1 /* 2 * Copyright (c) 1999 - 2003 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "krb5_locl.h" 35 #include <getarg.h> 36 #include <parse_bytes.h> 37 #include <err.h> 38 RCSID("$Id: verify_krb5_conf.c,v 1.17.2.2 2004/02/13 16:19:44 lha Exp $"); 39 40 /* verify krb5.conf */ 41 42 static int dumpconfig_flag = 0; 43 static int version_flag = 0; 44 static int help_flag = 0; 45 46 static struct getargs args[] = { 47 {"dumpconfig", 0, arg_flag, &dumpconfig_flag, 48 "show the parsed config files", NULL }, 49 {"version", 0, arg_flag, &version_flag, 50 "print version", NULL }, 51 {"help", 0, arg_flag, &help_flag, 52 NULL, NULL } 53 }; 54 55 static void 56 usage (int ret) 57 { 58 arg_printusage (args, 59 sizeof(args)/sizeof(*args), 60 NULL, 61 "[config-file]"); 62 exit (ret); 63 } 64 65 static int 66 check_bytes(krb5_context context, const char *path, char *data) 67 { 68 if(parse_bytes(data, NULL) == -1) { 69 krb5_warnx(context, "%s: failed to parse \"%s\" as size", path, data); 70 return 1; 71 } 72 return 0; 73 } 74 75 static int 76 check_time(krb5_context context, const char *path, char *data) 77 { 78 if(parse_time(data, NULL) == -1) { 79 krb5_warnx(context, "%s: failed to parse \"%s\" as time", path, data); 80 return 1; 81 } 82 return 0; 83 } 84 85 static int 86 check_numeric(krb5_context context, const char *path, char *data) 87 { 88 long int v; 89 char *end; 90 v = strtol(data, &end, 0); 91 if(*end != '\0') { 92 krb5_warnx(context, "%s: failed to parse \"%s\" as a number", 93 path, data); 94 return 1; 95 } 96 return 0; 97 } 98 99 static int 100 check_boolean(krb5_context context, const char *path, char *data) 101 { 102 long int v; 103 char *end; 104 if(strcasecmp(data, "yes") == 0 || 105 strcasecmp(data, "true") == 0 || 106 strcasecmp(data, "no") == 0 || 107 strcasecmp(data, "false") == 0) 108 return 0; 109 v = strtol(data, &end, 0); 110 if(*end != '\0') { 111 krb5_warnx(context, "%s: failed to parse \"%s\" as a boolean", 112 path, data); 113 return 1; 114 } 115 if(v != 0 && v != 1) 116 krb5_warnx(context, "%s: numeric value \"%s\" is treated as \"true\"", 117 path, data); 118 return 0; 119 } 120 121 static int 122 check_524(krb5_context context, const char *path, char *data) 123 { 124 if(strcasecmp(data, "yes") == 0 || 125 strcasecmp(data, "no") == 0 || 126 strcasecmp(data, "2b") == 0 || 127 strcasecmp(data, "local") == 0) 128 return 0; 129 130 krb5_warnx(context, "%s: didn't contain a valid option `%s'", 131 path, data); 132 return 1; 133 } 134 135 static int 136 check_host(krb5_context context, const char *path, char *data) 137 { 138 int ret; 139 char hostname[128]; 140 const char *p = data; 141 struct addrinfo *ai; 142 /* XXX data could be a list of hosts that this code can't handle */ 143 /* XXX copied from krbhst.c */ 144 if(strncmp(p, "http://", 7) == 0){ 145 p += 7; 146 } else if(strncmp(p, "http/", 5) == 0) { 147 p += 5; 148 }else if(strncmp(p, "tcp/", 4) == 0){ 149 p += 4; 150 } else if(strncmp(p, "udp/", 4) == 0) { 151 p += 4; 152 } 153 if(strsep_copy(&p, ":", hostname, sizeof(hostname)) < 0) { 154 return 1; 155 } 156 hostname[strcspn(hostname, "/")] = '\0'; 157 ret = getaddrinfo(hostname, "telnet" /* XXX */, NULL, &ai); 158 if(ret != 0) { 159 krb5_warnx(context, "%s: %s (%s)", path, gai_strerror(ret), hostname); 160 return 1; 161 } 162 return 0; 163 } 164 165 #if 0 166 static int 167 mit_entry(krb5_context context, const char *path, char *data) 168 { 169 krb5_warnx(context, "%s is only used by MIT Kerberos", path); 170 return 0; 171 } 172 #endif 173 174 struct s2i { 175 char *s; 176 int val; 177 }; 178 179 #define L(X) { #X, LOG_ ## X } 180 181 static struct s2i syslogvals[] = { 182 /* severity */ 183 L(EMERG), 184 L(ALERT), 185 L(CRIT), 186 L(ERR), 187 L(WARNING), 188 L(NOTICE), 189 L(INFO), 190 L(DEBUG), 191 /* facility */ 192 L(AUTH), 193 #ifdef LOG_AUTHPRIV 194 L(AUTHPRIV), 195 #endif 196 #ifdef LOG_CRON 197 L(CRON), 198 #endif 199 L(DAEMON), 200 #ifdef LOG_FTP 201 L(FTP), 202 #endif 203 L(KERN), 204 L(LPR), 205 L(MAIL), 206 #ifdef LOG_NEWS 207 L(NEWS), 208 #endif 209 L(SYSLOG), 210 L(USER), 211 #ifdef LOG_UUCP 212 L(UUCP), 213 #endif 214 L(LOCAL0), 215 L(LOCAL1), 216 L(LOCAL2), 217 L(LOCAL3), 218 L(LOCAL4), 219 L(LOCAL5), 220 L(LOCAL6), 221 L(LOCAL7), 222 { NULL, -1 } 223 }; 224 225 static int 226 find_value(const char *s, struct s2i *table) 227 { 228 while(table->s && strcasecmp(table->s, s)) 229 table++; 230 return table->val; 231 } 232 233 static int 234 check_log(krb5_context context, const char *path, char *data) 235 { 236 /* XXX sync with log.c */ 237 int min = 0, max = -1, n; 238 char c; 239 const char *p = data; 240 241 n = sscanf(p, "%d%c%d/", &min, &c, &max); 242 if(n == 2){ 243 if(c == '/') { 244 if(min < 0){ 245 max = -min; 246 min = 0; 247 }else{ 248 max = min; 249 } 250 } 251 } 252 if(n){ 253 p = strchr(p, '/'); 254 if(p == NULL) { 255 krb5_warnx(context, "%s: failed to parse \"%s\"", path, data); 256 return 1; 257 } 258 p++; 259 } 260 if(strcmp(p, "STDERR") == 0 || 261 strcmp(p, "CONSOLE") == 0 || 262 (strncmp(p, "FILE", 4) == 0 && (p[4] == ':' || p[4] == '=')) || 263 (strncmp(p, "DEVICE", 6) == 0 && p[6] == '=')) 264 return 0; 265 if(strncmp(p, "SYSLOG", 6) == 0){ 266 int ret = 0; 267 char severity[128] = ""; 268 char facility[128] = ""; 269 p += 6; 270 if(*p != '\0') 271 p++; 272 if(strsep_copy(&p, ":", severity, sizeof(severity)) != -1) 273 strsep_copy(&p, ":", facility, sizeof(facility)); 274 if(*severity == '\0') 275 strlcpy(severity, "ERR", sizeof(severity)); 276 if(*facility == '\0') 277 strlcpy(facility, "AUTH", sizeof(facility)); 278 if(find_value(severity, syslogvals) == -1) { 279 krb5_warnx(context, "%s: unknown syslog facility \"%s\"", 280 path, facility); 281 ret++; 282 } 283 if(find_value(severity, syslogvals) == -1) { 284 krb5_warnx(context, "%s: unknown syslog severity \"%s\"", 285 path, severity); 286 ret++; 287 } 288 return ret; 289 }else{ 290 krb5_warnx(context, "%s: unknown log type: \"%s\"", path, data); 291 return 1; 292 } 293 } 294 295 typedef int (*check_func_t)(krb5_context, const char*, char*); 296 struct entry { 297 const char *name; 298 int type; 299 void *check_data; 300 }; 301 302 struct entry all_strings[] = { 303 { "", krb5_config_string, NULL }, 304 { NULL } 305 }; 306 307 struct entry v4_name_convert_entries[] = { 308 { "host", krb5_config_list, all_strings }, 309 { "plain", krb5_config_list, all_strings }, 310 { NULL } 311 }; 312 313 struct entry libdefaults_entries[] = { 314 { "accept_null_addresses", krb5_config_string, check_boolean }, 315 { "capath", krb5_config_list, all_strings }, 316 { "clockskew", krb5_config_string, check_time }, 317 { "date_format", krb5_config_string, NULL }, 318 { "default_etypes", krb5_config_string, NULL }, 319 { "default_etypes_des", krb5_config_string, NULL }, 320 { "default_keytab_modify_name", krb5_config_string, NULL }, 321 { "default_keytab_name", krb5_config_string, NULL }, 322 { "default_realm", krb5_config_string, NULL }, 323 { "dns_proxy", krb5_config_string, NULL }, 324 { "dns_lookup_kdc", krb5_config_string, check_boolean }, 325 { "dns_lookup_realm", krb5_config_string, check_boolean }, 326 { "dns_lookup_realm_labels", krb5_config_string, NULL }, 327 { "egd_socket", krb5_config_string, NULL }, 328 { "encrypt", krb5_config_string, check_boolean }, 329 { "extra_addresses", krb5_config_string, NULL }, 330 { "fcache_version", krb5_config_string, check_numeric }, 331 { "forward", krb5_config_string, check_boolean }, 332 { "forwardable", krb5_config_string, check_boolean }, 333 { "http_proxy", krb5_config_string, check_host /* XXX */ }, 334 { "ignore_addresses", krb5_config_string, NULL }, 335 { "kdc_timeout", krb5_config_string, check_time }, 336 { "kdc_timesync", krb5_config_string, check_boolean }, 337 { "log_utc", krb5_config_string, check_boolean }, 338 { "maxretries", krb5_config_string, check_numeric }, 339 { "scan_interfaces", krb5_config_string, check_boolean }, 340 { "srv_lookup", krb5_config_string, check_boolean }, 341 { "srv_try_txt", krb5_config_string, check_boolean }, 342 { "ticket_lifetime", krb5_config_string, check_time }, 343 { "time_format", krb5_config_string, NULL }, 344 { "transited_realms_reject", krb5_config_string, NULL }, 345 { "v4_instance_resolve", krb5_config_string, check_boolean }, 346 { "v4_name_convert", krb5_config_list, v4_name_convert_entries }, 347 { "verify_ap_req_nofail", krb5_config_string, check_boolean }, 348 { NULL } 349 }; 350 351 struct entry appdefaults_entries[] = { 352 { "afslog", krb5_config_string, check_boolean }, 353 { "afs-use-524", krb5_config_string, check_524 }, 354 { "forwardable", krb5_config_string, check_boolean }, 355 { "proxiable", krb5_config_string, check_boolean }, 356 { "ticket_lifetime", krb5_config_string, check_time }, 357 { "renew_lifetime", krb5_config_string, check_time }, 358 { "no-addresses", krb5_config_string, check_boolean }, 359 { "krb4_get_tickets", krb5_config_string, check_boolean }, 360 #if 0 361 { "anonymous", krb5_config_string, check_boolean }, 362 #endif 363 { "", krb5_config_list, appdefaults_entries }, 364 { NULL } 365 }; 366 367 struct entry realms_entries[] = { 368 { "forwardable", krb5_config_string, check_boolean }, 369 { "proxiable", krb5_config_string, check_boolean }, 370 { "ticket_lifetime", krb5_config_string, check_time }, 371 { "renew_lifetime", krb5_config_string, check_time }, 372 { "warn_pwexpire", krb5_config_string, check_time }, 373 { "kdc", krb5_config_string, check_host }, 374 { "admin_server", krb5_config_string, check_host }, 375 { "kpasswd_server", krb5_config_string, check_host }, 376 { "krb524_server", krb5_config_string, check_host }, 377 { "v4_name_convert", krb5_config_list, v4_name_convert_entries }, 378 { "v4_instance_convert", krb5_config_list, all_strings }, 379 { "v4_domains", krb5_config_string, NULL }, 380 { "default_domain", krb5_config_string, NULL }, 381 #if 0 382 /* MIT stuff */ 383 { "admin_keytab", krb5_config_string, mit_entry }, 384 { "acl_file", krb5_config_string, mit_entry }, 385 { "dict_file", krb5_config_string, mit_entry }, 386 { "kadmind_port", krb5_config_string, mit_entry }, 387 { "kpasswd_port", krb5_config_string, mit_entry }, 388 { "master_key_name", krb5_config_string, mit_entry }, 389 { "master_key_type", krb5_config_string, mit_entry }, 390 { "key_stash_file", krb5_config_string, mit_entry }, 391 { "max_life", krb5_config_string, mit_entry }, 392 { "max_renewable_life", krb5_config_string, mit_entry }, 393 { "default_principal_expiration", krb5_config_string, mit_entry }, 394 { "default_principal_flags", krb5_config_string, mit_entry }, 395 { "supported_enctypes", krb5_config_string, mit_entry }, 396 { "database_name", krb5_config_string, mit_entry }, 397 #endif 398 { NULL } 399 }; 400 401 struct entry realms_foobar[] = { 402 { "", krb5_config_list, realms_entries }, 403 { NULL } 404 }; 405 406 407 struct entry kdc_database_entries[] = { 408 { "realm", krb5_config_string, NULL }, 409 { "dbname", krb5_config_string, NULL }, 410 { "mkey_file", krb5_config_string, NULL }, 411 { NULL } 412 }; 413 414 struct entry kdc_entries[] = { 415 { "database", krb5_config_list, kdc_database_entries }, 416 { "key-file", krb5_config_string, NULL }, 417 { "logging", krb5_config_string, check_log }, 418 { "max-request", krb5_config_string, check_bytes }, 419 { "require-preauth", krb5_config_string, check_boolean }, 420 { "ports", krb5_config_string, NULL }, 421 { "addresses", krb5_config_string, NULL }, 422 { "enable-kerberos4", krb5_config_string, check_boolean }, 423 { "enable-524", krb5_config_string, check_boolean }, 424 { "enable-http", krb5_config_string, check_boolean }, 425 { "check_ticket-addresses", krb5_config_string, check_boolean }, 426 { "allow-null-addresses", krb5_config_string, check_boolean }, 427 { "allow-anonymous", krb5_config_string, check_boolean }, 428 { "v4_realm", krb5_config_string, NULL }, 429 { "enable-kaserver", krb5_config_string, check_boolean }, 430 { "encode_as_rep_as_tgs_rep", krb5_config_string, check_boolean }, 431 { "kdc_warn_pwexpire", krb5_config_string, check_time }, 432 { NULL } 433 }; 434 435 struct entry kadmin_entries[] = { 436 { "password_lifetime", krb5_config_string, check_time }, 437 { "default_keys", krb5_config_string, NULL }, 438 { "use_v4_salt", krb5_config_string, NULL }, 439 { NULL } 440 }; 441 struct entry log_strings[] = { 442 { "", krb5_config_string, check_log }, 443 { NULL } 444 }; 445 446 447 #if 0 448 struct entry kdcdefaults_entries[] = { 449 { "kdc_ports", krb5_config_string, mit_entry }, 450 { "v4_mode", krb5_config_string, mit_entry }, 451 { NULL } 452 }; 453 #endif 454 455 struct entry toplevel_sections[] = { 456 { "libdefaults" , krb5_config_list, libdefaults_entries }, 457 { "realms", krb5_config_list, realms_foobar }, 458 { "domain_realm", krb5_config_list, all_strings }, 459 { "logging", krb5_config_list, log_strings }, 460 { "kdc", krb5_config_list, kdc_entries }, 461 { "kadmin", krb5_config_list, kadmin_entries }, 462 { "appdefaults", krb5_config_list, appdefaults_entries }, 463 #if 0 464 /* MIT stuff */ 465 { "kdcdefaults", krb5_config_list, kdcdefaults_entries }, 466 #endif 467 { NULL } 468 }; 469 470 471 static int 472 check_section(krb5_context context, const char *path, krb5_config_section *cf, 473 struct entry *entries) 474 { 475 int error = 0; 476 krb5_config_section *p; 477 struct entry *e; 478 479 char *local; 480 481 for(p = cf; p != NULL; p = p->next) { 482 asprintf(&local, "%s/%s", path, p->name); 483 for(e = entries; e->name != NULL; e++) { 484 if(*e->name == '\0' || strcmp(e->name, p->name) == 0) { 485 if(e->type != p->type) { 486 krb5_warnx(context, "%s: unknown or wrong type", local); 487 error |= 1; 488 } else if(p->type == krb5_config_string && e->check_data != NULL) { 489 error |= (*(check_func_t)e->check_data)(context, local, p->u.string); 490 } else if(p->type == krb5_config_list && e->check_data != NULL) { 491 error |= check_section(context, local, p->u.list, e->check_data); 492 } 493 break; 494 } 495 } 496 if(e->name == NULL) { 497 krb5_warnx(context, "%s: unknown entry", local); 498 error |= 1; 499 } 500 free(local); 501 } 502 return error; 503 } 504 505 506 static void 507 dumpconfig(int level, krb5_config_section *top) 508 { 509 krb5_config_section *x; 510 for(x = top; x; x = x->next) { 511 switch(x->type) { 512 case krb5_config_list: 513 if(level == 0) { 514 printf("[%s]\n", x->name); 515 } else { 516 printf("%*s%s = {\n", 4 * level, " ", x->name); 517 } 518 dumpconfig(level + 1, x->u.list); 519 if(level > 0) 520 printf("%*s}\n", 4 * level, " "); 521 break; 522 case krb5_config_string: 523 printf("%*s%s = %s\n", 4 * level, " ", x->name, x->u.string); 524 break; 525 } 526 } 527 } 528 529 int 530 main(int argc, char **argv) 531 { 532 krb5_context context; 533 krb5_error_code ret; 534 krb5_config_section *tmp_cf; 535 int optind = 0; 536 537 setprogname (argv[0]); 538 539 ret = krb5_init_context(&context); 540 if (ret) 541 errx (1, "krb5_init_context failed"); 542 543 if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind)) 544 usage(1); 545 546 if (help_flag) 547 usage (0); 548 549 if(version_flag){ 550 print_version(NULL); 551 exit(0); 552 } 553 554 argc -= optind; 555 argv += optind; 556 557 tmp_cf = NULL; 558 if(argc == 0) 559 krb5_get_default_config_files(&argv); 560 561 while(*argv) { 562 ret = krb5_config_parse_file_multi(context, *argv, &tmp_cf); 563 if (ret != 0) 564 krb5_warn (context, ret, "krb5_config_parse_file"); 565 argv++; 566 } 567 568 if(dumpconfig_flag) 569 dumpconfig(0, tmp_cf); 570 571 return check_section(context, "", tmp_cf, toplevel_sections); 572 } 573