x
[heimdal.git] / kdc / config.c
blobbb1710f1dc864f9ccdf25fb583854683080a7d7f
1 /*
2 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
5 * All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the Institute nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
35 #include "kdc_locl.h"
36 #include <getarg.h>
37 #include <parse_bytes.h>
39 RCSID("$Id$");
41 struct dbinfo {
42 char *realm;
43 char *dbname;
44 char *mkey_file;
45 struct dbinfo *next;
48 static char *config_file; /* location of kdc config file */
50 static int require_preauth = -1; /* 1 == require preauth for all principals */
51 static char *max_request_str; /* `max_request' as a string */
53 static int disable_des = -1;
54 static int enable_v4 = -1;
55 static int enable_kaserver = -1;
56 static int enable_524 = -1;
57 static int enable_v4_cross_realm = -1;
59 static int builtin_hdb_flag;
60 static int help_flag;
61 static int version_flag;
63 static struct getarg_strings addresses_str; /* addresses to listen on */
65 static char *v4_realm;
67 static struct getargs args[] = {
69 "config-file", 'c', arg_string, &config_file,
70 "location of config file", "file"
73 "require-preauth", 'p', arg_negative_flag, &require_preauth,
74 "don't require pa-data in as-reqs"
77 "max-request", 0, arg_string, &max_request,
78 "max size for a kdc-request", "size"
80 { "enable-http", 'H', arg_flag, &enable_http, "turn on HTTP support" },
81 { "524", 0, arg_negative_flag, &enable_524,
82 "don't respond to 524 requests"
85 "kaserver", 'K', arg_flag, &enable_kaserver,
86 "enable kaserver support"
88 { "kerberos4", 0, arg_flag, &enable_v4,
89 "respond to kerberos 4 requests"
92 "v4-realm", 'r', arg_string, &v4_realm,
93 "realm to serve v4-requests for"
95 { "kerberos4-cross-realm", 0, arg_flag,
96 &enable_v4_cross_realm,
97 "respond to kerberos 4 requests from foreign realms"
99 { "ports", 'P', arg_string, &port_str,
100 "ports to listen to", "portspec"
102 #if DETACH_IS_DEFAULT
104 "detach", 'D', arg_negative_flag, &detach_from_console,
105 "don't detach from console"
107 #else
109 "detach", 0 , arg_flag, &detach_from_console,
110 "detach from console"
112 #endif
113 { "addresses", 0, arg_strings, &addresses_str,
114 "addresses to listen on", "list of addresses" },
115 { "disable-des", 0, arg_flag, &disable_des,
116 "disable DES" },
117 { "builtin-hdb", 0, arg_flag, &builtin_hdb_flag,
118 "list builtin hdb backends"},
119 { "help", 'h', arg_flag, &help_flag },
120 { "version", 'v', arg_flag, &version_flag }
123 static int num_args = sizeof(args) / sizeof(args[0]);
125 static void
126 usage(int ret)
128 arg_printusage (args, num_args, NULL, "");
129 exit (ret);
132 static void
133 add_one_address (krb5_context context, const char *str, int first)
135 krb5_error_code ret;
136 krb5_addresses tmp;
138 ret = krb5_parse_address (context, str, &tmp);
139 if (ret)
140 krb5_err (context, 1, ret, "parse_address `%s'", str);
141 if (first)
142 krb5_copy_addresses(context, &tmp, &explicit_addresses);
143 else
144 krb5_append_addresses(context, &explicit_addresses, &tmp);
145 krb5_free_addresses (context, &tmp);
148 krb5_kdc_configuration *
149 configure(krb5_context context, int argc, char **argv)
151 krb5_kdc_configuration *config;
152 krb5_error_code ret;
153 int optidx = 0;
154 const char *p;
156 while(getarg(args, num_args, argc, argv, &optidx))
157 warnx("error at argument `%s'", argv[optidx]);
159 if(help_flag)
160 usage (0);
162 if (version_flag) {
163 print_version(NULL);
164 exit(0);
167 if (builtin_hdb_flag) {
168 char *list;
169 ret = hdb_list_builtin(context, &list);
170 if (ret)
171 krb5_err(context, 1, ret, "listing builtin hdb backends");
172 printf("builtin hdb backends: %s\n", list);
173 free(list);
174 exit(0);
177 argc -= optidx;
178 argv += optidx;
180 if (argc != 0)
181 usage(1);
184 char **files;
186 if (config_file == NULL) {
187 asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
188 if (config_file == NULL)
189 errx(1, "out of memory");
192 ret = krb5_prepend_config_files_default(config_file, &files);
193 if (ret)
194 krb5_err(context, 1, ret, "getting configuration files");
196 ret = krb5_set_config_files(context, files);
197 krb5_free_config_files(files);
198 if(ret)
199 krb5_err(context, 1, ret, "reading configuration files");
202 ret = krb5_kdc_get_config(context, &config);
203 if (ret)
204 krb5_err(context, 1, ret, "krb5_kdc_default_config");
206 kdc_openlog(context, config);
208 ret = krb5_kdc_set_dbinfo(context, config);
209 if (ret)
210 krb5_err(context, 1, ret, "krb5_kdc_set_dbinfo");
212 if(max_request_str)
213 max_request = parse_bytes(max_request_str, NULL);
215 if(max_request == 0){
216 p = krb5_config_get_string (context,
217 NULL,
218 "kdc",
219 "max-request",
220 NULL);
221 if(p)
222 max_request = parse_bytes(p, NULL);
225 if(require_preauth != -1)
226 config->require_preauth = require_preauth;
228 if(port_str == NULL){
229 p = krb5_config_get_string(context, NULL, "kdc", "ports", NULL);
230 if (p != NULL)
231 port_str = strdup(p);
234 explicit_addresses.len = 0;
236 if (addresses_str.num_strings) {
237 int i;
239 for (i = 0; i < addresses_str.num_strings; ++i)
240 add_one_address (context, addresses_str.strings[i], i == 0);
241 free_getarg_strings (&addresses_str);
242 } else {
243 char **foo = krb5_config_get_strings (context, NULL,
244 "kdc", "addresses", NULL);
246 if (foo != NULL) {
247 add_one_address (context, *foo++, TRUE);
248 while (*foo)
249 add_one_address (context, *foo++, FALSE);
253 if(enable_v4 != -1)
254 config->enable_v4 = enable_v4;
256 if(enable_v4_cross_realm != -1)
257 config->enable_v4_cross_realm = enable_v4_cross_realm;
259 if(enable_524 != -1)
260 config->enable_524 = enable_524;
262 if(enable_http == -1)
263 enable_http = krb5_config_get_bool(context, NULL, "kdc",
264 "enable-http", NULL);
266 if(request_log == NULL)
267 request_log = krb5_config_get_string(context, NULL,
268 "kdc",
269 "kdc-request-log",
270 NULL);
272 if (krb5_config_get_string(context, NULL, "kdc",
273 "enforce-transited-policy", NULL))
274 krb5_errx(context, 1, "enforce-transited-policy deprecated, "
275 "use [kdc]transited-policy instead");
277 if (enable_kaserver != -1)
278 config->enable_kaserver = enable_kaserver;
280 if(detach_from_console == -1)
281 detach_from_console = krb5_config_get_bool_default(context, NULL,
282 DETACH_IS_DEFAULT,
283 "kdc",
284 "detach", NULL);
286 if(max_request == 0)
287 max_request = 64 * 1024;
289 if (port_str == NULL)
290 port_str = "+";
292 if (v4_realm)
293 config->v4_realm = v4_realm;
295 if(config->v4_realm == NULL && (config->enable_kaserver || config->enable_v4))
296 krb5_errx(context, 1, "Kerberos 4 enabled but no realm configured");
298 if(disable_des == -1)
299 disable_des = krb5_config_get_bool_default(context, NULL,
300 FALSE,
301 "kdc",
302 "disable-des", NULL);
303 if(disable_des) {
304 krb5_enctype_disable(context, ETYPE_DES_CBC_CRC);
305 krb5_enctype_disable(context, ETYPE_DES_CBC_MD4);
306 krb5_enctype_disable(context, ETYPE_DES_CBC_MD5);
307 krb5_enctype_disable(context, ETYPE_DES_CBC_NONE);
308 krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE);
309 krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE);
311 kdc_log(context, config,
312 0, "DES was disabled, turned off Kerberos V4, 524 "
313 "and kaserver");
314 config->enable_v4 = 0;
315 config->enable_524 = 0;
316 config->enable_kaserver = 0;
319 krb5_kdc_windc_init(context);
321 return config;