kdc/windc.c

   1 /*
   2  * Copyright (c) 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kdc_locl.h"
  35
  36 static int have_plugin = 0;
  37
  38 /*
  39  * Pick the first WINDC module that we find.
  40  */
  41
  42 static krb5_error_code KRB5_LIB_CALL
  43 load(krb5_context context, const void *plug, void *plugctx, void *userctx)
  44 {
  45     have_plugin = 1;
  46     return KRB5_PLUGIN_NO_HANDLE;
  47 }
  48
  49 krb5_error_code
  50 krb5_kdc_windc_init(krb5_context context)
  51 {
  52     (void)_krb5_plugin_run_f(context, "krb5", "windc",
  53                              KRB5_WINDC_PLUGIN_MINOR, 0, NULL, load);
  54     return 0;
  55 }
  56
  57 struct generate_uc {
  58     hdb_entry_ex *client;
  59     krb5_pac *pac;
  60 };
  61
  62 static krb5_error_code KRB5_LIB_CALL
  63 generate(krb5_context context, const void *plug, void *plugctx, void *userctx)
  64 {
  65     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
  66     struct generate_uc *uc = (struct generate_uc *)userctx;
  67     return ft->pac_generate((void *)plug, context, uc->client, uc->pac);
  68 }
  69
  70
  71 krb5_error_code
  72 _kdc_pac_generate(krb5_context context,
  73                   hdb_entry_ex *client,
  74                   krb5_pac *pac)
  75 {
  76     struct generate_uc uc;
  77
  78     if (!have_plugin)
  79         return 0;
  80
  81     uc.client = client;
  82     uc.pac = pac;
  83
  84     (void)_krb5_plugin_run_f(context, "krb5", "windc",
  85                              KRB5_WINDC_PLUGIN_MINOR, 0, &uc, generate);
  86     return 0;
  87 }
  88
  89 struct verify_uc {
  90     krb5_principal client_principal;
  91     krb5_principal delegated_proxy_principal;
  92     hdb_entry_ex *client;
  93     hdb_entry_ex *server;
  94     hdb_entry_ex *krbtgt;
  95     krb5_pac *pac;
  96     int *verified;
  97 };
  98
  99 static krb5_error_code KRB5_LIB_CALL
 100 verify(krb5_context context, const void *plug, void *plugctx, void *userctx)
 101 {
 102     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
 103     struct verify_uc *uc = (struct verify_uc *)userctx;
 104     krb5_error_code ret;
 105
 106     ret = ft->pac_verify((void *)plug, context,
 107                          uc->client_principal,
 108                          uc->delegated_proxy_principal,
 109                          uc->client, uc->server, uc->krbtgt, uc->pac);
 110     if (ret == 0)
 111         (*uc->verified) = 1;
 112
 113     return 0;
 114 }
 115
 116 krb5_error_code
 117 _kdc_pac_verify(krb5_context context,
 118                 const krb5_principal client_principal,
 119                 const krb5_principal delegated_proxy_principal,
 120                 hdb_entry_ex *client,
 121                 hdb_entry_ex *server,
 122                 hdb_entry_ex *krbtgt,
 123                 krb5_pac *pac,
 124                 int *verified)
 125 {
 126     struct verify_uc uc;
 127
 128     if (!have_plugin)
 129         return 0;
 130
 131     uc.client_principal = client_principal;
 132     uc.delegated_proxy_principal = delegated_proxy_principal;
 133     uc.client = client;
 134     uc.server = server;
 135     uc.krbtgt = krbtgt;
 136     uc.pac = pac;
 137     uc.verified = verified;
 138
 139     (void)_krb5_plugin_run_f(context, "krb5", "windc",
 140                              KRB5_WINDC_PLUGIN_MINOR, 0, &uc, verify);
 141     return 0;
 142 }
 143
 144 struct check_uc {
 145     krb5_kdc_configuration *config;
 146     hdb_entry_ex *client_ex;
 147     const char *client_name;
 148     hdb_entry_ex *server_ex;
 149     const char *server_name;
 150     KDC_REQ *req;
 151     METHOD_DATA *method_data;
 152 };
 153
 154 static krb5_error_code KRB5_LIB_CALL
 155 check(krb5_context context, const void *plug, void *plugctx, void *userctx)
 156 {
 157     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
 158     struct check_uc *uc = (struct check_uc *)userctx;
 159
 160     return ft->client_access((void *)plug, context, uc->config,
 161                              uc->client_ex, uc->client_name,
 162                              uc->server_ex, uc->server_name,
 163                              uc->req, uc->method_data);
 164 }
 165
 166
 167 krb5_error_code
 168 _kdc_check_access(krb5_context context,
 169                   krb5_kdc_configuration *config,
 170                   hdb_entry_ex *client_ex, const char *client_name,
 171                   hdb_entry_ex *server_ex, const char *server_name,
 172                   KDC_REQ *req,
 173                   METHOD_DATA *method_data)
 174 {
 175     struct check_uc uc;
 176
 177     if (!have_plugin)
 178         return kdc_check_flags(context, config,
 179                                client_ex, client_name,
 180                                server_ex, server_name,
 181                                req->msg_type == krb_as_req);
 182
 183     uc.config = config;
 184     uc.client_ex = client_ex;
 185     uc.client_name = client_name;
 186     uc.server_ex = server_ex;
 187     uc.server_name = server_name;
 188     uc.req = req;
 189     uc.method_data = method_data;
 190
 191     return _krb5_plugin_run_f(context, "krb5", "windc",
 192                               KRB5_WINDC_PLUGIN_MINOR, 0, &uc, check);
 193
 194 }