summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--daemons/ipa-kdb/Makefile.am1
-rw-r--r--daemons/ipa-kdb/ipa_kdb.c2
-rw-r--r--daemons/ipa-kdb/ipa_kdb.h13
-rw-r--r--daemons/ipa-kdb/ipa_kdb_passwords.c102
-rw-r--r--daemons/ipa-kdb/ipa_kdb_principals.c9
-rw-r--r--util/ipa_krb5.c33
-rw-r--r--util/ipa_krb5.h4
7 files changed, 153 insertions, 11 deletions
diff --git a/daemons/ipa-kdb/Makefile.am b/daemons/ipa-kdb/Makefile.am
index 609372612..c33695933 100644
--- a/daemons/ipa-kdb/Makefile.am
+++ b/daemons/ipa-kdb/Makefile.am
@@ -29,6 +29,7 @@ ipadb_la_SOURCES = \
ipa_kdb.c \
ipa_kdb_common.c \
ipa_kdb_mkey.c \
+ ipa_kdb_passwords.c \
ipa_kdb_principals.c \
ipa_kdb_pwdpolicy.c \
$(KRB5_UTIL_SRCS) \
diff --git a/daemons/ipa-kdb/ipa_kdb.c b/daemons/ipa-kdb/ipa_kdb.c
index d38ce048d..880a7890b 100644
--- a/daemons/ipa-kdb/ipa_kdb.c
+++ b/daemons/ipa-kdb/ipa_kdb.c
@@ -441,7 +441,7 @@ kdb_vftabl kdb_function_table = {
NULL, /* fetch_master_key_list */
ipadb_store_master_key_list, /* store_master_key_list */
NULL, /* dbe_search_enctype */
- NULL, /* change_pwd */
+ ipadb_change_pwd, /* change_pwd */
NULL, /* promote_db */
NULL, /* decrypt_key_data */
NULL, /* encrypt_key_data */
diff --git a/daemons/ipa-kdb/ipa_kdb.h b/daemons/ipa-kdb/ipa_kdb.h
index 257145cb6..7dc880527 100644
--- a/daemons/ipa-kdb/ipa_kdb.h
+++ b/daemons/ipa-kdb/ipa_kdb.h
@@ -66,10 +66,6 @@
#define KMASK_TL_DATA 0x040000
#define KMASK_LOAD 0x200000
-/* MIT Kerberos sanctioned hack to carry private data around.
- * In krb5 1.10 this should be superceeded by a better mechanism */
-#define KDB_TL_USER_INFO 0x7ffe
-
#define IPA_SETUP "ipa-setup-override-restrictions"
struct ipadb_context {
@@ -161,3 +157,12 @@ krb5_error_code ipadb_store_master_key_list(krb5_context kcontext,
char *master_pwd);
krb5_error_code ipadb_create_master_key(krb5_context kcontext);
+
+/* PASSWORD FUNCTIONS */
+krb5_error_code ipadb_change_pwd(krb5_context context,
+ krb5_keyblock *master_key,
+ krb5_key_salt_tuple *ks_tuple,
+ int ks_tuple_count, char *passwd,
+ int new_kvno, krb5_boolean keepold,
+ krb5_db_entry *db_entry);
+
diff --git a/daemons/ipa-kdb/ipa_kdb_passwords.c b/daemons/ipa-kdb/ipa_kdb_passwords.c
new file mode 100644
index 000000000..9c927c265
--- /dev/null
+++ b/daemons/ipa-kdb/ipa_kdb_passwords.c
@@ -0,0 +1,102 @@
+/*
+ * MIT Kerberos KDC database backend for FreeIPA
+ *
+ * Authors: Simo Sorce <ssorce@redhat.com>
+ *
+ * Copyright (C) 2011 Simo Sorce, Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "ipa_kdb.h"
+
+krb5_error_code ipadb_change_pwd(krb5_context context,
+ krb5_keyblock *master_key,
+ krb5_key_salt_tuple *ks_tuple,
+ int ks_tuple_count, char *passwd,
+ int new_kvno, krb5_boolean keepold,
+ krb5_db_entry *db_entry)
+{
+ krb5_error_code kerr;
+ krb5_data pwd;
+ struct ipadb_context *ipactx;
+ krb5_key_salt_tuple *fks = NULL;
+ int n_fks;
+ krb5_key_data *keys = NULL;
+ int n_keys;
+ krb5_key_data *tdata;
+ int t_keys;
+ int old_kvno;
+ int i;
+
+ ipactx = ipadb_get_context(context);
+ if (!ipactx) {
+ return KRB5_KDB_DBNOTINITED;
+ }
+
+ old_kvno = krb5_db_get_key_data_kvno(context, db_entry->n_key_data,
+ db_entry->key_data);
+ if (old_kvno >= new_kvno) {
+ new_kvno = old_kvno + 1;
+ }
+
+ pwd.data = passwd;
+ pwd.length = strlen(passwd);
+
+ /* We further filter supported enctypes to restrict to the list
+ * we have in ldap */
+ kerr = filter_key_salt_tuples(context, ks_tuple, ks_tuple_count,
+ ipactx->supp_encs, ipactx->n_supp_encs,
+ &fks, &n_fks);
+ if (kerr) {
+ return kerr;
+ }
+
+ kerr = ipa_krb5_generate_key_data(context, db_entry->princ,
+ pwd, new_kvno, master_key,
+ n_fks, fks, &n_keys, &keys);
+ free(fks);
+ if (kerr) {
+ return kerr;
+ }
+
+ if (keepold) {
+ /* need to add the new keys to the old list */
+ t_keys = db_entry->n_key_data;
+
+ tdata = realloc(db_entry->key_data,
+ sizeof(krb5_key_data) * (t_keys + n_keys));
+ if (!tdata) {
+ ipa_krb5_free_key_data(keys, n_keys);
+ return ENOMEM;
+ }
+ db_entry->key_data = tdata;
+ db_entry->n_key_data = t_keys + n_keys;
+
+ for (i = 0; i < n_keys; i++) {
+ db_entry->key_data[t_keys + i] = keys[i];
+ }
+ free(keys);
+
+ } else {
+
+ ipa_krb5_free_key_data(db_entry->key_data, db_entry->n_key_data);
+ db_entry->key_data = keys;
+ db_entry->n_key_data = n_keys;
+ }
+
+ return 0;
+}
+
diff --git a/daemons/ipa-kdb/ipa_kdb_principals.c b/daemons/ipa-kdb/ipa_kdb_principals.c
index 97b240650..993f2981d 100644
--- a/daemons/ipa-kdb/ipa_kdb_principals.c
+++ b/daemons/ipa-kdb/ipa_kdb_principals.c
@@ -348,7 +348,7 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
krb5_error_code kerr;
krb5_tl_data *res_tl_data;
krb5_key_data *res_key_data;
- krb5_kvno mkvno;
+ krb5_kvno mkvno = 0;
char *restring;
time_t restime;
bool resbool;
@@ -844,7 +844,6 @@ done:
void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry)
{
krb5_tl_data *prev, *next;
- int i;
if (entry) {
free(entry->e_data);
@@ -1128,8 +1127,7 @@ static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
data->tl_data_type == KRB5_TL_KADM_DATA ||
data->tl_data_type == KRB5_TL_DB_ARGS ||
data->tl_data_type == KRB5_TL_MKVNO ||
- data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK ||
- data->tl_data_type == KDB_TL_USER_INFO) {
+ data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK) {
continue;
}
n++;
@@ -1151,8 +1149,7 @@ static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
data->tl_data_type == KRB5_TL_KADM_DATA ||
data->tl_data_type == KRB5_TL_DB_ARGS ||
data->tl_data_type == KRB5_TL_MKVNO ||
- data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK ||
- data->tl_data_type == KDB_TL_USER_INFO) {
+ data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK) {
continue;
}
diff --git a/util/ipa_krb5.c b/util/ipa_krb5.c
index 96056c769..5b6fc5821 100644
--- a/util/ipa_krb5.c
+++ b/util/ipa_krb5.c
@@ -452,3 +452,36 @@ fail:
return kerr;
}
+krb5_error_code filter_key_salt_tuples(krb5_context context,
+ krb5_key_salt_tuple *req, int n_req,
+ krb5_key_salt_tuple *supp, int n_supp,
+ krb5_key_salt_tuple **res, int *n_res)
+{
+ krb5_key_salt_tuple *ks = NULL;
+ int n_ks;
+ int i, j;
+
+ ks = calloc(n_req, sizeof(krb5_key_salt_tuple));
+ if (!ks) {
+ return ENOMEM;
+ }
+ n_ks = 0;
+
+ for (i = 0; i < n_req; i++) {
+ for (j = 0; j < n_supp; j++) {
+ if (req[i].ks_enctype == supp[j].ks_enctype &&
+ req[i].ks_salttype == supp[j].ks_salttype) {
+ break;
+ }
+ }
+ if (j < n_supp) {
+ ks[n_ks] = req[i];
+ n_ks++;
+ }
+ }
+
+ *res = ks;
+ *n_res = n_ks;
+ return 0;
+}
+
diff --git a/util/ipa_krb5.h b/util/ipa_krb5.h
index 7019e5e63..f0513d109 100644
--- a/util/ipa_krb5.h
+++ b/util/ipa_krb5.h
@@ -32,4 +32,8 @@ krb5_error_code parse_bval_key_salt_tuples(krb5_context kcontext,
krb5_key_salt_tuple **kst,
int *n_kst);
+krb5_error_code filter_key_salt_tuples(krb5_context context,
+ krb5_key_salt_tuple *req, int n_req,
+ krb5_key_salt_tuple *supp, int n_supp,
+ krb5_key_salt_tuple **res, int *n_res);
#endif /* __IPA_KRB5_H_ */
generated by cgit (git 2.34.1) at 2024-11-12 10:12:25 +0000