LCOV - code coverage report
Current view: top level - source4/heimdal/kdc - misc.c (source / functions) Hit Total Coverage
Test: coverage report for abartlet/fix-coverage dd10fb34 Lines: 54 78 69.2 %
Date: 2021-09-23 10:06:22 Functions: 3 3 100.0 %

          Line data    Source code
       1             : /*
       2             :  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
       3             :  * (Royal Institute of Technology, Stockholm, Sweden).
       4             :  * All rights reserved.
       5             :  *
       6             :  * Redistribution and use in source and binary forms, with or without
       7             :  * modification, are permitted provided that the following conditions
       8             :  * are met:
       9             :  *
      10             :  * 1. Redistributions of source code must retain the above copyright
      11             :  *    notice, this list of conditions and the following disclaimer.
      12             :  *
      13             :  * 2. Redistributions in binary form must reproduce the above copyright
      14             :  *    notice, this list of conditions and the following disclaimer in the
      15             :  *    documentation and/or other materials provided with the distribution.
      16             :  *
      17             :  * 3. Neither the name of the Institute nor the names of its contributors
      18             :  *    may be used to endorse or promote products derived from this software
      19             :  *    without specific prior written permission.
      20             :  *
      21             :  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
      22             :  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
      23             :  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
      24             :  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
      25             :  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
      26             :  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
      27             :  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
      28             :  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
      29             :  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
      30             :  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
      31             :  * SUCH DAMAGE.
      32             :  */
      33             : 
      34             : #include "kdc_locl.h"
      35             : 
      36             : struct timeval _kdc_now;
      37             : 
      38             : krb5_error_code
      39      248978 : _kdc_db_fetch(krb5_context context,
      40             :               krb5_kdc_configuration *config,
      41             :               krb5_const_principal principal,
      42             :               unsigned flags,
      43             :               krb5uint32 *kvno_ptr,
      44             :               HDB **db,
      45             :               hdb_entry_ex **h)
      46             : {
      47             :     hdb_entry_ex *ent;
      48      248978 :     krb5_error_code ret = HDB_ERR_NOENTRY;
      49             :     int i;
      50      248978 :     unsigned kvno = 0;
      51      248978 :     krb5_principal enterprise_principal = NULL;
      52             :     krb5_const_principal princ;
      53             : 
      54      248978 :     *h = NULL;
      55             : 
      56      248978 :     if (kvno_ptr) {
      57       41831 :             kvno = *kvno_ptr;
      58       41831 :             flags |= HDB_F_KVNO_SPECIFIED;
      59             :     }
      60             : 
      61      248978 :     ent = calloc(1, sizeof (*ent));
      62      248978 :     if (ent == NULL)
      63           0 :         return krb5_enomem(context);
      64             : 
      65      248978 :     if (principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
      66       11718 :         if (principal->name.name_string.len != 1) {
      67           0 :             ret = KRB5_PARSE_MALFORMED;
      68           0 :             krb5_set_error_message(context, ret,
      69             :                                    "malformed request: "
      70             :                                    "enterprise name with %d name components",
      71             :                                    principal->name.name_string.len);
      72           0 :             goto out;
      73             :         }
      74       11718 :         ret = krb5_parse_name(context, principal->name.name_string.val[0],
      75             :                               &enterprise_principal);
      76       11718 :         if (ret)
      77           0 :             goto out;
      78             :     }
      79             : 
      80      244546 :     for (i = 0; i < config->num_db; i++) {
      81      248978 :         ret = config->db[i]->hdb_open(context, config->db[i], O_RDONLY, 0);
      82      248978 :         if (ret) {
      83           0 :             const char *msg = krb5_get_error_message(context, ret);
      84           0 :             kdc_log(context, config, 0, "Failed to open database: %s", msg);
      85           0 :             krb5_free_error_message(context, msg);
      86           0 :             continue;
      87             :         }
      88             : 
      89      248978 :         princ = principal;
      90      248978 :         if (!(config->db[i]->hdb_capability_flags & HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL) && enterprise_principal)
      91           0 :             princ = enterprise_principal;
      92             : 
      93      491830 :         ret = config->db[i]->hdb_fetch_kvno(context,
      94      242852 :                                             config->db[i],
      95             :                                             princ,
      96             :                                             flags | HDB_F_DECRYPT,
      97             :                                             kvno,
      98             :                                             ent);
      99      248978 :         config->db[i]->hdb_close(context, config->db[i]);
     100             : 
     101      248978 :         switch (ret) {
     102      244164 :         case HDB_ERR_WRONG_REALM:
     103             :             /*
     104             :              * the ent->entry.principal just contains hints for the client
     105             :              * to retry. This is important for enterprise principal routing
     106             :              * between trusts.
     107             :              */
     108             :             /* fall through */
     109             :         case 0:
     110      244164 :             if (db)
     111       82280 :                 *db = config->db[i];
     112      244164 :             *h = ent;
     113      244164 :             ent = NULL;
     114      244164 :             goto out;
     115             : 
     116        1694 :         case HDB_ERR_NOENTRY:
     117             :             /* Check the other databases */
     118        1694 :             continue;
     119             : 
     120        3120 :         default:
     121             :             /* 
     122             :              * This is really important, because errors like
     123             :              * HDB_ERR_NOT_FOUND_HERE (used to indicate to Samba that
     124             :              * the RODC on which this code is running does not have
     125             :              * the key we need, and so a proxy to the KDC is required)
     126             :              * have specific meaning, and need to be propogated up.
     127             :              */
     128        3120 :             goto out;
     129             :         }
     130             :     }
     131             : 
     132        1694 :     if (ret == HDB_ERR_NOENTRY) {
     133        1694 :         krb5_set_error_message(context, ret, "no such entry found in hdb");
     134             :     }
     135      248978 : out:
     136      248978 :     krb5_free_principal(context, enterprise_principal);
     137      248978 :     free(ent);
     138      248978 :     return ret;
     139             : }
     140             : 
     141             : void
     142      243862 : _kdc_free_ent(krb5_context context, hdb_entry_ex *ent)
     143             : {
     144      243862 :     hdb_free_entry (context, ent);
     145      243862 :     free (ent);
     146      243862 : }
     147             : 
     148             : /*
     149             :  * Use the order list of preferred encryption types and sort the
     150             :  * available keys and return the most preferred key.
     151             :  */
     152             : 
     153             : krb5_error_code
     154       26343 : _kdc_get_preferred_key(krb5_context context,
     155             :                        krb5_kdc_configuration *config,
     156             :                        hdb_entry_ex *h,
     157             :                        const char *name,
     158             :                        krb5_enctype *enctype,
     159             :                        Key **key)
     160             : {
     161             :     krb5_error_code ret;
     162             :     int i;
     163             : 
     164       26343 :     if (config->use_strongest_server_key) {
     165       26343 :         const krb5_enctype *p = krb5_kerberos_enctypes(context);
     166             : 
     167       35471 :         for (i = 0; p[i] != ETYPE_NULL; i++) {
     168       35471 :             if (krb5_enctype_valid(context, p[i]) != 0)
     169           0 :                 continue;
     170       35471 :             ret = hdb_enctype2key(context, &h->entry, p[i], key);
     171       35471 :             if (ret != 0)
     172        9128 :                 continue;
     173       26343 :             if (enctype != NULL)
     174       26343 :                 *enctype = p[i];
     175       25753 :             return 0;
     176             :         }
     177             :     } else {
     178           0 :         *key = NULL;
     179             : 
     180           0 :         for (i = 0; i < h->entry.keys.len; i++) {
     181           0 :             if (krb5_enctype_valid(context, h->entry.keys.val[i].key.keytype)
     182             :                 != 0)
     183           0 :                 continue;
     184           0 :             ret = hdb_enctype2key(context, &h->entry,
     185           0 :                 h->entry.keys.val[i].key.keytype, key);
     186           0 :             if (ret != 0)
     187           0 :                 continue;
     188           0 :             if (enctype != NULL)
     189           0 :                 *enctype = (*key)->key.keytype;
     190           0 :             return 0;
     191             :         }
     192             :     }
     193             : 
     194           0 :     krb5_set_error_message(context, EINVAL,
     195             :                            "No valid kerberos key found for %s", name);
     196           0 :     return EINVAL; /* XXX */
     197             : }
     198             : 

Generated by: LCOV version 1.13