2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadmin_locl.h"
35 #include <krb5-private.h>
40 kadmind_dispatch(void *kadm_handle
, krb5_boolean initial
,
41 krb5_data
*in
, krb5_data
*out
)
44 int32_t cmd
, mask
, tmp
;
45 kadm5_server_context
*context
= kadm_handle
;
46 char client
[128], name
[128], name2
[128];
48 krb5_principal princ
, princ2
;
49 kadm5_principal_ent_rec ent
;
50 char *password
, *expression
;
51 krb5_keyblock
*new_keys
;
57 krb5_unparse_name_fixed(context
->context
, context
->caller
,
58 client
, sizeof(client
));
60 sp
= krb5_storage_from_data(in
);
62 krb5_ret_int32(sp
, &cmd
);
66 ret
= krb5_ret_principal(sp
, &princ
);
69 ret
= krb5_ret_int32(sp
, &mask
);
71 krb5_free_principal(context
->context
, princ
);
74 krb5_unparse_name_fixed(context
->context
, princ
, name
, sizeof(name
));
75 krb5_warnx(context
->context
, "%s: %s %s", client
, op
, name
);
76 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_GET
, princ
);
78 krb5_free_principal(context
->context
, princ
);
81 ret
= kadm5_get_principal(kadm_handle
, princ
, &ent
, mask
);
82 krb5_storage_free(sp
);
83 sp
= krb5_storage_emem();
84 krb5_store_int32(sp
, ret
);
86 kadm5_store_principal_ent(sp
, &ent
);
87 kadm5_free_principal_ent(kadm_handle
, &ent
);
89 krb5_free_principal(context
->context
, princ
);
94 ret
= krb5_ret_principal(sp
, &princ
);
97 krb5_unparse_name_fixed(context
->context
, princ
, name
, sizeof(name
));
98 krb5_warnx(context
->context
, "%s: %s %s", client
, op
, name
);
99 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_DELETE
, princ
);
101 krb5_free_principal(context
->context
, princ
);
104 ret
= kadm5_delete_principal(kadm_handle
, princ
);
105 krb5_free_principal(context
->context
, princ
);
106 krb5_storage_free(sp
);
107 sp
= krb5_storage_emem();
108 krb5_store_int32(sp
, ret
);
113 ret
= kadm5_ret_principal_ent(sp
, &ent
);
116 ret
= krb5_ret_int32(sp
, &mask
);
118 kadm5_free_principal_ent(context
->context
, &ent
);
121 ret
= krb5_ret_string(sp
, &password
);
123 kadm5_free_principal_ent(context
->context
, &ent
);
126 krb5_unparse_name_fixed(context
->context
, ent
.principal
,
128 krb5_warnx(context
->context
, "%s: %s %s", client
, op
, name
);
129 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_ADD
,
132 kadm5_free_principal_ent(context
->context
, &ent
);
133 memset(password
, 0, strlen(password
));
137 ret
= kadm5_create_principal(kadm_handle
, &ent
,
139 kadm5_free_principal_ent(kadm_handle
, &ent
);
140 memset(password
, 0, strlen(password
));
142 krb5_storage_free(sp
);
143 sp
= krb5_storage_emem();
144 krb5_store_int32(sp
, ret
);
149 ret
= kadm5_ret_principal_ent(sp
, &ent
);
152 ret
= krb5_ret_int32(sp
, &mask
);
154 kadm5_free_principal_ent(context
, &ent
);
157 krb5_unparse_name_fixed(context
->context
, ent
.principal
,
159 krb5_warnx(context
->context
, "%s: %s %s", client
, op
, name
);
160 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_MODIFY
,
163 kadm5_free_principal_ent(context
, &ent
);
166 ret
= kadm5_modify_principal(kadm_handle
, &ent
, mask
);
167 kadm5_free_principal_ent(kadm_handle
, &ent
);
168 krb5_storage_free(sp
);
169 sp
= krb5_storage_emem();
170 krb5_store_int32(sp
, ret
);
175 ret
= krb5_ret_principal(sp
, &princ
);
178 ret
= krb5_ret_principal(sp
, &princ2
);
180 krb5_free_principal(context
->context
, princ
);
183 krb5_unparse_name_fixed(context
->context
, princ
, name
, sizeof(name
));
184 krb5_unparse_name_fixed(context
->context
, princ2
, name2
, sizeof(name2
));
185 krb5_warnx(context
->context
, "%s: %s %s -> %s",
186 client
, op
, name
, name2
);
187 ret
= _kadm5_acl_check_permission(context
,
190 || _kadm5_acl_check_permission(context
,
194 krb5_free_principal(context
->context
, princ
);
195 krb5_free_principal(context
->context
, princ2
);
198 ret
= kadm5_rename_principal(kadm_handle
, princ
, princ2
);
199 krb5_free_principal(context
->context
, princ
);
200 krb5_free_principal(context
->context
, princ2
);
201 krb5_storage_free(sp
);
202 sp
= krb5_storage_emem();
203 krb5_store_int32(sp
, ret
);
208 ret
= krb5_ret_principal(sp
, &princ
);
211 ret
= krb5_ret_string(sp
, &password
);
213 krb5_free_principal(context
->context
, princ
);
216 krb5_unparse_name_fixed(context
->context
, princ
, name
, sizeof(name
));
217 krb5_warnx(context
->context
, "%s: %s %s", client
, op
, name
);
220 * The change is allowed if at least one of:
222 * a) it's for the principal him/herself and this was an
223 * initial ticket, but then, check with the password quality
225 * b) the user is on the CPW ACL.
229 && krb5_principal_compare (context
->context
, context
->caller
,
233 const char *pwd_reason
;
235 pwd_data
.data
= password
;
236 pwd_data
.length
= strlen(password
);
238 pwd_reason
= kadm5_check_password_quality (context
->context
,
240 if (pwd_reason
!= NULL
)
241 ret
= KADM5_PASS_Q_DICT
;
245 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_CPW
, princ
);
248 krb5_free_principal(context
->context
, princ
);
249 memset(password
, 0, strlen(password
));
253 ret
= kadm5_chpass_principal(kadm_handle
, princ
, password
);
254 krb5_free_principal(context
->context
, princ
);
255 memset(password
, 0, strlen(password
));
257 krb5_storage_free(sp
);
258 sp
= krb5_storage_emem();
259 krb5_store_int32(sp
, ret
);
262 case kadm_chpass_with_key
:{
264 krb5_key_data
*key_data
;
267 op
= "CHPASS_WITH_KEY";
268 ret
= krb5_ret_principal(sp
, &princ
);
271 ret
= krb5_ret_int32(sp
, &n_key_data
);
273 krb5_free_principal(context
->context
, princ
);
276 /* n_key_data will be squeezed into an int16_t below. */
277 if (n_key_data
< 0 || n_key_data
>= 1 << 16 ||
278 n_key_data
> UINT_MAX
/sizeof(*key_data
)) {
280 krb5_free_principal(context
->context
, princ
);
284 key_data
= malloc (n_key_data
* sizeof(*key_data
));
285 if (key_data
== NULL
) {
287 krb5_free_principal(context
->context
, princ
);
291 for (i
= 0; i
< n_key_data
; ++i
) {
292 ret
= kadm5_ret_key_data (sp
, &key_data
[i
]);
296 kadm5_free_key_data (context
, &dummy
, key_data
);
298 krb5_free_principal(context
->context
, princ
);
303 krb5_unparse_name_fixed(context
->context
, princ
, name
, sizeof(name
));
304 krb5_warnx(context
->context
, "%s: %s %s", client
, op
, name
);
307 * The change is only allowed if the user is on the CPW ACL,
308 * this it to force password quality check on the user.
311 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_CPW
, princ
);
313 int16_t dummy
= n_key_data
;
315 kadm5_free_key_data (context
, &dummy
, key_data
);
317 krb5_free_principal(context
->context
, princ
);
320 ret
= kadm5_chpass_principal_with_key(kadm_handle
, princ
,
321 n_key_data
, key_data
);
323 int16_t dummy
= n_key_data
;
324 kadm5_free_key_data (context
, &dummy
, key_data
);
327 krb5_free_principal(context
->context
, princ
);
328 krb5_storage_free(sp
);
329 sp
= krb5_storage_emem();
330 krb5_store_int32(sp
, ret
);
335 ret
= krb5_ret_principal(sp
, &princ
);
338 krb5_unparse_name_fixed(context
->context
, princ
, name
, sizeof(name
));
339 krb5_warnx(context
->context
, "%s: %s %s", client
, op
, name
);
341 * The change is allowed if at least one of:
342 * a) it's for the principal him/herself and this was an initial ticket
343 * b) the user is on the CPW ACL.
347 && krb5_principal_compare (context
->context
, context
->caller
,
351 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_CPW
, princ
);
354 krb5_free_principal(context
->context
, princ
);
357 ret
= kadm5_randkey_principal(kadm_handle
, princ
,
359 krb5_free_principal(context
->context
, princ
);
360 krb5_storage_free(sp
);
361 sp
= krb5_storage_emem();
362 krb5_store_int32(sp
, ret
);
365 krb5_store_int32(sp
, n_keys
);
366 for(i
= 0; i
< n_keys
; i
++){
367 krb5_store_keyblock(sp
, new_keys
[i
]);
368 krb5_free_keyblock_contents(context
->context
, &new_keys
[i
]);
373 case kadm_get_privs
:{
375 ret
= kadm5_get_privs(kadm_handle
, &privs
);
376 krb5_storage_free(sp
);
377 sp
= krb5_storage_emem();
378 krb5_store_int32(sp
, ret
);
380 krb5_store_uint32(sp
, privs
);
383 case kadm_get_princs
:{
385 ret
= krb5_ret_int32(sp
, &tmp
);
389 ret
= krb5_ret_string(sp
, &expression
);
394 krb5_warnx(context
->context
, "%s: %s %s", client
, op
,
395 expression
? expression
: "*");
396 ret
= _kadm5_acl_check_permission(context
, KADM5_PRIV_LIST
, NULL
);
401 ret
= kadm5_get_principals(kadm_handle
, expression
, &princs
, &n_princs
);
403 krb5_storage_free(sp
);
404 sp
= krb5_storage_emem();
405 krb5_store_int32(sp
, ret
);
408 krb5_store_int32(sp
, n_princs
);
409 for(i
= 0; i
< n_princs
; i
++)
410 krb5_store_string(sp
, princs
[i
]);
411 kadm5_free_name_list(kadm_handle
, princs
, &n_princs
);
416 krb5_warnx(context
->context
, "%s: UNKNOWN OP %d", client
, cmd
);
417 krb5_storage_free(sp
);
418 sp
= krb5_storage_emem();
419 krb5_store_int32(sp
, KADM5_FAILURE
);
422 krb5_storage_to_data(sp
, out
);
423 krb5_storage_free(sp
);
426 krb5_warn(context
->context
, ret
, "%s", op
);
427 krb5_storage_seek(sp
, 0, SEEK_SET
);
428 krb5_store_int32(sp
, ret
);
429 krb5_storage_to_data(sp
, out
);
430 krb5_storage_free(sp
);
435 v5_loop (krb5_context context
,
436 krb5_auth_context ac
,
437 krb5_boolean initial
,
445 doing_useful_work
= 0;
448 ret
= krb5_read_priv_message(context
, ac
, &fd
, &in
);
449 if(ret
== HEIM_ERR_EOF
)
452 krb5_err(context
, 1, ret
, "krb5_read_priv_message");
453 doing_useful_work
= 1;
454 kadmind_dispatch(kadm_handle
, initial
, &in
, &out
);
456 ret
= krb5_write_priv_message(context
, ac
, &fd
, &out
);
458 krb5_err(context
, 1, ret
, "krb5_write_priv_message");
463 match_appl_version(const void *data
, const char *appl_version
)
466 if(sscanf(appl_version
, "KADM0.%u", &minor
) != 1)
468 *(unsigned*)data
= minor
;
473 handle_v5(krb5_context context
,
474 krb5_auth_context ac
,
480 u_char version
[sizeof(KRB5_SENDAUTH_VERSION
)];
486 krb5_boolean initial
;
488 unsigned kadm_version
;
489 kadm5_config_params realm_params
;
491 if (len
!= sizeof(KRB5_SENDAUTH_VERSION
))
492 krb5_errx(context
, 1, "bad sendauth len %d", len
);
493 n
= krb5_net_read(context
, &fd
, version
, len
);
495 krb5_err (context
, 1, errno
, "reading sendauth version");
497 krb5_errx (context
, 1, "EOF reading sendauth version");
498 if(memcmp(version
, KRB5_SENDAUTH_VERSION
, len
) != 0)
499 krb5_errx(context
, 1, "bad sendauth version %.8s", version
);
501 ret
= krb5_recvauth_match_version(context
, &ac
, &fd
,
502 match_appl_version
, &kadm_version
,
503 NULL
, KRB5_RECVAUTH_IGNORE_VERSION
,
505 if(ret
== KRB5_KT_NOTFOUND
)
506 krb5_errx(context
, 1, "krb5_recvauth: key not found");
508 krb5_err(context
, 1, ret
, "krb5_recvauth");
510 ret
= krb5_unparse_name (context
, ticket
->server
, &server_name
);
512 krb5_err (context
, 1, ret
, "krb5_unparse_name");
514 if (strncmp (server_name
, KADM5_ADMIN_SERVICE
,
515 strlen(KADM5_ADMIN_SERVICE
)) != 0)
516 krb5_errx (context
, 1, "ticket for strange principal (%s)",
521 memset(&realm_params
, 0, sizeof(realm_params
));
523 if(kadm_version
== 1) {
525 ret
= krb5_read_priv_message(context
, ac
, &fd
, ¶ms
);
527 krb5_err(context
, 1, ret
, "krb5_read_priv_message");
528 _kadm5_unmarshal_params(context
, ¶ms
, &realm_params
);
531 initial
= ticket
->ticket
.flags
.initial
;
532 ret
= krb5_unparse_name(context
, ticket
->client
, &client
);
534 krb5_err (context
, 1, ret
, "krb5_unparse_name");
535 krb5_free_ticket (context
, ticket
);
536 ret
= kadm5_init_with_password_ctx(context
,
544 krb5_err (context
, 1, ret
, "kadm5_init_with_password_ctx");
545 v5_loop (context
, ac
, initial
, kadm_handle
, fd
);
549 kadmind_loop(krb5_context context
,
550 krb5_auth_context ac
,
554 unsigned char tmp
[4];
558 n
= krb5_net_read(context
, &fd
, tmp
, 4);
562 krb5_err(context
, 1, errno
, "read");
563 _krb5_get_int(tmp
, &len
, 4);
564 /* this v4 test could probably also go away */
565 if(len
> 0xffff && (len
& 0xffff) == ('K' << 8) + 'A') {
566 unsigned char v4reply
[] = {
568 'K', 'Y', 'O', 'U', 'L', 'O', 'S', 'E',
569 0x95, 0xb7, 0xa7, 0x08 /* KADM_BAD_VER */
571 krb5_net_write(context
, &fd
, v4reply
, sizeof(v4reply
));
572 krb5_errx(context
, 1, "packet appears to be version 4");
574 handle_v5(context
, ac
, keytab
, len
, fd
);