xref: /freebsd/crypto/heimdal/lib/krb5/verify_krb5_conf.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*
2  * Copyright (c) 1999 - 2003 Kungliga Tekniska H�gskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "krb5_locl.h"
35 #include <getarg.h>
36 #include <parse_bytes.h>
37 #include <err.h>
38 RCSID("$Id: verify_krb5_conf.c,v 1.17.2.2 2004/02/13 16:19:44 lha Exp $");
39 
40 /* verify krb5.conf */
41 
42 static int dumpconfig_flag = 0;
43 static int version_flag = 0;
44 static int help_flag	= 0;
45 
46 static struct getargs args[] = {
47     {"dumpconfig", 0,      arg_flag,       &dumpconfig_flag,
48      "show the parsed config files", NULL },
49     {"version",	0,	arg_flag,	&version_flag,
50      "print version", NULL },
51     {"help",	0,	arg_flag,	&help_flag,
52      NULL, NULL }
53 };
54 
55 static void
56 usage (int ret)
57 {
58     arg_printusage (args,
59 		    sizeof(args)/sizeof(*args),
60 		    NULL,
61 		    "[config-file]");
62     exit (ret);
63 }
64 
65 static int
66 check_bytes(krb5_context context, const char *path, char *data)
67 {
68     if(parse_bytes(data, NULL) == -1) {
69 	krb5_warnx(context, "%s: failed to parse \"%s\" as size", path, data);
70 	return 1;
71     }
72     return 0;
73 }
74 
75 static int
76 check_time(krb5_context context, const char *path, char *data)
77 {
78     if(parse_time(data, NULL) == -1) {
79 	krb5_warnx(context, "%s: failed to parse \"%s\" as time", path, data);
80 	return 1;
81     }
82     return 0;
83 }
84 
85 static int
86 check_numeric(krb5_context context, const char *path, char *data)
87 {
88     long int v;
89     char *end;
90     v = strtol(data, &end, 0);
91     if(*end != '\0') {
92 	krb5_warnx(context, "%s: failed to parse \"%s\" as a number",
93 		   path, data);
94 	return 1;
95     }
96     return 0;
97 }
98 
99 static int
100 check_boolean(krb5_context context, const char *path, char *data)
101 {
102     long int v;
103     char *end;
104     if(strcasecmp(data, "yes") == 0 ||
105        strcasecmp(data, "true") == 0 ||
106        strcasecmp(data, "no") == 0 ||
107        strcasecmp(data, "false") == 0)
108 	return 0;
109     v = strtol(data, &end, 0);
110     if(*end != '\0') {
111 	krb5_warnx(context, "%s: failed to parse \"%s\" as a boolean",
112 		   path, data);
113 	return 1;
114     }
115     if(v != 0 && v != 1)
116 	krb5_warnx(context, "%s: numeric value \"%s\" is treated as \"true\"",
117 		   path, data);
118     return 0;
119 }
120 
121 static int
122 check_524(krb5_context context, const char *path, char *data)
123 {
124     if(strcasecmp(data, "yes") == 0 ||
125        strcasecmp(data, "no") == 0 ||
126        strcasecmp(data, "2b") == 0 ||
127        strcasecmp(data, "local") == 0)
128 	return 0;
129 
130     krb5_warnx(context, "%s: didn't contain a valid option `%s'",
131 	       path, data);
132     return 1;
133 }
134 
135 static int
136 check_host(krb5_context context, const char *path, char *data)
137 {
138     int ret;
139     char hostname[128];
140     const char *p = data;
141     struct addrinfo *ai;
142     /* XXX data could be a list of hosts that this code can't handle */
143     /* XXX copied from krbhst.c */
144     if(strncmp(p, "http://", 7) == 0){
145         p += 7;
146     } else if(strncmp(p, "http/", 5) == 0) {
147         p += 5;
148     }else if(strncmp(p, "tcp/", 4) == 0){
149         p += 4;
150     } else if(strncmp(p, "udp/", 4) == 0) {
151         p += 4;
152     }
153     if(strsep_copy(&p, ":", hostname, sizeof(hostname)) < 0) {
154 	return 1;
155     }
156     hostname[strcspn(hostname, "/")] = '\0';
157     ret = getaddrinfo(hostname, "telnet" /* XXX */, NULL, &ai);
158     if(ret != 0) {
159 	krb5_warnx(context, "%s: %s (%s)", path, gai_strerror(ret), hostname);
160 	return 1;
161     }
162     return 0;
163 }
164 
165 #if 0
166 static int
167 mit_entry(krb5_context context, const char *path, char *data)
168 {
169     krb5_warnx(context, "%s is only used by MIT Kerberos", path);
170     return 0;
171 }
172 #endif
173 
174 struct s2i {
175     char *s;
176     int val;
177 };
178 
179 #define L(X) { #X, LOG_ ## X }
180 
181 static struct s2i syslogvals[] = {
182     /* severity */
183     L(EMERG),
184     L(ALERT),
185     L(CRIT),
186     L(ERR),
187     L(WARNING),
188     L(NOTICE),
189     L(INFO),
190     L(DEBUG),
191     /* facility */
192     L(AUTH),
193 #ifdef LOG_AUTHPRIV
194     L(AUTHPRIV),
195 #endif
196 #ifdef LOG_CRON
197     L(CRON),
198 #endif
199     L(DAEMON),
200 #ifdef LOG_FTP
201     L(FTP),
202 #endif
203     L(KERN),
204     L(LPR),
205     L(MAIL),
206 #ifdef LOG_NEWS
207     L(NEWS),
208 #endif
209     L(SYSLOG),
210     L(USER),
211 #ifdef LOG_UUCP
212     L(UUCP),
213 #endif
214     L(LOCAL0),
215     L(LOCAL1),
216     L(LOCAL2),
217     L(LOCAL3),
218     L(LOCAL4),
219     L(LOCAL5),
220     L(LOCAL6),
221     L(LOCAL7),
222     { NULL, -1 }
223 };
224 
225 static int
226 find_value(const char *s, struct s2i *table)
227 {
228     while(table->s && strcasecmp(table->s, s))
229 	table++;
230     return table->val;
231 }
232 
233 static int
234 check_log(krb5_context context, const char *path, char *data)
235 {
236     /* XXX sync with log.c */
237     int min = 0, max = -1, n;
238     char c;
239     const char *p = data;
240 
241     n = sscanf(p, "%d%c%d/", &min, &c, &max);
242     if(n == 2){
243 	if(c == '/') {
244 	    if(min < 0){
245 		max = -min;
246 		min = 0;
247 	    }else{
248 		max = min;
249 	    }
250 	}
251     }
252     if(n){
253 	p = strchr(p, '/');
254 	if(p == NULL) {
255 	    krb5_warnx(context, "%s: failed to parse \"%s\"", path, data);
256 	    return 1;
257 	}
258 	p++;
259     }
260     if(strcmp(p, "STDERR") == 0 ||
261        strcmp(p, "CONSOLE") == 0 ||
262        (strncmp(p, "FILE", 4) == 0 && (p[4] == ':' || p[4] == '=')) ||
263        (strncmp(p, "DEVICE", 6) == 0 && p[6] == '='))
264 	return 0;
265     if(strncmp(p, "SYSLOG", 6) == 0){
266 	int ret = 0;
267 	char severity[128] = "";
268 	char facility[128] = "";
269 	p += 6;
270 	if(*p != '\0')
271 	    p++;
272 	if(strsep_copy(&p, ":", severity, sizeof(severity)) != -1)
273 	    strsep_copy(&p, ":", facility, sizeof(facility));
274 	if(*severity == '\0')
275 	    strlcpy(severity, "ERR", sizeof(severity));
276  	if(*facility == '\0')
277 	    strlcpy(facility, "AUTH", sizeof(facility));
278 	if(find_value(severity, syslogvals) == -1) {
279 	    krb5_warnx(context, "%s: unknown syslog facility \"%s\"",
280 		       path, facility);
281 	    ret++;
282 	}
283 	if(find_value(severity, syslogvals) == -1) {
284 	    krb5_warnx(context, "%s: unknown syslog severity \"%s\"",
285 		       path, severity);
286 	    ret++;
287 	}
288 	return ret;
289     }else{
290 	krb5_warnx(context, "%s: unknown log type: \"%s\"", path, data);
291 	return 1;
292     }
293 }
294 
295 typedef int (*check_func_t)(krb5_context, const char*, char*);
296 struct entry {
297     const char *name;
298     int type;
299     void *check_data;
300 };
301 
302 struct entry all_strings[] = {
303     { "", krb5_config_string, NULL },
304     { NULL }
305 };
306 
307 struct entry v4_name_convert_entries[] = {
308     { "host", krb5_config_list, all_strings },
309     { "plain", krb5_config_list, all_strings },
310     { NULL }
311 };
312 
313 struct entry libdefaults_entries[] = {
314     { "accept_null_addresses", krb5_config_string, check_boolean },
315     { "capath", krb5_config_list, all_strings },
316     { "clockskew", krb5_config_string, check_time },
317     { "date_format", krb5_config_string, NULL },
318     { "default_etypes", krb5_config_string, NULL },
319     { "default_etypes_des", krb5_config_string, NULL },
320     { "default_keytab_modify_name", krb5_config_string, NULL },
321     { "default_keytab_name", krb5_config_string, NULL },
322     { "default_realm", krb5_config_string, NULL },
323     { "dns_proxy", krb5_config_string, NULL },
324     { "dns_lookup_kdc", krb5_config_string, check_boolean },
325     { "dns_lookup_realm", krb5_config_string, check_boolean },
326     { "dns_lookup_realm_labels", krb5_config_string, NULL },
327     { "egd_socket", krb5_config_string, NULL },
328     { "encrypt", krb5_config_string, check_boolean },
329     { "extra_addresses", krb5_config_string, NULL },
330     { "fcache_version", krb5_config_string, check_numeric },
331     { "forward", krb5_config_string, check_boolean },
332     { "forwardable", krb5_config_string, check_boolean },
333     { "http_proxy", krb5_config_string, check_host /* XXX */ },
334     { "ignore_addresses", krb5_config_string, NULL },
335     { "kdc_timeout", krb5_config_string, check_time },
336     { "kdc_timesync", krb5_config_string, check_boolean },
337     { "log_utc", krb5_config_string, check_boolean },
338     { "maxretries", krb5_config_string, check_numeric },
339     { "scan_interfaces", krb5_config_string, check_boolean },
340     { "srv_lookup", krb5_config_string, check_boolean },
341     { "srv_try_txt", krb5_config_string, check_boolean },
342     { "ticket_lifetime", krb5_config_string, check_time },
343     { "time_format", krb5_config_string, NULL },
344     { "transited_realms_reject", krb5_config_string, NULL },
345     { "v4_instance_resolve", krb5_config_string, check_boolean },
346     { "v4_name_convert", krb5_config_list, v4_name_convert_entries },
347     { "verify_ap_req_nofail", krb5_config_string, check_boolean },
348     { NULL }
349 };
350 
351 struct entry appdefaults_entries[] = {
352     { "afslog", krb5_config_string, check_boolean },
353     { "afs-use-524", krb5_config_string, check_524 },
354     { "forwardable", krb5_config_string, check_boolean },
355     { "proxiable", krb5_config_string, check_boolean },
356     { "ticket_lifetime", krb5_config_string, check_time },
357     { "renew_lifetime", krb5_config_string, check_time },
358     { "no-addresses", krb5_config_string, check_boolean },
359     { "krb4_get_tickets", krb5_config_string, check_boolean },
360 #if 0
361     { "anonymous", krb5_config_string, check_boolean },
362 #endif
363     { "", krb5_config_list, appdefaults_entries },
364     { NULL }
365 };
366 
367 struct entry realms_entries[] = {
368     { "forwardable", krb5_config_string, check_boolean },
369     { "proxiable", krb5_config_string, check_boolean },
370     { "ticket_lifetime", krb5_config_string, check_time },
371     { "renew_lifetime", krb5_config_string, check_time },
372     { "warn_pwexpire", krb5_config_string, check_time },
373     { "kdc", krb5_config_string, check_host },
374     { "admin_server", krb5_config_string, check_host },
375     { "kpasswd_server", krb5_config_string, check_host },
376     { "krb524_server", krb5_config_string, check_host },
377     { "v4_name_convert", krb5_config_list, v4_name_convert_entries },
378     { "v4_instance_convert", krb5_config_list, all_strings },
379     { "v4_domains", krb5_config_string, NULL },
380     { "default_domain", krb5_config_string, NULL },
381 #if 0
382     /* MIT stuff */
383     { "admin_keytab", krb5_config_string, mit_entry },
384     { "acl_file", krb5_config_string, mit_entry },
385     { "dict_file", krb5_config_string, mit_entry },
386     { "kadmind_port", krb5_config_string, mit_entry },
387     { "kpasswd_port", krb5_config_string, mit_entry },
388     { "master_key_name", krb5_config_string, mit_entry },
389     { "master_key_type", krb5_config_string, mit_entry },
390     { "key_stash_file", krb5_config_string, mit_entry },
391     { "max_life", krb5_config_string, mit_entry },
392     { "max_renewable_life", krb5_config_string, mit_entry },
393     { "default_principal_expiration", krb5_config_string, mit_entry },
394     { "default_principal_flags", krb5_config_string, mit_entry },
395     { "supported_enctypes", krb5_config_string, mit_entry },
396     { "database_name", krb5_config_string, mit_entry },
397 #endif
398     { NULL }
399 };
400 
401 struct entry realms_foobar[] = {
402     { "", krb5_config_list, realms_entries },
403     { NULL }
404 };
405 
406 
407 struct entry kdc_database_entries[] = {
408     { "realm", krb5_config_string, NULL },
409     { "dbname", krb5_config_string, NULL },
410     { "mkey_file", krb5_config_string, NULL },
411     { NULL }
412 };
413 
414 struct entry kdc_entries[] = {
415     { "database", krb5_config_list, kdc_database_entries },
416     { "key-file", krb5_config_string, NULL },
417     { "logging", krb5_config_string, check_log },
418     { "max-request", krb5_config_string, check_bytes },
419     { "require-preauth", krb5_config_string, check_boolean },
420     { "ports", krb5_config_string, NULL },
421     { "addresses", krb5_config_string, NULL },
422     { "enable-kerberos4", krb5_config_string, check_boolean },
423     { "enable-524", krb5_config_string, check_boolean },
424     { "enable-http", krb5_config_string, check_boolean },
425     { "check_ticket-addresses", krb5_config_string, check_boolean },
426     { "allow-null-addresses", krb5_config_string, check_boolean },
427     { "allow-anonymous", krb5_config_string, check_boolean },
428     { "v4_realm", krb5_config_string, NULL },
429     { "enable-kaserver", krb5_config_string, check_boolean },
430     { "encode_as_rep_as_tgs_rep", krb5_config_string, check_boolean },
431     { "kdc_warn_pwexpire", krb5_config_string, check_time },
432     { NULL }
433 };
434 
435 struct entry kadmin_entries[] = {
436     { "password_lifetime", krb5_config_string, check_time },
437     { "default_keys", krb5_config_string, NULL },
438     { "use_v4_salt", krb5_config_string, NULL },
439     { NULL }
440 };
441 struct entry log_strings[] = {
442     { "", krb5_config_string, check_log },
443     { NULL }
444 };
445 
446 
447 #if 0
448 struct entry kdcdefaults_entries[] = {
449     { "kdc_ports", krb5_config_string, mit_entry },
450     { "v4_mode", krb5_config_string, mit_entry },
451     { NULL }
452 };
453 #endif
454 
455 struct entry toplevel_sections[] = {
456     { "libdefaults" , krb5_config_list, libdefaults_entries },
457     { "realms", krb5_config_list, realms_foobar },
458     { "domain_realm", krb5_config_list, all_strings },
459     { "logging", krb5_config_list, log_strings },
460     { "kdc", krb5_config_list, kdc_entries },
461     { "kadmin", krb5_config_list, kadmin_entries },
462     { "appdefaults", krb5_config_list, appdefaults_entries },
463 #if 0
464     /* MIT stuff */
465     { "kdcdefaults", krb5_config_list, kdcdefaults_entries },
466 #endif
467     { NULL }
468 };
469 
470 
471 static int
472 check_section(krb5_context context, const char *path, krb5_config_section *cf,
473 	      struct entry *entries)
474 {
475     int error = 0;
476     krb5_config_section *p;
477     struct entry *e;
478 
479     char *local;
480 
481     for(p = cf; p != NULL; p = p->next) {
482 	asprintf(&local, "%s/%s", path, p->name);
483 	for(e = entries; e->name != NULL; e++) {
484 	    if(*e->name == '\0' || strcmp(e->name, p->name) == 0) {
485 		if(e->type != p->type) {
486 		    krb5_warnx(context, "%s: unknown or wrong type", local);
487 		    error |= 1;
488 		} else if(p->type == krb5_config_string && e->check_data != NULL) {
489 		    error |= (*(check_func_t)e->check_data)(context, local, p->u.string);
490 		} else if(p->type == krb5_config_list && e->check_data != NULL) {
491 		    error |= check_section(context, local, p->u.list, e->check_data);
492 		}
493 		break;
494 	    }
495 	}
496 	if(e->name == NULL) {
497 	    krb5_warnx(context, "%s: unknown entry", local);
498 	    error |= 1;
499 	}
500 	free(local);
501     }
502     return error;
503 }
504 
505 
506 static void
507 dumpconfig(int level, krb5_config_section *top)
508 {
509     krb5_config_section *x;
510     for(x = top; x; x = x->next) {
511 	switch(x->type) {
512 	case krb5_config_list:
513 	    if(level == 0) {
514 		printf("[%s]\n", x->name);
515 	    } else {
516 		printf("%*s%s = {\n", 4 * level, " ", x->name);
517 	    }
518 	    dumpconfig(level + 1, x->u.list);
519 	    if(level > 0)
520 		printf("%*s}\n", 4 * level, " ");
521 	    break;
522 	case krb5_config_string:
523 	    printf("%*s%s = %s\n", 4 * level, " ", x->name, x->u.string);
524 	    break;
525 	}
526     }
527 }
528 
529 int
530 main(int argc, char **argv)
531 {
532     krb5_context context;
533     krb5_error_code ret;
534     krb5_config_section *tmp_cf;
535     int optind = 0;
536 
537     setprogname (argv[0]);
538 
539     ret = krb5_init_context(&context);
540     if (ret)
541 	errx (1, "krb5_init_context failed");
542 
543     if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
544 	usage(1);
545 
546     if (help_flag)
547 	usage (0);
548 
549     if(version_flag){
550 	print_version(NULL);
551 	exit(0);
552     }
553 
554     argc -= optind;
555     argv += optind;
556 
557     tmp_cf = NULL;
558     if(argc == 0)
559 	krb5_get_default_config_files(&argv);
560 
561     while(*argv) {
562 	ret = krb5_config_parse_file_multi(context, *argv, &tmp_cf);
563 	if (ret != 0)
564 	    krb5_warn (context, ret, "krb5_config_parse_file");
565 	argv++;
566     }
567 
568     if(dumpconfig_flag)
569 	dumpconfig(0, tmp_cf);
570 
571     return check_section(context, "", tmp_cf, toplevel_sections);
572 }
573