lib/kadm5/set_keys.c

   1 /*
   2  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadm5_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 /*
  39  * Set the keys of `ent' to the string-to-key of `password'
  40  */
  41
  42 kadm5_ret_t
  43 _kadm5_set_keys(kadm5_server_context *context,
  44                 hdb_entry *ent,
  45                 int n_ks_tuple,
  46                 krb5_key_salt_tuple *ks_tuple,
  47                 const char *password)
  48 {
  49     Key *keys;
  50     size_t num_keys;
  51     kadm5_ret_t ret;
  52
  53     ret = hdb_generate_key_set_password(context->context,
  54                                         ent->principal,
  55                                         password,
  56                                         ks_tuple, n_ks_tuple,
  57                                         &keys, &num_keys);
  58     if (ret)
  59         return ret;
  60
  61     _kadm5_free_keys (context->context, ent->keys.len, ent->keys.val);
  62     ent->keys.val = keys;
  63     ent->keys.len = num_keys;
  64
  65     hdb_entry_set_pw_change_time(context->context, ent, 0);
  66
  67     if (krb5_config_get_bool_default(context->context, NULL, FALSE,
  68                                      "kadmin", "save-password", NULL))
  69     {
  70         ret = hdb_entry_set_password(context->context, context->db,
  71                                      ent, password);
  72         if (ret)
  73             return ret;
  74     }
  75
  76     return 0;
  77 }
  78
  79 static void
  80 setup_Key(Key *k, Salt *s, krb5_key_data *kd, size_t kd_offset)
  81 {
  82     memset(k, 0, sizeof (*k)); /* sets mkvno and salt */
  83     k->key.keytype = kd[kd_offset].key_data_type[0];
  84     k->key.keyvalue.length = kd[kd_offset].key_data_length[0];
  85     k->key.keyvalue.data = kd[kd_offset].key_data_contents[0];
  86
  87     if(kd[kd_offset].key_data_ver == 2) {
  88         memset(s, 0, sizeof (*s));
  89         s->type = kd[kd_offset].key_data_type[1];
  90         s->salt.length = kd[kd_offset].key_data_length[1];
  91         s->salt.data = kd[kd_offset].key_data_contents[1];
  92         k->salt = s;
  93     }
  94 }
  95
  96 /*
  97  * Set the keys of `ent' to (`n_key_data', `key_data')
  98  */
  99
 100 kadm5_ret_t
 101 _kadm5_set_keys2(kadm5_server_context *context,
 102                  hdb_entry *ent,
 103                  int16_t n_key_data,
 104                  krb5_key_data *key_data)
 105 {
 106     krb5_error_code ret;
 107     size_t i, k;
 108     HDB_extension ext;
 109     HDB_extension *extp = NULL;
 110     HDB_Ext_KeySet *hist_keys = &ext.data.u.hist_keys;
 111     Key key;
 112     Salt salt;
 113     Keys keys;
 114     hdb_keyset hkset;
 115     krb5_kvno kvno = -1;
 116     int one_key_set = 1;
 117     int replace_hist_keys = 0;
 118
 119     if (n_key_data == 0) {
 120         /* Clear all keys! */
 121         ret = hdb_clear_extension(context->context, ent,
 122                                   choice_HDB_extension_data_hist_keys);
 123         if (ret)
 124             return ret;
 125         free_Keys(&ent->keys);
 126         return 0;
 127     }
 128
 129     memset(&keys, 0, sizeof (keys));
 130     memset(&hkset, 0, sizeof (hkset)); /* set set_time */
 131     memset(&ext, 0, sizeof (ext));
 132     ext.data.element = choice_HDB_extension_data_hist_keys;
 133     memset(hist_keys, 0, sizeof (*hist_keys));
 134
 135     for (i = 0; i < n_key_data; i++) {
 136         if (kvno != -1 && kvno != key_data[i].key_data_kvno) {
 137             one_key_set = 0;
 138             break;
 139         }
 140         kvno = key_data[i].key_data_kvno;
 141     }
 142     if (one_key_set) {
 143         /*
 144          * If we're updating KADM5_KEY_DATA with a single keyset then we
 145          * assume we must be setting the principal's kvno as well!
 146          *
 147          * Just have to be careful about old clients that might have
 148          * sent 0 as the kvno...  This may seem ugly, but it's the price
 149          * of backwards compatibility with pre-multi-kvno kadmin clients
 150          * (besides, who's to say that updating KADM5_KEY_DATA requires
 151          * updating the entry's kvno?)
 152          *
 153          * Note that we do nothing special for the case where multiple
 154          * keysets are given but the entry's kvno is not set and not in
 155          * the given set of keysets.  If this happens we'll just update
 156          * the key history only and leave the current keyset alone.
 157          */
 158         if (kvno == 0) {
 159             /* Force kvno to 1 if it was 0; (ank would do this anyways) */
 160             if (ent->kvno == 0)
 161                 ent->kvno = 1;
 162             /* Below we need key_data[*].kvno to be reasonable */
 163             for (i = 0; i < n_key_data; i++)
 164                 key_data[i].key_data_kvno = ent->kvno;
 165         } else {
 166             /*
 167              * Or force the entry's kvno to match the one from the new,
 168              * singular keyset
 169              */
 170             ent->kvno = kvno;
 171         }
 172     }
 173
 174     for (i = 0; i < n_key_data; i++) {
 175         if (key_data[i].key_data_kvno == ent->kvno) {
 176             /* A current key; add to current key set */
 177             setup_Key(&key, &salt, key_data, i);
 178             ret = add_Keys(&keys, &key);
 179             continue;
 180         }
 181
 182         /*
 183          * This kvno is historical.  Build an hdb_keyset for keys of
 184          * this enctype and add them to the new key history.
 185          */
 186         for (k = 0; k < hist_keys->len; k++) {
 187             if (hist_keys->val[k].kvno == key_data[i].key_data_kvno)
 188                 break;
 189         }
 190         if (hist_keys->len > k &&
 191             hist_keys->val[k].kvno == key_data[i].key_data_kvno)
 192             /* We've added all keys of this kvno already (see below) */
 193             continue;
 194
 195         memset(&hkset, 0, sizeof (hkset)); /* set set_time */
 196         hkset.kvno = key_data[i].key_data_kvno;
 197         for (k = 0; k < n_key_data; k++) {
 198             /* Find all keys of this kvno and add them to the new keyset */
 199             if (key_data[k].key_data_kvno != hkset.kvno)
 200                 continue;
 201
 202             setup_Key(&key, &salt, key_data, k);
 203             ret = add_Keys(&hkset.keys, &key);
 204             if (ret)
 205                 goto out;
 206         }
 207         ret = add_HDB_Ext_KeySet(hist_keys, &hkset);
 208         if (ret)
 209             goto out;
 210         replace_hist_keys = 1;
 211     }
 212
 213     if (replace_hist_keys)
 214         /* No key history given -> leave it alone */
 215         extp = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
 216     if (extp != NULL) {
 217         HDB_Ext_KeySet *old_hist_keys;
 218
 219         /*
 220          * Try to keep the very useful set_time values from the old hist
 221          * keys.  kadm5 loses this info, so this heuristic is the best we
 222          * can do.
 223          */
 224         old_hist_keys = &extp->data.u.hist_keys;
 225         for (i = 0; i < old_hist_keys->len; i++) {
 226             if (old_hist_keys->val[i].set_time == NULL)
 227                 continue;
 228             for (k = 0; k < hist_keys->len; k++) {
 229                 if (hist_keys->val[k].kvno != old_hist_keys->val[k].kvno)
 230                     continue;
 231                 hist_keys->val[k].set_time = old_hist_keys->val[k].set_time;
 232                 old_hist_keys->val[k].set_time = NULL;
 233             }
 234         }
 235     }
 236
 237     if (replace_hist_keys) {
 238         /* If hist keys not given in key_data then don't blow away hist_keys */
 239         ret = hdb_replace_extension(context->context, ent, &ext);
 240         if (ret)
 241             goto out;
 242     }
 243
 244     /*
 245      * A structure copy is more efficient here than this would be:
 246      *
 247      * copy_Keys(&keys, &ent->keys);
 248      * free_Keys(&keys);
 249      *
 250      * Of course, the above hdb_replace_extension() is not at all efficient...
 251      */
 252     free_Keys(&ent->keys);
 253     ent->keys = keys;
 254     hdb_entry_set_pw_change_time(context->context, ent, 0);
 255     hdb_entry_clear_password(context->context, ent);
 256
 257     return 0;
 258
 259 out:
 260     free_Keys(&keys);
 261     free_hdb_keyset(&hkset);
 262     free_HDB_extension(&ext);
 263     return ret;
 264 }
 265
 266 /*
 267  * Set the keys of `ent' to `n_keys, keys'
 268  */
 269
 270 kadm5_ret_t
 271 _kadm5_set_keys3(kadm5_server_context *context,
 272                  hdb_entry *ent,
 273                  int n_keys,
 274                  krb5_keyblock *keyblocks)
 275 {
 276     krb5_error_code ret;
 277     int i;
 278     unsigned len;
 279     Key *keys;
 280
 281     len  = n_keys;
 282     keys = malloc (len * sizeof(*keys));
 283     if (keys == NULL && len != 0)
 284         return ENOMEM;
 285
 286     _kadm5_init_keys (keys, len);
 287
 288     for(i = 0; i < n_keys; i++) {
 289         keys[i].mkvno = NULL;
 290         ret = krb5_copy_keyblock_contents (context->context,
 291                                            &keyblocks[i],
 292                                            &keys[i].key);
 293         if(ret)
 294             goto out;
 295         keys[i].salt = NULL;
 296     }
 297     _kadm5_free_keys (context->context, ent->keys.len, ent->keys.val);
 298     ent->keys.len = len;
 299     ent->keys.val = keys;
 300
 301     hdb_entry_set_pw_change_time(context->context, ent, 0);
 302     hdb_entry_clear_password(context->context, ent);
 303
 304     return 0;
 305  out:
 306     _kadm5_free_keys (context->context, len, keys);
 307     return ret;
 308 }
 309
 310 /*
 311  *
 312  */
 313
 314 static int
 315 is_des_key_p(int keytype)
 316 {
 317     return keytype == ETYPE_DES_CBC_CRC ||
 318         keytype == ETYPE_DES_CBC_MD4 ||
 319         keytype == ETYPE_DES_CBC_MD5;
 320 }
 321
 322
 323 /*
 324  * Set the keys of `ent' to random keys and return them in `n_keys'
 325  * and `new_keys'.
 326  */
 327
 328 kadm5_ret_t
 329 _kadm5_set_keys_randomly (kadm5_server_context *context,
 330                           hdb_entry *ent,
 331                           int n_ks_tuple,
 332                           krb5_key_salt_tuple *ks_tuple,
 333                           krb5_keyblock **new_keys,
 334                           int *n_keys)
 335 {
 336    krb5_keyblock *kblock = NULL;
 337    kadm5_ret_t ret = 0;
 338    int des_keyblock;
 339    size_t i, num_keys;
 340    Key *keys;
 341
 342    ret = hdb_generate_key_set(context->context, ent->principal,
 343                               ks_tuple, n_ks_tuple, &keys, &num_keys, 1);
 344    if (ret)
 345         return ret;
 346
 347    kblock = malloc(num_keys * sizeof(kblock[0]));
 348    if (kblock == NULL) {
 349         ret = ENOMEM;
 350         _kadm5_free_keys (context->context, num_keys, keys);
 351         return ret;
 352    }
 353    memset(kblock, 0, num_keys * sizeof(kblock[0]));
 354
 355    des_keyblock = -1;
 356    for (i = 0; i < num_keys; i++) {
 357
 358         /*
 359          * To make sure all des keys are the the same we generate only
 360          * the first one and then copy key to all other des keys.
 361          */
 362
 363         if (des_keyblock != -1 && is_des_key_p(keys[i].key.keytype)) {
 364             ret = krb5_copy_keyblock_contents (context->context,
 365                                                &kblock[des_keyblock],
 366                                                &kblock[i]);
 367             if (ret)
 368                 goto out;
 369             kblock[i].keytype = keys[i].key.keytype;
 370         } else {
 371             ret = krb5_generate_random_keyblock (context->context,
 372                                                  keys[i].key.keytype,
 373                                                  &kblock[i]);
 374             if (ret)
 375                 goto out;
 376
 377             if (is_des_key_p(keys[i].key.keytype))
 378                 des_keyblock = i;
 379         }
 380
 381         ret = krb5_copy_keyblock_contents (context->context,
 382                                            &kblock[i],
 383                                            &keys[i].key);
 384         if (ret)
 385             goto out;
 386    }
 387
 388 out:
 389    if(ret) {
 390         for (i = 0; i < num_keys; ++i)
 391             krb5_free_keyblock_contents (context->context, &kblock[i]);
 392         free(kblock);
 393         _kadm5_free_keys (context->context, num_keys, keys);
 394         return ret;
 395    }
 396
 397    _kadm5_free_keys (context->context, ent->keys.len, ent->keys.val);
 398    ent->keys.val = keys;
 399    ent->keys.len = num_keys;
 400    if (n_keys && new_keys) {
 401        *new_keys     = kblock;
 402        *n_keys       = num_keys;
 403    }
 404
 405    hdb_entry_set_pw_change_time(context->context, ent, 0);
 406    hdb_entry_clear_password(context->context, ent);
 407
 408    return 0;
 409 }