2 * Copyright (c) 1997 - 2001, 2003 - 2004 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 * free all the memory used by (len, keys)
43 hdb_free_keys (krb5_context context
, int len
, Key
*keys
)
47 for (i
= 0; i
< len
; i
++) {
50 if (keys
[i
].salt
!= NULL
) {
51 free_Salt(keys
[i
].salt
);
55 krb5_free_keyblock_contents(context
, &keys
[i
].key
);
61 * for each entry in `default_keys' try to parse it as a sequence
62 * of etype:salttype:salt, syntax of this if something like:
63 * [(des|des3|etype):](pw-salt|afs3)[:string], if etype is omitted it
64 * means all etypes, and if string is omitted is means the default
65 * string (for that principal). Additional special values:
68 * afs or afs3 == des:afs3-salt
71 /* the 3 DES types must be first */
72 static const krb5_enctype all_etypes
[] = {
76 ETYPE_AES256_CTS_HMAC_SHA1_96
,
77 ETYPE_ARCFOUR_HMAC_MD5
,
81 static krb5_error_code
82 parse_key_set(krb5_context context
, const char *key
,
83 krb5_enctype
**ret_enctypes
, size_t *ret_num_enctypes
,
84 krb5_salt
*salt
, krb5_principal principal
)
89 int i
, num_enctypes
= 0;
91 const krb5_enctype
*enctypes
= NULL
;
97 *ret_num_enctypes
= 0;
99 /* split p in a list of :-separated strings */
100 for(num_buf
= 0; num_buf
< 3; num_buf
++)
101 if(strsep_copy(&p
, ":", buf
[num_buf
], sizeof(buf
[num_buf
])) == -1)
104 salt
->saltvalue
.data
= NULL
;
105 salt
->saltvalue
.length
= 0;
107 for(i
= 0; i
< num_buf
; i
++) {
108 if(enctypes
== NULL
&& num_buf
> 1) {
109 /* this might be a etype specifier */
110 /* XXX there should be a string_to_etypes handling
111 special cases like `des' and `all' */
112 if(strcmp(buf
[i
], "des") == 0) {
113 enctypes
= all_etypes
;
115 } else if(strcmp(buf
[i
], "des3") == 0) {
116 e
= ETYPE_DES3_CBC_SHA1
;
120 ret
= krb5_string_to_enctype(context
, buf
[i
], &e
);
129 if(salt
->salttype
== 0) {
130 /* interpret string as a salt specifier, if no etype
131 is set, this sets default values */
132 /* XXX should perhaps use string_to_salttype, but that
134 if(strcmp(buf
[i
], "pw-salt") == 0) {
135 if(enctypes
== NULL
) {
136 enctypes
= all_etypes
;
137 num_enctypes
= sizeof(all_etypes
)/sizeof(all_etypes
[0]);
139 salt
->salttype
= KRB5_PW_SALT
;
140 } else if(strcmp(buf
[i
], "afs3-salt") == 0) {
141 if(enctypes
== NULL
) {
142 enctypes
= all_etypes
;
145 salt
->salttype
= KRB5_AFS3_SALT
;
151 /* if there is a final string, use it as the string to
152 salt with, this is mostly useful with null salt for
153 v4 compat, and a cell name for afs compat */
154 salt
->saltvalue
.data
= strdup(buf
[i
]);
155 if (salt
->saltvalue
.data
== NULL
) {
156 krb5_set_error_string(context
, "out of memory");
159 salt
->saltvalue
.length
= strlen(buf
[i
]);
163 if(enctypes
== NULL
|| salt
->salttype
== 0) {
164 krb5_set_error_string(context
, "bad value for default_keys `%s'", key
);
168 /* if no salt was specified make up default salt */
169 if(salt
->saltvalue
.data
== NULL
) {
170 if(salt
->salttype
== KRB5_PW_SALT
)
171 ret
= krb5_get_pw_salt(context
, principal
, salt
);
172 else if(salt
->salttype
== KRB5_AFS3_SALT
) {
173 krb5_realm
*realm
= krb5_princ_realm(context
, principal
);
174 salt
->saltvalue
.data
= strdup(*realm
);
175 if(salt
->saltvalue
.data
== NULL
) {
176 krb5_set_error_string(context
, "out of memory while "
177 "parsing salt specifiers");
180 strlwr(salt
->saltvalue
.data
);
181 salt
->saltvalue
.length
= strlen(*realm
);
185 *ret_enctypes
= malloc(sizeof(enctypes
[0]) * num_enctypes
);
186 if (*ret_enctypes
== NULL
) {
187 krb5_free_salt(context
, *salt
);
188 krb5_set_error_string(context
, "out of memory");
191 memcpy(*ret_enctypes
, enctypes
, sizeof(enctypes
[0]) * num_enctypes
);
192 *ret_num_enctypes
= num_enctypes
;
197 static krb5_error_code
198 add_enctype_to_key_set(Key
**key_set
, size_t *nkeyset
,
199 krb5_enctype enctype
, krb5_salt
*salt
)
204 memset(&key
, 0, sizeof(key
));
206 tmp
= realloc(*key_set
, (*nkeyset
+ 1) * sizeof((*key_set
)[0]));
212 key
.key
.keytype
= enctype
;
213 key
.key
.keyvalue
.length
= 0;
214 key
.key
.keyvalue
.data
= NULL
;
217 key
.salt
= malloc(sizeof(*key
.salt
));
218 if (key
.salt
== NULL
) {
223 key
.salt
->type
= salt
->salttype
;
224 krb5_data_zero (&key
.salt
->salt
);
226 ret
= krb5_data_copy(&key
.salt
->salt
,
227 salt
->saltvalue
.data
,
228 salt
->saltvalue
.length
);
236 (*key_set
)[*nkeyset
] = key
;
245 * Generate the `key_set' from the [kadmin]default_keys statement. If
246 * `no_salt' is set, salt is not important (and will not be set) since
247 * it's random keys that is going to be created.
251 hdb_generate_key_set(krb5_context context
, krb5_principal principal
,
252 Key
**ret_key_set
, size_t *nkeyset
, int no_salt
)
258 char *default_keytypes
[] = {
260 "aes256-cts-hmac-sha1-96:pw-salt",
261 "des3-cbc-sha1:pw-salt",
262 "arcfour-hmac-md5:pw-salt",
266 ktypes
= krb5_config_get_strings(context
, NULL
, "kadmin",
267 "default_keys", NULL
);
269 ktypes
= default_keytypes
;
274 *ret_key_set
= key_set
= NULL
;
279 for(kp
= ktypes
; kp
&& *kp
; kp
++) {
282 krb5_enctype
*enctypes
;
287 if(strcmp(p
, "v5") == 0)
289 else if(strcmp(p
, "v4") == 0)
291 else if(strcmp(p
, "afs") == 0 || strcmp(p
, "afs3") == 0)
293 else if (strcmp(p
, "arcfour-hmac-md5") == 0)
294 p
= "arcfour-hmac-md5:pw-salt";
296 memset(&salt
, 0, sizeof(salt
));
298 ret
= parse_key_set(context
, p
,
299 &enctypes
, &num_enctypes
, &salt
, principal
);
301 krb5_warn(context
, ret
, "bad value for default_keys `%s'", *kp
);
306 for (i
= 0; i
< num_enctypes
; i
++) {
307 /* find duplicates */
308 for (j
= 0; j
< *nkeyset
; j
++) {
312 if (k
->key
.keytype
== enctypes
[i
]) {
315 if (k
->salt
== NULL
&& salt
.salttype
== KRB5_PW_SALT
)
317 if (k
->salt
->type
== salt
.salttype
&&
318 k
->salt
->salt
.length
== salt
.saltvalue
.length
&&
319 memcmp(k
->salt
->salt
.data
, salt
.saltvalue
.data
,
320 salt
.saltvalue
.length
) == 0)
324 /* not a duplicate, lets add it */
326 ret
= add_enctype_to_key_set(&key_set
, nkeyset
, enctypes
[i
],
327 no_salt
? NULL
: &salt
);
330 krb5_free_salt(context
, salt
);
336 krb5_free_salt(context
, salt
);
339 *ret_key_set
= key_set
;
342 if (ktypes
!= default_keytypes
)
343 krb5_config_free_strings(ktypes
);
346 krb5_warn(context
, ret
,
347 "failed to parse the [kadmin]default_keys values");
349 for (i
= 0; i
< *nkeyset
; i
++)
350 free_Key(&key_set
[i
]);
352 } else if (*nkeyset
== 0) {
354 "failed to parse any of the [kadmin]default_keys values");
355 ret
= EINVAL
; /* XXX */
363 hdb_generate_key_set_password(krb5_context context
,
364 krb5_principal principal
,
365 const char *password
,
366 Key
**keys
, size_t *num_keys
)
371 ret
= hdb_generate_key_set(context
, principal
,
376 for (i
= 0; i
< (*num_keys
); i
++) {
379 salt
.salttype
= (*keys
)[i
].salt
->type
;
380 salt
.saltvalue
.length
= (*keys
)[i
].salt
->salt
.length
;
381 salt
.saltvalue
.data
= (*keys
)[i
].salt
->salt
.data
;
383 ret
= krb5_string_to_key_salt (context
,
384 (*keys
)[i
].key
.keytype
,
394 hdb_free_keys (context
, *num_keys
, *keys
);