2 * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
36 RCSID("$Id: keytab.c,v 1.53 2002/03/10 23:14:12 assar Exp $");
39 * Register a new keytab in `ops'
40 * Return 0 or an error.
44 krb5_kt_register(krb5_context context,
45 const krb5_kt_ops *ops)
47 struct krb5_keytab_data *tmp;
49 tmp = realloc(context->kt_types,
50 (context->num_kt_types + 1) * sizeof(*context->kt_types));
52 krb5_set_error_string(context, "malloc: out of memory");
55 memcpy(&tmp[context->num_kt_types], ops,
56 sizeof(tmp[context->num_kt_types]));
57 context->kt_types = tmp;
58 context->num_kt_types++;
63 * Resolve the keytab name (of the form `type:residual') in `name'
64 * into a keytab in `id'.
65 * Return 0 or an error
69 krb5_kt_resolve(krb5_context context,
75 const char *type, *residual;
79 residual = strchr(name, ':');
80 if(residual == NULL) {
82 type_len = strlen(type);
86 type_len = residual - name;
90 for(i = 0; i < context->num_kt_types; i++) {
91 if(strncasecmp(type, context->kt_types[i].prefix, type_len) == 0)
94 if(i == context->num_kt_types) {
95 krb5_set_error_string(context, "unknown keytab type %.*s",
97 return KRB5_KT_UNKNOWN_TYPE;
100 k = malloc (sizeof(*k));
102 krb5_set_error_string(context, "malloc: out of memory");
105 memcpy(k, &context->kt_types[i], sizeof(*k));
107 ret = (*k->resolve)(context, residual, k);
117 * copy the name of the default keytab into `name'.
118 * Return 0 or KRB5_CONFIG_NOTENUFSPACE if `namesize' is too short.
122 krb5_kt_default_name(krb5_context context, char *name, size_t namesize)
124 if (strlcpy (name, context->default_keytab, namesize) >= namesize) {
125 krb5_clear_error_string (context);
126 return KRB5_CONFIG_NOTENUFSPACE;
132 * copy the name of the default modify keytab into `name'.
133 * Return 0 or KRB5_CONFIG_NOTENUFSPACE if `namesize' is too short.
137 krb5_kt_default_modify_name(krb5_context context, char *name, size_t namesize)
139 const char *kt = NULL;
140 if(context->default_keytab_modify == NULL) {
141 if(strncasecmp(context->default_keytab, "ANY:", 4) != 0)
142 kt = context->default_keytab;
144 size_t len = strcspn(context->default_keytab + 4, ",");
145 if(len >= namesize) {
146 krb5_clear_error_string(context);
147 return KRB5_CONFIG_NOTENUFSPACE;
149 strlcpy(name, context->default_keytab + 4, namesize);
154 kt = context->default_keytab_modify;
155 if (strlcpy (name, kt, namesize) >= namesize) {
156 krb5_clear_error_string (context);
157 return KRB5_CONFIG_NOTENUFSPACE;
163 * Set `id' to the default keytab.
164 * Return 0 or an error.
168 krb5_kt_default(krb5_context context, krb5_keytab *id)
170 return krb5_kt_resolve (context, context->default_keytab, id);
174 * Read the key identified by `(principal, vno, enctype)' from the
175 * keytab in `keyprocarg' (the default if == NULL) into `*key'.
176 * Return 0 or an error.
180 krb5_kt_read_service_key(krb5_context context,
181 krb5_pointer keyprocarg,
182 krb5_principal principal,
184 krb5_enctype enctype,
188 krb5_keytab_entry entry;
192 ret = krb5_kt_resolve (context, keyprocarg, &keytab);
194 ret = krb5_kt_default (context, &keytab);
199 ret = krb5_kt_get_entry (context, keytab, principal, vno, enctype, &entry);
200 krb5_kt_close (context, keytab);
203 ret = krb5_copy_keyblock (context, &entry.keyblock, key);
204 krb5_kt_free_entry(context, &entry);
209 * Retrieve the name of the keytab `keytab' into `name', `namesize'
210 * Return 0 or an error.
214 krb5_kt_get_name(krb5_context context,
219 return (*keytab->get_name)(context, keytab, name, namesize);
223 * Finish using the keytab in `id'. All resources will be released.
224 * Return 0 or an error.
228 krb5_kt_close(krb5_context context,
233 ret = (*id->close)(context, id);
240 * Compare `entry' against `principal, vno, enctype'.
241 * Any of `principal, vno, enctype' might be 0 which acts as a wildcard.
242 * Return TRUE if they compare the same, FALSE otherwise.
246 krb5_kt_compare(krb5_context context,
247 krb5_keytab_entry *entry,
248 krb5_const_principal principal,
250 krb5_enctype enctype)
252 if(principal != NULL &&
253 !krb5_principal_compare(context, entry->principal, principal))
255 if(vno && vno != entry->vno)
257 if(enctype && enctype != entry->keyblock.keytype)
263 * Retrieve the keytab entry for `principal, kvno, enctype' into `entry'
264 * from the keytab `id'.
265 * kvno == 0 is a wildcard and gives the keytab with the highest vno.
266 * Return 0 or an error.
270 krb5_kt_get_entry(krb5_context context,
272 krb5_const_principal principal,
274 krb5_enctype enctype,
275 krb5_keytab_entry *entry)
277 krb5_keytab_entry tmp;
279 krb5_kt_cursor cursor;
282 return (*id->get)(context, id, principal, kvno, enctype, entry);
284 ret = krb5_kt_start_seq_get (context, id, &cursor);
286 return KRB5_KT_NOTFOUND; /* XXX i.e. file not found */
289 while (krb5_kt_next_entry(context, id, &tmp, &cursor) == 0) {
290 if (krb5_kt_compare(context, &tmp, principal, 0, enctype)) {
291 /* the file keytab might only store the lower 8 bits of
292 the kvno, so only compare those bits */
294 || (tmp.vno < 256 && kvno % 256 == tmp.vno)) {
295 krb5_kt_copy_entry_contents (context, &tmp, entry);
296 krb5_kt_free_entry (context, &tmp);
297 krb5_kt_end_seq_get(context, id, &cursor);
299 } else if (kvno == 0 && tmp.vno > entry->vno) {
301 krb5_kt_free_entry (context, entry);
302 krb5_kt_copy_entry_contents (context, &tmp, entry);
305 krb5_kt_free_entry(context, &tmp);
307 krb5_kt_end_seq_get (context, id, &cursor);
311 char princ[256], kt_name[256];
313 krb5_unparse_name_fixed (context, principal, princ, sizeof(princ));
314 krb5_kt_get_name (context, id, kt_name, sizeof(kt_name));
316 krb5_set_error_string (context,
317 "failed to find %s%s%d%s in keytab %s",
323 return KRB5_KT_NOTFOUND;
328 * Copy the contents of `in' into `out'.
329 * Return 0 or an error. */
332 krb5_kt_copy_entry_contents(krb5_context context,
333 const krb5_keytab_entry *in,
334 krb5_keytab_entry *out)
338 memset(out, 0, sizeof(*out));
341 ret = krb5_copy_principal (context, in->principal, &out->principal);
344 ret = krb5_copy_keyblock_contents (context,
349 out->timestamp = in->timestamp;
352 krb5_kt_free_entry (context, out);
357 * Free the contents of `entry'.
361 krb5_kt_free_entry(krb5_context context,
362 krb5_keytab_entry *entry)
364 krb5_free_principal (context, entry->principal);
365 krb5_free_keyblock_contents (context, &entry->keyblock);
371 xxxlock(int fd, int write)
373 if(flock(fd, (write ? LOCK_EX : LOCK_SH) | LOCK_NB) < 0) {
375 if(flock(fd, (write ? LOCK_EX : LOCK_SH) | LOCK_NB) < 0)
389 * Set `cursor' to point at the beginning of `id'.
390 * Return 0 or an error.
394 krb5_kt_start_seq_get(krb5_context context,
396 krb5_kt_cursor *cursor)
398 if(id->start_seq_get == NULL) {
399 krb5_set_error_string(context,
400 "start_seq_get is not supported in the %s "
401 " keytab", id->prefix);
402 return HEIM_ERR_OPNOTSUPP;
404 return (*id->start_seq_get)(context, id, cursor);
408 * Get the next entry from `id' pointed to by `cursor' and advance the
410 * Return 0 or an error.
414 krb5_kt_next_entry(krb5_context context,
416 krb5_keytab_entry *entry,
417 krb5_kt_cursor *cursor)
419 if(id->next_entry == NULL) {
420 krb5_set_error_string(context,
421 "next_entry is not supported in the %s "
422 " keytab", id->prefix);
423 return HEIM_ERR_OPNOTSUPP;
425 return (*id->next_entry)(context, id, entry, cursor);
429 * Release all resources associated with `cursor'.
433 krb5_kt_end_seq_get(krb5_context context,
435 krb5_kt_cursor *cursor)
437 if(id->end_seq_get == NULL) {
438 krb5_set_error_string(context,
439 "end_seq_get is not supported in the %s "
440 " keytab", id->prefix);
441 return HEIM_ERR_OPNOTSUPP;
443 return (*id->end_seq_get)(context, id, cursor);
447 * Add the entry in `entry' to the keytab `id'.
448 * Return 0 or an error.
452 krb5_kt_add_entry(krb5_context context,
454 krb5_keytab_entry *entry)
456 if(id->add == NULL) {
457 krb5_set_error_string(context, "Add is not supported in the %s keytab",
459 return KRB5_KT_NOWRITE;
461 entry->timestamp = time(NULL);
462 return (*id->add)(context, id,entry);
466 * Remove the entry `entry' from the keytab `id'.
467 * Return 0 or an error.
471 krb5_kt_remove_entry(krb5_context context,
473 krb5_keytab_entry *entry)
475 if(id->remove == NULL) {
476 krb5_set_error_string(context,
477 "Remove is not supported in the %s keytab",
479 return KRB5_KT_NOWRITE;
481 return (*id->remove)(context, id, entry);