kdc/windc.c

   1 /*
   2  * Copyright (c) 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kdc_locl.h"
  35
  36 static int have_plugin = 0;
  37
  38 /*
  39  * Pick the first WINDC module that we find.
  40  */
  41
  42 static krb5_error_code KRB5_LIB_CALL
  43 load(krb5_context context, const void *plug, void *plugctx, void *userctx)
  44 {
  45     have_plugin = 1;
  46     return KRB5_PLUGIN_NO_HANDLE;
  47 }
  48
  49 krb5_error_code
  50 krb5_kdc_windc_init(krb5_context context)
  51 {
  52     (void)_krb5_plugin_run_f(context, "krb5", "windc",
  53                              KRB5_WINDC_PLUGIN_MINOR, 0, NULL, load);
  54     return 0;
  55 }
  56
  57 struct generate_uc {
  58     hdb_entry_ex *client;
  59     krb5_pac *pac;
  60 };
  61
  62 static krb5_error_code KRB5_LIB_CALL
  63 generate(krb5_context context, const void *plug, void *plugctx, void *userctx)
  64 {
  65     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
  66     struct generate_uc *uc = (struct generate_uc *)userctx;
  67
  68     if (ft->pac_generate == NULL)
  69         return KRB5_PLUGIN_NO_HANDLE;
  70     return ft->pac_generate((void *)plug, context, uc->client, uc->pac);
  71 }
  72
  73
  74 krb5_error_code
  75 _kdc_pac_generate(krb5_context context,
  76                   hdb_entry_ex *client,
  77                   krb5_pac *pac)
  78 {
  79     struct generate_uc uc;
  80
  81     if (!have_plugin)
  82         return 0;
  83
  84     uc.client = client;
  85     uc.pac = pac;
  86
  87     (void)_krb5_plugin_run_f(context, "krb5", "windc",
  88                              KRB5_WINDC_PLUGIN_MINOR, 0, &uc, generate);
  89     return 0;
  90 }
  91
  92 struct verify_uc {
  93     krb5_principal client_principal;
  94     krb5_principal delegated_proxy_principal;
  95     hdb_entry_ex *client;
  96     hdb_entry_ex *server;
  97     hdb_entry_ex *krbtgt;
  98     krb5_pac *pac;
  99     int *verified;
 100 };
 101
 102 static krb5_error_code KRB5_LIB_CALL
 103 verify(krb5_context context, const void *plug, void *plugctx, void *userctx)
 104 {
 105     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
 106     struct verify_uc *uc = (struct verify_uc *)userctx;
 107     krb5_error_code ret;
 108
 109     if (ft->pac_verify == NULL)
 110         return KRB5_PLUGIN_NO_HANDLE;
 111     ret = ft->pac_verify((void *)plug, context,
 112                          uc->client_principal,
 113                          uc->delegated_proxy_principal,
 114                          uc->client, uc->server, uc->krbtgt, uc->pac);
 115     if (ret == 0)
 116         (*uc->verified) = 1;
 117
 118     return 0;
 119 }
 120
 121 krb5_error_code
 122 _kdc_pac_verify(krb5_context context,
 123                 const krb5_principal client_principal,
 124                 const krb5_principal delegated_proxy_principal,
 125                 hdb_entry_ex *client,
 126                 hdb_entry_ex *server,
 127                 hdb_entry_ex *krbtgt,
 128                 krb5_pac *pac,
 129                 int *verified)
 130 {
 131     struct verify_uc uc;
 132
 133     if (!have_plugin)
 134         return 0;
 135
 136     uc.client_principal = client_principal;
 137     uc.delegated_proxy_principal = delegated_proxy_principal;
 138     uc.client = client;
 139     uc.server = server;
 140     uc.krbtgt = krbtgt;
 141     uc.pac = pac;
 142     uc.verified = verified;
 143
 144     (void)_krb5_plugin_run_f(context, "krb5", "windc",
 145                              KRB5_WINDC_PLUGIN_MINOR, 0, &uc, verify);
 146     return 0;
 147 }
 148
 149 struct check_uc {
 150     krb5_kdc_configuration *config;
 151     hdb_entry_ex *client_ex;
 152     const char *client_name;
 153     hdb_entry_ex *server_ex;
 154     const char *server_name;
 155     KDC_REQ *req;
 156     METHOD_DATA *method_data;
 157 };
 158
 159 static krb5_error_code KRB5_LIB_CALL
 160 check(krb5_context context, const void *plug, void *plugctx, void *userctx)
 161 {
 162     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
 163     struct check_uc *uc = (struct check_uc *)userctx;
 164
 165     if (ft->client_access == NULL)
 166         return KRB5_PLUGIN_NO_HANDLE;
 167     return ft->client_access((void *)plug, context, uc->config,
 168                              uc->client_ex, uc->client_name,
 169                              uc->server_ex, uc->server_name,
 170                              uc->req, uc->method_data);
 171 }
 172
 173
 174 krb5_error_code
 175 _kdc_check_access(krb5_context context,
 176                   krb5_kdc_configuration *config,
 177                   hdb_entry_ex *client_ex, const char *client_name,
 178                   hdb_entry_ex *server_ex, const char *server_name,
 179                   KDC_REQ *req,
 180                   METHOD_DATA *method_data)
 181 {
 182     krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
 183     struct check_uc uc;
 184
 185     if (have_plugin) {
 186         uc.config = config;
 187         uc.client_ex = client_ex;
 188         uc.client_name = client_name;
 189         uc.server_ex = server_ex;
 190         uc.server_name = server_name;
 191         uc.req = req;
 192         uc.method_data = method_data;
 193
 194         ret = _krb5_plugin_run_f(context, "krb5", "windc",
 195                                  KRB5_WINDC_PLUGIN_MINOR, 0, &uc, check);
 196     }
 197
 198     if (ret == KRB5_PLUGIN_NO_HANDLE)
 199         return kdc_check_flags(context, config,
 200                                client_ex, client_name,
 201                                server_ex, server_name,
 202                                req->msg_type == krb_as_req);
 203     return ret;
 204 }