2 * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadm5_locl.h"
36 RCSID("$Id: set_keys.c,v 1.25 2001/08/13 15:12:16 joda Exp $");
39 * the known and used DES enctypes
42 static krb5_enctype des_types
[] = { ETYPE_DES_CBC_CRC
,
45 static unsigned n_des_types
= sizeof(des_types
) / sizeof(des_types
[0]);
47 static krb5_error_code
48 make_keys(krb5_context context
, krb5_principal principal
, const char *password
,
49 Key
**keys_ret
, size_t *num_keys_ret
)
51 krb5_enctype all_etypes
[] = { ETYPE_DES3_CBC_SHA1
,
59 krb5_error_code ret
= 0;
62 Key
*keys
= NULL
, *tmp
;
67 char *v4_ktypes
[] = {"des3:pw-salt", "v4", NULL
};
69 ktypes
= krb5_config_get_strings(context
, NULL
, "kadmin",
70 "default_keys", NULL
);
72 /* for each entry in `default_keys' try to parse it as a sequence
73 of etype:salttype:salt, syntax of this if something like:
74 [(des|des3|etype):](pw|afs3)[:string], if etype is omitted it
75 means all etypes, and if string is omitted is means the default
76 string (for that principal). Additional special values:
79 afs or afs3 == des:afs3-salt
83 && krb5_config_get_bool (context
, NULL
, "kadmin",
87 for(kp
= ktypes
; kp
&& *kp
; kp
++) {
91 krb5_boolean salt_set
;
98 if(strcmp(p
, "v5") == 0)
100 else if(strcmp(p
, "v4") == 0)
102 else if(strcmp(p
, "afs") == 0 || strcmp(p
, "afs3") == 0)
105 /* split p in a list of :-separated strings */
106 for(num_buf
= 0; num_buf
< 3; num_buf
++)
107 if(strsep_copy(&p
, ":", buf
[num_buf
], sizeof(buf
[num_buf
])) == -1)
112 memset(&salt
, 0, sizeof(salt
));
115 for(i
= 0; i
< num_buf
; i
++) {
117 /* this might be a etype specifier */
118 /* XXX there should be a string_to_etypes handling
119 special cases like `des' and `all' */
120 if(strcmp(buf
[i
], "des") == 0) {
121 etypes
= all_etypes
+ 1;
124 } else if(strcmp(buf
[i
], "des3") == 0) {
125 e
= ETYPE_DES3_CBC_SHA1
;
130 ret
= krb5_string_to_enctype(context
, buf
[i
], &e
);
138 if(salt
.salttype
== 0) {
139 /* interpret string as a salt specifier, if no etype
140 is set, this sets default values */
141 /* XXX should perhaps use string_to_salttype, but that
143 if(strcmp(buf
[i
], "pw-salt") == 0) {
148 salt
.salttype
= KRB5_PW_SALT
;
149 } else if(strcmp(buf
[i
], "afs3-salt") == 0) {
151 etypes
= all_etypes
+ 1;
154 salt
.salttype
= KRB5_AFS3_SALT
;
157 /* if there is a final string, use it as the string to
158 salt with, this is mostly useful with null salt for
159 v4 compat, and a cell name for afs compat */
160 salt
.saltvalue
.data
= buf
[i
];
161 salt
.saltvalue
.length
= strlen(buf
[i
]);
166 if(etypes
== NULL
|| salt
.salttype
== 0) {
167 krb5_warnx(context
, "bad value for default_keys `%s'", *kp
);
172 /* make up default salt */
173 if(salt
.salttype
== KRB5_PW_SALT
)
174 ret
= krb5_get_pw_salt(context
, principal
, &salt
);
175 else if(salt
.salttype
== KRB5_AFS3_SALT
) {
176 krb5_realm
*realm
= krb5_princ_realm(context
, principal
);
177 salt
.saltvalue
.data
= strdup(*realm
);
178 if(salt
.saltvalue
.data
== NULL
) {
179 krb5_set_error_string(context
, "out of memory while "
180 "parsinig salt specifiers");
184 strlwr(salt
.saltvalue
.data
);
185 salt
.saltvalue
.length
= strlen(*realm
);
189 memset(&key
, 0, sizeof(key
));
190 for(i
= 0; i
< num_etypes
; i
++) {
192 for(k
= keys
; k
< keys
+ num_keys
; k
++) {
193 if(k
->key
.keytype
== etypes
[i
] &&
195 k
->salt
->type
== salt
.salttype
&&
196 k
->salt
->salt
.length
== salt
.saltvalue
.length
&&
197 memcmp(k
->salt
->salt
.data
, salt
.saltvalue
.data
,
198 salt
.saltvalue
.length
) == 0) ||
200 salt
.salttype
== KRB5_PW_SALT
&&
205 ret
= krb5_string_to_key_salt (context
,
214 if (salt
.salttype
!= KRB5_PW_SALT
|| salt_set
) {
215 key
.salt
= malloc (sizeof(*key
.salt
));
216 if (key
.salt
== NULL
) {
221 key
.salt
->type
= salt
.salttype
;
222 krb5_data_zero (&key
.salt
->salt
);
224 /* is the salt has not been set explicitly, it will be
225 the default salt, so there's no need to explicitly
228 ret
= krb5_data_copy(&key
.salt
->salt
,
230 salt
.saltvalue
.length
);
237 tmp
= realloc(keys
, (num_keys
+ 1) * sizeof(*keys
));
244 keys
[num_keys
++] = key
;
250 /* if we didn't manage to find a single valid key, create a
252 /* XXX only do this is there is no `default_keys'? */
254 tmp
= realloc(keys
, (num_keys
+ 4) * sizeof(*keys
));
260 ret
= krb5_get_pw_salt(context
, principal
, &v5_salt
);
263 for(i
= 0; i
< 4; i
++) {
264 memset(&key
, 0, sizeof(key
));
265 ret
= krb5_string_to_key_salt(context
, all_etypes
[i
], password
,
268 krb5_free_salt(context
, v5_salt
);
271 keys
[num_keys
++] = key
;
273 krb5_free_salt(context
, v5_salt
);
279 *num_keys_ret
= num_keys
;
281 for(i
= 0; i
< num_keys
; i
++) {
290 * Set the keys of `ent' to the string-to-key of `password'
294 _kadm5_set_keys(kadm5_server_context
*context
,
296 const char *password
)
302 ret
= make_keys(context
->context
, ent
->principal
, password
,
308 _kadm5_free_keys (context
, ent
->keys
.len
, ent
->keys
.val
);
309 ent
->keys
.val
= keys
;
310 ent
->keys
.len
= num_keys
;
316 * Set the keys of `ent' to (`n_key_data', `key_data')
320 _kadm5_set_keys2(kadm5_server_context
*context
,
323 krb5_key_data
*key_data
)
331 keys
= malloc (len
* sizeof(*keys
));
335 _kadm5_init_keys (keys
, len
);
337 for(i
= 0; i
< n_key_data
; i
++) {
338 keys
[i
].mkvno
= NULL
;
339 keys
[i
].key
.keytype
= key_data
[i
].key_data_type
[0];
340 ret
= krb5_data_copy(&keys
[i
].key
.keyvalue
,
341 key_data
[i
].key_data_contents
[0],
342 key_data
[i
].key_data_length
[0]);
345 if(key_data
[i
].key_data_ver
== 2) {
348 salt
= malloc(sizeof(*salt
));
354 salt
->type
= key_data
[i
].key_data_type
[1];
355 krb5_data_copy(&salt
->salt
,
356 key_data
[i
].key_data_contents
[1],
357 key_data
[i
].key_data_length
[1]);
361 _kadm5_free_keys (context
, ent
->keys
.len
, ent
->keys
.val
);
363 ent
->keys
.val
= keys
;
367 _kadm5_free_keys (context
, len
, keys
);
372 * Set the keys of `ent' to `n_keys, keys'
376 _kadm5_set_keys3(kadm5_server_context
*context
,
379 krb5_keyblock
*keyblocks
)
387 keys
= malloc (len
* sizeof(*keys
));
391 _kadm5_init_keys (keys
, len
);
393 for(i
= 0; i
< n_keys
; i
++) {
394 keys
[i
].mkvno
= NULL
;
395 ret
= krb5_copy_keyblock_contents (context
->context
,
402 _kadm5_free_keys (context
, ent
->keys
.len
, ent
->keys
.val
);
404 ent
->keys
.val
= keys
;
408 _kadm5_free_keys (context
, len
, keys
);
413 * Set the keys of `ent' to random keys and return them in `n_keys'
418 _kadm5_set_keys_randomly (kadm5_server_context
*context
,
420 krb5_keyblock
**new_keys
,
429 len
= n_des_types
+ 1;
430 keys
= malloc (len
* sizeof(*keys
));
434 for (i
= 0; i
< len
; ++i
) {
435 keys
[i
].keyvalue
.length
= 0;
436 keys
[i
].keyvalue
.data
= NULL
;
439 hkeys
= malloc (len
* sizeof(*hkeys
));
445 _kadm5_init_keys (hkeys
, len
);
447 ret
= krb5_generate_random_keyblock (context
->context
,
453 ret
= krb5_copy_keyblock_contents (context
->context
,
459 for (i
= 1; i
< n_des_types
; ++i
) {
460 ret
= krb5_copy_keyblock_contents (context
->context
,
465 keys
[i
].keytype
= des_types
[i
];
466 ret
= krb5_copy_keyblock_contents (context
->context
,
471 hkeys
[i
].key
.keytype
= des_types
[i
];
474 ret
= krb5_generate_random_keyblock (context
->context
,
480 ret
= krb5_copy_keyblock_contents (context
->context
,
482 &hkeys
[n_des_types
].key
);
486 _kadm5_free_keys (context
, ent
->keys
.len
, ent
->keys
.val
);
488 ent
->keys
.val
= hkeys
;
494 for (i
= 0; i
< len
; ++i
)
495 krb5_free_keyblock_contents (context
->context
, &keys
[i
]);
497 _kadm5_free_keys (context
, len
, hkeys
);