kadmin/util.c

   1 /*
   2  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <parse_units.h>
  36
  37 /*
  38  * util.c - functions for parsing, unparsing, and editing different
  39  * types of data used in kadmin.
  40  */
  41
  42 static int
  43 get_response(const char *prompt, const char *def, char *buf, size_t len);
  44
  45 /*
  46  * attributes
  47  */
  48
  49 struct units kdb_attrs[] = {
  50     { "allow-digest",           KRB5_KDB_ALLOW_DIGEST },
  51     { "allow-kerberos4",        KRB5_KDB_ALLOW_KERBEROS4 },
  52     { "trusted-for-delegation", KRB5_KDB_TRUSTED_FOR_DELEGATION },
  53     { "ok-as-delegate",         KRB5_KDB_OK_AS_DELEGATE },
  54     { "new-princ",              KRB5_KDB_NEW_PRINC },
  55     { "support-desmd5",         KRB5_KDB_SUPPORT_DESMD5 },
  56     { "pwchange-service",       KRB5_KDB_PWCHANGE_SERVICE },
  57     { "disallow-svr",           KRB5_KDB_DISALLOW_SVR },
  58     { "requires-pw-change",     KRB5_KDB_REQUIRES_PWCHANGE },
  59     { "requires-hw-auth",       KRB5_KDB_REQUIRES_HW_AUTH },
  60     { "requires-pre-auth",      KRB5_KDB_REQUIRES_PRE_AUTH },
  61     { "disallow-all-tix",       KRB5_KDB_DISALLOW_ALL_TIX },
  62     { "disallow-dup-skey",      KRB5_KDB_DISALLOW_DUP_SKEY },
  63     { "disallow-proxiable",     KRB5_KDB_DISALLOW_PROXIABLE },
  64     { "disallow-renewable",     KRB5_KDB_DISALLOW_RENEWABLE },
  65     { "disallow-tgt-based",     KRB5_KDB_DISALLOW_TGT_BASED },
  66     { "disallow-forwardable",   KRB5_KDB_DISALLOW_FORWARDABLE },
  67     { "disallow-postdated",     KRB5_KDB_DISALLOW_POSTDATED },
  68     { NULL, 0 }
  69 };
  70
  71 /*
  72  * convert the attributes in `attributes' into a printable string
  73  * in `str, len'
  74  */
  75
  76 void
  77 attributes2str(krb5_flags attributes, char *str, size_t len)
  78 {
  79     unparse_flags (attributes, kdb_attrs, str, len);
  80 }
  81
  82 /*
  83  * convert the string in `str' into attributes in `flags'
  84  * return 0 if parsed ok, else -1.
  85  */
  86
  87 int
  88 str2attributes(const char *str, krb5_flags *flags)
  89 {
  90     int res;
  91
  92     res = parse_flags (str, kdb_attrs, *flags);
  93     if (res < 0)
  94         return res;
  95     else {
  96         *flags = res;
  97         return 0;
  98     }
  99 }
 100
 101 /*
 102  * try to parse the string `resp' into attributes in `attr', also
 103  * setting the `bit' in `mask' if attributes are given and valid.
 104  */
 105
 106 int
 107 parse_attributes (const char *resp, krb5_flags *attr, int *mask, int bit)
 108 {
 109     krb5_flags tmp = *attr;
 110
 111     if (str2attributes(resp, &tmp) == 0) {
 112         *attr = tmp;
 113         if (mask)
 114             *mask |= bit;
 115         return 0;
 116     } else if(*resp == '?') {
 117         print_flags_table (kdb_attrs, stderr);
 118     } else {
 119         fprintf (stderr, "Unable to parse \"%s\"\n", resp);
 120     }
 121     return -1;
 122 }
 123
 124 /*
 125  * allow the user to edit the attributes in `attr', prompting with `prompt'
 126  */
 127
 128 int
 129 edit_attributes (const char *prompt, krb5_flags *attr, int *mask, int bit)
 130 {
 131     char buf[1024], resp[1024];
 132
 133     if (mask && (*mask & bit))
 134         return 0;
 135
 136     attributes2str(*attr, buf, sizeof(buf));
 137     for (;;) {
 138         if(get_response("Attributes", buf, resp, sizeof(resp)) != 0)
 139             return 1;
 140         if (resp[0] == '\0')
 141             break;
 142         if (parse_attributes (resp, attr, mask, bit) == 0)
 143             break;
 144     }
 145     return 0;
 146 }
 147
 148 /*
 149  * try to parse the string `resp' into policy in `attr', also
 150  * setting the `bit' in `mask' if attributes are given and valid.
 151  */
 152
 153 #define VALID_POLICY_NAME_CHARS \
 154         "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_"
 155
 156 int
 157 parse_policy (const char *resp, char **policy, int *mask, int bit)
 158 {
 159     if (strspn(resp, VALID_POLICY_NAME_CHARS) == strlen(resp) &&
 160         *resp != '\0') {
 161
 162         *policy = strdup(resp);
 163         if (*policy == NULL) {
 164             fprintf (stderr, "Out of memory");
 165             return -1;
 166         }
 167         if (mask)
 168             *mask |= bit;
 169         return 0;
 170     } else if(*resp == '?') {
 171         print_flags_table (kdb_attrs, stderr);
 172     } else {
 173         fprintf (stderr, "Unable to parse \"%s\"\n", resp);
 174     }
 175     return -1;
 176 }
 177
 178 /*
 179  * allow the user to edit the attributes in `attr', prompting with `prompt'
 180  */
 181
 182 int
 183 edit_policy (const char *prompt, char **policy, int *mask, int bit)
 184 {
 185     char buf[1024], resp[1024];
 186
 187     if (mask && (*mask & bit))
 188         return 0;
 189
 190     buf[0] = '\0';
 191     strlcpy(buf, "default", sizeof (buf));
 192     for (;;) {
 193         if(get_response("Policy", buf, resp, sizeof(resp)) != 0)
 194             return 1;
 195         if (resp[0] == '\0')
 196             break;
 197         if (parse_policy (resp, policy, mask, bit) == 0)
 198             break;
 199     }
 200     return 0;
 201 }
 202
 203 /*
 204  * time_t
 205  * the special value 0 means ``never''
 206  */
 207
 208 /*
 209  * Convert the time `t' to a string representation in `str' (of max
 210  * size `len').  If include_time also include time, otherwise just
 211  * date.
 212  */
 213
 214 void
 215 time_t2str(time_t t, char *str, size_t len, int include_time)
 216 {
 217     if(t) {
 218         if(include_time)
 219             strftime(str, len, "%Y-%m-%d %H:%M:%S UTC", gmtime(&t));
 220         else
 221             strftime(str, len, "%Y-%m-%d", gmtime(&t));
 222     } else
 223         snprintf(str, len, "never");
 224 }
 225
 226 /*
 227  * Convert the time representation in `str' to a time in `time'.
 228  * Return 0 if succesful, else -1.
 229  */
 230
 231 int
 232 str2time_t (const char *str, time_t *t)
 233 {
 234     const char *p;
 235     struct tm tm, tm2;
 236
 237     memset (&tm, 0, sizeof (tm));
 238     memset (&tm2, 0, sizeof (tm2));
 239
 240     while(isspace((unsigned char)*str))
 241         str++;
 242
 243     if (str[0] == '+') {
 244         str++;
 245         *t = parse_time(str, "month");
 246         if (*t < 0)
 247             return -1;
 248         *t += time(NULL);
 249         return 0;
 250     }
 251
 252     if(strcasecmp(str, "never") == 0) {
 253         *t = 0;
 254         return 0;
 255     }
 256
 257     if(strcasecmp(str, "now") == 0) {
 258         *t = time(NULL);
 259         return 0;
 260     }
 261
 262     p = strptime (str, "%Y-%m-%d", &tm);
 263
 264     if (p == NULL)
 265         return -1;
 266
 267     while(isspace((unsigned char)*p))
 268         p++;
 269
 270     /* XXX this is really a bit optimistic, we should really complain
 271        if there was a problem parsing the time */
 272     if(p[0] != '\0' && strptime (p, "%H:%M:%S", &tm2) != NULL) {
 273         tm.tm_hour = tm2.tm_hour;
 274         tm.tm_min  = tm2.tm_min;
 275         tm.tm_sec  = tm2.tm_sec;
 276     } else {
 277         /* Do it on the end of the day */
 278         tm.tm_hour = 23;
 279         tm.tm_min  = 59;
 280         tm.tm_sec  = 59;
 281     }
 282
 283     *t = tm2time (tm, 0);
 284     return 0;
 285 }
 286
 287 /*
 288  * try to parse the time in `resp' storing it in `value'
 289  */
 290
 291 int
 292 parse_timet (const char *resp, krb5_timestamp *value, int *mask, int bit)
 293 {
 294     time_t tmp;
 295
 296     if (str2time_t(resp, &tmp) == 0) {
 297         *value = tmp;
 298         if(mask)
 299             *mask |= bit;
 300         return 0;
 301     }
 302     if(*resp != '?')
 303         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 304     fprintf (stderr, "Print date on format YYYY-mm-dd [hh:mm:ss]\n");
 305     return -1;
 306 }
 307
 308 /*
 309  * allow the user to edit the time in `value'
 310  */
 311
 312 int
 313 edit_timet (const char *prompt, krb5_timestamp *value, int *mask, int bit)
 314 {
 315     char buf[1024], resp[1024];
 316
 317     if (mask && (*mask & bit))
 318         return 0;
 319
 320     time_t2str (*value, buf, sizeof (buf), 0);
 321
 322     for (;;) {
 323         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 324             return 1;
 325         if (parse_timet (resp, value, mask, bit) == 0)
 326             break;
 327     }
 328     return 0;
 329 }
 330
 331 /*
 332  * deltat
 333  * the special value 0 means ``unlimited''
 334  */
 335
 336 /*
 337  * convert the delta_t value in `t' into a printable form in `str, len'
 338  */
 339
 340 void
 341 deltat2str(unsigned t, char *str, size_t len)
 342 {
 343     if(t == 0 || t == INT_MAX)
 344         snprintf(str, len, "unlimited");
 345     else
 346         unparse_time(t, str, len);
 347 }
 348
 349 /*
 350  * parse the delta value in `str', storing result in `*delta'
 351  * return 0 if ok, else -1
 352  */
 353
 354 int
 355 str2deltat(const char *str, krb5_deltat *delta)
 356 {
 357     int res;
 358
 359     if(strcasecmp(str, "unlimited") == 0) {
 360         *delta = 0;
 361         return 0;
 362     }
 363     res = parse_time(str, "day");
 364     if (res < 0)
 365         return res;
 366     else {
 367         *delta = res;
 368         return 0;
 369     }
 370 }
 371
 372 /*
 373  * try to parse the string in `resp' into a deltad in `value'
 374  * `mask' will get the bit `bit' set if a value was given.
 375  */
 376
 377 int
 378 parse_deltat (const char *resp, krb5_deltat *value, int *mask, int bit)
 379 {
 380     krb5_deltat tmp;
 381
 382     if (str2deltat(resp, &tmp) == 0) {
 383         *value = tmp;
 384         if (mask)
 385             *mask |= bit;
 386         return 0;
 387     } else if(*resp == '?') {
 388         print_time_table (stderr);
 389     } else {
 390         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 391     }
 392     return -1;
 393 }
 394
 395 /*
 396  * allow the user to edit the deltat in `value'
 397  */
 398
 399 int
 400 edit_deltat (const char *prompt, krb5_deltat *value, int *mask, int bit)
 401 {
 402     char buf[1024], resp[1024];
 403
 404     if (mask && (*mask & bit))
 405         return 0;
 406
 407     deltat2str(*value, buf, sizeof(buf));
 408     for (;;) {
 409         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 410             return 1;
 411         if (parse_deltat (resp, value, mask, bit) == 0)
 412             break;
 413     }
 414     return 0;
 415 }
 416
 417 /*
 418  * allow the user to edit `ent'
 419  */
 420
 421 void
 422 set_defaults(kadm5_principal_ent_t ent, int *mask,
 423              kadm5_principal_ent_t default_ent, int default_mask)
 424 {
 425     if (default_ent
 426         && (default_mask & KADM5_MAX_LIFE)
 427         && !(*mask & KADM5_MAX_LIFE))
 428         ent->max_life = default_ent->max_life;
 429
 430     if (default_ent
 431         && (default_mask & KADM5_MAX_RLIFE)
 432         && !(*mask & KADM5_MAX_RLIFE))
 433         ent->max_renewable_life = default_ent->max_renewable_life;
 434
 435     if (default_ent
 436         && (default_mask & KADM5_PRINC_EXPIRE_TIME)
 437         && !(*mask & KADM5_PRINC_EXPIRE_TIME))
 438         ent->princ_expire_time = default_ent->princ_expire_time;
 439
 440     if (default_ent
 441         && (default_mask & KADM5_PW_EXPIRATION)
 442         && !(*mask & KADM5_PW_EXPIRATION))
 443         ent->pw_expiration = default_ent->pw_expiration;
 444
 445     if (default_ent
 446         && (default_mask & KADM5_ATTRIBUTES)
 447         && !(*mask & KADM5_ATTRIBUTES))
 448         ent->attributes = default_ent->attributes & ~KRB5_KDB_DISALLOW_ALL_TIX;
 449
 450     if (default_ent
 451         && (default_mask & KADM5_POLICY)
 452         && !(*mask & KADM5_POLICY)) {
 453         ent->policy = strdup(default_ent->policy);
 454         if (ent->policy == NULL)
 455             abort();
 456     }
 457 }
 458
 459 int
 460 edit_entry(kadm5_principal_ent_t ent, int *mask,
 461            kadm5_principal_ent_t default_ent, int default_mask)
 462 {
 463
 464     set_defaults(ent, mask, default_ent, default_mask);
 465
 466     if(edit_deltat ("Max ticket life", &ent->max_life, mask,
 467                     KADM5_MAX_LIFE) != 0)
 468         return 1;
 469
 470     if(edit_deltat ("Max renewable life", &ent->max_renewable_life, mask,
 471                     KADM5_MAX_RLIFE) != 0)
 472         return 1;
 473
 474     if(edit_timet ("Principal expiration time", &ent->princ_expire_time, mask,
 475                    KADM5_PRINC_EXPIRE_TIME) != 0)
 476         return 1;
 477
 478     if(edit_timet ("Password expiration time", &ent->pw_expiration, mask,
 479                    KADM5_PW_EXPIRATION) != 0)
 480         return 1;
 481
 482     if(edit_attributes ("Attributes", &ent->attributes, mask,
 483                         KADM5_ATTRIBUTES) != 0)
 484         return 1;
 485
 486     if(edit_policy ("Policy", &ent->policy, mask,
 487                         KADM5_POLICY) != 0)
 488         return 1;
 489
 490     return 0;
 491 }
 492
 493 /*
 494  * Parse the arguments, set the fields in `ent' and the `mask' for the
 495  * entries having been set.
 496  * Return 1 on failure and 0 on success.
 497  */
 498
 499 int
 500 set_entry(krb5_context contextp,
 501           kadm5_principal_ent_t ent,
 502           int *mask,
 503           const char *max_ticket_life,
 504           const char *max_renewable_life,
 505           const char *expiration,
 506           const char *pw_expiration,
 507           const char *attributes,
 508           const char *policy)
 509 {
 510     if (max_ticket_life != NULL) {
 511         if (parse_deltat (max_ticket_life, &ent->max_life,
 512                           mask, KADM5_MAX_LIFE)) {
 513             krb5_warnx (contextp, "unable to parse `%s'", max_ticket_life);
 514             return 1;
 515         }
 516     }
 517     if (max_renewable_life != NULL) {
 518         if (parse_deltat (max_renewable_life, &ent->max_renewable_life,
 519                           mask, KADM5_MAX_RLIFE)) {
 520             krb5_warnx (contextp, "unable to parse `%s'", max_renewable_life);
 521             return 1;
 522         }
 523     }
 524
 525     if (expiration) {
 526         if (parse_timet (expiration, &ent->princ_expire_time,
 527                         mask, KADM5_PRINC_EXPIRE_TIME)) {
 528             krb5_warnx (contextp, "unable to parse `%s'", expiration);
 529             return 1;
 530         }
 531     }
 532     if (pw_expiration) {
 533         if (parse_timet (pw_expiration, &ent->pw_expiration,
 534                          mask, KADM5_PW_EXPIRATION)) {
 535             krb5_warnx (contextp, "unable to parse `%s'", pw_expiration);
 536             return 1;
 537         }
 538     }
 539     if (attributes != NULL) {
 540         if (parse_attributes (attributes, &ent->attributes,
 541                               mask, KADM5_ATTRIBUTES)) {
 542             krb5_warnx (contextp, "unable to parse `%s'", attributes);
 543             return 1;
 544         }
 545     }
 546     if (policy != NULL) {
 547         if (parse_policy (policy, &ent->policy,
 548                               mask, KADM5_POLICY)) {
 549             krb5_warnx (contextp, "unable to parse `%s'", attributes);
 550             return 1;
 551         }
 552     }
 553     return 0;
 554 }
 555
 556 /*
 557  * Does `string' contain any globing characters?
 558  */
 559
 560 static int
 561 is_expression(const char *string)
 562 {
 563     const char *p;
 564     int quote = 0;
 565
 566     for(p = string; *p; p++) {
 567         if(quote) {
 568             quote = 0;
 569             continue;
 570         }
 571         if(*p == '\\')
 572             quote++;
 573         else if(strchr("[]*?", *p) != NULL)
 574             return 1;
 575     }
 576     return 0;
 577 }
 578
 579 /*
 580  * Loop over all principals matching exp.  If any of calls to `func'
 581  * failes, the first error is returned when all principals are
 582  * processed.
 583  */
 584 int
 585 foreach_principal(const char *exp_str,
 586                   int (*func)(krb5_principal, void*),
 587                   const char *funcname,
 588                   void *data)
 589 {
 590     char **princs = NULL;
 591     int num_princs = 0;
 592     int i;
 593     krb5_error_code saved_ret = 0, ret = 0;
 594     krb5_principal princ_ent;
 595     int is_expr;
 596
 597     /* if this isn't an expression, there is no point in wading
 598        through the whole database looking for matches */
 599     is_expr = is_expression(exp_str);
 600     if(is_expr)
 601         ret = kadm5_get_principals(kadm_handle, exp_str, &princs, &num_princs);
 602     if(!is_expr || ret == KADM5_AUTH_LIST) {
 603         /* we might be able to perform the requested opreration even
 604            if we're not allowed to list principals */
 605         num_princs = 1;
 606         princs = malloc(sizeof(*princs));
 607         if(princs == NULL)
 608             return ENOMEM;
 609         princs[0] = strdup(exp_str);
 610         if(princs[0] == NULL){
 611             free(princs);
 612             return ENOMEM;
 613         }
 614     } else if(ret) {
 615         krb5_warn(context, ret, "kadm5_get_principals");
 616         return ret;
 617     }
 618     for(i = 0; i < num_princs; i++) {
 619         ret = krb5_parse_name(context, princs[i], &princ_ent);
 620         if(ret){
 621             krb5_warn(context, ret, "krb5_parse_name(%s)", princs[i]);
 622             continue;
 623         }
 624         ret = (*func)(princ_ent, data);
 625         if(ret) {
 626             krb5_clear_error_message(context);
 627             krb5_warn(context, ret, "%s %s", funcname, princs[i]);
 628             if (saved_ret == 0)
 629                 saved_ret = ret;
 630         }
 631         krb5_free_principal(context, princ_ent);
 632     }
 633     if (ret == 0 && saved_ret != 0)
 634         ret = saved_ret;
 635     kadm5_free_name_list(kadm_handle, princs, &num_princs);
 636     return ret;
 637 }
 638
 639 /*
 640  * prompt with `prompt' and default value `def', and store the reply
 641  * in `buf, len'
 642  */
 643
 644 #include <setjmp.h>
 645
 646 static jmp_buf jmpbuf;
 647
 648 static void
 649 interrupt(int sig)
 650 {
 651     longjmp(jmpbuf, 1);
 652 }
 653
 654 static int
 655 get_response(const char *prompt, const char *def, char *buf, size_t len)
 656 {
 657     char *p;
 658     void (*osig)(int);
 659
 660     osig = signal(SIGINT, interrupt);
 661     if(setjmp(jmpbuf)) {
 662         signal(SIGINT, osig);
 663         fprintf(stderr, "\n");
 664         return 1;
 665     }
 666
 667     fprintf(stderr, "%s [%s]:", prompt, def);
 668     if(fgets(buf, len, stdin) == NULL) {
 669         int save_errno = errno;
 670         if(ferror(stdin))
 671             krb5_err(context, 1, save_errno, "<stdin>");
 672         signal(SIGINT, osig);
 673         return 1;
 674     }
 675     p = strchr(buf, '\n');
 676     if(p)
 677         *p = '\0';
 678     if(strcmp(buf, "") == 0)
 679         strlcpy(buf, def, len);
 680     signal(SIGINT, osig);
 681     return 0;
 682 }
 683
 684 /*
 685  * return [0, 16) or -1
 686  */
 687
 688 static int
 689 hex2n (char c)
 690 {
 691     static char hexdigits[] = "0123456789abcdef";
 692     const char *p;
 693
 694     p = strchr (hexdigits, tolower((unsigned char)c));
 695     if (p == NULL)
 696         return -1;
 697     else
 698         return p - hexdigits;
 699 }
 700
 701 /*
 702  * convert a key in a readable format into a keyblock.
 703  * return 0 iff succesful, otherwise `err' should point to an error message
 704  */
 705
 706 int
 707 parse_des_key (const char *key_string, krb5_key_data *key_data,
 708                const char **error)
 709 {
 710     const char *p = key_string;
 711     unsigned char bits[8];
 712     int i;
 713
 714     if (strlen (key_string) != 16) {
 715         *error = "bad length, should be 16 for DES key";
 716         return 1;
 717     }
 718     for (i = 0; i < 8; ++i) {
 719         int d1, d2;
 720
 721         d1 = hex2n(p[2 * i]);
 722         d2 = hex2n(p[2 * i + 1]);
 723         if (d1 < 0 || d2 < 0) {
 724             *error = "non-hex character";
 725             return 1;
 726         }
 727         bits[i] = (d1 << 4) | d2;
 728     }
 729     for (i = 0; i < 3; ++i) {
 730         key_data[i].key_data_ver  = 2;
 731         key_data[i].key_data_kvno = 0;
 732         /* key */
 733         key_data[i].key_data_type[0]     = ETYPE_DES_CBC_CRC;
 734         key_data[i].key_data_length[0]   = 8;
 735         key_data[i].key_data_contents[0] = malloc(8);
 736         if (key_data[i].key_data_contents[0] == NULL) {
 737             *error = "malloc";
 738             return ENOMEM;
 739         }
 740         memcpy (key_data[i].key_data_contents[0], bits, 8);
 741         /* salt */
 742         key_data[i].key_data_type[1]     = KRB5_PW_SALT;
 743         key_data[i].key_data_length[1]   = 0;
 744         key_data[i].key_data_contents[1] = NULL;
 745     }
 746     key_data[0].key_data_type[0] = ETYPE_DES_CBC_MD5;
 747     key_data[1].key_data_type[0] = ETYPE_DES_CBC_MD4;
 748     return 0;
 749 }