oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

hdb: Move virtual principals into HDB layer

Browse Source 
This is a large commit that adds several features:

 - Revamps and moves virtual host-based service principal functionality
   from kdc/ to lib/hdb/ so that it may be automatically visible to
   lib/kadm5/, as well as kadmin(1)/kadmind(8) and ktutil(1).

   The changes are backwards-incompatible.

 - Completes support for documenting a service principal's supported
   enctypes in its HDB entry independently of its long-term keys.  This
   will reduce HDB bloat by not requiring that service principals have
   more long-term keys than they need just to document the service's
   supported enctypes.

 - Adds support for storing krb5.conf content in principals' HDB
   entries.  This may eventually be used for causing Heimdal KDC
   services to reconfigure primary/secondary roles automatically by
   discovering the configured primary in an HDB entry for the realm.

   For now this will be used to help reduce the amount of configuration
   needed by clients of an upcoming HTTP binding of the kadmin service.
This commit is contained in:
Nicolas Williams
2020-08-24 16:16:59 -05:00
parent ef06b94132
commit 5447b81fb1
50 changed files with 4017 additions and 530 deletions
Download Patch File Download Diff File Expand all files Collapse all files

232
lib/hdb/hdb.c
View File

@@ -119,6 +119,16 @@ static struct hdb_method default_dbmethod =
{ HDB_INTERFACE_VERSION, NULL, NULL, "", hdb_ndbm_create };
#endif
/**
* Returns the Keys of `e' for `kvno', or NULL if not found. The Keys will
* remain valid provided that the entry is not mutated.
*
* @param context Context
* @param e The HDB entry
* @param kvno The kvno
*
* @return A pointer to the Keys for the requested kvno.
*/
const Keys *
hdb_kvno2keys(krb5_context context,
const hdb_entry *e,
@@ -128,7 +138,7 @@ hdb_kvno2keys(krb5_context context,
HDB_extension *extp;
size_t i;
if (kvno == 0)
if (kvno == 0 || e->kvno == kvno)
return &e->keys;
extp = hdb_find_extension(e, choice_HDB_extension_data_hist_keys);
@@ -144,6 +154,188 @@ hdb_kvno2keys(krb5_context context,
return NULL;
}
/* Based on remove_HDB_Ext_KeySet(), generated by the ASN.1 compiler */
static int
dequeue_HDB_Ext_KeySet(HDB_Ext_KeySet *data, unsigned int element, hdb_keyset *ks)
{
if (element >= data->len) {
ks->kvno = 0;
ks->keys.len = 0;
ks->keys.val = 0;
ks->set_time = 0;
return ASN1_OVERRUN;
}
*ks = data->val[element];
data->len--;
/* Swap instead of memmove()... changes the order of elements */
if (element < data->len)
data->val[element] = data->val[data->len];
if (data->len == 0) {
free(data->val);
data->val = 0;
}
return 0;
}
/**
* Removes from `e' and optionally outputs the keyset for the requested `kvno'.
*
* @param context Context
* @param e The HDB entry
* @param kvno The key version number
* @param ks A pointer to a variable of type hdb_keyset (may be NULL)
*
* @return Zero on success, an error code otherwise.
*/
krb5_error_code
hdb_remove_keys(krb5_context context,
hdb_entry *e,
krb5_kvno kvno,
hdb_keyset *ks)
{
HDB_Ext_KeySet *hist_keys;
HDB_extension *extp;
size_t i;
if (kvno == 0 || e->kvno == kvno) {
if (ks) {
KerberosTime t;
(void) hdb_entry_get_pw_change_time(e, &t);
if (t) {
if ((ks->set_time = malloc(sizeof(*ks->set_time))) == NULL)
return krb5_enomem(context);
*ks->set_time = t;
}
ks->kvno = e->kvno;
ks->keys = e->keys;
e->keys.len = 0;
e->keys.val = NULL;
e->kvno = 0;
} else {
free_Keys(&e->keys);
}
return 0;
}
if (ks) {
ks->kvno = 0;
ks->keys.len = 0;
ks->keys.val = 0;
ks->set_time = 0;
}
extp = hdb_find_extension(e, choice_HDB_extension_data_hist_keys);
if (extp == NULL)
return 0;
hist_keys = &extp->data.u.hist_keys;
for (i = 0; i < hist_keys->len; i++) {
if (hist_keys->val[i].kvno != kvno)
continue;
if (ks)
return dequeue_HDB_Ext_KeySet(hist_keys, i, ks);
return remove_HDB_Ext_KeySet(hist_keys, i);
}
return HDB_ERR_NOENTRY;
}
/**
* Removes from `e' and outputs all the base keys for virtual principal and/or
* key derivation.
*
* @param context Context
* @param e The HDB entry
* @param ks A pointer to a variable of type HDB_Ext_KeySet
*
* @return Zero on success, an error code otherwise.
*/
krb5_error_code
hdb_remove_base_keys(krb5_context context,
hdb_entry *e,
HDB_Ext_KeySet *base_keys)
{
krb5_error_code ret;
const HDB_Ext_KeyRotation *ckr;
HDB_Ext_KeyRotation kr;
size_t i, k;
ret = hdb_entry_get_key_rotation(context, e, &ckr);
if (ret == 0) {
/*
* Changing the entry's extensions invalidates extensions obtained
* before the change.
*/
ret = copy_HDB_Ext_KeyRotation(ckr, &kr);
ckr = NULL;
}
base_keys->len = 0;
if (ret == 0 &&
(base_keys->val = calloc(kr.len, sizeof(base_keys->val[0]))) == NULL)
ret = krb5_enomem(context);
for (k = i = 0; ret == 0 && i < kr.len; i++) {
const KeyRotation *krp = &kr.val[i];
/*
* WARNING: O(N * M) where M is number of keysets and N is the number
* of base keysets.
*
* In practice N will never be > 3 because the ASN.1 module imposes
* that as a constraint, and M will generally be the same as N, so this
* will be O(1) after all.
*/
ret = hdb_remove_keys(context, e, krp->base_key_kvno,
&base_keys->val[k]);
if (ret == 0)
k++;
else if (ret == HDB_ERR_NOENTRY)
ret = 0;
}
if (ret == 0)
base_keys->len = k;
else
free_HDB_Ext_KeySet(base_keys);
free_HDB_Ext_KeyRotation(&kr);
return 0;
}
/**
* Removes from `e' and outputs all the base keys for virtual principal and/or
* key derivation.
*
* @param context Context
* @param e The HDB entry
* @param is_current_keyset Whether to make the keys the current keys for `e'
* @param ks A pointer to an hdb_keyset containing the keys to set
*
* @return Zero on success, an error code otherwise.
*/
krb5_error_code
hdb_install_keyset(krb5_context context,
hdb_entry *e,
int is_current_keyset,
const hdb_keyset *ks)
{
krb5_error_code ret = 0;
if (is_current_keyset) {
if (e->keys.len &&
(ret = hdb_add_current_keys_to_history(context, e)))
return ret;
free_Keys(&e->keys);
if (ret == 0)
ret = copy_Keys(&ks->keys, &e->keys);
e->kvno = ks->kvno;
if (ks->set_time)
return hdb_entry_set_pw_change_time(context, e, *ks->set_time);
return 0;
}
return hdb_add_history_keyset(context, e, ks);
}
krb5_error_code
hdb_next_enctype2key(krb5_context context,
const hdb_entry *e,
@@ -481,8 +673,10 @@ _hdb_keytab2hdb_entry(krb5_context context,
krb5_error_code
hdb_create(krb5_context context, HDB **db, const char *filename)
{
krb5_error_code ret;
struct cb_s cb_ctx;
*db = NULL;
if (filename == NULL)
filename = HDB_DEFAULT_DB;
cb_ctx.h = find_method (filename, &cb_ctx.residual);
@@ -504,9 +698,43 @@ hdb_create(krb5_context context, HDB **db, const char *filename)
free(rk_UNCONST(hdb_plugin_data.name));
}
/* XXX krb5_errx()?! */
if (cb_ctx.h == NULL)
krb5_errx(context, 1, "No database support for %s", cb_ctx.filename);
return (*cb_ctx.h->create)(context, db, cb_ctx.residual);
ret = (*cb_ctx.h->create)(context, db, cb_ctx.residual);
if (ret == 0 && *db) {
(*db)->enable_virtual_hostbased_princs =
krb5_config_get_bool_default(context, NULL, FALSE, "hdb",
"enable_virtual_hostbased_princs",
NULL);
(*db)->virtual_hostbased_princ_ndots =
krb5_config_get_int_default(context, NULL, 1, "hdb",
"virtual_hostbased_princ_mindots",
NULL);
(*db)->virtual_hostbased_princ_maxdots =
krb5_config_get_int_default(context, NULL, 0, "hdb",
"virtual_hostbased_princ_maxdots",
NULL);
(*db)->new_service_key_delay =
krb5_config_get_time_default(context, NULL, 0, "hdb",
"new_service_key_delay", NULL);
/*
* XXX Needs freeing in the HDB backends because we don't have a
* first-class hdb_close() :(
*/
(*db)->virtual_hostbased_princ_svcs =
krb5_config_get_strings(context, NULL, "hdb",
"virtual_hostbased_princ_svcs", NULL);
/* Check for ENOMEM */
if ((*db)->virtual_hostbased_princ_svcs == NULL
&& krb5_config_get_string(context, NULL, "hdb",
"virtual_hostbased_princ_svcs", NULL)) {
(*db)->hdb_destroy(context, *db);
*db = NULL;
ret = krb5_enomem(context);
}
}
return ret;
}
uintptr_t KRB5_CALLCONV