kadmin/util.c

   1 /*
   2  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <parse_units.h>
  36
  37 /*
  38  * util.c - functions for parsing, unparsing, and editing different
  39  * types of data used in kadmin.
  40  */
  41
  42 static int
  43 get_response(const char *prompt, const char *def, char *buf, size_t len);
  44
  45 /*
  46  * attributes
  47  */
  48
  49 struct units kdb_attrs[] = {
  50     { "disallow-client",        KRB5_KDB_DISALLOW_CLIENT },
  51     { "virtual",                KRB5_KDB_VIRTUAL },
  52     { "virtual-keys",           KRB5_KDB_VIRTUAL_KEYS },
  53     { "materialize",            KRB5_KDB_MATERIALIZE },
  54     { "allow-digest",           KRB5_KDB_ALLOW_DIGEST },
  55     { "allow-kerberos4",        KRB5_KDB_ALLOW_KERBEROS4 },
  56     { "trusted-for-delegation", KRB5_KDB_TRUSTED_FOR_DELEGATION },
  57     { "ok-as-delegate",         KRB5_KDB_OK_AS_DELEGATE },
  58     { "new-princ",              KRB5_KDB_NEW_PRINC },
  59     { "support-desmd5",         KRB5_KDB_SUPPORT_DESMD5 },
  60     { "pwchange-service",       KRB5_KDB_PWCHANGE_SERVICE },
  61     { "disallow-svr",           KRB5_KDB_DISALLOW_SVR },
  62     { "requires-pw-change",     KRB5_KDB_REQUIRES_PWCHANGE },
  63     { "requires-hw-auth",       KRB5_KDB_REQUIRES_HW_AUTH },
  64     { "requires-pre-auth",      KRB5_KDB_REQUIRES_PRE_AUTH },
  65     { "disallow-all-tix",       KRB5_KDB_DISALLOW_ALL_TIX },
  66     { "disallow-dup-skey",      KRB5_KDB_DISALLOW_DUP_SKEY },
  67     { "disallow-proxiable",     KRB5_KDB_DISALLOW_PROXIABLE },
  68     { "disallow-renewable",     KRB5_KDB_DISALLOW_RENEWABLE },
  69     { "disallow-tgt-based",     KRB5_KDB_DISALLOW_TGT_BASED },
  70     { "disallow-forwardable",   KRB5_KDB_DISALLOW_FORWARDABLE },
  71     { "disallow-postdated",     KRB5_KDB_DISALLOW_POSTDATED },
  72     { "no-auth-data-reqd",      KRB5_KDB_NO_AUTH_DATA_REQUIRED },
  73     { NULL, 0 }
  74 };
  75
  76 /*
  77  * convert the attributes in `attributes' into a printable string
  78  * in `str, len'
  79  */
  80
  81 void
  82 attributes2str(krb5_flags attributes, char *str, size_t len)
  83 {
  84     unparse_flags (attributes, kdb_attrs, str, len);
  85 }
  86
  87 /*
  88  * convert the string in `str' into attributes in `flags'
  89  * return 0 if parsed ok, else -1.
  90  */
  91
  92 int
  93 str2attributes(const char *str, krb5_flags *flags)
  94 {
  95     int res;
  96
  97     res = parse_flags (str, kdb_attrs, *flags);
  98     if (res < 0)
  99         return res;
 100     else {
 101         *flags = res;
 102         return 0;
 103     }
 104 }
 105
 106 /*
 107  * try to parse the string `resp' into attributes in `attr', also
 108  * setting the `bit' in `mask' if attributes are given and valid.
 109  */
 110
 111 int
 112 parse_attributes (const char *resp, krb5_flags *attr, int *mask, int bit)
 113 {
 114     krb5_flags tmp = *attr;
 115
 116     if (str2attributes(resp, &tmp) == 0) {
 117         *attr = tmp;
 118         if (mask)
 119             *mask |= bit;
 120         return 0;
 121     } else if(*resp == '?') {
 122         print_flags_table (kdb_attrs, stderr);
 123     } else {
 124         fprintf (stderr, "Unable to parse \"%s\"\n", resp);
 125     }
 126     return -1;
 127 }
 128
 129 /*
 130  * allow the user to edit the attributes in `attr', prompting with `prompt'
 131  */
 132
 133 int
 134 edit_attributes (const char *prompt, krb5_flags *attr, int *mask, int bit)
 135 {
 136     char buf[1024], resp[1024];
 137
 138     if (mask && (*mask & bit))
 139         return 0;
 140
 141     attributes2str(*attr, buf, sizeof(buf));
 142     for (;;) {
 143         if(get_response("Attributes", buf, resp, sizeof(resp)) != 0)
 144             return 1;
 145         if (resp[0] == '\0')
 146             break;
 147         if (parse_attributes (resp, attr, mask, bit) == 0)
 148             break;
 149     }
 150     return 0;
 151 }
 152
 153 /*
 154  * try to parse the string `resp' into policy in `attr', also
 155  * setting the `bit' in `mask' if attributes are given and valid.
 156  */
 157
 158 #define VALID_POLICY_NAME_CHARS \
 159         "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_"
 160
 161 int
 162 parse_policy (const char *resp, char **policy, int *mask, int bit)
 163 {
 164     if (strspn(resp, VALID_POLICY_NAME_CHARS) == strlen(resp) &&
 165         *resp != '\0') {
 166
 167         *policy = strdup(resp);
 168         if (*policy == NULL) {
 169             fprintf (stderr, "Out of memory");
 170             return -1;
 171         }
 172         if (mask)
 173             *mask |= bit;
 174         return 0;
 175     } else if(*resp == '?') {
 176         print_flags_table (kdb_attrs, stderr);
 177     } else {
 178         fprintf (stderr, "Unable to parse \"%s\"\n", resp);
 179     }
 180     return -1;
 181 }
 182
 183 /*
 184  * allow the user to edit the attributes in `attr', prompting with `prompt'
 185  */
 186
 187 int
 188 edit_policy (const char *prompt, char **policy, int *mask, int bit)
 189 {
 190     char buf[1024], resp[1024];
 191
 192     if (mask && (*mask & bit))
 193         return 0;
 194
 195     buf[0] = '\0';
 196     strlcpy(buf, "default", sizeof (buf));
 197     for (;;) {
 198         if(get_response("Policy", buf, resp, sizeof(resp)) != 0)
 199             return 1;
 200         if (resp[0] == '\0')
 201             break;
 202         if (parse_policy (resp, policy, mask, bit) == 0)
 203             break;
 204     }
 205     return 0;
 206 }
 207
 208 /*
 209  * time_t
 210  * the special value 0 means ``never''
 211  */
 212
 213 /*
 214  * Convert the time `t' to a string representation in `str' (of max
 215  * size `len').  If include_time also include time, otherwise just
 216  * date.
 217  */
 218
 219 void
 220 time_t2str(time_t t, char *str, size_t len, int include_time)
 221 {
 222     if(t) {
 223         if(include_time)
 224             strftime(str, len, "%Y-%m-%d %H:%M:%S UTC", gmtime(&t));
 225         else
 226             strftime(str, len, "%Y-%m-%d", gmtime(&t));
 227     } else
 228         snprintf(str, len, "never");
 229 }
 230
 231 /*
 232  * Convert the time representation in `str' to a time in `time'.
 233  * Return 0 if succesful, else -1.
 234  */
 235
 236 int
 237 str2time_t (const char *str, time_t *t)
 238 {
 239     const char *p;
 240     struct tm tm, tm2;
 241
 242     memset (&tm, 0, sizeof (tm));
 243     memset (&tm2, 0, sizeof (tm2));
 244
 245     while(isspace((unsigned char)*str))
 246         str++;
 247
 248     if (str[0] == '+') {
 249         str++;
 250         *t = parse_time(str, "month");
 251         if (*t < 0)
 252             return -1;
 253         *t += time(NULL);
 254         return 0;
 255     }
 256     if (str[0] == '-') {
 257         str++;
 258         *t = parse_time(str, "month");
 259         if (*t < 0)
 260             return -1;
 261         *t = time(NULL) - *t;
 262         return 0;
 263     }
 264
 265     if(strcasecmp(str, "never") == 0) {
 266         *t = 0;
 267         return 0;
 268     }
 269
 270     if(strcasecmp(str, "now") == 0) {
 271         *t = time(NULL);
 272         return 0;
 273     }
 274
 275     p = strptime (str, "%Y-%m-%d", &tm);
 276
 277     if (p == NULL)
 278         return -1;
 279
 280     while(isspace((unsigned char)*p))
 281         p++;
 282
 283     /* XXX this is really a bit optimistic, we should really complain
 284        if there was a problem parsing the time */
 285     if(p[0] != '\0' && strptime (p, "%H:%M:%S", &tm2) != NULL) {
 286         tm.tm_hour = tm2.tm_hour;
 287         tm.tm_min  = tm2.tm_min;
 288         tm.tm_sec  = tm2.tm_sec;
 289     } else {
 290         /* Do it on the end of the day */
 291         tm.tm_hour = 23;
 292         tm.tm_min  = 59;
 293         tm.tm_sec  = 59;
 294     }
 295
 296     *t = tm2time (tm, 0);
 297     return 0;
 298 }
 299
 300 /*
 301  * try to parse the time in `resp' storing it in `value'
 302  */
 303
 304 int
 305 parse_timet (const char *resp, krb5_timestamp *value, int *mask, int bit)
 306 {
 307     time_t tmp;
 308
 309     if (str2time_t(resp, &tmp) == 0) {
 310         *value = tmp;
 311         if(mask)
 312             *mask |= bit;
 313         return 0;
 314     }
 315     if(*resp != '?')
 316         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 317     fprintf (stderr, "Print date on format YYYY-mm-dd [hh:mm:ss]\n");
 318     return -1;
 319 }
 320
 321 /*
 322  * allow the user to edit the time in `value'
 323  */
 324
 325 int
 326 edit_timet (const char *prompt, krb5_timestamp *value, int *mask, int bit)
 327 {
 328     char buf[1024], resp[1024];
 329
 330     if (mask && (*mask & bit))
 331         return 0;
 332
 333     time_t2str (*value, buf, sizeof (buf), 0);
 334
 335     for (;;) {
 336         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 337             return 1;
 338         if (parse_timet (resp, value, mask, bit) == 0)
 339             break;
 340     }
 341     return 0;
 342 }
 343
 344 /*
 345  * deltat
 346  * the special value 0 means ``unlimited''
 347  */
 348
 349 /*
 350  * convert the delta_t value in `t' into a printable form in `str, len'
 351  */
 352
 353 void
 354 deltat2str(unsigned t, char *str, size_t len)
 355 {
 356     if(t == 0 || t == INT_MAX)
 357         snprintf(str, len, "unlimited");
 358     else
 359         unparse_time(t, str, len);
 360 }
 361
 362 /*
 363  * parse the delta value in `str', storing result in `*delta'
 364  * return 0 if ok, else -1
 365  */
 366
 367 int
 368 str2deltat(const char *str, krb5_deltat *delta)
 369 {
 370     int res;
 371
 372     if(strcasecmp(str, "unlimited") == 0) {
 373         *delta = 0;
 374         return 0;
 375     }
 376     res = parse_time(str, "day");
 377     if (res < 0)
 378         return res;
 379     else {
 380         *delta = res;
 381         return 0;
 382     }
 383 }
 384
 385 /*
 386  * try to parse the string in `resp' into a deltad in `value'
 387  * `mask' will get the bit `bit' set if a value was given.
 388  */
 389
 390 int
 391 parse_deltat (const char *resp, krb5_deltat *value, int *mask, int bit)
 392 {
 393     krb5_deltat tmp;
 394
 395     if (str2deltat(resp, &tmp) == 0) {
 396         *value = tmp;
 397         if (mask)
 398             *mask |= bit;
 399         return 0;
 400     } else if(*resp == '?') {
 401         print_time_table (stderr);
 402     } else {
 403         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 404     }
 405     return -1;
 406 }
 407
 408 /*
 409  * allow the user to edit the deltat in `value'
 410  */
 411
 412 int
 413 edit_deltat (const char *prompt, krb5_deltat *value, int *mask, int bit)
 414 {
 415     char buf[1024], resp[1024];
 416
 417     if (mask && (*mask & bit))
 418         return 0;
 419
 420     deltat2str(*value, buf, sizeof(buf));
 421     for (;;) {
 422         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 423             return 1;
 424         if (parse_deltat (resp, value, mask, bit) == 0)
 425             break;
 426     }
 427     return 0;
 428 }
 429
 430 /*
 431  * allow the user to edit `ent'
 432  */
 433
 434 void
 435 set_defaults(kadm5_principal_ent_t ent, int *mask,
 436              kadm5_principal_ent_t default_ent, int default_mask)
 437 {
 438     if (default_ent
 439         && (default_mask & KADM5_MAX_LIFE)
 440         && !(*mask & KADM5_MAX_LIFE))
 441         ent->max_life = default_ent->max_life;
 442
 443     if (default_ent
 444         && (default_mask & KADM5_MAX_RLIFE)
 445         && !(*mask & KADM5_MAX_RLIFE))
 446         ent->max_renewable_life = default_ent->max_renewable_life;
 447
 448     if (default_ent
 449         && (default_mask & KADM5_PRINC_EXPIRE_TIME)
 450         && !(*mask & KADM5_PRINC_EXPIRE_TIME))
 451         ent->princ_expire_time = default_ent->princ_expire_time;
 452
 453     if (default_ent
 454         && (default_mask & KADM5_PW_EXPIRATION)
 455         && !(*mask & KADM5_PW_EXPIRATION))
 456         ent->pw_expiration = default_ent->pw_expiration;
 457
 458     if (default_ent
 459         && (default_mask & KADM5_ATTRIBUTES)
 460         && !(*mask & KADM5_ATTRIBUTES))
 461         ent->attributes = default_ent->attributes & ~KRB5_KDB_DISALLOW_ALL_TIX;
 462
 463     if (default_ent
 464         && (default_mask & KADM5_POLICY)
 465         && !(*mask & KADM5_POLICY)) {
 466         ent->policy = strdup(default_ent->policy);
 467         if (ent->policy == NULL)
 468             abort();
 469     }
 470 }
 471
 472 int
 473 edit_entry(kadm5_principal_ent_t ent, int *mask,
 474            kadm5_principal_ent_t default_ent, int default_mask)
 475 {
 476
 477     set_defaults(ent, mask, default_ent, default_mask);
 478
 479     if(edit_deltat ("Max ticket life", &ent->max_life, mask,
 480                     KADM5_MAX_LIFE) != 0)
 481         return 1;
 482
 483     if(edit_deltat ("Max renewable life", &ent->max_renewable_life, mask,
 484                     KADM5_MAX_RLIFE) != 0)
 485         return 1;
 486
 487     if(edit_timet ("Principal expiration time", &ent->princ_expire_time, mask,
 488                    KADM5_PRINC_EXPIRE_TIME) != 0)
 489         return 1;
 490
 491     if(edit_timet ("Password expiration time", &ent->pw_expiration, mask,
 492                    KADM5_PW_EXPIRATION) != 0)
 493         return 1;
 494
 495     if(edit_attributes ("Attributes", &ent->attributes, mask,
 496                         KADM5_ATTRIBUTES) != 0)
 497         return 1;
 498
 499     if(edit_policy ("Policy", &ent->policy, mask,
 500                         KADM5_POLICY) != 0)
 501         return 1;
 502
 503     return 0;
 504 }
 505
 506 /*
 507  * Parse the arguments, set the fields in `ent' and the `mask' for the
 508  * entries having been set.
 509  * Return 1 on failure and 0 on success.
 510  */
 511
 512 int
 513 set_entry(krb5_context contextp,
 514           kadm5_principal_ent_t ent,
 515           int *mask,
 516           const char *max_ticket_life,
 517           const char *max_renewable_life,
 518           const char *expiration,
 519           const char *pw_expiration,
 520           const char *attributes,
 521           const char *policy)
 522 {
 523     if (max_ticket_life != NULL) {
 524         if (parse_deltat (max_ticket_life, &ent->max_life,
 525                           mask, KADM5_MAX_LIFE)) {
 526             krb5_warnx (contextp, "unable to parse `%s'", max_ticket_life);
 527             return 1;
 528         }
 529     }
 530     if (max_renewable_life != NULL) {
 531         if (parse_deltat (max_renewable_life, &ent->max_renewable_life,
 532                           mask, KADM5_MAX_RLIFE)) {
 533             krb5_warnx (contextp, "unable to parse `%s'", max_renewable_life);
 534             return 1;
 535         }
 536     }
 537
 538     if (expiration) {
 539         if (parse_timet (expiration, &ent->princ_expire_time,
 540                         mask, KADM5_PRINC_EXPIRE_TIME)) {
 541             krb5_warnx (contextp, "unable to parse `%s'", expiration);
 542             return 1;
 543         }
 544     }
 545     if (pw_expiration) {
 546         if (parse_timet (pw_expiration, &ent->pw_expiration,
 547                          mask, KADM5_PW_EXPIRATION)) {
 548             krb5_warnx (contextp, "unable to parse `%s'", pw_expiration);
 549             return 1;
 550         }
 551     }
 552     if (attributes != NULL) {
 553         if (parse_attributes (attributes, &ent->attributes,
 554                               mask, KADM5_ATTRIBUTES)) {
 555             krb5_warnx (contextp, "unable to parse `%s'", attributes);
 556             return 1;
 557         }
 558     }
 559     if (policy != NULL) {
 560         if (parse_policy (policy, &ent->policy,
 561                               mask, KADM5_POLICY)) {
 562             krb5_warnx (contextp, "unable to parse `%s'", attributes);
 563             return 1;
 564         }
 565     }
 566     return 0;
 567 }
 568
 569 /*
 570  * Does `string' contain any globing characters?
 571  */
 572
 573 static int
 574 is_expression(const char *string)
 575 {
 576     const char *p;
 577     int quote = 0;
 578
 579     for(p = string; *p; p++) {
 580         if(quote) {
 581             quote = 0;
 582             continue;
 583         }
 584         if(*p == '\\')
 585             quote++;
 586         else if(strchr("[]*?", *p) != NULL)
 587             return 1;
 588     }
 589     return 0;
 590 }
 591
 592 /*
 593  * Loop over all principals matching exp.  If any of calls to `func'
 594  * failes, the first error is returned when all principals are
 595  * processed.
 596  */
 597 int
 598 foreach_principal(const char *exp_str,
 599                   int (*func)(krb5_principal, void*),
 600                   const char *funcname,
 601                   void *data)
 602 {
 603     char **princs = NULL;
 604     int num_princs = 0;
 605     int i;
 606     krb5_error_code saved_ret = 0, ret = 0;
 607     krb5_principal princ_ent;
 608     int is_expr;
 609
 610     /* if this isn't an expression, there is no point in wading
 611        through the whole database looking for matches */
 612     is_expr = is_expression(exp_str);
 613     if(is_expr)
 614         ret = kadm5_get_principals(kadm_handle, exp_str, &princs, &num_princs);
 615     if(!is_expr || ret == KADM5_AUTH_LIST) {
 616         /* we might be able to perform the requested opreration even
 617            if we're not allowed to list principals */
 618         num_princs = 1;
 619         princs = malloc(sizeof(*princs));
 620         if(princs == NULL)
 621             return ENOMEM;
 622         princs[0] = strdup(exp_str);
 623         if(princs[0] == NULL){
 624             free(princs);
 625             return ENOMEM;
 626         }
 627     } else if(ret) {
 628         krb5_warn(context, ret, "kadm5_get_principals");
 629         return ret;
 630     }
 631     for(i = 0; i < num_princs; i++) {
 632         ret = krb5_parse_name(context, princs[i], &princ_ent);
 633         if(ret){
 634             krb5_warn(context, ret, "krb5_parse_name(%s)", princs[i]);
 635             continue;
 636         }
 637         ret = (*func)(princ_ent, data);
 638         if(ret) {
 639             krb5_warn(context, ret, "%s %s", funcname, princs[i]);
 640             krb5_clear_error_message(context);
 641             if (saved_ret == 0)
 642                 saved_ret = ret;
 643         }
 644         krb5_free_principal(context, princ_ent);
 645     }
 646     if (ret == 0 && saved_ret != 0)
 647         ret = saved_ret;
 648     kadm5_free_name_list(kadm_handle, princs, &num_princs);
 649     return ret;
 650 }
 651
 652 /*
 653  * prompt with `prompt' and default value `def', and store the reply
 654  * in `buf, len'
 655  */
 656
 657 #include <setjmp.h>
 658
 659 static jmp_buf jmpbuf;
 660
 661 static void
 662 interrupt(int sig)
 663 {
 664     longjmp(jmpbuf, 1);
 665 }
 666
 667 static int
 668 get_response(const char *prompt, const char *def, char *buf, size_t len)
 669 {
 670     char *p;
 671     void (*osig)(int);
 672
 673     osig = signal(SIGINT, interrupt);
 674     if(setjmp(jmpbuf)) {
 675         signal(SIGINT, osig);
 676         fprintf(stderr, "\n");
 677         return 1;
 678     }
 679
 680     fprintf(stderr, "%s [%s]:", prompt, def);
 681     if(fgets(buf, len, stdin) == NULL) {
 682         int save_errno = errno;
 683         if(ferror(stdin))
 684             krb5_err(context, 1, save_errno, "<stdin>");
 685         signal(SIGINT, osig);
 686         return 1;
 687     }
 688     p = strchr(buf, '\n');
 689     if(p)
 690         *p = '\0';
 691     if(strcmp(buf, "") == 0)
 692         strlcpy(buf, def, len);
 693     signal(SIGINT, osig);
 694     return 0;
 695 }
 696
 697 /*
 698  * return [0, 16) or -1
 699  */
 700
 701 static int
 702 hex2n (char c)
 703 {
 704     static char hexdigits[] = "0123456789abcdef";
 705     const char *p;
 706
 707     p = strchr (hexdigits, tolower((unsigned char)c));
 708     if (p == NULL)
 709         return -1;
 710     else
 711         return p - hexdigits;
 712 }
 713
 714 /*
 715  * convert a key in a readable format into a keyblock.
 716  * return 0 iff succesful, otherwise `err' should point to an error message
 717  */
 718
 719 int
 720 parse_des_key (const char *key_string, krb5_key_data *key_data,
 721                const char **error)
 722 {
 723     const char *p = key_string;
 724     unsigned char bits[8];
 725     int i;
 726
 727     if (strlen (key_string) != 16) {
 728         *error = "bad length, should be 16 for DES key";
 729         return 1;
 730     }
 731     for (i = 0; i < 8; ++i) {
 732         int d1, d2;
 733
 734         d1 = hex2n(p[2 * i]);
 735         d2 = hex2n(p[2 * i + 1]);
 736         if (d1 < 0 || d2 < 0) {
 737             *error = "non-hex character";
 738             return 1;
 739         }
 740         bits[i] = (d1 << 4) | d2;
 741     }
 742     for (i = 0; i < 3; ++i) {
 743         key_data[i].key_data_ver  = 2;
 744         key_data[i].key_data_kvno = 0;
 745         /* key */
 746         key_data[i].key_data_type[0]     = ETYPE_DES_CBC_CRC;
 747         key_data[i].key_data_length[0]   = 8;
 748         key_data[i].key_data_contents[0] = malloc(8);
 749         if (key_data[i].key_data_contents[0] == NULL) {
 750             *error = "malloc";
 751             return ENOMEM;
 752         }
 753         memcpy (key_data[i].key_data_contents[0], bits, 8);
 754         /* salt */
 755         key_data[i].key_data_type[1]     = KRB5_PW_SALT;
 756         key_data[i].key_data_length[1]   = 0;
 757         key_data[i].key_data_contents[1] = NULL;
 758     }
 759     key_data[0].key_data_type[0] = ETYPE_DES_CBC_MD5;
 760     key_data[1].key_data_type[0] = ETYPE_DES_CBC_MD4;
 761     return 0;
 762 }