevel@tonic-gate krb5_context context; 1287c478bd9Sstevel@tonic-gate krb5_keyblock * master_key; 1297c478bd9Sstevel@tonic-gate krb5_error_code kerror = 0; 1307c478bd9Sstevel@tonic-gate krb5_key_data * key_data; 1317c478bd9Sstevel@tonic-gate krb5_db_entry db_entry; 1327c478bd9Sstevel@tonic-gate krb5_boolean more = 0; 1337c478bd9Sstevel@tonic-gate int n = 0; 134*56a424ccSmp int xrealm_tgt; 135*56a424ccSmp krb5_boolean similar; 1367c478bd9Sstevel@tonic-gate 1377c478bd9Sstevel@tonic-gate if (ktkdb_ctx) 1387c478bd9Sstevel@tonic-gate context = ktkdb_ctx; 1397c478bd9Sstevel@tonic-gate else 1407c478bd9Sstevel@tonic-gate context = in_context; 1417c478bd9Sstevel@tonic-gate 142*56a424ccSmp xrealm_tgt = is_xrealm_tgt(context, principal); 143*56a424ccSmp 1447c478bd9Sstevel@tonic-gate /* Open database */ 1457c478bd9Sstevel@tonic-gate /* krb5_db_init(context); */ 1467c478bd9Sstevel@tonic-gate if ((kerror = krb5_db_open_database(context))) 1477c478bd9Sstevel@tonic-gate return(kerror); 1487c478bd9Sstevel@tonic-gate 1497c478bd9Sstevel@tonic-gate /* get_principal */ 1507c478bd9Sstevel@tonic-gate kerror = krb5_db_get_principal(context, principal, & 1517c478bd9Sstevel@tonic-gate db_entry, &n, &more); 1527c478bd9Sstevel@tonic-gate if (kerror) { 1537c478bd9Sstevel@tonic-gate krb5_db_close_database(context); 1547c478bd9Sstevel@tonic-gate return(kerror); 1557c478bd9Sstevel@tonic-gate } 1567c478bd9Sstevel@tonic-gate if (n != 1) { 1577c478bd9Sstevel@tonic-gate krb5_db_close_database(context); 1587c478bd9Sstevel@tonic-gate return KRB5_KT_NOTFOUND; 1597c478bd9Sstevel@tonic-gate } 1607c478bd9Sstevel@tonic-gate 1617c478bd9Sstevel@tonic-gate if (db_entry.attributes & KRB5_KDB_DISALLOW_SVR 1627c478bd9Sstevel@tonic-gate || db_entry.attributes & KRB5_KDB_DISALLOW_ALL_TIX) { 1637c478bd9Sstevel@tonic-gate kerror = KRB5_KT_NOTFOUND; 1647c478bd9Sstevel@tonic-gate goto error; 1657c478bd9Sstevel@tonic-gate } 1667c478bd9Sstevel@tonic-gate 1677c478bd9Sstevel@tonic-gate /* match key */ 1687c478bd9Sstevel@tonic-gate kerror = krb5_db_get_mkey(context, &master_key); 1697c478bd9Sstevel@tonic-gate if (kerror) 1707c478bd9Sstevel@tonic-gate goto error; 1717c478bd9Sstevel@tonic-gate 1727c478bd9Sstevel@tonic-gate /* For cross realm tgts, we match whatever enctype is provided; 1737c478bd9Sstevel@tonic-gate * for other principals, we only match the first enctype that is 1747c478bd9Sstevel@tonic-gate * found. Since the TGS and AS code do the same thing, then we 1757c478bd9Sstevel@tonic-gate * will only successfully decrypt tickets we have issued.*/ 1767c478bd9Sstevel@tonic-gate kerror = krb5_dbe_find_enctype(context, &db_entry, 1777c478bd9Sstevel@tonic-gate xrealm_tgt?enctype:-1, 1787c478bd9Sstevel@tonic-gate -1, kvno, &key_data); 1797c478bd9Sstevel@tonic-gate if (kerror) 1807c478bd9Sstevel@tonic-gate goto error; 1817c478bd9Sstevel@tonic-gate 1827c478bd9Sstevel@tonic-gate 1837c478bd9Sstevel@tonic-gate kerror = krb5_dbekd_decrypt_key_data(context, master_key, 1847c478bd9Sstevel@tonic-gate key_data, &entry->key, NULL); 1857c478bd9Sstevel@tonic-gate if (kerror) 1867c478bd9Sstevel@tonic-gate goto error; 1877c478bd9Sstevel@tonic-gate 1887c478bd9Sstevel@tonic-gate if (enctype > 0) { 1897c478bd9Sstevel@tonic-gate kerror = krb5_c_enctype_compare(context, enctype, 1907c478bd9Sstevel@tonic-gate entry->key.enctype, &similar); 1917c478bd9Sstevel@tonic-gate if (kerror) 1927c478bd9Sstevel@tonic-gate goto error; 1937c478bd9Sstevel@tonic-gate 1947c478bd9Sstevel@tonic-gate if (!similar) { 1957c478bd9Sstevel@tonic-gate kerror = KRB5_KDB_NO_PERMITTED_KEY; 1967c478bd9Sstevel@tonic-gate goto error; 1977c478bd9Sstevel@tonic-gate } 1987c478bd9Sstevel@tonic-gate } 1997c478bd9Sstevel@tonic-gate /* 2007c478bd9Sstevel@tonic-gate * Coerce the enctype of the output keyblock in case we got an 2017c478bd9Sstevel@tonic-gate * inexact match on the enctype. 2027c478bd9Sstevel@tonic-gate */ 2037c478bd9Sstevel@tonic-gate entry->key.enctype = enctype; 2047c478bd9Sstevel@tonic-gate 2057c478bd9Sstevel@tonic-gate kerror = krb5_copy_principal(context, principal, &entry->principal); 2067c478bd9Sstevel@tonic-gate if (kerror) 2077c478bd9Sstevel@tonic-gate goto error; 2087c478bd9Sstevel@tonic-gate 2097c478bd9Sstevel@tonic-gate /* Close database */ 2107c478bd9Sstevel@tonic-gate error: 2117c478bd9Sstevel@tonic-gate krb5_dbe_free_contents(context, &db_entry); 2127c478bd9Sstevel@tonic-gate krb5_db_close_database(context); 2137c478bd9Sstevel@tonic-gate return(kerror); 2147c478bd9Sstevel@tonic-gate } 2157c478bd9Sstevel@tonic-gate 2167c478bd9Sstevel@tonic-gate /* 2177c478bd9Sstevel@tonic-gate * is_xrealm_tgt: Returns true if the principal is a cross-realm TGT 2187c478bd9Sstevel@tonic-gate * principal-- a principal with first component krbtgt and second 2197c478bd9Sstevel@tonic-gate * component not equal to realm. 2207c478bd9Sstevel@tonic-gate */ 2217c478bd9Sstevel@tonic-gate static int 2227c478bd9Sstevel@tonic-gate is_xrealm_tgt(krb5_context context, krb5_const_principal princ) 2237c478bd9Sstevel@tonic-gate { 2247c478bd9Sstevel@tonic-gate krb5_data *dat; 2257c478bd9Sstevel@tonic-gate if (krb5_princ_size(context, princ) != 2) 2267c478bd9Sstevel@tonic-gate return 0; 2277c478bd9Sstevel@tonic-gate dat = krb5_princ_component(context, princ, 0); 2287c478bd9Sstevel@tonic-gate if (strncmp("krbtgt", dat->data, dat->length) != 0) 2297c478bd9Sstevel@tonic-gate return 0; 2307c478bd9Sstevel@tonic-gate dat = krb5_princ_component(context, princ, 1); 2317c478bd9Sstevel@tonic-gate if (dat->length != princ->realm.length) 2327c478bd9Sstevel@tonic-gate return 1; 2337c478bd9Sstevel@tonic-gate if (strncmp(dat->data, princ->realm.data, dat->length) == 0) 2347c478bd9Sstevel@tonic-gate return 0; 2357c478bd9Sstevel@tonic-gate return 1; 2367c478bd9Sstevel@tonic-gate 2377c478bd9Sstevel@tonic-gate } 2387c478bd9Sstevel@tonic-gate 239