1 /*
2 * Copyright (c) 1997 - 2002 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include "krb5_locl.h"
35
36 RCSID("$Id: keytab_krb4.c 17046 2006-04-10 17:10:53Z lha $");
37
38 struct krb4_kt_data {
39 char *filename;
40 };
41
42 static krb5_error_code
krb4_kt_resolve(krb5_context context,const char * name,krb5_keytab id)43 krb4_kt_resolve(krb5_context context, const char *name, krb5_keytab id)
44 {
45 struct krb4_kt_data *d;
46
47 d = malloc (sizeof(*d));
48 if (d == NULL) {
49 krb5_set_error_string (context, "malloc: out of memory");
50 return ENOMEM;
51 }
52 d->filename = strdup (name);
53 if (d->filename == NULL) {
54 free(d);
55 krb5_set_error_string (context, "malloc: out of memory");
56 return ENOMEM;
57 }
58 id->data = d;
59 return 0;
60 }
61
62 static krb5_error_code
krb4_kt_get_name(krb5_context context,krb5_keytab id,char * name,size_t name_sz)63 krb4_kt_get_name (krb5_context context,
64 krb5_keytab id,
65 char *name,
66 size_t name_sz)
67 {
68 struct krb4_kt_data *d = id->data;
69
70 strlcpy (name, d->filename, name_sz);
71 return 0;
72 }
73
74 static krb5_error_code
krb4_kt_close(krb5_context context,krb5_keytab id)75 krb4_kt_close (krb5_context context,
76 krb5_keytab id)
77 {
78 struct krb4_kt_data *d = id->data;
79
80 free (d->filename);
81 free (d);
82 return 0;
83 }
84
85 struct krb4_cursor_extra_data {
86 krb5_keytab_entry entry;
87 int num;
88 };
89
90 static int
open_flock(const char * filename,int flags,int mode)91 open_flock(const char *filename, int flags, int mode)
92 {
93 int lock_mode;
94 int tries = 0;
95 int fd = open(filename, flags, mode);
96 if(fd < 0)
97 return fd;
98 if((flags & O_ACCMODE) == O_RDONLY)
99 lock_mode = LOCK_SH | LOCK_NB;
100 else
101 lock_mode = LOCK_EX | LOCK_NB;
102 while(flock(fd, lock_mode) < 0) {
103 if(++tries < 5) {
104 sleep(1);
105 } else {
106 close(fd);
107 return -1;
108 }
109 }
110 return fd;
111 }
112
113
114
115 static krb5_error_code
krb4_kt_start_seq_get_int(krb5_context context,krb5_keytab id,int flags,krb5_kt_cursor * c)116 krb4_kt_start_seq_get_int (krb5_context context,
117 krb5_keytab id,
118 int flags,
119 krb5_kt_cursor *c)
120 {
121 struct krb4_kt_data *d = id->data;
122 struct krb4_cursor_extra_data *ed;
123 int ret;
124
125 ed = malloc (sizeof(*ed));
126 if (ed == NULL) {
127 krb5_set_error_string (context, "malloc: out of memory");
128 return ENOMEM;
129 }
130 ed->entry.principal = NULL;
131 ed->num = -1;
132 c->data = ed;
133 c->fd = open_flock (d->filename, flags, 0);
134 if (c->fd < 0) {
135 ret = errno;
136 free (ed);
137 krb5_set_error_string(context, "open(%s): %s", d->filename,
138 strerror(ret));
139 return ret;
140 }
141 c->sp = krb5_storage_from_fd(c->fd);
142 if(c->sp == NULL) {
143 close(c->fd);
144 free(ed);
145 return ENOMEM;
146 }
147 krb5_storage_set_eof_code(c->sp, KRB5_KT_END);
148 return 0;
149 }
150
151 static krb5_error_code
krb4_kt_start_seq_get(krb5_context context,krb5_keytab id,krb5_kt_cursor * c)152 krb4_kt_start_seq_get (krb5_context context,
153 krb5_keytab id,
154 krb5_kt_cursor *c)
155 {
156 return krb4_kt_start_seq_get_int (context, id, O_BINARY | O_RDONLY, c);
157 }
158
159 static krb5_error_code
read_v4_entry(krb5_context context,struct krb4_kt_data * d,krb5_kt_cursor * c,struct krb4_cursor_extra_data * ed)160 read_v4_entry (krb5_context context,
161 struct krb4_kt_data *d,
162 krb5_kt_cursor *c,
163 struct krb4_cursor_extra_data *ed)
164 {
165 unsigned char des_key[8];
166 krb5_error_code ret;
167 char *service, *instance, *realm;
168 int8_t kvno;
169
170 ret = krb5_ret_stringz(c->sp, &service);
171 if (ret)
172 return ret;
173 ret = krb5_ret_stringz(c->sp, &instance);
174 if (ret) {
175 free (service);
176 return ret;
177 }
178 ret = krb5_ret_stringz(c->sp, &realm);
179 if (ret) {
180 free (service);
181 free (instance);
182 return ret;
183 }
184 ret = krb5_425_conv_principal (context, service, instance, realm,
185 &ed->entry.principal);
186 free (service);
187 free (instance);
188 free (realm);
189 if (ret)
190 return ret;
191 ret = krb5_ret_int8(c->sp, &kvno);
192 if (ret) {
193 krb5_free_principal (context, ed->entry.principal);
194 return ret;
195 }
196 ret = krb5_storage_read(c->sp, des_key, sizeof(des_key));
197 if (ret < 0) {
198 krb5_free_principal(context, ed->entry.principal);
199 return ret;
200 }
201 if (ret < 8) {
202 krb5_free_principal(context, ed->entry.principal);
203 return EINVAL;
204 }
205 ed->entry.vno = kvno;
206 ret = krb5_data_copy (&ed->entry.keyblock.keyvalue,
207 des_key, sizeof(des_key));
208 if (ret)
209 return ret;
210 ed->entry.timestamp = time(NULL);
211 ed->num = 0;
212 return 0;
213 }
214
215 static krb5_error_code
krb4_kt_next_entry(krb5_context context,krb5_keytab id,krb5_keytab_entry * entry,krb5_kt_cursor * c)216 krb4_kt_next_entry (krb5_context context,
217 krb5_keytab id,
218 krb5_keytab_entry *entry,
219 krb5_kt_cursor *c)
220 {
221 krb5_error_code ret;
222 struct krb4_kt_data *d = id->data;
223 struct krb4_cursor_extra_data *ed = c->data;
224 const krb5_enctype keytypes[] = {ETYPE_DES_CBC_MD5,
225 ETYPE_DES_CBC_MD4,
226 ETYPE_DES_CBC_CRC};
227
228 if (ed->num == -1) {
229 ret = read_v4_entry (context, d, c, ed);
230 if (ret)
231 return ret;
232 }
233 ret = krb5_kt_copy_entry_contents (context,
234 &ed->entry,
235 entry);
236 if (ret)
237 return ret;
238 entry->keyblock.keytype = keytypes[ed->num];
239 if (++ed->num == 3) {
240 krb5_kt_free_entry (context, &ed->entry);
241 ed->num = -1;
242 }
243 return 0;
244 }
245
246 static krb5_error_code
krb4_kt_end_seq_get(krb5_context context,krb5_keytab id,krb5_kt_cursor * c)247 krb4_kt_end_seq_get (krb5_context context,
248 krb5_keytab id,
249 krb5_kt_cursor *c)
250 {
251 struct krb4_cursor_extra_data *ed = c->data;
252
253 krb5_storage_free (c->sp);
254 if (ed->num != -1)
255 krb5_kt_free_entry (context, &ed->entry);
256 free (c->data);
257 close (c->fd);
258 return 0;
259 }
260
261 static krb5_error_code
krb4_store_keytab_entry(krb5_context context,krb5_keytab_entry * entry,krb5_storage * sp)262 krb4_store_keytab_entry(krb5_context context,
263 krb5_keytab_entry *entry,
264 krb5_storage *sp)
265 {
266 krb5_error_code ret;
267 #define ANAME_SZ 40
268 #define INST_SZ 40
269 #define REALM_SZ 40
270 char service[ANAME_SZ];
271 char instance[INST_SZ];
272 char realm[REALM_SZ];
273 ret = krb5_524_conv_principal (context, entry->principal,
274 service, instance, realm);
275 if (ret)
276 return ret;
277 if (entry->keyblock.keyvalue.length == 8
278 && entry->keyblock.keytype == ETYPE_DES_CBC_MD5) {
279 ret = krb5_store_stringz(sp, service);
280 ret = krb5_store_stringz(sp, instance);
281 ret = krb5_store_stringz(sp, realm);
282 ret = krb5_store_int8(sp, entry->vno);
283 ret = krb5_storage_write(sp, entry->keyblock.keyvalue.data, 8);
284 }
285 return 0;
286 }
287
288 static krb5_error_code
krb4_kt_add_entry(krb5_context context,krb5_keytab id,krb5_keytab_entry * entry)289 krb4_kt_add_entry (krb5_context context,
290 krb5_keytab id,
291 krb5_keytab_entry *entry)
292 {
293 struct krb4_kt_data *d = id->data;
294 krb5_storage *sp;
295 krb5_error_code ret;
296 int fd;
297
298 fd = open_flock (d->filename, O_WRONLY | O_APPEND | O_BINARY, 0);
299 if (fd < 0) {
300 fd = open_flock (d->filename,
301 O_WRONLY | O_APPEND | O_BINARY | O_CREAT, 0600);
302 if (fd < 0) {
303 ret = errno;
304 krb5_set_error_string(context, "open(%s): %s", d->filename,
305 strerror(ret));
306 return ret;
307 }
308 }
309 sp = krb5_storage_from_fd(fd);
310 if(sp == NULL) {
311 close(fd);
312 return ENOMEM;
313 }
314 krb5_storage_set_eof_code(sp, KRB5_KT_END);
315 ret = krb4_store_keytab_entry(context, entry, sp);
316 krb5_storage_free(sp);
317 if(close (fd) < 0)
318 return errno;
319 return ret;
320 }
321
322 static krb5_error_code
krb4_kt_remove_entry(krb5_context context,krb5_keytab id,krb5_keytab_entry * entry)323 krb4_kt_remove_entry(krb5_context context,
324 krb5_keytab id,
325 krb5_keytab_entry *entry)
326 {
327 struct krb4_kt_data *d = id->data;
328 krb5_error_code ret;
329 krb5_keytab_entry e;
330 krb5_kt_cursor cursor;
331 krb5_storage *sp;
332 int remove_flag = 0;
333
334 sp = krb5_storage_emem();
335 if (sp == NULL) {
336 krb5_set_error_string(context, "malloc: out of memory");
337 return ENOMEM;
338 }
339 ret = krb5_kt_start_seq_get(context, id, &cursor);
340 if (ret) {
341 krb5_storage_free(sp);
342 return ret;
343 }
344 while(krb5_kt_next_entry(context, id, &e, &cursor) == 0) {
345 if(!krb5_kt_compare(context, &e, entry->principal,
346 entry->vno, entry->keyblock.keytype)) {
347 ret = krb4_store_keytab_entry(context, &e, sp);
348 if(ret) {
349 krb5_kt_free_entry(context, &e);
350 krb5_storage_free(sp);
351 return ret;
352 }
353 } else
354 remove_flag = 1;
355 krb5_kt_free_entry(context, &e);
356 }
357 krb5_kt_end_seq_get(context, id, &cursor);
358 if(remove_flag) {
359 int fd;
360 unsigned char buf[1024];
361 ssize_t n;
362 krb5_data data;
363 struct stat st;
364
365 krb5_storage_to_data(sp, &data);
366 krb5_storage_free(sp);
367
368 fd = open_flock (d->filename, O_RDWR | O_BINARY, 0);
369 if(fd < 0) {
370 memset(data.data, 0, data.length);
371 krb5_data_free(&data);
372 if(errno == EACCES || errno == EROFS)
373 return KRB5_KT_NOWRITE;
374 return errno;
375 }
376
377 if(write(fd, data.data, data.length) != data.length) {
378 memset(data.data, 0, data.length);
379 krb5_data_free(&data);
380 close(fd);
381 krb5_set_error_string(context, "failed writing to \"%s\"", d->filename);
382 return errno;
383 }
384 memset(data.data, 0, data.length);
385 if(fstat(fd, &st) < 0) {
386 krb5_data_free(&data);
387 close(fd);
388 krb5_set_error_string(context, "failed getting size of \"%s\"", d->filename);
389 return errno;
390 }
391 st.st_size -= data.length;
392 memset(buf, 0, sizeof(buf));
393 while(st.st_size > 0) {
394 n = min(st.st_size, sizeof(buf));
395 n = write(fd, buf, n);
396 if(n <= 0) {
397 krb5_data_free(&data);
398 close(fd);
399 krb5_set_error_string(context, "failed writing to \"%s\"", d->filename);
400 return errno;
401
402 }
403 st.st_size -= n;
404 }
405 if(ftruncate(fd, data.length) < 0) {
406 krb5_data_free(&data);
407 close(fd);
408 krb5_set_error_string(context, "failed truncating \"%s\"", d->filename);
409 return errno;
410 }
411 krb5_data_free(&data);
412 if(close(fd) < 0) {
413 krb5_set_error_string(context, "error closing \"%s\"", d->filename);
414 return errno;
415 }
416 return 0;
417 } else {
418 krb5_storage_free(sp);
419 return KRB5_KT_NOTFOUND;
420 }
421 }
422
423
424 const krb5_kt_ops krb4_fkt_ops = {
425 "krb4",
426 krb4_kt_resolve,
427 krb4_kt_get_name,
428 krb4_kt_close,
429 NULL, /* get */
430 krb4_kt_start_seq_get,
431 krb4_kt_next_entry,
432 krb4_kt_end_seq_get,
433 krb4_kt_add_entry, /* add_entry */
434 krb4_kt_remove_entry /* remove_entry */
435 };
436
437 const krb5_kt_ops krb5_srvtab_fkt_ops = {
438 "SRVTAB",
439 krb4_kt_resolve,
440 krb4_kt_get_name,
441 krb4_kt_close,
442 NULL, /* get */
443 krb4_kt_start_seq_get,
444 krb4_kt_next_entry,
445 krb4_kt_end_seq_get,
446 krb4_kt_add_entry, /* add_entry */
447 krb4_kt_remove_entry /* remove_entry */
448 };
449