oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

hdb: Move virtual principals into HDB layer

Browse Source 
This is a large commit that adds several features:

 - Revamps and moves virtual host-based service principal functionality
   from kdc/ to lib/hdb/ so that it may be automatically visible to
   lib/kadm5/, as well as kadmin(1)/kadmind(8) and ktutil(1).

   The changes are backwards-incompatible.

 - Completes support for documenting a service principal's supported
   enctypes in its HDB entry independently of its long-term keys.  This
   will reduce HDB bloat by not requiring that service principals have
   more long-term keys than they need just to document the service's
   supported enctypes.

 - Adds support for storing krb5.conf content in principals' HDB
   entries.  This may eventually be used for causing Heimdal KDC
   services to reconfigure primary/secondary roles automatically by
   discovering the configured primary in an HDB entry for the realm.

   For now this will be used to help reduce the amount of configuration
   needed by clients of an upcoming HTTP binding of the kadmin service.
This commit is contained in:
Nicolas Williams
2020-08-24 16:16:59 -05:00
parent ef06b94132
commit 5447b81fb1
50 changed files with 4017 additions and 530 deletions
Download Patch File Download Diff File Expand all files Collapse all files

209
kadmin/ank.c
View File

@@ -34,6 +34,9 @@
#include "kadmin_locl.h"
#include "kadmin-commands.h"
/* No useful password policies for namespaces */
#define NSPOLICY "default"
/*
* fetch the default principal corresponding to `princ'
*/
@@ -308,3 +311,209 @@ add_new_key(struct add_options *opt, int argc, char **argv)
free(kstuple);
return ret != 0;
}
static krb5_error_code
kstuple2etypes(kadm5_principal_ent_rec *rec,
int *maskp,
size_t nkstuple,
krb5_key_salt_tuple *kstuple)
{
krb5_error_code ret;
HDB_EncTypeList etypes;
krb5_data buf;
size_t len, i;
etypes.len = 0;
if ((etypes.val = calloc(nkstuple, sizeof(etypes.val[0]))) == NULL)
return krb5_enomem(context);
for (i = 0; i < nkstuple; i++)
etypes.val[i] = kstuple[i].ks_enctype;
ASN1_MALLOC_ENCODE(HDB_EncTypeList, buf.data, buf.length,
&etypes, &len, ret);
if (ret == 0)
add_tl(rec, KRB5_TL_ETYPES, &buf);
free(etypes.val);
if (ret == 0)
(*maskp) |= KADM5_TL_DATA;
return ret;
}
/*
* Add the namespace `name' to the database.
* Prompt for all data not given by the input parameters.
*/
static krb5_error_code
add_one_namespace(const char *name,
size_t nkstuple,
krb5_key_salt_tuple *kstuple,
const char *max_ticket_life,
const char *max_renewable_life,
const char *key_rotation_epoch,
const char *key_rotation_period,
const char *attributes)
{
krb5_error_code ret;
kadm5_principal_ent_rec princ;
kadm5_principal_ent_rec *default_ent = NULL;
krb5_principal princ_ent = NULL;
int mask = 0;
int default_mask = 0;
HDB_extension ext;
krb5_data buf;
const char *comp0;
const char *comp1;
time_t kre;
char pwbuf[1024];
krb5_deltat krp;
if (!key_rotation_epoch) {
krb5_warnx(context, "key rotation epoch defaulted to \"now\"");
key_rotation_epoch = "now";
}
if (!key_rotation_period) {
krb5_warnx(context, "key rotation period defaulted to \"5d\"");
key_rotation_period = "5d";
}
if ((ret = str2time_t(key_rotation_epoch, &kre)) != 0) {
krb5_warn(context, ret, "invalid rotation epoch: %s",
key_rotation_epoch);
return ret;
}
if (ret == 0 && (ret = str2deltat(key_rotation_period, &krp)) != 0) {
krb5_warn(context, ret, "invalid rotation period: %s",
key_rotation_period);
return ret;
}
if (ret == 0) {
memset(&princ, 0, sizeof(princ));
princ.kvno = 1;
ret = krb5_parse_name(context, name, &princ_ent);
if (ret)
krb5_warn(context, ret, "krb5_parse_name");
}
if (ret != 0)
return ret;
/*
* Check that namespace has exactly one component, and prepend
* WELLKNOWN/HOSTBASED-NAMESPACE
*/
if (krb5_principal_get_num_comp(context, princ_ent) != 2
|| (comp0 = krb5_principal_get_comp_string(context, princ_ent, 0)) == 0
|| (comp1 = krb5_principal_get_comp_string(context, princ_ent, 1)) == 0
|| *comp0 == 0 || *comp1 == 0
|| strcmp(comp0, "krbtgt") == 0)
krb5_warn(context, ret = EINVAL,
"namespaces must have exactly two non-empty components "
"like host-base principal names");
if (ret == 0)
ret = krb5_principal_set_comp_string(context, princ_ent, 2, comp0);
if (ret == 0)
ret = krb5_principal_set_comp_string(context, princ_ent, 3, comp1);
if (ret == 0)
ret = krb5_principal_set_comp_string(context, princ_ent, 0,
"WELLKNOWN");
if (ret == 0)
ret = krb5_principal_set_comp_string(context, princ_ent, 1,
HDB_WK_NAMESPACE);
/* Set up initial key rotation extension */
if (ret == 0) {
KeyRotation kr;
size_t size;
/* Setup key rotation metadata in a convenient way */
kr.flags = int2KeyRotationFlags(0);
kr.base_key_kvno = 1;
/*
* Avoid kvnos 0/1/2 which don't normally appear in fully created
* principals.
*/
kr.base_kvno = 3;
/* XXX: Sanity check */
kr.epoch = kre;
kr.period = krp;
memset(&ext, 0, sizeof(ext));
ext.mandatory = FALSE;
ext.data.element = choice_HDB_extension_data_key_rotation;
ext.data.u.key_rotation.len = 1;
ext.data.u.key_rotation.val = &kr;
ASN1_MALLOC_ENCODE(HDB_extension, buf.data, buf.length,
&ext, &size, ret);
add_tl(&princ, KRB5_TL_EXTENSION, &buf);
mask |= KADM5_TL_DATA;
}
if (ret == 0) {
princ.principal = princ_ent;
mask |= KADM5_PRINCIPAL | KADM5_KVNO;
ret = set_entry(context, &princ, &mask,
max_ticket_life, max_renewable_life,
"never", "never", attributes, NSPOLICY);
}
if (ret == 0)
ret = edit_entry(&princ, &mask, default_ent, default_mask);
if (ret == 0)
ret = kstuple2etypes(&princ, &mask, nkstuple, kstuple);
/* XXX Shouldn't need a password for this */
random_password(pwbuf, sizeof(pwbuf));
ret = kadm5_create_principal_3(kadm_handle, &princ, mask,
nkstuple, kstuple, pwbuf);
if (ret)
krb5_warn(context, ret, "kadm5_create_principal_3");
kadm5_free_principal_ent(kadm_handle, &princ); /* frees princ_ent */
if (default_ent)
kadm5_free_principal_ent(kadm_handle, default_ent);
memset(pwbuf, 0, sizeof(pwbuf));
return ret;
}
int
add_new_namespace(struct add_namespace_options *opt, int argc, char **argv)
{
krb5_error_code ret = 0;
krb5_key_salt_tuple *kstuple = NULL;
const char *enctypes;
size_t i, nkstuple;
if (argc < 1) {
fprintf(stderr, "at least one namespace name required\n");
return 1;
}
enctypes = opt->enctypes_string;
if (enctypes == NULL || enctypes[0] == '\0')
enctypes = krb5_config_get_string(context, NULL, "libdefaults",
"supported_enctypes", NULL);
if (enctypes == NULL || enctypes[0] == '\0')
enctypes = "aes128-cts-hmac-sha1-96";
ret = krb5_string_to_keysalts2(context, enctypes, &nkstuple, &kstuple);
if (ret) {
fprintf(stderr, "enctype(s) unknown\n");
return ret;
}
for (i = 0; i < argc; i++) {
ret = add_one_namespace(argv[i], nkstuple, kstuple,
opt->max_ticket_life_string,
opt->max_renewable_life_string,
opt->key_rotation_epoch_string,
opt->key_rotation_period_string,
opt->attributes_string);
if (ret) {
krb5_warn(context, ret, "adding namespace %s", argv[i]);
break;
}
}
free(kstuple);
return ret != 0;
}