xref: /freebsd/crypto/heimdal/kdc/hpropd.c (revision 6780ab54325a71e7e70112b11657973edde8655e)
1 /*
2  * Copyright (c) 1997-2002 Kungliga Tekniska H�gskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "hprop.h"
35 
36 RCSID("$Id: hpropd.c,v 1.35 2002/04/18 10:18:50 joda Exp $");
37 
38 #ifdef KRB4
39 static des_cblock mkey4;
40 static des_key_schedule msched4;
41 
42 static char *
43 time2str(time_t t)
44 {
45     static char buf[128];
46     strftime(buf, sizeof(buf), "%Y%m%d%H%M", gmtime(&t));
47     return buf;
48 }
49 
50 static int
51 dump_krb4(krb5_context context, hdb_entry *ent, int fd)
52 {
53     char name[ANAME_SZ];
54     char instance[INST_SZ];
55     char realm[REALM_SZ];
56     char buf[1024];
57     char *p;
58     int i;
59     int ret;
60     char *princ_name;
61     Event *modifier;
62     krb5_realm *realms;
63     int cmp;
64 
65     ret = krb5_524_conv_principal(context, ent->principal,
66 				  name, instance, realm);
67     if (ret) {
68 	krb5_unparse_name(context, ent->principal, &princ_name);
69 	krb5_warn(context, ret, "%s", princ_name);
70 	free(princ_name);
71 	return -1;
72     }
73 
74     ret = krb5_get_default_realms (context, &realms);
75     if (ret) {
76 	krb5_warn(context, ret, "krb5_get_default_realms");
77 	return -1;
78     }
79 
80     cmp = strcmp (realms[0], ent->principal->realm);
81     krb5_free_host_realm (context, realms);
82     if (cmp != 0)
83         return -1;
84 
85     snprintf (buf, sizeof(buf), "%s %s ", name,
86 	      (strlen(instance) != 0) ? instance : "*");
87 
88     if (ent->max_life) {
89 	asprintf(&p, "%d", krb_time_to_life(0, *ent->max_life));
90 	strcat(buf, p);
91 	free(p);
92     } else
93 	strcat(buf, "255");
94     strcat(buf, " ");
95 
96     i = 0;
97     while (i < ent->keys.len &&
98 	   ent->keys.val[i].key.keytype != KEYTYPE_DES)
99 	++i;
100 
101     if (i == ent->keys.len) {
102 	krb5_warnx(context, "No DES key for %s.%s", name, instance);
103 	return -1;
104     }
105 
106     if (ent->keys.val[i].mkvno)
107 	asprintf(&p, "%d ", *ent->keys.val[i].mkvno);
108     else
109 	asprintf(&p, "%d ", 1);
110     strcat(buf, p);
111     free(p);
112 
113     asprintf(&p, "%d ", ent->kvno);
114     strcat(buf, p);
115     free(p);
116 
117     asprintf(&p, "%d ", 0); /* Attributes are always 0*/
118     strcat(buf, p);
119     free(p);
120 
121     {
122 	u_int32_t *key = ent->keys.val[i].key.keyvalue.data;
123 	kdb_encrypt_key((des_cblock*)key, (des_cblock*)key,
124 			&mkey4, msched4, DES_ENCRYPT);
125 	asprintf(&p, "%x %x ", (int)htonl(*key), (int)htonl(*(key+1)));
126 	strcat(buf, p);
127 	free(p);
128     }
129 
130     if (ent->valid_end == NULL)
131 	strcat(buf, time2str(60*60*24*365*50)); /* no expiration */
132     else
133 	strcat(buf, time2str(*ent->valid_end));
134     strcat(buf, " ");
135 
136     if (ent->modified_by == NULL)
137 	modifier = &ent->created_by;
138     else
139 	modifier = ent->modified_by;
140 
141     ret = krb5_524_conv_principal(context, modifier->principal,
142 				  name, instance, realm);
143     if (ret) {
144 	krb5_unparse_name(context, modifier->principal, &princ_name);
145 	krb5_warn(context, ret, "%s", princ_name);
146 	free(princ_name);
147 	return -1;
148     }
149     asprintf(&p, "%s %s %s\n", time2str(modifier->time),
150 	     (strlen(name) != 0) ? name : "*",
151 	     (strlen(instance) != 0) ? instance : "*");
152     strcat(buf, p);
153     free(p);
154 
155     ret = write(fd, buf, strlen(buf));
156     if (ret == -1)
157 	krb5_warnx(context, "write");
158     return 0;
159 }
160 #endif /* KRB4 */
161 
162 static int inetd_flag = -1;
163 static int help_flag;
164 static int version_flag;
165 static int print_dump;
166 static const char *database = HDB_DEFAULT_DB;
167 static int from_stdin;
168 static char *local_realm;
169 #ifdef KRB4
170 static int v4dump;
171 #endif
172 static char *ktname = NULL;
173 
174 struct getargs args[] = {
175     { "database", 'd', arg_string, &database, "database", "file" },
176     { "stdin",    'n', arg_flag, &from_stdin, "read from stdin" },
177     { "print",	    0, arg_flag, &print_dump, "print dump to stdout" },
178     { "inetd",	   'i',	arg_negative_flag,	&inetd_flag,
179       "Not started from inetd" },
180     { "keytab",   'k',	arg_string, &ktname,	"keytab to use for authentication", "keytab" },
181     { "realm",   'r',	arg_string, &local_realm, "realm to use" },
182 #ifdef KRB4
183     { "v4dump",       '4',  arg_flag, &v4dump, "create v4 type DB" },
184 #endif
185     { "version",    0, arg_flag, &version_flag, NULL, NULL },
186     { "help",    'h',  arg_flag, &help_flag, NULL, NULL}
187 };
188 
189 static int num_args = sizeof(args) / sizeof(args[0]);
190 
191 static void
192 usage(int ret)
193 {
194     arg_printusage (args, num_args, NULL, "");
195     exit (ret);
196 }
197 
198 int
199 main(int argc, char **argv)
200 {
201     krb5_error_code ret;
202     krb5_context context;
203     krb5_auth_context ac = NULL;
204     krb5_principal c1, c2;
205     krb5_authenticator authent;
206     krb5_keytab keytab;
207     int fd;
208     HDB *db;
209     int optind = 0;
210     char *tmp_db;
211     krb5_log_facility *fac;
212     int nprincs;
213 #ifdef KRB4
214     int e;
215     int fd_out = -1;
216 #endif
217 
218     setprogname(argv[0]);
219 
220     ret = krb5_init_context(&context);
221     if(ret)
222 	exit(1);
223 
224     ret = krb5_openlog(context, "hpropd", &fac);
225     if(ret)
226 	;
227     krb5_set_warn_dest(context, fac);
228 
229     if(getarg(args, num_args, argc, argv, &optind))
230 	usage(1);
231 
232 #ifdef KRB4
233     if (v4dump && database == HDB_DEFAULT_DB)
234        database = "/var/kerberos/524_dump";
235 #endif /* KRB4 */
236 
237     if(local_realm != NULL)
238 	krb5_set_default_realm(context, local_realm);
239 
240     if(help_flag)
241 	usage(0);
242     if(version_flag) {
243 	print_version(NULL);
244 	exit(0);
245     }
246 
247     argc -= optind;
248     argv += optind;
249 
250     if (argc != 0)
251 	usage(1);
252 
253     if(from_stdin)
254 	fd = STDIN_FILENO;
255     else {
256 	struct sockaddr_storage ss;
257 	struct sockaddr *sa = (struct sockaddr *)&ss;
258 	socklen_t sin_len = sizeof(ss);
259 	char addr_name[256];
260 	krb5_ticket *ticket;
261 	char *server;
262 
263 	fd = STDIN_FILENO;
264 	if (inetd_flag == -1) {
265 	    if (getpeername (fd, sa, &sin_len) < 0)
266 		inetd_flag = 0;
267 	    else
268 		inetd_flag = 1;
269 	}
270 	if (!inetd_flag) {
271 	    mini_inetd (krb5_getportbyname (context, "hprop", "tcp",
272 					    HPROP_PORT));
273 	}
274 	sin_len = sizeof(ss);
275 	if(getpeername(fd, sa, &sin_len) < 0)
276 	    krb5_err(context, 1, errno, "getpeername");
277 
278 	if (inet_ntop(sa->sa_family,
279 		      socket_get_address (sa),
280 		      addr_name,
281 		      sizeof(addr_name)) == NULL)
282 	    strlcpy (addr_name, "unknown address",
283 			     sizeof(addr_name));
284 
285 	krb5_log(context, fac, 0, "Connection from %s", addr_name);
286 
287 	ret = krb5_kt_register(context, &hdb_kt_ops);
288 	if(ret)
289 	    krb5_err(context, 1, ret, "krb5_kt_register");
290 
291 	if (ktname != NULL) {
292 	    ret = krb5_kt_resolve(context, ktname, &keytab);
293 	    if (ret)
294 		krb5_err (context, 1, ret, "krb5_kt_resolve %s", ktname);
295 	} else {
296 	    ret = krb5_kt_default (context, &keytab);
297 	    if (ret)
298 		krb5_err (context, 1, ret, "krb5_kt_default");
299 	}
300 
301 	ret = krb5_recvauth(context, &ac, &fd, HPROP_VERSION, NULL,
302 			    0, keytab, &ticket);
303 	if(ret)
304 	    krb5_err(context, 1, ret, "krb5_recvauth");
305 
306 	ret = krb5_unparse_name(context, ticket->server, &server);
307 	if (ret)
308 	    krb5_err(context, 1, ret, "krb5_unparse_name");
309 	if (strncmp(server, "hprop/", 5) != 0)
310 	    krb5_errx(context, 1, "ticket not for hprop (%s)", server);
311 
312 	free(server);
313 	krb5_free_ticket (context, ticket);
314 
315 	ret = krb5_auth_con_getauthenticator(context, ac, &authent);
316 	if(ret)
317 	    krb5_err(context, 1, ret, "krb5_auth_con_getauthenticator");
318 
319 	ret = krb5_make_principal(context, &c1, NULL, "kadmin", "hprop", NULL);
320 	if(ret)
321 	    krb5_err(context, 1, ret, "krb5_make_principal");
322 	principalname2krb5_principal(&c2, authent->cname, authent->crealm);
323 	if(!krb5_principal_compare(context, c1, c2)) {
324 	    char *s;
325 	    krb5_unparse_name(context, c2, &s);
326 	    krb5_errx(context, 1, "Unauthorized connection from %s", s);
327 	}
328 	krb5_free_principal(context, c1);
329 	krb5_free_principal(context, c2);
330 
331 	ret = krb5_kt_close(context, keytab);
332 	if(ret)
333 	    krb5_err(context, 1, ret, "krb5_kt_close");
334     }
335 
336     if(!print_dump) {
337 	asprintf(&tmp_db, "%s~", database);
338 #ifdef KRB4
339 	if (v4dump) {
340 	    fd_out = open(tmp_db, O_WRONLY | O_CREAT | O_TRUNC, 0600);
341 	    if (fd_out == -1)
342 		krb5_errx(context, 1, "%s", strerror(errno));
343 	}
344 	else
345 #endif /* KRB4 */
346 	{
347 	    ret = hdb_create(context, &db, tmp_db);
348 	    if(ret)
349 		krb5_err(context, 1, ret, "hdb_create(%s)", tmp_db);
350 	    ret = db->open(context, db, O_RDWR | O_CREAT | O_TRUNC, 0600);
351 	    if(ret)
352 		krb5_err(context, 1, ret, "hdb_open(%s)", tmp_db);
353 	}
354     }
355 
356 #ifdef KRB4
357     if (v4dump) {
358 	e = kdb_get_master_key(0, &mkey4, msched4);
359 	if(e)
360 	    krb5_errx(context, 1, "kdb_get_master_key: %s",
361 		      krb_get_err_text(e));
362     }
363 #endif /* KRB4 */
364 
365     nprincs = 0;
366     while(1){
367 	krb5_data data;
368 	hdb_entry entry;
369 
370 	if(from_stdin) {
371 	    ret = krb5_read_message(context, &fd, &data);
372 	    if(ret != 0 && ret != HEIM_ERR_EOF)
373 		krb5_err(context, 1, ret, "krb5_read_message");
374 	} else {
375 	    ret = krb5_read_priv_message(context, ac, &fd, &data);
376 	    if(ret)
377 		krb5_err(context, 1, ret, "krb5_read_priv_message");
378 	}
379 
380 	if(ret == HEIM_ERR_EOF || data.length == 0) {
381 	    if(!from_stdin) {
382 		data.data = NULL;
383 		data.length = 0;
384 		krb5_write_priv_message(context, ac, &fd, &data);
385 	    }
386 	    if(!print_dump) {
387 #ifdef KRB4
388 		if (v4dump) {
389 		    ret = rename(tmp_db, database);
390 		    if (ret)
391 			krb5_errx(context, 1, "rename");
392 		    ret = close(fd_out);
393 		    if (ret)
394 			krb5_errx(context, 1, "close");
395 		} else
396 #endif /* KRB4 */
397 		{
398 		    ret = db->rename(context, db, database);
399 		    if(ret)
400 			krb5_err(context, 1, ret, "db_rename");
401 		    ret = db->close(context, db);
402 		    if(ret)
403 			krb5_err(context, 1, ret, "db_close");
404 		}
405 	    }
406 	    break;
407 	}
408 	ret = hdb_value2entry(context, &data, &entry);
409 	if(ret)
410 	    krb5_err(context, 1, ret, "hdb_value2entry");
411 	if(print_dump)
412 	    hdb_print_entry(context, db, &entry, stdout);
413 	else {
414 #ifdef KRB4
415 	    if (v4dump) {
416 		ret = dump_krb4(context, &entry, fd_out);
417 		if(!ret) nprincs++;
418 	    }
419 	    else
420 #endif /* KRB4 */
421 	    {
422 		ret = db->store(context, db, 0, &entry);
423 		if(ret == HDB_ERR_EXISTS) {
424 		    char *s;
425 		    krb5_unparse_name(context, entry.principal, &s);
426 		    krb5_warnx(context, "Entry exists: %s", s);
427 		    free(s);
428 		} else if(ret)
429 		    krb5_err(context, 1, ret, "db_store");
430 		else
431 		    nprincs++;
432 	    }
433 	}
434 	hdb_free_entry(context, &entry);
435     }
436     if (!print_dump)
437 	krb5_log(context, fac, 0, "Received %d principals", nprincs);
438     exit(0);
439 }
440