kdc/windc.c

   1 /*
   2  * Copyright (c) 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kdc_locl.h"
  35
  36 static int have_plugin = 0;
  37
  38 /*
  39  * Pick the first WINDC module that we find.
  40  */
  41
  42 static const char *windc_plugin_deps[] = {
  43     "kdc",
  44     "krb5",
  45     "hdb",
  46     NULL
  47 };
  48
  49 static struct heim_plugin_data windc_plugin_data = {
  50     "krb5",
  51     "windc",
  52     KRB5_WINDC_PLUGIN_MINOR,
  53     windc_plugin_deps,
  54     kdc_get_instance
  55 };
  56
  57 static krb5_error_code KRB5_LIB_CALL
  58 load(krb5_context context, const void *plug, void *plugctx, void *userctx)
  59 {
  60     have_plugin = 1;
  61     return KRB5_PLUGIN_NO_HANDLE;
  62 }
  63
  64 krb5_error_code
  65 krb5_kdc_windc_init(krb5_context context)
  66 {
  67     (void)_krb5_plugin_run_f(context, &windc_plugin_data, 0, NULL, load);
  68
  69     return 0;
  70 }
  71
  72 struct generate_uc {
  73     hdb_entry_ex *client;
  74     krb5_pac *pac;
  75 };
  76
  77 static krb5_error_code KRB5_LIB_CALL
  78 generate(krb5_context context, const void *plug, void *plugctx, void *userctx)
  79 {
  80     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
  81     struct generate_uc *uc = (struct generate_uc *)userctx;
  82
  83     if (ft->pac_generate == NULL)
  84         return KRB5_PLUGIN_NO_HANDLE;
  85     return ft->pac_generate((void *)plug, context, uc->client, uc->pac);
  86 }
  87
  88
  89 krb5_error_code
  90 _kdc_pac_generate(krb5_context context,
  91                   hdb_entry_ex *client,
  92                   krb5_pac *pac)
  93 {
  94     struct generate_uc uc;
  95
  96     if (!have_plugin)
  97         return 0;
  98
  99     uc.client = client;
 100     uc.pac = pac;
 101
 102     (void)_krb5_plugin_run_f(context, &windc_plugin_data,
 103                              0, &uc, generate);
 104     return 0;
 105 }
 106
 107 struct verify_uc {
 108     krb5_principal client_principal;
 109     krb5_principal delegated_proxy_principal;
 110     hdb_entry_ex *client;
 111     hdb_entry_ex *server;
 112     hdb_entry_ex *krbtgt;
 113     krb5_pac *pac;
 114     int *verified;
 115 };
 116
 117 static krb5_error_code KRB5_LIB_CALL
 118 verify(krb5_context context, const void *plug, void *plugctx, void *userctx)
 119 {
 120     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
 121     struct verify_uc *uc = (struct verify_uc *)userctx;
 122     krb5_error_code ret;
 123
 124     if (ft->pac_verify == NULL)
 125         return KRB5_PLUGIN_NO_HANDLE;
 126     ret = ft->pac_verify((void *)plug, context,
 127                          uc->client_principal,
 128                          uc->delegated_proxy_principal,
 129                          uc->client, uc->server, uc->krbtgt, uc->pac);
 130     if (ret == 0)
 131         (*uc->verified) = 1;
 132
 133     return 0;
 134 }
 135
 136 krb5_error_code
 137 _kdc_pac_verify(krb5_context context,
 138                 const krb5_principal client_principal,
 139                 const krb5_principal delegated_proxy_principal,
 140                 hdb_entry_ex *client,
 141                 hdb_entry_ex *server,
 142                 hdb_entry_ex *krbtgt,
 143                 krb5_pac *pac,
 144                 int *verified)
 145 {
 146     struct verify_uc uc;
 147
 148     if (!have_plugin)
 149         return 0;
 150
 151     uc.client_principal = client_principal;
 152     uc.delegated_proxy_principal = delegated_proxy_principal;
 153     uc.client = client;
 154     uc.server = server;
 155     uc.krbtgt = krbtgt;
 156     uc.pac = pac;
 157     uc.verified = verified;
 158
 159     (void)_krb5_plugin_run_f(context, &windc_plugin_data,
 160                              0, &uc, verify);
 161     return 0;
 162 }
 163
 164 struct check_uc {
 165     krb5_kdc_configuration *config;
 166     hdb_entry_ex *client_ex;
 167     const char *client_name;
 168     hdb_entry_ex *server_ex;
 169     const char *server_name;
 170     KDC_REQ *req;
 171     METHOD_DATA *method_data;
 172 };
 173
 174 static krb5_error_code KRB5_LIB_CALL
 175 check(krb5_context context, const void *plug, void *plugctx, void *userctx)
 176 {
 177     krb5plugin_windc_ftable *ft = (krb5plugin_windc_ftable *)plug;
 178     struct check_uc *uc = (struct check_uc *)userctx;
 179
 180     if (ft->client_access == NULL)
 181         return KRB5_PLUGIN_NO_HANDLE;
 182     return ft->client_access((void *)plug, context, uc->config,
 183                              uc->client_ex, uc->client_name,
 184                              uc->server_ex, uc->server_name,
 185                              uc->req, uc->method_data);
 186 }
 187
 188
 189 krb5_error_code
 190 _kdc_check_access(astgs_request_t r, KDC_REQ *req, METHOD_DATA *method_data)
 191 {
 192     krb5_context context = r->context;
 193     krb5_kdc_configuration *config = r->config;
 194     hdb_entry_ex *client_ex = r->client;
 195     const char *client_name = r->cname;
 196     hdb_entry_ex *server_ex = r->server;
 197     const char *server_name = r->sname;
 198     krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
 199     struct check_uc uc;
 200
 201     if (have_plugin) {
 202         uc.config = config;
 203         uc.client_ex = client_ex;
 204         uc.client_name = client_name;
 205         uc.server_ex = server_ex;
 206         uc.server_name = server_name;
 207         uc.req = req;
 208         uc.method_data = method_data;
 209
 210         ret = _krb5_plugin_run_f(context, &windc_plugin_data,
 211                                  0, &uc, check);
 212     }
 213
 214     if (ret == KRB5_PLUGIN_NO_HANDLE)
 215         return kdc_check_flags(r, req->msg_type == krb_as_req);
 216     return ret;
 217 }
 218
 219 uintptr_t KRB5_CALLCONV
 220 kdc_get_instance(const char *libname)
 221 {
 222     static const char *instance = "libkdc";
 223
 224     if (strcmp(libname, "kdc") == 0)
 225         return (uintptr_t)instance;
 226     else if (strcmp(libname, "hdb") == 0)
 227         return hdb_get_instance(libname);
 228     else if (strcmp(libname, "krb5") == 0)
 229         return krb5_get_instance(libname);
 230
 231     return 0;
 232 }