1 /* $NetBSD: hdb-keytab.c,v 1.2 2017/01/28 21:31:48 christos Exp $ */
2
3 /*
4 * Copyright (c) 2009 Kungliga Tekniska H�gskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 *
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 *
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 *
21 * 3. Neither the name of the Institute nor the names of its contributors
22 * may be used to endorse or promote products derived from this software
23 * without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 */
37
38 #include "hdb_locl.h"
39 #include <assert.h>
40
41 typedef struct {
42 char *path;
43 krb5_keytab keytab;
44 } *hdb_keytab;
45
46 /*
47 *
48 */
49
50 static krb5_error_code
hkt_close(krb5_context context,HDB * db)51 hkt_close(krb5_context context, HDB *db)
52 {
53 hdb_keytab k = (hdb_keytab)db->hdb_db;
54 krb5_error_code ret;
55
56 assert(k->keytab);
57
58 ret = krb5_kt_close(context, k->keytab);
59 k->keytab = NULL;
60
61 return ret;
62 }
63
64 static krb5_error_code
hkt_destroy(krb5_context context,HDB * db)65 hkt_destroy(krb5_context context, HDB *db)
66 {
67 hdb_keytab k = (hdb_keytab)db->hdb_db;
68 krb5_error_code ret;
69
70 ret = hdb_clear_master_key (context, db);
71
72 free(k->path);
73 free(k);
74
75 free(db->hdb_name);
76 free(db);
77 return ret;
78 }
79
80 static krb5_error_code
hkt_lock(krb5_context context,HDB * db,int operation)81 hkt_lock(krb5_context context, HDB *db, int operation)
82 {
83 return 0;
84 }
85
86 static krb5_error_code
hkt_unlock(krb5_context context,HDB * db)87 hkt_unlock(krb5_context context, HDB *db)
88 {
89 return 0;
90 }
91
92 static krb5_error_code
hkt_firstkey(krb5_context context,HDB * db,unsigned flags,hdb_entry_ex * entry)93 hkt_firstkey(krb5_context context, HDB *db,
94 unsigned flags, hdb_entry_ex *entry)
95 {
96 return HDB_ERR_DB_INUSE;
97 }
98
99 static krb5_error_code
hkt_nextkey(krb5_context context,HDB * db,unsigned flags,hdb_entry_ex * entry)100 hkt_nextkey(krb5_context context, HDB * db, unsigned flags,
101 hdb_entry_ex * entry)
102 {
103 return HDB_ERR_DB_INUSE;
104 }
105
106 static krb5_error_code
hkt_open(krb5_context context,HDB * db,int flags,mode_t mode)107 hkt_open(krb5_context context, HDB * db, int flags, mode_t mode)
108 {
109 hdb_keytab k = (hdb_keytab)db->hdb_db;
110 krb5_error_code ret;
111
112 assert(k->keytab == NULL);
113
114 ret = krb5_kt_resolve(context, k->path, &k->keytab);
115 if (ret)
116 return ret;
117
118 return 0;
119 }
120
121 static krb5_error_code
hkt_fetch_kvno(krb5_context context,HDB * db,krb5_const_principal principal,unsigned flags,krb5_kvno kvno,hdb_entry_ex * entry)122 hkt_fetch_kvno(krb5_context context, HDB * db, krb5_const_principal principal,
123 unsigned flags, krb5_kvno kvno, hdb_entry_ex * entry)
124 {
125 hdb_keytab k = (hdb_keytab)db->hdb_db;
126 krb5_error_code ret;
127 krb5_keytab_entry ktentry;
128
129 if (!(flags & HDB_F_KVNO_SPECIFIED)) {
130 /* Preserve previous behaviour if no kvno specified */
131 kvno = 0;
132 }
133
134 memset(&ktentry, 0, sizeof(ktentry));
135
136 entry->entry.flags.server = 1;
137 entry->entry.flags.forwardable = 1;
138 entry->entry.flags.renewable = 1;
139
140 /* Not recorded in the OD backend, make something up */
141 ret = krb5_parse_name(context, "hdb/keytab@WELL-KNOWN:KEYTAB-BACKEND",
142 &entry->entry.created_by.principal);
143 if (ret)
144 goto out;
145
146 /*
147 * XXX really needs to try all enctypes and just not pick the
148 * first one, even if that happens to be des3-cbc-sha1 (ie best
149 * enctype) in the Apple case. A while loop over all known
150 * enctypes should work.
151 */
152
153 ret = krb5_kt_get_entry(context, k->keytab, principal, kvno, 0, &ktentry);
154 if (ret) {
155 ret = HDB_ERR_NOENTRY;
156 goto out;
157 }
158
159 ret = krb5_copy_principal(context, principal, &entry->entry.principal);
160 if (ret)
161 goto out;
162
163 ret = _hdb_keytab2hdb_entry(context, &ktentry, entry);
164
165 out:
166 if (ret) {
167 free_hdb_entry(&entry->entry);
168 memset(&entry->entry, 0, sizeof(entry->entry));
169 }
170 krb5_kt_free_entry(context, &ktentry);
171
172 return ret;
173 }
174
175 static krb5_error_code
hkt_store(krb5_context context,HDB * db,unsigned flags,hdb_entry_ex * entry)176 hkt_store(krb5_context context, HDB * db, unsigned flags,
177 hdb_entry_ex * entry)
178 {
179 return HDB_ERR_DB_INUSE;
180 }
181
182
183 krb5_error_code
hdb_keytab_create(krb5_context context,HDB ** db,const char * arg)184 hdb_keytab_create(krb5_context context, HDB ** db, const char *arg)
185 {
186 hdb_keytab k;
187
188 *db = calloc(1, sizeof(**db));
189 if (*db == NULL) {
190 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
191 return ENOMEM;
192 }
193 memset(*db, 0, sizeof(**db));
194
195 k = calloc(1, sizeof(*k));
196 if (k == NULL) {
197 free(*db);
198 *db = NULL;
199 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
200 return ENOMEM;
201 }
202
203 k->path = strdup(arg);
204 if (k->path == NULL) {
205 free(k);
206 free(*db);
207 *db = NULL;
208 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
209 return ENOMEM;
210 }
211
212
213 (*db)->hdb_db = k;
214
215 (*db)->hdb_master_key_set = 0;
216 (*db)->hdb_openp = 0;
217 (*db)->hdb_open = hkt_open;
218 (*db)->hdb_close = hkt_close;
219 (*db)->hdb_fetch_kvno = hkt_fetch_kvno;
220 (*db)->hdb_store = hkt_store;
221 (*db)->hdb_remove = NULL;
222 (*db)->hdb_firstkey = hkt_firstkey;
223 (*db)->hdb_nextkey = hkt_nextkey;
224 (*db)->hdb_lock = hkt_lock;
225 (*db)->hdb_unlock = hkt_unlock;
226 (*db)->hdb_rename = NULL;
227 (*db)->hdb__get = NULL;
228 (*db)->hdb__put = NULL;
229 (*db)->hdb__del = NULL;
230 (*db)->hdb_destroy = hkt_destroy;
231
232 return 0;
233 }
234