Optionally prune old keys when setting new keys.

When new keys are added (typically via kadm5_setkey_principal_3),
truncate the key history to remove old keys, that is keys older than
the newest key which was in effect prior longer ago than the principal's
maximum ticket lifetime.  This feature is controlled via the "[kadmin]"
section's "prune-key-history" boolean parameter, which defaults to false.

Currently this happens only when kadm5_setkey_principal_3()
is called directly on the server, the client API simulates
kadm5_setkey_principal_3() via a get, update, modify sequence that does
not prune the key history.  The plan is to add a new kadm5 protocol RPC
and convert clients to call that instead.

In setkey_principal_3 seal keys after entry key update

Also, for now, don't check the return value of kadm5_log_modify() in
the new kadm5_s_setkey_principal_3().  This has to be addressed more
globally.

Censor stale keys in kadm5_s_get_principal

lib/hdb/keys.c

@@ -196,6 +196,66 @@ parse_key_set(krb5_context context, const char *key,
     return 0;
 }
 
+/**
+ * This function prunes an HDB entry's keys that are too old to have been used
+ * to mint still valid tickets (based on the entry's maximum ticket lifetime).
+ * 
+ * @param context   Context
+ * @param entry	    HDB entry
+ */
+krb5_error_code
+hdb_prune_keys(krb5_context context, hdb_entry *entry)
+{
+    HDB_extension *ext;
+    HDB_Ext_KeySet *keys;
+    size_t nelem;
+
+    ext = hdb_find_extension(entry, choice_HDB_extension_data_hist_keys);
+    if (ext == NULL)
+	return 0;
+    keys = &ext->data.u.hist_keys;
+    nelem = keys->len;
+
+    /* Optionally drop key history for keys older than now - max_life */
+    if (entry->max_life != NULL && nelem > 0
+	&& krb5_config_get_bool_default(context, NULL, FALSE,
+					"kadmin", "prune-key-history", NULL)) {
+	hdb_keyset *elem;
+	time_t ceiling = time(NULL) - *entry->max_life;
+	time_t keep_time = 0;
+	size_t i;
+
+	/*
+	 * Compute most recent key timestamp that predates the current time
+	 * by at least the entry's maximum ticket lifetime.
+	 */
+	for (i = 0; i < nelem; ++i) {
+	    elem = &keys->val[i];
+	    if (elem->set_time && *elem->set_time < ceiling
+		&& (keep_time == 0 || *elem->set_time > keep_time))
+		keep_time = *elem->set_time;
+	}
+
+	/* Drop obsolete entries */
+	if (keep_time) {
+	    for (i = 0; i < nelem; /* see below */) {
+		elem = &keys->val[i];
+		if (elem->set_time && *elem->set_time < keep_time) {
+		    remove_HDB_Ext_KeySet(keys, i);
+		    /*
+		     * Removing the i'th element shifts the tail down, continue
+		     * at same index with reduced upper bound.
+		     */
+		    --nelem;
+		    continue;
+		}
+		++i;
+	    }
+	}
+    }
+
+    return 0;
+}
 
 /**
  * This function adds an HDB entry's current keyset to the entry's key
@@ -211,6 +271,7 @@ hdb_add_current_keys_to_history(krb5_context context, hdb_entry *entry)
     krb5_boolean replace = FALSE;
     krb5_error_code ret;
     HDB_extension *ext;
+    HDB_Ext_KeySet *keys;
     hdb_keyset newkeyset;
     time_t newtime;
 
@@ -226,6 +287,7 @@ hdb_add_current_keys_to_history(krb5_context context, hdb_entry *entry)
 
 	ext->data.element = choice_HDB_extension_data_hist_keys;
     }
+    keys = &ext->data.u.hist_keys;
 
     ext->mandatory = FALSE;
 
@@ -241,7 +303,7 @@ hdb_add_current_keys_to_history(krb5_context context, hdb_entry *entry)
     newkeyset.kvno = entry->kvno;
     newkeyset.set_time = &newtime;
 
-    ret = add_HDB_Ext_KeySet(&ext->data.u.hist_keys, &newkeyset);
+    ret = add_HDB_Ext_KeySet(keys, &newkeyset);
     if (ret)
 	goto out;
 
@@ -252,6 +314,10 @@ hdb_add_current_keys_to_history(krb5_context context, hdb_entry *entry)
 	    goto out;
     }
 
+    ret = hdb_prune_keys(context, entry);
+    if (ret)
+	goto out;
+
  out:
     if (replace && ext) {
 	free_HDB_extension(ext);

lib/hdb/libhdb-exports.def

@@ -52,6 +52,7 @@ EXPORTS
 	hdb_principal2key
 	hdb_print_entry
 	hdb_process_master_key
+	hdb_prune_keys
 	hdb_read_master_key
 	hdb_replace_extension
 	hdb_seal_key

lib/hdb/version-script.map

@@ -54,6 +54,7 @@ HEIMDAL_HDB_1.0 {
 		hdb_principal2key;
 		hdb_print_entry;
 		hdb_process_master_key;
+		hdb_prune_keys;
 		hdb_read_master_key;
 		hdb_replace_extension;
 		hdb_seal_key;