Remove the v4 and afs3 salt types

In preparation for removing single-DES support, remove the v4 and afs3
salt types.  The afs3 salt type could only be used with single-DES
keys, and the v4 salt type was only useful for single-DES keys from
krb4 databases.

[ghudson@mit.edu: wrote commit message]

ticket: 8808

17 files changed, 25 insertions, 165 deletions

diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
index c73791c..62d1bfc 100644
--- a/doc/admin/conf_files/kdc_conf.rst
+++ b/doc/admin/conf_files/kdc_conf.rst
@@ -917,10 +917,8 @@ follows:
 
 ================= ============================================
 normal            default for Kerberos Version 5
-v4                the only type used by Kerberos Version 4 (no salt)
 norealm           same as the default, without using realm information
 onlyrealm         uses only realm information as the salt
-afs3              AFS version 3, only used for compatibility with Kerberos 4 in AFS
 special           generate a random salt
 ================= ============================================
 
diff --git a/src/include/kdb.h b/src/include/kdb.h
index 92f8458..0c48da6 100644
--- a/src/include/kdb.h
+++ b/src/include/kdb.h
@@ -73,11 +73,11 @@
 
 /* Salt types */
 #define KRB5_KDB_SALTTYPE_NORMAL        0
-#define KRB5_KDB_SALTTYPE_V4            1
+/* #define KRB5_KDB_SALTTYPE_V4            1 */
 #define KRB5_KDB_SALTTYPE_NOREALM       2
 #define KRB5_KDB_SALTTYPE_ONLYREALM     3
 #define KRB5_KDB_SALTTYPE_SPECIAL       4
-#define KRB5_KDB_SALTTYPE_AFS3          5
+/* #define KRB5_KDB_SALTTYPE_AFS3          5 */
 #define KRB5_KDB_SALTTYPE_CERTHASH      6
 
 /* Attributes */
diff --git a/src/kadmin/testing/proto/kdc.conf.proto b/src/kadmin/testing/proto/kdc.conf.proto
index 61283ac..45df78b 100644
--- a/src/kadmin/testing/proto/kdc.conf.proto
+++ b/src/kadmin/testing/proto/kdc.conf.proto
@@ -12,5 +12,5 @@
 		kadmind_port = 1751
 		kpasswd_port = 1752
 		master_key_type = des3-hmac-sha1
-		supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-md5:normal des-cbc-raw:normal
+		supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal des-cbc-md5:normal des-cbc-raw:normal
 	}
diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index caf133c..508a5cf 100644
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -781,8 +781,8 @@ add_etype_info(krb5_context context, krb5_kdcpreauth_rock rock,
     return add_pa_data_element(pa_list, pa);
 }
 
-/* Add PW-SALT or AFS3-SALT entries to pa_list as appropriate for the request
- * and client principal. */
+/* Add PW-SALT entries to pa_list as appropriate for the request and client
+ * principal. */
 static krb5_error_code
 add_pw_salt(krb5_context context, krb5_kdcpreauth_rock rock,
             krb5_pa_data ***pa_list)
@@ -801,21 +801,13 @@ add_pw_salt(krb5_context context, krb5_kdcpreauth_rock rock,
     if (ret)
         return 0;
 
-    if (salttype == KRB5_KDB_SALTTYPE_AFS3) {
-        ret = alloc_pa_data(KRB5_PADATA_AFS3_SALT, salt->length + 1, &pa);
-        if (ret)
-            goto cleanup;
-        memcpy(pa->contents, salt->data, salt->length);
-        pa->contents[salt->length] = '\0';
-    } else {
-        /* Steal memory from salt to make the pa-data entry. */
-        ret = alloc_pa_data(KRB5_PADATA_PW_SALT, 0, &pa);
-        if (ret)
-            goto cleanup;
-        pa->length = salt->length;
-        pa->contents = (uint8_t *)salt->data;
-        salt->data = NULL;
-    }
+    /* Steal memory from salt to make the pa-data entry. */
+    ret = alloc_pa_data(KRB5_PADATA_PW_SALT, 0, &pa);
+    if (ret)
+        goto cleanup;
+    pa->length = salt->length;
+    pa->contents = (uint8_t *)salt->data;
+    salt->data = NULL;
 
     /* add_pa_data_element() claims pa on success or failure. */
     ret = add_pa_data_element(pa_list, pa);
@@ -1545,20 +1537,6 @@ _make_etype_info_entry(krb5_context context,
                                    &salttype, &salt);
     if (retval)
         goto cleanup;
-    if (etype_info2 && salttype == KRB5_KDB_SALTTYPE_AFS3) {
-        switch (etype) {
-        case ENCTYPE_DES_CBC_CRC:
-        case ENCTYPE_DES_CBC_MD4:
-        case ENCTYPE_DES_CBC_MD5:
-            retval = alloc_data(&entry->s2kparams, 1);
-            if (retval)
-                goto cleanup;
-            entry->s2kparams.data[0] = 1;
-            break;
-        default:
-            break;
-        }
-    }
 
     entry->length = salt->length;
     entry->salt = (unsigned char *)salt->data;
diff --git a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
index 8361fb0..db899a1 100644
--- a/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
+++ b/src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
@@ -18,8 +18,8 @@ proc test200 {} {
 
     # I'd like to specify a long list of keysalt tuples and make sure
     # that chpass does the right thing, but we can only use those
-    # enctypes that krbtgt has a key for: des-cbc-crc:normal and
-    # des-cbc-crc:v4, according to the prototype kdc.conf.
+    # enctypes that krbtgt has a key for: des-cbc-crc:normal
+    # according to the prototype kdc.conf.
     if {! [cmd [format {
 	kadm5_init admin admin $KADM5_ADMIN_SERVICE null \
 		$KADM5_STRUCT_VERSION $KADM5_API_VERSION_3 \
@@ -53,10 +53,10 @@ proc test200 {} {
     }
 
     # XXX Perhaps I should actually check the key type returned.
-    if {$num_keys == 3} {
+    if {$num_keys == 2} {
 	pass "$test"
     } else {
-	fail "$test: $num_keys keys, should be 3"
+	fail "$test: $num_keys keys, should be 2"
     }
     if { ! [cmd {kadm5_destroy $server_handle}]} {
 	perror "$test: unexpected failure in destroy"
diff --git a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
index 86c45f4..8526897 100644
--- a/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
+++ b/src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
@@ -143,8 +143,8 @@ proc test101_102 {rpc} {
     }
 
     set failed 0
-    if {$num_keys != 3} {
-	fail "$test: num_keys $num_keys should be 3"
+    if {$num_keys != 2} {
+	fail "$test: num_keys $num_keys should be 2"
 	set failed 1
     }
     for {set i 0} {$i < $num_keys} {incr i} {
diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c
index 0c25bf2..b910bd3 100644
--- a/src/lib/kdb/kdb5.c
+++ b/src/lib/kdb/kdb5.c
@@ -2318,15 +2318,11 @@ krb5_dbe_compute_salt(krb5_context context, const krb5_key_data *key,
         if (retval)
             return retval;
         break;
-    case KRB5_KDB_SALTTYPE_V4:
-        sdata = empty_data();
-        break;
     case KRB5_KDB_SALTTYPE_NOREALM:
         retval = krb5_principal2salt_norealm(context, princ, &sdata);
         if (retval)
             return retval;
         break;
-    case KRB5_KDB_SALTTYPE_AFS3:
     case KRB5_KDB_SALTTYPE_ONLYREALM:
         return krb5_copy_data(context, &princ->realm, salt_out);
     case KRB5_KDB_SALTTYPE_SPECIAL:
diff --git a/src/lib/kdb/kdb_cpw.c b/src/lib/kdb/kdb_cpw.c
index 03efc28..450860f 100644
--- a/src/lib/kdb/kdb_cpw.c
+++ b/src/lib/kdb/kdb_cpw.c
@@ -260,7 +260,6 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
     krb5_keysalt          key_salt;
     krb5_keyblock         key;
     krb5_data             pwd;
-    krb5_data             afs_params = string2data("\1"), *s2k_params;
     int                   i, j;
     krb5_key_data        *kd_slot;
 
@@ -268,7 +267,6 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
         krb5_boolean similar;
 
         similar = 0;
-        s2k_params = NULL;
 
         /*
          * We could use krb5_keysalt_iterate to replace this loop, or use
@@ -316,18 +314,6 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
                                               &key_salt.data)))
                 return(retval);
             break;
-        case KRB5_KDB_SALTTYPE_V4:
-            key_salt.data.length = 0;
-            key_salt.data.data = 0;
-            break;
-        case KRB5_KDB_SALTTYPE_AFS3:
-            retval = krb5int_copy_data_contents(context,
-                                                &db_entry->princ->realm,
-                                                &key_salt.data);
-            if (retval)
-                return retval;
-            s2k_params = &afs_params;
-            break;
         case KRB5_KDB_SALTTYPE_SPECIAL:
             retval = make_random_salt(context, &key_salt);
             if (retval)
@@ -342,7 +328,7 @@ add_key_pwd(context, master_key, ks_tuple, ks_tuple_count, passwd,
         retval = krb5_c_string_to_key_with_params(context,
                                                   ks_tuple[i].ks_enctype,
                                                   &pwd, &key_salt.data,
-                                                  s2k_params, &key);
+                                                  NULL, &key);
         if (retval) {
             free(key_salt.data.data);
             return retval;
diff --git a/src/lib/krb5/krb/str_conv.c b/src/lib/krb5/krb/str_conv.c
index 3d05724..c8421a8 100644
--- a/src/lib/krb5/krb/str_conv.c
+++ b/src/lib/krb5/krb/str_conv.c
@@ -61,11 +61,9 @@ struct salttype_lookup_entry {
 #include "kdb.h"
 static const struct salttype_lookup_entry salttype_table[] = {
     { KRB5_KDB_SALTTYPE_NORMAL,     "normal"     },
-    { KRB5_KDB_SALTTYPE_V4,         "v4",        },
     { KRB5_KDB_SALTTYPE_NOREALM,    "norealm",   },
     { KRB5_KDB_SALTTYPE_ONLYREALM,  "onlyrealm", },
     { KRB5_KDB_SALTTYPE_SPECIAL,    "special",   },
-    { KRB5_KDB_SALTTYPE_AFS3,       "afs3",      },
 };
 static const int salttype_table_nents = sizeof(salttype_table)/
     sizeof(salttype_table[0]);
diff --git a/src/lib/krb5/krb/t_get_etype_info.py b/src/lib/krb5/krb/t_get_etype_info.py
index 7c400be..3c91685 100644
--- a/src/lib/krb5/krb/t_get_etype_info.py
+++ b/src/lib/krb5/krb/t_get_etype_info.py
@@ -9,9 +9,6 @@ realm.run([kadminl, 'ank', '-nokey', '+preauth', 'pnokey'])
 realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', 'exp'])
 realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', '+preauth',
            'pexp'])
-realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', 'afs'])
-realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', '+preauth',
-           'pafs'])
 
 # Extract the explicit salt values from the database.
 out = realm.run([kdb5_util, 'tabdump', 'keyinfo'])
@@ -56,8 +53,4 @@ realm.run(['./t_get_etype_info', 'exp'],
 realm.run(['./t_get_etype_info', 'pexp'],
           expected_msg='etype: aes256-cts\nsalt: ' + pexp_salt + '\n')
 
-msg = 'etype: des-cbc-crc\nsalt: KRBTEST.COM\ns2kparams: 01\n'
-realm.run(['./t_get_etype_info', 'afs'], expected_msg=msg)
-realm.run(['./t_get_etype_info', 'pafs'], expected_msg=msg)
-
 success('krb5_get_etype_info() tests')
diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index 05cc8f6..4a75be8 100644
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDC.CONF" "5" " " "1.17" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.18" "MIT Kerberos"
 .SH NAME
 kdc.conf \- Kerberos V5 KDC configuration file
 .
@@ -1148,12 +1148,6 @@ default for Kerberos Version 5
 T}
 _
 T{
-v4
-T}	T{
-the only type used by Kerberos Version 4 (no salt)
-T}
-_
-T{
 norealm
 T}	T{
 same as the default, without using realm information
@@ -1166,12 +1160,6 @@ uses only realm information as the salt
 T}
 _
 T{
-afs3
-T}	T{
-AFS version 3, only used for compatibility with Kerberos 4 in AFS
-T}
-_
-T{
 special
 T}	T{
 generate a random salt
@@ -1233,6 +1221,6 @@ krb5.conf(5), krb5kdc(8), kadm5.acl(5)
 .SH AUTHOR
 MIT
 .SH COPYRIGHT
-1985-2018, MIT
+1985-2019, MIT
 .\" Generated by docutils manpage writer.
 .
diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp
index ea9bedd..c061d76 100644
--- a/src/tests/dejagnu/config/default.exp
+++ b/src/tests/dejagnu/config/default.exp
@@ -239,22 +239,6 @@ set passes {
 	{dummy=[verbose -log "AES + DES enctypes, DES3 TGT"]}
     }
     {
-	des-v4
-	mode=udp
-	des3_krbtgt=0
-	{supported_enctypes=des-cbc-crc:v4}
-	{default_tkt_enctypes(client)=des-cbc-crc}
-	{dummy=[verbose -log "DES TGT, DES-CRC enctype, V4 salt"]}
-    }
-    {
-	des-md5-v4
-	mode=udp
-	des3_krbtgt=0
-	{supported_enctypes=des-cbc-md5:v4 des-cbc-crc:v4}
-	{default_tkt_enctypes(client)=des-cbc-md5 des-cbc-crc}
-	{dummy=[verbose -log "DES TGT, DES-MD5 and -CRC enctypes, V4 salt"]}
-    }
-    {
 	all-enctypes
 	mode=udp
 	des3_krbtgt=0
@@ -356,7 +340,6 @@ set unused_passes {
 	aes128-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:norealm \
 	des3-cbc-sha1:normal des3-cbc-sha1:none \
 	des-cbc-md5:normal des-cbc-md4:normal des-cbc-crc:normal \
-	des-cbc-md5:v4 des-cbc-md4:v4 des-cbc-crc:v4 \
 	}
 	{dummy=[verbose -log "DES3 TGT, default enctypes"]}
     }
diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py
index 2026e78..c21d054 100644
--- a/src/tests/t_etype_info.py
+++ b/src/tests/t_etype_info.py
@@ -1,6 +1,6 @@
 from k5test import *
 
-supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac des-cbc-crc:afs3'
+supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'
 conf = {'libdefaults': {'allow_weak_crypto': 'true'},
         'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}
 realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)
@@ -43,28 +43,6 @@ test_etinfo('preauthuser', 'rc4-hmac-exp des3 rc4 des-cbc-crc',
 test_etinfo('preauthuser', 'rc4 aes256-cts',
             ['error etype_info2 rc4-hmac KRBTEST.COMpreauthuser'])
 
-# AFS3 salt for DES enctypes is conveyed using s2kparams in
-# PA-ETYPE-INFO2, not at all in PA-ETYPE-INFO, and with a special padata
-# type instead of PA-PW-SALT.
-test_etinfo('user', 'des-cbc-crc rc4',
-            ['asrep etype_info2 des-cbc-crc KRBTEST.COM 01',
-             'asrep etype_info des-cbc-crc KRBTEST.COM',
-             'asrep afs3_salt KRBTEST.COM'])
-test_etinfo('preauthuser', 'des-cbc-crc rc4',
-            ['error etype_info2 des-cbc-crc KRBTEST.COM 01',
-             'error etype_info des-cbc-crc KRBTEST.COM'])
-
-# DES keys can be used with other DES enctypes.  The requested enctype
-# shows up in the etype-info, not the database key enctype.
-test_etinfo('user', 'des-cbc-md4 rc4',
-            ['asrep etype_info2 des-cbc-md4 KRBTEST.COM 01',
-             'asrep etype_info des-cbc-md4 KRBTEST.COM',
-             'asrep afs3_salt KRBTEST.COM'])
-test_etinfo('user', 'des-cbc-md5 rc4',
-            ['asrep etype_info2 des KRBTEST.COM 01',
-             'asrep etype_info des KRBTEST.COM',
-             'asrep afs3_salt KRBTEST.COM'])
-
 # If no keys are found matching the request enctypes, a
 # preauth-required error can be generated with no etype-info at all
 # (to allow for preauth mechs which don't depend on long-term keys).
diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py
index 72e09da..633f7c7 100755
--- a/src/tests/t_keytab.py
+++ b/src/tests/t_keytab.py
@@ -155,9 +155,6 @@ realm.run([kadminl, 'ank', '-pw', 'pw', 'default'])
 realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', 'exp'])
 realm.run([kadminl, 'ank', '-e', 'aes256-cts:special', '-pw', 'pw', '+preauth',
            'pexp'])
-realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', 'afs'])
-realm.run([kadminl, 'ank', '-e', 'des-cbc-crc:afs3', '-pw', 'pw', '+preauth',
-           'pafs'])
 
 # Extract one of the explicit salt values from the database.
 out = realm.run([kdb5_util, 'tabdump', 'keyinfo'])
@@ -187,8 +184,6 @@ test_addent(realm, 'default', '-f')
 test_addent(realm, 'default', '-f -e aes128-cts')
 test_addent(realm, 'exp', '-f')
 test_addent(realm, 'pexp', '-f')
-test_addent(realm, 'afs', '-f')
-test_addent(realm, 'pafs', '-f')
 
 success('Keytab-related tests')
 success('Keytab-related tests')
diff --git a/src/tests/t_renprinc.py b/src/tests/t_renprinc.py
index 46cbed4..3dbb3e7 100755
--- a/src/tests/t_renprinc.py
+++ b/src/tests/t_renprinc.py
@@ -25,7 +25,7 @@ from k5test import *
 enctype = "aes128-cts"
 
 realm = K5Realm(create_host=False, create_user=False)
-salttypes = ('normal', 'v4', 'norealm', 'onlyrealm')
+salttypes = ('normal', 'norealm', 'onlyrealm')
 
 # For a variety of salt types, test that we can rename a principal and
 # still get tickets with the same password.
diff --git a/src/tests/t_salt.py b/src/tests/t_salt.py
index 278911a..008efcb 100755
--- a/src/tests/t_salt.py
+++ b/src/tests/t_salt.py
@@ -15,13 +15,9 @@ def test_salt(realm, e1, salt, e2):
     realm.run([kadminl, 'delprinc', 'user'])
 
 # Enctype/salt pairs chosen with non-default salt types.
-# The enctypes are mostly arbitrary, though afs3 must only be used with des.
-# We do not enforce that v4 salts must only be used with des, but it seems
-# like a good idea.
-salts = [('des-cbc-crc', 'afs3'),
-         ('des3-cbc-sha1', 'norealm'),
+# The enctypes are mostly arbitrary.
+salts = [('des3-cbc-sha1', 'norealm'),
          ('arcfour-hmac', 'onlyrealm'),
-         ('des-cbc-crc', 'v4'),
          ('aes128-cts-hmac-sha1-96', 'special')]
 # These enctypes are chosen to cover the different string-to-key routines.
 # Omit ":normal" from aes256 to check that salttype defaulting works.
@@ -56,22 +52,4 @@ dup_kstypes = ['arcfour-hmac-md5:normal,rc4-hmac:normal',
 for ks in dup_kstypes:
     test_dup(realm, ks)
 
-# Attempt to create a principal with a non-des enctype and the afs3 salt,
-# verifying that the expected error is received and the principal creation
-# fails.
-def test_reject_afs3(realm, etype):
-    query = 'ank -e ' + etype + ':afs3 -pw password princ1'
-    realm.run([kadminl, 'ank', '-e', etype + ':afs3', '-pw', 'password',
-               'princ1'], expected_code=1,
-              expected_msg='Invalid key generation parameters from KDC')
-    realm.run([kadminl, 'getprinc', 'princ1'], expected_code=1,
-              expected_msg='Principal does not exist')
-
-# Verify that the afs3 salt is rejected for arcfour and pbkdf2 enctypes.
-# We do not currently do any verification on the key-generation parameters
-# for the triple-DES enctypes, so that test is commented out.
-test_reject_afs3(realm, 'arcfour-hmac')
-test_reject_afs3(realm, 'aes256-cts-hmac-sha1-96')
-#test_reject_afs3(realm, 'des3-cbc-sha1')
-
 success("Salt types")
diff --git a/src/util/k5test.py b/src/util/k5test.py
index 3aec1ef..b6d93f1 100644
--- a/src/util/k5test.py
+++ b/src/util/k5test.py
@@ -1246,17 +1246,6 @@ _passes = [
     # No special settings; exercises AES256.
     ('default', None, None, None),
 
-    # Exercise a DES enctype and the v4 salt type.
-    ('desv4', None,
-     {'libdefaults': {
-                'default_tgs_enctypes': 'des-cbc-crc',
-                'default_tkt_enctypes': 'des-cbc-crc',
-                'permitted_enctypes': 'des-cbc-crc',
-                'allow_weak_crypto': 'true'}},
-     {'realms': {'$realm': {
-                    'supported_enctypes': 'des-cbc-crc:v4',
-                    'master_key_type': 'des-cbc-crc'}}}),
-
     # Exercise the DES3 enctype.
     ('des3', None,
      {'libdefaults': {