/*

 * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.

 */

/*

 * kt_solaris.c is to provide set of keytab interfaces contracted with SMB team.

 */

#include "k5-int.h"

#include <errno.h>

#include <netdb.h>

#include <strings.h>

#include <stdio.h>

#include <assert.h>

#include <ctype.h>

#include "kt_solaris.h"

#define	AES128		ENCTYPE_AES128_CTS_HMAC_SHA1_96

#define	AES256		ENCTYPE_AES256_CTS_HMAC_SHA1_96

#define	DES3		ENCTYPE_DES3_CBC_SHA1

#define	AES_ENTRIES	2

#define	HOST_TRUNC	15

#define	SVC_ENTRIES	4

static krb5_error_code

k5_kt_open(krb5_context ctx, krb5_keytab *kt)

{

	krb5_error_code code;

	char		buf[MAX_KEYTAB_NAME_LEN], ktstr[MAX_KEYTAB_NAME_LEN];

	memset(buf, 0, sizeof (buf));

	memset(ktstr, 0, sizeof (ktstr));

	if ((code = krb5_kt_default_name(ctx, buf, sizeof (buf))) != 0)

		return (code);

	/*

	 * The default is file type w/o the write.  If it's anything besides

	 * FILE or WRFILE then we bail as quickly as possible.

	 */

	if (strncmp(buf, "FILE:", strlen("FILE:")) == 0)

		(void) snprintf(ktstr, sizeof (ktstr), "WR%s", buf);

	else if (strncmp(buf, "WRFILE:", strlen("WRFILE:")) == 0)

		(void) snprintf(ktstr, sizeof (ktstr), "%s", buf);

	else

		return (EINVAL);

	return (krb5_kt_resolve(ctx, ktstr, kt));

}

static krb5_error_code

k5_kt_add_entry(krb5_context ctx, krb5_keytab kt, const krb5_principal princ,

    const krb5_principal svc_princ, krb5_enctype enctype, krb5_kvno kvno,

    const char *pw)

{

	krb5_keytab_entry entry;

	krb5_data password, salt;

	krb5_keyblock key;

	krb5_error_code code;

	memset(&entry, 0, sizeof (entry));

	memset(&key, 0, sizeof (krb5_keyblock));

	password.length = strlen(pw);

	password.data = (char *)pw;

	if ((code = krb5_principal2salt(ctx, svc_princ, &salt)) != 0) {

		return (code);

	}

	if ((krb5_c_string_to_key(ctx, enctype, &password, &salt, &key)) != 0)

		goto cleanup;

	entry.key = key;

	entry.vno = kvno;

	entry.principal = princ;

	code = krb5_kt_add_entry(ctx, kt, &entry);

cleanup:

	free(salt.data);

	krb5_free_keyblock_contents(ctx, &key);

	return (code);

}

/*

 * krb5_error_code k5_kt_add_ad_entries(krb5_context ctx, char **sprincs_str,

 * krb5_kvno kvno, uint_t flags, char *password)

 *

 * Adds keys to the keytab file for a default set of service principals for

 * the specified host (or local host) in an Active Directory environment.

 *

 * where ctx is the pointer passed back from krb5_init_context

 * where sprincs_str is an array of service principal names to be added

 * to the keytab file, terminated by a NULL pointer

 * where domain is the domain used to fully qualify the hostname for

 * constructing the salt in the string-to-key function.

 * where kvno is the key version number of the set of service principal

 * keys to be added

 * where flags is the set of conditions that affects the key table entries

 * current set of defined flags:

 *

 * 	encryption type

 * 	---------------

 *  	0x00000001  K5_KT_FLAG_AES_SUPPORT (core set + AES-256-128 keys added)

 *

 * where password is the password that will be used to derive the key for

 * the associated service principals in the keytab file

 * where hostname is the unqualified hostname of the system that will be used to

 * derive the key salt. If NULL is specified, this function will use the hostname

 * of the local system.

 *

 * Note: this function is used for adding service principals to the

 * local /etc/krb5/krb5.keytab (unless KRB5_KTNAME has been set to something

 * different, see krb5envvar(5)) file when the client belongs to an AD domain.

 * The keytab file is populated differently for an AD domain as the various

 * service principals share the same key material, unlike MIT based

 * implementations.

 *

 * Note: For encryption types; the union of the enc type flag and the

 * capabilities of the client is used to determine the enc type set to

 * populate the keytab file.

 *

 * Note: The keys are not created for any AES enctypes UNLESS the

 * K5_KT_FLAG_AES_SUPPORT flag is set and permitted_enctypes has the AES

 * enctypes enabled.

 *

 * Note: In Active Directory environments the salt is constructed by truncating

 * the host name to 15 characters and only use the host svc princ as the salt,

 * e.g. host/<str15>.<domain>@<realm>.  The realm name is determined by parsing

 * sprincs_str.  The local host name to construct is determined by calling

 * gethostname(3C).  If AD environments construct salts differently in the

 * future or this function is expanded outside of AD environments one could

 * derive the salt by sending an initial authentication exchange.

 *

 * Note: The kvno was previously determined by performing an LDAP query of the

 * computer account's msDS-KeyVersionNumber attribute.  If the schema changes

 * in the future or this function is expanded outside of AD environments then

 * one could derive the principal's kvno by requesting a service ticket.

 */

krb5_error_code

k5_kt_add_ad_entries(krb5_context ctx, char **sprincs_str, char *domain,

    krb5_kvno kvno, uint_t flags, char *password, char *hostname)

{

	krb5_principal	princ = NULL, salt = NULL, f_princ = NULL;

	krb5_keytab	kt = NULL;

	krb5_enctype	*enctypes = NULL, *tenctype, penctype = 0;

	char		**tprinc, *ptr, *token, *t_host = NULL, *realm;

	char		localname[MAXHOSTNAMELEN];

	krb5_error_code	code;

	krb5_boolean	similar;

	uint_t		t_len;

	assert(ctx != NULL && sprincs_str != NULL && *sprincs_str != NULL);

	assert(password != NULL && domain != NULL);

	if ((code = krb5_parse_name(ctx, *sprincs_str, &f_princ)) != 0)

		return (code);

	if (krb5_princ_realm(ctx, f_princ)->length == 0) {

		code = EINVAL;

		goto cleanup;

	}

	realm = krb5_princ_realm(ctx, f_princ)->data;

	if (hostname == NULL) {

		if (gethostname(localname, MAXHOSTNAMELEN) != 0) {

			code = errno;

			goto cleanup;

		}

		token = localname;

		/*

		 * Local host name could be fully qualified and/or in upper

		 * case, but usually and appropriately not.

		 */

		if ((ptr = strchr(token, '.')) != NULL)

			ptr = '\0';

		for (ptr = token; *ptr; ptr++)

			*ptr = tolower(*ptr);

	} else {

		token = hostname;

	}

	/*

	 * Windows servers currently truncate the host name to 15 characters

	 * and only use the host svc princ as the salt, e.g.

	 * host/str15.domain@realm

	 */

	t_len = snprintf(NULL, 0, "host/%.*s.%s@%s", HOST_TRUNC, token, domain,

	    realm) + 1;

	if ((t_host = malloc(t_len)) == NULL) {

		code = ENOMEM;

		goto cleanup;

	}

	(void) snprintf(t_host, t_len, "host/%.*s.%s@%s", HOST_TRUNC, token,

	    domain, realm);

	if ((code = krb5_parse_name(ctx, t_host, &salt)) != 0)

		goto cleanup;

	if ((code = k5_kt_open(ctx, &kt)) != 0)

		goto cleanup;

	code = krb5_get_permitted_enctypes(ctx, &enctypes);

	if (code != 0 || *enctypes == NULL)

		goto cleanup;

	for (tprinc = sprincs_str; *tprinc; tprinc++) {

		if ((code = krb5_parse_name(ctx, *tprinc, &princ)) != 0)

			goto cleanup;

		for (tenctype = enctypes; *tenctype; tenctype++) {

			if ((!(flags & K5_KT_FLAG_AES_SUPPORT) &&

			    (*tenctype == AES128 || *tenctype == AES256)) ||

			    (*tenctype == DES3)) {

				continue;

			}

			if (penctype) {

				code = krb5_c_enctype_compare(ctx, *tenctype,

				    penctype, &similar);

				if (code != 0)

					goto cleanup;

				else if (similar)

					continue;

			}

			code = k5_kt_add_entry(ctx, kt, princ, salt, *tenctype,

			    kvno, password);

			if (code != 0)

				goto cleanup;

			penctype = *tenctype;

		}

		krb5_free_principal(ctx, princ);

		princ = NULL;

		penctype = NULL;

	}

cleanup:

	if (f_princ != NULL)

		krb5_free_principal(ctx, f_princ);

	if (salt != NULL)

		krb5_free_principal(ctx, salt);

	if (t_host != NULL)

		free(t_host);

	if (kt != NULL)

		(void) krb5_kt_close(ctx, kt);

	if (enctypes != NULL)

		krb5_free_enctypes(ctx, enctypes);

	if (princ != NULL)

		krb5_free_principal(ctx, princ);

	return (code);

}

#define	PRINCIPAL	0

#define	REALM		1

static krb5_error_code

k5_kt_remove_by_key(krb5_context ctx, char *key, uint_t type)

{

	krb5_error_code		code;

	krb5_kt_cursor		cursor;

	krb5_keytab_entry	entry;

	krb5_keytab		kt = NULL;

	krb5_principal		svc_princ = NULL;

	krb5_principal_data	realm_data;

	boolean_t		found = FALSE;

	assert(ctx != NULL && key != NULL);

	if (type == REALM) {

		krb5_princ_realm(ctx, &realm_data)->length = strlen(key);

		krb5_princ_realm(ctx, &realm_data)->data = key;

	} else if (type == PRINCIPAL) {

		if ((code = krb5_parse_name(ctx, key, &svc_princ)) != 0)

			goto cleanup;

	} else

		return (EINVAL);

	if ((code = k5_kt_open(ctx, &kt)) != 0)

		goto cleanup;

	if ((code = krb5_kt_start_seq_get(ctx, kt, &cursor)) != 0)

		goto cleanup;

	while ((code = krb5_kt_next_entry(ctx, kt, &entry, &cursor)) == 0) {

		if (type == PRINCIPAL && krb5_principal_compare(ctx, svc_princ,

		    entry.principal)) {

			found = TRUE;

		} else if (type == REALM && krb5_realm_compare(ctx, &realm_data,

		    entry.principal)) {

			found = TRUE;

		}

		if (found == TRUE) {

			code = krb5_kt_end_seq_get(ctx, kt, &cursor);

			if (code != 0) {

				krb5_kt_free_entry(ctx, &entry);

				goto cleanup;

			}

			code = krb5_kt_remove_entry(ctx, kt, &entry);

			if (code != 0) {

				krb5_kt_free_entry(ctx, &entry);

				goto cleanup;

			}

			code = krb5_kt_start_seq_get(ctx, kt, &cursor);

			if (code != 0) {

				krb5_kt_free_entry(ctx, &entry);

				goto cleanup;

			}

			found = FALSE;

		}

		krb5_kt_free_entry(ctx, &entry);

	}

	if (code && code != KRB5_KT_END)

		goto cleanup;

	code = krb5_kt_end_seq_get(ctx, kt, &cursor);

cleanup:

	if (svc_princ != NULL)

		krb5_free_principal(ctx, svc_princ);

	if (kt != NULL)

		(void) krb5_kt_close(ctx, kt);

	return (code);

}

/*

 * krb5_error_code k5_kt_remove_by_realm(krb5_context ctx, char *realm)

 *

 * Removes all key entries in the keytab file that match the exact realm name

 * specified.

 *

 * where ctx is the pointer passed back from krb5_init_context

 * where realm is the realm name that is matched for any keytab entries

 * to be removed

 *

 * Note: if there are no entries matching realm then 0 (success) is returned

 */

krb5_error_code

k5_kt_remove_by_realm(krb5_context ctx, char *realm)

{

	return (k5_kt_remove_by_key(ctx, realm, REALM));

}

/*

 * krb5_error_code k5_kt_remove_by_svcprinc(krb5_context ctx, char *sprinc_str)

 *

 * Removes all key entries in the keytab file that match the exact service

 * principal name specified.

 *

 * where ctx is the pointer passed back from krb5_init_context

 * where sprinc_str is the service principal name that is matched for any

 * keytab entries to be removed

 *

 * Note: if there are no entries matching sprinc_str then 0 (success) is

 * returned

 */

krb5_error_code

k5_kt_remove_by_svcprinc(krb5_context ctx, char *sprinc_str)

{

	return (k5_kt_remove_by_key(ctx, sprinc_str, PRINCIPAL));

}

/*

 * krb5_error_code k5_kt_validate(krb5_context ctx, char *sprinc_str,

 * uint_t flags, boolean_t *valid)

 *

 * The validate function determines that the service principal exists and that

 * it has a valid set of encryption types for said principal.

 *

 * where ctx is the pointer passed back from krb5_init_context

 * where sprinc_str is the principal to be validated in the keytab file

 * where flags is the set of conditions that affects the key table entries

 * that the function considers valid

 * 	current set of defined flags:

 *

 *	encryption type

 *	---------------

 *	0x00000001 K5_KT_FLAG_AES_SUPPORT (core set + AES-256-128 keys are

 *		valid)

 *

 * where valid is a boolean that is set if the sprinc_str is correctly

 * populated in the keytab file based on the flags set else valid is unset.

 *

 * Note: The validate function assumes that only one set of keys exists for

 * a corresponding service principal, of key version number (kvno) n.  It would

 * consider more than one kvno set as invalid.  This is from the fact that AD

 * clients will attempt to refresh credential caches if KRB5KRB_AP_ERR_MODIFIED

 * is returned by the acceptor when the requested kvno is not found within the

 * keytab file.

 */

krb5_error_code

k5_kt_ad_validate(krb5_context ctx, char *sprinc_str, uint_t flags,

    boolean_t *valid)

{

	krb5_error_code		code;

	krb5_kt_cursor		cursor;

	krb5_keytab_entry	entry;

	krb5_keytab		kt = NULL;

	krb5_principal		svc_princ = NULL;

	krb5_enctype		*enctypes = NULL, *tenctype, penctype = 0;

	boolean_t		ck_aes = FALSE;

	uint_t			aes_count = 0, kt_entries = 0;

	krb5_boolean		similar;

	assert(ctx != NULL && sprinc_str != NULL && valid != NULL);

	*valid = FALSE;

	ck_aes = flags & K5_KT_FLAG_AES_SUPPORT;

	if ((code = krb5_parse_name(ctx, sprinc_str, &svc_princ)) != 0)

		goto cleanup;

	if ((code = k5_kt_open(ctx, &kt)) != 0)

		goto cleanup;

	code = krb5_get_permitted_enctypes(ctx, &enctypes);

	if (code != 0 || *enctypes == NULL)

		goto cleanup;

	if ((code = krb5_kt_start_seq_get(ctx, kt, &cursor)) != 0)

		goto cleanup;

	while ((code = krb5_kt_next_entry(ctx, kt, &entry, &cursor)) == 0) {

		if (krb5_principal_compare(ctx, svc_princ, entry.principal)) {

			for (tenctype = enctypes; *tenctype; tenctype++) {

				if (penctype) {

					code = krb5_c_enctype_compare(ctx,

					    *tenctype, penctype, &similar);

					if (code != 0) {

						krb5_kt_free_entry(ctx, &entry);

						goto cleanup;

					} else if (similar)

						continue;

				}

				if ((*tenctype != DES3) &&

				    (entry.key.enctype == *tenctype)) {

					kt_entries++;

				}

				penctype = *tenctype;

			}

			if ((entry.key.enctype == AES128) ||

			    (entry.key.enctype == AES256)) {

				aes_count++;

			}

		}

		krb5_kt_free_entry(ctx, &entry);

	}

	if (code && code != KRB5_KT_END)

		goto cleanup;

	if ((code = krb5_kt_end_seq_get(ctx, kt, &cursor)))

		goto cleanup;

	if (ck_aes == TRUE) {

		if ((kt_entries != SVC_ENTRIES) || (aes_count != AES_ENTRIES))

			goto cleanup;

	} else if (kt_entries != (SVC_ENTRIES - AES_ENTRIES))

		goto cleanup;

	*valid = TRUE;

cleanup:

	if (svc_princ != NULL)

		krb5_free_principal(ctx, svc_princ);

	if (kt != NULL)

		(void) krb5_kt_close(ctx, kt);

	if (enctypes != NULL)

		krb5_free_enctypes(ctx, enctypes);

	return (code);

}