1 /* $NetBSD: get_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include <krb5_locl.h> 37 #include "kadm5_locl.h" 38 #include <assert.h> 39 40 __RCSID("$NetBSD: get_s.c,v 1.2 2017/01/28 21:31:49 christos Exp $"); 41 42 static kadm5_ret_t 43 add_tl_data(kadm5_principal_ent_t ent, int16_t type, 44 const void *data, size_t size) 45 { 46 krb5_tl_data *tl; 47 48 tl = calloc(1, sizeof(*tl)); 49 if (tl == NULL) 50 return _kadm5_error_code(ENOMEM); 51 52 tl->tl_data_type = type; 53 tl->tl_data_length = size; 54 tl->tl_data_contents = malloc(size); 55 if (tl->tl_data_contents == NULL && size != 0) { 56 free(tl); 57 return _kadm5_error_code(ENOMEM); 58 } 59 memcpy(tl->tl_data_contents, data, size); 60 61 tl->tl_data_next = ent->tl_data; 62 ent->tl_data = tl; 63 ent->n_tl_data++; 64 65 return 0; 66 } 67 68 static 69 krb5_error_code 70 copy_keyset_to_kadm5(kadm5_server_context *context, krb5_kvno kvno, 71 size_t n_keys, Key *keys, krb5_salt *salt, 72 kadm5_principal_ent_t out) 73 { 74 size_t i; 75 Key *key; 76 krb5_key_data *kd; 77 krb5_data *sp; 78 krb5_error_code ret = 0; 79 80 for (i = 0; i < n_keys; i++) { 81 key = &keys[i]; 82 kd = &out->key_data[out->n_key_data]; 83 kd->key_data_ver = 2; 84 kd->key_data_kvno = kvno; 85 kd->key_data_type[0] = key->key.keytype; 86 if(key->salt) 87 kd->key_data_type[1] = key->salt->type; 88 else 89 kd->key_data_type[1] = KRB5_PADATA_PW_SALT; 90 /* setup key */ 91 kd->key_data_length[0] = key->key.keyvalue.length; 92 kd->key_data_contents[0] = malloc(kd->key_data_length[0]); 93 if(kd->key_data_contents[0] == NULL && kd->key_data_length[0] != 0){ 94 ret = ENOMEM; 95 break; 96 } 97 memcpy(kd->key_data_contents[0], key->key.keyvalue.data, 98 kd->key_data_length[0]); 99 /* setup salt */ 100 if(key->salt) 101 sp = &key->salt->salt; 102 else 103 sp = &salt->saltvalue; 104 kd->key_data_length[1] = sp->length; 105 kd->key_data_contents[1] = malloc(kd->key_data_length[1]); 106 if(kd->key_data_length[1] != 0 107 && kd->key_data_contents[1] == NULL) { 108 memset(kd->key_data_contents[0], 0, kd->key_data_length[0]); 109 ret = ENOMEM; 110 break; 111 } 112 memcpy(kd->key_data_contents[1], sp->data, kd->key_data_length[1]); 113 out->n_key_data++; 114 } 115 116 return ret; 117 } 118 119 kadm5_ret_t 120 kadm5_s_get_principal(void *server_handle, 121 krb5_principal princ, 122 kadm5_principal_ent_t out, 123 uint32_t mask) 124 { 125 kadm5_server_context *context = server_handle; 126 kadm5_ret_t ret; 127 hdb_entry_ex ent; 128 int hdb_is_rw = 1; 129 130 memset(&ent, 0, sizeof(ent)); 131 memset(out, 0, sizeof(*out)); 132 133 if (!context->keep_open) { 134 ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0); 135 if (ret == EPERM || ret == EACCES) { 136 ret = context->db->hdb_open(context->context, context->db, O_RDONLY, 0); 137 hdb_is_rw = 0; 138 } 139 if (ret) 140 return ret; 141 } 142 143 /* 144 * Attempt to recover the log. This will generally fail on slaves, 145 * and we can't tell if we're on a slave here. 146 * 147 * Perhaps we could set a flag in the kadm5_server_context to 148 * indicate whether a read has been done without recovering the log, 149 * in which case we could fail any subsequent writes. 150 */ 151 if (hdb_is_rw && kadm5_log_init_nb(context) == 0) 152 (void) kadm5_log_end(context); 153 154 ret = context->db->hdb_fetch_kvno(context->context, context->db, princ, 155 HDB_F_DECRYPT|HDB_F_ALL_KVNOS| 156 HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent); 157 158 if (!context->keep_open) 159 context->db->hdb_close(context->context, context->db); 160 if(ret) 161 return _kadm5_error_code(ret); 162 163 if(mask & KADM5_PRINCIPAL) 164 ret = krb5_copy_principal(context->context, ent.entry.principal, 165 &out->principal); 166 if(ret) 167 goto out; 168 if(mask & KADM5_PRINC_EXPIRE_TIME && ent.entry.valid_end) 169 out->princ_expire_time = *ent.entry.valid_end; 170 if(mask & KADM5_PW_EXPIRATION && ent.entry.pw_end) 171 out->pw_expiration = *ent.entry.pw_end; 172 if(mask & KADM5_LAST_PWD_CHANGE) 173 hdb_entry_get_pw_change_time(&ent.entry, &out->last_pwd_change); 174 if(mask & KADM5_ATTRIBUTES){ 175 out->attributes |= ent.entry.flags.postdate ? 0 : KRB5_KDB_DISALLOW_POSTDATED; 176 out->attributes |= ent.entry.flags.forwardable ? 0 : KRB5_KDB_DISALLOW_FORWARDABLE; 177 out->attributes |= ent.entry.flags.initial ? KRB5_KDB_DISALLOW_TGT_BASED : 0; 178 out->attributes |= ent.entry.flags.renewable ? 0 : KRB5_KDB_DISALLOW_RENEWABLE; 179 out->attributes |= ent.entry.flags.proxiable ? 0 : KRB5_KDB_DISALLOW_PROXIABLE; 180 out->attributes |= ent.entry.flags.invalid ? KRB5_KDB_DISALLOW_ALL_TIX : 0; 181 out->attributes |= ent.entry.flags.require_preauth ? KRB5_KDB_REQUIRES_PRE_AUTH : 0; 182 out->attributes |= ent.entry.flags.require_pwchange ? KRB5_KDB_REQUIRES_PWCHANGE : 0; 183 out->attributes |= ent.entry.flags.server ? 0 : KRB5_KDB_DISALLOW_SVR; 184 out->attributes |= ent.entry.flags.change_pw ? KRB5_KDB_PWCHANGE_SERVICE : 0; 185 out->attributes |= ent.entry.flags.ok_as_delegate ? KRB5_KDB_OK_AS_DELEGATE : 0; 186 out->attributes |= ent.entry.flags.trusted_for_delegation ? KRB5_KDB_TRUSTED_FOR_DELEGATION : 0; 187 out->attributes |= ent.entry.flags.allow_kerberos4 ? KRB5_KDB_ALLOW_KERBEROS4 : 0; 188 out->attributes |= ent.entry.flags.allow_digest ? KRB5_KDB_ALLOW_DIGEST : 0; 189 } 190 if(mask & KADM5_MAX_LIFE) { 191 if(ent.entry.max_life) 192 out->max_life = *ent.entry.max_life; 193 else 194 out->max_life = INT_MAX; 195 } 196 if(mask & KADM5_MOD_TIME) { 197 if(ent.entry.modified_by) 198 out->mod_date = ent.entry.modified_by->time; 199 else 200 out->mod_date = ent.entry.created_by.time; 201 } 202 if(mask & KADM5_MOD_NAME) { 203 if(ent.entry.modified_by) { 204 if (ent.entry.modified_by->principal != NULL) 205 ret = krb5_copy_principal(context->context, 206 ent.entry.modified_by->principal, 207 &out->mod_name); 208 } else if(ent.entry.created_by.principal != NULL) 209 ret = krb5_copy_principal(context->context, 210 ent.entry.created_by.principal, 211 &out->mod_name); 212 else 213 out->mod_name = NULL; 214 } 215 if(ret) 216 goto out; 217 218 if(mask & KADM5_KVNO) 219 out->kvno = ent.entry.kvno; 220 if(mask & KADM5_MKVNO) { 221 size_t n; 222 out->mkvno = 0; /* XXX */ 223 for(n = 0; n < ent.entry.keys.len; n++) 224 if(ent.entry.keys.val[n].mkvno) { 225 out->mkvno = *ent.entry.keys.val[n].mkvno; /* XXX this isn't right */ 226 break; 227 } 228 } 229 #if 0 /* XXX implement */ 230 if(mask & KADM5_AUX_ATTRIBUTES) 231 ; 232 if(mask & KADM5_LAST_SUCCESS) 233 ; 234 if(mask & KADM5_LAST_FAILED) 235 ; 236 if(mask & KADM5_FAIL_AUTH_COUNT) 237 ; 238 #endif 239 if(mask & KADM5_POLICY) { 240 HDB_extension *ext; 241 242 ext = hdb_find_extension(&ent.entry, choice_HDB_extension_data_policy); 243 if (ext == NULL) { 244 out->policy = strdup("default"); 245 /* It's OK if we retun NULL instead of "default" */ 246 } else { 247 out->policy = strdup(ext->data.u.policy); 248 if (out->policy == NULL) { 249 ret = ENOMEM; 250 goto out; 251 } 252 } 253 } 254 if(mask & KADM5_MAX_RLIFE) { 255 if(ent.entry.max_renew) 256 out->max_renewable_life = *ent.entry.max_renew; 257 else 258 out->max_renewable_life = INT_MAX; 259 } 260 if(mask & KADM5_KEY_DATA){ 261 size_t i; 262 size_t n_keys = ent.entry.keys.len; 263 krb5_salt salt; 264 HDB_extension *ext; 265 HDB_Ext_KeySet *hist_keys = NULL; 266 267 /* Don't return stale keys to kadm5 clients */ 268 ret = hdb_prune_keys(context->context, &ent.entry); 269 if (ret) 270 goto out; 271 ext = hdb_find_extension(&ent.entry, choice_HDB_extension_data_hist_keys); 272 if (ext != NULL) 273 hist_keys = &ext->data.u.hist_keys; 274 275 krb5_get_pw_salt(context->context, ent.entry.principal, &salt); 276 for (i = 0; hist_keys != NULL && i < hist_keys->len; i++) 277 n_keys += hist_keys->val[i].keys.len; 278 out->key_data = malloc(n_keys * sizeof(*out->key_data)); 279 if (out->key_data == NULL && n_keys != 0) { 280 ret = ENOMEM; 281 goto out; 282 } 283 out->n_key_data = 0; 284 ret = copy_keyset_to_kadm5(context, ent.entry.kvno, ent.entry.keys.len, 285 ent.entry.keys.val, &salt, out); 286 if (ret) 287 goto out; 288 for (i = 0; hist_keys != NULL && i < hist_keys->len; i++) { 289 ret = copy_keyset_to_kadm5(context, hist_keys->val[i].kvno, 290 hist_keys->val[i].keys.len, 291 hist_keys->val[i].keys.val, 292 &salt, out); 293 if (ret) 294 goto out; 295 } 296 krb5_free_salt(context->context, salt); 297 assert( out->n_key_data == n_keys ); 298 } 299 if (ret) 300 goto out; 301 if(mask & KADM5_TL_DATA) { 302 time_t last_pw_expire; 303 const HDB_Ext_PKINIT_acl *acl; 304 const HDB_Ext_Aliases *aliases; 305 306 ret = hdb_entry_get_pw_change_time(&ent.entry, &last_pw_expire); 307 if (ret == 0 && last_pw_expire) { 308 unsigned char buf[4]; 309 _krb5_put_int(buf, last_pw_expire, sizeof(buf)); 310 ret = add_tl_data(out, KRB5_TL_LAST_PWD_CHANGE, buf, sizeof(buf)); 311 } 312 if (ret) 313 goto out; 314 /* 315 * If the client was allowed to get key data, let it have the 316 * password too. 317 */ 318 if (mask & KADM5_KEY_DATA) { 319 heim_utf8_string pw; 320 321 ret = hdb_entry_get_password(context->context, 322 context->db, &ent.entry, &pw); 323 if (ret == 0) { 324 ret = add_tl_data(out, KRB5_TL_PASSWORD, pw, strlen(pw) + 1); 325 free(pw); 326 } 327 krb5_clear_error_message(context->context); 328 } 329 330 ret = hdb_entry_get_pkinit_acl(&ent.entry, &acl); 331 if (ret == 0 && acl) { 332 krb5_data buf; 333 size_t len; 334 335 ASN1_MALLOC_ENCODE(HDB_Ext_PKINIT_acl, buf.data, buf.length, 336 acl, &len, ret); 337 if (ret) 338 goto out; 339 if (len != buf.length) 340 krb5_abortx(context->context, 341 "internal ASN.1 encoder error"); 342 ret = add_tl_data(out, KRB5_TL_PKINIT_ACL, buf.data, buf.length); 343 free(buf.data); 344 if (ret) 345 goto out; 346 } 347 if (ret) 348 goto out; 349 350 ret = hdb_entry_get_aliases(&ent.entry, &aliases); 351 if (ret == 0 && aliases) { 352 krb5_data buf; 353 size_t len; 354 355 ASN1_MALLOC_ENCODE(HDB_Ext_Aliases, buf.data, buf.length, 356 aliases, &len, ret); 357 if (ret) 358 goto out; 359 if (len != buf.length) 360 krb5_abortx(context->context, 361 "internal ASN.1 encoder error"); 362 ret = add_tl_data(out, KRB5_TL_ALIASES, buf.data, buf.length); 363 free(buf.data); 364 if (ret) 365 goto out; 366 } 367 if (ret) 368 goto out; 369 } 370 371 out: 372 if (ret) 373 kadm5_free_principal_ent(context, out); 374 hdb_free_entry(context->context, &ent); 375 376 return _kadm5_error_code(ret); 377 } 378