lib/krb5/verify_krb5_conf.c

   1 /*
   2  * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35 #include <getarg.h>
  36 #include <parse_bytes.h>
  37 #include <err.h>
  38 RCSID("$Id$");
  39
  40 /* verify krb5.conf */
  41
  42 static int dumpconfig_flag = 0;
  43 static int version_flag = 0;
  44 static int help_flag    = 0;
  45
  46 static struct getargs args[] = {
  47     {"dumpconfig", 0,      arg_flag,       &dumpconfig_flag,
  48      "show the parsed config files", NULL },
  49     {"version", 0,      arg_flag,       &version_flag,
  50      "print version", NULL },
  51     {"help",    0,      arg_flag,       &help_flag,
  52      NULL, NULL }
  53 };
  54
  55 static void
  56 usage (int ret)
  57 {
  58     arg_printusage (args,
  59                     sizeof(args)/sizeof(*args),
  60                     NULL,
  61                     "[config-file]");
  62     exit (ret);
  63 }
  64
  65 static int
  66 check_bytes(krb5_context context, const char *path, char *data)
  67 {
  68     if(parse_bytes(data, NULL) == -1) {
  69         krb5_warnx(context, "%s: failed to parse \"%s\" as size", path, data);
  70         return 1;
  71     }
  72     return 0;
  73 }
  74
  75 static int
  76 check_time(krb5_context context, const char *path, char *data)
  77 {
  78     if(parse_time(data, NULL) == -1) {
  79         krb5_warnx(context, "%s: failed to parse \"%s\" as time", path, data);
  80         return 1;
  81     }
  82     return 0;
  83 }
  84
  85 static int
  86 check_numeric(krb5_context context, const char *path, char *data)
  87 {
  88     long int v;
  89     char *end;
  90     v = strtol(data, &end, 0);
  91     if(*end != '\0') {
  92         krb5_warnx(context, "%s: failed to parse \"%s\" as a number",
  93                    path, data);
  94         return 1;
  95     }
  96     return 0;
  97 }
  98
  99 static int
 100 check_boolean(krb5_context context, const char *path, char *data)
 101 {
 102     long int v;
 103     char *end;
 104     if(strcasecmp(data, "yes") == 0 ||
 105        strcasecmp(data, "true") == 0 ||
 106        strcasecmp(data, "no") == 0 ||
 107        strcasecmp(data, "false") == 0)
 108         return 0;
 109     v = strtol(data, &end, 0);
 110     if(*end != '\0') {
 111         krb5_warnx(context, "%s: failed to parse \"%s\" as a boolean",
 112                    path, data);
 113         return 1;
 114     }
 115     if(v != 0 && v != 1)
 116         krb5_warnx(context, "%s: numeric value \"%s\" is treated as \"true\"",
 117                    path, data);
 118     return 0;
 119 }
 120
 121 static int
 122 check_524(krb5_context context, const char *path, char *data)
 123 {
 124     if(strcasecmp(data, "yes") == 0 ||
 125        strcasecmp(data, "no") == 0 ||
 126        strcasecmp(data, "2b") == 0 ||
 127        strcasecmp(data, "local") == 0)
 128         return 0;
 129
 130     krb5_warnx(context, "%s: didn't contain a valid option `%s'",
 131                path, data);
 132     return 1;
 133 }
 134
 135 static int
 136 check_host(krb5_context context, const char *path, char *data)
 137 {
 138     int ret;
 139     char hostname[128];
 140     const char *p = data;
 141     struct addrinfo *ai;
 142     /* XXX data could be a list of hosts that this code can't handle */
 143     /* XXX copied from krbhst.c */
 144     if(strncmp(p, "http://", 7) == 0){
 145         p += 7;
 146     } else if(strncmp(p, "http/", 5) == 0) {
 147         p += 5;
 148     }else if(strncmp(p, "tcp/", 4) == 0){
 149         p += 4;
 150     } else if(strncmp(p, "udp/", 4) == 0) {
 151         p += 4;
 152     }
 153     if(strsep_copy(&p, ":", hostname, sizeof(hostname)) < 0) {
 154         return 1;
 155     }
 156     hostname[strcspn(hostname, "/")] = '\0';
 157     ret = getaddrinfo(hostname, "telnet" /* XXX */, NULL, &ai);
 158     if(ret != 0) {
 159         krb5_warnx(context, "%s: %s (%s)", path, gai_strerror(ret), hostname);
 160         return 1;
 161     }
 162     return 0;
 163 }
 164
 165 #if 0
 166 static int
 167 mit_entry(krb5_context context, const char *path, char *data)
 168 {
 169     krb5_warnx(context, "%s is only used by MIT Kerberos", path);
 170     return 0;
 171 }
 172 #endif
 173
 174 struct s2i {
 175     char *s;
 176     int val;
 177 };
 178
 179 #define L(X) { #X, LOG_ ## X }
 180
 181 static struct s2i syslogvals[] = {
 182     /* severity */
 183     L(EMERG),
 184     L(ALERT),
 185     L(CRIT),
 186     L(ERR),
 187     L(WARNING),
 188     L(NOTICE),
 189     L(INFO),
 190     L(DEBUG),
 191     /* facility */
 192     L(AUTH),
 193 #ifdef LOG_AUTHPRIV
 194     L(AUTHPRIV),
 195 #endif
 196 #ifdef LOG_CRON
 197     L(CRON),
 198 #endif
 199     L(DAEMON),
 200 #ifdef LOG_FTP
 201     L(FTP),
 202 #endif
 203     L(KERN),
 204     L(LPR),
 205     L(MAIL),
 206 #ifdef LOG_NEWS
 207     L(NEWS),
 208 #endif
 209     L(SYSLOG),
 210     L(USER),
 211 #ifdef LOG_UUCP
 212     L(UUCP),
 213 #endif
 214     L(LOCAL0),
 215     L(LOCAL1),
 216     L(LOCAL2),
 217     L(LOCAL3),
 218     L(LOCAL4),
 219     L(LOCAL5),
 220     L(LOCAL6),
 221     L(LOCAL7),
 222     { NULL, -1 }
 223 };
 224
 225 static int
 226 find_value(const char *s, struct s2i *table)
 227 {
 228     while(table->s && strcasecmp(table->s, s))
 229         table++;
 230     return table->val;
 231 }
 232
 233 static int
 234 check_log(krb5_context context, const char *path, char *data)
 235 {
 236     /* XXX sync with log.c */
 237     int min = 0, max = -1, n;
 238     char c;
 239     const char *p = data;
 240
 241     n = sscanf(p, "%d%c%d/", &min, &c, &max);
 242     if(n == 2){
 243         if(c == '/') {
 244             if(min < 0){
 245                 max = -min;
 246                 min = 0;
 247             }else{
 248                 max = min;
 249             }
 250         }
 251     }
 252     if(n){
 253         p = strchr(p, '/');
 254         if(p == NULL) {
 255             krb5_warnx(context, "%s: failed to parse \"%s\"", path, data);
 256             return 1;
 257         }
 258         p++;
 259     }
 260     if(strcmp(p, "STDERR") == 0 ||
 261        strcmp(p, "CONSOLE") == 0 ||
 262        (strncmp(p, "FILE", 4) == 0 && (p[4] == ':' || p[4] == '=')) ||
 263        (strncmp(p, "DEVICE", 6) == 0 && p[6] == '='))
 264         return 0;
 265     if(strncmp(p, "SYSLOG", 6) == 0){
 266         int ret = 0;
 267         char severity[128] = "";
 268         char facility[128] = "";
 269         p += 6;
 270         if(*p != '\0')
 271             p++;
 272         if(strsep_copy(&p, ":", severity, sizeof(severity)) != -1)
 273             strsep_copy(&p, ":", facility, sizeof(facility));
 274         if(*severity == '\0')
 275             strlcpy(severity, "ERR", sizeof(severity));
 276         if(*facility == '\0')
 277             strlcpy(facility, "AUTH", sizeof(facility));
 278         if(find_value(severity, syslogvals) == -1) {
 279             krb5_warnx(context, "%s: unknown syslog facility \"%s\"",
 280                        path, facility);
 281             ret++;
 282         }
 283         if(find_value(severity, syslogvals) == -1) {
 284             krb5_warnx(context, "%s: unknown syslog severity \"%s\"",
 285                        path, severity);
 286             ret++;
 287         }
 288         return ret;
 289     }else{
 290         krb5_warnx(context, "%s: unknown log type: \"%s\"", path, data);
 291         return 1;
 292     }
 293 }
 294
 295 typedef int (*check_func_t)(krb5_context, const char*, char*);
 296 struct entry {
 297     const char *name;
 298     int type;
 299     void *check_data;
 300 };
 301
 302 struct entry all_strings[] = {
 303     { "", krb5_config_string, NULL },
 304     { NULL }
 305 };
 306
 307 struct entry v4_name_convert_entries[] = {
 308     { "host", krb5_config_list, all_strings },
 309     { "plain", krb5_config_list, all_strings },
 310     { NULL }
 311 };
 312
 313 struct entry libdefaults_entries[] = {
 314     { "accept_null_addresses", krb5_config_string, check_boolean },
 315     { "capath", krb5_config_list, all_strings },
 316     { "clockskew", krb5_config_string, check_time },
 317     { "date_format", krb5_config_string, NULL },
 318     { "default_etypes", krb5_config_string, NULL },
 319     { "default_etypes_des", krb5_config_string, NULL },
 320     { "default_keytab_modify_name", krb5_config_string, NULL },
 321     { "default_keytab_name", krb5_config_string, NULL },
 322     { "default_realm", krb5_config_string, NULL },
 323     { "dns_proxy", krb5_config_string, NULL },
 324     { "dns_lookup_kdc", krb5_config_string, check_boolean },
 325     { "dns_lookup_realm", krb5_config_string, check_boolean },
 326     { "dns_lookup_realm_labels", krb5_config_string, NULL },
 327     { "egd_socket", krb5_config_string, NULL },
 328     { "encrypt", krb5_config_string, check_boolean },
 329     { "extra_addresses", krb5_config_string, NULL },
 330     { "fcache_version", krb5_config_string, check_numeric },
 331     { "forward", krb5_config_string, check_boolean },
 332     { "forwardable", krb5_config_string, check_boolean },
 333     { "http_proxy", krb5_config_string, check_host /* XXX */ },
 334     { "ignore_addresses", krb5_config_string, NULL },
 335     { "kdc_timeout", krb5_config_string, check_time },
 336     { "kdc_timesync", krb5_config_string, check_boolean },
 337     { "log_utc", krb5_config_string, check_boolean },
 338     { "maxretries", krb5_config_string, check_numeric },
 339     { "scan_interfaces", krb5_config_string, check_boolean },
 340     { "srv_lookup", krb5_config_string, check_boolean },
 341     { "srv_try_txt", krb5_config_string, check_boolean },
 342     { "ticket_lifetime", krb5_config_string, check_time },
 343     { "time_format", krb5_config_string, NULL },
 344     { "transited_realms_reject", krb5_config_string, NULL },
 345     { "v4_instance_resolve", krb5_config_string, check_boolean },
 346     { "v4_name_convert", krb5_config_list, v4_name_convert_entries },
 347     { "verify_ap_req_nofail", krb5_config_string, check_boolean },
 348     { NULL }
 349 };
 350
 351 struct entry appdefaults_entries[] = {
 352     { "afslog", krb5_config_string, check_boolean },
 353     { "afs-use-524", krb5_config_string, check_524 },
 354     { "forwardable", krb5_config_string, check_boolean },
 355     { "proxiable", krb5_config_string, check_boolean },
 356     { "ticket_lifetime", krb5_config_string, check_time },
 357     { "renew_lifetime", krb5_config_string, check_time },
 358     { "no-addresses", krb5_config_string, check_boolean },
 359     { "krb4_get_tickets", krb5_config_string, check_boolean },
 360 #if 0
 361     { "anonymous", krb5_config_string, check_boolean },
 362 #endif
 363     { "", krb5_config_list, appdefaults_entries },
 364     { NULL }
 365 };
 366
 367 struct entry realms_entries[] = {
 368     { "forwardable", krb5_config_string, check_boolean },
 369     { "proxiable", krb5_config_string, check_boolean },
 370     { "ticket_lifetime", krb5_config_string, check_time },
 371     { "renew_lifetime", krb5_config_string, check_time },
 372     { "warn_pwexpire", krb5_config_string, check_time },
 373     { "kdc", krb5_config_string, check_host },
 374     { "admin_server", krb5_config_string, check_host },
 375     { "kpasswd_server", krb5_config_string, check_host },
 376     { "krb524_server", krb5_config_string, check_host },
 377     { "v4_name_convert", krb5_config_list, v4_name_convert_entries },
 378     { "v4_instance_convert", krb5_config_list, all_strings },
 379     { "v4_domains", krb5_config_string, NULL },
 380     { "default_domain", krb5_config_string, NULL },
 381 #if 0
 382     /* MIT stuff */
 383     { "admin_keytab", krb5_config_string, mit_entry },
 384     { "acl_file", krb5_config_string, mit_entry },
 385     { "dict_file", krb5_config_string, mit_entry },
 386     { "kadmind_port", krb5_config_string, mit_entry },
 387     { "kpasswd_port", krb5_config_string, mit_entry },
 388     { "master_key_name", krb5_config_string, mit_entry },
 389     { "master_key_type", krb5_config_string, mit_entry },
 390     { "key_stash_file", krb5_config_string, mit_entry },
 391     { "max_life", krb5_config_string, mit_entry },
 392     { "max_renewable_life", krb5_config_string, mit_entry },
 393     { "default_principal_expiration", krb5_config_string, mit_entry },
 394     { "default_principal_flags", krb5_config_string, mit_entry },
 395     { "supported_enctypes", krb5_config_string, mit_entry },
 396     { "database_name", krb5_config_string, mit_entry },
 397 #endif
 398     { NULL }
 399 };
 400
 401 struct entry realms_foobar[] = {
 402     { "", krb5_config_list, realms_entries },
 403     { NULL }
 404 };
 405
 406
 407 struct entry kdc_database_entries[] = {
 408     { "realm", krb5_config_string, NULL },
 409     { "dbname", krb5_config_string, NULL },
 410     { "mkey_file", krb5_config_string, NULL },
 411     { NULL }
 412 };
 413
 414 struct entry kdc_entries[] = {
 415     { "database", krb5_config_list, kdc_database_entries },
 416     { "key-file", krb5_config_string, NULL },
 417     { "logging", krb5_config_string, check_log },
 418     { "max-request", krb5_config_string, check_bytes },
 419     { "require-preauth", krb5_config_string, check_boolean },
 420     { "ports", krb5_config_string, NULL },
 421     { "addresses", krb5_config_string, NULL },
 422     { "enable-kerberos4", krb5_config_string, check_boolean },
 423     { "enable-524", krb5_config_string, check_boolean },
 424     { "enable-http", krb5_config_string, check_boolean },
 425     { "check_ticket-addresses", krb5_config_string, check_boolean },
 426     { "allow-null-addresses", krb5_config_string, check_boolean },
 427     { "allow-anonymous", krb5_config_string, check_boolean },
 428     { "v4_realm", krb5_config_string, NULL },
 429     { "enable-kaserver", krb5_config_string, check_boolean },
 430     { "encode_as_rep_as_tgs_rep", krb5_config_string, check_boolean },
 431     { "kdc_warn_pwexpire", krb5_config_string, check_time },
 432     { NULL }
 433 };
 434
 435 struct entry kadmin_entries[] = {
 436     { "password_lifetime", krb5_config_string, check_time },
 437     { "default_keys", krb5_config_string, NULL },
 438     { "use_v4_salt", krb5_config_string, NULL },
 439     { NULL }
 440 };
 441 struct entry log_strings[] = {
 442     { "", krb5_config_string, check_log },
 443     { NULL }
 444 };
 445
 446
 447 #if 0
 448 struct entry kdcdefaults_entries[] = {
 449     { "kdc_ports", krb5_config_string, mit_entry },
 450     { "v4_mode", krb5_config_string, mit_entry },
 451     { NULL }
 452 };
 453 #endif
 454
 455 struct entry toplevel_sections[] = {
 456     { "libdefaults" , krb5_config_list, libdefaults_entries },
 457     { "realms", krb5_config_list, realms_foobar },
 458     { "domain_realm", krb5_config_list, all_strings },
 459     { "logging", krb5_config_list, log_strings },
 460     { "kdc", krb5_config_list, kdc_entries },
 461     { "kadmin", krb5_config_list, kadmin_entries },
 462     { "appdefaults", krb5_config_list, appdefaults_entries },
 463 #if 0
 464     /* MIT stuff */
 465     { "kdcdefaults", krb5_config_list, kdcdefaults_entries },
 466 #endif
 467     { NULL }
 468 };
 469
 470
 471 static int
 472 check_section(krb5_context context, const char *path, krb5_config_section *cf,
 473               struct entry *entries)
 474 {
 475     int error = 0;
 476     krb5_config_section *p;
 477     struct entry *e;
 478
 479     char *local;
 480
 481     for(p = cf; p != NULL; p = p->next) {
 482         asprintf(&local, "%s/%s", path, p->name);
 483         for(e = entries; e->name != NULL; e++) {
 484             if(*e->name == '\0' || strcmp(e->name, p->name) == 0) {
 485                 if(e->type != p->type) {
 486                     krb5_warnx(context, "%s: unknown or wrong type", local);
 487                     error |= 1;
 488                 } else if(p->type == krb5_config_string && e->check_data != NULL) {
 489                     error |= (*(check_func_t)e->check_data)(context, local, p->u.string);
 490                 } else if(p->type == krb5_config_list && e->check_data != NULL) {
 491                     error |= check_section(context, local, p->u.list, e->check_data);
 492                 }
 493                 break;
 494             }
 495         }
 496         if(e->name == NULL) {
 497             krb5_warnx(context, "%s: unknown entry", local);
 498             error |= 1;
 499         }
 500         free(local);
 501     }
 502     return error;
 503 }
 504
 505
 506 static void
 507 dumpconfig(int level, krb5_config_section *top)
 508 {
 509     krb5_config_section *x;
 510     for(x = top; x; x = x->next) {
 511         switch(x->type) {
 512         case krb5_config_list:
 513             if(level == 0) {
 514                 printf("[%s]\n", x->name);
 515             } else {
 516                 printf("%*s%s = {\n", 4 * level, " ", x->name);
 517             }
 518             dumpconfig(level + 1, x->u.list);
 519             if(level > 0)
 520                 printf("%*s}\n", 4 * level, " ");
 521             break;
 522         case krb5_config_string:
 523             printf("%*s%s = %s\n", 4 * level, " ", x->name, x->u.string);
 524             break;
 525         }
 526     }
 527 }
 528
 529 int
 530 main(int argc, char **argv)
 531 {
 532     krb5_context context;
 533     krb5_error_code ret;
 534     krb5_config_section *tmp_cf;
 535     int optind = 0;
 536
 537     setprogname (argv[0]);
 538
 539     ret = krb5_init_context(&context);
 540     if (ret)
 541         errx (1, "krb5_init_context failed");
 542
 543     if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind))
 544         usage(1);
 545
 546     if (help_flag)
 547         usage (0);
 548
 549     if(version_flag){
 550         print_version(NULL);
 551         exit(0);
 552     }
 553
 554     argc -= optind;
 555     argv += optind;
 556
 557     tmp_cf = NULL;
 558     if(argc == 0)
 559         krb5_get_default_config_files(&argv);
 560
 561     while(*argv) {
 562         ret = krb5_config_parse_file_multi(context, *argv, &tmp_cf);
 563         if (ret != 0)
 564             krb5_warn (context, ret, "krb5_config_parse_file");
 565         argv++;
 566     }
 567
 568     if(dumpconfig_flag)
 569         dumpconfig(0, tmp_cf);
 570
 571     return check_section(context, "", tmp_cf, toplevel_sections);
 572 }