kpasswd/kpasswdd.c

   1 /*
   2  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kpasswd_locl.h"
  35 RCSID("$Id$");
  36
  37 #include <kadm5/admin.h>
  38 #ifdef HAVE_SYS_UN_H
  39 #include <sys/un.h>
  40 #endif
  41 #include <hdb.h>
  42 #include <kadm5/private.h>
  43 #include <kadm5/kadm5_err.h>
  44
  45 static krb5_context context;
  46 static krb5_log_facility *log_facility;
  47
  48 static struct getarg_strings addresses_str;
  49 krb5_addresses explicit_addresses;
  50
  51 static sig_atomic_t exit_flag = 0;
  52
  53 static void
  54 add_one_address (const char *str, int first)
  55 {
  56     krb5_error_code ret;
  57     krb5_addresses tmp;
  58
  59     ret = krb5_parse_address (context, str, &tmp);
  60     if (ret)
  61         krb5_err (context, 1, ret, "parse_address `%s'", str);
  62     if (first)
  63         krb5_copy_addresses(context, &tmp, &explicit_addresses);
  64     else
  65         krb5_append_addresses(context, &explicit_addresses, &tmp);
  66     krb5_free_addresses (context, &tmp);
  67 }
  68
  69 static void
  70 send_reply (int s,
  71             struct sockaddr *sa,
  72             int sa_size,
  73             krb5_data *ap_rep,
  74             krb5_data *rest)
  75 {
  76     struct msghdr msghdr;
  77     struct iovec iov[3];
  78     uint16_t len, ap_rep_len;
  79     u_char header[6];
  80     u_char *p;
  81
  82     if (ap_rep)
  83         ap_rep_len = ap_rep->length;
  84     else
  85         ap_rep_len = 0;
  86
  87     len = 6 + ap_rep_len + rest->length;
  88     p = header;
  89     *p++ = (len >> 8) & 0xFF;
  90     *p++ = (len >> 0) & 0xFF;
  91     *p++ = 0;
  92     *p++ = 1;
  93     *p++ = (ap_rep_len >> 8) & 0xFF;
  94     *p++ = (ap_rep_len >> 0) & 0xFF;
  95
  96     memset (&msghdr, 0, sizeof(msghdr));
  97     msghdr.msg_name       = (void *)sa;
  98     msghdr.msg_namelen    = sa_size;
  99     msghdr.msg_iov        = iov;
 100     msghdr.msg_iovlen     = sizeof(iov)/sizeof(*iov);
 101 #if 0
 102     msghdr.msg_control    = NULL;
 103     msghdr.msg_controllen = 0;
 104 #endif
 105
 106     iov[0].iov_base       = (char *)header;
 107     iov[0].iov_len        = 6;
 108     if (ap_rep_len) {
 109         iov[1].iov_base   = ap_rep->data;
 110         iov[1].iov_len    = ap_rep->length;
 111     } else {
 112         iov[1].iov_base   = NULL;
 113         iov[1].iov_len    = 0;
 114     }
 115     iov[2].iov_base       = rest->data;
 116     iov[2].iov_len        = rest->length;
 117
 118     if (sendmsg (s, &msghdr, 0) < 0)
 119         krb5_warn (context, errno, "sendmsg");
 120 }
 121
 122 static int
 123 make_result (krb5_data *data,
 124              uint16_t result_code,
 125              const char *expl)
 126 {
 127     krb5_error_code ret;
 128     krb5_storage *sp;
 129
 130     sp = krb5_storage_emem();
 131     if (sp == NULL) goto out;
 132     ret = krb5_store_uint16(sp, result_code);
 133     if (ret) goto out;
 134     ret = krb5_store_stringz(sp, expl);
 135     if (ret) goto out;
 136     ret = krb5_storage_to_data(sp, data);
 137     if (ret) goto out;
 138     krb5_storage_free(sp);
 139
 140     return 0;
 141  out:
 142     if (sp)
 143         krb5_storage_free(sp);
 144
 145     krb5_warnx (context, "Out of memory generating error reply");
 146     return 1;
 147 }
 148
 149 static void
 150 reply_error (krb5_realm realm,
 151              int s,
 152              struct sockaddr *sa,
 153              int sa_size,
 154              krb5_error_code error_code,
 155              uint16_t result_code,
 156              const char *expl)
 157 {
 158     krb5_error_code ret;
 159     krb5_data error_data;
 160     krb5_data e_data;
 161     krb5_principal server = NULL;
 162
 163     if (make_result(&e_data, result_code, expl))
 164         return;
 165
 166     if (realm) {
 167         ret = krb5_make_principal (context, &server, realm,
 168                                    "kadmin", "changepw", NULL);
 169         if (ret) {
 170             krb5_data_free (&e_data);
 171             return;
 172         }
 173     }
 174
 175     ret = krb5_mk_error (context,
 176                          error_code,
 177                          NULL,
 178                          &e_data,
 179                          NULL,
 180                          server,
 181                          NULL,
 182                          NULL,
 183                          &error_data);
 184     if (server)
 185         krb5_free_principal(context, server);
 186     krb5_data_free (&e_data);
 187     if (ret) {
 188         krb5_warn (context, ret, "Could not even generate error reply");
 189         return;
 190     }
 191     send_reply (s, sa, sa_size, NULL, &error_data);
 192     krb5_data_free (&error_data);
 193 }
 194
 195 static void
 196 reply_priv (krb5_auth_context auth_context,
 197             int s,
 198             struct sockaddr *sa,
 199             int sa_size,
 200             uint16_t result_code,
 201             const char *expl)
 202 {
 203     krb5_error_code ret;
 204     krb5_data krb_priv_data;
 205     krb5_data ap_rep_data;
 206     krb5_data e_data;
 207
 208     ret = krb5_mk_rep (context,
 209                        auth_context,
 210                        &ap_rep_data);
 211     if (ret) {
 212         krb5_warn (context, ret, "Could not even generate error reply");
 213         return;
 214     }
 215
 216     if (make_result(&e_data, result_code, expl))
 217         return;
 218
 219     ret = krb5_mk_priv (context,
 220                         auth_context,
 221                         &e_data,
 222                         &krb_priv_data,
 223                         NULL);
 224     krb5_data_free (&e_data);
 225     if (ret) {
 226         krb5_warn (context, ret, "Could not even generate error reply");
 227         return;
 228     }
 229     send_reply (s, sa, sa_size, &ap_rep_data, &krb_priv_data);
 230     krb5_data_free (&ap_rep_data);
 231     krb5_data_free (&krb_priv_data);
 232 }
 233
 234 /*
 235  * Change the password for `principal', sending the reply back on `s'
 236  * (`sa', `sa_size') to `pwd_data'.
 237  */
 238
 239 static void
 240 change (krb5_auth_context auth_context,
 241         krb5_principal admin_principal,
 242         uint16_t version,
 243         int s,
 244         struct sockaddr *sa,
 245         int sa_size,
 246         krb5_data *in_data)
 247 {
 248     krb5_error_code ret;
 249     char *client = NULL, *admin = NULL;
 250     kadm5_config_params conf;
 251     void *kadm5_handle = NULL;
 252     krb5_principal principal = NULL;
 253     krb5_data *pwd_data = NULL;
 254     char *tmp;
 255     ChangePasswdDataMS chpw;
 256
 257     memset (&conf, 0, sizeof(conf));
 258     memset(&chpw, 0, sizeof(chpw));
 259
 260     if (version == KRB5_KPASSWD_VERS_CHANGEPW) {
 261         ret = krb5_copy_data(context, in_data, &pwd_data);
 262         if (ret) {
 263             krb5_warn (context, ret, "krb5_copy_data");
 264             reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
 265                         "out out memory copying password");
 266             return;
 267         }
 268         principal = admin_principal;
 269     } else if (version == KRB5_KPASSWD_VERS_SETPW) {
 270         size_t len;
 271
 272         ret = decode_ChangePasswdDataMS(in_data->data, in_data->length,
 273                                         &chpw, &len);
 274         if (ret) {
 275             krb5_warn (context, ret, "decode_ChangePasswdDataMS");
 276             reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
 277                         "malformed ChangePasswdData");
 278             return;
 279         }
 280
 281
 282         ret = krb5_copy_data(context, &chpw.newpasswd, &pwd_data);
 283         if (ret) {
 284             krb5_warn (context, ret, "krb5_copy_data");
 285             reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
 286                         "out out memory copying password");
 287             goto out;
 288         }
 289
 290         if (chpw.targname == NULL && chpw.targrealm != NULL) {
 291             krb5_warn (context, ret, "kadm5_init_with_password_ctx");
 292             reply_priv (auth_context, s, sa, sa_size,
 293                         KRB5_KPASSWD_MALFORMED,
 294                         "targrealm but not targname");
 295             goto out;
 296         }
 297
 298         if (chpw.targname) {
 299             krb5_principal_data princ;
 300
 301             memset(&princ, 0, sizeof (princ));
 302             princ.name = *chpw.targname;
 303             princ.realm = *chpw.targrealm;
 304             if (princ.realm == NULL) {
 305                 ret = krb5_get_default_realm(context, &princ.realm);
 306
 307                 if (ret) {
 308                     krb5_warnx (context,
 309                                 "kadm5_init_with_password_ctx: "
 310                                 "failed to allocate realm");
 311                     reply_priv (auth_context, s, sa, sa_size,
 312                                 KRB5_KPASSWD_SOFTERROR,
 313                                 "failed to allocate realm");
 314                     goto out;
 315                 }
 316             }
 317             ret = krb5_copy_principal(context, &princ, &principal);
 318             if (*chpw.targrealm == NULL)
 319                 free(princ.realm);
 320             if (ret) {
 321                 krb5_warn(context, ret, "krb5_copy_principal");
 322                 reply_priv(auth_context, s, sa, sa_size,
 323                            KRB5_KPASSWD_HARDERROR,
 324                            "failed to allocate principal");
 325                 goto out;
 326             }
 327         } else
 328             principal = admin_principal;
 329     } else {
 330         krb5_warnx (context, "kadm5_init_with_password_ctx: unknown proto");
 331         reply_priv (auth_context, s, sa, sa_size,
 332                     KRB5_KPASSWD_HARDERROR,
 333                     "Unknown protocol used");
 334         return;
 335     }
 336
 337     ret = krb5_unparse_name (context, admin_principal, &admin);
 338     if (ret) {
 339         krb5_warn (context, ret, "unparse_name failed");
 340         reply_priv (auth_context, s, sa, sa_size,
 341                     KRB5_KPASSWD_HARDERROR, "out of memory error");
 342         goto out;
 343     }
 344
 345     conf.realm = principal->realm;
 346     conf.mask |= KADM5_CONFIG_REALM;
 347
 348     ret = kadm5_init_with_password_ctx(context,
 349                                        admin,
 350                                        NULL,
 351                                        KADM5_ADMIN_SERVICE,
 352                                        &conf, 0, 0,
 353                                        &kadm5_handle);
 354     if (ret) {
 355         krb5_warn (context, ret, "kadm5_init_with_password_ctx");
 356         reply_priv (auth_context, s, sa, sa_size, 2,
 357                     "Internal error");
 358         goto out;
 359     }
 360
 361     ret = krb5_unparse_name(context, principal, &client);
 362     if (ret) {
 363         krb5_warn (context, ret, "unparse_name failed");
 364         reply_priv (auth_context, s, sa, sa_size,
 365                     KRB5_KPASSWD_HARDERROR, "out of memory error");
 366         goto out;
 367     }
 368
 369     if (krb5_principal_compare(context, admin_principal, principal) == FALSE) {
 370         ret = _kadm5_acl_check_permission(kadm5_handle, KADM5_PRIV_CPW,
 371                                           principal);
 372         if (ret) {
 373             krb5_warn (context, ret,
 374                        "Check ACL failed for %s for changing %s password",
 375                        admin, client);
 376             reply_priv (auth_context, s, sa, sa_size,
 377                         KRB5_KPASSWD_HARDERROR, "permission denied");
 378             goto out;
 379         }
 380         krb5_warnx (context, "%s is changing password for %s", admin, client);
 381     } else {
 382         krb5_warnx (context, "Changing password for %s", client);
 383     }
 384
 385     ret = krb5_data_realloc(pwd_data, pwd_data->length + 1);
 386     if (ret) {
 387         krb5_warn (context, ret, "malloc: out of memory");
 388         reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_HARDERROR,
 389                     "Internal error");
 390         goto out;
 391     }
 392     tmp = pwd_data->data;
 393     tmp[pwd_data->length - 1] = '\0';
 394
 395     ret = kadm5_s_chpass_principal_cond (kadm5_handle, principal, 1, tmp);
 396     krb5_free_data (context, pwd_data);
 397     pwd_data = NULL;
 398     if (ret) {
 399         const char *str = krb5_get_error_message(context, ret);
 400
 401         switch (ret) {
 402         case KADM5_PASS_Q_TOOSHORT:
 403         case KADM5_PASS_Q_CLASS:
 404         case KADM5_PASS_Q_DICT:
 405         case KADM5_PASS_Q_GENERIC:
 406             krb5_warnx(context,
 407                        "%s didn't pass password quality check with error: %s",
 408                        client, str);
 409             break;
 410         default:
 411             krb5_warnx(context, "kadm5_s_chpass_principal_cond: %s", str);
 412         }
 413         reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SOFTERROR,
 414                     str ? str : "Internal error");
 415         krb5_free_error_message(context, str);
 416         goto out;
 417     }
 418     reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SUCCESS,
 419                 "Password changed");
 420 out:
 421     free_ChangePasswdDataMS(&chpw);
 422     if (principal != admin_principal)
 423         krb5_free_principal(context, principal);
 424     if (admin)
 425         free(admin);
 426     if (client)
 427         free(client);
 428     if (pwd_data)
 429         krb5_free_data(context, pwd_data);
 430     if (kadm5_handle)
 431         kadm5_destroy (kadm5_handle);
 432 }
 433
 434 static int
 435 verify (krb5_auth_context *auth_context,
 436         krb5_keytab keytab,
 437         krb5_ticket **ticket,
 438         krb5_data *out_data,
 439         uint16_t *version,
 440         int s,
 441         struct sockaddr *sa,
 442         int sa_size,
 443         u_char *msg,
 444         size_t len,
 445         krb5_address *client_addr)
 446 {
 447     krb5_error_code ret;
 448     uint16_t pkt_len, pkt_ver, ap_req_len;
 449     krb5_data ap_req_data;
 450     krb5_data krb_priv_data;
 451     krb5_const_realm client_realm;
 452     krb5_principal sprinc;
 453     int same;
 454
 455     /*
 456      * Only send an error reply if the request passes basic length
 457      * verification.  Otherwise, kpasswdd would reply to every UDP packet,
 458      * allowing an attacker to set up a ping-pong DoS attack via a spoofed UDP
 459      * packet with a source address of another UDP service that also replies
 460      * to every packet.
 461      *
 462      * Also suppress the error reply if ap_req_len is 0, which indicates
 463      * either an invalid request or an error packet.  An error packet may be
 464      * the result of a ping-pong attacker pointing us at another kpasswdd.
 465      */
 466     if (len < 6) {
 467         krb5_warnx(context, "Message too short: %llu",
 468             (unsigned long long)len);
 469         return 1;
 470     }
 471     pkt_len = (msg[0] << 8) | (msg[1]);
 472     pkt_ver = (msg[2] << 8) | (msg[3]);
 473     ap_req_len = (msg[4] << 8) | (msg[5]);
 474     if (pkt_len != len) {
 475         krb5_warnx(context, "Bad packet length: %u != %llu", pkt_len,
 476             (unsigned long long)len);
 477         return 1;
 478     }
 479     if (ap_req_len == 0) {
 480         krb5_warnx (context, "Request is error packet (ap_req_len == 0)");
 481         return 1;
 482     }
 483     if (ap_req_len + 6 > len) {
 484         krb5_warnx(context, "Bad AP-REQ length: %u", ap_req_len);
 485         return 1;
 486     }
 487     if (pkt_ver != KRB5_KPASSWD_VERS_CHANGEPW &&
 488         pkt_ver != KRB5_KPASSWD_VERS_SETPW) {
 489         krb5_warnx (context, "Bad version (%d)", pkt_ver);
 490         reply_error (NULL, s, sa, sa_size, 0, 1, "Wrong program version");
 491         return 1;
 492     }
 493     *version = pkt_ver;
 494
 495     ap_req_data.data   = msg + 6;
 496     ap_req_data.length = ap_req_len;
 497
 498     ret = krb5_rd_req (context,
 499                        auth_context,
 500                        &ap_req_data,
 501                        NULL,
 502                        keytab,
 503                        NULL,
 504                        ticket);
 505     if (ret) {
 506         krb5_warn (context, ret, "krb5_rd_req");
 507         reply_error (NULL, s, sa, sa_size, ret, 3, "Authentication failed");
 508         return 1;
 509     }
 510
 511     if (!(*ticket)->ticket.flags.initial) {
 512         krb5_warnx(context, "initial flag not set");
 513         reply_error((*ticket)->server->realm, s, sa, sa_size, ret, 1,
 514                     "Bad request");
 515         goto out;
 516     }
 517
 518     /*
 519      * The service principal must be kadmin/changepw@CLIENT-REALM, there
 520      * is no reason to require the KDC's default realm(s) to be the same
 521      * as the realm(s) it serves. The only potential issue is when a KDC
 522      * is a master for realm A and a slave for realm B, in which case it
 523      * should not accept requests to change passwords for realm B, these
 524      * should be sent to realm B's master. This same issue is present in
 525      * the checks that only accepted local realms, there is no new risk.
 526      */
 527
 528     client_realm = krb5_principal_get_realm(context, (*ticket)->client);
 529     ret = krb5_make_principal(context, &sprinc, client_realm,
 530                               "kadmin", "changepw", NULL);
 531     if (ret)
 532         goto out;
 533     same = krb5_principal_compare(context, sprinc, (*ticket)->server);
 534     krb5_free_principal(context, sprinc);
 535
 536     if (!same) {
 537         char *sname;
 538
 539         if (krb5_unparse_name(context, (*ticket)->server, &sname) != 0)
 540             sname = NULL;
 541         krb5_warnx(context, "Invalid kpasswd service principal %s",
 542                    sname ? sname : "<enomem>");
 543         free(sname);
 544         reply_error(NULL, s, sa, sa_size, ret, 1, "Bad request");
 545         goto out;
 546     }
 547     krb_priv_data.data   = msg + 6 + ap_req_len;
 548     krb_priv_data.length = len - 6 - ap_req_len;
 549
 550     /*
 551      * Only enforce client addresses on on tickets with addresses.  If
 552      * its addressless, we are guessing its behind NAT and really
 553      * can't know this information.
 554      */
 555
 556     if ((*ticket)->ticket.caddr && (*ticket)->ticket.caddr->len > 0) {
 557         ret = krb5_auth_con_setaddrs (context, *auth_context,
 558                                       NULL, client_addr);
 559         if (ret) {
 560             krb5_warn (context, ret, "krb5_auth_con_setaddr(this)");
 561             goto out;
 562         }
 563     }
 564
 565     ret = krb5_rd_priv (context,
 566                         *auth_context,
 567                         &krb_priv_data,
 568                         out_data,
 569                         NULL);
 570
 571     if (ret) {
 572         krb5_warn (context, ret, "krb5_rd_priv");
 573         reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 3,
 574                      "Bad request");
 575         goto out;
 576     }
 577     return 0;
 578 out:
 579     krb5_free_ticket (context, *ticket);
 580     ticket = NULL;
 581     return 1;
 582 }
 583
 584 static void
 585 process (krb5_keytab keytab,
 586          int s,
 587          krb5_address *this_addr,
 588          struct sockaddr *sa,
 589          int sa_size,
 590          u_char *msg,
 591          int len)
 592 {
 593     krb5_error_code ret;
 594     krb5_auth_context auth_context = NULL;
 595     krb5_data out_data;
 596     krb5_ticket *ticket;
 597     krb5_address other_addr;
 598     uint16_t version;
 599
 600     memset(&other_addr, 0, sizeof(other_addr));
 601     krb5_data_zero (&out_data);
 602
 603     ret = krb5_auth_con_init (context, &auth_context);
 604     if (ret) {
 605         krb5_warn (context, ret, "krb5_auth_con_init");
 606         return;
 607     }
 608
 609     krb5_auth_con_setflags (context, auth_context,
 610                             KRB5_AUTH_CONTEXT_DO_SEQUENCE);
 611
 612     ret = krb5_sockaddr2address (context, sa, &other_addr);
 613     if (ret) {
 614         krb5_warn (context, ret, "krb5_sockaddr2address");
 615         goto out;
 616     }
 617
 618     ret = krb5_auth_con_setaddrs (context, auth_context, this_addr, NULL);
 619     if (ret) {
 620         krb5_warn (context, ret, "krb5_auth_con_setaddr(this)");
 621         goto out;
 622     }
 623
 624     if (verify (&auth_context, keytab, &ticket, &out_data,
 625                 &version, s, sa, sa_size, msg, len, &other_addr) == 0)
 626     {
 627         /*
 628          * We always set the client_addr, to assume that the client
 629          * can ignore it if it choose to do so (just the server does
 630          * so for addressless tickets).
 631          */
 632         ret = krb5_auth_con_setaddrs (context, auth_context,
 633                                       this_addr, &other_addr);
 634         if (ret) {
 635             krb5_warn (context, ret, "krb5_auth_con_setaddr(other)");
 636             goto out;
 637         }
 638
 639         change (auth_context,
 640                 ticket->client,
 641                 version,
 642                 s,
 643                 sa, sa_size,
 644                 &out_data);
 645         memset (out_data.data, 0, out_data.length);
 646         krb5_free_ticket (context, ticket);
 647     }
 648
 649 out:
 650     krb5_free_address(context, &other_addr);
 651     krb5_data_free(&out_data);
 652     krb5_auth_con_free(context, auth_context);
 653 }
 654
 655 static const char *check_library  = NULL;
 656 static const char *check_function = NULL;
 657 static getarg_strings policy_libraries = { 0, NULL };
 658 static char sHDB[] = "HDBGET:";
 659 static char *keytab_str = sHDB;
 660 static char *realm_str;
 661 static int version_flag;
 662 static int help_flag;
 663 static int detach_from_console;
 664 static int daemon_child = -1;
 665 static char *port_str;
 666 static char *config_file;
 667
 668 struct getargs args[] = {
 669 #ifdef HAVE_DLOPEN
 670     { "check-library", 0, arg_string, &check_library,
 671       "library to load password check function from", "library" },
 672     { "check-function", 0, arg_string, &check_function,
 673       "password check function to load", "function" },
 674     { "policy-libraries", 0, arg_strings, &policy_libraries,
 675       "password check function to load", "function" },
 676 #endif
 677     { "addresses", 0, arg_strings, &addresses_str,
 678       "addresses to listen on", "list of addresses" },
 679     { "detach", 0, arg_flag, &detach_from_console,
 680       "detach from console", NULL },
 681     { "daemon-child",       0 ,      arg_integer, &daemon_child,
 682       "private argument, do not use", NULL },
 683     { "keytab", 'k', arg_string, &keytab_str,
 684       "keytab to get authentication key from", "kspec" },
 685     { "config-file", 'c', arg_string, &config_file, NULL, NULL },
 686     { "realm", 'r', arg_string, &realm_str, "default realm", "realm" },
 687     { "port",  'p', arg_string, &port_str, "port", NULL },
 688     { "version", 0, arg_flag, &version_flag, NULL, NULL },
 689     { "help", 0, arg_flag, &help_flag, NULL, NULL }
 690 };
 691 int num_args = sizeof(args) / sizeof(args[0]);
 692
 693 static int
 694 doit(krb5_keytab keytab, int port)
 695 {
 696     krb5_error_code ret;
 697     int *sockets;
 698     int maxfd;
 699     krb5_addresses addrs;
 700     unsigned n, i;
 701     fd_set real_fdset;
 702     struct sockaddr_storage __ss;
 703     struct sockaddr *sa = (struct sockaddr *)&__ss;
 704
 705     if (explicit_addresses.len) {
 706         addrs = explicit_addresses;
 707     } else {
 708         ret = krb5_get_all_server_addrs(context, &addrs);
 709         if (ret)
 710             krb5_err(context, 1, ret, "krb5_get_all_server_addrs");
 711     }
 712     n = addrs.len;
 713
 714     sockets = malloc(n * sizeof(*sockets));
 715     if (sockets == NULL)
 716         krb5_errx(context, 1, "out of memory");
 717     maxfd = -1;
 718     FD_ZERO(&real_fdset);
 719     for (i = 0; i < n; ++i) {
 720         krb5_socklen_t sa_size = sizeof(__ss);
 721
 722         krb5_addr2sockaddr(context, &addrs.val[i], sa, &sa_size, port);
 723
 724         sockets[i] = socket(__ss.ss_family, SOCK_DGRAM, 0);
 725         if (sockets[i] < 0)
 726             krb5_err(context, 1, errno, "socket");
 727         if (bind(sockets[i], sa, sa_size) < 0) {
 728             char str[128];
 729             size_t len;
 730             int save_errno = errno;
 731
 732             ret = krb5_print_address(&addrs.val[i], str, sizeof(str), &len);
 733             if (ret)
 734                 strlcpy(str, "unknown address", sizeof(str));
 735             krb5_warn(context, save_errno, "bind(%s)", str);
 736             continue;
 737         }
 738         maxfd = max(maxfd, sockets[i]);
 739         if (maxfd >= FD_SETSIZE)
 740             krb5_errx(context, 1, "fd too large");
 741         FD_SET(sockets[i], &real_fdset);
 742     }
 743     if (maxfd == -1)
 744         krb5_errx(context, 1, "No sockets!");
 745
 746     roken_detach_finish(NULL, daemon_child);
 747
 748     while (exit_flag == 0) {
 749         krb5_ssize_t retx;
 750         fd_set fdset = real_fdset;
 751
 752         retx = select(maxfd + 1, &fdset, NULL, NULL, NULL);
 753         if (retx < 0) {
 754             if (errno == EINTR)
 755                 continue;
 756             else
 757                 krb5_err(context, 1, errno, "select");
 758         }
 759         for (i = 0; i < n; ++i)
 760             if (FD_ISSET(sockets[i], &fdset)) {
 761                 u_char buf[BUFSIZ];
 762                 socklen_t addrlen = sizeof(__ss);
 763
 764                 retx = recvfrom(sockets[i], buf, sizeof(buf), 0,
 765                                 sa, &addrlen);
 766                 if (retx < 0) {
 767                     if (errno == EINTR)
 768                         break;
 769                     else
 770                         krb5_err(context, 1, errno, "recvfrom");
 771                 }
 772
 773                 process(keytab, sockets[i],
 774                          &addrs.val[i],
 775                          sa, addrlen,
 776                          buf, retx);
 777             }
 778     }
 779
 780     for (i = 0; i < n; ++i)
 781         close(sockets[i]);
 782     free(sockets);
 783
 784     krb5_free_addresses(context, &addrs);
 785     krb5_kt_close(context, keytab);
 786     krb5_free_context(context);
 787     return 0;
 788 }
 789
 790 static RETSIGTYPE
 791 sigterm(int sig)
 792 {
 793     exit_flag = 1;
 794 }
 795
 796 int
 797 main(int argc, char **argv)
 798 {
 799     krb5_keytab keytab;
 800     krb5_error_code ret;
 801     char **files;
 802     int port, i;
 803     int aret;
 804
 805     krb5_program_setup(&context, argc, argv, args, num_args, NULL);
 806
 807     if (help_flag)
 808         krb5_std_usage(0, args, num_args);
 809
 810     if (version_flag) {
 811         print_version(NULL);
 812         exit(0);
 813     }
 814
 815     if (detach_from_console > 0 && daemon_child == -1)
 816         daemon_child = roken_detach_prep(argc, argv, "--daemon-child");
 817
 818     if (config_file == NULL) {
 819         aret = asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
 820         if (aret == -1)
 821             errx(1, "out of memory");
 822     }
 823
 824     ret = krb5_prepend_config_files_default(config_file, &files);
 825     if (ret)
 826         krb5_err(context, 1, ret, "getting configuration files");
 827
 828     ret = krb5_set_config_files(context, files);
 829     krb5_free_config_files(files);
 830     if (ret)
 831         krb5_err(context, 1, ret, "reading configuration files");
 832
 833     if (realm_str)
 834         krb5_set_default_realm(context, realm_str);
 835
 836     krb5_openlog(context, "kpasswdd", &log_facility);
 837     krb5_set_warn_dest(context, log_facility);
 838
 839     if (port_str != NULL) {
 840         struct servent *s = roken_getservbyname(port_str, "udp");
 841
 842         if (s != NULL)
 843             port = s->s_port;
 844         else {
 845             char *ptr;
 846
 847             port = strtol(port_str, &ptr, 10);
 848             if (port == 0 && ptr == port_str)
 849                 krb5_errx(context, 1, "bad port `%s'", port_str);
 850             port = htons(port);
 851         }
 852     } else
 853         port = krb5_getportbyname(context, "kpasswd", "udp", KPASSWD_PORT);
 854
 855     ret = krb5_kt_register(context, &hdb_get_kt_ops);
 856     if (ret)
 857         krb5_err(context, 1, ret, "krb5_kt_register");
 858
 859     ret = krb5_kt_resolve(context, keytab_str, &keytab);
 860     if (ret)
 861         krb5_err(context, 1, ret, "%s", keytab_str);
 862
 863     kadm5_setup_passwd_quality_check(context, check_library, check_function);
 864
 865     for (i = 0; i < policy_libraries.num_strings; i++) {
 866         ret = kadm5_add_passwd_quality_verifier(context,
 867                                                 policy_libraries.strings[i]);
 868         if (ret)
 869             krb5_err(context, 1, ret, "kadm5_add_passwd_quality_verifier");
 870     }
 871     ret = kadm5_add_passwd_quality_verifier(context, NULL);
 872     if (ret)
 873         krb5_err(context, 1, ret, "kadm5_add_passwd_quality_verifier");
 874
 875
 876     explicit_addresses.len = 0;
 877
 878     if (addresses_str.num_strings) {
 879         int j;
 880
 881         for (j = 0; j < addresses_str.num_strings; ++j)
 882             add_one_address(addresses_str.strings[j], j == 0);
 883         free_getarg_strings(&addresses_str);
 884     } else {
 885         char **foo = krb5_config_get_strings(context, NULL,
 886                                               "kdc", "addresses", NULL);
 887
 888         if (foo != NULL) {
 889             add_one_address(*foo++, TRUE);
 890             while (*foo)
 891                 add_one_address(*foo++, FALSE);
 892         }
 893     }
 894
 895 #ifdef HAVE_SIGACTION
 896     {
 897         struct sigaction sa;
 898
 899         sa.sa_flags = 0;
 900         sa.sa_handler = sigterm;
 901         sigemptyset(&sa.sa_mask);
 902
 903         sigaction(SIGINT,  &sa, NULL);
 904         sigaction(SIGTERM, &sa, NULL);
 905     }
 906 #else
 907     signal(SIGINT,  sigterm);
 908     signal(SIGTERM, sigterm);
 909 #endif
 910
 911     rk_pidfile(NULL);
 912
 913     return doit(keytab, port);
 914 }