[2433] in Kerberos
kdb5_edit extract_srvtab brain-damaged
daemon@ATHENA.MIT.EDU (Jonathan I. Kamens)
Mon Dec 7 18:31:39 1992
Date: 7 Dec 1992 20:48:57 GMT
From: jik@Athena.MIT.EDU (Jonathan I. Kamens)
To: kerberos@shelby.Stanford.EDU
The kdb5_edit version of extract_srvtab is broken in two different ways: (1) It
thinks that principals contain a single-component aname and single-component
instance, a la V4; (2) It doesn't allow keys for different "instances" to be
written to the same file. The latter is especially necessary if you're going
to be running V4 compatibility mode in the server and therefore need some
V4-style keys in the default srvtab and some V5-style keys (i.e.,
first-hostname-component instances vs. FDQN instances).
This patch adds a new function, new_extract_srvtab. I think it should actually
be the default, but I'm not going to replace the default because that might
mess people up.
Apply in src/admin/edit.
*** 1.2 1992/12/07 15:13:07
--- kdb5_edit.c 1992/12/07 20:36:28
***************
*** 740,745 ****
--- 740,882 ----
}
void
+ new_extract_srvtab(argc, argv)
+ int argc;
+ char *argv[];
+ {
+ char ktname[MAXPATHLEN+sizeof("WRFILE:")+1], *ktnameptr = 0;
+ krb5_keytab ktid;
+ krb5_error_code retval;
+ krb5_principal princ;
+ krb5_db_entry dbentry;
+ char *pname;
+ register int i;
+ int nentries;
+ krb5_boolean more;
+ krb5_keytab_entry newentry;
+ char *subsysname = argv[0];
+ static int srvtab_number = 0;
+
+ argv++, argc--;
+
+ while (argc && **argv == '-') {
+ if (! strcmp(&argv[0][1], "file")) {
+ argv++, argc--;
+ if (! argc) {
+ com_err(subsysname, 0, "Missing argument after '-file'");
+ goto usage;
+ }
+ ktnameptr = argv[0];
+ argv++, argc--;
+ }
+ else {
+ goto usage;
+ }
+ }
+
+ if (! argc) {
+ goto usage;
+ }
+
+ if (!dbactive) {
+ com_err(subsysname, 0, Err_no_database);
+ return;
+ }
+ if (!valid_master_key) {
+ com_err(subsysname, 0, Err_no_master_msg);
+ return;
+ }
+
+ memset(ktname, 0, sizeof(ktname));
+ strcpy(ktname, "WRFILE:");
+ if (ktnameptr) {
+ if (strlen(ktnameptr) + strlen(ktname) + 1 > sizeof(ktname)) {
+ com_err(subsysname, 0, "File name '%s' is too long",
+ ktnameptr);
+ return;
+ }
+ strcat(ktname, ktnameptr);
+ }
+ else {
+ (void) sprintf(&ktname[strlen(ktname)], "new-srvtab-%d",
+ srvtab_number++);
+ }
+
+ if (retval = krb5_kt_resolve(ktname, &ktid)) {
+ com_err(subsysname, retval, "while resolving keytab name '%s'",
+ ktname);
+ return;
+ }
+
+ for (; argc; argc--, argv++) {
+ /* iterate over the names */
+ pname = malloc(strlen(*argv) + strlen(cur_realm)+2);
+ if (!pname) {
+ com_err(subsysname, ENOMEM,
+ "while preparing to extract key for %s", *argv);
+ continue;
+ }
+ strcpy(pname, *argv);
+ if (!strchr(*argv, REALM_SEP)) {
+ strcat(pname, REALM_SEP_STR);
+ strcat(pname, cur_realm);
+ }
+
+ if (retval = krb5_parse_name(pname, &princ)) {
+ com_err(subsysname, retval, "while parsing '%s'", pname);
+ free(pname);
+ continue;
+ }
+ nentries = 1;
+ if (retval = krb5_db_get_principal(princ, &dbentry, &nentries,
+ &more)) {
+ com_err(subsysname, retval, "while retrieving '%s'", pname);
+ goto cleanmost;
+ } else if (more) {
+ com_err(subsysname, KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE,
+ "while retrieving '%s'", pname);
+ if (nentries)
+ krb5_db_free_principal(&dbentry, nentries);
+ goto cleanmost;
+ } else if (!nentries) {
+ com_err(subsysname, KRB5_KDB_NOENTRY, "while retrieving '%s'",
+ pname);
+ goto cleanmost;
+ }
+ if (retval = krb5_kdb_decrypt_key(&master_encblock,
+ &dbentry.key,
+ &newentry.key)) {
+ com_err(subsysname, retval, "while decrypting key for '%s'",
+ pname);
+ goto cleanall;
+ }
+ newentry.principal = princ;
+ newentry.vno = dbentry.kvno;
+ if (retval = krb5_kt_add_entry(ktid, &newentry)) {
+ com_err(subsysname, retval, "while adding key to keytab '%s'",
+ ktname);
+ } else
+ printf("'%s' added to keytab '%s'\n",
+ pname, ktname);
+ memset((char *)newentry.key.contents, 0, newentry.key.length);
+ xfree(newentry.key.contents);
+ cleanall:
+ krb5_db_free_principal(&dbentry, nentries);
+ cleanmost:
+ free(pname);
+ krb5_free_principal(princ);
+ }
+ if (retval = krb5_kt_close(ktid))
+ com_err(subsysname, retval, "while closing keytab");
+ return;
+
+ usage:
+ com_err(subsysname, 0, "Usage: %s [ -file srvtab-file ] principal ...",
+ subsysname);
+ return;
+ }
+
+ void
extract_v4_srvtab(argc, argv)
int argc;
char *argv[];
*** 5.11 1991/06/06 09:25:28
--- kdb5_ed_ct.ct 1992/12/07 20:32:30
***************
*** 51,56 ****
--- 51,59 ----
request extract_srvtab, "Extract service key table",
extract_srvtab, xst, ex_st;
+ request new_extract_srvtab, "Extract service key table",
+ new_extract_srvtab, nxst, n_ex_st;
+
request extract_v4_srvtab, "Extract service key table",
extract_v4_srvtab, xst4;
--
Jonathan Kamens jik@MIT.Edu
MIT Information Systems/Athena Moderator, news.answers
