kadmin/server.c

   1 /*
   2  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <krb5-private.h>
  36
  37 static kadm5_ret_t check_aliases(kadm5_server_context *,
  38                                  kadm5_principal_ent_rec *,
  39                                  kadm5_principal_ent_rec *);
  40
  41 static kadm5_ret_t
  42 kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
  43                  krb5_data *in, krb5_data *out)
  44 {
  45     kadm5_ret_t ret;
  46     int32_t cmd, mask, kvno, tmp;
  47     kadm5_server_context *contextp = kadm_handlep;
  48     char client[128], name[128], name2[128];
  49     const char *op = "";
  50     krb5_principal princ = NULL, princ2 = NULL;
  51     kadm5_principal_ent_rec ent, ent_prev;
  52     char *password = NULL, *expression;
  53     krb5_keyblock *new_keys;
  54     krb5_key_salt_tuple *ks_tuple = NULL;
  55     int keepold = FALSE;
  56     int n_ks_tuple = 0;
  57     int n_keys;
  58     char **princs;
  59     int n_princs;
  60     int keys_ok = 0;
  61     krb5_storage *sp;
  62     int len;
  63
  64     krb5_unparse_name_fixed(contextp->context, contextp->caller,
  65                             client, sizeof(client));
  66
  67     sp = krb5_storage_from_data(in);
  68     if (sp == NULL) {
  69         ret = krb5_enomem(contextp->context);
  70         goto fail;
  71     }
  72
  73     krb5_ret_int32(sp, &cmd);
  74     switch(cmd){
  75     case kadm_get:{
  76         op = "GET";
  77         ret = krb5_ret_principal(sp, &princ);
  78         if(ret)
  79             goto fail;
  80         ret = krb5_ret_int32(sp, &mask);
  81         if (ret)
  82             goto fail;
  83
  84         mask |= KADM5_PRINCIPAL;
  85         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
  86         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
  87
  88         /* If the caller doesn't have KADM5_PRIV_GET, we're done. */
  89         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET, princ);
  90         if (ret)
  91             goto fail;
  92
  93         /* Then check to see if it is ok to return keys */
  94         if ((mask & KADM5_KEY_DATA) != 0) {
  95             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_GET_KEYS,
  96                                               princ);
  97             if (ret == 0) {
  98                 keys_ok = 1;
  99             } else if ((mask == (KADM5_PRINCIPAL|KADM5_KEY_DATA)) ||
 100                        (mask == (KADM5_PRINCIPAL|KADM5_KVNO|KADM5_KEY_DATA))) {
 101                 /*
 102                  * Requests for keys will get bogus keys, which is useful if
 103                  * the client just wants to see what (kvno, enctype)s the
 104                  * principal has keys for, but terrible if the client wants to
 105                  * write the keys into a keytab or modify the principal and
 106                  * write the bogus keys back to the server.
 107                  *
 108                  * We use a heuristic to detect which case we're handling here.
 109                  * If the client only asks for the flags in the above
 110                  * condition, then it's very likely a kadmin ext_keytab,
 111                  * add_enctype, or other request that should not see bogus
 112                  * keys.  We deny them.
 113                  *
 114                  * The kadmin get command can be coaxed into making a request
 115                  * with the same mask.  But the default long and terse output
 116                  * modes request other things too, so in all likelihood this
 117                  * heuristic will not hurt any kadmin get uses.
 118                  */
 119                 goto fail;
 120             }
 121         }
 122
 123         ret = kadm5_get_principal(kadm_handlep, princ, &ent, mask);
 124         krb5_storage_free(sp);
 125         sp = krb5_storage_emem();
 126         if (sp == NULL) {
 127             ret = krb5_enomem(contextp->context);
 128             goto fail;
 129         }
 130         krb5_store_int32(sp, ret);
 131         if (ret == 0){
 132             if (keys_ok)
 133                 kadm5_store_principal_ent(sp, &ent);
 134             else
 135                 kadm5_store_principal_ent_nokeys(sp, &ent);
 136             kadm5_free_principal_ent(kadm_handlep, &ent);
 137         }
 138         break;
 139     }
 140     case kadm_delete:{
 141         op = "DELETE";
 142         ret = krb5_ret_principal(sp, &princ);
 143         if(ret)
 144             goto fail;
 145         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 146         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 147         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_DELETE, princ);
 148         if (ret)
 149             goto fail;
 150
 151         /*
 152          * There's no need to check that the caller has permission to
 153          * delete the victim principal's aliases.
 154          */
 155
 156         ret = kadm5_delete_principal(kadm_handlep, princ);
 157         krb5_storage_free(sp);
 158         sp = krb5_storage_emem();
 159         if (sp == NULL) {
 160             ret = krb5_enomem(contextp->context);
 161             goto fail;
 162         }
 163         krb5_store_int32(sp, ret);
 164         break;
 165     }
 166     case kadm_create:{
 167         op = "CREATE";
 168         ret = kadm5_ret_principal_ent(sp, &ent);
 169         if(ret)
 170             goto fail;
 171         ret = krb5_ret_int32(sp, &mask);
 172         if(ret){
 173             kadm5_free_principal_ent(kadm_handlep, &ent);
 174             goto fail;
 175         }
 176         ret = krb5_ret_string(sp, &password);
 177         if(ret){
 178             kadm5_free_principal_ent(kadm_handlep, &ent);
 179             goto fail;
 180         }
 181         krb5_unparse_name_fixed(contextp->context, ent.principal,
 182                                 name, sizeof(name));
 183         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 184         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD,
 185                                           ent.principal);
 186         if(ret){
 187             kadm5_free_principal_ent(kadm_handlep, &ent);
 188             goto fail;
 189         }
 190         if ((mask & KADM5_TL_DATA)) {
 191             /*
 192              * Also check that the caller can create the aliases, if the
 193              * new principal has any.
 194              */
 195             ret = check_aliases(contextp, &ent, NULL);
 196             if (ret) {
 197                 kadm5_free_principal_ent(kadm_handlep, &ent);
 198                 goto fail;
 199             }
 200         }
 201         ret = kadm5_create_principal(kadm_handlep, &ent,
 202                                      mask, password);
 203         kadm5_free_principal_ent(kadm_handlep, &ent);
 204         krb5_storage_free(sp);
 205         sp = krb5_storage_emem();
 206         if (sp == NULL) {
 207             ret = krb5_enomem(contextp->context);
 208             goto fail;
 209         }
 210         krb5_store_int32(sp, ret);
 211         break;
 212     }
 213     case kadm_modify:{
 214         op = "MODIFY";
 215         ret = kadm5_ret_principal_ent(sp, &ent);
 216         if(ret)
 217             goto fail;
 218         ret = krb5_ret_int32(sp, &mask);
 219         if(ret){
 220             kadm5_free_principal_ent(contextp, &ent);
 221             goto fail;
 222         }
 223         krb5_unparse_name_fixed(contextp->context, ent.principal,
 224                                 name, sizeof(name));
 225         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 226         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_MODIFY,
 227                                           ent.principal);
 228         if(ret){
 229             kadm5_free_principal_ent(contextp, &ent);
 230             goto fail;
 231         }
 232         if ((mask & KADM5_TL_DATA)) {
 233             /*
 234              * Also check that the caller can create aliases that are in
 235              * the new entry but not the old one.  There's no need to
 236              * check that the caller can delete aliases it wants to
 237              * drop.  See also handling of rename.
 238              */
 239             ret = kadm5_get_principal(kadm_handlep, ent.principal, &ent_prev, mask);
 240             if (ret) {
 241                 kadm5_free_principal_ent(contextp, &ent);
 242                 goto fail;
 243             }
 244             ret = check_aliases(contextp, &ent, &ent_prev);
 245             kadm5_free_principal_ent(contextp, &ent_prev);
 246             if (ret) {
 247                 kadm5_free_principal_ent(contextp, &ent);
 248                 goto fail;
 249             }
 250         }
 251         ret = kadm5_modify_principal(kadm_handlep, &ent, mask);
 252         kadm5_free_principal_ent(kadm_handlep, &ent);
 253         krb5_storage_free(sp);
 254         sp = krb5_storage_emem();
 255         if (sp == NULL) {
 256             ret = krb5_enomem(contextp->context);
 257             goto fail;
 258         }
 259         krb5_store_int32(sp, ret);
 260         break;
 261     }
 262     case kadm_prune:{
 263         op = "PRUNE";
 264         ret = krb5_ret_principal(sp, &princ);
 265         if (ret)
 266             goto fail;
 267         ret = krb5_ret_int32(sp, &kvno);
 268         if (ret == HEIM_ERR_EOF) {
 269             kvno = 0;
 270         } else if (ret) {
 271             goto fail;
 272         }
 273         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 274         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 275         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 276         if (ret)
 277             goto fail;
 278
 279         ret = kadm5_prune_principal(kadm_handlep, princ, kvno);
 280         krb5_storage_free(sp);
 281         sp = krb5_storage_emem();
 282         if (sp == NULL) {
 283             ret = krb5_enomem(contextp->context);
 284             goto fail;
 285         }
 286         krb5_store_int32(sp, ret);
 287         break;
 288     }
 289     case kadm_rename:{
 290         op = "RENAME";
 291         ret = krb5_ret_principal(sp, &princ);
 292         if(ret)
 293             goto fail;
 294         ret = krb5_ret_principal(sp, &princ2);
 295         if (ret)
 296             goto fail;
 297
 298         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 299         krb5_unparse_name_fixed(contextp->context, princ2,
 300                                 name2, sizeof(name2));
 301         krb5_warnx(contextp->context, "%s: %s %s -> %s",
 302                    client, op, name, name2);
 303         ret = _kadm5_acl_check_permission(contextp,
 304                                           KADM5_PRIV_ADD,
 305                                           princ2);
 306         if (ret == 0) {
 307             /*
 308              * Also require modify for the principal.  For backwards
 309              * compatibility, allow delete permission on the old name to
 310              * cure lack of modify permission on the old name.
 311              */
 312             ret = _kadm5_acl_check_permission(contextp,
 313                                               KADM5_PRIV_MODIFY,
 314                                               princ);
 315             if (ret) {
 316                 ret = _kadm5_acl_check_permission(contextp,
 317                                                   KADM5_PRIV_DELETE,
 318                                                   princ);
 319             }
 320         }
 321         if (ret)
 322             goto fail;
 323
 324         ret = kadm5_rename_principal(kadm_handlep, princ, princ2);
 325         krb5_storage_free(sp);
 326         sp = krb5_storage_emem();
 327         if (sp == NULL) {
 328             ret = krb5_enomem(contextp->context);
 329             goto fail;
 330         }
 331         krb5_store_int32(sp, ret);
 332         break;
 333     }
 334     case kadm_chpass:{
 335         krb5_boolean is_self_cpw, allow_self_cpw;
 336
 337         op = "CHPASS";
 338         ret = krb5_ret_principal(sp, &princ);
 339         if (ret)
 340             goto fail;
 341         ret = krb5_ret_string(sp, &password);
 342         if (ret)
 343             goto fail;
 344
 345         ret = krb5_ret_int32(sp, &keepold);
 346         if (ret && ret != HEIM_ERR_EOF)
 347             goto fail;
 348
 349         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 350         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 351
 352         /*
 353          * Change password requests are subject to ACLs unless the principal is
 354          * changing their own password and the initial ticket flag is set, and
 355          * the allow_self_change_password configuration option is TRUE.
 356          */
 357         is_self_cpw =
 358             krb5_principal_compare(contextp->context, contextp->caller, princ);
 359         allow_self_cpw =
 360             krb5_config_get_bool_default(contextp->context, NULL, TRUE,
 361                                          "kadmin", "allow_self_change_password", NULL);
 362         if (!(is_self_cpw && initial && allow_self_cpw)) {
 363             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 364             if (ret)
 365                 goto fail;
 366         }
 367
 368         ret = kadm5_chpass_principal_3(kadm_handlep, princ, keepold, 0, NULL,
 369                                        password);
 370         krb5_storage_free(sp);
 371         sp = krb5_storage_emem();
 372         if (sp == NULL) {
 373             ret = krb5_enomem(contextp->context);
 374             goto fail;
 375         }
 376         krb5_store_int32(sp, ret);
 377         break;
 378     }
 379     case kadm_chpass_with_key:{
 380         int i;
 381         krb5_key_data *key_data;
 382         int n_key_data;
 383
 384         op = "CHPASS_WITH_KEY";
 385         ret = krb5_ret_principal(sp, &princ);
 386         if(ret)
 387             goto fail;
 388         ret = krb5_ret_int32(sp, &n_key_data);
 389         if (ret)
 390             goto fail;
 391
 392         ret = krb5_ret_int32(sp, &keepold);
 393         if (ret && ret != HEIM_ERR_EOF)
 394             goto fail;
 395
 396         /* n_key_data will be squeezed into an int16_t below. */
 397         if (n_key_data < 0 || n_key_data >= 1 << 16 ||
 398             (size_t)n_key_data > UINT_MAX/sizeof(*key_data)) {
 399             ret = ERANGE;
 400             goto fail;
 401         }
 402
 403         key_data = malloc (n_key_data * sizeof(*key_data));
 404         if (key_data == NULL && n_key_data != 0) {
 405             ret = krb5_enomem(contextp->context);
 406             goto fail;
 407         }
 408
 409         for (i = 0; i < n_key_data; ++i) {
 410             ret = kadm5_ret_key_data (sp, &key_data[i]);
 411             if (ret) {
 412                 int16_t dummy = i;
 413
 414                 kadm5_free_key_data (contextp, &dummy, key_data);
 415                 free (key_data);
 416                 goto fail;
 417             }
 418         }
 419
 420         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 421         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 422
 423         /*
 424          * The change is only allowed if the user is on the CPW ACL,
 425          * this it to force password quality check on the user.
 426          */
 427
 428         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 429         if(ret) {
 430             int16_t dummy = n_key_data;
 431
 432             kadm5_free_key_data (contextp, &dummy, key_data);
 433             free (key_data);
 434             goto fail;
 435         }
 436         ret = kadm5_chpass_principal_with_key_3(kadm_handlep, princ, keepold,
 437                                                 n_key_data, key_data);
 438         {
 439             int16_t dummy = n_key_data;
 440             kadm5_free_key_data (contextp, &dummy, key_data);
 441         }
 442         free (key_data);
 443         krb5_storage_free(sp);
 444         sp = krb5_storage_emem();
 445         if (sp == NULL) {
 446             ret = krb5_enomem(contextp->context);
 447             goto fail;
 448         }
 449         krb5_store_int32(sp, ret);
 450         break;
 451     }
 452     case kadm_randkey:{
 453         size_t i;
 454
 455         op = "RANDKEY";
 456         ret = krb5_ret_principal(sp, &princ);
 457         if (ret)
 458             goto fail;
 459         krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
 460         krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
 461         /*
 462          * The change is allowed if at least one of:
 463          * a) it's for the principal him/herself and this was an initial ticket
 464          * b) the user is on the CPW ACL.
 465          */
 466
 467         if (initial
 468             && krb5_principal_compare (contextp->context, contextp->caller,
 469                                        princ))
 470             ret = 0;
 471         else
 472             ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
 473
 474         if (ret)
 475             goto fail;
 476
 477         /*
 478          * See comments in kadm5_c_randkey_principal() regarding the
 479          * protocol.
 480          */
 481         ret = krb5_ret_int32(sp, &keepold);
 482         if (ret != 0 && ret != HEIM_ERR_EOF)
 483             goto fail;
 484
 485         ret = krb5_ret_int32(sp, &n_ks_tuple);
 486         if (ret == HEIM_ERR_EOF) {
 487             const char *enctypes;
 488             size_t n;
 489
 490             enctypes = krb5_config_get_string(contextp->context, NULL,
 491                                               "realms",
 492                                               krb5_principal_get_realm(contextp->context,
 493                                                                        princ),
 494                                               "supported_enctypes", NULL);
 495             if (enctypes == NULL || enctypes[0] == '\0')
 496                 enctypes = "aes128-cts-hmac-sha1-96";
 497             ret = krb5_string_to_keysalts2(contextp->context, enctypes,
 498                                            &n, &ks_tuple);
 499             n_ks_tuple = n;
 500         }
 501         if (ret != 0)
 502             goto fail;
 503
 504         if (n_ks_tuple < 0) {
 505             ret = EOVERFLOW;
 506             goto fail;
 507         }
 508
 509         if ((ks_tuple = calloc(n_ks_tuple, sizeof (*ks_tuple))) == NULL) {
 510             ret = errno;
 511             goto fail;
 512         }
 513
 514         for (i = 0; i < n_ks_tuple; i++) {
 515             ret = krb5_ret_int32(sp, &ks_tuple[i].ks_enctype);
 516             if (ret != 0) {
 517                 free(ks_tuple);
 518                 goto fail;
 519             }
 520             ret = krb5_ret_int32(sp, &ks_tuple[i].ks_salttype);
 521             if (ret != 0) {
 522                 free(ks_tuple);
 523                 goto fail;
 524             }
 525         }
 526         ret = kadm5_randkey_principal_3(kadm_handlep, princ, keepold,
 527                                         n_ks_tuple, ks_tuple, &new_keys,
 528                                         &n_keys);
 529         free(ks_tuple);
 530
 531         krb5_storage_free(sp);
 532         sp = krb5_storage_emem();
 533         if (sp == NULL) {
 534             ret = krb5_enomem(contextp->context);
 535             goto fail;
 536         }
 537         krb5_store_int32(sp, ret);
 538         if (ret == 0){
 539             krb5_store_int32(sp, n_keys);
 540             for (i = 0; i < n_keys; i++){
 541                 if (ret == 0)
 542                     ret = krb5_store_keyblock(sp, new_keys[i]);
 543                 krb5_free_keyblock_contents(contextp->context, &new_keys[i]);
 544             }
 545             free(new_keys);
 546         }
 547         break;
 548     }
 549     case kadm_get_privs:{
 550         uint32_t privs;
 551         ret = kadm5_get_privs(kadm_handlep, &privs);
 552         krb5_storage_free(sp);
 553         sp = krb5_storage_emem();
 554         if (sp == NULL) {
 555             ret = krb5_enomem(contextp->context);
 556             goto fail;
 557         }
 558         krb5_store_int32(sp, ret);
 559         if(ret == 0)
 560             krb5_store_uint32(sp, privs);
 561         break;
 562     }
 563     case kadm_get_princs:{
 564         op = "LIST";
 565         ret = krb5_ret_int32(sp, &tmp);
 566         if(ret)
 567             goto fail;
 568         if(tmp){
 569             ret = krb5_ret_string(sp, &expression);
 570             if(ret)
 571                 goto fail;
 572         }else
 573             expression = NULL;
 574         krb5_warnx(contextp->context, "%s: %s %s", client, op,
 575                    expression ? expression : "*");
 576         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_LIST, NULL);
 577         if(ret){
 578             free(expression);
 579             goto fail;
 580         }
 581         ret = kadm5_get_principals(kadm_handlep, expression, &princs, &n_princs);
 582         free(expression);
 583         krb5_storage_free(sp);
 584         sp = krb5_storage_emem();
 585         if (sp == NULL) {
 586             ret = krb5_enomem(contextp->context);
 587             goto fail;
 588         }
 589         krb5_store_int32(sp, ret);
 590         if(ret == 0){
 591             int i;
 592             krb5_store_int32(sp, n_princs);
 593             for(i = 0; i < n_princs; i++)
 594                 krb5_store_string(sp, princs[i]);
 595             kadm5_free_name_list(kadm_handlep, princs, &n_princs);
 596         }
 597         break;
 598     }
 599     default:
 600         krb5_warnx(contextp->context, "%s: UNKNOWN OP %d", client, cmd);
 601         krb5_storage_free(sp);
 602         sp = krb5_storage_emem();
 603         if (sp == NULL) {
 604             ret = krb5_enomem(contextp->context);
 605             goto fail;
 606         }
 607         krb5_store_int32(sp, KADM5_FAILURE);
 608         break;
 609     }
 610     if (password != NULL) {
 611         len = strlen(password);
 612         memset_s(password, len, 0, len);
 613         free(password);
 614     }
 615     krb5_storage_to_data(sp, out);
 616     krb5_storage_free(sp);
 617     if (princ != NULL)
 618         krb5_free_principal(contextp->context, princ);
 619     if (princ2 != NULL)
 620         krb5_free_principal(contextp->context, princ2);
 621     return 0;
 622 fail:
 623     if (password != NULL) {
 624         len = strlen(password);
 625         memset_s(password, len, 0, len);
 626         free(password);
 627     }
 628     krb5_warn(contextp->context, ret, "%s", op);
 629     if (sp != NULL) {
 630         krb5_storage_seek(sp, 0, SEEK_SET);
 631         krb5_store_int32(sp, ret);
 632         krb5_storage_to_data(sp, out);
 633         krb5_storage_free(sp);
 634     }
 635     if (princ != NULL)
 636         krb5_free_principal(contextp->context, princ);
 637     if (princ2 != NULL)
 638         krb5_free_principal(contextp->context, princ2);
 639     return 0;
 640 }
 641
 642 struct iter_aliases_ctx {
 643     HDB_Ext_Aliases aliases;
 644     krb5_tl_data *tl;
 645     int alias_idx;
 646     int done;
 647 };
 648
 649 static kadm5_ret_t
 650 iter_aliases(kadm5_principal_ent_rec *from,
 651              struct iter_aliases_ctx *ctx,
 652              krb5_principal *out)
 653 {
 654     HDB_extension ext;
 655     kadm5_ret_t ret;
 656     size_t size;
 657
 658     *out = NULL;
 659
 660     if (ctx->done > 0)
 661         return 0;
 662
 663     if (ctx->done == 0) {
 664         if (ctx->alias_idx < ctx->aliases.aliases.len) {
 665             *out = &ctx->aliases.aliases.val[ctx->alias_idx++];
 666             return 0;
 667         }
 668         /* Out of aliases in this TL, step to next TL */
 669         ctx->tl = ctx->tl->tl_data_next;
 670     } else if (ctx->done < 0) {
 671         /* Setup iteration context */
 672         memset(ctx, 0, sizeof(*ctx));
 673         ctx->done = 0;
 674         ctx->aliases.aliases.val = NULL;
 675         ctx->aliases.aliases.len = 0;
 676         ctx->tl = from->tl_data;
 677     }
 678
 679     free_HDB_Ext_Aliases(&ctx->aliases);
 680     ctx->alias_idx = 0;
 681
 682     /* Find TL with aliases */
 683     for (; ctx->tl != NULL; ctx->tl = ctx->tl->tl_data_next) {
 684         if (ctx->tl->tl_data_type != KRB5_TL_EXTENSION)
 685             continue;
 686
 687         ret = decode_HDB_extension(ctx->tl->tl_data_contents,
 688                                    ctx->tl->tl_data_length,
 689                                    &ext, &size);
 690         if (ret)
 691             return ret;
 692         if (ext.data.element == choice_HDB_extension_data_aliases &&
 693             ext.data.u.aliases.aliases.len > 0) {
 694             ctx->aliases = ext.data.u.aliases;
 695             break;
 696         }
 697         free_HDB_extension(&ext);
 698     }
 699
 700     if (ctx->tl != NULL && ctx->aliases.aliases.len > 0) {
 701         *out = &ctx->aliases.aliases.val[ctx->alias_idx++];
 702         return 0;
 703     }
 704
 705     ctx->done = 1;
 706     return 0;
 707 }
 708
 709 static kadm5_ret_t
 710 check_aliases(kadm5_server_context *contextp,
 711               kadm5_principal_ent_rec *add_princ,
 712               kadm5_principal_ent_rec *del_princ)
 713 {
 714     kadm5_ret_t ret;
 715     struct iter_aliases_ctx iter;
 716     struct iter_aliases_ctx iter_del;
 717     krb5_principal new_name, old_name;
 718     int match;
 719
 720     /*
 721      * Yeah, this is O(N^2).  Gathering and sorting all the aliases
 722      * would be a bit of a pain; if we ever have principals with enough
 723      * aliases for this to be a problem, we can fix it then.
 724      */
 725     for (iter.done = -1; iter.done != 1;) {
 726         match = 0;
 727         ret = iter_aliases(add_princ, &iter, &new_name);
 728         if (ret)
 729             return ret;
 730         if (iter.done == 1)
 731             break;
 732         for (iter_del.done = -1; iter_del.done != 1;) {
 733             ret = iter_aliases(del_princ, &iter_del, &old_name);
 734             if (ret)
 735                 return ret;
 736             if (iter_del.done == 1)
 737                 break;
 738             if (!krb5_principal_compare(contextp->context, new_name, old_name))
 739                 continue;
 740             free_HDB_Ext_Aliases(&iter_del.aliases);
 741             match = 1;
 742             break;
 743         }
 744         if (match)
 745             continue;
 746         ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_ADD, new_name);
 747         if (ret) {
 748             free_HDB_Ext_Aliases(&iter.aliases);
 749             return ret;
 750         }
 751     }
 752
 753     return 0;
 754 }
 755
 756 static void
 757 v5_loop (krb5_context contextp,
 758          krb5_auth_context ac,
 759          krb5_boolean initial,
 760          void *kadm_handlep,
 761          krb5_socket_t fd)
 762 {
 763     krb5_error_code ret;
 764     krb5_data in, out;
 765
 766     for (;;) {
 767         doing_useful_work = 0;
 768         if(term_flag)
 769             exit(0);
 770         ret = krb5_read_priv_message(contextp, ac, &fd, &in);
 771         if(ret == HEIM_ERR_EOF)
 772             exit(0);
 773         if(ret)
 774             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 775         doing_useful_work = 1;
 776         ret = kadmind_dispatch(kadm_handlep, initial, &in, &out);
 777         if (ret)
 778             krb5_err(contextp, 1, ret, "kadmind_dispatch");
 779         krb5_data_free(&in);
 780         ret = krb5_write_priv_message(contextp, ac, &fd, &out);
 781         krb5_data_free(&out);
 782         if(ret)
 783             krb5_err(contextp, 1, ret, "krb5_write_priv_message");
 784     }
 785 }
 786
 787 static krb5_boolean
 788 match_appl_version(const void *data, const char *appl_version)
 789 {
 790     unsigned minor;
 791     if(sscanf(appl_version, "KADM0.%u", &minor) != 1)
 792         return 0;
 793     /*XXX*/
 794     *(unsigned*)(intptr_t)data = minor;
 795     return 1;
 796 }
 797
 798 static void
 799 handle_v5(krb5_context contextp,
 800           krb5_keytab keytab,
 801           krb5_socket_t fd)
 802 {
 803     krb5_error_code ret;
 804     krb5_ticket *ticket;
 805     char *server_name;
 806     char *client;
 807     void *kadm_handlep;
 808     krb5_boolean initial;
 809     krb5_auth_context ac = NULL;
 810
 811     unsigned kadm_version = 1;
 812     kadm5_config_params realm_params;
 813
 814     ret = krb5_recvauth_match_version(contextp, &ac, &fd,
 815                                       match_appl_version, &kadm_version,
 816                                       NULL, KRB5_RECVAUTH_IGNORE_VERSION,
 817                                       keytab, &ticket);
 818     if (ret)
 819         krb5_err(contextp, 1, ret, "krb5_recvauth");
 820
 821     ret = krb5_unparse_name (contextp, ticket->server, &server_name);
 822     if (ret)
 823         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 824
 825     if (strncmp (server_name, KADM5_ADMIN_SERVICE,
 826                  strlen(KADM5_ADMIN_SERVICE)) != 0)
 827         krb5_errx (contextp, 1, "ticket for strange principal (%s)",
 828                    server_name);
 829
 830     free (server_name);
 831
 832     memset(&realm_params, 0, sizeof(realm_params));
 833
 834     if(kadm_version == 1) {
 835         krb5_data params;
 836         ret = krb5_read_priv_message(contextp, ac, &fd, &params);
 837         if(ret)
 838             krb5_err(contextp, 1, ret, "krb5_read_priv_message");
 839         _kadm5_unmarshal_params(contextp, &params, &realm_params);
 840     }
 841
 842     initial = ticket->ticket.flags.initial;
 843     ret = krb5_unparse_name(contextp, ticket->client, &client);
 844     if (ret)
 845         krb5_err (contextp, 1, ret, "krb5_unparse_name");
 846     krb5_free_ticket (contextp, ticket);
 847     ret = kadm5_s_init_with_password_ctx(contextp,
 848                                          client,
 849                                          NULL,
 850                                          KADM5_ADMIN_SERVICE,
 851                                          &realm_params,
 852                                          0, 0,
 853                                          &kadm_handlep);
 854     if(ret)
 855         krb5_err (contextp, 1, ret, "kadm5_init_with_password_ctx");
 856     v5_loop (contextp, ac, initial, kadm_handlep, fd);
 857 }
 858
 859 krb5_error_code
 860 kadmind_loop(krb5_context contextp,
 861              krb5_keytab keytab,
 862              krb5_socket_t sock)
 863 {
 864     u_char buf[sizeof(KRB5_SENDAUTH_VERSION) + 4];
 865     ssize_t n;
 866     unsigned long len;
 867
 868     n = krb5_net_read(contextp, &sock, buf, 4);
 869     if(n == 0)
 870         exit(0);
 871     if(n < 0)
 872         krb5_err(contextp, 1, errno, "read");
 873     _krb5_get_int(buf, &len, 4);
 874
 875     if (len == sizeof(KRB5_SENDAUTH_VERSION)) {
 876
 877         n = krb5_net_read(contextp, &sock, buf + 4, len);
 878         if (n < 0)
 879             krb5_err (contextp, 1, errno, "reading sendauth version");
 880         if (n == 0)
 881             krb5_errx (contextp, 1, "EOF reading sendauth version");
 882
 883         if(memcmp(buf + 4, KRB5_SENDAUTH_VERSION, len) == 0) {
 884             handle_v5(contextp, keytab, sock);
 885             return 0;
 886         }
 887         len += 4;
 888     } else
 889         len = 4;
 890
 891     handle_mit(contextp, buf, len, sock);
 892
 893     return 0;
 894 }
 895