2 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
36 RCSID("$Id: keytab_keyfile.c 20695 2007-05-30 14:09:09Z lha $");
38 /* afs keyfile operations --------------------------------------- */
41 * Minimum tools to handle the AFS KeyFile.
43 * Format of the KeyFile is:
44 * <int32_t numkeys> {[<int32_t kvno> <char[8] deskey>] * numkeys}
46 * It just adds to the end of the keyfile, deleting isn't implemented.
47 * Use your favorite text/hex editor to delete keys.
51 #define AFS_SERVERTHISCELL "/usr/afs/etc/ThisCell"
52 #define AFS_SERVERMAGICKRBCONF "/usr/afs/etc/krb.conf"
62 * set `d->cell' and `d->realm'
66 get_cell_and_realm (krb5_context context, struct akf_data *d)
69 char buf[BUFSIZ], *cp;
72 f = fopen (AFS_SERVERTHISCELL, "r");
75 krb5_set_error_string (context, "open %s: %s", AFS_SERVERTHISCELL,
79 if (fgets (buf, sizeof(buf), f) == NULL) {
81 krb5_set_error_string (context, "no cell in %s", AFS_SERVERTHISCELL);
84 buf[strcspn(buf, "\n")] = '\0';
87 d->cell = strdup (buf);
88 if (d->cell == NULL) {
89 krb5_set_error_string (context, "malloc: out of memory");
93 f = fopen (AFS_SERVERMAGICKRBCONF, "r");
95 if (fgets (buf, sizeof(buf), f) == NULL) {
99 krb5_set_error_string (context, "no realm in %s",
100 AFS_SERVERMAGICKRBCONF);
103 buf[strcspn(buf, "\n")] = '\0';
107 for (cp = buf; *cp != '\0'; cp++)
108 *cp = toupper((unsigned char)*cp);
110 d->realm = strdup (buf);
111 if (d->realm == NULL) {
114 krb5_set_error_string (context, "malloc: out of memory");
121 * init and get filename
124 static krb5_error_code
125 akf_resolve(krb5_context context, const char *name, krb5_keytab id)
128 struct akf_data *d = malloc(sizeof (struct akf_data));
131 krb5_set_error_string (context, "malloc: out of memory");
136 ret = get_cell_and_realm (context, d);
141 d->filename = strdup (name);
142 if (d->filename == NULL) {
146 krb5_set_error_string (context, "malloc: out of memory");
158 static krb5_error_code
159 akf_close(krb5_context context, krb5_keytab id)
161 struct akf_data *d = id->data;
173 static krb5_error_code
174 akf_get_name(krb5_context context,
179 struct akf_data *d = id->data;
181 strlcpy (name, d->filename, name_sz);
189 static krb5_error_code
190 akf_start_seq_get(krb5_context context,
195 struct akf_data *d = id->data;
197 c->fd = open (d->filename, O_RDONLY|O_BINARY, 0600);
200 krb5_set_error_string(context, "open(%s): %s", d->filename,
205 c->sp = krb5_storage_from_fd(c->fd);
206 ret = krb5_ret_int32(c->sp, &d->num_entries);
208 krb5_storage_free(c->sp);
210 krb5_clear_error_string (context);
211 if(ret == KRB5_KT_END)
212 return KRB5_KT_NOTFOUND;
219 static krb5_error_code
220 akf_next_entry(krb5_context context,
222 krb5_keytab_entry *entry,
223 krb5_kt_cursor *cursor)
225 struct akf_data *d = id->data;
230 pos = krb5_storage_seek(cursor->sp, 0, SEEK_CUR);
232 if ((pos - 4) / (4 + 8) >= d->num_entries)
235 ret = krb5_make_principal (context, &entry->principal,
236 d->realm, "afs", d->cell, NULL);
240 ret = krb5_ret_int32(cursor->sp, &kvno);
242 krb5_free_principal (context, entry->principal);
248 entry->keyblock.keytype = ETYPE_DES_CBC_MD5;
249 entry->keyblock.keyvalue.length = 8;
250 entry->keyblock.keyvalue.data = malloc (8);
251 if (entry->keyblock.keyvalue.data == NULL) {
252 krb5_free_principal (context, entry->principal);
253 krb5_set_error_string (context, "malloc: out of memory");
258 ret = krb5_storage_read(cursor->sp, entry->keyblock.keyvalue.data, 8);
260 ret = (ret < 0) ? errno : KRB5_KT_END;
264 entry->timestamp = time(NULL);
267 krb5_storage_seek(cursor->sp, pos + 4 + 8, SEEK_SET);
271 static krb5_error_code
272 akf_end_seq_get(krb5_context context,
274 krb5_kt_cursor *cursor)
276 krb5_storage_free(cursor->sp);
281 static krb5_error_code
282 akf_add_entry(krb5_context context,
284 krb5_keytab_entry *entry)
286 struct akf_data *d = id->data;
293 if (entry->keyblock.keyvalue.length != 8)
295 switch(entry->keyblock.keytype) {
296 case ETYPE_DES_CBC_CRC:
297 case ETYPE_DES_CBC_MD4:
298 case ETYPE_DES_CBC_MD5:
304 fd = open (d->filename, O_RDWR | O_BINARY);
306 fd = open (d->filename,
307 O_RDWR | O_BINARY | O_CREAT | O_EXCL, 0600);
310 krb5_set_error_string(context, "open(%s): %s", d->filename,
317 sp = krb5_storage_from_fd(fd);
320 krb5_set_error_string (context, "malloc: out of memory");
326 if(krb5_storage_seek(sp, 0, SEEK_SET) < 0) {
328 krb5_storage_free(sp);
330 krb5_set_error_string (context, "seek: %s", strerror(ret));
334 ret = krb5_ret_int32(sp, &len);
336 krb5_storage_free(sp);
343 * Make sure we don't add the entry twice, assumes the DES
344 * encryption types are all the same key.
350 for (i = 0; i < len; i++) {
351 ret = krb5_ret_int32(sp, &kvno);
353 krb5_set_error_string (context, "Failed to get kvno ");
356 if(krb5_storage_seek(sp, 8, SEEK_CUR) < 0) {
357 krb5_set_error_string (context, "seek: %s", strerror(ret));
360 if (kvno == entry->vno) {
369 if(krb5_storage_seek(sp, 0, SEEK_SET) < 0) {
371 krb5_set_error_string (context, "seek: %s", strerror(ret));
375 ret = krb5_store_int32(sp, len);
377 krb5_set_error_string(context, "keytab keyfile failed new length");
381 if(krb5_storage_seek(sp, (len - 1) * (8 + 4), SEEK_CUR) < 0) {
383 krb5_set_error_string (context, "seek to end: %s", strerror(ret));
387 ret = krb5_store_int32(sp, entry->vno);
389 krb5_set_error_string(context, "keytab keyfile failed store kvno");
392 ret = krb5_storage_write(sp, entry->keyblock.keyvalue.data,
393 entry->keyblock.keyvalue.length);
394 if(ret != entry->keyblock.keyvalue.length) {
399 krb5_set_error_string(context, "keytab keyfile failed to add key");
404 krb5_storage_free(sp);
409 const krb5_kt_ops krb5_akf_ops = {