oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

hdb: Move virtual principals into HDB layer

Browse Source 
This is a large commit that adds several features:

 - Revamps and moves virtual host-based service principal functionality
   from kdc/ to lib/hdb/ so that it may be automatically visible to
   lib/kadm5/, as well as kadmin(1)/kadmind(8) and ktutil(1).

   The changes are backwards-incompatible.

 - Completes support for documenting a service principal's supported
   enctypes in its HDB entry independently of its long-term keys.  This
   will reduce HDB bloat by not requiring that service principals have
   more long-term keys than they need just to document the service's
   supported enctypes.

 - Adds support for storing krb5.conf content in principals' HDB
   entries.  This may eventually be used for causing Heimdal KDC
   services to reconfigure primary/secondary roles automatically by
   discovering the configured primary in an HDB entry for the realm.

   For now this will be used to help reduce the amount of configuration
   needed by clients of an upcoming HTTP binding of the kadmin service.
This commit is contained in:
Nicolas Williams
2020-08-24 16:16:59 -05:00
parent ef06b94132
commit 5447b81fb1
50 changed files with 4017 additions and 530 deletions
Download Patch File Download Diff File Expand all files Collapse all files

302
lib/hdb/ext.c
View File

@@ -86,7 +86,6 @@ hdb_replace_extension(krb5_context context,
const HDB_extension *ext)
{
HDB_extension *ext2;
HDB_extension *es;
int ret;
ext2 = NULL;
@@ -157,22 +156,7 @@ hdb_replace_extension(krb5_context context,
return ret;
}
es = realloc(entry->extensions->val,
(entry->extensions->len+1)*sizeof(entry->extensions->val[0]));
if (es == NULL) {
krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
return ENOMEM;
}
entry->extensions->val = es;
ret = copy_HDB_extension(ext,
&entry->extensions->val[entry->extensions->len]);
if (ret == 0)
entry->extensions->len++;
else
krb5_set_error_message(context, ret, "hdb: failed to copy new extension");
return ret;
return add_HDB_extensions(entry->extensions, ext);
}
krb5_error_code
@@ -186,13 +170,8 @@ hdb_clear_extension(krb5_context context,
return 0;
for (i = 0; i < entry->extensions->len; i++) {
if (entry->extensions->val[i].data.element == (unsigned)type) {
free_HDB_extension(&entry->extensions->val[i]);
memmove(&entry->extensions->val[i],
&entry->extensions->val[i + 1],
sizeof(entry->extensions->val[i]) * (entry->extensions->len - i - 1));
entry->extensions->len--;
}
if (entry->extensions->val[i].data.element == (unsigned)type)
(void) remove_HDB_extensions(entry->extensions, i);
}
if (entry->extensions->len == 0) {
free(entry->extensions->val);
@@ -246,6 +225,33 @@ hdb_entry_get_pkinit_cert(const hdb_entry *entry, const HDB_Ext_PKINIT_cert **a)
return 0;
}
krb5_error_code
hdb_entry_get_krb5_config(const hdb_entry *entry, heim_octet_string *c)
{
const HDB_extension *ext;
c->data = NULL;
c->length = 0;
ext = hdb_find_extension(entry, choice_HDB_extension_data_krb5_config);
if (ext)
*c = ext->data.u.krb5_config;
return 0;
}
krb5_error_code
hdb_entry_set_krb5_config(krb5_context context,
hdb_entry *entry,
heim_octet_string *s)
{
HDB_extension ext;
ext.mandatory = FALSE;
ext.data.element = choice_HDB_extension_data_last_pw_change;
/* hdb_replace_extension() copies this, so no need to copy it here */
ext.data.u.krb5_config = *s;
return hdb_replace_extension(context, entry, &ext);
}
krb5_error_code
hdb_entry_get_pw_change_time(const hdb_entry *entry, time_t *t)
{
@@ -530,3 +536,251 @@ hdb_set_last_modified_by(krb5_context context, hdb_entry *entry,
return 0;
}
krb5_error_code
hdb_entry_get_key_rotation(krb5_context context,
const hdb_entry *entry,
const HDB_Ext_KeyRotation **kr)
{
HDB_extension *ext =
hdb_find_extension(entry, choice_HDB_extension_data_key_rotation);
*kr = ext ? &ext->data.u.key_rotation : NULL;
return 0;
}
krb5_error_code
hdb_validate_key_rotation(krb5_context context,
const KeyRotation *past_kr,
const KeyRotation *new_kr)
{
unsigned int last_kvno;
if (new_kr->period < 1) {
krb5_set_error_message(context, EINVAL,
"Key rotation periods must be non-zero "
"and positive");
return EINVAL;
}
if (new_kr->base_key_kvno < 1 || new_kr->base_kvno < 1) {
krb5_set_error_message(context, EINVAL,
"Key version number zero not allowed "
"for key rotation");
return EINVAL;
}
if (!past_kr)
return 0;
if (past_kr->base_key_kvno == new_kr->base_key_kvno) {
/*
* The new base keys can be the same as the old, but must have
* different kvnos. (Well, not must must. It's a convention for now.)
*/
krb5_set_error_message(context, EINVAL,
"Base key version numbers for KRs must differ");
return EINVAL;
}
if (new_kr->epoch - past_kr->epoch <= 0) {
krb5_set_error_message(context, EINVAL,
"New key rotation periods must start later "
"than existing ones");
return EINVAL;
}
last_kvno = 1 + ((new_kr->epoch - past_kr->epoch) / past_kr->period);
if (new_kr->base_kvno <= last_kvno) {
krb5_set_error_message(context, EINVAL,
"New key rotation base kvno must be larger "
"the last kvno for the current key "
"rotation (%u)", last_kvno);
return EINVAL;
}
return 0;
}
static int
kr_eq(const KeyRotation *a, const KeyRotation *b)
{
return !!(
a->epoch == b->epoch &&
a->period == b->period &&
a->base_kvno == b->base_kvno &&
a->base_key_kvno == b->base_key_kvno &&
KeyRotationFlags2int(a->flags) == KeyRotationFlags2int(b->flags)
);
}
krb5_error_code
hdb_validate_key_rotations(krb5_context context,
const HDB_Ext_KeyRotation *existing,
const HDB_Ext_KeyRotation *krs)
{
krb5_error_code ret = 0;
size_t added = 0;
size_t i;
if ((!existing || !existing->len) && (!krs || !krs->len))
return 0; /* Nothing to do; weird */
/*
* HDB_Ext_KeyRotation has to have 1..3 elements, and this is enforced by
* the ASN.1 compiler and the code it generates. Nonetheless we'll check
* that there's not zero elements.
*/
if ((!krs || !krs->len)) {
/*
* NOTE: We can clear this on concrete principals with virtual keys
* though. The caller can check for that case.
*/
krb5_set_error_message(context, EINVAL,
"Cannot clear key rotation metadata on "
"virtual principal namespaces");
ret = EINVAL;
}
/* Validate the new KRs by themselves */
for (i = 0; ret == 0 && i < krs->len; i++) {
ret = hdb_validate_key_rotation(context,
i+1 < krs->len ? &krs->val[i+1] : 0,
&krs->val[i]);
}
if (ret || !existing || !existing->len)
return ret;
if (existing->len == krs->len) {
/* Check for no change */
for (i = 0; i < krs->len; i++)
if (!kr_eq(&existing->val[i], &krs->val[i]))
break;
if (i == krs->len)
return 0; /* No change */
}
/*
* Check that new KRs make sense in the context of the previous KRs.
*
* Permitted changes:
*
* - add one new KR in front
* - drop old KRs
*
* Start by checking if we're adding a KR, then go on to check for dropped
* KRs and/or last KR alteration.
*/
if (existing->val[0].epoch == krs->val[0].epoch ||
existing->val[0].base_kvno == krs->val[0].base_kvno) {
if (!kr_eq(&existing->val[0], &krs->val[0])) {
krb5_set_error_message(context, EINVAL,
"Key rotation change not sensible");
ret = EINVAL;
}
/* Key rotation *not* added */
} else {
/* Key rotation added; check it first */
ret = hdb_validate_key_rotation(context,
&existing->val[0],
&krs->val[0]);
added = 1;
}
for (i = 0; ret == 0 && i < existing->len && i + added < krs->len; i++)
if (!kr_eq(&existing->val[i], &krs->val[i + added]))
krb5_set_error_message(context, ret = EINVAL,
"Only last key rotation may be truncated");
return ret;
}
/* XXX We need a function to "revoke" the past */
/**
* This function adds a KeyRotation value to an entry, validating the
* change. One of `entry' and `krs' must be NULL, and the other non-NULL, and
* whichever is given will be altered.
*
* @param context Context
* @param entry An HDB entry
* @param krs A key rotation extension for hdb_entry
* @param kr A new KeyRotation value
*
* @return Zero on success, an error otherwise.
*/
krb5_error_code
hdb_entry_add_key_rotation(krb5_context context,
hdb_entry *entry,
HDB_Ext_KeyRotation *krs,
const KeyRotation *kr)
{
krb5_error_code ret;
HDB_extension new_ext;
HDB_extension *ext = 0;
KeyRotation tmp;
size_t i, sz;
if (kr->period < 1) {
krb5_set_error_message(context, EINVAL,
"Key rotation period cannot be zero");
return EINVAL;
}
new_ext.mandatory = TRUE;
new_ext.data.element = choice_HDB_extension_data_key_rotation;
new_ext.data.u.key_rotation.len = 0;
new_ext.data.u.key_rotation.val = 0;
if (entry && krs)
return EINVAL;
if (entry) {
ext = hdb_find_extension(entry, choice_HDB_extension_data_key_rotation);
if (!ext)
ext = &new_ext;
else
krs = &ext->data.u.key_rotation;
} else {
const KeyRotation *prev_kr = &krs->val[0];
unsigned int last_kvno = 0;
if (kr->epoch - prev_kr->epoch <= 0) {
krb5_set_error_message(context, EINVAL,
"New key rotation periods must start later "
"than existing ones");
return EINVAL;
}
if (kr->base_kvno <= prev_kr->base_kvno ||
kr->base_kvno - prev_kr->base_kvno <=
(last_kvno = 1 +
((kr->epoch - prev_kr->epoch) / prev_kr->period))) {
krb5_set_error_message(context, EINVAL,
"New key rotation base kvno must be larger "
"the last kvno for the current key "
"rotation (%u)", last_kvno);
return EINVAL;
}
}
/* First, append */
ret = add_HDB_Ext_KeyRotation(&ext->data.u.key_rotation, kr);
if (ret)
return ret;
/* Rotate new to front */
tmp = ext->data.u.key_rotation.val[ext->data.u.key_rotation.len - 1];
sz = sizeof(ext->data.u.key_rotation.val[0]);
memmove(&ext->data.u.key_rotation.val[1], &ext->data.u.key_rotation.val[0],
(ext->data.u.key_rotation.len - 1) * sz);
ext->data.u.key_rotation.val[0] = tmp;
/* Drop too old entries */
for (i = 3; i < ext->data.u.key_rotation.len; i++)
free_KeyRotation(&ext->data.u.key_rotation.val[i]);
ext->data.u.key_rotation.len =
ext->data.u.key_rotation.len > 3 ? 3 : ext->data.u.key_rotation.len;
if (ext != &new_ext)
return 0;
/* Install new extension */
if (ret == 0 && entry)
ret = hdb_replace_extension(context, entry, ext);
free_HDB_extension(&new_ext);
return ret;
}