2 * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadm5_locl.h"
36 RCSID("$Id: set_keys.c,v 1.25 2001/08/13 15:12:16 joda Exp $");
39 * the known and used DES enctypes
42 static krb5_enctype des_types[] = { ETYPE_DES_CBC_CRC,
45 static unsigned n_des_types = sizeof(des_types) / sizeof(des_types[0]);
47 static krb5_error_code
48 make_keys(krb5_context context, krb5_principal principal, const char *password,
49 Key **keys_ret, size_t *num_keys_ret)
51 krb5_enctype all_etypes[] = { ETYPE_DES3_CBC_SHA1,
59 krb5_error_code ret = 0;
62 Key *keys = NULL, *tmp;
67 char *v4_ktypes[] = {"des3:pw-salt", "v4", NULL};
69 ktypes = krb5_config_get_strings(context, NULL, "kadmin",
70 "default_keys", NULL);
72 /* for each entry in `default_keys' try to parse it as a sequence
73 of etype:salttype:salt, syntax of this if something like:
74 [(des|des3|etype):](pw|afs3)[:string], if etype is omitted it
75 means all etypes, and if string is omitted is means the default
76 string (for that principal). Additional special values:
79 afs or afs3 == des:afs3-salt
83 && krb5_config_get_bool (context, NULL, "kadmin",
87 for(kp = ktypes; kp && *kp; kp++) {
91 krb5_boolean salt_set;
98 if(strcmp(p, "v5") == 0)
100 else if(strcmp(p, "v4") == 0)
102 else if(strcmp(p, "afs") == 0 || strcmp(p, "afs3") == 0)
105 /* split p in a list of :-separated strings */
106 for(num_buf = 0; num_buf < 3; num_buf++)
107 if(strsep_copy(&p, ":", buf[num_buf], sizeof(buf[num_buf])) == -1)
112 memset(&salt, 0, sizeof(salt));
115 for(i = 0; i < num_buf; i++) {
117 /* this might be a etype specifier */
118 /* XXX there should be a string_to_etypes handling
119 special cases like `des' and `all' */
120 if(strcmp(buf[i], "des") == 0) {
121 etypes = all_etypes + 1;
124 } else if(strcmp(buf[i], "des3") == 0) {
125 e = ETYPE_DES3_CBC_SHA1;
130 ret = krb5_string_to_enctype(context, buf[i], &e);
138 if(salt.salttype == 0) {
139 /* interpret string as a salt specifier, if no etype
140 is set, this sets default values */
141 /* XXX should perhaps use string_to_salttype, but that
143 if(strcmp(buf[i], "pw-salt") == 0) {
148 salt.salttype = KRB5_PW_SALT;
149 } else if(strcmp(buf[i], "afs3-salt") == 0) {
151 etypes = all_etypes + 1;
154 salt.salttype = KRB5_AFS3_SALT;
157 /* if there is a final string, use it as the string to
158 salt with, this is mostly useful with null salt for
159 v4 compat, and a cell name for afs compat */
160 salt.saltvalue.data = buf[i];
161 salt.saltvalue.length = strlen(buf[i]);
166 if(etypes == NULL || salt.salttype == 0) {
167 krb5_warnx(context, "bad value for default_keys `%s'", *kp);
172 /* make up default salt */
173 if(salt.salttype == KRB5_PW_SALT)
174 ret = krb5_get_pw_salt(context, principal, &salt);
175 else if(salt.salttype == KRB5_AFS3_SALT) {
176 krb5_realm *realm = krb5_princ_realm(context, principal);
177 salt.saltvalue.data = strdup(*realm);
178 if(salt.saltvalue.data == NULL) {
179 krb5_set_error_string(context, "out of memory while "
180 "parsinig salt specifiers");
184 strlwr(salt.saltvalue.data);
185 salt.saltvalue.length = strlen(*realm);
189 memset(&key, 0, sizeof(key));
190 for(i = 0; i < num_etypes; i++) {
192 for(k = keys; k < keys + num_keys; k++) {
193 if(k->key.keytype == etypes[i] &&
195 k->salt->type == salt.salttype &&
196 k->salt->salt.length == salt.saltvalue.length &&
197 memcmp(k->salt->salt.data, salt.saltvalue.data,
198 salt.saltvalue.length) == 0) ||
200 salt.salttype == KRB5_PW_SALT &&
205 ret = krb5_string_to_key_salt (context,
214 if (salt.salttype != KRB5_PW_SALT || salt_set) {
215 key.salt = malloc (sizeof(*key.salt));
216 if (key.salt == NULL) {
221 key.salt->type = salt.salttype;
222 krb5_data_zero (&key.salt->salt);
224 /* is the salt has not been set explicitly, it will be
225 the default salt, so there's no need to explicitly
228 ret = krb5_data_copy(&key.salt->salt,
230 salt.saltvalue.length);
237 tmp = realloc(keys, (num_keys + 1) * sizeof(*keys));
244 keys[num_keys++] = key;
250 /* if we didn't manage to find a single valid key, create a
252 /* XXX only do this is there is no `default_keys'? */
254 tmp = realloc(keys, (num_keys + 4) * sizeof(*keys));
260 ret = krb5_get_pw_salt(context, principal, &v5_salt);
263 for(i = 0; i < 4; i++) {
264 memset(&key, 0, sizeof(key));
265 ret = krb5_string_to_key_salt(context, all_etypes[i], password,
268 krb5_free_salt(context, v5_salt);
271 keys[num_keys++] = key;
273 krb5_free_salt(context, v5_salt);
279 *num_keys_ret = num_keys;
281 for(i = 0; i < num_keys; i++) {
290 * Set the keys of `ent' to the string-to-key of `password'
294 _kadm5_set_keys(kadm5_server_context *context,
296 const char *password)
302 ret = make_keys(context->context, ent->principal, password,
308 _kadm5_free_keys (context, ent->keys.len, ent->keys.val);
309 ent->keys.val = keys;
310 ent->keys.len = num_keys;
316 * Set the keys of `ent' to (`n_key_data', `key_data')
320 _kadm5_set_keys2(kadm5_server_context *context,
323 krb5_key_data *key_data)
331 keys = malloc (len * sizeof(*keys));
335 _kadm5_init_keys (keys, len);
337 for(i = 0; i < n_key_data; i++) {
338 keys[i].mkvno = NULL;
339 keys[i].key.keytype = key_data[i].key_data_type[0];
340 ret = krb5_data_copy(&keys[i].key.keyvalue,
341 key_data[i].key_data_contents[0],
342 key_data[i].key_data_length[0]);
345 if(key_data[i].key_data_ver == 2) {
348 salt = malloc(sizeof(*salt));
354 salt->type = key_data[i].key_data_type[1];
355 krb5_data_copy(&salt->salt,
356 key_data[i].key_data_contents[1],
357 key_data[i].key_data_length[1]);
361 _kadm5_free_keys (context, ent->keys.len, ent->keys.val);
363 ent->keys.val = keys;
367 _kadm5_free_keys (context, len, keys);
372 * Set the keys of `ent' to `n_keys, keys'
376 _kadm5_set_keys3(kadm5_server_context *context,
379 krb5_keyblock *keyblocks)
387 keys = malloc (len * sizeof(*keys));
391 _kadm5_init_keys (keys, len);
393 for(i = 0; i < n_keys; i++) {
394 keys[i].mkvno = NULL;
395 ret = krb5_copy_keyblock_contents (context->context,
402 _kadm5_free_keys (context, ent->keys.len, ent->keys.val);
404 ent->keys.val = keys;
408 _kadm5_free_keys (context, len, keys);
413 * Set the keys of `ent' to random keys and return them in `n_keys'
418 _kadm5_set_keys_randomly (kadm5_server_context *context,
420 krb5_keyblock **new_keys,
429 len = n_des_types + 1;
430 keys = malloc (len * sizeof(*keys));
434 for (i = 0; i < len; ++i) {
435 keys[i].keyvalue.length = 0;
436 keys[i].keyvalue.data = NULL;
439 hkeys = malloc (len * sizeof(*hkeys));
445 _kadm5_init_keys (hkeys, len);
447 ret = krb5_generate_random_keyblock (context->context,
453 ret = krb5_copy_keyblock_contents (context->context,
459 for (i = 1; i < n_des_types; ++i) {
460 ret = krb5_copy_keyblock_contents (context->context,
465 keys[i].keytype = des_types[i];
466 ret = krb5_copy_keyblock_contents (context->context,
471 hkeys[i].key.keytype = des_types[i];
474 ret = krb5_generate_random_keyblock (context->context,
480 ret = krb5_copy_keyblock_contents (context->context,
482 &hkeys[n_des_types].key);
486 _kadm5_free_keys (context, ent->keys.len, ent->keys.val);
488 ent->keys.val = hkeys;
494 for (i = 0; i < len; ++i)
495 krb5_free_keyblock_contents (context->context, &keys[i]);
497 _kadm5_free_keys (context, len, hkeys);