1 /*
2 * Copyright (c) 1997-2007 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 *
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * 3. Neither the name of the Institute nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 */
34
35 #include "kdc_locl.h"
36 #include <getarg.h>
37 #include <parse_bytes.h>
38
39 RCSID("$Id: config.c 22248 2007-12-08 23:52:12Z lha $");
40
41 struct dbinfo {
42 char *realm;
43 char *dbname;
44 char *mkey_file;
45 struct dbinfo *next;
46 };
47
48 static char *config_file; /* location of kdc config file */
49
50 static int require_preauth = -1; /* 1 == require preauth for all principals */
51 static char *max_request_str; /* `max_request' as a string */
52
53 static int disable_des = -1;
54 static int enable_v4 = -1;
55 static int enable_kaserver = -1;
56 static int enable_524 = -1;
57 static int enable_v4_cross_realm = -1;
58
59 static int builtin_hdb_flag;
60 static int help_flag;
61 static int version_flag;
62
63 static struct getarg_strings addresses_str; /* addresses to listen on */
64
65 static char *v4_realm;
66
67 static struct getargs args[] = {
68 {
69 "config-file", 'c', arg_string, &config_file,
70 "location of config file", "file"
71 },
72 {
73 "require-preauth", 'p', arg_negative_flag, &require_preauth,
74 "don't require pa-data in as-reqs"
75 },
76 {
77 "max-request", 0, arg_string, &max_request,
78 "max size for a kdc-request", "size"
79 },
80 { "enable-http", 'H', arg_flag, &enable_http, "turn on HTTP support" },
81 { "524", 0, arg_negative_flag, &enable_524,
82 "don't respond to 524 requests"
83 },
84 {
85 "kaserver", 'K', arg_flag, &enable_kaserver,
86 "enable kaserver support"
87 },
88 { "kerberos4", 0, arg_flag, &enable_v4,
89 "respond to kerberos 4 requests"
90 },
91 {
92 "v4-realm", 'r', arg_string, &v4_realm,
93 "realm to serve v4-requests for"
94 },
95 { "kerberos4-cross-realm", 0, arg_flag,
96 &enable_v4_cross_realm,
97 "respond to kerberos 4 requests from foreign realms"
98 },
99 { "ports", 'P', arg_string, &port_str,
100 "ports to listen to", "portspec"
101 },
102 #if DETACH_IS_DEFAULT
103 {
104 "detach", 'D', arg_negative_flag, &detach_from_console,
105 "don't detach from console"
106 },
107 #else
108 {
109 "detach", 0 , arg_flag, &detach_from_console,
110 "detach from console"
111 },
112 #endif
113 { "addresses", 0, arg_strings, &addresses_str,
114 "addresses to listen on", "list of addresses" },
115 { "disable-des", 0, arg_flag, &disable_des,
116 "disable DES" },
117 { "builtin-hdb", 0, arg_flag, &builtin_hdb_flag,
118 "list builtin hdb backends"},
119 { "help", 'h', arg_flag, &help_flag },
120 { "version", 'v', arg_flag, &version_flag }
121 };
122
123 static int num_args = sizeof(args) / sizeof(args[0]);
124
125 static void
usage(int ret)126 usage(int ret)
127 {
128 arg_printusage (args, num_args, NULL, "");
129 exit (ret);
130 }
131
132 static void
add_one_address(krb5_context context,const char * str,int first)133 add_one_address (krb5_context context, const char *str, int first)
134 {
135 krb5_error_code ret;
136 krb5_addresses tmp;
137
138 ret = krb5_parse_address (context, str, &tmp);
139 if (ret)
140 krb5_err (context, 1, ret, "parse_address `%s'", str);
141 if (first)
142 krb5_copy_addresses(context, &tmp, &explicit_addresses);
143 else
144 krb5_append_addresses(context, &explicit_addresses, &tmp);
145 krb5_free_addresses (context, &tmp);
146 }
147
148 krb5_kdc_configuration *
configure(krb5_context context,int argc,char ** argv)149 configure(krb5_context context, int argc, char **argv)
150 {
151 krb5_kdc_configuration *config;
152 krb5_error_code ret;
153 int optidx = 0;
154 const char *p;
155
156 while(getarg(args, num_args, argc, argv, &optidx))
157 warnx("error at argument `%s'", argv[optidx]);
158
159 if(help_flag)
160 usage (0);
161
162 if (version_flag) {
163 print_version(NULL);
164 exit(0);
165 }
166
167 if (builtin_hdb_flag) {
168 char *list;
169 ret = hdb_list_builtin(context, &list);
170 if (ret)
171 krb5_err(context, 1, ret, "listing builtin hdb backends");
172 printf("builtin hdb backends: %s\n", list);
173 free(list);
174 exit(0);
175 }
176
177 argc -= optidx;
178 argv += optidx;
179
180 if (argc != 0)
181 usage(1);
182
183 {
184 char **files;
185
186 if (config_file == NULL) {
187 asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
188 if (config_file == NULL)
189 errx(1, "out of memory");
190 }
191
192 ret = krb5_prepend_config_files_default(config_file, &files);
193 if (ret)
194 krb5_err(context, 1, ret, "getting configuration files");
195
196 ret = krb5_set_config_files(context, files);
197 krb5_free_config_files(files);
198 if(ret)
199 krb5_err(context, 1, ret, "reading configuration files");
200 }
201
202 ret = krb5_kdc_get_config(context, &config);
203 if (ret)
204 krb5_err(context, 1, ret, "krb5_kdc_default_config");
205
206 kdc_openlog(context, config);
207
208 ret = krb5_kdc_set_dbinfo(context, config);
209 if (ret)
210 krb5_err(context, 1, ret, "krb5_kdc_set_dbinfo");
211
212 if(max_request_str)
213 max_request = parse_bytes(max_request_str, NULL);
214
215 if(max_request == 0){
216 p = krb5_config_get_string (context,
217 NULL,
218 "kdc",
219 "max-request",
220 NULL);
221 if(p)
222 max_request = parse_bytes(p, NULL);
223 }
224
225 if(require_preauth != -1)
226 config->require_preauth = require_preauth;
227
228 if(port_str == NULL){
229 p = krb5_config_get_string(context, NULL, "kdc", "ports", NULL);
230 if (p != NULL)
231 port_str = strdup(p);
232 }
233
234 explicit_addresses.len = 0;
235
236 if (addresses_str.num_strings) {
237 int i;
238
239 for (i = 0; i < addresses_str.num_strings; ++i)
240 add_one_address (context, addresses_str.strings[i], i == 0);
241 free_getarg_strings (&addresses_str);
242 } else {
243 char **foo = krb5_config_get_strings (context, NULL,
244 "kdc", "addresses", NULL);
245
246 if (foo != NULL) {
247 add_one_address (context, *foo++, TRUE);
248 while (*foo)
249 add_one_address (context, *foo++, FALSE);
250 }
251 }
252
253 if(enable_v4 != -1)
254 config->enable_v4 = enable_v4;
255
256 if(enable_v4_cross_realm != -1)
257 config->enable_v4_cross_realm = enable_v4_cross_realm;
258
259 if(enable_524 != -1)
260 config->enable_524 = enable_524;
261
262 if(enable_http == -1)
263 enable_http = krb5_config_get_bool(context, NULL, "kdc",
264 "enable-http", NULL);
265
266 if(request_log == NULL)
267 request_log = krb5_config_get_string(context, NULL,
268 "kdc",
269 "kdc-request-log",
270 NULL);
271
272 if (krb5_config_get_string(context, NULL, "kdc",
273 "enforce-transited-policy", NULL))
274 krb5_errx(context, 1, "enforce-transited-policy deprecated, "
275 "use [kdc]transited-policy instead");
276
277 if (enable_kaserver != -1)
278 config->enable_kaserver = enable_kaserver;
279
280 if(detach_from_console == -1)
281 detach_from_console = krb5_config_get_bool_default(context, NULL,
282 DETACH_IS_DEFAULT,
283 "kdc",
284 "detach", NULL);
285
286 if(max_request == 0)
287 max_request = 64 * 1024;
288
289 if (port_str == NULL)
290 port_str = "+";
291
292 if (v4_realm)
293 config->v4_realm = v4_realm;
294
295 if(config->v4_realm == NULL && (config->enable_kaserver || config->enable_v4))
296 krb5_errx(context, 1, "Kerberos 4 enabled but no realm configured");
297
298 if(disable_des == -1)
299 disable_des = krb5_config_get_bool_default(context, NULL,
300 FALSE,
301 "kdc",
302 "disable-des", NULL);
303 if(disable_des) {
304 krb5_enctype_disable(context, ETYPE_DES_CBC_CRC);
305 krb5_enctype_disable(context, ETYPE_DES_CBC_MD4);
306 krb5_enctype_disable(context, ETYPE_DES_CBC_MD5);
307 krb5_enctype_disable(context, ETYPE_DES_CBC_NONE);
308 krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE);
309 krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE);
310
311 kdc_log(context, config,
312 0, "DES was disabled, turned off Kerberos V4, 524 "
313 "and kaserver");
314 config->enable_v4 = 0;
315 config->enable_524 = 0;
316 config->enable_kaserver = 0;
317 }
318
319 krb5_kdc_windc_init(context);
320
321 return config;
322 }
323