[2907] in Kerberos-V5-bugs
krb5-libs/575: More hacks to help transition from krb4
daemon@ATHENA.MIT.EDU (ghudson@MIT.EDU)
Wed Mar 25 11:54:12 1998
Resent-From: gnats@rt-11.MIT.EDU (GNATS Management)
Resent-To: krb5-unassigned@RT-11.MIT.EDU
Resent-Reply-To: krb5-bugs@MIT.EDU, ghudson@MIT.EDU
Date: Wed, 25 Mar 1998 11:53:49 -0500
From: ghudson@MIT.EDU
Reply-To: ghudson@MIT.EDU
To: krb5-bugs@MIT.EDU
>Number: 575
>Category: krb5-libs
>Synopsis: SRVTAB and ANY keytab types
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: krb5-unassigned
>State: open
>Class: change-request
>Submitter-Id: unknown
>Arrival-Date: Wed Mar 25 11:54:00 EST 1998
>Last-Modified:
>Originator: Greg Hudson
>Organization:
MIT
>Release: 1.0pl1
>Environment:
System: SunOS small-gods 5.5.1 Generic_103640-12 sun4u sparc SUNW,Ultra-1
Architecture: sun4
>Description:
It is inconvenient for the krb4 to krb5 upgrade to require that machines
update their srvtab files to keytab files. There may be complicated
procedures in place for the distribution of srvtab files, and it may be
difficult to give instructions to people who may be running krb4 or krb5
without knowing which.
>How-To-Repeat:
>Fix:
My proposal is to implement two new keytab types, SRVTAB and ANY. The
SRVTAB type can read a krb4 srvtab file, while the ANY type tries to
resolve several keytab specifications in turn, picking the first one
which does not return ENOENT. In the Athena environment, we will set
the default keytab to:
ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/athena/srvtab
which will read a krb5 keytab if it exists or a krb4 srvtab if not.
This patch (against the 1.0 distribution) includes a few changes to
existing files:
* Makefile.in, keytab/Makefile.in, and keytab/configure.in need
to know about two new directories.
* keytab/ktbase.c needs to know about the new keytab types. I
also changed it from using krb5_dfl_ops to the equivalent
krb5_ktf_ops for consistency.
* keytab/file/ktf_resolv.c needs to check if the keytab file can
be opened for reading so that we can detect at resolve time
when a keytab file doesn't exist.
I believe all of these changes to be appropriate for the krb5
distribution. Some notes, though:
* I did not implement serialization or write access for the
SRVTAB type. If one were to implement write access a la
WRFILE, then a lot of the code in ktutil could go away.
As it stands (with no modifications to kutil), you can
"rkt SRVTAB:/etc/athena/srvtab" instead of
"rst /etc/athena/srvtab", which is sort of neat.
* The SRVTAB keytab type may want to be conditional on
KRB5_KRB4_COMPAT. Since that's tied into the build system,
I didn't try to do that. The only ifdef required in the
source itself would presumably be in keytab/ktbase.c;
beyond that you'd just need to avoid building keytab/srvtab
to prevent the library bloat.
Index: Makefile.in
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/krb5/src/lib/krb5/Makefile.in,v
retrieving revision 1.1.1.2
diff -c -r1.1.1.2 Makefile.in
*** Makefile.in 1997/01/21 09:28:32 1.1.1.2
--- Makefile.in 1998/03/17 20:59:48
***************
*** 8,20 ****
MAC_SUBDIRS = error_tables asn.1 ccache keytab krb rcache free os posix
LIB_SUBDIRS= error_tables asn.1 ccache ccache/stdio ccache/file ccache/memory \
! keytab keytab/file krb rcache free os posix \
$(BUILDTOP)/util/profile
LIBUPDATE= $(BUILDTOP)/util/libupdate
LIBDONE= error_tables/DONE asn.1/DONE ccache/DONE ccache/stdio/DONE \
ccache/file/DONE ccache/memory/DONE keytab/DONE \
! keytab/file/DONE krb/DONE rcache/DONE free/DONE os/DONE \
! posix/DONE $(BUILDTOP)/util/profile/DONE
#
CRYPTO_VER=@CRYPTO_SH_VERS@
--- 8,21 ----
MAC_SUBDIRS = error_tables asn.1 ccache keytab krb rcache free os posix
LIB_SUBDIRS= error_tables asn.1 ccache ccache/stdio ccache/file ccache/memory \
! keytab keytab/file keytab/srvtab keytab/any krb rcache free os posix \
$(BUILDTOP)/util/profile
LIBUPDATE= $(BUILDTOP)/util/libupdate
LIBDONE= error_tables/DONE asn.1/DONE ccache/DONE ccache/stdio/DONE \
ccache/file/DONE ccache/memory/DONE keytab/DONE \
! keytab/file/DONE keytab/srvtab/DONE keytab/any/DONE \
! krb/DONE rcache/DONE free/DONE os/DONE posix/DONE \
! $(BUILDTOP)/util/profile/DONE
#
CRYPTO_VER=@CRYPTO_SH_VERS@
Index: keytab/Makefile.in
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/krb5/src/lib/krb5/keytab/Makefile.in,v
retrieving revision 1.1.1.1
diff -c -r1.1.1.1 Makefile.in
*** Makefile.in 1996/09/12 04:44:54 1.1.1.1
--- Makefile.in 1998/03/17 18:27:52
***************
*** 3,9 ****
##DOSBUILDTOP = ..\..\..
##DOSLIBNAME=..\krb5.lib
! MAC_SUBDIRS = file
.c.o:
$(CC) $(CFLAGS) -c $(srcdir)/$*.c
--- 3,9 ----
##DOSBUILDTOP = ..\..\..
##DOSLIBNAME=..\krb5.lib
! MAC_SUBDIRS = file srvtab
.c.o:
$(CC) $(CFLAGS) -c $(srcdir)/$*.c
Index: keytab/configure.in
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/krb5/src/lib/krb5/keytab/configure.in,v
retrieving revision 1.1.1.1
diff -c -r1.1.1.1 configure.in
*** configure.in 1996/09/12 04:44:54 1.1.1.1
--- configure.in 1998/03/17 19:09:02
***************
*** 1,6 ****
AC_INIT(configure.in)
CONFIG_RULES
! CONFIG_DIRS(file)
AC_PROG_ARCHIVE
AC_PROG_ARCHIVE_ADD
AC_PROG_RANLIB
--- 1,6 ----
AC_INIT(configure.in)
CONFIG_RULES
! CONFIG_DIRS(file srvtab any)
AC_PROG_ARCHIVE
AC_PROG_ARCHIVE_ADD
AC_PROG_RANLIB
Index: keytab/ktbase.c
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/krb5/src/lib/krb5/keytab/ktbase.c,v
retrieving revision 1.1.1.1
diff -c -r1.1.1.1 ktbase.c
*** ktbase.c 1996/09/12 04:44:54 1.1.1.1
--- ktbase.c 1998/03/17 21:03:03
***************
*** 26,38 ****
#include "k5-int.h"
struct krb5_kt_typelist
{
krb5_kt_ops *ops;
struct krb5_kt_typelist *next;
};
! static struct krb5_kt_typelist krb5_kt_typelist_dfl = { &krb5_kt_dfl_ops, 0 };
! static struct krb5_kt_typelist *kt_typehead = &krb5_kt_typelist_dfl;
/*
* Register a new key table type
--- 26,53 ----
#include "k5-int.h"
+ extern krb5_kt_ops krb5_ktf_ops;
+ extern krb5_kt_ops krb5_kts_ops;
+ extern krb5_kt_ops krb5_kta_ops;
+
struct krb5_kt_typelist
{
krb5_kt_ops *ops;
struct krb5_kt_typelist *next;
};
! static struct krb5_kt_typelist krb5_kt_typelist_file = {
! &krb5_ktf_ops,
! 0
! };
! static struct krb5_kt_typelist krb5_kt_typelist_srvtab = {
! &krb5_kts_ops,
! &krb5_kt_typelist_file
! };
! static struct krb5_kt_typelist krb5_kt_typelist_any = {
! &krb5_kta_ops,
! &krb5_kt_typelist_srvtab
! };
! static struct krb5_kt_typelist *kt_typehead = &krb5_kt_typelist_any;
/*
* Register a new key table type
Index: keytab/any/Makefile.in
===================================================================
RCS file: Makefile.in
diff -N Makefile.in
*** /dev/null Tue Mar 17 16:00:23 1998
--- Makefile.in Tue Mar 17 16:23:36 1998
***************
*** 0 ****
--- 1,29 ----
+ CFLAGS = $(CCOPTS) $(DEFS)
+
+ ##DOSBUILDTOP = ..\..\..\..
+ ##DOSLIBNAME=..\..\krb5.lib
+
+ .c.o:
+ $(CC) $(CFLAGS) -c $(srcdir)/$*.c
+ @SHARED_RULE@
+
+ SRCS= \
+ $(srcdir)/kta_ops.c \
+ $(srcdir)/kta_resolv.c
+
+ OBJS = \
+ kta_ops.$(OBJEXT) \
+ kta_resolv.$(OBJEXT)
+
+ all-unix:: shared $(OBJS)
+ all-mac:: $(OBJS)
+ all-windows:: $(OBJS)
+
+ shared:
+ mkdir shared
+
+ clean-unix::
+ $(RM) shared/*
+
+ clean-mac::
+ clean-windows::
Index: keytab/any/configure.in
===================================================================
RCS file: configure.in
diff -N configure.in
*** /dev/null Tue Mar 17 16:00:23 1998
--- configure.in Tue Mar 17 14:08:51 1998
***************
*** 0 ****
--- 1,5 ----
+ AC_INIT(configure.in)
+ CONFIG_RULES
+ V5_SHARED_LIB_OBJS
+ SubdirLibraryRule([${OBJS}])
+ V5_AC_OUTPUT_MAKEFILE
Index: keytab/any/kta_ops.c
===================================================================
RCS file: kta_ops.c
diff -N kta_ops.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kta_ops.c Tue Mar 17 16:24:00 1998
***************
*** 0 ****
--- 1,43 ----
+ /*
+ * lib/krb5/keytab/any/kta_ops.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * krb5_kta_ops
+ */
+
+ #include "k5-int.h"
+ #include "ktany.h"
+
+ struct _krb5_kt_ops krb5_kta_ops = {
+ 0,
+ "ANY", /* Prefix -- this string should not appear anywhere else! */
+ krb5_ktany_resolve,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0,
+ 0
+ };
Index: keytab/any/kta_resolv.c
===================================================================
RCS file: kta_resolv.c
diff -N kta_resolv.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kta_resolv.c Tue Mar 17 16:23:50 1998
***************
*** 0 ****
--- 1,59 ----
+ /*
+ * lib/krb5/keytab/any/kta_resolv.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * This is an implementation specific resolver. It tries to resolve a
+ * list of keytab types in sequence and returns the first one which
+ * succeeds.
+ */
+
+ #include "k5-int.h"
+ #include "ktany.h"
+
+ krb5_error_code
+ krb5_ktany_resolve(context, name, id)
+ krb5_context context;
+ const char *name;
+ krb5_keytab *id;
+ {
+ char *buf, *p, *q;
+ krb5_error_code kerror;
+
+ /* Make a copy of name which we can modify. */
+ buf = malloc(strlen(name) + 1);
+ if (buf == NULL)
+ return(ENOMEM);
+ strcpy(buf, name);
+
+ p = buf;
+ while ((q = strchr(p, ',')) != NULL) {
+ *q = 0;
+ kerror = krb5_kt_resolve(context, p, id);
+ if (kerror != ENOENT) {
+ krb5_xfree(buf);
+ return(kerror);
+ }
+ p = q + 1;
+ }
+ krb5_xfree(buf);
+ return(krb5_kt_resolve(context, name + (p - buf), id));
+ }
Index: keytab/any/ktany.h
===================================================================
RCS file: ktany.h
diff -N ktany.h
*** /dev/null Tue Mar 17 16:00:23 1998
--- ktany.h Tue Mar 17 16:24:22 1998
***************
*** 0 ****
--- 1,39 ----
+ /*
+ * lib/krb5/keytab/any/ktany.h
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * This header file contains information needed by internal routines
+ * of the file-based ticket cache implementation.
+ */
+
+
+ #ifndef KRB5_KTANY__
+ #define KRB5_KTANY__
+
+ extern struct _krb5_kt_ops krb5_kta_ops;
+
+ krb5_error_code krb5_ktany_resolve
+ PROTOTYPE((krb5_context,
+ const char *,
+ krb5_keytab *));
+
+ #endif /* KRB5_KTANY__ */
Index: keytab/file/ktf_resolv.c
===================================================================
RCS file: /afs/dev.mit.edu/source/repository/third/krb5/src/lib/krb5/keytab/file/ktf_resolv.c,v
retrieving revision 1.1.1.1
diff -c -r1.1.1.1 ktf_resolv.c
*** ktf_resolv.c 1996/09/12 04:44:56 1.1.1.1
--- ktf_resolv.c 1998/03/17 19:03:59
***************
*** 35,40 ****
--- 35,47 ----
krb5_keytab *id;
{
krb5_ktfile_data *data;
+ FILE *fp;
+
+ /* Make sure we can open the keytab file for reading. */
+ fp = fopen(name, "r");
+ if (!fp)
+ return(errno);
+ fclose(fp);
if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL)
return(ENOMEM);
Index: keytab/srvtab/Makefile.in
===================================================================
RCS file: Makefile.in
diff -N Makefile.in
*** /dev/null Tue Mar 17 16:00:23 1998
--- Makefile.in Tue Mar 17 13:29:26 1998
***************
*** 0 ****
--- 1,43 ----
+ CFLAGS = $(CCOPTS) $(DEFS)
+
+ ##DOSBUILDTOP = ..\..\..\..
+ ##DOSLIBNAME=..\..\krb5.lib
+
+ .c.o:
+ $(CC) $(CFLAGS) -c $(srcdir)/$*.c
+ @SHARED_RULE@
+
+ SRCS= \
+ $(srcdir)/kts_close.c \
+ $(srcdir)/kts_endget.c \
+ $(srcdir)/kts_g_ent.c \
+ $(srcdir)/kts_g_name.c \
+ $(srcdir)/kts_next.c \
+ $(srcdir)/kts_ops.c \
+ $(srcdir)/kts_resolv.c \
+ $(srcdir)/kts_ssget.c \
+ $(srcdir)/kts_util.c
+
+ OBJS = \
+ kts_close.$(OBJEXT) \
+ kts_endget.$(OBJEXT) \
+ kts_g_ent.$(OBJEXT) \
+ kts_g_name.$(OBJEXT) \
+ kts_next.$(OBJEXT) \
+ kts_ops.$(OBJEXT) \
+ kts_resolv.$(OBJEXT) \
+ kts_ssget.$(OBJEXT) \
+ kts_util.$(OBJEXT)
+
+ all-unix:: shared $(OBJS)
+ all-mac:: $(OBJS)
+ all-windows:: $(OBJS)
+
+ shared:
+ mkdir shared
+
+ clean-unix::
+ $(RM) shared/*
+
+ clean-mac::
+ clean-windows::
Index: keytab/srvtab/configure.in
===================================================================
RCS file: configure.in
diff -N configure.in
*** /dev/null Tue Mar 17 16:00:23 1998
--- configure.in Tue Mar 17 11:00:42 1998
***************
*** 0 ****
--- 1,5 ----
+ AC_INIT(configure.in)
+ CONFIG_RULES
+ V5_SHARED_LIB_OBJS
+ SubdirLibraryRule([${OBJS}])
+ V5_AC_OUTPUT_MAKEFILE
Index: keytab/srvtab/kts_close.c
===================================================================
RCS file: kts_close.c
diff -N kts_close.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_close.c Tue Mar 17 14:17:17 1998
***************
*** 0 ****
--- 1,48 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_close.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * "Close" a file-based keytab and invalidate the id. This means
+ * free memory hidden in the structures.
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ krb5_error_code
+ krb5_ktsrvtab_close(context, id)
+ krb5_context context;
+ krb5_keytab id;
+ /*
+ * This routine is responsible for freeing all memory allocated
+ * for this keytab. There are no system resources that need
+ * to be freed nor are there any open files.
+ *
+ * This routine should undo anything done by krb5_ktsrvtab_resolve().
+ */
+ {
+ krb5_xfree(KTFILENAME(id));
+ krb5_xfree(id->data);
+ id->ops = 0;
+ krb5_xfree(id);
+ return (0);
+ }
Index: keytab/srvtab/kts_endget.c
===================================================================
RCS file: kts_endget.c
diff -N kts_endget.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_endget.c Tue Mar 17 14:24:41 1998
***************
*** 0 ****
--- 1,38 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_endget.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * krb5_ktsrvtab_end_get()
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ krb5_error_code
+ krb5_ktsrvtab_end_get(context, id, cursor)
+ krb5_context context;
+ krb5_keytab id;
+ krb5_kt_cursor *cursor;
+ {
+ krb5_xfree(*cursor);
+ return krb5_ktsrvint_close(context, id);
+ }
Index: keytab/srvtab/kts_g_ent.c
===================================================================
RCS file: kts_g_ent.c
diff -N kts_g_ent.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_g_ent.c Tue Mar 17 14:26:44 1998
***************
*** 0 ****
--- 1,102 ----
+ /*
+ * lib/krb5/keytab/file/kts_g_ent.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * This is the get_entry routine for the file based keytab implementation.
+ * It opens the keytab file, and either retrieves the entry or returns
+ * an error.
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ krb5_error_code
+ krb5_ktsrvtab_get_entry(context, id, principal, kvno, enctype, entry)
+ krb5_context context;
+ krb5_keytab id;
+ krb5_principal principal;
+ krb5_kvno kvno;
+ krb5_enctype enctype;
+ krb5_keytab_entry * entry;
+ {
+ krb5_keytab_entry best_entry, ent;
+ krb5_error_code kerror = 0;
+ int found_wrong_kvno = 0;
+
+ /* Open the srvtab. */
+ if ((kerror = krb5_ktsrvint_open(context, id)))
+ return(kerror);
+
+ /* srvtab files only have DES_CBC_CRC keys. */
+ switch (enctype) {
+ case ENCTYPE_DES_CBC_CRC:
+ case ENCTYPE_DES_CBC_MD5:
+ case ENCTYPE_DES_CBC_MD4:
+ case ENCTYPE_DES_CBC_RAW:
+ case IGNORE_ENCTYPE:
+ break;
+ default:
+ return KRB5_KT_NOTFOUND;
+ }
+
+ best_entry.principal = 0;
+ best_entry.vno = 0;
+ best_entry.key.contents = 0;
+ while ((kerror = krb5_ktsrvint_read_entry(context, id, &ent)) == 0) {
+ if (krb5_principal_compare(context, principal, ent.principal)) {
+ if (kvno == IGNORE_VNO) {
+ if (!best_entry.principal || (best_entry.vno < ent.vno)) {
+ krb5_kt_free_entry(context, &best_entry);
+ best_entry = ent;
+ }
+ } else {
+ if (ent.vno == kvno) {
+ best_entry = ent;
+ break;
+ } else {
+ found_wrong_kvno = 1;
+ }
+ }
+ } else {
+ krb5_kt_free_entry(context, &ent);
+ }
+ }
+ if (kerror == KRB5_KT_END) {
+ if (best_entry.principal)
+ kerror = 0;
+ else if (found_wrong_kvno)
+ kerror = KRB5_KT_KVNONOTFOUND;
+ else
+ kerror = KRB5_KT_NOTFOUND;
+ }
+ if (kerror) {
+ (void) krb5_ktsrvint_close(context, id);
+ krb5_kt_free_entry(context, &best_entry);
+ return kerror;
+ }
+ if ((kerror = krb5_ktsrvint_close(context, id)) != 0) {
+ krb5_kt_free_entry(context, &best_entry);
+ return kerror;
+ }
+ *entry = best_entry;
+ return 0;
+ }
Index: keytab/srvtab/kts_g_name.c
===================================================================
RCS file: kts_g_name.c
diff -N kts_g_name.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_g_name.c Sun Mar 15 13:32:52 1998
***************
*** 0 ****
--- 1,58 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_g_name.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * Get the name of the file containing a srvtab-based keytab.
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ krb5_error_code
+ krb5_ktsrvtab_get_name(context, id, name, len)
+ krb5_context context;
+ krb5_keytab id;
+ char *name;
+ int len;
+ /*
+ * This routine returns the name of the name of the file associated with
+ * this srvtab-based keytab. The name is prefixed with PREFIX:, so that
+ * trt will happen if the name is passed back to resolve.
+ */
+ {
+ memset(name, 0, len);
+
+ if (len < strlen(id->ops->prefix)+2)
+ return(KRB5_KT_NAME_TOOLONG);
+ strcpy(name, id->ops->prefix);
+ name += strlen(id->ops->prefix);
+ name[0] = ':';
+ name++;
+ len -= strlen(id->ops->prefix)+1;
+
+ if (len < strlen(KTFILENAME(id)+1))
+ return(KRB5_KT_NAME_TOOLONG);
+ strcpy(name, KTFILENAME(id));
+ /* strcpy will NUL-terminate the destination */
+
+ return(0);
+ }
Index: keytab/srvtab/kts_next.c
===================================================================
RCS file: kts_next.c
diff -N kts_next.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_next.c Tue Mar 17 10:58:37 1998
***************
*** 0 ****
--- 1,48 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_next.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * krb5_ktsrvtab_get_next()
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ krb5_error_code
+ krb5_ktsrvtab_get_next(context, id, entry, cursor)
+ krb5_context context;
+ krb5_keytab id;
+ krb5_keytab_entry *entry;
+ krb5_kt_cursor *cursor;
+ {
+ long *fileoff = (long *)*cursor;
+ krb5_keytab_entry cur_entry;
+ krb5_error_code kerror;
+
+ if (fseek(KTFILEP(id), *fileoff, 0) == -1)
+ return KRB5_KT_END;
+ if ((kerror = krb5_ktsrvint_read_entry(context, id, &cur_entry)))
+ return kerror;
+ *fileoff = ftell(KTFILEP(id));
+ *entry = cur_entry;
+ return 0;
+ }
Index: keytab/srvtab/kts_ops.c
===================================================================
RCS file: kts_ops.c
diff -N kts_ops.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_ops.c Tue Mar 17 16:01:52 1998
***************
*** 0 ****
--- 1,43 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_ops.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * krb5_kts_ops
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ struct _krb5_kt_ops krb5_kts_ops = {
+ 0,
+ "SRVTAB", /* Prefix -- this string should not appear anywhere else! */
+ krb5_ktsrvtab_resolve,
+ krb5_ktsrvtab_get_name,
+ krb5_ktsrvtab_close,
+ krb5_ktsrvtab_get_entry,
+ krb5_ktsrvtab_start_seq_get,
+ krb5_ktsrvtab_get_next,
+ krb5_ktsrvtab_end_get,
+ 0,
+ 0,
+ 0
+ };
Index: keytab/srvtab/kts_resolv.c
===================================================================
RCS file: kts_resolv.c
diff -N kts_resolv.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_resolv.c Tue Mar 17 14:25:01 1998
***************
*** 0 ****
--- 1,69 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_resolv.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * This is an implementation specific resolver. It returns a keytab id
+ * initialized with srvtab keytab routines.
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ krb5_error_code
+ krb5_ktsrvtab_resolve(context, name, id)
+ krb5_context context;
+ const char *name;
+ krb5_keytab *id;
+ {
+ krb5_ktsrvtab_data *data;
+ FILE *fp;
+
+ /* Make sure we can open the srvtab file for reading. */
+ fp = fopen(name, "r");
+ if (!fp)
+ return(errno);
+ fclose(fp);
+
+ if ((*id = (krb5_keytab) malloc(sizeof(**id))) == NULL)
+ return(ENOMEM);
+
+ (*id)->ops = &krb5_kts_ops;
+ data = (krb5_ktsrvtab_data *)malloc(sizeof(krb5_ktsrvtab_data));
+ if (data == NULL) {
+ krb5_xfree(*id);
+ return(ENOMEM);
+ }
+
+ data->name = (char *)malloc(strlen(name) + 1);
+ if (data->name == NULL) {
+ krb5_xfree(data);
+ krb5_xfree(*id);
+ return(ENOMEM);
+ }
+
+ (void) strcpy(data->name, name);
+ data->openf = 0;
+
+ (*id)->data = (krb5_pointer)data;
+ (*id)->magic = KV5M_KEYTAB;
+ return(0);
+ }
Index: keytab/srvtab/kts_ssget.c
===================================================================
RCS file: kts_ssget.c
diff -N kts_ssget.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_ssget.c Tue Mar 17 16:03:42 1998
***************
*** 0 ****
--- 1,50 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_ssget.c
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * krb5_ktsrvtab_start_seq_get()
+ */
+
+ #include "k5-int.h"
+ #include "ktsrvtab.h"
+
+ krb5_error_code
+ krb5_ktsrvtab_start_seq_get(context, id, cursorp)
+ krb5_context context;
+ krb5_keytab id;
+ krb5_kt_cursor *cursorp;
+ {
+ krb5_error_code retval;
+ long *fileoff;
+
+ if ((retval = krb5_ktsrvint_open(context, id)))
+ return retval;
+
+ if (!(fileoff = (long *)malloc(sizeof(*fileoff)))) {
+ krb5_ktsrvint_close(context, id);
+ return ENOMEM;
+ }
+ *fileoff = ftell(KTFILEP(id));
+ *cursorp = (krb5_kt_cursor)fileoff;
+
+ return 0;
+ }
Index: keytab/srvtab/kts_util.c
===================================================================
RCS file: kts_util.c
diff -N kts_util.c
*** /dev/null Tue Mar 17 16:00:23 1998
--- kts_util.c Tue Mar 17 16:17:44 1998
***************
*** 0 ****
--- 1,148 ----
+ /*
+ * lib/krb5/keytab/srvtab/kts_util.c
+ *
+ * Copyright (c) Hewlett-Packard Company 1991
+ * Released to the Massachusetts Institute of Technology for inclusion
+ * in the Kerberos source code distribution.
+ *
+ * Copyright 1990,1991 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * This function contains utilities for the srvtab based implementation
+ * of the keytab. There are no public functions in this file.
+ */
+
+ #define NEED_SOCKETS
+ #include "krb5.h"
+ #include "k5-int.h"
+ #include <stdio.h>
+
+ #include "ktsrvtab.h"
+
+ #ifdef ANSI_STDIO
+ #define READ_MODE "rb"
+ #else
+ #define READ_MODE "r"
+ #endif
+
+ /* The maximum sizes for V4 aname, realm, sname, and instance +1 */
+ /* Taken from krb.h */
+ #define ANAME_SZ 40
+ #define REALM_SZ 40
+ #define SNAME_SZ 40
+ #define INST_SZ 40
+
+ #ifndef HAVE_ERRNO
+ extern int errno;
+ #endif
+
+ static krb5_error_code
+ read_field(fp, s, len)
+ FILE *fp;
+ char *s;
+ int len;
+ {
+ int c, n = 0;
+
+ while ((c = getc(fp)) != 0) {
+ if (c == EOF || len <= 1)
+ return KRB5_KT_END;
+ *s = c;
+ s++;
+ len--;
+ }
+ *s = 0;
+ return 0;
+ }
+
+ krb5_error_code
+ krb5_ktsrvint_open(context, id)
+ krb5_context context;
+ krb5_keytab id;
+ {
+ KTFILEP(id) = fopen(KTFILENAME(id), READ_MODE);
+ if (!KTFILEP(id))
+ return errno;
+ return 0;
+ }
+
+ krb5_error_code
+ krb5_ktsrvint_close(context, id)
+ krb5_context context;
+ krb5_keytab id;
+ {
+ if (!KTFILEP(id))
+ return 0;
+ (void) fclose(KTFILEP(id));
+ KTFILEP(id) = 0;
+ }
+
+ krb5_error_code
+ krb5_ktsrvint_read_entry(context, id, ret_entry)
+ krb5_context context;
+ krb5_keytab id;
+ krb5_keytab_entry *ret_entry;
+ {
+ FILE *fp;
+ char name[SNAME_SZ], instance[INST_SZ], realm[REALM_SZ];
+ unsigned char key[8];
+ int vno;
+ krb5_error_code kerror;
+
+ /* Read in an entry from the srvtab file. */
+ fp = KTFILEP(id);
+ kerror = read_field(fp, name, sizeof(name));
+ if (kerror != 0)
+ return kerror;
+ kerror = read_field(fp, instance, sizeof(instance));
+ if (kerror != 0)
+ return kerror;
+ kerror = read_field(fp, realm, sizeof(realm));
+ if (kerror != 0)
+ return kerror;
+ vno = getc(fp);
+ if (vno == EOF)
+ return KRB5_KT_END;
+ if (fread(key, 1, sizeof(key), fp) != sizeof(key))
+ return KRB5_KT_END;
+
+ /* Fill in ret_entry with the data we read. Everything maps well
+ * except for the timestamp, which we don't have a value for. For
+ * now we just set it to 0. */
+ memset(ret_entry, 0, sizeof(*ret_entry));
+ ret_entry->magic = KV5M_KEYTAB_ENTRY;
+ kerror = krb5_425_conv_principal(context, name, instance, realm,
+ &ret_entry->principal);
+ if (kerror != 0)
+ return kerror;
+ ret_entry->vno = vno;
+ ret_entry->timestamp = 0;
+ ret_entry->key.enctype = ENCTYPE_DES_CBC_CRC;
+ ret_entry->key.magic = KV5M_KEYBLOCK;
+ ret_entry->key.length = sizeof(key);
+ ret_entry->key.contents = malloc(sizeof(key));
+ if (!ret_entry->key.contents) {
+ krb5_free_principal(context, ret_entry->principal);
+ return ENOMEM;
+ }
+ memcpy(ret_entry->key.contents, key, sizeof(key));
+
+ return 0;
+ }
Index: keytab/srvtab/ktsrvtab.h
===================================================================
RCS file: ktsrvtab.h
diff -N ktsrvtab.h
*** /dev/null Tue Mar 17 16:00:23 1998
--- ktsrvtab.h Tue Mar 17 15:44:20 1998
***************
*** 0 ****
--- 1,114 ----
+ /*
+ * lib/krb5/keytab/srvtab/ktsrvtab.h
+ *
+ * Copyright 1990 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * This header file contains information needed by internal routines
+ * of the file-based ticket cache implementation.
+ */
+
+
+ #ifndef KRB5_KTSRVTAB__
+ #define KRB5_KTSRVTAB__
+
+ #include <stdio.h>
+
+ /*
+ * Constants
+ */
+ #define IGNORE_VNO 0
+ #define IGNORE_ENCTYPE 0
+
+ #define KRB5_KT_VNO_1 0x0501 /* krb v5, keytab version 1 (DCE compat) */
+ #define KRB5_KT_VNO 0x0502 /* krb v5, keytab version 2 (standard) */
+
+ #define KRB5_KT_DEFAULT_VNO KRB5_KT_VNO
+
+ /*
+ * Types
+ */
+ typedef struct _krb5_ktsrvtab_data {
+ char *name; /* Name of the file */
+ FILE *openf; /* open file, if any. */
+ } krb5_ktsrvtab_data;
+
+ /*
+ * Macros
+ */
+ #define KTPRIVATE(id) ((krb5_ktsrvtab_data *)(id)->data)
+ #define KTFILENAME(id) (((krb5_ktsrvtab_data *)(id)->data)->name)
+ #define KTFILEP(id) (((krb5_ktsrvtab_data *)(id)->data)->openf)
+
+ extern struct _krb5_kt_ops krb5_kts_ops;
+
+ krb5_error_code krb5_ktsrvtab_resolve
+ PROTOTYPE((krb5_context,
+ const char *,
+ krb5_keytab *));
+
+ krb5_error_code krb5_ktsrvtab_get_name
+ PROTOTYPE((krb5_context,
+ krb5_keytab,
+ char *,
+ int));
+
+ krb5_error_code krb5_ktsrvtab_close
+ PROTOTYPE((krb5_context,
+ krb5_keytab));
+
+ krb5_error_code krb5_ktsrvtab_get_entry
+ PROTOTYPE((krb5_context,
+ krb5_keytab,
+ krb5_principal,
+ krb5_kvno,
+ krb5_enctype,
+ krb5_keytab_entry *));
+
+ krb5_error_code krb5_ktsrvtab_start_seq_get
+ PROTOTYPE((krb5_context,
+ krb5_keytab,
+ krb5_kt_cursor *));
+
+ krb5_error_code krb5_ktsrvtab_get_next
+ PROTOTYPE((krb5_context,
+ krb5_keytab,
+ krb5_keytab_entry *,
+ krb5_kt_cursor *));
+
+ krb5_error_code krb5_ktsrvtab_end_get
+ PROTOTYPE((krb5_context,
+ krb5_keytab,
+ krb5_kt_cursor *));
+
+ krb5_error_code krb5_ktsrvint_open
+ PROTOTYPE((krb5_context,
+ krb5_keytab));
+
+ krb5_error_code krb5_ktsrvint_close
+ PROTOTYPE((krb5_context,
+ krb5_keytab));
+
+ krb5_error_code krb5_ktsrvint_read_entry
+ PROTOTYPE((krb5_context,
+ krb5_keytab,
+ krb5_keytab_entry *));
+
+ #endif /* KRB5_KTSRVTAB__ */
*** End of Transaction ***
>Audit-Trail:
>Unformatted:
