xref: /illumos-gate/usr/src/lib/krb5/kdb/keytab.c (revision 159d09a2)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * kadmin/v5server/keytab.c
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * Copyright 1995 by the Massachusetts Institute of Technology.
57c478bd9Sstevel@tonic-gate  * All Rights Reserved.
67c478bd9Sstevel@tonic-gate  *
77c478bd9Sstevel@tonic-gate  * Export of this software from the United States of America may
87c478bd9Sstevel@tonic-gate  *   require a specific license from the United States Government.
97c478bd9Sstevel@tonic-gate  *   It is the responsibility of any person or organization contemplating
107c478bd9Sstevel@tonic-gate  *   export to obtain such a license before exporting.
117c478bd9Sstevel@tonic-gate  *
127c478bd9Sstevel@tonic-gate  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
137c478bd9Sstevel@tonic-gate  * distribute this software and its documentation for any purpose and
147c478bd9Sstevel@tonic-gate  * without fee is hereby granted, provided that the above copyright
157c478bd9Sstevel@tonic-gate  * notice appear in all copies and that both that copyright notice and
167c478bd9Sstevel@tonic-gate  * this permission notice appear in supporting documentation, and that
177c478bd9Sstevel@tonic-gate  * the name of M.I.T. not be used in advertising or publicity pertaining
187c478bd9Sstevel@tonic-gate  * to distribution of the software without specific, written prior
197c478bd9Sstevel@tonic-gate  * permission.  Furthermore if you modify this software you must label
207c478bd9Sstevel@tonic-gate  * your software as modified software and not distribute it in such a
217c478bd9Sstevel@tonic-gate  * fashion that it might be confused with the original M.I.T. software.
227c478bd9Sstevel@tonic-gate  * M.I.T. makes no representations about the suitability of
237c478bd9Sstevel@tonic-gate  * this software for any purpose.  It is provided "as is" without express
247c478bd9Sstevel@tonic-gate  * or implied warranty.
257c478bd9Sstevel@tonic-gate  *
267c478bd9Sstevel@tonic-gate  */
277c478bd9Sstevel@tonic-gate #include <string.h>
287c478bd9Sstevel@tonic-gate 
297c478bd9Sstevel@tonic-gate #include "k5-int.h"
3056a424ccSmp #include "kdb_kt.h"
317c478bd9Sstevel@tonic-gate 
327c478bd9Sstevel@tonic-gate static int
337c478bd9Sstevel@tonic-gate is_xrealm_tgt(krb5_context, krb5_const_principal);
347c478bd9Sstevel@tonic-gate 
357c478bd9Sstevel@tonic-gate krb5_error_code krb5_ktkdb_close (krb5_context, krb5_keytab);
367c478bd9Sstevel@tonic-gate 
377c478bd9Sstevel@tonic-gate krb5_error_code krb5_ktkdb_get_entry (krb5_context, krb5_keytab, krb5_const_principal,
387c478bd9Sstevel@tonic-gate 		   krb5_kvno, krb5_enctype, krb5_keytab_entry *);
397c478bd9Sstevel@tonic-gate 
4056a424ccSmp static krb5_error_code
krb5_ktkdb_get_name(krb5_context context,krb5_keytab keytab,char * name,unsigned int namelen)4156a424ccSmp krb5_ktkdb_get_name(krb5_context context, krb5_keytab keytab,
4256a424ccSmp 		    char *name, unsigned int namelen)
4356a424ccSmp {
4456a424ccSmp     if (namelen < sizeof("KDB:"))
4556a424ccSmp 	return KRB5_KT_NAME_TOOLONG;
4656a424ccSmp     strcpy(name, "KDB:");
4756a424ccSmp     return 0;
4856a424ccSmp }
497c478bd9Sstevel@tonic-gate 
507c478bd9Sstevel@tonic-gate krb5_kt_ops krb5_kt_kdb_ops = {
517c478bd9Sstevel@tonic-gate     0,
527c478bd9Sstevel@tonic-gate     "KDB", 	/* Prefix -- this string should not appear anywhere else! */
537c478bd9Sstevel@tonic-gate     krb5_ktkdb_resolve,		/* resolve */
5456a424ccSmp     krb5_ktkdb_get_name,	/* get_name */
557c478bd9Sstevel@tonic-gate     krb5_ktkdb_close,		/* close */
567c478bd9Sstevel@tonic-gate     krb5_ktkdb_get_entry,	/* get */
577c478bd9Sstevel@tonic-gate     NULL,			/* start_seq_get */
587c478bd9Sstevel@tonic-gate     NULL,			/* get_next */
597c478bd9Sstevel@tonic-gate     NULL,			/* end_get */
607c478bd9Sstevel@tonic-gate     NULL,			/* add (extended) */
617c478bd9Sstevel@tonic-gate     NULL,			/* remove (extended) */
627c478bd9Sstevel@tonic-gate     NULL, 		/* (void *) &krb5_ktfile_ser_entry */
637c478bd9Sstevel@tonic-gate };
647c478bd9Sstevel@tonic-gate 
657c478bd9Sstevel@tonic-gate typedef struct krb5_ktkdb_data {
667c478bd9Sstevel@tonic-gate     char * name;
677c478bd9Sstevel@tonic-gate } krb5_ktkdb_data;
687c478bd9Sstevel@tonic-gate 
697c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_resolve(context,name,id)707c478bd9Sstevel@tonic-gate krb5_ktkdb_resolve(context, name, id)
717c478bd9Sstevel@tonic-gate     krb5_context  	  context;
727c478bd9Sstevel@tonic-gate     const char		* name;
737c478bd9Sstevel@tonic-gate     krb5_keytab		* id;
747c478bd9Sstevel@tonic-gate {
757c478bd9Sstevel@tonic-gate     if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL)
767c478bd9Sstevel@tonic-gate         return(ENOMEM);
777c478bd9Sstevel@tonic-gate     (*id)->ops = &krb5_kt_kdb_ops;
787c478bd9Sstevel@tonic-gate     (*id)->magic = KV5M_KEYTAB;
797c478bd9Sstevel@tonic-gate     return(0);
807c478bd9Sstevel@tonic-gate }
817c478bd9Sstevel@tonic-gate 
827c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_close(context,kt)837c478bd9Sstevel@tonic-gate krb5_ktkdb_close(context, kt)
847c478bd9Sstevel@tonic-gate      krb5_context context;
857c478bd9Sstevel@tonic-gate      krb5_keytab kt;
867c478bd9Sstevel@tonic-gate {
877c478bd9Sstevel@tonic-gate   /*
887c478bd9Sstevel@tonic-gate    * This routine is responsible for freeing all memory allocated
897c478bd9Sstevel@tonic-gate    * for this keytab.  There are no system resources that need
907c478bd9Sstevel@tonic-gate    * to be freed nor are there any open files.
917c478bd9Sstevel@tonic-gate    *
927c478bd9Sstevel@tonic-gate    * This routine should undo anything done by krb5_ktkdb_resolve().
937c478bd9Sstevel@tonic-gate    */
947c478bd9Sstevel@tonic-gate 
957c478bd9Sstevel@tonic-gate   kt->ops = NULL;
967c478bd9Sstevel@tonic-gate   krb5_xfree(kt);
977c478bd9Sstevel@tonic-gate 
987c478bd9Sstevel@tonic-gate   return 0;
997c478bd9Sstevel@tonic-gate }
1007c478bd9Sstevel@tonic-gate 
1017c478bd9Sstevel@tonic-gate static krb5_context ktkdb_ctx = NULL;
1027c478bd9Sstevel@tonic-gate 
1037c478bd9Sstevel@tonic-gate /*
1047c478bd9Sstevel@tonic-gate  * Set a different context for use with ktkdb_get_entry().  This is
1057c478bd9Sstevel@tonic-gate  * primarily useful for kadmind, where the gssapi library context,
1067c478bd9Sstevel@tonic-gate  * which will be used for the keytab, will necessarily have a
1077c478bd9Sstevel@tonic-gate  * different context than that used by the kadm5 library to access the
1087c478bd9Sstevel@tonic-gate  * database for its own purposes.
1097c478bd9Sstevel@tonic-gate  */
1107c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_set_context(krb5_context ctx)1117c478bd9Sstevel@tonic-gate krb5_ktkdb_set_context(krb5_context ctx)
1127c478bd9Sstevel@tonic-gate {
1137c478bd9Sstevel@tonic-gate     ktkdb_ctx = ctx;
1147c478bd9Sstevel@tonic-gate     return 0;
1157c478bd9Sstevel@tonic-gate }
1167c478bd9Sstevel@tonic-gate 
1177c478bd9Sstevel@tonic-gate krb5_error_code
krb5_ktkdb_get_entry(in_context,id,principal,kvno,enctype,entry)1187c478bd9Sstevel@tonic-gate krb5_ktkdb_get_entry(in_context, id, principal, kvno, enctype, entry)
1197c478bd9Sstevel@tonic-gate     krb5_context 	  in_context;
1207c478bd9Sstevel@tonic-gate     krb5_keytab 	  id;
1217c478bd9Sstevel@tonic-gate     krb5_const_principal  principal;
1227c478bd9Sstevel@tonic-gate     krb5_kvno 	 	  kvno;
1237c478bd9Sstevel@tonic-gate     krb5_enctype 	  enctype;
1247c478bd9Sstevel@tonic-gate     krb5_keytab_entry 	* entry;
1257c478bd9Sstevel@tonic-gate {
1267c478bd9Sstevel@tonic-gate     krb5_context	  context;
1277c478bd9Sstevel@tonic-gate     krb5_keyblock       * master_key;
1287c478bd9Sstevel@tonic-gate     krb5_error_code 	  kerror = 0;
1297c478bd9Sstevel@tonic-gate     krb5_key_data 	* key_data;
1307c478bd9Sstevel@tonic-gate     krb5_db_entry 	  db_entry;
1317c478bd9Sstevel@tonic-gate     krb5_boolean 	  more = 0;
1327c478bd9Sstevel@tonic-gate     int 	 	  n = 0;
13356a424ccSmp     int xrealm_tgt;
13456a424ccSmp     krb5_boolean similar;
1357c478bd9Sstevel@tonic-gate 
1367c478bd9Sstevel@tonic-gate     if (ktkdb_ctx)
1377c478bd9Sstevel@tonic-gate 	context = ktkdb_ctx;
1387c478bd9Sstevel@tonic-gate     else
1397c478bd9Sstevel@tonic-gate 	context = in_context;
1407c478bd9Sstevel@tonic-gate 
14156a424ccSmp     xrealm_tgt = is_xrealm_tgt(context, principal);
14256a424ccSmp 
1437c478bd9Sstevel@tonic-gate     /* Open database */
1447c478bd9Sstevel@tonic-gate     /* krb5_db_init(context); */
14554925bf6Swillf     if ((kerror = krb5_db_inited(context)))
1467c478bd9Sstevel@tonic-gate         return(kerror);
1477c478bd9Sstevel@tonic-gate 
1487c478bd9Sstevel@tonic-gate     /* get_principal */
1497c478bd9Sstevel@tonic-gate     kerror = krb5_db_get_principal(context, principal, &
1507c478bd9Sstevel@tonic-gate 				       db_entry, &n, &more);
1517c478bd9Sstevel@tonic-gate     if (kerror) {
152*159d09a2SMark Phalan       /*        krb5_db_close_database(context); */
1537c478bd9Sstevel@tonic-gate         return(kerror);
1547c478bd9Sstevel@tonic-gate     }
1557c478bd9Sstevel@tonic-gate     if (n != 1) {
156*159d09a2SMark Phalan       /* krb5_db_close_database(context); */
1577c478bd9Sstevel@tonic-gate 	return KRB5_KT_NOTFOUND;
1587c478bd9Sstevel@tonic-gate     }
1597c478bd9Sstevel@tonic-gate 
1607c478bd9Sstevel@tonic-gate     if (db_entry.attributes & KRB5_KDB_DISALLOW_SVR
1617c478bd9Sstevel@tonic-gate 	|| db_entry.attributes & KRB5_KDB_DISALLOW_ALL_TIX) {
1627c478bd9Sstevel@tonic-gate 	kerror = KRB5_KT_NOTFOUND;
1637c478bd9Sstevel@tonic-gate 	goto error;
1647c478bd9Sstevel@tonic-gate     }
1657c478bd9Sstevel@tonic-gate 
1667c478bd9Sstevel@tonic-gate     /* match key */
1677c478bd9Sstevel@tonic-gate     kerror = krb5_db_get_mkey(context, &master_key);
1687c478bd9Sstevel@tonic-gate     if (kerror)
1697c478bd9Sstevel@tonic-gate 	goto error;
1707c478bd9Sstevel@tonic-gate 
1717c478bd9Sstevel@tonic-gate     /* For cross realm tgts, we match whatever enctype is provided;
1727c478bd9Sstevel@tonic-gate      * for other principals, we only match the first enctype that is
1737c478bd9Sstevel@tonic-gate      * found.  Since the TGS and AS code do the same thing, then we
1747c478bd9Sstevel@tonic-gate      * will only successfully decrypt  tickets we have issued.*/
1757c478bd9Sstevel@tonic-gate     kerror = krb5_dbe_find_enctype(context, &db_entry,
1767c478bd9Sstevel@tonic-gate 				   xrealm_tgt?enctype:-1,
1777c478bd9Sstevel@tonic-gate 				   -1, kvno, &key_data);
1787c478bd9Sstevel@tonic-gate     if (kerror)
1797c478bd9Sstevel@tonic-gate 	goto error;
1807c478bd9Sstevel@tonic-gate 
1817c478bd9Sstevel@tonic-gate 
1827c478bd9Sstevel@tonic-gate     kerror = krb5_dbekd_decrypt_key_data(context, master_key,
1837c478bd9Sstevel@tonic-gate 					 key_data, &entry->key, NULL);
1847c478bd9Sstevel@tonic-gate     if (kerror)
1857c478bd9Sstevel@tonic-gate 	goto error;
1867c478bd9Sstevel@tonic-gate 
1877c478bd9Sstevel@tonic-gate     if (enctype > 0) {
1887c478bd9Sstevel@tonic-gate 	kerror = krb5_c_enctype_compare(context, enctype,
1897c478bd9Sstevel@tonic-gate 					entry->key.enctype, &similar);
1907c478bd9Sstevel@tonic-gate 	if (kerror)
1917c478bd9Sstevel@tonic-gate 	    goto error;
1927c478bd9Sstevel@tonic-gate 
1937c478bd9Sstevel@tonic-gate 	if (!similar) {
1947c478bd9Sstevel@tonic-gate 	    kerror = KRB5_KDB_NO_PERMITTED_KEY;
1957c478bd9Sstevel@tonic-gate 	    goto error;
1967c478bd9Sstevel@tonic-gate 	}
1977c478bd9Sstevel@tonic-gate     }
1987c478bd9Sstevel@tonic-gate     /*
1997c478bd9Sstevel@tonic-gate      * Coerce the enctype of the output keyblock in case we got an
2007c478bd9Sstevel@tonic-gate      * inexact match on the enctype.
2017c478bd9Sstevel@tonic-gate      */
2027c478bd9Sstevel@tonic-gate     entry->key.enctype = enctype;
2037c478bd9Sstevel@tonic-gate 
2047c478bd9Sstevel@tonic-gate     kerror = krb5_copy_principal(context, principal, &entry->principal);
2057c478bd9Sstevel@tonic-gate     if (kerror)
2067c478bd9Sstevel@tonic-gate 	goto error;
2077c478bd9Sstevel@tonic-gate 
2087c478bd9Sstevel@tonic-gate     /* Close database */
2097c478bd9Sstevel@tonic-gate   error:
21054925bf6Swillf     krb5_db_free_principal(context, &db_entry, 1);
211*159d09a2SMark Phalan     /*    krb5_db_close_database(context); */
2127c478bd9Sstevel@tonic-gate     return(kerror);
2137c478bd9Sstevel@tonic-gate }
2147c478bd9Sstevel@tonic-gate 
2157c478bd9Sstevel@tonic-gate /*
2167c478bd9Sstevel@tonic-gate  * is_xrealm_tgt: Returns true if the principal is a cross-realm  TGT
2177c478bd9Sstevel@tonic-gate  * principal-- a principal with first component  krbtgt and second
2187c478bd9Sstevel@tonic-gate  * component not equal to realm.
2197c478bd9Sstevel@tonic-gate  */
2207c478bd9Sstevel@tonic-gate static int
is_xrealm_tgt(krb5_context context,krb5_const_principal princ)2217c478bd9Sstevel@tonic-gate is_xrealm_tgt(krb5_context context, krb5_const_principal princ)
2227c478bd9Sstevel@tonic-gate {
2237c478bd9Sstevel@tonic-gate     krb5_data *dat;
2247c478bd9Sstevel@tonic-gate     if (krb5_princ_size(context, princ) != 2)
2257c478bd9Sstevel@tonic-gate 	return 0;
2267c478bd9Sstevel@tonic-gate     dat = krb5_princ_component(context, princ, 0);
2277c478bd9Sstevel@tonic-gate     if (strncmp("krbtgt", dat->data, dat->length) != 0)
2287c478bd9Sstevel@tonic-gate 	return 0;
2297c478bd9Sstevel@tonic-gate     dat = krb5_princ_component(context, princ, 1);
2307c478bd9Sstevel@tonic-gate     if (dat->length != princ->realm.length)
2317c478bd9Sstevel@tonic-gate 	return 1;
2327c478bd9Sstevel@tonic-gate     if (strncmp(dat->data, princ->realm.data, dat->length) == 0)
2337c478bd9Sstevel@tonic-gate 	return 0;
2347c478bd9Sstevel@tonic-gate     return 1;
2357c478bd9Sstevel@tonic-gate 
2367c478bd9Sstevel@tonic-gate }
2377c478bd9Sstevel@tonic-gate 
238