crypto/external/bsd/heimdal/dist/admin/change.c

   1 /*      $NetBSD: change.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $    */
   2
   3 /*
   4  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
   5  * (Royal Institute of Technology, Stockholm, Sweden).
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "ktutil_locl.h"
  37
  38 __RCSID("NetBSD");
  39
  40 static krb5_error_code
  41 change_entry (krb5_keytab keytab,
  42               krb5_principal principal, krb5_kvno kvno,
  43               const char *realm, const char *admin_server, int server_port)
  44 {
  45     krb5_error_code ret;
  46     kadm5_config_params conf;
  47     void *kadm_handle;
  48     char *client_name;
  49     krb5_keyblock *keys;
  50     int num_keys;
  51     int i;
  52
  53     ret = krb5_unparse_name (context, principal, &client_name);
  54     if (ret) {
  55         krb5_warn (context, ret, "krb5_unparse_name");
  56         return ret;
  57     }
  58
  59     memset (&conf, 0, sizeof(conf));
  60
  61     if(realm == NULL)
  62         realm = krb5_principal_get_realm(context, principal);
  63     conf.realm = strdup(realm);
  64     if (conf.realm == NULL) {
  65         free (client_name);
  66         krb5_set_error_message(context, ENOMEM, "malloc failed");
  67         return ENOMEM;
  68     }
  69     conf.mask |= KADM5_CONFIG_REALM;
  70
  71     if (admin_server) {
  72         conf.admin_server = strdup(admin_server);
  73         if (conf.admin_server == NULL) {
  74             free(client_name);
  75             free(conf.realm);
  76             krb5_set_error_message(context, ENOMEM, "malloc failed");
  77             return ENOMEM;
  78         }
  79         conf.mask |= KADM5_CONFIG_ADMIN_SERVER;
  80     }
  81
  82     if (server_port) {
  83         conf.kadmind_port = htons(server_port);
  84         conf.mask |= KADM5_CONFIG_KADMIND_PORT;
  85     }
  86
  87     ret = kadm5_init_with_skey_ctx (context,
  88                                     client_name,
  89                                     keytab_string,
  90                                     KADM5_ADMIN_SERVICE,
  91                                     &conf, 0, 0,
  92                                     &kadm_handle);
  93     free(conf.admin_server);
  94     free(conf.realm);
  95     if (ret) {
  96         krb5_warn (context, ret,
  97                    "kadm5_c_init_with_skey_ctx: %s:", client_name);
  98         free (client_name);
  99         return ret;
 100     }
 101     ret = kadm5_randkey_principal (kadm_handle, principal, &keys, &num_keys);
 102     kadm5_destroy (kadm_handle);
 103     if (ret) {
 104         krb5_warn(context, ret, "kadm5_randkey_principal: %s:", client_name);
 105         free (client_name);
 106         return ret;
 107     }
 108     free (client_name);
 109     for (i = 0; i < num_keys; ++i) {
 110         krb5_keytab_entry new_entry;
 111
 112         new_entry.principal = principal;
 113         new_entry.timestamp = time (NULL);
 114         new_entry.vno = kvno + 1;
 115         new_entry.keyblock  = keys[i];
 116
 117         ret = krb5_kt_add_entry (context, keytab, &new_entry);
 118         if (ret)
 119             krb5_warn (context, ret, "krb5_kt_add_entry");
 120         krb5_free_keyblock_contents (context, &keys[i]);
 121     }
 122     return ret;
 123 }
 124
 125 /*
 126  * loop over all the entries in the keytab (or those given) and change
 127  * their keys, writing the new keys
 128  */
 129
 130 struct change_set {
 131     krb5_principal principal;
 132     krb5_kvno kvno;
 133 };
 134
 135 int
 136 kt_change (struct change_options *opt, int argc, char **argv)
 137 {
 138     krb5_error_code ret;
 139     krb5_keytab keytab;
 140     krb5_kt_cursor cursor;
 141     krb5_keytab_entry entry;
 142     int i, j, max;
 143     struct change_set *changeset;
 144     int errors = 0;
 145
 146     if((keytab = ktutil_open_keytab()) == NULL)
 147         return 1;
 148
 149     j = 0;
 150     max = 0;
 151     changeset = NULL;
 152
 153     ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 154     if(ret){
 155         krb5_warn(context, ret, "%s", keytab_string);
 156         goto out;
 157     }
 158
 159     while((ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0) {
 160         int add = 0;
 161
 162         for (i = 0; i < j; ++i) {
 163             if (krb5_principal_compare (context, changeset[i].principal,
 164                                         entry.principal)) {
 165                 if (changeset[i].kvno < entry.vno)
 166                     changeset[i].kvno = entry.vno;
 167                 break;
 168             }
 169         }
 170         if (i < j) {
 171             krb5_kt_free_entry (context, &entry);
 172             continue;
 173         }
 174
 175         if (argc == 0) {
 176             add = 1;
 177         } else {
 178             for (i = 0; i < argc; ++i) {
 179                 krb5_principal princ;
 180
 181                 ret = krb5_parse_name (context, argv[i], &princ);
 182                 if (ret) {
 183                     krb5_warn (context, ret, "%s", argv[i]);
 184                     continue;
 185                 }
 186                 if (krb5_principal_compare (context, princ, entry.principal))
 187                     add = 1;
 188
 189                 krb5_free_principal (context, princ);
 190             }
 191         }
 192
 193         if (add) {
 194             if (j >= max) {
 195                 void *tmp;
 196
 197                 max = max(max * 2, 1);
 198                 tmp = realloc (changeset, max * sizeof(*changeset));
 199                 if (tmp == NULL) {
 200                     krb5_kt_free_entry (context, &entry);
 201                     krb5_warnx (context, "realloc: out of memory");
 202                     ret = ENOMEM;
 203                     break;
 204                 }
 205                 changeset = tmp;
 206             }
 207             ret = krb5_copy_principal (context, entry.principal,
 208                                        &changeset[j].principal);
 209             if (ret) {
 210                 krb5_warn (context, ret, "krb5_copy_principal");
 211                 krb5_kt_free_entry (context, &entry);
 212                 break;
 213             }
 214             changeset[j].kvno = entry.vno;
 215             ++j;
 216         }
 217         krb5_kt_free_entry (context, &entry);
 218     }
 219     krb5_kt_end_seq_get(context, keytab, &cursor);
 220
 221     if (ret == KRB5_KT_END) {
 222         ret = 0;
 223         for (i = 0; i < j; i++) {
 224             if (verbose_flag) {
 225                 char *client_name;
 226
 227                 ret = krb5_unparse_name (context, changeset[i].principal,
 228                                          &client_name);
 229                 if (ret) {
 230                     krb5_warn (context, ret, "krb5_unparse_name");
 231                 } else {
 232                     printf("Changing %s kvno %d\n",
 233                            client_name, changeset[i].kvno);
 234                     free(client_name);
 235                 }
 236             }
 237             ret = change_entry (keytab,
 238                                 changeset[i].principal, changeset[i].kvno,
 239                                 opt->realm_string,
 240                                 opt->admin_server_string,
 241                                 opt->server_port_integer);
 242             if (ret != 0)
 243                 errors = 1;
 244         }
 245     } else
 246         errors = 1;
 247     for (i = 0; i < j; i++)
 248         krb5_free_principal (context, changeset[i].principal);
 249     free (changeset);
 250
 251  out:
 252     krb5_kt_close(context, keytab);
 253     return errors;
 254 }