xref: /illumos-gate/usr/src/lib/krb5/kdb/keytab.c (revision 159d09a2)
1 /*
2  * kadmin/v5server/keytab.c
3  *
4  * Copyright 1995 by the Massachusetts Institute of Technology.
5  * All Rights Reserved.
6  *
7  * Export of this software from the United States of America may
8  *   require a specific license from the United States Government.
9  *   It is the responsibility of any person or organization contemplating
10  *   export to obtain such a license before exporting.
11  *
12  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
13  * distribute this software and its documentation for any purpose and
14  * without fee is hereby granted, provided that the above copyright
15  * notice appear in all copies and that both that copyright notice and
16  * this permission notice appear in supporting documentation, and that
17  * the name of M.I.T. not be used in advertising or publicity pertaining
18  * to distribution of the software without specific, written prior
19  * permission.  Furthermore if you modify this software you must label
20  * your software as modified software and not distribute it in such a
21  * fashion that it might be confused with the original M.I.T. software.
22  * M.I.T. makes no representations about the suitability of
23  * this software for any purpose.  It is provided "as is" without express
24  * or implied warranty.
25  *
26  */
27 #include <string.h>
28 
29 #include "k5-int.h"
30 #include "kdb_kt.h"
31 
32 static int
33 is_xrealm_tgt(krb5_context, krb5_const_principal);
34 
35 krb5_error_code krb5_ktkdb_close (krb5_context, krb5_keytab);
36 
37 krb5_error_code krb5_ktkdb_get_entry (krb5_context, krb5_keytab, krb5_const_principal,
38 		   krb5_kvno, krb5_enctype, krb5_keytab_entry *);
39 
40 static krb5_error_code
krb5_ktkdb_get_name(krb5_context context,krb5_keytab keytab,char * name,unsigned int namelen)41 krb5_ktkdb_get_name(krb5_context context, krb5_keytab keytab,
42 		    char *name, unsigned int namelen)
43 {
44     if (namelen < sizeof("KDB:"))
45 	return KRB5_KT_NAME_TOOLONG;
46     strcpy(name, "KDB:");
47     return 0;
48 }
49 
50 krb5_kt_ops krb5_kt_kdb_ops = {
51     0,
52     "KDB", 	/* Prefix -- this string should not appear anywhere else! */
53     krb5_ktkdb_resolve,		/* resolve */
54     krb5_ktkdb_get_name,	/* get_name */
55     krb5_ktkdb_close,		/* close */
56     krb5_ktkdb_get_entry,	/* get */
57     NULL,			/* start_seq_get */
58     NULL,			/* get_next */
59     NULL,			/* end_get */
60     NULL,			/* add (extended) */
61     NULL,			/* remove (extended) */
62     NULL, 		/* (void *) &krb5_ktfile_ser_entry */
63 };
64 
65 typedef struct krb5_ktkdb_data {
66     char * name;
67 } krb5_ktkdb_data;
68 
69 krb5_error_code
krb5_ktkdb_resolve(context,name,id)70 krb5_ktkdb_resolve(context, name, id)
71     krb5_context  	  context;
72     const char		* name;
73     krb5_keytab		* id;
74 {
75     if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL)
76         return(ENOMEM);
77     (*id)->ops = &krb5_kt_kdb_ops;
78     (*id)->magic = KV5M_KEYTAB;
79     return(0);
80 }
81 
82 krb5_error_code
krb5_ktkdb_close(context,kt)83 krb5_ktkdb_close(context, kt)
84      krb5_context context;
85      krb5_keytab kt;
86 {
87   /*
88    * This routine is responsible for freeing all memory allocated
89    * for this keytab.  There are no system resources that need
90    * to be freed nor are there any open files.
91    *
92    * This routine should undo anything done by krb5_ktkdb_resolve().
93    */
94 
95   kt->ops = NULL;
96   krb5_xfree(kt);
97 
98   return 0;
99 }
100 
101 static krb5_context ktkdb_ctx = NULL;
102 
103 /*
104  * Set a different context for use with ktkdb_get_entry().  This is
105  * primarily useful for kadmind, where the gssapi library context,
106  * which will be used for the keytab, will necessarily have a
107  * different context than that used by the kadm5 library to access the
108  * database for its own purposes.
109  */
110 krb5_error_code
krb5_ktkdb_set_context(krb5_context ctx)111 krb5_ktkdb_set_context(krb5_context ctx)
112 {
113     ktkdb_ctx = ctx;
114     return 0;
115 }
116 
117 krb5_error_code
krb5_ktkdb_get_entry(in_context,id,principal,kvno,enctype,entry)118 krb5_ktkdb_get_entry(in_context, id, principal, kvno, enctype, entry)
119     krb5_context 	  in_context;
120     krb5_keytab 	  id;
121     krb5_const_principal  principal;
122     krb5_kvno 	 	  kvno;
123     krb5_enctype 	  enctype;
124     krb5_keytab_entry 	* entry;
125 {
126     krb5_context	  context;
127     krb5_keyblock       * master_key;
128     krb5_error_code 	  kerror = 0;
129     krb5_key_data 	* key_data;
130     krb5_db_entry 	  db_entry;
131     krb5_boolean 	  more = 0;
132     int 	 	  n = 0;
133     int xrealm_tgt;
134     krb5_boolean similar;
135 
136     if (ktkdb_ctx)
137 	context = ktkdb_ctx;
138     else
139 	context = in_context;
140 
141     xrealm_tgt = is_xrealm_tgt(context, principal);
142 
143     /* Open database */
144     /* krb5_db_init(context); */
145     if ((kerror = krb5_db_inited(context)))
146         return(kerror);
147 
148     /* get_principal */
149     kerror = krb5_db_get_principal(context, principal, &
150 				       db_entry, &n, &more);
151     if (kerror) {
152       /*        krb5_db_close_database(context); */
153         return(kerror);
154     }
155     if (n != 1) {
156       /* krb5_db_close_database(context); */
157 	return KRB5_KT_NOTFOUND;
158     }
159 
160     if (db_entry.attributes & KRB5_KDB_DISALLOW_SVR
161 	|| db_entry.attributes & KRB5_KDB_DISALLOW_ALL_TIX) {
162 	kerror = KRB5_KT_NOTFOUND;
163 	goto error;
164     }
165 
166     /* match key */
167     kerror = krb5_db_get_mkey(context, &master_key);
168     if (kerror)
169 	goto error;
170 
171     /* For cross realm tgts, we match whatever enctype is provided;
172      * for other principals, we only match the first enctype that is
173      * found.  Since the TGS and AS code do the same thing, then we
174      * will only successfully decrypt  tickets we have issued.*/
175     kerror = krb5_dbe_find_enctype(context, &db_entry,
176 				   xrealm_tgt?enctype:-1,
177 				   -1, kvno, &key_data);
178     if (kerror)
179 	goto error;
180 
181 
182     kerror = krb5_dbekd_decrypt_key_data(context, master_key,
183 					 key_data, &entry->key, NULL);
184     if (kerror)
185 	goto error;
186 
187     if (enctype > 0) {
188 	kerror = krb5_c_enctype_compare(context, enctype,
189 					entry->key.enctype, &similar);
190 	if (kerror)
191 	    goto error;
192 
193 	if (!similar) {
194 	    kerror = KRB5_KDB_NO_PERMITTED_KEY;
195 	    goto error;
196 	}
197     }
198     /*
199      * Coerce the enctype of the output keyblock in case we got an
200      * inexact match on the enctype.
201      */
202     entry->key.enctype = enctype;
203 
204     kerror = krb5_copy_principal(context, principal, &entry->principal);
205     if (kerror)
206 	goto error;
207 
208     /* Close database */
209   error:
210     krb5_db_free_principal(context, &db_entry, 1);
211     /*    krb5_db_close_database(context); */
212     return(kerror);
213 }
214 
215 /*
216  * is_xrealm_tgt: Returns true if the principal is a cross-realm  TGT
217  * principal-- a principal with first component  krbtgt and second
218  * component not equal to realm.
219  */
220 static int
is_xrealm_tgt(krb5_context context,krb5_const_principal princ)221 is_xrealm_tgt(krb5_context context, krb5_const_principal princ)
222 {
223     krb5_data *dat;
224     if (krb5_princ_size(context, princ) != 2)
225 	return 0;
226     dat = krb5_princ_component(context, princ, 0);
227     if (strncmp("krbtgt", dat->data, dat->length) != 0)
228 	return 0;
229     dat = krb5_princ_component(context, princ, 1);
230     if (dat->length != princ->realm.length)
231 	return 1;
232     if (strncmp(dat->data, princ->realm.data, dat->length) == 0)
233 	return 0;
234     return 1;
235 
236 }
237 
238