summaryrefslogtreecommitdiffstats
path: root/src/lib/kdb/kdb_default.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/kdb/kdb_default.c')
-rw-r--r--src/lib/kdb/kdb_default.c291
1 files changed, 146 insertions, 145 deletions
diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c
index 69cc52b8e..81c70f36c 100644
--- a/src/lib/kdb/kdb_default.c
+++ b/src/lib/kdb/kdb_default.c
@@ -1,14 +1,15 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/*
* lib/kdb/kdb_helper.c
*
- * Copyright 1995, 2009 by the Massachusetts Institute of Technology.
+ * Copyright 1995, 2009 by the Massachusetts Institute of Technology.
* All Rights Reserved.
*
* Export of this software from the United States of America may
* require a specific license from the United States Government.
* It is the responsibility of any person or organization contemplating
* export to obtain such a license before exporting.
- *
+ *
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
@@ -22,7 +23,7 @@
* M.I.T. makes no representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* or implied warranty.
- *
+ *
*/
/*
@@ -48,30 +49,30 @@
*/
krb5_error_code
krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap)
- krb5_context kcontext;
- krb5_db_entry *dbentp;
- krb5_int32 *start;
- krb5_int32 ktype;
- krb5_int32 stype;
- krb5_int32 kvno;
- krb5_key_data **kdatap;
+ krb5_context kcontext;
+ krb5_db_entry *dbentp;
+ krb5_int32 *start;
+ krb5_int32 ktype;
+ krb5_int32 stype;
+ krb5_int32 kvno;
+ krb5_key_data **kdatap;
{
- int i, idx;
- int maxkvno;
- krb5_key_data *datap;
- krb5_error_code ret;
+ int i, idx;
+ int maxkvno;
+ krb5_key_data *datap;
+ krb5_error_code ret;
ret = 0;
if (kvno == -1 && stype == -1 && ktype == -1)
- kvno = 0;
-
- if (kvno == 0) {
- /* Get the max key version */
- for (i = 0; i < dbentp->n_key_data; i++) {
- if (kvno < dbentp->key_data[i].key_data_kvno) {
- kvno = dbentp->key_data[i].key_data_kvno;
- }
- }
+ kvno = 0;
+
+ if (kvno == 0) {
+ /* Get the max key version */
+ for (i = 0; i < dbentp->n_key_data; i++) {
+ if (kvno < dbentp->key_data[i].key_data_kvno) {
+ kvno = dbentp->key_data[i].key_data_kvno;
+ }
+ }
}
maxkvno = -1;
@@ -80,56 +81,56 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap)
krb5_boolean similar;
krb5_int32 db_stype;
- ret = 0;
- if (dbentp->key_data[i].key_data_ver > 1) {
- db_stype = dbentp->key_data[i].key_data_type[1];
- } else {
- db_stype = KRB5_KDB_SALTTYPE_NORMAL;
- }
-
- /*
- * Filter out non-permitted enctypes.
- */
- if (!krb5_is_permitted_enctype(kcontext,
- dbentp->key_data[i].key_data_type[0])) {
- ret = KRB5_KDB_NO_PERMITTED_KEY;
- continue;
- }
-
-
- if (ktype > 0) {
- if ((ret = krb5_c_enctype_compare(kcontext, (krb5_enctype) ktype,
- dbentp->key_data[i].key_data_type[0],
- &similar)))
-
- return(ret);
- }
-
- if (((ktype <= 0) || similar) &&
- ((db_stype == stype) || (stype < 0))) {
- if (kvno >= 0) {
- if (kvno == dbentp->key_data[i].key_data_kvno) {
- datap = &dbentp->key_data[i];
- idx = i;
- maxkvno = kvno;
- break;
- }
- } else {
- if (dbentp->key_data[i].key_data_kvno > maxkvno) {
- maxkvno = dbentp->key_data[i].key_data_kvno;
- datap = &dbentp->key_data[i];
- idx = i;
- }
- }
- }
+ ret = 0;
+ if (dbentp->key_data[i].key_data_ver > 1) {
+ db_stype = dbentp->key_data[i].key_data_type[1];
+ } else {
+ db_stype = KRB5_KDB_SALTTYPE_NORMAL;
+ }
+
+ /*
+ * Filter out non-permitted enctypes.
+ */
+ if (!krb5_is_permitted_enctype(kcontext,
+ dbentp->key_data[i].key_data_type[0])) {
+ ret = KRB5_KDB_NO_PERMITTED_KEY;
+ continue;
+ }
+
+
+ if (ktype > 0) {
+ if ((ret = krb5_c_enctype_compare(kcontext, (krb5_enctype) ktype,
+ dbentp->key_data[i].key_data_type[0],
+ &similar)))
+
+ return(ret);
+ }
+
+ if (((ktype <= 0) || similar) &&
+ ((db_stype == stype) || (stype < 0))) {
+ if (kvno >= 0) {
+ if (kvno == dbentp->key_data[i].key_data_kvno) {
+ datap = &dbentp->key_data[i];
+ idx = i;
+ maxkvno = kvno;
+ break;
+ }
+ } else {
+ if (dbentp->key_data[i].key_data_kvno > maxkvno) {
+ maxkvno = dbentp->key_data[i].key_data_kvno;
+ datap = &dbentp->key_data[i];
+ idx = i;
+ }
+ }
+ }
}
if (maxkvno < 0)
- return ret ? ret : KRB5_KDB_NO_MATCHING_KEY;
+ return ret ? ret : KRB5_KDB_NO_MATCHING_KEY;
*kdatap = datap;
*start = idx+1;
return 0;
}
-
+
/*
* kdb default functions. Ideally, some other file should have this functions. For now, TBD.
*/
@@ -139,10 +140,10 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap)
krb5_error_code
krb5_def_store_mkey_list(krb5_context context,
- char *keyfile,
- krb5_principal mname,
- krb5_keylist_node *keylist,
- char *master_pwd)
+ char *keyfile,
+ krb5_principal mname,
+ krb5_keylist_node *keylist,
+ char *master_pwd)
{
krb5_error_code retval = 0;
char defkeyfile[MAXPATHLEN+1];
@@ -168,8 +169,8 @@ krb5_def_store_mkey_list(krb5_context context,
if (!S_ISREG(stb.st_mode)) {
retval = EINVAL;
krb5_set_error_message (context, retval,
- "keyfile (%s) is not a regular file: %s",
- keyfile, error_message(retval));
+ "keyfile (%s) is not a regular file: %s",
+ keyfile, error_message(retval));
goto out;
}
}
@@ -179,7 +180,7 @@ krb5_def_store_mkey_list(krb5_context context,
/* create temp file template for use by mktemp() */
if ((retval = asprintf(&tmp_ktname, "WRFILE:%s_XXXXXX", keyfile)) < 0) {
krb5_set_error_message (context, retval,
- "Could not create temp keytab file name.");
+ "Could not create temp keytab file name.");
goto out;
}
@@ -193,8 +194,8 @@ krb5_def_store_mkey_list(krb5_context context,
if (mktemp(tmp_ktpath) == NULL) {
retval = errno;
krb5_set_error_message (context, retval,
- "Could not create temp stash file: %s",
- error_message(errno));
+ "Could not create temp stash file: %s",
+ error_message(errno));
goto out;
}
@@ -223,8 +224,8 @@ krb5_def_store_mkey_list(krb5_context context,
if (rename(tmp_ktpath, keyfile) < 0) {
retval = errno;
krb5_set_error_message (context, retval,
- "rename of temporary keyfile (%s) to (%s) failed: %s",
- tmp_ktpath, keyfile, error_message(errno));
+ "rename of temporary keyfile (%s) to (%s) failed: %s",
+ tmp_ktpath, keyfile, error_message(errno));
}
}
@@ -249,14 +250,14 @@ krb5_def_store_mkey(krb5_context context,
list.keyblock = *key;
list.next = NULL;
return krb5_def_store_mkey_list(context, keyfile, mname, &list,
- master_pwd);
+ master_pwd);
}
static krb5_error_code
krb5_db_def_fetch_mkey_stash(krb5_context context,
- const char *keyfile,
- krb5_keyblock *key,
- krb5_kvno *kvno)
+ const char *keyfile,
+ krb5_keyblock *key,
+ krb5_kvno *kvno)
{
krb5_error_code retval = 0;
krb5_ui_2 enctype;
@@ -266,14 +267,14 @@ krb5_db_def_fetch_mkey_stash(krb5_context context,
#ifdef ANSI_STDIO
if (!(kf = fopen(keyfile, "rb")))
#else
- if (!(kf = fopen(keyfile, "r")))
+ if (!(kf = fopen(keyfile, "r")))
#endif
- return KRB5_KDB_CANTREAD_STORED;
+ return KRB5_KDB_CANTREAD_STORED;
set_cloexec_file(kf);
if (fread((krb5_pointer) &enctype, 2, 1, kf) != 1) {
- retval = KRB5_KDB_CANTREAD_STORED;
- goto errout;
+ retval = KRB5_KDB_CANTREAD_STORED;
+ goto errout;
}
#if BIG_ENDIAN_MASTER_KEY
@@ -281,16 +282,16 @@ krb5_db_def_fetch_mkey_stash(krb5_context context,
#endif
if (key->enctype == ENCTYPE_UNKNOWN)
- key->enctype = enctype;
+ key->enctype = enctype;
else if (enctype != key->enctype) {
- retval = KRB5_KDB_BADSTORED_MKEY;
- goto errout;
+ retval = KRB5_KDB_BADSTORED_MKEY;
+ goto errout;
}
if (fread((krb5_pointer) &keylength,
- sizeof(keylength), 1, kf) != 1) {
- retval = KRB5_KDB_CANTREAD_STORED;
- goto errout;
+ sizeof(keylength), 1, kf) != 1) {
+ retval = KRB5_KDB_CANTREAD_STORED;
+ goto errout;
}
#if BIG_ENDIAN_MASTER_KEY
@@ -300,23 +301,23 @@ krb5_db_def_fetch_mkey_stash(krb5_context context,
#endif
if (!key->length || ((int) key->length) < 0) {
- retval = KRB5_KDB_BADSTORED_MKEY;
- goto errout;
+ retval = KRB5_KDB_BADSTORED_MKEY;
+ goto errout;
}
-
+
if (!(key->contents = (krb5_octet *)malloc(key->length))) {
- retval = ENOMEM;
- goto errout;
+ retval = ENOMEM;
+ goto errout;
}
if (fread((krb5_pointer) key->contents, sizeof(key->contents[0]),
- key->length, kf) != key->length) {
- retval = KRB5_KDB_CANTREAD_STORED;
- zap(key->contents, key->length);
- free(key->contents);
- key->contents = 0;
+ key->length, kf) != key->length) {
+ retval = KRB5_KDB_CANTREAD_STORED;
+ zap(key->contents, key->length);
+ free(key->contents);
+ key->contents = 0;
} else
- retval = 0;
+ retval = 0;
/*
* Note, the old stash format did not store the kvno and at this point it
@@ -325,9 +326,9 @@ krb5_db_def_fetch_mkey_stash(krb5_context context,
* verifcation trouble if the mkey princ is using a kvno other than 1.
*/
if (kvno && *kvno == IGNORE_VNO)
- *kvno = 1;
+ *kvno = 1;
- errout:
+errout:
(void) fclose(kf);
return retval;
}
@@ -391,7 +392,7 @@ krb5_db_def_fetch_mkey_keytab(krb5_context context,
errout:
if (kt)
- krb5_kt_close(context, kt);
+ krb5_kt_close(context, kt);
return retval;
}
@@ -428,12 +429,12 @@ krb5_db_def_fetch_mkey(krb5_context context,
* key, but set a message indicating the actual error.
*/
if (retval != 0) {
- krb5_set_error_message(context, KRB5_KDB_CANTREAD_STORED,
- "Can not fetch master key (error: %s).",
- error_message(retval));
- return KRB5_KDB_CANTREAD_STORED;
+ krb5_set_error_message(context, KRB5_KDB_CANTREAD_STORED,
+ "Can not fetch master key (error: %s).",
+ error_message(retval));
+ return KRB5_KDB_CANTREAD_STORED;
} else
- return 0;
+ return 0;
}
/*
@@ -453,52 +454,52 @@ krb5_def_verify_master_key(krb5_context context,
nprinc = 1;
if ((retval = krb5_db_get_principal(context, mprinc,
- &master_entry, &nprinc, &more)))
- return(retval);
-
+ &master_entry, &nprinc, &more)))
+ return(retval);
+
if (nprinc != 1) {
- if (nprinc)
- krb5_db_free_principal(context, &master_entry, nprinc);
- return(KRB5_KDB_NOMASTERKEY);
+ if (nprinc)
+ krb5_db_free_principal(context, &master_entry, nprinc);
+ return(KRB5_KDB_NOMASTERKEY);
} else if (more) {
- krb5_db_free_principal(context, &master_entry, nprinc);
- return(KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE);
- }
-
- if ((retval = krb5_dbekd_decrypt_key_data(context, mkey,
- &master_entry.key_data[0],
- &tempkey, NULL))) {
- krb5_db_free_principal(context, &master_entry, nprinc);
- return retval;
+ krb5_db_free_principal(context, &master_entry, nprinc);
+ return(KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE);
+ }
+
+ if ((retval = krb5_dbekd_decrypt_key_data(context, mkey,
+ &master_entry.key_data[0],
+ &tempkey, NULL))) {
+ krb5_db_free_principal(context, &master_entry, nprinc);
+ return retval;
}
if (mkey->length != tempkey.length ||
- memcmp((char *)mkey->contents,
- (char *)tempkey.contents,mkey->length)) {
- retval = KRB5_KDB_BADMASTERKEY;
+ memcmp((char *)mkey->contents,
+ (char *)tempkey.contents,mkey->length)) {
+ retval = KRB5_KDB_BADMASTERKEY;
}
if (kvno != IGNORE_VNO &&
kvno != (krb5_kvno) master_entry.key_data->key_data_kvno) {
retval = KRB5_KDB_BADMASTERKEY;
krb5_set_error_message (context, retval,
- "User specified mkeyVNO (%u) does not match master key princ's KVNO (%u)",
- kvno, master_entry.key_data->key_data_kvno);
+ "User specified mkeyVNO (%u) does not match master key princ's KVNO (%u)",
+ kvno, master_entry.key_data->key_data_kvno);
}
zap((char *)tempkey.contents, tempkey.length);
free(tempkey.contents);
krb5_db_free_principal(context, &master_entry, nprinc);
-
+
return retval;
}
krb5_error_code
krb5_def_fetch_mkey_list(krb5_context context,
- krb5_principal mprinc,
- const krb5_keyblock *mkey,
- krb5_kvno mkvno,
- krb5_keylist_node **mkeys_list)
+ krb5_principal mprinc,
+ const krb5_keyblock *mkey,
+ krb5_kvno mkvno,
+ krb5_keylist_node **mkeys_list)
{
krb5_error_code retval;
krb5_db_entry master_entry;
@@ -507,7 +508,7 @@ krb5_def_fetch_mkey_list(krb5_context context,
krb5_keyblock cur_mkey;
krb5_keylist_node *mkey_list_head = NULL, **mkey_list_node;
krb5_key_data *key_data;
- krb5_mkey_aux_node *mkey_aux_data_list = NULL, *aux_data_entry;
+ krb5_mkey_aux_node *mkey_aux_data_list = NULL, *aux_data_entry;
int i;
if (mkeys_list == NULL)
@@ -583,7 +584,7 @@ krb5_def_fetch_mkey_list(krb5_context context,
}
if (found_key != TRUE) {
krb5_set_error_message (context, KRB5_KDB_BADMASTERKEY,
- "Unable to decrypt latest master key with the provided master key\n");
+ "Unable to decrypt latest master key with the provided master key\n");
retval = KRB5_KDB_BADMASTERKEY;
goto clean_n_exit;
}
@@ -592,7 +593,7 @@ krb5_def_fetch_mkey_list(krb5_context context,
/*
* Extract all the mkeys from master_entry using the most current mkey and
- * create a mkey list for the mkeys field in kdc_realm_t.
+ * create a mkey list for the mkeys field in kdc_realm_t.
*/
mkey_list_head = (krb5_keylist_node *) malloc(sizeof(krb5_keylist_node));
@@ -644,36 +645,36 @@ clean_n_exit:
}
krb5_error_code kdb_def_set_mkey ( krb5_context kcontext,
- char *pwd,
- krb5_keyblock *key )
+ char *pwd,
+ krb5_keyblock *key )
{
/* printf("default set master key\n"); */
return 0;
}
krb5_error_code kdb_def_get_mkey ( krb5_context kcontext,
- krb5_keyblock **key )
+ krb5_keyblock **key )
{
/* printf("default get master key\n"); */
return 0;
}
krb5_error_code kdb_def_set_mkey_list ( krb5_context kcontext,
- krb5_keylist_node *keylist )
+ krb5_keylist_node *keylist )
{
/* printf("default set master key\n"); */
return 0;
}
krb5_error_code kdb_def_get_mkey_list ( krb5_context kcontext,
- krb5_keylist_node **keylist )
+ krb5_keylist_node **keylist )
{
/* printf("default get master key\n"); */
return 0;
}
krb5_error_code krb5_def_promote_db (krb5_context kcontext,
- char *s, char **args)
+ char *s, char **args)
{
/* printf("default promote_db\n"); */
return KRB5_PLUGIN_OP_NOTSUPP;
generated by cgit (git 2.34.1) at 2024-09-20 01:26:55 +0000