lib/kadm5/set_keys.c

   1 /*
   2  * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadm5_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 /*
  39  * Set the keys of `ent' to the string-to-key of `password'
  40  */
  41
  42 kadm5_ret_t
  43 _kadm5_set_keys(kadm5_server_context *context,
  44                 hdb_entry *ent,
  45                 int n_ks_tuple,
  46                 krb5_key_salt_tuple *ks_tuple,
  47                 const char *password)
  48 {
  49     Key *keys;
  50     size_t num_keys;
  51     kadm5_ret_t ret;
  52
  53     ret = hdb_generate_key_set_password_with_ks_tuple(context->context,
  54                                                       ent->principal,
  55                                                       password,
  56                                                       ks_tuple, n_ks_tuple,
  57                                                       &keys, &num_keys);
  58     if (ret)
  59         return ret;
  60
  61     _kadm5_free_keys (context->context, ent->keys.len, ent->keys.val);
  62     ent->keys.val = keys;
  63     ent->keys.len = num_keys;
  64
  65     hdb_entry_set_pw_change_time(context->context, ent, 0);
  66
  67     if (krb5_config_get_bool_default(context->context, NULL, FALSE,
  68                                      "kadmin", "save-password", NULL))
  69     {
  70         ret = hdb_entry_set_password(context->context, context->db,
  71                                      ent, password);
  72         if (ret)
  73             return ret;
  74     }
  75
  76     return 0;
  77 }
  78
  79 static void
  80 setup_Key(Key *k, Salt *s, krb5_key_data *kd, size_t kd_offset)
  81 {
  82     memset(k, 0, sizeof (*k)); /* sets mkvno and salt */
  83     k->key.keytype = kd[kd_offset].key_data_type[0];
  84     k->key.keyvalue.length = kd[kd_offset].key_data_length[0];
  85     k->key.keyvalue.data = kd[kd_offset].key_data_contents[0];
  86
  87     if(kd[kd_offset].key_data_ver == 2) {
  88         memset(s, 0, sizeof (*s));
  89         s->type = kd[kd_offset].key_data_type[1];
  90         s->salt.length = kd[kd_offset].key_data_length[1];
  91         s->salt.data = kd[kd_offset].key_data_contents[1];
  92         k->salt = s;
  93     }
  94 }
  95
  96 /*
  97  * Set the keys of `ent' to (`n_key_data', `key_data')
  98  */
  99
 100 kadm5_ret_t
 101 _kadm5_set_keys2(kadm5_server_context *context,
 102                  hdb_entry *ent,
 103                  int16_t n_key_data,
 104                  krb5_key_data *key_data)
 105 {
 106     krb5_error_code ret;
 107     size_t i, k;
 108     HDB_extension ext;
 109     HDB_extension *extp = NULL;
 110     HDB_Ext_KeySet *hist_keys = &ext.data.u.hist_keys;
 111     Key key;
 112     Salt salt;
 113     Keys keys;
 114     hdb_keyset hkset;
 115     krb5_kvno kvno = -1;
 116     int one_key_set = 1;
 117     int replace_hist_keys = 0;
 118
 119     if (n_key_data == 0) {
 120         /* Clear all keys! */
 121         ret = hdb_clear_extension(context->context, ent,
 122                                   choice_HDB_extension_data_hist_keys);
 123         if (ret)
 124             return ret;
 125         free_Keys(&ent->keys);
 126         return 0;
 127     }
 128
 129     memset(&keys, 0, sizeof (keys));
 130     memset(&hkset, 0, sizeof (hkset)); /* set set_time */
 131     memset(&ext, 0, sizeof (ext));
 132     ext.mandatory = FALSE;
 133     ext.data.element = choice_HDB_extension_data_hist_keys;
 134     memset(hist_keys, 0, sizeof (*hist_keys));
 135
 136     for (i = 0; i < n_key_data; i++) {
 137         if (kvno != -1 && kvno != key_data[i].key_data_kvno) {
 138             one_key_set = 0;
 139             break;
 140         }
 141         kvno = key_data[i].key_data_kvno;
 142     }
 143     if (one_key_set) {
 144         /*
 145          * If we're updating KADM5_KEY_DATA with a single keyset then we
 146          * assume we must be setting the principal's kvno as well!
 147          *
 148          * Just have to be careful about old clients that might have
 149          * sent 0 as the kvno...  This may seem ugly, but it's the price
 150          * of backwards compatibility with pre-multi-kvno kadmin clients
 151          * (besides, who's to say that updating KADM5_KEY_DATA requires
 152          * updating the entry's kvno?)
 153          *
 154          * Note that we do nothing special for the case where multiple
 155          * keysets are given but the entry's kvno is not set and not in
 156          * the given set of keysets.  If this happens we'll just update
 157          * the key history only and leave the current keyset alone.
 158          */
 159         if (kvno == 0) {
 160             /* Force kvno to 1 if it was 0; (ank would do this anyways) */
 161             if (ent->kvno == 0)
 162                 ent->kvno = 1;
 163             /* Below we need key_data[*].kvno to be reasonable */
 164             for (i = 0; i < n_key_data; i++)
 165                 key_data[i].key_data_kvno = ent->kvno;
 166         } else {
 167             /*
 168              * Or force the entry's kvno to match the one from the new,
 169              * singular keyset
 170              */
 171             ent->kvno = kvno;
 172         }
 173     }
 174
 175     for (i = 0; i < n_key_data; i++) {
 176         if (key_data[i].key_data_kvno == ent->kvno) {
 177             /* A current key; add to current key set */
 178             setup_Key(&key, &salt, key_data, i);
 179             ret = add_Keys(&keys, &key);
 180             if (ret)
 181                 goto out;
 182             continue;
 183         }
 184
 185         /*
 186          * This kvno is historical.  Build an hdb_keyset for keys of
 187          * this enctype and add them to the new key history.
 188          */
 189         for (k = 0; k < hist_keys->len; k++) {
 190             if (hist_keys->val[k].kvno == key_data[i].key_data_kvno)
 191                 break;
 192         }
 193         if (hist_keys->len > k &&
 194             hist_keys->val[k].kvno == key_data[i].key_data_kvno)
 195             /* We've added all keys of this kvno already (see below) */
 196             continue;
 197
 198         memset(&hkset, 0, sizeof (hkset)); /* set set_time */
 199         hkset.kvno = key_data[i].key_data_kvno;
 200         for (k = 0; k < n_key_data; k++) {
 201             /* Find all keys of this kvno and add them to the new keyset */
 202             if (key_data[k].key_data_kvno != hkset.kvno)
 203                 continue;
 204
 205             setup_Key(&key, &salt, key_data, k);
 206             ret = add_Keys(&hkset.keys, &key);
 207             if (ret) {
 208                 free_hdb_keyset(&hkset);
 209                 goto out;
 210             }
 211         }
 212         ret = add_HDB_Ext_KeySet(hist_keys, &hkset);
 213         free_hdb_keyset(&hkset);
 214         if (ret)
 215             goto out;
 216         replace_hist_keys = 1;
 217     }
 218
 219     if (replace_hist_keys)
 220         /* No key history given -> leave it alone */
 221         extp = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
 222     if (extp != NULL) {
 223         HDB_Ext_KeySet *old_hist_keys;
 224
 225         /*
 226          * Try to keep the very useful set_time values from the old hist
 227          * keys.  kadm5 loses this info, so this heuristic is the best we
 228          * can do.
 229          */
 230         old_hist_keys = &extp->data.u.hist_keys;
 231         for (i = 0; i < old_hist_keys->len; i++) {
 232             if (old_hist_keys->val[i].set_time == NULL)
 233                 continue;
 234             for (k = 0; k < hist_keys->len; k++) {
 235                 if (hist_keys->val[k].kvno != old_hist_keys->val[k].kvno)
 236                     continue;
 237                 hist_keys->val[k].set_time = old_hist_keys->val[k].set_time;
 238                 old_hist_keys->val[k].set_time = NULL;
 239             }
 240         }
 241     }
 242
 243     if (replace_hist_keys) {
 244         /* If hist keys not given in key_data then don't blow away hist_keys */
 245         ret = hdb_replace_extension(context->context, ent, &ext);
 246         if (ret)
 247             goto out;
 248     }
 249
 250     /*
 251      * A structure copy is more efficient here than this would be:
 252      *
 253      * copy_Keys(&keys, &ent->keys);
 254      * free_Keys(&keys);
 255      *
 256      * Of course, the above hdb_replace_extension() is not at all efficient...
 257      */
 258     free_HDB_extension(&ext);
 259     free_Keys(&ent->keys);
 260     free_hdb_keyset(&hkset);
 261     ent->keys = keys;
 262     hdb_entry_set_pw_change_time(context->context, ent, 0);
 263     hdb_entry_clear_password(context->context, ent);
 264
 265     return 0;
 266
 267 out:
 268     free_Keys(&keys);
 269     free_HDB_extension(&ext);
 270     return ret;
 271 }
 272
 273 /*
 274  * Set the keys of `ent' to `n_keys, keys'
 275  */
 276
 277 kadm5_ret_t
 278 _kadm5_set_keys3(kadm5_server_context *context,
 279                  hdb_entry *ent,
 280                  int n_keys,
 281                  krb5_keyblock *keyblocks)
 282 {
 283     krb5_error_code ret;
 284     int i;
 285     unsigned len;
 286     Key *keys;
 287
 288     len  = n_keys;
 289     keys = malloc (len * sizeof(*keys));
 290     if (keys == NULL && len != 0)
 291         return krb5_enomem(context->context);
 292
 293     _kadm5_init_keys (keys, len);
 294
 295     for(i = 0; i < n_keys; i++) {
 296         keys[i].mkvno = NULL;
 297         ret = krb5_copy_keyblock_contents (context->context,
 298                                            &keyblocks[i],
 299                                            &keys[i].key);
 300         if(ret)
 301             goto out;
 302         keys[i].salt = NULL;
 303     }
 304     _kadm5_free_keys (context->context, ent->keys.len, ent->keys.val);
 305     ent->keys.len = len;
 306     ent->keys.val = keys;
 307
 308     hdb_entry_set_pw_change_time(context->context, ent, 0);
 309     hdb_entry_clear_password(context->context, ent);
 310
 311     return 0;
 312  out:
 313     _kadm5_free_keys (context->context, len, keys);
 314     return ret;
 315 }
 316
 317 /*
 318  *
 319  */
 320
 321 static int
 322 is_des_key_p(int keytype)
 323 {
 324     return keytype == ETYPE_DES_CBC_CRC ||
 325         keytype == ETYPE_DES_CBC_MD4 ||
 326         keytype == ETYPE_DES_CBC_MD5;
 327 }
 328
 329
 330 /*
 331  * Set the keys of `ent' to random keys and return them in `n_keys'
 332  * and `new_keys'.
 333  */
 334
 335 kadm5_ret_t
 336 _kadm5_set_keys_randomly (kadm5_server_context *context,
 337                           hdb_entry *ent,
 338                           int n_ks_tuple,
 339                           krb5_key_salt_tuple *ks_tuple,
 340                           krb5_keyblock **new_keys,
 341                           int *n_keys)
 342 {
 343    krb5_keyblock *kblock = NULL;
 344    kadm5_ret_t ret = 0;
 345    int des_keyblock;
 346    size_t i, num_keys;
 347    Key *keys;
 348
 349    ret = hdb_generate_key_set(context->context, ent->principal,
 350                               ks_tuple, n_ks_tuple, &keys, &num_keys, 1);
 351    if (ret)
 352         return ret;
 353
 354    kblock = malloc(num_keys * sizeof(kblock[0]));
 355    if (kblock == NULL) {
 356         ret = krb5_enomem(context->context);
 357         _kadm5_free_keys (context->context, num_keys, keys);
 358         return ret;
 359    }
 360    memset(kblock, 0, num_keys * sizeof(kblock[0]));
 361
 362    des_keyblock = -1;
 363    for (i = 0; i < num_keys; i++) {
 364
 365         /*
 366          * To make sure all des keys are the the same we generate only
 367          * the first one and then copy key to all other des keys.
 368          */
 369
 370         if (des_keyblock != -1 && is_des_key_p(keys[i].key.keytype)) {
 371             ret = krb5_copy_keyblock_contents (context->context,
 372                                                &kblock[des_keyblock],
 373                                                &kblock[i]);
 374             if (ret)
 375                 goto out;
 376             kblock[i].keytype = keys[i].key.keytype;
 377         } else {
 378             ret = krb5_generate_random_keyblock (context->context,
 379                                                  keys[i].key.keytype,
 380                                                  &kblock[i]);
 381             if (ret)
 382                 goto out;
 383
 384             if (is_des_key_p(keys[i].key.keytype))
 385                 des_keyblock = i;
 386         }
 387
 388         ret = krb5_copy_keyblock_contents (context->context,
 389                                            &kblock[i],
 390                                            &keys[i].key);
 391         if (ret)
 392             goto out;
 393    }
 394
 395 out:
 396    if(ret) {
 397         for (i = 0; i < num_keys; ++i)
 398             krb5_free_keyblock_contents(context->context, &kblock[i]);
 399         free(kblock);
 400         _kadm5_free_keys(context->context, num_keys, keys);
 401         return ret;
 402    }
 403
 404    _kadm5_free_keys(context->context, ent->keys.len, ent->keys.val);
 405    ent->keys.val = keys;
 406    ent->keys.len = num_keys;
 407    if (n_keys && new_keys) {
 408        *new_keys     = kblock;
 409        *n_keys       = num_keys;
 410    } else {
 411         for (i = 0; i < num_keys; ++i)
 412             krb5_free_keyblock_contents(context->context, &kblock[i]);
 413         free(kblock);
 414    }
 415
 416    hdb_entry_set_pw_change_time(context->context, ent, 0);
 417    hdb_entry_clear_password(context->context, ent);
 418
 419    return 0;
 420 }