source: branches/samba-3.5.x/source4/heimdal/lib/krb5/keytab.c

Last change on this file was 414, checked in by Herwig Bauernfeind, 15 years ago

Samba 3.5.0: Initial import
File size: 22.4 KB
Line 
1/*
2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35
36/**
37 * @page krb5_keytab_intro The keytab handing functions
38 * @section section_krb5_keytab Kerberos Keytabs
39 *
40 * See the library functions here: @ref krb5_keytab
41 *
42 * Keytabs are long term key storage for servers, their equvalment of
43 * password files.
44 *
45 * Normally the only function that useful for server are to specify
46 * what keytab to use to other core functions like krb5_rd_req()
47 * krb5_kt_resolve(), and krb5_kt_close().
48 *
49 * @subsection krb5_keytab_names Keytab names
50 *
51 * A keytab name is on the form type:residual. The residual part is
52 * specific to each keytab-type.
53 *
54 * When a keytab-name is resolved, the type is matched with an internal
55 * list of keytab types. If there is no matching keytab type,
56 * the default keytab is used. The current default type is FILE.
57 *
58 * The default value can be changed in the configuration file
59 * /etc/krb5.conf by setting the variable
60 * [defaults]default_keytab_name.
61 *
62 * The keytab types that are implemented in Heimdal are:
63 * - file
64 * store the keytab in a file, the type's name is FILE . The
65 * residual part is a filename. For compatibility with other
66 * Kerberos implemtation WRFILE and JAVA14 is also accepted. WRFILE
67 * has the same format as FILE. JAVA14 have a format that is
68 * compatible with older versions of MIT kerberos and SUN's Java
69 * based installation. They store a truncted kvno, so when the knvo
70 * excess 255, they are truncted in this format.
71 *
72 * - keytab
73 * store the keytab in a AFS keyfile (usually /usr/afs/etc/KeyFile ),
74 * the type's name is AFSKEYFILE. The residual part is a filename.
75 *
76 * - krb4
77 * the keytab is a Kerberos 4 srvtab that is on-the-fly converted to
78 * a keytab. The type's name is krb4 The residual part is a
79 * filename.
80 *
81 * - memory
82 * The keytab is stored in a memory segment. This allows sensitive
83 * and/or temporary data not to be stored on disk. The type's name
84 * is MEMORY. Each MEMORY keytab is referenced counted by and
85 * opened by the residual name, so two handles can point to the
86 * same memory area. When the last user closes the entry, it
87 * disappears.
88 *
89 *
90 * @subsection krb5_keytab_example Keytab example
91 *
92 * This is a minimalistic version of ktutil.
93 *
94 * @code
95int
96main (int argc, char **argv)
97{
98 krb5_context context;
99 krb5_keytab keytab;
100 krb5_kt_cursor cursor;
101 krb5_keytab_entry entry;
102 krb5_error_code ret;
103 char *principal;
104
105 if (krb5_init_context (&context) != 0)
106 errx(1, "krb5_context");
107
108 ret = krb5_kt_default (context, &keytab);
109 if (ret)
110 krb5_err(context, 1, ret, "krb5_kt_default");
111
112 ret = krb5_kt_start_seq_get(context, keytab, &cursor);
113 if (ret)
114 krb5_err(context, 1, ret, "krb5_kt_start_seq_get");
115 while((ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0){
116 krb5_unparse_name_short(context, entry.principal, &principal);
117 printf("principal: %s\n", principal);
118 free(principal);
119 krb5_kt_free_entry(context, &entry);
120 }
121 ret = krb5_kt_end_seq_get(context, keytab, &cursor);
122 if (ret)
123 krb5_err(context, 1, ret, "krb5_kt_end_seq_get");
124 ret = krb5_kt_close(context, keytab);
125 if (ret)
126 krb5_err(context, 1, ret, "krb5_kt_close");
127 krb5_free_context(context);
128 return 0;
129}
130 * @endcode
131 *
132 */
133
134
135/**
136 * Register a new keytab backend.
137 *
138 * @param context a Keberos context.
139 * @param ops a backend to register.
140 *
141 * @return Return an error code or 0, see krb5_get_error_message().
142 *
143 * @ingroup krb5_keytab
144 */
145
146krb5_error_code KRB5_LIB_FUNCTION
147krb5_kt_register(krb5_context context,
148 const krb5_kt_ops *ops)
149{
150 struct krb5_keytab_data *tmp;
151
152 if (strlen(ops->prefix) > KRB5_KT_PREFIX_MAX_LEN - 1) {
153 krb5_set_error_message(context, KRB5_KT_BADNAME,
154 N_("can't register cache type, prefix too long", ""));
155 return KRB5_KT_BADNAME;
156 }
157
158 tmp = realloc(context->kt_types,
159 (context->num_kt_types + 1) * sizeof(*context->kt_types));
160 if(tmp == NULL) {
161 krb5_set_error_message(context, ENOMEM,
162 N_("malloc: out of memory", ""));
163 return ENOMEM;
164 }
165 memcpy(&tmp[context->num_kt_types], ops,
166 sizeof(tmp[context->num_kt_types]));
167 context->kt_types = tmp;
168 context->num_kt_types++;
169 return 0;
170}
171
172/**
173 * Resolve the keytab name (of the form `type:residual') in `name'
174 * into a keytab in `id'.
175 *
176 * @param context a Keberos context.
177 * @param name name to resolve
178 * @param id resulting keytab, free with krb5_kt_close().
179 *
180 * @return Return an error code or 0, see krb5_get_error_message().
181 *
182 * @ingroup krb5_keytab
183 */
184
185
186krb5_error_code KRB5_LIB_FUNCTION
187krb5_kt_resolve(krb5_context context,
188 const char *name,
189 krb5_keytab *id)
190{
191 krb5_keytab k;
192 int i;
193 const char *type, *residual;
194 size_t type_len;
195 krb5_error_code ret;
196
197 residual = strchr(name, ':');
198 if(residual == NULL) {
199 type = "FILE";
200 type_len = strlen(type);
201 residual = name;
202 } else {
203 type = name;
204 type_len = residual - name;
205 residual++;
206 }
207
208 for(i = 0; i < context->num_kt_types; i++) {
209 if(strncasecmp(type, context->kt_types[i].prefix, type_len) == 0)
210 break;
211 }
212 if(i == context->num_kt_types) {
213 krb5_set_error_message(context, KRB5_KT_UNKNOWN_TYPE,
214 N_("unknown keytab type %.*s", "type"),
215 (int)type_len, type);
216 return KRB5_KT_UNKNOWN_TYPE;
217 }
218
219 k = malloc (sizeof(*k));
220 if (k == NULL) {
221 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
222 return ENOMEM;
223 }
224 memcpy(k, &context->kt_types[i], sizeof(*k));
225 k->data = NULL;
226 ret = (*k->resolve)(context, residual, k);
227 if(ret) {
228 free(k);
229 k = NULL;
230 }
231 *id = k;
232 return ret;
233}
234
235/**
236 * copy the name of the default keytab into `name'.
237 *
238 * @param context a Keberos context.
239 * @param name buffer where the name will be written
240 * @param namesize length of name
241 *
242 * @return Return an error code or 0, see krb5_get_error_message().
243 *
244 * @ingroup krb5_keytab
245 */
246
247krb5_error_code KRB5_LIB_FUNCTION
248krb5_kt_default_name(krb5_context context, char *name, size_t namesize)
249{
250 if (strlcpy (name, context->default_keytab, namesize) >= namesize) {
251 krb5_clear_error_message (context);
252 return KRB5_CONFIG_NOTENUFSPACE;
253 }
254 return 0;
255}
256
257/**
258 * Copy the name of the default modify keytab into `name'.
259 *
260 * @param context a Keberos context.
261 * @param name buffer where the name will be written
262 * @param namesize length of name
263 *
264 * @return Return an error code or 0, see krb5_get_error_message().
265 *
266 * @ingroup krb5_keytab
267 */
268
269krb5_error_code KRB5_LIB_FUNCTION
270krb5_kt_default_modify_name(krb5_context context, char *name, size_t namesize)
271{
272 const char *kt = NULL;
273 if(context->default_keytab_modify == NULL) {
274 if(strncasecmp(context->default_keytab, "ANY:", 4) != 0)
275 kt = context->default_keytab;
276 else {
277 size_t len = strcspn(context->default_keytab + 4, ",");
278 if(len >= namesize) {
279 krb5_clear_error_message(context);
280 return KRB5_CONFIG_NOTENUFSPACE;
281 }
282 strlcpy(name, context->default_keytab + 4, namesize);
283 name[len] = '\0';
284 return 0;
285 }
286 } else
287 kt = context->default_keytab_modify;
288 if (strlcpy (name, kt, namesize) >= namesize) {
289 krb5_clear_error_message (context);
290 return KRB5_CONFIG_NOTENUFSPACE;
291 }
292 return 0;
293}
294
295/**
296 * Set `id' to the default keytab.
297 *
298 * @param context a Keberos context.
299 * @param id the new default keytab.
300 *
301 * @return Return an error code or 0, see krb5_get_error_message().
302 *
303 * @ingroup krb5_keytab
304 */
305
306krb5_error_code KRB5_LIB_FUNCTION
307krb5_kt_default(krb5_context context, krb5_keytab *id)
308{
309 return krb5_kt_resolve (context, context->default_keytab, id);
310}
311
312/**
313 * Read the key identified by `(principal, vno, enctype)' from the
314 * keytab in `keyprocarg' (the default if == NULL) into `*key'.
315 *
316 * @param context a Keberos context.
317 * @param keyprocarg
318 * @param principal
319 * @param vno
320 * @param enctype
321 * @param key
322 *
323 * @return Return an error code or 0, see krb5_get_error_message().
324 *
325 * @ingroup krb5_keytab
326 */
327
328krb5_error_code KRB5_LIB_FUNCTION
329krb5_kt_read_service_key(krb5_context context,
330 krb5_pointer keyprocarg,
331 krb5_principal principal,
332 krb5_kvno vno,
333 krb5_enctype enctype,
334 krb5_keyblock **key)
335{
336 krb5_keytab keytab;
337 krb5_keytab_entry entry;
338 krb5_error_code ret;
339
340 if (keyprocarg)
341 ret = krb5_kt_resolve (context, keyprocarg, &keytab);
342 else
343 ret = krb5_kt_default (context, &keytab);
344
345 if (ret)
346 return ret;
347
348 ret = krb5_kt_get_entry (context, keytab, principal, vno, enctype, &entry);
349 krb5_kt_close (context, keytab);
350 if (ret)
351 return ret;
352 ret = krb5_copy_keyblock (context, &entry.keyblock, key);
353 krb5_kt_free_entry(context, &entry);
354 return ret;
355}
356
357/**
358 * Return the type of the `keytab' in the string `prefix of length
359 * `prefixsize'.
360 *
361 * @param context a Keberos context.
362 * @param keytab the keytab to get the prefix for
363 * @param prefix prefix buffer
364 * @param prefixsize length of prefix buffer
365 *
366 * @return Return an error code or 0, see krb5_get_error_message().
367 *
368 * @ingroup krb5_keytab
369 */
370
371krb5_error_code KRB5_LIB_FUNCTION
372krb5_kt_get_type(krb5_context context,
373 krb5_keytab keytab,
374 char *prefix,
375 size_t prefixsize)
376{
377 strlcpy(prefix, keytab->prefix, prefixsize);
378 return 0;
379}
380
381/**
382 * Retrieve the name of the keytab `keytab' into `name', `namesize'
383 *
384 * @param context a Keberos context.
385 * @param keytab the keytab to get the name for.
386 * @param name name buffer.
387 * @param namesize size of name buffer.
388 *
389 * @return Return an error code or 0, see krb5_get_error_message().
390 *
391 * @ingroup krb5_keytab
392 */
393
394krb5_error_code KRB5_LIB_FUNCTION
395krb5_kt_get_name(krb5_context context,
396 krb5_keytab keytab,
397 char *name,
398 size_t namesize)
399{
400 return (*keytab->get_name)(context, keytab, name, namesize);
401}
402
403/**
404 * Retrieve the full name of the keytab `keytab' and store the name in
405 * `str'.
406 *
407 * @param context a Keberos context.
408 * @param keytab keytab to get name for.
409 * @param str the name of the keytab name, usee krb5_xfree() to free
410 * the string. On error, *str is set to NULL.
411 *
412 * @return Return an error code or 0, see krb5_get_error_message().
413 *
414 * @ingroup krb5_keytab
415 */
416
417krb5_error_code KRB5_LIB_FUNCTION
418krb5_kt_get_full_name(krb5_context context,
419 krb5_keytab keytab,
420 char **str)
421{
422 char type[KRB5_KT_PREFIX_MAX_LEN];
423 char name[MAXPATHLEN];
424 krb5_error_code ret;
425
426 *str = NULL;
427
428 ret = krb5_kt_get_type(context, keytab, type, sizeof(type));
429 if (ret)
430 return ret;
431
432 ret = krb5_kt_get_name(context, keytab, name, sizeof(name));
433 if (ret)
434 return ret;
435
436 if (asprintf(str, "%s:%s", type, name) == -1) {
437 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
438 *str = NULL;
439 return ENOMEM;
440 }
441
442 return 0;
443}
444
445/**
446 * Finish using the keytab in `id'. All resources will be released,
447 * even on errors.
448 *
449 * @param context a Keberos context.
450 * @param id keytab to close.
451 *
452 * @return Return an error code or 0, see krb5_get_error_message().
453 *
454 * @ingroup krb5_keytab
455 */
456
457krb5_error_code KRB5_LIB_FUNCTION
458krb5_kt_close(krb5_context context,
459 krb5_keytab id)
460{
461 krb5_error_code ret;
462
463 ret = (*id->close)(context, id);
464 memset(id, 0, sizeof(*id));
465 free(id);
466 return ret;
467}
468
469/**
470 * Destroy (remove) the keytab in `id'. All resources will be released,
471 * even on errors, does the equvalment of krb5_kt_close() on the resources.
472 *
473 * @param context a Keberos context.
474 * @param id keytab to destroy.
475 *
476 * @return Return an error code or 0, see krb5_get_error_message().
477 *
478 * @ingroup krb5_keytab
479 */
480
481krb5_error_code KRB5_LIB_FUNCTION
482krb5_kt_destroy(krb5_context context,
483 krb5_keytab id)
484{
485 krb5_error_code ret;
486
487 ret = (*id->destroy)(context, id);
488 krb5_kt_close(context, id);
489 return ret;
490}
491
492/*
493 * Match any aliases in keytab `entry' with `principal'.
494 */
495
496static krb5_boolean
497compare_aliseses(krb5_context context,
498 krb5_keytab_entry *entry,
499 krb5_const_principal principal)
500{
501 unsigned int i;
502 if (entry->aliases == NULL)
503 return FALSE;
504 for (i = 0; i < entry->aliases->len; i++)
505 if (krb5_principal_compare(context, &entry->aliases->val[i], principal))
506 return TRUE;
507 return FALSE;
508}
509
510/**
511 * Compare `entry' against `principal, vno, enctype'.
512 * Any of `principal, vno, enctype' might be 0 which acts as a wildcard.
513 * Return TRUE if they compare the same, FALSE otherwise.
514 *
515 * @param context a Keberos context.
516 * @param entry an entry to match with.
517 * @param principal principal to match, NULL matches all principals.
518 * @param vno key version to match, 0 matches all key version numbers.
519 * @param enctype encryption type to match, 0 matches all encryption types.
520 *
521 * @return Return TRUE or match, FALSE if not matched.
522 *
523 * @ingroup krb5_keytab
524 */
525
526krb5_boolean KRB5_LIB_FUNCTION
527krb5_kt_compare(krb5_context context,
528 krb5_keytab_entry *entry,
529 krb5_const_principal principal,
530 krb5_kvno vno,
531 krb5_enctype enctype)
532{
533 if(principal != NULL &&
534 !(krb5_principal_compare(context, entry->principal, principal) ||
535 compare_aliseses(context, entry, principal)))
536 return FALSE;
537 if(vno && vno != entry->vno)
538 return FALSE;
539 if(enctype && enctype != entry->keyblock.keytype)
540 return FALSE;
541 return TRUE;
542}
543
544krb5_error_code
545_krb5_kt_principal_not_found(krb5_context context,
546 krb5_error_code ret,
547 krb5_keytab id,
548 krb5_const_principal principal,
549 krb5_enctype enctype,
550 int kvno)
551{
552 char princ[256], kvno_str[25], *kt_name;
553 char *enctype_str = NULL;
554
555 krb5_unparse_name_fixed (context, principal, princ, sizeof(princ));
556 krb5_kt_get_full_name (context, id, &kt_name);
557 krb5_enctype_to_string(context, enctype, &enctype_str);
558
559 if (kvno)
560 snprintf(kvno_str, sizeof(kvno_str), "(kvno %d)", kvno);
561 else
562 kvno_str[0] = '\0';
563
564 krb5_set_error_message (context, ret,
565 N_("Failed to find %s%s in keytab %s (%s)",
566 "principal, kvno, keytab file, enctype"),
567 princ,
568 kvno_str,
569 kt_name ? kt_name : "unknown keytab",
570 enctype_str ? enctype_str : "unknown enctype");
571 free(kt_name);
572 free(enctype_str);
573 return ret;
574}
575
576
577/**
578 * Retrieve the keytab entry for `principal, kvno, enctype' into `entry'
579 * from the keytab `id'. Matching is done like krb5_kt_compare().
580 *
581 * @param context a Keberos context.
582 * @param id a keytab.
583 * @param principal principal to match, NULL matches all principals.
584 * @param kvno key version to match, 0 matches all key version numbers.
585 * @param enctype encryption type to match, 0 matches all encryption types.
586 * @param entry the returned entry, free with krb5_kt_free_entry().
587 *
588 * @return Return an error code or 0, see krb5_get_error_message().
589 *
590 * @ingroup krb5_keytab
591 */
592
593krb5_error_code KRB5_LIB_FUNCTION
594krb5_kt_get_entry(krb5_context context,
595 krb5_keytab id,
596 krb5_const_principal principal,
597 krb5_kvno kvno,
598 krb5_enctype enctype,
599 krb5_keytab_entry *entry)
600{
601 krb5_keytab_entry tmp;
602 krb5_error_code ret;
603 krb5_kt_cursor cursor;
604
605 if(id->get)
606 return (*id->get)(context, id, principal, kvno, enctype, entry);
607
608 ret = krb5_kt_start_seq_get (context, id, &cursor);
609 if (ret) {
610 /* This is needed for krb5_verify_init_creds, but keep error
611 * string from previous error for the human. */
612 context->error_code = KRB5_KT_NOTFOUND;
613 return KRB5_KT_NOTFOUND;
614 }
615
616 entry->vno = 0;
617 while (krb5_kt_next_entry(context, id, &tmp, &cursor) == 0) {
618 if (krb5_kt_compare(context, &tmp, principal, 0, enctype)) {
619 /* the file keytab might only store the lower 8 bits of
620 the kvno, so only compare those bits */
621 if (kvno == tmp.vno
622 || (tmp.vno < 256 && kvno % 256 == tmp.vno)) {
623 krb5_kt_copy_entry_contents (context, &tmp, entry);
624 krb5_kt_free_entry (context, &tmp);
625 krb5_kt_end_seq_get(context, id, &cursor);
626 return 0;
627 } else if (kvno == 0 && tmp.vno > entry->vno) {
628 if (entry->vno)
629 krb5_kt_free_entry (context, entry);
630 krb5_kt_copy_entry_contents (context, &tmp, entry);
631 }
632 }
633 krb5_kt_free_entry(context, &tmp);
634 }
635 krb5_kt_end_seq_get (context, id, &cursor);
636 if (entry->vno == 0)
637 return _krb5_kt_principal_not_found(context, KRB5_KT_NOTFOUND,
638 id, principal, enctype, kvno);
639 return 0;
640}
641
642/**
643 * Copy the contents of `in' into `out'.
644 *
645 * @param context a Keberos context.
646 * @param in the keytab entry to copy.
647 * @param out the copy of the keytab entry, free with krb5_kt_free_entry().
648 *
649 * @return Return an error code or 0, see krb5_get_error_message().
650 *
651 * @ingroup krb5_keytab
652 */
653
654krb5_error_code KRB5_LIB_FUNCTION
655krb5_kt_copy_entry_contents(krb5_context context,
656 const krb5_keytab_entry *in,
657 krb5_keytab_entry *out)
658{
659 krb5_error_code ret;
660
661 memset(out, 0, sizeof(*out));
662 out->vno = in->vno;
663
664 ret = krb5_copy_principal (context, in->principal, &out->principal);
665 if (ret)
666 goto fail;
667 ret = krb5_copy_keyblock_contents (context,
668 &in->keyblock,
669 &out->keyblock);
670 if (ret)
671 goto fail;
672 out->timestamp = in->timestamp;
673 return 0;
674fail:
675 krb5_kt_free_entry (context, out);
676 return ret;
677}
678
679/**
680 * Free the contents of `entry'.
681 *
682 * @param context a Keberos context.
683 * @param entry the entry to free
684 *
685 * @return Return an error code or 0, see krb5_get_error_message().
686 *
687 * @ingroup krb5_keytab
688 */
689
690krb5_error_code KRB5_LIB_FUNCTION
691krb5_kt_free_entry(krb5_context context,
692 krb5_keytab_entry *entry)
693{
694 krb5_free_principal (context, entry->principal);
695 krb5_free_keyblock_contents (context, &entry->keyblock);
696 memset(entry, 0, sizeof(*entry));
697 return 0;
698}
699
700/**
701 * Set `cursor' to point at the beginning of `id'.
702 *
703 * @param context a Keberos context.
704 * @param id a keytab.
705 * @param cursor a newly allocated cursor, free with krb5_kt_end_seq_get().
706 *
707 * @return Return an error code or 0, see krb5_get_error_message().
708 *
709 * @ingroup krb5_keytab
710 */
711
712krb5_error_code KRB5_LIB_FUNCTION
713krb5_kt_start_seq_get(krb5_context context,
714 krb5_keytab id,
715 krb5_kt_cursor *cursor)
716{
717 if(id->start_seq_get == NULL) {
718 krb5_set_error_message(context, HEIM_ERR_OPNOTSUPP,
719 N_("start_seq_get is not supported "
720 "in the %s keytab type", ""),
721 id->prefix);
722 return HEIM_ERR_OPNOTSUPP;
723 }
724 return (*id->start_seq_get)(context, id, cursor);
725}
726
727/**
728 * Get the next entry from keytab, advance the cursor. On last entry
729 * the function will return KRB5_KT_END.
730 *
731 * @param context a Keberos context.
732 * @param id a keytab.
733 * @param entry the returned entry, free with krb5_kt_free_entry().
734 * @param cursor the cursor of the iteration.
735 *
736 * @return Return an error code or 0, see krb5_get_error_message().
737 *
738 * @ingroup krb5_keytab
739 */
740
741krb5_error_code KRB5_LIB_FUNCTION
742krb5_kt_next_entry(krb5_context context,
743 krb5_keytab id,
744 krb5_keytab_entry *entry,
745 krb5_kt_cursor *cursor)
746{
747 if(id->next_entry == NULL) {
748 krb5_set_error_message(context, HEIM_ERR_OPNOTSUPP,
749 N_("next_entry is not supported in the %s "
750 " keytab", ""),
751 id->prefix);
752 return HEIM_ERR_OPNOTSUPP;
753 }
754 return (*id->next_entry)(context, id, entry, cursor);
755}
756
757/**
758 * Release all resources associated with `cursor'.
759 *
760 * @param context a Keberos context.
761 * @param id a keytab.
762 * @param cursor the cursor to free.
763 *
764 * @return Return an error code or 0, see krb5_get_error_message().
765 *
766 * @ingroup krb5_keytab
767 */
768
769krb5_error_code KRB5_LIB_FUNCTION
770krb5_kt_end_seq_get(krb5_context context,
771 krb5_keytab id,
772 krb5_kt_cursor *cursor)
773{
774 if(id->end_seq_get == NULL) {
775 krb5_set_error_message(context, HEIM_ERR_OPNOTSUPP,
776 "end_seq_get is not supported in the %s "
777 " keytab", id->prefix);
778 return HEIM_ERR_OPNOTSUPP;
779 }
780 return (*id->end_seq_get)(context, id, cursor);
781}
782
783/**
784 * Add the entry in `entry' to the keytab `id'.
785 *
786 * @param context a Keberos context.
787 * @param id a keytab.
788 * @param entry the entry to add
789 *
790 * @return Return an error code or 0, see krb5_get_error_message().
791 *
792 * @ingroup krb5_keytab
793 */
794
795krb5_error_code KRB5_LIB_FUNCTION
796krb5_kt_add_entry(krb5_context context,
797 krb5_keytab id,
798 krb5_keytab_entry *entry)
799{
800 if(id->add == NULL) {
801 krb5_set_error_message(context, KRB5_KT_NOWRITE,
802 N_("Add is not supported in the %s keytab", ""),
803 id->prefix);
804 return KRB5_KT_NOWRITE;
805 }
806 entry->timestamp = time(NULL);
807 return (*id->add)(context, id,entry);
808}
809
810/**
811 * Remove an entry from the keytab, matching is done using
812 * krb5_kt_compare().
813
814 * @param context a Keberos context.
815 * @param id a keytab.
816 * @param entry the entry to remove
817 *
818 * @return Return an error code or 0, see krb5_get_error_message().
819 *
820 * @ingroup krb5_keytab
821 */
822
823krb5_error_code KRB5_LIB_FUNCTION
824krb5_kt_remove_entry(krb5_context context,
825 krb5_keytab id,
826 krb5_keytab_entry *entry)
827{
828 if(id->remove == NULL) {
829 krb5_set_error_message(context, KRB5_KT_NOWRITE,
830 N_("Remove is not supported in the %s keytab", ""),
831 id->prefix);
832 return KRB5_KT_NOWRITE;
833 }
834 return (*id->remove)(context, id, entry);
835}
Note: See TracBrowser for help on using the repository browser.