kadmin/server.c

   1 /*
   2  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <krb5-private.h>
  36
  37 static kadm5_ret_t check_aliases(kadm5_server_context *,
  38                                  kadm5_principal_ent_rec *,
  39                                  kadm5_principal_ent_rec *);
  40
  41 static kadm5_ret_t
  42 kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
  43                  krb5_data *in, krb5_data *out, int readonly)
  44 {
  45     kadm5_ret_t ret;
  46     int32_t cmd, mask, kvno, tmp;
  47     kadm5_server_context *contextp = kadm_handlep;
  48     char client[128], name[128], name2[128];
  49     const char *op = "";
  50     krb5_principal princ = NULL, princ2 = NULL;
  51     kadm5_principal_ent_rec ent, ent_prev;
  52     char *password = NULL, *expression;
  53     krb5_keyblock *new_keys;
  54     krb5_key_salt_tuple *ks_tuple = NULL;
  55     int keepold = FALSE;
  56     int n_ks_tuple = 0;
  57     int n_keys;
  58     char **princs;
  59     int n_princs;
  60     int keys_ok = 0;
  61     krb5_storage *sp;
  62     int len;
  63
  64     krb5_unparse_name_fixed(contextp->context, contextp->caller,
  65                             client, sizeof(client));
  66
  67     sp = krb5_storage_from_data(in);
  68     if (sp == NULL) {
  69         ret = krb5_enomem(contextp->context);
  70         goto fail;
  71     }
  72
  73     krb5_ret_int32(sp, &cmd);
  74     switch(cmd){
  75     case kadm_get:{
  76         op = "GET";
  77         ret = krb5_ret_principal(sp, &princ);
  78         if(ret)
  79             goto fail;
  80         ret = krb5_ret_int32(sp, &mask);
  81         if (ret)
  82             goto fail;
  83
  84         mask |= KADM5_PRINCIPAL;
  85         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
  86         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
  87
  88         /* If the caller doesn't have KADM5_PRIV_GET, we're done. */
  89         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET, princ);
  90         if (ret)
  91             goto fail;
  92
  93         /* Then check to see if it is ok to return keys */
  94         if ((mask & KADM5_KEY_DATA) != 0) {
  95             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET_KEYS,
  96                                               princ);
  97             if (ret == 0) {
  98                 keys_ok = 1;
  99             } else if ((mask == (KADM5_PRINCIPAL|KADM5_KEY_DATA)) ||
 100                        (mask == (KADM5_PRINCIPAL|KADM5_KVNO|KADM5_KEY_DATA))) {
 101                 /*
 102                  * Requests for keys will get bogus keys, which is useful if
 103                  * the client just wants to see what (kvno, enctype)s the
 104                  * principal has keys for, but terrible if the client wants to
 105                  * write the keys into a keytab or modify the principal and
 106                  * write the bogus keys back to the server.
 107                  *
 108                  * We use a heuristic to detect which case we're handling here.
 109                  * If the client only asks for the flags in the above
 110                  * condition, then it's very likely a kadmin ext_keytab,
 111                  * add_enctype, or other request that should not see bogus
 112                  * keys.  We deny them.
 113                  *
 114                  * The kadmin get command can be coaxed into making a request
 115                  * with the same mask.  But the default long and terse output
 116                  * modes request other things too, so in all likelihood this
 117                  * heuristic will not hurt any kadmin get uses.
 118                  */
 119                 goto fail;
 120             }
 121         }
 122
 123         ret = kadm5_get_principal(kadm_handlep, princ, &ent, mask);
 124         krb5_storage_free(sp);
 125         sp = krb5_storage_emem();
 126         if (sp == NULL) {
 127             ret = krb5_enomem(contextp->context);
 128             goto fail;
 129         }
 130         krb5_store_int32(sp, ret);
 131         if (ret == 0){
 132             if (keys_ok)
 133                 kadm5_store_principal_ent(sp, &ent);
 134             else
 135                 kadm5_store_principal_ent_nokeys(sp, &ent);
 136             kadm5_free_principal_ent(kadm_handlep, &ent);
 137         }
 138         break;
 139     }
 140     case kadm_delete:{
 141         op = "DELETE";
 142         if (readonly) {
 143             ret = KADM5_READ_ONLY;
 144             goto fail;
 145         }
 146         ret = krb5_ret_principal(sp, &princ);
 147         if (ret)
 148             goto fail;
 149         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 150         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 151         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_DELETE, princ);
 152         if (ret)
 153             goto fail;
 154
 155         /*
 156          * There's no need to check that the caller has permission to
 157          * delete the victim principal's aliases.
 158          */
 159
 160         ret = kadm5_delete_principal(kadm_handlep, princ);
 161         krb5_storage_free(sp);
 162         sp = krb5_storage_emem();
 163         if (sp == NULL) {
 164             ret = krb5_enomem(contextp->context);
 165             goto fail;
 166         }
 167         krb5_store_int32(sp, ret);
 168         break;
 169     }
 170     case kadm_create:{
 171         op = "CREATE";
 172         if (readonly) {
 173             ret = KADM5_READ_ONLY;
 174             goto fail;
 175         }
 176         ret = kadm5_ret_principal_ent(sp, &ent);
 177         if(ret)
 178             goto fail;
 179         ret = krb5_ret_int32(sp, &mask);
 180         if(ret){
 181             kadm5_free_principal_ent(kadm_handlep, &ent);
 182             goto fail;
 183         }
 184         ret = krb5_ret_string(sp, &password);
 185         if(ret){
 186             kadm5_free_principal_ent(kadm_handlep, &ent);
 187             goto fail;
 188         }
 189         krb5_unparse_name_fixed(contextp->context, ent.principal,
 190                                 name, sizeof(name));
 191         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 192         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD,
 193                                           ent.principal);
 194         if(ret){
 195             kadm5_free_principal_ent(kadm_handlep, &ent);
 196             goto fail;
 197         }
 198         if ((mask & KADM5_TL_DATA)) {
 199             /*
 200              * Also check that the caller can create the aliases, if the
 201              * new principal has any.
 202              */
 203             ret = check_aliases(contextp, &ent, NULL);
 204             if (ret) {
 205                 kadm5_free_principal_ent(kadm_handlep, &ent);
 206                 goto fail;
 207             }
 208         }
 209         ret = kadm5_create_principal(kadm_handlep, &ent,
 210                                      mask, password);
 211         kadm5_free_principal_ent(kadm_handlep, &ent);
 212         krb5_storage_free(sp);
 213         sp = krb5_storage_emem();
 214         if (sp == NULL) {
 215             ret = krb5_enomem(contextp->context);
 216             goto fail;
 217         }
 218         krb5_store_int32(sp, ret);
 219         break;
 220     }
 221     case kadm_modify:{
 222         op = "MODIFY";
 223         if (readonly) {
 224             ret = KADM5_READ_ONLY;
 225             goto fail;
 226         }
 227         ret = kadm5_ret_principal_ent(sp, &ent);
 228         if(ret)
 229             goto fail;
 230         ret = krb5_ret_int32(sp, &mask);
 231         if(ret){
 232             kadm5_free_principal_ent(contextp, &ent);
 233             goto fail;
 234         }
 235         krb5_unparse_name_fixed(contextp->context, ent.principal,
 236                                 name, sizeof(name));
 237         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 238         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_MODIFY,
 239                                           ent.principal);
 240         if(ret){
 241             kadm5_free_principal_ent(contextp, &ent);
 242             goto fail;
 243         }
 244         if ((mask & KADM5_TL_DATA)) {
 245             /*
 246              * Also check that the caller can create aliases that are in
 247              * the new entry but not the old one.  There's no need to
 248              * check that the caller can delete aliases it wants to
 249              * drop.  See also handling of rename.
 250              */
 251             ret = kadm5_get_principal(kadm_handlep, ent.principal, &ent_prev, mask);
 252             if (ret) {
 253                 kadm5_free_principal_ent(contextp, &ent);
 254                 goto fail;
 255             }
 256             ret = check_aliases(contextp, &ent, &ent_prev);
 257             kadm5_free_principal_ent(contextp, &ent_prev);
 258             if (ret) {
 259                 kadm5_free_principal_ent(contextp, &ent);
 260                 goto fail;
 261             }
 262         }
 263         ret = kadm5_modify_principal(kadm_handlep, &ent, mask);
 264         kadm5_free_principal_ent(kadm_handlep, &ent);
 265         krb5_storage_free(sp);
 266         sp = krb5_storage_emem();
 267         if (sp == NULL) {
 268             ret = krb5_enomem(contextp->context);
 269             goto fail;
 270         }
 271         krb5_store_int32(sp, ret);
 272         break;
 273     }
 274     case kadm_prune:{
 275         op = "PRUNE";
 276         if (readonly) {
 277             ret = KADM5_READ_ONLY;
 278             goto fail;
 279         }
 280         ret = krb5_ret_principal(sp, &princ);
 281         if (ret)
 282             goto fail;
 283         ret = krb5_ret_int32(sp, &kvno);
 284         if (ret == HEIM_ERR_EOF) {
 285             kvno = 0;
 286         } else if (ret) {
 287             goto fail;
 288         }
 289         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 290         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 291         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 292         if (ret)
 293             goto fail;
 294
 295         ret = kadm5_prune_principal(kadm_handlep, princ, kvno);
 296         krb5_storage_free(sp);
 297         sp = krb5_storage_emem();
 298         if (sp == NULL) {
 299             ret = krb5_enomem(contextp->context);
 300             goto fail;
 301         }
 302         krb5_store_int32(sp, ret);
 303         break;
 304     }
 305     case kadm_rename:{
 306         op = "RENAME";
 307         if (readonly) {
 308             ret = KADM5_READ_ONLY;
 309             goto fail;
 310         }
 311         ret = krb5_ret_principal(sp, &princ);
 312         if(ret)
 313             goto fail;
 314         ret = krb5_ret_principal(sp, &princ2);
 315         if (ret)
 316             goto fail;
 317
 318         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 319         krb5_unparse_name_fixed(contextp->context, princ2,
 320                                 name2, sizeof(name2));
 321         krb5_warnx(contextp->context, "%s: %s %s -> %s",
 322                    client, op, name, name2);
 323         ret = _kadm5_acl_check_permission(contextp,
 324                                           KADM5_PRIV_ADD,
 325                                           princ2);
 326         if (ret == 0) {
 327             /*
 328              * Also require modify for the principal.  For backwards
 329              * compatibility, allow delete permission on the old name to
 330              * cure lack of modify permission on the old name.
 331              */
 332             ret = _kadm5_acl_check_permission(contextp,
 333                                               KADM5_PRIV_MODIFY,
 334                                               princ);
 335             if (ret) {
 336                 ret = _kadm5_acl_check_permission(contextp,
 337                                                   KADM5_PRIV_DELETE,
 338                                                   princ);
 339             }
 340         }
 341         if (ret)
 342             goto fail;
 343
 344         ret = kadm5_rename_principal(kadm_handlep, princ, princ2);
 345         krb5_storage_free(sp);
 346         sp = krb5_storage_emem();
 347         if (sp == NULL) {
 348             ret = krb5_enomem(contextp->context);
 349             goto fail;
 350         }
 351         krb5_store_int32(sp, ret);
 352         break;
 353     }
 354     case kadm_chpass:{
 355         krb5_boolean is_self_cpw, allow_self_cpw;
 356
 357         op = "CHPASS";
 358         if (readonly) {
 359             ret = KADM5_READ_ONLY;
 360             goto fail;
 361         }
 362         ret = krb5_ret_principal(sp, &princ);
 363         if (ret)
 364             goto fail;
 365         ret = krb5_ret_string(sp, &password);
 366         if (ret)
 367             goto fail;
 368
 369         ret = krb5_ret_int32(sp, &keepold);
 370         if (ret && ret != HEIM_ERR_EOF)
 371             goto fail;
 372
 373         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 374         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 375
 376         /*
 377          * Change password requests are subject to ACLs unless the principal is
 378          * changing their own password and the initial ticket flag is set, and
 379          * the allow_self_change_password configuration option is TRUE.
 380          */
 381         is_self_cpw =
 382             krb5_principal_compare(contextp->context, contextp->caller, princ);
 383         allow_self_cpw =
 384             krb5_config_get_bool_default(contextp->context, NULL, TRUE,
 385                                          "kadmin", "allow_self_change_password", NULL);
 386         if (!(is_self_cpw && initial && allow_self_cpw)) {
 387             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 388             if (ret)
 389                 goto fail;
 390         }
 391
 392         ret = kadm5_chpass_principal_3(kadm_handlep, princ, keepold, 0, NULL,
 393                                        password);
 394         krb5_storage_free(sp);
 395         sp = krb5_storage_emem();
 396         if (sp == NULL) {
 397             ret = krb5_enomem(contextp->context);
 398             goto fail;
 399         }
 400         krb5_store_int32(sp, ret);
 401         break;
 402     }
 403     case kadm_chpass_with_key:{
 404         int i;
 405         krb5_key_data *key_data;
 406         int n_key_data;
 407
 408         op = "CHPASS_WITH_KEY";
 409         if (readonly) {
 410             ret = KADM5_READ_ONLY;
 411             goto fail;
 412         }
 413         ret = krb5_ret_principal(sp, &princ);
 414         if(ret)
 415             goto fail;
 416         ret = krb5_ret_int32(sp, &n_key_data);
 417         if (ret)
 418             goto fail;
 419
 420         ret = krb5_ret_int32(sp, &keepold);
 421         if (ret && ret != HEIM_ERR_EOF)
 422             goto fail;
 423
 424         /* n_key_data will be squeezed into an int16_t below. */
 425         if (n_key_data < 0 || n_key_data >= 1 << 16 ||
 426             (size_t)n_key_data > UINT_MAX/sizeof(*key_data)) {
 427             ret = ERANGE;
 428             goto fail;
 429         }
 430
 431         key_data = malloc (n_key_data * sizeof(*key_data));
 432         if (key_data == NULL && n_key_data != 0) {
 433             ret = krb5_enomem(contextp->context);
 434             goto fail;
 435         }
 436
 437         for (i = 0; i < n_key_data; ++i) {
 438             ret = kadm5_ret_key_data (sp, &key_data[i]);
 439             if (ret) {
 440                 int16_t dummy = i;
 441
 442                 kadm5_free_key_data (contextp, &dummy, key_data);
 443                 free (key_data);
 444                 goto fail;
 445             }
 446         }
 447
 448         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 449         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 450
 451         /*
 452          * The change is only allowed if the user is on the CPW ACL,
 453          * this it to force password quality check on the user.
 454          */
 455
 456         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 457         if(ret) {
 458             int16_t dummy = n_key_data;
 459
 460             kadm5_free_key_data (contextp, &dummy, key_data);
 461             free (key_data);
 462             goto fail;
 463         }
 464         ret = kadm5_chpass_principal_with_key_3(kadm_handlep, princ, keepold,
 465                                                 n_key_data, key_data);
 466         {
 467             int16_t dummy = n_key_data;
 468             kadm5_free_key_data (contextp, &dummy, key_data);
 469         }
 470         free (key_data);
 471         krb5_storage_free(sp);
 472         sp = krb5_storage_emem();
 473         if (sp == NULL) {
 474             ret = krb5_enomem(contextp->context);
 475             goto fail;
 476         }
 477         krb5_store_int32(sp, ret);
 478         break;
 479     }
 480     case kadm_randkey:{
 481         size_t i;
 482
 483         op = "RANDKEY";
 484         if (readonly) {
 485             ret = KADM5_READ_ONLY;
 486             goto fail;
 487         }
 488         ret = krb5_ret_principal(sp, &princ);
 489         if (ret)
 490             goto fail;
 491         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 492         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 493         /*
 494          * The change is allowed if at least one of:
 495          * a) it's for the principal him/herself and this was an initial ticket
 496          * b) the user is on the CPW ACL.
 497          */
 498
 499         if (initial
 500             && krb5_principal_compare (contextp->context, contextp->caller,
 501                                        princ))
 502             ret = 0;
 503         else
 504             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 505
 506         if (ret)
 507             goto fail;
 508
 509         /*
 510          * See comments in kadm5_c_randkey_principal() regarding the
 511          * protocol.
 512          */
 513         ret = krb5_ret_int32(sp, &keepold);
 514         if (ret != 0 && ret != HEIM_ERR_EOF)
 515             goto fail;
 516
 517         ret = krb5_ret_int32(sp, &n_ks_tuple);
 518         if (ret == HEIM_ERR_EOF) {
 519             const char *enctypes;
 520             size_t n;
 521
 522             enctypes = krb5_config_get_string(contextp->context, NULL,
 523                                               "realms",
 524                                               krb5_principal_get_realm(contextp->context,
 525                                                                        princ),
 526                                               "supported_enctypes", NULL);
 527             if (enctypes == NULL || enctypes[0] == '\0')
 528                 enctypes = "aes128-cts-hmac-sha1-96";
 529             ret = krb5_string_to_keysalts2(contextp->context, enctypes,
 530                                            &n, &ks_tuple);
 531             n_ks_tuple = n;
 532         }
 533         if (ret != 0)
 534             goto fail;
 535
 536         if (n_ks_tuple < 0) {
 537             ret = EOVERFLOW;
 538             goto fail;
 539         }
 540         free(ks_tuple);
 541         if ((ks_tuple = calloc(n_ks_tuple, sizeof (*ks_tuple))) == NULL) {
 542             ret = errno;
 543             goto fail;
 544         }
 545
 546         for (i = 0; i < n_ks_tuple; i++) {
 547             ret = krb5_ret_int32(sp, &ks_tuple[i].ks_enctype);
 548             if (ret != 0) {
 549                 free(ks_tuple);
 550                 goto fail;
 551             }
 552             ret = krb5_ret_int32(sp, &ks_tuple[i].ks_salttype);
 553             if (ret != 0) {
 554                 free(ks_tuple);
 555                 goto fail;
 556             }
 557         }
 558         ret = kadm5_randkey_principal_3(kadm_handlep, princ, keepold,
 559                                         n_ks_tuple, ks_tuple, &new_keys,
 560                                         &n_keys);
 561         free(ks_tuple);
 562
 563         krb5_storage_free(sp);
 564         sp = krb5_storage_emem();
 565         if (sp == NULL) {
 566             ret = krb5_enomem(contextp->context);
 567             goto fail;
 568         }
 569         krb5_store_int32(sp, ret);
 570         if (ret == 0){
 571             krb5_store_int32(sp, n_keys);
 572             for (i = 0; i < n_keys; i++){
 573                 if (ret == 0)
 574                     ret = krb5_store_keyblock(sp, new_keys[i]);
 575                 krb5_free_keyblock_contents(contextp->context, &new_keys[i]);
 576             }
 577             free(new_keys);
 578         }
 579         break;
 580     }
 581     case kadm_get_privs:{
 582         uint32_t privs;
 583         ret = kadm5_get_privs(kadm_handlep, &privs);
 584         krb5_storage_free(sp);
 585         sp = krb5_storage_emem();
 586         if (sp == NULL) {
 587             ret = krb5_enomem(contextp->context);
 588             goto fail;
 589         }
 590         krb5_store_int32(sp, ret);
 591         if(ret == 0)
 592             krb5_store_uint32(sp, privs);
 593         break;
 594     }
 595     case kadm_get_princs:{
 596         op = "LIST";
 597         ret = krb5_ret_int32(sp, &tmp);
 598         if(ret)
 599             goto fail;
 600         if(tmp){
 601             ret = krb5_ret_string(sp, &expression);
 602             if(ret)
 603                 goto fail;
 604         }else
 605             expression = NULL;
 606         krb5_warnx(contextp->context, "%s: %s %s", client, op,
 607                    expression ? expression : "*");
 608         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_LIST, NULL);
 609         if(ret){
 610             free(expression);
 611             goto fail;
 612         }
 613         ret = kadm5_get_principals(kadm_handlep, expression, &princs, &n_princs);
 614         free(expression);
 615         krb5_storage_free(sp);
 616         sp = krb5_storage_emem();
 617         if (sp == NULL) {
 618             ret = krb5_enomem(contextp->context);
 619             goto fail;
 620         }
 621         krb5_store_int32(sp, ret);
 622         if(ret == 0){
 623             int i;
 624             krb5_store_int32(sp, n_princs);
 625             for(i = 0; i < n_princs; i++)
 626                 krb5_store_string(sp, princs[i]);
 627             kadm5_free_name_list(kadm_handlep, princs, &n_princs);
 628         }
 629         break;
 630     }
 631     default:
 632         krb5_warnx(contextp->context, "%s: UNKNOWN OP %d", client, cmd);
 633         krb5_storage_free(sp);
 634         sp = krb5_storage_emem();
 635         if (sp == NULL) {
 636             ret = krb5_enomem(contextp->context);
 637             goto fail;
 638         }
 639         krb5_store_int32(sp, KADM5_FAILURE);
 640         break;
 641     }
 642     if (password != NULL) {
 643         len = strlen(password);
 644         memset_s(password, len, 0, len);
 645         free(password);
 646     }
 647     krb5_storage_to_data(sp, out);
 648     krb5_storage_free(sp);
 649     if (princ != NULL)
 650         krb5_free_principal(contextp->context, princ);
 651     if (princ2 != NULL)
 652         krb5_free_principal(contextp->context, princ2);
 653     return 0;
 654 fail:
 655     if (password != NULL) {
 656         len = strlen(password);
 657         memset_s(password, len, 0, len);
 658         free(password);
 659     }
 660     krb5_warn(contextp->context, ret, "%s", op);
 661     if (sp != NULL) {
 662         krb5_storage_seek(sp, 0, SEEK_SET);
 663         krb5_store_int32(sp, ret);
 664         krb5_storage_to_data(sp, out);
 665         krb5_storage_free(sp);
 666     }
 667     if (princ != NULL)
 668         krb5_free_principal(contextp->context, princ);
 669     if (princ2 != NULL)
 670         krb5_free_principal(contextp->context, princ2);
 671     return 0;
 672 }
 673
 674 struct iter_aliases_ctx {
 675     HDB_Ext_Aliases aliases;
 676     krb5_tl_data *tl;
 677     int alias_idx;
 678     int done;
 679 };
 680
 681 static kadm5_ret_t
 682 iter_aliases(kadm5_principal_ent_rec *from,
 683              struct iter_aliases_ctx *ctx,
 684              krb5_principal *out)
 685 {
 686     HDB_extension ext;
 687     kadm5_ret_t ret;
 688     size_t size;
 689
 690     *out = NULL;
 691
 692     if (ctx->done > 0)
 693         return 0;
 694     if (from == NULL) {
 695         ctx->done = 1;
 696         return 0;
 697     }
 698
 699     if (ctx->done == 0) {
 700         if (ctx->alias_idx < ctx->aliases.aliases.len) {
 701             *out = &ctx->aliases.aliases.val[ctx->alias_idx++];
 702             return 0;
 703         }
 704         /* Out of aliases in this TL, step to next TL */
 705         ctx->tl = ctx->tl->tl_data_next;
 706     } else if (ctx->done < 0) {
 707         /* Setup iteration context */
 708         memset(ctx, 0, sizeof(*ctx));
 709         ctx->done = 0;
 710         ctx->aliases.aliases.val = NULL;
 711         ctx->aliases.aliases.len = 0;
 712         ctx->tl = from->tl_data;
 713     }
 714
 715     free_HDB_Ext_Aliases(&ctx->aliases);
 716     ctx->alias_idx = 0;
 717
 718     /* Find TL with aliases */
 719     for (; ctx->tl != NULL; ctx->tl = ctx->tl->tl_data_next) {
 720         if (ctx->tl->tl_data_type != KRB5_TL_EXTENSION)
 721             continue;
 722
 723         ret = decode_HDB_extension(ctx->tl->tl_data_contents,
 724                                    ctx->tl->tl_data_length,
 725                                    &ext, &size);
 726         if (ret)
 727             return ret;
 728         if (ext.data.element == choice_HDB_extension_data_aliases &&
 729             ext.data.u.aliases.aliases.len > 0) {
 730             ctx->aliases = ext.data.u.aliases;
 731             break;
 732         }
 733         free_HDB_extension(&ext);
 734     }
 735
 736     if (ctx->tl != NULL && ctx->aliases.aliases.len > 0) {
 737         *out = &ctx->aliases.aliases.val[ctx->alias_idx++];
 738         return 0;
 739     }
 740
 741     ctx->done = 1;
 742     return 0;
 743 }
 744
 745 static kadm5_ret_t
 746 check_aliases(kadm5_server_context *contextp,
 747               kadm5_principal_ent_rec *add_princ,
 748               kadm5_principal_ent_rec *del_princ)
 749 {
 750     kadm5_ret_t ret;
 751     struct iter_aliases_ctx iter;
 752     struct iter_aliases_ctx iter_del;
 753     krb5_principal new_name, old_name;
 754     int match;
 755
 756     /*
 757      * Yeah, this is O(N^2).  Gathering and sorting all the aliases
 758      * would be a bit of a pain; if we ever have principals with enough
 759      * aliases for this to be a problem, we can fix it then.
 760      */
 761     for (iter.done = -1; iter.done != 1;) {
 762         match = 0;
 763         ret = iter_aliases(add_princ, &iter, &new_name);
 764         if (ret)
 765             return ret;
 766         if (iter.done == 1)
 767             break;
 768         for (iter_del.done = -1; iter_del.done != 1;) {
 769             ret = iter_aliases(del_princ, &iter_del, &old_name);
 770             if (ret)
 771                 return ret;
 772             if (iter_del.done == 1)
 773                 break;
 774             if (!krb5_principal_compare(contextp->context, new_name, old_name))
 775                 continue;
 776             free_HDB_Ext_Aliases(&iter_del.aliases);
 777             match = 1;
 778             break;
 779         }
 780         if (match)
 781             continue;
 782         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD, new_name);
 783         if (ret) {
 784             free_HDB_Ext_Aliases(&iter.aliases);
 785             return ret;
 786         }
 787     }
 788
 789     return 0;
 790 }
 791
 792 static void
 793 v5_loop (krb5_context contextp,
 794          krb5_auth_context ac,
 795          krb5_boolean initial,
 796          void *kadm_handlep,
 797          krb5_socket_t fd,
 798          int readonly)
 799 {
 800     krb5_error_code ret;
 801     krb5_data in, out;
 802
 803     for (;;) {
 804         doing_useful_work = 0;
 805         if(term_flag)
 806             exit(0);
 807         ret = krb5_read_priv_message(contextp, ac, &fd, &in);
 808         if(ret == HEIM_ERR_EOF)
 809             exit(0);
 810         if(ret)
 811             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 812         doing_useful_work = 1;
 813         ret = kadmind_dispatch(kadm_handlep, initial, &in, &out, readonly);
 814         if (ret)
 815             krb5_err(contextp, 1, ret, "kadmind_dispatch");
 816         krb5_data_free(&in);
 817         ret = krb5_write_priv_message(contextp, ac, &fd, &out);
 818         krb5_data_free(&out);
 819         if(ret)
 820             krb5_err(contextp, 1, ret, "krb5_write_priv_message");
 821     }
 822 }
 823
 824 static krb5_boolean
 825 match_appl_version(const void *data, const char *appl_version)
 826 {
 827     unsigned minor;
 828     if(sscanf(appl_version, "KADM0.%u", &minor) != 1)
 829         return 0;
 830     /*XXX*/
 831     *(unsigned*)(intptr_t)data = minor;
 832     return 1;
 833 }
 834
 835 static void
 836 handle_v5(krb5_context contextp,
 837           krb5_keytab keytab,
 838           krb5_socket_t fd,
 839           int readonly)
 840 {
 841     krb5_error_code ret;
 842     krb5_ticket *ticket;
 843     char *server_name;
 844     char *client;
 845     void *kadm_handlep;
 846     krb5_boolean initial;
 847     krb5_auth_context ac = NULL;
 848
 849     unsigned kadm_version = 1;
 850     kadm5_config_params realm_params;
 851
 852     ret = krb5_recvauth_match_version(contextp, &ac, &fd,
 853                                       match_appl_version, &kadm_version,
 854                                       NULL, KRB5_RECVAUTH_IGNORE_VERSION,
 855                                       keytab, &ticket);
 856     if (ret)
 857         krb5_err(contextp, 1, ret, "krb5_recvauth");
 858
 859     ret = krb5_unparse_name (contextp, ticket->server, &server_name);
 860     if (ret)
 861         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 862
 863     if (strncmp (server_name, KADM5_ADMIN_SERVICE,
 864                  strlen(KADM5_ADMIN_SERVICE)) != 0)
 865         krb5_errx (contextp, 1, "ticket for strange principal (%s)",
 866                    server_name);
 867
 868     free (server_name);
 869
 870     memset(&realm_params, 0, sizeof(realm_params));
 871
 872     if(kadm_version == 1) {
 873         krb5_data params;
 874         ret = krb5_read_priv_message(contextp, ac, &fd, &params);
 875         if(ret)
 876             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 877         _kadm5_unmarshal_params(contextp, &params, &realm_params);
 878     }
 879
 880     initial = ticket->ticket.flags.initial;
 881     ret = krb5_unparse_name(contextp, ticket->client, &client);
 882     if (ret)
 883         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 884     krb5_free_ticket (contextp, ticket);
 885     ret = kadm5_s_init_with_password_ctx(contextp,
 886                                          client,
 887                                          NULL,
 888                                          KADM5_ADMIN_SERVICE,
 889                                          &realm_params,
 890                                          0, 0,
 891                                          &kadm_handlep);
 892     if(ret)
 893         krb5_err (contextp, 1, ret, "kadm5_init_with_password_ctx");
 894     v5_loop (contextp, ac, initial, kadm_handlep, fd, readonly);
 895 }
 896
 897 krb5_error_code
 898 kadmind_loop(krb5_context contextp,
 899              krb5_keytab keytab,
 900              krb5_socket_t sock,
 901              int readonly)
 902 {
 903     u_char buf[sizeof(KRB5_SENDAUTH_VERSION) + 4];
 904     ssize_t n;
 905     unsigned long len;
 906
 907     n = krb5_net_read(contextp, &sock, buf, 4);
 908     if(n == 0)
 909         exit(0);
 910     if(n < 0)
 911         krb5_err(contextp, 1, errno, "read");
 912     _krb5_get_int(buf, &len, 4);
 913
 914     if (len == sizeof(KRB5_SENDAUTH_VERSION)) {
 915
 916         n = krb5_net_read(contextp, &sock, buf + 4, len);
 917         if (n < 0)
 918             krb5_err (contextp, 1, errno, "reading sendauth version");
 919         if (n == 0)
 920             krb5_errx (contextp, 1, "EOF reading sendauth version");
 921
 922         if(memcmp(buf + 4, KRB5_SENDAUTH_VERSION, len) == 0) {
 923             handle_v5(contextp, keytab, sock, readonly);
 924             return 0;
 925         }
 926         len += 4;
 927     } else
 928         len = 4;
 929
 930     handle_mit(contextp, buf, len, sock, readonly);
 931
 932     return 0;
 933 }
 934