Commit e91c0b93 authored by Russ Allbery's avatar Russ Allbery
Browse files

Imported Upstream version 0.12

parent 602ff758
......@@ -2,6 +2,7 @@
/aclocal.m4
/build-aux/
/client/wallet
/client/wallet-rekey
/config.h
/config.h.in
/config.h.in~
......@@ -19,6 +20,7 @@
/tests/client/basic-t
/tests/client/full-t
/tests/client/prompt-t
/tests/client/rekey-t
/tests/data/.placeholder
/tests/data/test.keytab
/tests/data/test.password
......
......@@ -10,40 +10,43 @@
# and are not generated or touched by configure. They're listed here to be
# added to EXTRA_DIST and so that they can be copied over properly for
# builddir != srcdir builds.
PERL_FILES = perl/Wallet/ACL.pm perl/Wallet/ACL/Base.pm \
perl/Wallet/ACL/Krb5.pm perl/Wallet/ACL/NetDB.pm \
perl/Wallet/ACL/NetDB/Root.pm perl/Wallet/Admin.pm \
perl/Wallet/Config.pm perl/Wallet/Database.pm perl/Wallet/Kadmin.pm \
perl/Wallet/Kadmin/Heimdal.pm perl/Wallet/Kadmin/MIT.pm \
perl/Wallet/Object/Base.pm perl/Wallet/Object/File.pm \
perl/Wallet/Object/Keytab.pm perl/Wallet/Report.pm \
perl/Wallet/Schema.pm perl/Wallet/Server.pm perl/t/acl.t \
perl/t/admin.t perl/t/config.t perl/t/data/README \
perl/t/data/keytab-fake perl/t/data/keytab.conf \
perl/t/data/netdb.conf perl/t/data/netdb-fake perl/t/file.t \
perl/t/init.t perl/t/kadmin.t perl/t/keytab.t perl/t/lib/Util.pm \
perl/t/object.t perl/t/pod-spelling.t perl/t/pod.t perl/t/report.t \
perl/t/schema.t perl/t/server.t perl/t/verifier-netdb.t \
PERL_FILES = perl/Wallet/ACL.pm perl/Wallet/ACL/Base.pm \
perl/Wallet/ACL/Krb5.pm perl/Wallet/ACL/Krb5/Regex.pm \
perl/Wallet/ACL/NetDB.pm perl/Wallet/ACL/NetDB/Root.pm \
perl/Wallet/Admin.pm perl/Wallet/Config.pm perl/Wallet/Database.pm \
perl/Wallet/Kadmin.pm perl/Wallet/Kadmin/Heimdal.pm \
perl/Wallet/Kadmin/MIT.pm perl/Wallet/Object/Base.pm \
perl/Wallet/Object/File.pm perl/Wallet/Object/Keytab.pm \
perl/Wallet/Report.pm perl/Wallet/Schema.pm perl/Wallet/Server.pm \
perl/t/acl.t perl/t/admin.t perl/t/config.t perl/t/data/README \
perl/t/data/keytab-fake perl/t/data/keytab.conf \
perl/t/data/netdb.conf perl/t/data/netdb-fake perl/t/file.t \
perl/t/init.t perl/t/kadmin.t perl/t/keytab.t perl/t/lib/Util.pm \
perl/t/object.t perl/t/pod-spelling.t perl/t/pod.t perl/t/report.t \
perl/t/schema.t perl/t/server.t perl/t/verifier-netdb.t \
perl/t/verifier.t
AUTOMAKE_OPTIONS = foreign subdir-objects
ACLOCAL_AMFLAGS = -I m4
EXTRA_DIST = .gitignore LICENSE autogen client/wallet.pod \
config/allow-extract config/keytab config/keytab.acl config/wallet \
docs/design contrib/README contrib/convert-srvtab-db \
contrib/used-principals contrib/wallet-contacts \
contrib/wallet-summary contrib/wallet-summary.8 docs/design-acl \
docs/design-api docs/netdb-role-api docs/notes docs/setup \
docs/stanford-naming examples/stanford.conf tests/TESTS \
tests/data/README tests/data/allow-extract tests/data/basic.conf \
tests/data/cmd-fake tests/data/cmd-wrapper tests/data/fake-data \
tests/data/fake-kadmin tests/data/fake-keytab \
tests/data/fake-keytab-2 tests/data/fake-keytab-merge \
tests/data/fake-keytab-old tests/data/fake-srvtab \
tests/data/full.conf tests/data/wallet.conf \
tests/docs/pod-spelling-t tests/docs/pod-t tests/server/admin-t \
tests/server/backend-t tests/server/keytab-t tests/server/report-t \
tests/tap/kerberos.sh tests/tap/libtap.sh tests/tap/remctl.sh \
EXTRA_DIST = .gitignore LICENSE autogen client/wallet.pod \
client/wallet-rekey.pod config/allow-extract config/keytab \
config/keytab.acl config/wallet config/wallet-report.acl docs/design \
contrib/README contrib/convert-srvtab-db contrib/used-principals \
contrib/wallet-contacts contrib/wallet-summary \
contrib/wallet-summary.8 contrib/wallet-unknown-hosts \
docs/design-acl docs/design-api docs/netdb-role-api docs/notes \
docs/setup docs/stanford-naming examples/stanford.conf tests/TESTS \
tests/data/README tests/data/allow-extract tests/data/basic.conf \
tests/data/cmd-fake tests/data/cmd-wrapper tests/data/fake-data \
tests/data/fake-kadmin tests/data/fake-keytab \
tests/data/fake-keytab-2 tests/data/fake-keytab-foreign \
tests/data/fake-keytab-merge tests/data/fake-keytab-old \
tests/data/fake-keytab-partial tests/data/fake-keytab-partial-result \
tests/data/fake-keytab-rekey tests/data/fake-keytab-unknown \
tests/data/fake-srvtab tests/data/full.conf tests/data/wallet.conf \
tests/docs/pod-spelling-t tests/docs/pod-t tests/server/admin-t \
tests/server/backend-t tests/server/keytab-t tests/server/report-t \
tests/tap/kerberos.sh tests/tap/libtap.sh tests/tap/remctl.sh \
tests/util/xmalloc-t $(PERL_FILES)
noinst_LIBRARIES = portable/libportable.a util/libutil.a
......@@ -57,23 +60,35 @@ util_libutil_a_SOURCES = util/concat.c util/concat.h util/macros.h \
util/messages.h util/xmalloc.c util/xmalloc.h
util_libutil_a_CPPFLAGS = $(KRB5_CPPFLAGS)
bin_PROGRAMS = client/wallet
noinst_LIBRARIES += client/libwallet.a
client_libwallet_a_SOURCES = client/file.c client/internal.h client/keytab.c \
client/krb5.c client/options.c client/remctl.c client/srvtab.c
client_libwallet_a_CPPFLAGS = $(REMCTL_CPPFLAGS) $(KRB5_CPPFLAGS)
bin_PROGRAMS = client/wallet client/wallet-rekey
dist_sbin_SCRIPTS = server/keytab-backend server/wallet-admin \
server/wallet-backend server/wallet-report
client_wallet_SOURCES = client/file.c client/internal.h client/keytab.c \
client/krb5.c client/remctl.c client/srvtab.c client/wallet.c
client_wallet_CPPFLAGS = $(REMCTL_CPPFLAGS) $(KRB5_CPPFLAGS)
client_wallet_LDFLAGS = $(REMCTL_LDFLAGS) $(KRB5_LDFLAGS)
client_wallet_LDADD = util/libutil.a portable/libportable.a $(REMCTL_LIBS) \
$(KRB5_LIBS)
dist_man_MANS = client/wallet.1 server/keytab-backend.8 \
client_wallet_LDADD = client/libwallet.a util/libutil.a \
portable/libportable.a $(REMCTL_LIBS) $(KRB5_LIBS)
client_wallet_rekey_CPPFLAGS = $(REMCTL_CPPFLAGS) $(KRB5_CPPFLAGS)
client_wallet_rekey_LDFLAGS = $(REMCTL_LDFLAGS) $(KRB5_LDFLAGS)
client_wallet_rekey_LDADD = client/libwallet.a util/libutil.a \
portable/libportable.a $(REMCTL_LIBS) $(KRB5_LIBS)
dist_man_MANS = client/wallet.1 client/wallet-rekey.1 server/keytab-backend.8 \
server/wallet-admin.8 server/wallet-backend.8 server/wallet-report.8
# A set of flags for warnings. Add -O because gcc won't find some warnings
# without optimization turned on, and add -DDEBUG=1 so we'll also compile all
# debugging code and test it.
WARNINGS = -g -O -DDEBUG=1 -Wall -W -Wendif-labels -Wpointer-arith \
# without optimization turned on. Desirable warnings that can't be turned
# on due to other problems:
#
# -Wconversion http://bugs.debian.org/488884 (htons warnings)
#
# Last checked against gcc 4.4 (2010-08-15).
WARNINGS = -g -O -Wall -Wextra -Wendif-labels -Wformat=2 -Winit-self \
-Wswitch-enum -Wdeclaration-after-statement -Wshadow -Wpointer-arith \
-Wbad-function-cast -Wwrite-strings -Wstrict-prototypes \
-Wmissing-prototypes -Wnested-externs -Werror
......@@ -97,9 +112,9 @@ all-local: perl/blib/lib/Wallet/Config.pm
perl/blib/lib/Wallet/Config.pm:
set -e; if [ x"$(builddir)" != x"$(srcdir)" ] ; then \
mkdir perl/Wallet perl/Wallet/ACL perl/Wallet/ACL/NetDB \
perl/Wallet/Kadmin perl/Wallet/Object perl/t perl/t/data \
perl/t/lib 2>/dev/null || true ; \
mkdir perl/Wallet perl/Wallet/ACL perl/Wallet/ACL/Krb5 \
perl/Wallet/ACL/NetDB perl/Wallet/Kadmin perl/Wallet/Object \
perl/t perl/t/data perl/t/lib 2>/dev/null || true ; \
for f in $(PERL_FILES) ; do \
cp "$(srcdir)/$$f" "$(builddir)/$$f" ; \
done \
......
This diff is collapsed.
User-Visible wallet Changes
wallet 0.12 (2010-08-25)
New client program wallet-rekey that, given a list of keytabs on the
command line, requests new keytab objects for each principal in the
local realm and then merges the new objects into that keytab. The
current implementation only acquires new keys and doesn't purge any
old keys.
A new ACL type, krb5-regex, is now supported. This ACL type is the
same as krb5 except that the identifier is interpreted as a Perl
regular expression and matched against the authenticated identity
attempting to run a wallet command. Patch from Ian Durkacz.
Add a objects unused report to wallet-report and Wallet::Report,
returning all objects that have never been downloaded (in other words,
have never been the target of a get command).
Add an acls duplicate report to wallet-report and Wallet::Report,
returning sets of ACLs that have exactly the same entries.
Add a help command to wallet-report, which returns a summary of all
available commands.
Update to C TAP Harness 1.5:
* Better reporting of fatal errors in the test suite.
* Summarize results at the end of test execution.
* Add tests/HOWTO from docs/writing-tests in C TAP Harness.
Update to rra-c-util 2.6:
* Fix portability to bundled Heimdal on OpenBSD.
* Improve checking for krb5_kt_free_entry with older MIT Kerberos.
* Fix portability for missing krb5_get_init_creds_opt_free.
* Fix header guard for util/xwrite.h.
* Restore default compiler configuration after GSS-API library probe.
wallet 0.11 (2010-03-08)
When deleting an ACL on the server, verify that the ACL is not
......
wallet release 0.11
wallet release 0.12
(secure data management system)
Written by Russ Allbery <rra@stanford.edu>
......@@ -8,9 +8,6 @@
license. Please see the file LICENSE in the distribution for more
information.
This software is beta-quality and should be treated with caution. It is
currently being tested for production deployment at Stanford.
BLURB
The wallet is a system for managing secure data, authorization rules to
......@@ -275,4 +272,5 @@ THANKS
security models.
To Jon Robertson for the refactoring of Wallet::Kadmin, Heimdal support,
and many of the wallet server-side reports.
many of the wallet server-side reports, and the initial wallet-rekey
implementation.
......@@ -18,11 +18,6 @@ Client:
* Add readline support to the wallet client to make it easier to issue
multiple commands.
* Add support for rekeying in the wallet client. Need to resolve how to
get a list of principals to rekey and which keytabs to work on. This
possibly should be a separate binary from the regular wallet client
binary.
* Support authenticating with a keytab.
* Allow store data to contain nuls. Requires rewriting the command
......@@ -87,6 +82,9 @@ ACLs:
* Provide an API for verifiers to syntax-check the values before an ACL
is set and implement syntax checking for the Krb5 verifier.
* Investigate how best to support client authentication using anonymous
PKINIT for things like initial system keying.
Database:
* Fix case-insensitivity bug in unique keys with MySQL for objects.
......@@ -130,6 +128,19 @@ Objects:
Reports:
* Add audit for references to unknown ACLs, possibly introduced by
previous versions before ACL deletion was checked with database
backends that don't do referential integrity.
* Add report for all objects that have never been stored.
* Add report of all ACLs with identical contents.
* For objects tied to hostnames, report on objects referring to hosts
which do not exist. For the initial pass, this is probably only keytab
objects with names containing a slash where the part after the slash
looks like a hostname. This may need some configuration help.
* Make contrib/wallet-summary generic and include it in wallet-report,
with additional configuration in Wallet::Config. Enhance it to report
on any sort of object, not just on keytabs, and to give numbers on
......
......@@ -13,14 +13,14 @@
m4_ifndef([AC_AUTOCONF_VERSION],
[m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.65],,
[m4_warning([this file was generated for autoconf 2.65.
m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.67],,
[m4_warning([this file was generated for autoconf 2.67.
You have another version of autoconf. It may work, but is not guaranteed to.
If you have problems, you may need to regenerate the build system entirely.
To do so, use the procedure documented by the package, typically `autoreconf'.])])
# longlong.m4 serial 13
dnl Copyright (C) 1999-2007 Free Software Foundation, Inc.
# longlong.m4 serial 14
dnl Copyright (C) 1999-2007, 2009-2010 Free Software Foundation, Inc.
dnl This file is free software; the Free Software Foundation
dnl gives unlimited permission to copy and/or distribute it,
dnl with or without modifications, as long as this notice is preserved.
......@@ -41,33 +41,33 @@ AC_DEFUN([AC_TYPE_LONG_LONG_INT],
[AC_LINK_IFELSE(
[_AC_TYPE_LONG_LONG_SNIPPET],
[dnl This catches a bug in Tandem NonStop Kernel (OSS) cc -O circa 2004.
dnl If cross compiling, assume the bug isn't important, since
dnl nobody cross compiles for this platform as far as we know.
AC_RUN_IFELSE(
[AC_LANG_PROGRAM(
[[@%:@include <limits.h>
@%:@ifndef LLONG_MAX
@%:@ define HALF \
(1LL << (sizeof (long long int) * CHAR_BIT - 2))
@%:@ define LLONG_MAX (HALF - 1 + HALF)
@%:@endif]],
[[long long int n = 1;
int i;
for (i = 0; ; i++)
{
long long int m = n << i;
if (m >> i != n)
return 1;
if (LLONG_MAX / 2 < m)
break;
}
return 0;]])],
[ac_cv_type_long_long_int=yes],
[ac_cv_type_long_long_int=no],
[ac_cv_type_long_long_int=yes])],
dnl If cross compiling, assume the bug isn't important, since
dnl nobody cross compiles for this platform as far as we know.
AC_RUN_IFELSE(
[AC_LANG_PROGRAM(
[[@%:@include <limits.h>
@%:@ifndef LLONG_MAX
@%:@ define HALF \
(1LL << (sizeof (long long int) * CHAR_BIT - 2))
@%:@ define LLONG_MAX (HALF - 1 + HALF)
@%:@endif]],
[[long long int n = 1;
int i;
for (i = 0; ; i++)
{
long long int m = n << i;
if (m >> i != n)
return 1;
if (LLONG_MAX / 2 < m)
break;
}
return 0;]])],
[ac_cv_type_long_long_int=yes],
[ac_cv_type_long_long_int=no],
[ac_cv_type_long_long_int=yes])],
[ac_cv_type_long_long_int=no])])
if test $ac_cv_type_long_long_int = yes; then
AC_DEFINE([HAVE_LONG_LONG_INT], 1,
AC_DEFINE([HAVE_LONG_LONG_INT], [1],
[Define to 1 if the system has the type `long long int'.])
fi
])
......@@ -90,7 +90,7 @@ AC_DEFUN([AC_TYPE_UNSIGNED_LONG_LONG_INT],
[ac_cv_type_unsigned_long_long_int=yes],
[ac_cv_type_unsigned_long_long_int=no])])
if test $ac_cv_type_unsigned_long_long_int = yes; then
AC_DEFINE([HAVE_UNSIGNED_LONG_LONG_INT], 1,
AC_DEFINE([HAVE_UNSIGNED_LONG_LONG_INT], [1],
[Define to 1 if the system has the type `unsigned long long int'.])
fi
])
......@@ -103,30 +103,27 @@ AC_DEFUN([AC_TYPE_UNSIGNED_LONG_LONG_INT],
AC_DEFUN([_AC_TYPE_LONG_LONG_SNIPPET],
[
AC_LANG_PROGRAM(
[[/* Test preprocessor. */
#if ! (-9223372036854775807LL < 0 && 0 < 9223372036854775807ll)
error in preprocessor;
#endif
#if ! (18446744073709551615ULL <= -1ull)
error in preprocessor;
#endif
[[/* For now, do not test the preprocessor; as of 2007 there are too many
implementations with broken preprocessors. Perhaps this can
be revisited in 2012. In the meantime, code should not expect
#if to work with literals wider than 32 bits. */
/* Test literals. */
long long int ll = 9223372036854775807ll;
long long int nll = -9223372036854775807LL;
unsigned long long int ull = 18446744073709551615ULL;
/* Test constant expressions. */
typedef int a[((-9223372036854775807LL < 0 && 0 < 9223372036854775807ll)
? 1 : -1)];
? 1 : -1)];
typedef int b[(18446744073709551615ULL <= (unsigned long long int) -1
? 1 : -1)];
? 1 : -1)];
int i = 63;]],
[[/* Test availability of runtime routines for shift and division. */
long long int llmax = 9223372036854775807ll;
unsigned long long int ullmax = 18446744073709551615ull;
return ((ll << 63) | (ll >> 63) | (ll < i) | (ll > i)
| (llmax / ll) | (llmax % ll)
| (ull << 63) | (ull >> 63) | (ull << i) | (ull >> i)
| (ullmax / ull) | (ullmax % ull));]])
| (llmax / ll) | (llmax % ll)
| (ull << 63) | (ull >> 63) | (ull << i) | (ull >> i)
| (ullmax / ull) | (ullmax % ull));]])
])
# Copyright (C) 2002, 2003, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
......
......@@ -11,6 +11,8 @@ rm -rf autom4te.cache
version=`grep '^wallet' NEWS | head -1 | cut -d' ' -f2`
pod2man --release="$version" --center=wallet client/wallet.pod \
> client/wallet.1
pod2man --release="$version" --center=wallet client/wallet-rekey.pod \
> client/wallet-rekey.1
pod2man --release="$version" --center=wallet -s 8 contrib/wallet-summary \
> contrib/wallet-summary.8
pod2man --release="$version" --center=wallet -s 8 server/keytab-backend \
......
......@@ -47,6 +47,31 @@ overwrite_file(const char *name, const void *data, size_t length)
}
/*
* Given a filename, some data, and a length, append that data to an existing
* file. Dies on any failure.
*/
void
append_file(const char *name, const void *data, size_t length)
{
int fd;
ssize_t status;
fd = open(name, O_WRONLY | O_APPEND);
if (fd < 0)
sysdie("open of %s failed", name);
if (length > 0) {
status = write(fd, data, length);
if (status < 0)
sysdie("write to %s failed", name);
else if (status != (ssize_t) length)
die("write to %s truncated", name);
}
if (close(fd) < 0)
sysdie("close of %s failed (file probably truncated)", name);
}
/*
* Given a filename, some data, and a length, write that data to the given
* file safely and atomically by creating file.new, writing the data, linking
......
......@@ -15,12 +15,42 @@
#include <sys/types.h>
/*
* Allow defaults to be set for a particular site with configure options if
* people don't want to use krb5.conf for some reason.
*/
#ifndef WALLET_SERVER
# define WALLET_SERVER NULL
#endif
#ifndef WALLET_PORT
# define WALLET_PORT 0
#endif
/* Forward declarations to avoid unnecessary includes. */
struct remctl;
struct iovec;
/*
* Basic wallet behavior options set either on the command line or via
* krb5.conf. If set via krb5.conf, we allocate memory for the strings, but
* we never free them.
*/
struct options {
char *type;
char *server;
char *principal;
char *user;
int port;
};
BEGIN_DECLS
/*
* Set default options from the system krb5.conf or from compile-time
* defaults.
*/
void default_options(krb5_context ctx, struct options *options);
/*
* Given a Kerberos context and a principal name, obtain Kerberos credentials
* for that principal and store them in a temporary ticket cache for use by
......@@ -74,12 +104,28 @@ int get_file(struct remctl *, const char *prefix, const char *type,
int get_keytab(struct remctl *, krb5_context, const char *type,
const char *name, const char *file, const char *srvtab);
/*
* Given a remctl object, the Kerberos context, the type for the wallet
* interface, and a file name of a keytab, iterate through every existing
* principal in the keytab in the local realm, get fresh keys for those
* principals, and save the old and new keys to that file. Returns true on
* success and false on partial failure to retrieve all the keys.
*/
bool rekey_keytab(struct remctl *, krb5_context, const char *type,
const char *file);
/*
* Given a filename, some data, and a length, write that data to the given
* file with error checking, overwriting any existing contents.
*/
void overwrite_file(const char *name, const void *data, size_t length);
/*
* Given a filename, some data, and a length, append that data to an existing
* file. Dies on any failure.
*/
void append_file(const char *name, const void *data, size_t length);
/*
* Given a filename, some data, and a length, write that data to the given
* file safely and atomically by creating file.new, writing the data, linking
......
......@@ -17,13 +17,84 @@
#include <util/concat.h>
#include <util/messages-krb5.h>
#include <util/messages.h>
#include <util/xmalloc.h>
/* List of principals we have already encountered. */
struct principal_name {
char *princ;
struct principal_name *next;
};
/*
* Given keytab data as a pointer to memory and a length and the path of a
* second keytab, merge the keys in the memory keytab into the file keytab.
* Currently, this doesn't do any cleanup of old kvnos and doesn't handle
* duplicate kvnos correctly. Dies on any error.
* Given a context, a keytab file, and a realm, return a list of all
* principals in that file.
*/
static struct principal_name *
keytab_principals(krb5_context ctx, const char *file, char *realm)
{
char *princname = NULL, *princrealm = NULL;
bool found;
krb5_keytab keytab = NULL;
krb5_kt_cursor cursor;
krb5_keytab_entry entry;
krb5_error_code status;
struct principal_name *names = NULL, *current = NULL, *last = NULL;
memset(&entry, 0, sizeof(entry));
status = krb5_kt_resolve(ctx, file, &keytab);
if (status != 0)
die_krb5(ctx, status, "cannot open keytab %s", file);
status = krb5_kt_start_seq_get(ctx, keytab, &cursor);
if (status != 0)
die_krb5(ctx, status, "cannot read keytab %s", file);
while ((status = krb5_kt_next_entry(ctx, keytab, &entry, &cursor)) == 0) {
status = krb5_unparse_name(ctx, entry.principal, &princname);
if (status != 0)
die_krb5(ctx, status, "cannot unparse name for a principal");
/* Separate into principal and realm. */
princrealm = strchr(princname, '@');
if (princrealm != NULL) {
*princrealm = '\0';
princrealm++;
}
if (princrealm == NULL || strcmp(princrealm, realm) != 0)
continue;
/* Check to see if the principal has already been listed. */
found = false;
for (current = names; current != NULL; current = current->next) {
if (strcmp(current->princ, princname) == 0) {
found = true;
break;
}
last = current;
}
if (found == false) {
current = xmalloc(sizeof(struct principal_name));
current->princ = xstrdup(princname);
current->next = NULL;
if (last == NULL)
names = current;
else
last->next = current;
}
krb5_kt_free_entry(ctx, &entry);
free(princname);
}
if (status != KRB5_KT_END)
die_krb5(ctx, status, "error reading keytab %s", file);
krb5_kt_end_seq_get(ctx, keytab, &cursor);
krb5_kt_close(ctx, keytab);
return names;
}
/*
* Given two files containing keytab data, second keytab, merge the keys into
* the new file. Currently, this doesn't do any cleanup of old kvnos and
* doesn't handle duplicate kvnos correctly. Dies on any error.
*/
static void
merge_keytab(krb5_context ctx, const char *newfile, const char *file)
......@@ -62,10 +133,37 @@ merge_keytab(krb5_context ctx, const char *newfile, const char *file)
}
/*
* Given a remctl object, the type and name of a keytab object, and
* references to keytab data and data length, call the correct wallet
* commands to download a keytab and return the keytab data. Returns the
* status of the remctl command.
*/
static int
download_keytab(struct remctl *r, const char *type, const char *name,
char **data, size_t *length)
{
const char *command[5];
int status;
command[0] = type;
command[1] = "get";
command[2] = "keytab";
command[3] = name;
command[4] = NULL;
status = run_command(r, command, data, length);
if (*data == NULL && status == 0) {
warn("no data returned by wallet server");
return 255;
}
return status;
}
/*
* Given a remctl object, the Kerberos context, the name of a keytab object,
* and a file name, call the correct wallet commands to download a keytab and
* write it to that file. Returns the setatus or 255 on an internal error.
* write it to that file. Returns the status or 255 on an internal error.
*/
int
get_keytab(struct remctl *r, krb5_context ctx, const char *type,
......@@ -105,3 +203,70 @@ get_keytab(struct remctl *r, krb5_context ctx, const char *type,
}
return 0;
}
/*
* Given a remctl object, the Kerberos context, the type for the wallet
* interface, and a file name of a keytab, iterate through every existing
* principal in the keytab in the local realm, get fresh keys for those
* principals, and save the old and new keys to that file. Returns true on
* success and false on partial failure to retrieve all the keys.
*/
bool
rekey_keytab(struct remctl *r, krb5_context ctx, const char *type,
const char *file)
{