1 /* 2 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 * 5 * $Header: /cvs/krbdev/krb5/src/lib/kadm5/clnt/client_init.c,v 1.13.2.2 2000/05/09 13:17:14 raeburn Exp $ 6 */ 7 8 #pragma ident "%Z%%M% %I% %E% SMI" 9 10 /* 11 * Copyright (C) 1998 by the FundsXpress, INC. 12 * 13 * All rights reserved. 14 * 15 * Export of this software from the United States of America may require 16 * a specific license from the United States Government. It is the 17 * responsibility of any person or organization contemplating export to 18 * obtain such a license before exporting. 19 * 20 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 21 * distribute this software and its documentation for any purpose and 22 * without fee is hereby granted, provided that the above copyright 23 * notice appear in all copies and that both that copyright notice and 24 * this permission notice appear in supporting documentation, and that 25 * the name of FundsXpress. not be used in advertising or publicity pertaining 26 * to distribution of the software without specific, written prior 27 * permission. FundsXpress makes no representations about the suitability of 28 * this software for any purpose. It is provided "as is" without express 29 * or implied warranty. 30 * 31 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 32 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 33 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 34 */ 35 36 37 /* 38 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved 39 * 40 * $Header: /afs/athena.mit.edu/astaff/project/krbdev/.cvsroot/src/lib/kadm5/clnt/client_init.c,v 1.6 1996/11/07 17:13:44 tytso Exp $ 41 */ 42 43 #include <stdio.h> 44 #include <netdb.h> 45 #ifdef HAVE_MEMORY_H 46 #include <memory.h> 47 #endif 48 #include <string.h> 49 #include <com_err.h> 50 #include <sys/types.h> 51 #include <sys/socket.h> 52 #include <netinet/in.h> 53 #include <krb5.h> 54 #include <k5-int.h> /* for KRB5_ADM_DEFAULT_PORT */ 55 #ifdef __STDC__ 56 #include <stdlib.h> 57 #endif 58 #include <libintl.h> 59 60 #include <kadm5/admin.h> 61 #include <kadm5/kadm_rpc.h> 62 #include "client_internal.h" 63 64 #include <syslog.h> 65 #include <gssapi/gssapi.h> 66 #include <gssapi_krb5.h> 67 #include <gssapiP_krb5.h> 68 #include <rpc/clnt.h> 69 70 #include <iprop_hdr.h> 71 #include "iprop.h" 72 73 #define ADM_CCACHE "/tmp/ovsec_adm.XXXXXX" 74 75 static int old_auth_gssapi = 0; 76 /* connection timeout to kadmind in seconds */ 77 #define KADMIND_CONNECT_TIMEOUT 25 78 79 int _kadm5_check_handle(); 80 81 enum init_type { INIT_PASS, INIT_SKEY, INIT_CREDS }; 82 83 static kadm5_ret_t _kadm5_init_any(char *client_name, 84 enum init_type init_type, 85 char *pass, 86 krb5_ccache ccache_in, 87 char *service_name, 88 kadm5_config_params *params, 89 krb5_ui_4 struct_version, 90 krb5_ui_4 api_version, 91 void **server_handle); 92 93 kadm5_ret_t kadm5_init_with_creds(char *client_name, 94 krb5_ccache ccache, 95 char *service_name, 96 kadm5_config_params *params, 97 krb5_ui_4 struct_version, 98 krb5_ui_4 api_version, 99 void **server_handle) 100 { 101 return _kadm5_init_any(client_name, INIT_CREDS, NULL, ccache, 102 service_name, params, 103 struct_version, api_version, 104 server_handle); 105 } 106 107 108 kadm5_ret_t kadm5_init_with_password(char *client_name, char *pass, 109 char *service_name, 110 kadm5_config_params *params, 111 krb5_ui_4 struct_version, 112 krb5_ui_4 api_version, 113 void **server_handle) 114 { 115 return _kadm5_init_any(client_name, INIT_PASS, pass, NULL, 116 service_name, params, struct_version, 117 api_version, server_handle); 118 } 119 120 kadm5_ret_t kadm5_init(char *client_name, char *pass, 121 char *service_name, 122 kadm5_config_params *params, 123 krb5_ui_4 struct_version, 124 krb5_ui_4 api_version, 125 void **server_handle) 126 { 127 return _kadm5_init_any(client_name, INIT_PASS, pass, NULL, 128 service_name, params, struct_version, 129 api_version, server_handle); 130 } 131 132 kadm5_ret_t kadm5_init_with_skey(char *client_name, char *keytab, 133 char *service_name, 134 kadm5_config_params *params, 135 krb5_ui_4 struct_version, 136 krb5_ui_4 api_version, 137 void **server_handle) 138 { 139 return _kadm5_init_any(client_name, INIT_SKEY, keytab, NULL, 140 service_name, params, struct_version, 141 api_version, server_handle); 142 } 143 144 krb5_error_code kadm5_free_config_params(); 145 146 static void 147 display_status_1(m, code, type, mech) 148 char *m; 149 OM_uint32 code; 150 int type; 151 const gss_OID mech; 152 { 153 OM_uint32 maj_stat, min_stat; 154 gss_buffer_desc msg = GSS_C_EMPTY_BUFFER; 155 OM_uint32 msg_ctx; 156 157 msg_ctx = 0; 158 ADMIN_LOG(LOG_ERR, "%s\n", m); 159 /* LINTED */ 160 while (1) { 161 maj_stat = gss_display_status(&min_stat, code, 162 type, mech, 163 &msg_ctx, &msg); 164 if (maj_stat != GSS_S_COMPLETE) { 165 syslog(LOG_ERR, 166 dgettext(TEXT_DOMAIN, 167 "error in gss_display_status" 168 " called from <%s>\n"), m); 169 break; 170 } else 171 syslog(LOG_ERR, dgettext(TEXT_DOMAIN, 172 "GSS-API error : %s\n"), 173 m); 174 syslog(LOG_ERR, dgettext(TEXT_DOMAIN, 175 "GSS-API error : %s\n"), 176 (char *)msg.value); 177 if (msg.length != 0) 178 (void) gss_release_buffer(&min_stat, &msg); 179 180 if (!msg_ctx) 181 break; 182 } 183 } 184 185 /* 186 * Function: display_status 187 * 188 * Purpose: displays GSS-API messages 189 * 190 * Arguments: 191 * 192 * msg a string to be displayed with the message 193 * maj_stat the GSS-API major status code 194 * min_stat the GSS-API minor status code 195 * mech kerberos mech 196 * Effects: 197 * 198 * The GSS-API messages associated with maj_stat and min_stat are 199 * displayed on stderr, each preceeded by "GSS-API error <msg>: " and 200 * followed by a newline. 201 */ 202 void 203 display_status(msg, maj_stat, min_stat, mech) 204 char *msg; 205 OM_uint32 maj_stat; 206 OM_uint32 min_stat; 207 char *mech; 208 { 209 gss_OID mech_oid; 210 211 if (!rpc_gss_mech_to_oid(mech, (rpc_gss_OID *)&mech_oid)) { 212 ADMIN_LOG(LOG_ERR, 213 dgettext(TEXT_DOMAIN, 214 "Invalid mechanism oid <%s>"), mech); 215 return; 216 } 217 218 display_status_1(msg, maj_stat, GSS_C_GSS_CODE, mech_oid); 219 display_status_1(msg, min_stat, GSS_C_MECH_CODE, mech_oid); 220 } 221 222 /* 223 * Open an fd for the given address and connect asynchronously. Wait 224 * KADMIND_CONNECT_TIMEOUT seconds or till it succeeds. If it succeeds 225 * change fd to blocking and return it, else return -1. 226 */ 227 static int 228 get_connection(struct netconfig *nconf, struct netbuf netaddr) 229 { 230 struct t_info tinfo; 231 struct t_call sndcall; 232 struct t_call *rcvcall = NULL; 233 int connect_time; 234 int flags; 235 int fd; 236 237 (void) memset(&tinfo, 0, sizeof (tinfo)); 238 239 /* we'l open with O_NONBLOCK and avoid an fcntl */ 240 fd = t_open(nconf->nc_device, O_RDWR | O_NONBLOCK, &tinfo); 241 if (fd == -1) { 242 return (-1); 243 } 244 245 if (t_bind(fd, (struct t_bind *)NULL, (struct t_bind *)NULL) == -1) { 246 (void) close(fd); 247 return (-1); 248 } 249 250 /* we can't connect unless fd is in IDLE state */ 251 if (t_getstate(fd) != T_IDLE) { 252 (void) close(fd); 253 return (-1); 254 } 255 256 /* setup connect parameters */ 257 netaddr.len = netaddr.maxlen = __rpc_get_a_size(tinfo.addr); 258 sndcall.addr = netaddr; 259 sndcall.opt.len = sndcall.udata.len = 0; 260 261 /* we wait for KADMIND_CONNECT_TIMEOUT seconds from now */ 262 connect_time = time(NULL) + KADMIND_CONNECT_TIMEOUT; 263 if (t_connect(fd, &sndcall, rcvcall) != 0) { 264 if (t_errno != TNODATA) { 265 (void) close(fd); 266 return (-1); 267 } 268 } 269 270 /* loop till success or timeout */ 271 for (;;) { 272 if (t_rcvconnect(fd, rcvcall) == 0) 273 break; 274 275 if (t_errno != TNODATA || time(NULL) > connect_time) { 276 /* we have either timed out or caught an error */ 277 (void) close(fd); 278 if (rcvcall != NULL) 279 t_free((char *)rcvcall, T_CALL); 280 return (-1); 281 } 282 sleep(1); 283 } 284 285 /* make the fd blocking (synchronous) */ 286 flags = fcntl(fd, F_GETFL, 0); 287 (void) fcntl(fd, F_SETFL, flags & ~O_NONBLOCK); 288 if (rcvcall != NULL) 289 t_free((char *)rcvcall, T_CALL); 290 return (fd); 291 } 292 293 /* 294 * Open an RPCSEC_GSS connection and 295 * get a client handle to use for future RPCSEC calls. 296 * 297 * This function is only used when changing passwords and 298 * the kpasswd_protocol is RPCSEC_GSS 299 */ 300 static int 301 _kadm5_initialize_rpcsec_gss_handle(kadm5_server_handle_t handle, 302 char *client_name, 303 char *service_name) 304 { 305 struct netbuf netaddr; 306 struct hostent *hp; 307 int fd; 308 struct sockaddr_in addr; 309 struct sockaddr_in *sin; 310 struct netconfig *nconf; 311 int code = 0; 312 generic_ret *r; 313 char *ccname_orig; 314 char *iprop_svc; 315 boolean_t iprop_enable = B_FALSE; 316 char mech[] = "kerberos_v5"; 317 gss_OID mech_oid; 318 gss_OID_set_desc oid_set; 319 gss_name_t gss_client; 320 gss_buffer_desc input_name; 321 gss_cred_id_t gss_client_creds = GSS_C_NO_CREDENTIAL; 322 rpc_gss_options_req_t options_req; 323 rpc_gss_options_ret_t options_ret; 324 rpc_gss_service_t service = rpc_gss_svc_privacy; 325 OM_uint32 gssstat, minor_stat; 326 void *handlep; 327 enum clnt_stat rpc_err_code; 328 329 hp = gethostbyname(handle->params.admin_server); 330 if (hp == (struct hostent *)NULL) { 331 code = KADM5_BAD_SERVER_NAME; 332 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 333 "bad server name\n")); 334 goto cleanup; 335 } 336 337 memset(&addr, 0, sizeof (addr)); 338 addr.sin_family = hp->h_addrtype; 339 (void) memcpy((char *)&addr.sin_addr, (char *)hp->h_addr, 340 sizeof (addr.sin_addr)); 341 addr.sin_port = htons((ushort_t)handle->params.kadmind_port); 342 sin = &addr; 343 #ifdef DEBUG 344 printf("kadmin_port %d\n", handle->params.kadmind_port); 345 printf("addr: sin_port: %d, sin_family: %d, sin_zero %s\n", 346 addr.sin_port, addr.sin_family, addr.sin_zero); 347 printf("sin_addr %d:%d\n", addr.sin_addr.S_un.S_un_w.s_w1, 348 addr.sin_addr.S_un.S_un_w.s_w2); 349 #endif 350 if ((handlep = setnetconfig()) == (void *) NULL) { 351 (void) syslog(LOG_ERR, 352 dgettext(TEXT_DOMAIN, 353 "cannot get any transport information")); 354 goto error; 355 } 356 357 while (nconf = getnetconfig(handlep)) { 358 if ((nconf->nc_semantics == NC_TPI_COTS_ORD) && 359 (strcmp(nconf->nc_protofmly, NC_INET) == 0) && 360 (strcmp(nconf->nc_proto, NC_TCP) == 0)) 361 break; 362 } 363 364 if (nconf == (struct netconfig *)NULL) 365 goto error; 366 367 /* Transform addr to netbuf */ 368 (void) memset(&netaddr, 0, sizeof (netaddr)); 369 netaddr.buf = (char *)sin; 370 371 /* get an fd connected to the given address */ 372 fd = get_connection(nconf, netaddr); 373 if (fd == -1) { 374 syslog(LOG_ERR, dgettext(TEXT_DOMAIN, 375 "unable to open connection to ADMIN server " 376 "(t_error %i)"), t_errno); 377 code = KADM5_RPC_ERROR; 378 goto error; 379 } 380 381 #ifdef DEBUG 382 printf("fd: %d, KADM: %d, KADMVERS %d\n", fd, KADM, KADMVERS); 383 printf("nconf: nc_netid: %s, nc_semantics: %d, nc_flag: %d, " 384 "nc_protofmly: %s\n", 385 nconf->nc_netid, nconf->nc_semantics, nconf->nc_flag, 386 nconf->nc_protofmly); 387 printf("nc_proto: %s, nc_device: %s, nc_nlookups: %d, nc_used: %d\n", 388 nconf->nc_proto, nconf->nc_device, nconf->nc_nlookups, 389 nconf->nc_unused); 390 printf("netaddr: maxlen %d, buf: %s, len: %d\n", netaddr.maxlen, 391 netaddr.buf, netaddr.len); 392 #endif 393 /* 394 * Tell clnt_tli_create that given fd is already connected 395 * 396 * If the service_name and client_name are iprop-centric, 397 * we need to clnt_tli_create to the appropriate RPC prog 398 */ 399 iprop_svc = strdup(KIPROP_SVC_NAME); 400 if (iprop_svc == NULL) 401 return (ENOMEM); 402 403 if ((strstr(service_name, iprop_svc) != NULL) && 404 (strstr(client_name, iprop_svc) != NULL)) { 405 iprop_enable = B_TRUE; 406 handle->clnt = clnt_tli_create(fd, nconf, NULL, 407 KRB5_IPROP_PROG, KRB5_IPROP_VERS, 0, 0); 408 } 409 else 410 handle->clnt = clnt_tli_create(fd, nconf, NULL, 411 KADM, KADMVERS, 0, 0); 412 413 if (iprop_svc) 414 free(iprop_svc); 415 416 if (handle->clnt == NULL) { 417 syslog(LOG_ERR, dgettext(TEXT_DOMAIN, 418 "clnt_tli_create failed\n")); 419 code = KADM5_RPC_ERROR; 420 (void) close(fd); 421 goto error; 422 } 423 /* 424 * The rpc-handle was created on an fd opened and connected 425 * by us, so we have to explicitly tell rpc to close it. 426 */ 427 if (clnt_control(handle->clnt, CLSET_FD_CLOSE, NULL) != TRUE) { 428 clnt_pcreateerror("ERROR:"); 429 syslog(LOG_ERR, dgettext(TEXT_DOMAIN, 430 "clnt_control failed to set CLSET_FD_CLOSE")); 431 code = KADM5_RPC_ERROR; 432 (void) close(fd); 433 goto error; 434 } 435 436 handle->lhandle->clnt = handle->clnt; 437 438 /* now that handle->clnt is set, we can check the handle */ 439 if (code = _kadm5_check_handle((void *) handle)) 440 goto error; 441 442 /* 443 * The RPC connection is open; establish the GSS-API 444 * authentication context. 445 */ 446 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 447 "have an rpc connection open\n")); 448 /* use the kadm5 cache */ 449 ccname_orig = getenv("KRB5CCNAME"); 450 if (ccname_orig) 451 ccname_orig = strdup(ccname_orig); 452 453 (void) krb5_setenv("KRB5CCNAME", handle->cache_name, 1); 454 455 ADMIN_LOG(LOG_ERR, 456 dgettext(TEXT_DOMAIN, 457 "current credential cache: %s"), handle->cache_name); 458 input_name.value = client_name; 459 input_name.length = strlen((char *)input_name.value) + 1; 460 gssstat = gss_import_name(&minor_stat, &input_name, 461 (gss_OID)gss_nt_krb5_name, &gss_client); 462 if (gssstat != GSS_S_COMPLETE) { 463 code = KADM5_GSS_ERROR; 464 ADMIN_LOGO(LOG_ERR, 465 dgettext(TEXT_DOMAIN, 466 "gss_import_name failed for client name\n")); 467 goto error; 468 } 469 470 if (!rpc_gss_mech_to_oid(mech, (rpc_gss_OID *)&mech_oid)) { 471 ADMIN_LOG(LOG_ERR, 472 dgettext(TEXT_DOMAIN, 473 "Invalid mechanism oid <%s>"), mech); 474 goto error; 475 } 476 477 oid_set.count = 1; 478 oid_set.elements = mech_oid; 479 480 gssstat = gss_acquire_cred(&minor_stat, gss_client, 0, 481 &oid_set, GSS_C_INITIATE, 482 &gss_client_creds, NULL, NULL); 483 (void) gss_release_name(&minor_stat, &gss_client); 484 if (gssstat != GSS_S_COMPLETE) { 485 code = KADM5_GSS_ERROR; 486 ADMIN_LOG(LOG_ERR, 487 dgettext(TEXT_DOMAIN, 488 "could not acquire credentials, " 489 "major error code: %d\n"), gssstat); 490 goto error; 491 } 492 handle->my_cred = gss_client_creds; 493 options_req.my_cred = gss_client_creds; 494 options_req.req_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG; 495 options_req.time_req = 0; 496 options_req.input_channel_bindings = NULL; 497 #ifndef INIT_TEST 498 handle->clnt->cl_auth = rpc_gss_seccreate(handle->clnt, 499 service_name, 500 mech, 501 service, 502 NULL, 503 &options_req, 504 &options_ret); 505 #endif /* ! INIT_TEST */ 506 507 if (ccname_orig) { 508 (void) krb5_setenv("KRB5CCNAME", ccname_orig, 1); 509 free(ccname_orig); 510 } else 511 (void) krb5_unsetenv("KRB5CCNAME"); 512 513 if (handle->clnt->cl_auth == NULL) { 514 code = KADM5_GSS_ERROR; 515 display_status(dgettext(TEXT_DOMAIN, 516 "rpc_gss_seccreate failed\n"), 517 options_ret.major_status, 518 options_ret.minor_status, 519 mech); 520 goto error; 521 } 522 523 /* 524 * Bypass the remainder of the code and return straightaway 525 * if the gss service requested is kiprop 526 */ 527 if (iprop_enable == B_TRUE) { 528 code = 0; 529 goto cleanup; 530 } 531 532 r = init_1(&handle->api_version, handle->clnt, &rpc_err_code); 533 if (r == NULL) { 534 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 535 "error during admin api initialization\n")); 536 537 if (rpc_err_code == RPC_CANTENCODEARGS) { 538 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 539 "encryption needed to encode RPC data may not be " 540 "installed/configured on this system")); 541 code = KADM5_RPC_ERROR_CANTENCODEARGS; 542 } else if (rpc_err_code == RPC_CANTDECODEARGS) { 543 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 544 "encryption needed to decode RPC data may not be " 545 "installed/configured on the server")); 546 code = KADM5_RPC_ERROR_CANTDECODEARGS; 547 } else 548 code = KADM5_RPC_ERROR; 549 550 goto error; 551 552 } 553 if (r->code) { 554 code = r->code; 555 ADMIN_LOG(LOG_ERR, 556 dgettext(TEXT_DOMAIN, 557 "error during admin api initialization: %d\n"), 558 r->code); 559 goto error; 560 } 561 error: 562 cleanup: 563 564 if (handlep != (void *) NULL) 565 (void) endnetconfig(handlep); 566 /* 567 * gss_client_creds is freed only when there is an error condition, 568 * given that rpc_gss_seccreate() will assign the cred pointer to the 569 * my_cred member in the auth handle's private data structure. 570 */ 571 if (code && (gss_client_creds != GSS_C_NO_CREDENTIAL)) 572 (void) gss_release_cred(&minor_stat, &gss_client_creds); 573 574 return (code); 575 } 576 577 static kadm5_ret_t _kadm5_init_any(char *client_name, 578 enum init_type init_type, 579 char *pass, 580 krb5_ccache ccache_in, 581 char *service_name, 582 kadm5_config_params *params_in, 583 krb5_ui_4 struct_version, 584 krb5_ui_4 api_version, 585 void **server_handle) 586 { 587 int i; 588 krb5_creds creds; 589 krb5_ccache ccache = NULL; 590 krb5_timestamp now; 591 OM_uint32 gssstat, minor_stat; 592 kadm5_server_handle_t handle; 593 kadm5_config_params params_local; 594 int code = 0; 595 krb5_get_init_creds_opt opt; 596 gss_buffer_desc input_name; 597 krb5_error_code kret; 598 krb5_int32 starttime; 599 char *server = NULL; 600 krb5_principal serverp = NULL, clientp = NULL; 601 bool_t cpw = FALSE; 602 603 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 604 "entering kadm5_init_any\n")); 605 if (! server_handle) { 606 return EINVAL; 607 } 608 609 if (! (handle = malloc(sizeof(*handle)))) { 610 return ENOMEM; 611 } 612 if (! (handle->lhandle = malloc(sizeof(*handle)))) { 613 free(handle); 614 return ENOMEM; 615 } 616 617 handle->magic_number = KADM5_SERVER_HANDLE_MAGIC; 618 handle->struct_version = struct_version; 619 handle->api_version = api_version; 620 handle->clnt = 0; 621 handle->cache_name = 0; 622 handle->destroy_cache = 0; 623 *handle->lhandle = *handle; 624 handle->lhandle->api_version = KADM5_API_VERSION_2; 625 handle->lhandle->struct_version = KADM5_STRUCT_VERSION; 626 handle->lhandle->lhandle = handle->lhandle; 627 628 kret = krb5_init_context(&handle->context); 629 if (kret) { 630 free(handle->lhandle); 631 free(handle); 632 return (kret); 633 } 634 635 if(service_name == NULL || client_name == NULL) { 636 krb5_free_context(handle->context); 637 free(handle->lhandle); 638 free(handle); 639 return EINVAL; 640 } 641 memset((char *) &creds, 0, sizeof(creds)); 642 643 /* 644 * Verify the version numbers before proceeding; we can't use 645 * CHECK_HANDLE because not all fields are set yet. 646 */ 647 GENERIC_CHECK_HANDLE(handle, KADM5_OLD_LIB_API_VERSION, 648 KADM5_NEW_LIB_API_VERSION); 649 650 /* 651 * Acquire relevant profile entries. In version 2, merge values 652 * in params_in with values from profile, based on 653 * params_in->mask. 654 * 655 * In version 1, we've given a realm (which may be NULL) instead 656 * of params_in. So use that realm, make params_in contain an 657 * empty mask, and behave like version 2. 658 */ 659 memset((char *) ¶ms_local, 0, sizeof(params_local)); 660 if (api_version == KADM5_API_VERSION_1) { 661 if (params_in) 662 params_local.mask = KADM5_CONFIG_REALM; 663 params_in = ¶ms_local; 664 } 665 666 #define ILLEGAL_PARAMS ( \ 667 KADM5_CONFIG_ACL_FILE | KADM5_CONFIG_ADB_LOCKFILE | \ 668 KADM5_CONFIG_DBNAME | KADM5_CONFIG_ADBNAME | \ 669 KADM5_CONFIG_DICT_FILE | KADM5_CONFIG_ADMIN_KEYTAB | \ 670 KADM5_CONFIG_STASH_FILE | KADM5_CONFIG_MKEY_NAME | \ 671 KADM5_CONFIG_ENCTYPE | KADM5_CONFIG_MAX_LIFE | \ 672 KADM5_CONFIG_MAX_RLIFE | KADM5_CONFIG_EXPIRATION | \ 673 KADM5_CONFIG_FLAGS | KADM5_CONFIG_ENCTYPES | \ 674 KADM5_CONFIG_MKEY_FROM_KBD) 675 676 if (params_in && params_in->mask & ILLEGAL_PARAMS) { 677 krb5_free_context(handle->context); 678 free(handle->lhandle); 679 free(handle); 680 ADMIN_LOG(LOG_ERR, dgettext(TEXT_DOMAIN, 681 "bad client parameters, returning %d"), 682 KADM5_BAD_CLIENT_PARAMS); 683 return KADM5_BAD_CLIENT_PARAMS; 684 } 685 686 if ((code = kadm5_get_config_params(handle->context, 687 DEFAULT_PROFILE_PATH, 688 "KRB5_CONFIG", 689 params_in, 690 &handle->params))) { 691 krb5_free_context(handle->context); 692 free(handle->lhandle); 693 free(handle); 694 ADMIN_LOG(LOG_ERR, dgettext(TEXT_DOMAIN, 695 "failed to get config_params, return: %d\n"), code); 696 return(code); 697 } 698 699 #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | \ 700 KADM5_CONFIG_ADMIN_SERVER | \ 701 KADM5_CONFIG_KADMIND_PORT) 702 703 if ((handle->params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { 704 (void) kadm5_free_config_params(handle->context, 705 &handle->params); 706 krb5_free_context(handle->context); 707 free(handle->lhandle); 708 free(handle); 709 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 710 "missing config parameters\n")); 711 return KADM5_MISSING_KRB5_CONF_PARAMS; 712 } 713 714 /* 715 * Acquire a service ticket for service_name@realm in the name of 716 * client_name, using password pass (which could be NULL), and 717 * create a ccache to store them in. If INIT_CREDS, use the 718 * ccache we were provided instead. 719 */ 720 if ((code = krb5_parse_name(handle->context, client_name, 721 &creds.client))) { 722 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 723 "could not parse client name\n")); 724 goto error; 725 } 726 clientp = creds.client; 727 728 if (strncmp(service_name, KADM5_CHANGEPW_HOST_SERVICE, 729 strlen(KADM5_CHANGEPW_HOST_SERVICE)) == 0) 730 cpw = TRUE; 731 732 if (init_type == INIT_PASS && 733 handle->params.kpasswd_protocol == KRB5_CHGPWD_CHANGEPW_V2 && 734 cpw == TRUE) { 735 /* 736 * The 'service_name' is constructed by the caller 737 * but its done before the parameter which determines 738 * the kpasswd_protocol is found. The servers that 739 * support the SET/CHANGE password protocol expect 740 * a slightly different service principal than 741 * the normal SEAM kadmind so construct the correct 742 * name here and then forget it. 743 */ 744 char *newsvcname = NULL; 745 newsvcname = malloc(strlen(KADM5_CHANGEPW_SERVICE) + 746 strlen(handle->params.realm) + 2); 747 if (newsvcname == NULL) { 748 return (ENOMEM); 749 } 750 sprintf(newsvcname, "%s@%s", KADM5_CHANGEPW_SERVICE, 751 handle->params.realm); 752 753 if ((code = krb5_parse_name(handle->context, newsvcname, 754 &creds.server))) { 755 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 756 "could not parse server " 757 "name\n")); 758 free(newsvcname); 759 goto error; 760 } 761 free(newsvcname); 762 } else { 763 input_name.value = service_name; 764 input_name.length = strlen((char *)input_name.value) + 1; 765 gssstat = krb5_gss_import_name(handle->context, 766 &minor_stat, 767 &input_name, 768 (gss_OID)GSS_C_NT_HOSTBASED_SERVICE, 769 (gss_name_t *)&creds.server); 770 771 if (gssstat != GSS_S_COMPLETE) { 772 code = KADM5_GSS_ERROR; 773 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 774 "gss_import_name failed for client name\n")); 775 goto error; 776 } 777 } 778 serverp = creds.server; 779 780 /* XXX temporarily fix a bug in krb5_cc_get_type */ 781 #undef krb5_cc_get_type 782 #define krb5_cc_get_type(context, cache) ((cache)->ops->prefix) 783 784 785 if (init_type == INIT_CREDS) { 786 ccache = ccache_in; 787 handle->cache_name = (char *) 788 malloc(strlen(krb5_cc_get_type(handle->context, ccache)) + 789 strlen(krb5_cc_get_name(handle->context, ccache)) + 2); 790 if (handle->cache_name == NULL) { 791 code = ENOMEM; 792 goto error; 793 } 794 sprintf(handle->cache_name, "%s:%s", 795 krb5_cc_get_type(handle->context, ccache), 796 krb5_cc_get_name(handle->context, ccache)); 797 } else { 798 #if 0 799 handle->cache_name = 800 (char *) malloc(strlen(ADM_CCACHE)+strlen("FILE:")+1); 801 if (handle->cache_name == NULL) { 802 code = ENOMEM; 803 goto error; 804 } 805 sprintf(handle->cache_name, "FILE:%s", ADM_CCACHE); 806 mktemp(handle->cache_name + strlen("FILE:")); 807 #endif 808 { 809 static int counter = 0; 810 handle->cache_name = malloc(sizeof("MEMORY:kadm5_") 811 + 3*sizeof(counter)); 812 sprintf(handle->cache_name, "MEMORY:kadm5_%u", counter++); 813 } 814 815 if ((code = krb5_cc_resolve(handle->context, handle->cache_name, 816 &ccache))) 817 goto error; 818 819 if ((code = krb5_cc_initialize (handle->context, ccache, 820 creds.client))) 821 goto error; 822 823 handle->destroy_cache = 1; 824 } 825 handle->lhandle->cache_name = handle->cache_name; 826 ADMIN_LOG(LOG_ERR, dgettext(TEXT_DOMAIN, 827 "cache created: %s\n"), handle->cache_name); 828 829 if ((code = krb5_timeofday(handle->context, &now))) 830 goto error; 831 832 /* 833 * Get a ticket, use the method specified in init_type. 834 */ 835 836 creds.times.starttime = 0; /* start timer at KDC */ 837 creds.times.endtime = 0; /* endtime will be limited by service */ 838 839 memset(&opt, 0, sizeof (opt)); 840 krb5_get_init_creds_opt_init(&opt); 841 842 if (creds.times.endtime) { 843 if (creds.times.starttime) 844 starttime = creds.times.starttime; 845 else 846 starttime = now; 847 848 krb5_get_init_creds_opt_set_tkt_life(&opt, 849 creds.times.endtime - starttime); 850 } 851 code = krb5_unparse_name(handle->context, creds.server, &server); 852 if (code) 853 goto error; 854 855 if (init_type == INIT_PASS) { 856 code = krb5_get_init_creds_password(handle->context, 857 &creds, creds.client, pass, NULL, 858 NULL, creds.times.starttime, 859 server, &opt); 860 } else if (init_type == INIT_SKEY) { 861 krb5_keytab kt = NULL; 862 863 if (!(pass && (code = krb5_kt_resolve(handle->context, 864 pass, &kt)))) { 865 code = krb5_get_init_creds_keytab( 866 handle->context, 867 &creds, creds.client, kt, 868 creds.times.starttime, 869 server, &opt); 870 871 if (pass) krb5_kt_close(handle->context, kt); 872 } 873 } 874 875 /* Improved error messages */ 876 if (code == KRB5KRB_AP_ERR_BAD_INTEGRITY) code = KADM5_BAD_PASSWORD; 877 if (code == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) 878 code = KADM5_SECURE_PRINC_MISSING; 879 880 if (code != 0) { 881 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, 882 "failed to obtain credentials cache\n")); 883 goto error; 884 } 885 886 /* 887 * If we got this far, save the creds in the cache. 888 */ 889 if (ccache) { 890 code = krb5_cc_store_cred(handle->context, ccache, &creds); 891 } 892 893 ADMIN_LOGO(LOG_ERR, dgettext(TEXT_DOMAIN, "obtained credentials cache\n")); 894 895 #ifdef ZEROPASSWD 896 if (pass != NULL) 897 memset(pass, 0, strlen(pass)); 898 #endif 899 900 if (init_type != INIT_PASS || 901 handle->params.kpasswd_protocol == KRB5_CHGPWD_RPCSEC || 902 cpw == FALSE) { 903 code = _kadm5_initialize_rpcsec_gss_handle(handle, 904 client_name, service_name); 905 if (code != 0) 906 goto error; 907 } 908 909 *server_handle = (void *) handle; 910 911 if (init_type != INIT_CREDS) 912 krb5_cc_close(handle->context, ccache); 913 914 goto cleanup; 915 916 error: 917 /* 918 * Note that it is illegal for this code to execute if "handle" 919 * has not been allocated and initialized. I.e., don't use "goto 920 * error" before the block of code at the top of the function 921 * that allocates and initializes "handle". 922 */ 923 if (handle->cache_name) 924 free(handle->cache_name); 925 if (handle->destroy_cache && ccache) 926 krb5_cc_destroy(handle->context, ccache); 927 if(handle->clnt && handle->clnt->cl_auth) 928 AUTH_DESTROY(handle->clnt->cl_auth); 929 if(handle->clnt) 930 clnt_destroy(handle->clnt); 931 (void) kadm5_free_config_params(handle->context, &handle->params); 932 933 cleanup: 934 if (server) 935 free(server); 936 937 /* 938 * cred's server and client pointers could have been overwritten 939 * by the krb5_get_init_* functions. If the addresses are different 940 * before and after the calls then we must free the memory that 941 * was allocated before the call. 942 */ 943 if (clientp && clientp != creds.client) 944 krb5_free_principal(handle->context, clientp); 945 946 if (serverp && serverp != creds.server) 947 krb5_free_principal(handle->context, serverp); 948 949 krb5_free_cred_contents(handle->context, &creds); 950 951 /* 952 * Dont clean up the handle if the code is OK (code==0) 953 * because it is returned to the caller in the 'server_handle' 954 * ptr. 955 */ 956 if (code) { 957 krb5_free_context(handle->context); 958 free(handle->lhandle); 959 free(handle); 960 } 961 962 return code; 963 } 964 965 kadm5_ret_t 966 kadm5_destroy(void *server_handle) 967 { 968 krb5_ccache ccache = NULL; 969 int code = KADM5_OK; 970 kadm5_server_handle_t handle = 971 (kadm5_server_handle_t) server_handle; 972 OM_uint32 min_stat; 973 974 CHECK_HANDLE(server_handle); 975 /* SUNW14resync: 976 * krb5_cc_resolve() will resolve a ccache with the same data that 977 * handle->my_cred points to. If the ccache is a MEMORY ccache then 978 * gss_release_cred() will free that data (it doesn't do this when ccache 979 * is a FILE ccache). 980 * if'ed out to avoid the double free. 981 */ 982 #if 0 983 if (handle->destroy_cache && handle->cache_name) { 984 if ((code = krb5_cc_resolve(handle->context, 985 handle->cache_name, &ccache)) == 0) 986 code = krb5_cc_destroy (handle->context, ccache); 987 } 988 #endif 989 if (handle->cache_name) 990 free(handle->cache_name); 991 if (handle->clnt && handle->clnt->cl_auth) { 992 /* 993 * Since kadm5 doesn't use the default credentials we 994 * must clean this up manually. 995 */ 996 if (handle->my_cred != GSS_C_NO_CREDENTIAL) 997 (void) gss_release_cred(&min_stat, &handle->my_cred); 998 AUTH_DESTROY(handle->clnt->cl_auth); 999 } 1000 if (handle->clnt) 1001 clnt_destroy(handle->clnt); 1002 if (handle->lhandle) 1003 free (handle->lhandle); 1004 1005 kadm5_free_config_params(handle->context, &handle->params); 1006 krb5_free_context(handle->context); 1007 1008 handle->magic_number = 0; 1009 free(handle); 1010 1011 return code; 1012 } 1013 /* not supported on client */ 1014 kadm5_ret_t kadm5_lock(void *server_handle) 1015 { 1016 return EINVAL; 1017 } 1018 1019 /* not supported on client */ 1020 kadm5_ret_t kadm5_unlock(void *server_handle) 1021 { 1022 return EINVAL; 1023 } 1024 1025 kadm5_ret_t kadm5_flush(void *server_handle) 1026 { 1027 return KADM5_OK; 1028 } 1029 1030 int _kadm5_check_handle(void *handle) 1031 { 1032 CHECK_HANDLE(handle); 1033 return 0; 1034 } 1035 1036 /* 1037 * Stub function for kadmin. It was created to eliminate the dependency on 1038 * libkdb's ulog functions. The srv equivalent makes the actual calls. 1039 */ 1040 krb5_error_code 1041 kadm5_init_iprop(void *handle) 1042 { 1043 return (0); 1044 } 1045