lib/hdb/mkey.c

   1 /*
   2  * Copyright (c) 2000 - 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "hdb_locl.h"
  35 #ifndef O_BINARY
  36 #define O_BINARY 0
  37 #endif
  38
  39 struct hdb_master_key_data {
  40     krb5_keytab_entry keytab;
  41     krb5_crypto crypto;
  42     struct hdb_master_key_data *next;
  43     unsigned int key_usage;
  44 };
  45
  46 void
  47 hdb_free_master_key(krb5_context context, hdb_master_key mkey)
  48 {
  49     struct hdb_master_key_data *ptr;
  50     while(mkey) {
  51         krb5_kt_free_entry(context, &mkey->keytab);
  52         if (mkey->crypto)
  53             krb5_crypto_destroy(context, mkey->crypto);
  54         ptr = mkey;
  55         mkey = mkey->next;
  56         free(ptr);
  57     }
  58 }
  59
  60 krb5_error_code
  61 hdb_process_master_key(krb5_context context,
  62                        int kvno, krb5_keyblock *key, krb5_enctype etype,
  63                        hdb_master_key *mkey)
  64 {
  65     krb5_error_code ret;
  66
  67     *mkey = calloc(1, sizeof(**mkey));
  68     if(*mkey == NULL) {
  69         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
  70         return ENOMEM;
  71     }
  72     (*mkey)->key_usage = HDB_KU_MKEY;
  73     (*mkey)->keytab.vno = kvno;
  74     ret = krb5_parse_name(context, "K/M", &(*mkey)->keytab.principal);
  75     if(ret)
  76         goto fail;
  77     ret = krb5_copy_keyblock_contents(context, key, &(*mkey)->keytab.keyblock);
  78     if(ret)
  79         goto fail;
  80     if(etype != 0)
  81         (*mkey)->keytab.keyblock.keytype = etype;
  82     (*mkey)->keytab.timestamp = time(NULL);
  83     ret = krb5_crypto_init(context, key, etype, &(*mkey)->crypto);
  84     if(ret)
  85         goto fail;
  86     return 0;
  87  fail:
  88     hdb_free_master_key(context, *mkey);
  89     *mkey = NULL;
  90     return ret;
  91 }
  92
  93 krb5_error_code
  94 hdb_add_master_key(krb5_context context, krb5_keyblock *key,
  95                    hdb_master_key *inout)
  96 {
  97     int vno = 0;
  98     hdb_master_key p;
  99     krb5_error_code ret;
 100
 101     for(p = *inout; p; p = p->next)
 102         vno = max(vno, p->keytab.vno);
 103     vno++;
 104     ret = hdb_process_master_key(context, vno, key, 0, &p);
 105     if(ret)
 106         return ret;
 107     p->next = *inout;
 108     *inout = p;
 109     return 0;
 110 }
 111
 112 static krb5_error_code
 113 read_master_keytab(krb5_context context, const char *filename,
 114                    hdb_master_key *mkey)
 115 {
 116     krb5_error_code ret;
 117     krb5_keytab id;
 118     krb5_kt_cursor cursor;
 119     krb5_keytab_entry entry;
 120     hdb_master_key p;
 121
 122     ret = krb5_kt_resolve(context, filename, &id);
 123     if(ret)
 124         return ret;
 125
 126     ret = krb5_kt_start_seq_get(context, id, &cursor);
 127     if(ret)
 128         goto out;
 129     *mkey = NULL;
 130     while(krb5_kt_next_entry(context, id, &entry, &cursor) == 0) {
 131         p = calloc(1, sizeof(*p));
 132         if(p == NULL) {
 133             krb5_kt_end_seq_get(context, id, &cursor);
 134             ret = ENOMEM;
 135             goto out;
 136         }
 137         p->keytab = entry;
 138         ret = krb5_crypto_init(context, &p->keytab.keyblock, 0, &p->crypto);
 139         p->next = *mkey;
 140         *mkey = p;
 141     }
 142     krb5_kt_end_seq_get(context, id, &cursor);
 143   out:
 144     krb5_kt_close(context, id);
 145     return ret;
 146 }
 147
 148 /* read a MIT master keyfile */
 149 static krb5_error_code
 150 read_master_mit(krb5_context context, const char *filename,
 151                 int byteorder, hdb_master_key *mkey)
 152 {
 153     int fd;
 154     krb5_error_code ret;
 155     krb5_storage *sp;
 156     int16_t enctype;
 157     krb5_keyblock key;
 158
 159     fd = open(filename, O_RDONLY | O_BINARY);
 160     if(fd < 0) {
 161         int save_errno = errno;
 162         krb5_set_error_message(context, save_errno, "failed to open %s: %s",
 163                                filename, strerror(save_errno));
 164         return save_errno;
 165     }
 166     sp = krb5_storage_from_fd(fd);
 167     if(sp == NULL) {
 168         close(fd);
 169         return errno;
 170     }
 171     krb5_storage_set_flags(sp, byteorder);
 172     /* could possibly use ret_keyblock here, but do it with more
 173        checks for now */
 174     {
 175         ret = krb5_ret_int16(sp, &enctype);
 176         if (ret)
 177             goto out;
 178         ret = krb5_enctype_valid(context, enctype);
 179         if (ret)
 180            goto out;
 181         key.keytype = enctype;
 182         ret = krb5_ret_data(sp, &key.keyvalue);
 183         if(ret)
 184             goto out;
 185     }
 186     ret = hdb_process_master_key(context, 1, &key, 0, mkey);
 187     krb5_free_keyblock_contents(context, &key);
 188   out:
 189     krb5_storage_free(sp);
 190     close(fd);
 191     return ret;
 192 }
 193
 194 /* read an old master key file */
 195 static krb5_error_code
 196 read_master_encryptionkey(krb5_context context, const char *filename,
 197                           hdb_master_key *mkey)
 198 {
 199     int fd;
 200     krb5_keyblock key;
 201     krb5_error_code ret;
 202     unsigned char buf[256];
 203     ssize_t len;
 204     size_t ret_len;
 205
 206     fd = open(filename, O_RDONLY | O_BINARY);
 207     if(fd < 0) {
 208         int save_errno = errno;
 209         krb5_set_error_message(context, save_errno, "failed to open %s: %s",
 210                               filename, strerror(save_errno));
 211         return save_errno;
 212     }
 213
 214     len = read(fd, buf, sizeof(buf));
 215     close(fd);
 216     if(len < 0) {
 217         int save_errno = errno;
 218         krb5_set_error_message(context, save_errno, "error reading %s: %s",
 219                               filename, strerror(save_errno));
 220         return save_errno;
 221     }
 222
 223     ret = decode_EncryptionKey(buf, len, &key, &ret_len);
 224     memset(buf, 0, sizeof(buf));
 225     if(ret)
 226         return ret;
 227
 228     /* Originally, the keytype was just that, and later it got changed
 229        to des-cbc-md5, but we always used des in cfb64 mode. This
 230        should cover all cases, but will break if someone has hacked
 231        this code to really use des-cbc-md5 -- but then that's not my
 232        problem. */
 233     if(key.keytype == ETYPE_DES_CBC_CRC || key.keytype == ETYPE_DES_CBC_MD5)
 234         key.keytype = ETYPE_DES_CFB64_NONE;
 235
 236     ret = hdb_process_master_key(context, 0, &key, 0, mkey);
 237     krb5_free_keyblock_contents(context, &key);
 238     return ret;
 239 }
 240
 241 /* read a krb4 /.k style file */
 242 static krb5_error_code
 243 read_master_krb4(krb5_context context, const char *filename,
 244                  hdb_master_key *mkey)
 245 {
 246     int fd;
 247     krb5_keyblock key;
 248     krb5_error_code ret;
 249     unsigned char buf[256];
 250     ssize_t len;
 251
 252     fd = open(filename, O_RDONLY | O_BINARY);
 253     if(fd < 0) {
 254         int save_errno = errno;
 255         krb5_set_error_message(context, save_errno, "failed to open %s: %s",
 256                                filename, strerror(save_errno));
 257         return save_errno;
 258     }
 259
 260     len = read(fd, buf, sizeof(buf));
 261     close(fd);
 262     if(len < 0) {
 263         int save_errno = errno;
 264         krb5_set_error_message(context, save_errno, "error reading %s: %s",
 265                                filename, strerror(save_errno));
 266         return save_errno;
 267     }
 268     if(len != 8) {
 269         krb5_set_error_message(context, HEIM_ERR_EOF,
 270                                "bad contents of %s", filename);
 271         return HEIM_ERR_EOF; /* XXX file might be too large */
 272     }
 273
 274     memset(&key, 0, sizeof(key));
 275     key.keytype = ETYPE_DES_PCBC_NONE;
 276     ret = krb5_data_copy(&key.keyvalue, buf, len);
 277     memset(buf, 0, sizeof(buf));
 278     if(ret)
 279         return ret;
 280
 281     ret = hdb_process_master_key(context, 0, &key, 0, mkey);
 282     krb5_free_keyblock_contents(context, &key);
 283     return ret;
 284 }
 285
 286 krb5_error_code
 287 hdb_read_master_key(krb5_context context, const char *filename,
 288                     hdb_master_key *mkey)
 289 {
 290     FILE *f;
 291     unsigned char buf[16];
 292     krb5_error_code ret;
 293
 294     off_t len;
 295
 296     *mkey = NULL;
 297
 298     if(filename == NULL)
 299         filename = HDB_DB_DIR "/m-key";
 300
 301     f = fopen(filename, "r");
 302     if(f == NULL) {
 303         int save_errno = errno;
 304         krb5_set_error_message(context, save_errno, "failed to open %s: %s",
 305                                filename, strerror(save_errno));
 306         return save_errno;
 307     }
 308
 309     if(fread(buf, 1, 2, f) != 2) {
 310         fclose(f);
 311         krb5_set_error_message(context, HEIM_ERR_EOF, "end of file reading %s", filename);
 312         return HEIM_ERR_EOF;
 313     }
 314
 315     fseek(f, 0, SEEK_END);
 316     len = ftell(f);
 317
 318     if(fclose(f) != 0)
 319         return errno;
 320
 321     if(len < 0)
 322         return errno;
 323
 324     if(len == 8) {
 325         ret = read_master_krb4(context, filename, mkey);
 326     } else if(buf[0] == 0x30 && len <= 127 && buf[1] == len - 2) {
 327         ret = read_master_encryptionkey(context, filename, mkey);
 328     } else if(buf[0] == 5 && buf[1] >= 1 && buf[1] <= 2) {
 329         ret = read_master_keytab(context, filename, mkey);
 330     } else {
 331       /*
 332        * Check both LittleEndian and BigEndian since they key file
 333        * might be moved from a machine with diffrent byte order, or
 334        * its running on MacOS X that always uses BE master keys.
 335        */
 336       ret = read_master_mit(context, filename, KRB5_STORAGE_BYTEORDER_LE, mkey);
 337       if (ret)
 338           ret = read_master_mit(context, filename, KRB5_STORAGE_BYTEORDER_BE, mkey);
 339     }
 340     return ret;
 341 }
 342
 343 krb5_error_code
 344 hdb_write_master_key(krb5_context context, const char *filename,
 345                      hdb_master_key mkey)
 346 {
 347     krb5_error_code ret;
 348     hdb_master_key p;
 349     krb5_keytab kt;
 350
 351     if(filename == NULL)
 352         filename = HDB_DB_DIR "/m-key";
 353
 354     ret = krb5_kt_resolve(context, filename, &kt);
 355     if(ret)
 356         return ret;
 357
 358     for(p = mkey; p; p = p->next) {
 359         ret = krb5_kt_add_entry(context, kt, &p->keytab);
 360     }
 361
 362     krb5_kt_close(context, kt);
 363
 364     return ret;
 365 }
 366
 367 krb5_error_code
 368 _hdb_set_master_key_usage(krb5_context context, HDB *db, unsigned int key_usage)
 369 {
 370     if (db->hdb_master_key_set == 0)
 371         return HDB_ERR_NO_MKEY;
 372     db->hdb_master_key->key_usage = key_usage;
 373     return 0;
 374 }
 375
 376 hdb_master_key
 377 _hdb_find_master_key(uint32_t *mkvno, hdb_master_key mkey)
 378 {
 379     hdb_master_key ret = NULL;
 380     while(mkey) {
 381         if(ret == NULL && mkey->keytab.vno == 0)
 382             ret = mkey;
 383         if(mkvno == NULL) {
 384             if(ret == NULL || mkey->keytab.vno > ret->keytab.vno)
 385                 ret = mkey;
 386         } else if((uint32_t)mkey->keytab.vno == *mkvno)
 387             return mkey;
 388         mkey = mkey->next;
 389     }
 390     return ret;
 391 }
 392
 393 int
 394 _hdb_mkey_version(hdb_master_key mkey)
 395 {
 396     return mkey->keytab.vno;
 397 }
 398
 399 int
 400 _hdb_mkey_decrypt(krb5_context context, hdb_master_key key,
 401                   krb5_key_usage usage,
 402                   void *ptr, size_t size, krb5_data *res)
 403 {
 404     return krb5_decrypt(context, key->crypto, usage,
 405                         ptr, size, res);
 406 }
 407
 408 int
 409 _hdb_mkey_encrypt(krb5_context context, hdb_master_key key,
 410                   krb5_key_usage usage,
 411                   const void *ptr, size_t size, krb5_data *res)
 412 {
 413     return krb5_encrypt(context, key->crypto, usage,
 414                         ptr, size, res);
 415 }
 416
 417 krb5_error_code
 418 hdb_unseal_key_mkey(krb5_context context, Key *k, hdb_master_key mkey)
 419 {
 420
 421     krb5_error_code ret;
 422     krb5_data res;
 423     size_t keysize;
 424
 425     hdb_master_key key;
 426
 427     if(k->mkvno == NULL)
 428         return 0;
 429
 430     key = _hdb_find_master_key(k->mkvno, mkey);
 431
 432     if (key == NULL)
 433         return HDB_ERR_NO_MKEY;
 434
 435     ret = _hdb_mkey_decrypt(context, key, HDB_KU_MKEY,
 436                             k->key.keyvalue.data,
 437                             k->key.keyvalue.length,
 438                             &res);
 439     if(ret == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
 440         /* try to decrypt with MIT key usage */
 441         ret = _hdb_mkey_decrypt(context, key, 0,
 442                                 k->key.keyvalue.data,
 443                                 k->key.keyvalue.length,
 444                                 &res);
 445     }
 446     if (ret)
 447         return ret;
 448
 449     /* fixup keylength if the key got padded when encrypting it */
 450     ret = krb5_enctype_keysize(context, k->key.keytype, &keysize);
 451     if (ret) {
 452         krb5_data_free(&res);
 453         return ret;
 454     }
 455     if (keysize > res.length) {
 456         krb5_data_free(&res);
 457         return KRB5_BAD_KEYSIZE;
 458     }
 459
 460     memset(k->key.keyvalue.data, 0, k->key.keyvalue.length);
 461     free(k->key.keyvalue.data);
 462     k->key.keyvalue = res;
 463     k->key.keyvalue.length = keysize;
 464     free(k->mkvno);
 465     k->mkvno = NULL;
 466
 467     return 0;
 468 }
 469
 470 krb5_error_code
 471 hdb_unseal_keys_mkey(krb5_context context, hdb_entry *ent, hdb_master_key mkey)
 472 {
 473     size_t i;
 474
 475     for(i = 0; i < ent->keys.len; i++){
 476         krb5_error_code ret;
 477
 478         ret = hdb_unseal_key_mkey(context, &ent->keys.val[i], mkey);
 479         if (ret)
 480             return ret;
 481     }
 482     return 0;
 483 }
 484
 485 krb5_error_code
 486 hdb_unseal_keys(krb5_context context, HDB *db, hdb_entry *ent)
 487 {
 488     if (db->hdb_master_key_set == 0)
 489         return 0;
 490     return hdb_unseal_keys_mkey(context, ent, db->hdb_master_key);
 491 }
 492
 493 krb5_error_code
 494 hdb_unseal_keys_kvno(krb5_context context, HDB *db, krb5_kvno kvno,
 495                      unsigned flags, hdb_entry *ent)
 496 {
 497     krb5_error_code ret = HDB_ERR_NOENTRY;
 498     HDB_extension *ext;
 499     HDB_Ext_KeySet *hist_keys;
 500     Key *tmp_val;
 501     time_t tmp_set_time;
 502     unsigned int tmp_len;
 503     unsigned int kvno_diff = 0;
 504     krb5_kvno tmp_kvno;
 505     size_t i, k;
 506     int exclude_dead = 0;
 507     KerberosTime now = 0;
 508
 509     if (kvno == 0)
 510         ret = 0;
 511
 512     if ((flags & HDB_F_LIVE_CLNT_KVNOS) || (flags & HDB_F_LIVE_SVC_KVNOS)) {
 513         exclude_dead = 1;
 514         now = time(NULL);
 515         if (HDB_F_LIVE_CLNT_KVNOS)
 516             kvno_diff = hdb_entry_get_kvno_diff_clnt(ent);
 517         else
 518             kvno_diff = hdb_entry_get_kvno_diff_svc(ent);
 519     }
 520
 521     ext = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
 522     if (ext == NULL)
 523         return ret;
 524
 525     /* For swapping; see below */
 526     tmp_len = ent->keys.len;
 527     tmp_val = ent->keys.val;
 528     tmp_kvno = ent->kvno;
 529     (void) hdb_entry_get_pw_change_time(ent, &tmp_set_time);
 530
 531     hist_keys = &ext->data.u.hist_keys;
 532
 533     for (i = 0; i < hist_keys->len; i++) {
 534         if (kvno != 0 && hist_keys->val[i].kvno != kvno)
 535             continue;
 536
 537         if (exclude_dead &&
 538             ((ent->max_life != NULL &&
 539               hist_keys->val[i].set_time != NULL &&
 540               (*hist_keys->val[i].set_time) < (now - (*ent->max_life))) ||
 541             (hist_keys->val[i].kvno < kvno &&
 542              (kvno - hist_keys->val[i].kvno) > kvno_diff)))
 543             /*
 544              * The KDC may want to to check for this keyset's set_time
 545              * is within the TGS principal's max_life, say.  But we stop
 546              * here.
 547              */
 548             continue;
 549
 550         /* Either the keys we want, or all the keys */
 551         for (k = 0; k < hist_keys->val[i].keys.len; k++) {
 552             ret = hdb_unseal_key_mkey(context,
 553                                       &hist_keys->val[i].keys.val[k],
 554                                       db->hdb_master_key);
 555             /*
 556              * If kvno == 0 we might not want to bail here!  E.g., if we
 557              * no longer have the right master key, so just ignore this.
 558              *
 559              * We could filter out keys that we can't decrypt here
 560              * because of HDB_ERR_NO_MKEY.  However, it seems safest to
 561              * filter them out only where necessary, say, in kadm5.
 562              */
 563             if (ret && kvno != 0)
 564                 return ret;
 565             if (ret && ret != HDB_ERR_NO_MKEY)
 566                 return (ret);
 567         }
 568
 569         if (kvno == 0)
 570             continue;
 571
 572         /*
 573          * What follows is a bit of a hack.
 574          *
 575          * This is the keyset we're being asked for, but it's not the
 576          * current keyset.  So we add the current keyset to the history,
 577          * leave the one we were asked for in the history, and pretend
 578          * the one we were asked for is also the current keyset.
 579          *
 580          * This is a bit of a defensive hack in case an entry fetched
 581          * this way ever gets modified then stored: if the keyset is not
 582          * changed we can detect this and put things back, else we won't
 583          * drop any keysets from history by accident.
 584          *
 585          * Note too that we only ever get called with a non-zero kvno
 586          * either in the KDC or in cases where we aren't changing the
 587          * HDB entry anyways, which is why this is just a defensive
 588          * hack.  We also don't fetch specific kvnos in the dump case,
 589          * so there's no danger that we'll dump this entry and load it
 590          * again, repeatedly causing the history to grow boundelessly.
 591          */
 592
 593         /* Swap key sets */
 594         ent->kvno = hist_keys->val[i].kvno;
 595         ent->keys.val = hist_keys->val[i].keys.val;
 596         ent->keys.len = hist_keys->val[i].keys.len;
 597         if (hist_keys->val[i].set_time != NULL)
 598             /* Sloppy, but the callers we expect won't care */
 599             (void) hdb_entry_set_pw_change_time(context, ent,
 600                                                 *hist_keys->val[i].set_time);
 601         hist_keys->val[i].kvno = tmp_kvno;
 602         hist_keys->val[i].keys.val = tmp_val;
 603         hist_keys->val[i].keys.len = tmp_len;
 604         if (hist_keys->val[i].set_time != NULL)
 605             /* Sloppy, but the callers we expect won't care */
 606             *hist_keys->val[i].set_time = tmp_set_time;
 607
 608         return 0;
 609     }
 610
 611     return (ret);
 612 }
 613
 614 krb5_error_code
 615 hdb_unseal_key(krb5_context context, HDB *db, Key *k)
 616 {
 617     if (db->hdb_master_key_set == 0)
 618         return 0;
 619     return hdb_unseal_key_mkey(context, k, db->hdb_master_key);
 620 }
 621
 622 krb5_error_code
 623 hdb_seal_key_mkey(krb5_context context, Key *k, hdb_master_key mkey)
 624 {
 625     krb5_error_code ret;
 626     krb5_data res;
 627     hdb_master_key key;
 628
 629     if(k->mkvno != NULL)
 630         return 0;
 631
 632     key = _hdb_find_master_key(k->mkvno, mkey);
 633
 634     if (key == NULL)
 635         return HDB_ERR_NO_MKEY;
 636
 637     ret = _hdb_mkey_encrypt(context, key, HDB_KU_MKEY,
 638                             k->key.keyvalue.data,
 639                             k->key.keyvalue.length,
 640                             &res);
 641     if (ret)
 642         return ret;
 643
 644     memset(k->key.keyvalue.data, 0, k->key.keyvalue.length);
 645     free(k->key.keyvalue.data);
 646     k->key.keyvalue = res;
 647
 648     if (k->mkvno == NULL) {
 649         k->mkvno = malloc(sizeof(*k->mkvno));
 650         if (k->mkvno == NULL)
 651             return ENOMEM;
 652     }
 653     *k->mkvno = key->keytab.vno;
 654
 655     return 0;
 656 }
 657
 658 krb5_error_code
 659 hdb_seal_keys_mkey(krb5_context context, hdb_entry *ent, hdb_master_key mkey)
 660 {
 661     HDB_extension *ext;
 662     HDB_Ext_KeySet *hist_keys;
 663     size_t i, k;
 664     krb5_error_code ret;
 665
 666     for(i = 0; i < ent->keys.len; i++){
 667         ret = hdb_seal_key_mkey(context, &ent->keys.val[i], mkey);
 668         if (ret)
 669             return ret;
 670     }
 671
 672     ext = hdb_find_extension(ent, choice_HDB_extension_data_hist_keys);
 673     if (ext == NULL)
 674         return 0;
 675     hist_keys = &ext->data.u.hist_keys;
 676
 677     for (i = 0; i < hist_keys->len; i++) {
 678         for (k = 0; k < hist_keys->val[i].keys.len; k++) {
 679             ret = hdb_seal_key_mkey(context, &hist_keys->val[i].keys.val[k],
 680                                     mkey);
 681             if (ret)
 682                 return ret;
 683         }
 684     }
 685
 686     return 0;
 687 }
 688
 689 krb5_error_code
 690 hdb_seal_keys(krb5_context context, HDB *db, hdb_entry *ent)
 691 {
 692     if (db->hdb_master_key_set == 0)
 693         return 0;
 694
 695     return hdb_seal_keys_mkey(context, ent, db->hdb_master_key);
 696 }
 697
 698 krb5_error_code
 699 hdb_seal_key(krb5_context context, HDB *db, Key *k)
 700 {
 701     if (db->hdb_master_key_set == 0)
 702         return 0;
 703
 704     return hdb_seal_key_mkey(context, k, db->hdb_master_key);
 705 }
 706
 707 krb5_error_code
 708 hdb_set_master_key(krb5_context context,
 709                    HDB *db,
 710                    krb5_keyblock *key)
 711 {
 712     krb5_error_code ret;
 713     hdb_master_key mkey;
 714
 715     ret = hdb_process_master_key(context, 0, key, 0, &mkey);
 716     if (ret)
 717         return ret;
 718     db->hdb_master_key = mkey;
 719 #if 0 /* XXX - why? */
 720     des_set_random_generator_seed(key.keyvalue.data);
 721 #endif
 722     db->hdb_master_key_set = 1;
 723     db->hdb_master_key->key_usage = HDB_KU_MKEY;
 724     return 0;
 725 }
 726
 727 krb5_error_code
 728 hdb_set_master_keyfile (krb5_context context,
 729                         HDB *db,
 730                         const char *keyfile)
 731 {
 732     hdb_master_key key;
 733     krb5_error_code ret;
 734
 735     ret = hdb_read_master_key(context, keyfile, &key);
 736     if (ret) {
 737         if (ret != ENOENT)
 738             return ret;
 739         krb5_clear_error_message(context);
 740         return 0;
 741     }
 742     db->hdb_master_key = key;
 743     db->hdb_master_key_set = 1;
 744     return ret;
 745 }
 746
 747 krb5_error_code
 748 hdb_clear_master_key (krb5_context context,
 749                       HDB *db)
 750 {
 751     if (db->hdb_master_key_set) {
 752         hdb_free_master_key(context, db->hdb_master_key);
 753         db->hdb_master_key_set = 0;
 754     }
 755     return 0;
 756 }