Line data Source code
1 : /*
2 : * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
3 : * (Royal Institute of Technology, Stockholm, Sweden).
4 : * All rights reserved.
5 : *
6 : * Redistribution and use in source and binary forms, with or without
7 : * modification, are permitted provided that the following conditions
8 : * are met:
9 : *
10 : * 1. Redistributions of source code must retain the above copyright
11 : * notice, this list of conditions and the following disclaimer.
12 : *
13 : * 2. Redistributions in binary form must reproduce the above copyright
14 : * notice, this list of conditions and the following disclaimer in the
15 : * documentation and/or other materials provided with the distribution.
16 : *
17 : * 3. Neither the name of the Institute nor the names of its contributors
18 : * may be used to endorse or promote products derived from this software
19 : * without specific prior written permission.
20 : *
21 : * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 : * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 : * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 : * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 : * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 : * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 : * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 : * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 : * SUCH DAMAGE.
32 : */
33 :
34 : #include "kdc_locl.h"
35 :
36 : struct timeval _kdc_now;
37 :
38 : krb5_error_code
39 248978 : _kdc_db_fetch(krb5_context context,
40 : krb5_kdc_configuration *config,
41 : krb5_const_principal principal,
42 : unsigned flags,
43 : krb5uint32 *kvno_ptr,
44 : HDB **db,
45 : hdb_entry_ex **h)
46 : {
47 : hdb_entry_ex *ent;
48 248978 : krb5_error_code ret = HDB_ERR_NOENTRY;
49 : int i;
50 248978 : unsigned kvno = 0;
51 248978 : krb5_principal enterprise_principal = NULL;
52 : krb5_const_principal princ;
53 :
54 248978 : *h = NULL;
55 :
56 248978 : if (kvno_ptr) {
57 41831 : kvno = *kvno_ptr;
58 41831 : flags |= HDB_F_KVNO_SPECIFIED;
59 : }
60 :
61 248978 : ent = calloc(1, sizeof (*ent));
62 248978 : if (ent == NULL)
63 0 : return krb5_enomem(context);
64 :
65 248978 : if (principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
66 11718 : if (principal->name.name_string.len != 1) {
67 0 : ret = KRB5_PARSE_MALFORMED;
68 0 : krb5_set_error_message(context, ret,
69 : "malformed request: "
70 : "enterprise name with %d name components",
71 : principal->name.name_string.len);
72 0 : goto out;
73 : }
74 11718 : ret = krb5_parse_name(context, principal->name.name_string.val[0],
75 : &enterprise_principal);
76 11718 : if (ret)
77 0 : goto out;
78 : }
79 :
80 244546 : for (i = 0; i < config->num_db; i++) {
81 248978 : ret = config->db[i]->hdb_open(context, config->db[i], O_RDONLY, 0);
82 248978 : if (ret) {
83 0 : const char *msg = krb5_get_error_message(context, ret);
84 0 : kdc_log(context, config, 0, "Failed to open database: %s", msg);
85 0 : krb5_free_error_message(context, msg);
86 0 : continue;
87 : }
88 :
89 248978 : princ = principal;
90 248978 : if (!(config->db[i]->hdb_capability_flags & HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL) && enterprise_principal)
91 0 : princ = enterprise_principal;
92 :
93 491830 : ret = config->db[i]->hdb_fetch_kvno(context,
94 242852 : config->db[i],
95 : princ,
96 : flags | HDB_F_DECRYPT,
97 : kvno,
98 : ent);
99 248978 : config->db[i]->hdb_close(context, config->db[i]);
100 :
101 248978 : switch (ret) {
102 244164 : case HDB_ERR_WRONG_REALM:
103 : /*
104 : * the ent->entry.principal just contains hints for the client
105 : * to retry. This is important for enterprise principal routing
106 : * between trusts.
107 : */
108 : /* fall through */
109 : case 0:
110 244164 : if (db)
111 82280 : *db = config->db[i];
112 244164 : *h = ent;
113 244164 : ent = NULL;
114 244164 : goto out;
115 :
116 1694 : case HDB_ERR_NOENTRY:
117 : /* Check the other databases */
118 1694 : continue;
119 :
120 3120 : default:
121 : /*
122 : * This is really important, because errors like
123 : * HDB_ERR_NOT_FOUND_HERE (used to indicate to Samba that
124 : * the RODC on which this code is running does not have
125 : * the key we need, and so a proxy to the KDC is required)
126 : * have specific meaning, and need to be propogated up.
127 : */
128 3120 : goto out;
129 : }
130 : }
131 :
132 1694 : if (ret == HDB_ERR_NOENTRY) {
133 1694 : krb5_set_error_message(context, ret, "no such entry found in hdb");
134 : }
135 248978 : out:
136 248978 : krb5_free_principal(context, enterprise_principal);
137 248978 : free(ent);
138 248978 : return ret;
139 : }
140 :
141 : void
142 243862 : _kdc_free_ent(krb5_context context, hdb_entry_ex *ent)
143 : {
144 243862 : hdb_free_entry (context, ent);
145 243862 : free (ent);
146 243862 : }
147 :
148 : /*
149 : * Use the order list of preferred encryption types and sort the
150 : * available keys and return the most preferred key.
151 : */
152 :
153 : krb5_error_code
154 26343 : _kdc_get_preferred_key(krb5_context context,
155 : krb5_kdc_configuration *config,
156 : hdb_entry_ex *h,
157 : const char *name,
158 : krb5_enctype *enctype,
159 : Key **key)
160 : {
161 : krb5_error_code ret;
162 : int i;
163 :
164 26343 : if (config->use_strongest_server_key) {
165 26343 : const krb5_enctype *p = krb5_kerberos_enctypes(context);
166 :
167 35471 : for (i = 0; p[i] != ETYPE_NULL; i++) {
168 35471 : if (krb5_enctype_valid(context, p[i]) != 0)
169 0 : continue;
170 35471 : ret = hdb_enctype2key(context, &h->entry, p[i], key);
171 35471 : if (ret != 0)
172 9128 : continue;
173 26343 : if (enctype != NULL)
174 26343 : *enctype = p[i];
175 25753 : return 0;
176 : }
177 : } else {
178 0 : *key = NULL;
179 :
180 0 : for (i = 0; i < h->entry.keys.len; i++) {
181 0 : if (krb5_enctype_valid(context, h->entry.keys.val[i].key.keytype)
182 : != 0)
183 0 : continue;
184 0 : ret = hdb_enctype2key(context, &h->entry,
185 0 : h->entry.keys.val[i].key.keytype, key);
186 0 : if (ret != 0)
187 0 : continue;
188 0 : if (enctype != NULL)
189 0 : *enctype = (*key)->key.keytype;
190 0 : return 0;
191 : }
192 : }
193 :
194 0 : krb5_set_error_message(context, EINVAL,
195 : "No valid kerberos key found for %s", name);
196 0 : return EINVAL; /* XXX */
197 : }
198 :
|