2 * Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 /* keytab backend for HDB databases */
45 hdb_entry_ex hdb_entry
;
51 * the format for HDB keytabs is:
52 * HDB:[database:file:mkey]
55 static krb5_error_code
56 hdb_resolve(krb5_context context
, const char *name
, krb5_keytab id
)
59 const char *db
, *mkey
;
61 d
= malloc(sizeof(*d
));
63 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
67 mkey
= strchr(name
, ':');
68 if(mkey
== NULL
|| mkey
[1] == '\0') {
72 d
->dbname
= strdup(name
);
73 if(d
->dbname
== NULL
) {
75 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
81 if((mkey
- db
) == 0) {
84 d
->dbname
= malloc(mkey
- db
+ 1);
85 if(d
->dbname
== NULL
) {
87 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
90 memmove(d
->dbname
, db
, mkey
- db
);
91 d
->dbname
[mkey
- db
] = '\0';
93 d
->mkey
= strdup(mkey
+ 1);
97 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
105 static krb5_error_code
106 hdb_close(krb5_context context
, krb5_keytab id
)
108 struct hdb_data
*d
= id
->data
;
116 static krb5_error_code
117 hdb_get_name(krb5_context context
,
122 struct hdb_data
*d
= id
->data
;
124 snprintf(name
, namesize
, "%s%s%s",
125 d
->dbname
? d
->dbname
: "",
126 (d
->dbname
|| d
->mkey
) ? ":" : "",
127 d
->mkey
? d
->mkey
: "");
132 * try to figure out the database (`dbname') and master-key (`mkey')
133 * that should be used for `principal'.
136 static krb5_error_code
137 find_db (krb5_context context
,
140 krb5_const_principal principal
)
142 krb5_const_realm realm
= krb5_principal_get_realm(context
, principal
);
144 struct hdb_dbinfo
*head
, *dbinfo
= NULL
;
146 *dbname
= *mkey
= NULL
;
148 ret
= hdb_get_dbinfo(context
, &head
);
152 while ((dbinfo
= hdb_dbinfo_get_next(head
, dbinfo
)) != NULL
) {
153 const char *p
= hdb_dbinfo_get_realm(context
, dbinfo
);
154 if (p
&& strcmp (realm
, p
) == 0) {
155 p
= hdb_dbinfo_get_dbname(context
, dbinfo
);
158 p
= hdb_dbinfo_get_mkey_file(context
, dbinfo
);
164 hdb_free_dbinfo(context
, &head
);
166 *dbname
= strdup(HDB_DEFAULT_DB
);
171 * find the keytab entry in `id' for `principal, kvno, enctype' and return
172 * it in `entry'. return 0 or an error code
175 static krb5_error_code
176 hdb_get_entry(krb5_context context
,
178 krb5_const_principal principal
,
180 krb5_enctype enctype
,
181 krb5_keytab_entry
*entry
)
185 struct hdb_data
*d
= id
->data
;
186 const char *dbname
= d
->dbname
;
187 const char *mkey
= d
->mkey
;
188 char *fdbname
= NULL
, *fmkey
= NULL
;
192 memset(&ent
, 0, sizeof(ent
));
194 if (dbname
== NULL
) {
195 ret
= find_db(context
, &fdbname
, &fmkey
, principal
);
202 ret
= hdb_create (context
, &db
, dbname
);
205 ret
= hdb_set_master_keyfile (context
, db
, mkey
);
207 (*db
->hdb_destroy
)(context
, db
);
211 ret
= (*db
->hdb_open
)(context
, db
, O_RDONLY
, 0);
213 (*db
->hdb_destroy
)(context
, db
);
216 ret
= (*db
->hdb_fetch
)(context
, db
, principal
,
218 HDB_F_GET_CLIENT
|HDB_F_GET_SERVER
|HDB_F_GET_KRBTGT
,
221 if(ret
== HDB_ERR_NOENTRY
) {
222 ret
= KRB5_KT_NOTFOUND
;
227 if(kvno
&& ent
.entry
.kvno
!= kvno
) {
228 hdb_free_entry(context
, &ent
);
229 ret
= KRB5_KT_NOTFOUND
;
233 if(ent
.entry
.keys
.len
> 0)
234 enctype
= ent
.entry
.keys
.val
[0].key
.keytype
;
235 ret
= KRB5_KT_NOTFOUND
;
236 for(i
= 0; i
< ent
.entry
.keys
.len
; i
++) {
237 if(ent
.entry
.keys
.val
[i
].key
.keytype
== enctype
) {
238 krb5_copy_principal(context
, principal
, &entry
->principal
);
239 entry
->vno
= ent
.entry
.kvno
;
240 krb5_copy_keyblock_contents(context
,
241 &ent
.entry
.keys
.val
[i
].key
,
247 hdb_free_entry(context
, &ent
);
249 (*db
->hdb_close
)(context
, db
);
250 (*db
->hdb_destroy
)(context
, db
);
258 * find the keytab entry in `id' for `principal, kvno, enctype' and return
259 * it in `entry'. return 0 or an error code
262 static krb5_error_code
263 hdb_start_seq_get(krb5_context context
,
265 krb5_kt_cursor
*cursor
)
268 struct hdb_cursor
*c
;
269 struct hdb_data
*d
= id
->data
;
270 const char *dbname
= d
->dbname
;
271 const char *mkey
= d
->mkey
;
274 if (dbname
== NULL
) {
276 * We don't support enumerating without being told what
277 * backend to enumerate on
279 ret
= KRB5_KT_NOTFOUND
;
283 ret
= hdb_create (context
, &db
, dbname
);
286 ret
= hdb_set_master_keyfile (context
, db
, mkey
);
288 (*db
->hdb_destroy
)(context
, db
);
292 ret
= (*db
->hdb_open
)(context
, db
, O_RDONLY
, 0);
294 (*db
->hdb_destroy
)(context
, db
);
298 cursor
->data
= c
= malloc (sizeof(*c
));
300 (*db
->hdb_close
)(context
, db
);
301 (*db
->hdb_destroy
)(context
, db
);
302 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
316 hdb_next_entry(krb5_context context
,
318 krb5_keytab_entry
*entry
,
319 krb5_kt_cursor
*cursor
)
321 struct hdb_cursor
*c
= cursor
->data
;
326 ret
= (c
->db
->hdb_firstkey
)(context
, c
->db
,
328 HDB_F_GET_CLIENT
|HDB_F_GET_SERVER
|HDB_F_GET_KRBTGT
,
330 if (ret
== HDB_ERR_NOENTRY
)
335 if (c
->hdb_entry
.entry
.keys
.len
== 0)
336 hdb_free_entry(context
, &c
->hdb_entry
);
342 ret
= (c
->db
->hdb_nextkey
)(context
, c
->db
,
344 HDB_F_GET_CLIENT
|HDB_F_GET_SERVER
|HDB_F_GET_KRBTGT
,
346 if (ret
== HDB_ERR_NOENTRY
)
351 /* If no keys on this entry, try again */
352 if (c
->hdb_entry
.entry
.keys
.len
== 0)
353 hdb_free_entry(context
, &c
->hdb_entry
);
359 * Return next enc type (keytabs are one slot per key, while
360 * hdb is one record per principal.
363 krb5_copy_principal(context
,
364 c
->hdb_entry
.entry
.principal
,
366 entry
->vno
= c
->hdb_entry
.entry
.kvno
;
367 krb5_copy_keyblock_contents(context
,
368 &c
->hdb_entry
.entry
.keys
.val
[c
->key_idx
].key
,
373 * Once we get to the end of the list, signal that we want the
377 if (c
->key_idx
== c
->hdb_entry
.entry
.keys
.len
) {
378 hdb_free_entry(context
, &c
->hdb_entry
);
386 static int hdb_end_seq_get(krb5_context context
,
388 krb5_kt_cursor
*cursor
) {
389 struct hdb_cursor
*c
= cursor
->data
;
390 (c
->db
->hdb_close
)(context
, c
->db
);
391 (c
->db
->hdb_destroy
)(context
, c
->db
);
393 hdb_free_entry(context
, &c
->hdb_entry
);
399 krb5_kt_ops hdb_kt_ops
= {