2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadmin_locl.h"
35 #include <krb5-private.h>
38 kadmind_dispatch(void *kadm_handlep
, krb5_boolean initial
,
39 krb5_data
*in
, krb5_data
*out
)
42 int32_t cmd
, mask
, tmp
;
43 kadm5_server_context
*contextp
= kadm_handlep
;
44 char client
[128], name
[128], name2
[128];
46 krb5_principal princ
, princ2
;
47 kadm5_principal_ent_rec ent
;
48 char *password
, *expression
;
49 krb5_keyblock
*new_keys
;
50 krb5_key_salt_tuple
*ks_tuple
= NULL
;
51 krb5_boolean keepold
= FALSE
;
59 krb5_unparse_name_fixed(contextp
->context
, contextp
->caller
,
60 client
, sizeof(client
));
62 sp
= krb5_storage_from_data(in
);
64 krb5_errx(contextp
->context
, 1, "out of memory");
66 krb5_ret_int32(sp
, &cmd
);
70 ret
= krb5_ret_principal(sp
, &princ
);
73 ret
= krb5_ret_int32(sp
, &mask
);
75 krb5_free_principal(contextp
->context
, princ
);
78 mask
|= KADM5_PRINCIPAL
;
79 krb5_unparse_name_fixed(contextp
->context
, princ
, name
, sizeof(name
));
80 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
, name
);
82 /* If the caller doesn't have KADM5_PRIV_GET, we're done. */
83 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_GET
, princ
);
85 krb5_free_principal(contextp
->context
, princ
);
89 /* Then check to see if it is ok to return keys */
90 if ((mask
& KADM5_KEY_DATA
) != 0) {
91 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_GET_KEYS
,
95 } else if ((mask
== (KADM5_PRINCIPAL
|KADM5_KEY_DATA
)) ||
96 (mask
== (KADM5_PRINCIPAL
|KADM5_KVNO
|KADM5_KEY_DATA
))) {
98 * Requests for keys will get bogus keys, which is useful if
99 * the client just wants to see what (kvno, enctype)s the
100 * principal has keys for, but terrible if the client wants to
101 * write the keys into a keytab or modify the principal and
102 * write the bogus keys back to the server.
104 * We use a heuristic to detect which case we're handling here.
105 * If the client only asks for the flags in the above
106 * condition, then it's very likely a kadmin ext_keytab,
107 * add_enctype, or other request that should not see bogus
108 * keys. We deny them.
110 * The kadmin get command can be coaxed into making a request
111 * with the same mask. But the default long and terse output
112 * modes request other things too, so in all likelihood this
113 * heuristic will not hurt any kadmin get uses.
115 krb5_free_principal(contextp
->context
, princ
);
120 ret
= kadm5_get_principal(kadm_handlep
, princ
, &ent
, mask
);
121 krb5_storage_free(sp
);
122 sp
= krb5_storage_emem();
123 krb5_store_int32(sp
, ret
);
126 kadm5_store_principal_ent(sp
, &ent
);
128 kadm5_store_principal_ent_nokeys(sp
, &ent
);
129 kadm5_free_principal_ent(kadm_handlep
, &ent
);
131 krb5_free_principal(contextp
->context
, princ
);
136 ret
= krb5_ret_principal(sp
, &princ
);
139 krb5_unparse_name_fixed(contextp
->context
, princ
, name
, sizeof(name
));
140 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
, name
);
141 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_DELETE
, princ
);
143 krb5_free_principal(contextp
->context
, princ
);
146 ret
= kadm5_delete_principal(kadm_handlep
, princ
);
147 krb5_free_principal(contextp
->context
, princ
);
148 krb5_storage_free(sp
);
149 sp
= krb5_storage_emem();
150 krb5_store_int32(sp
, ret
);
155 ret
= kadm5_ret_principal_ent(sp
, &ent
);
158 ret
= krb5_ret_int32(sp
, &mask
);
160 kadm5_free_principal_ent(contextp
->context
, &ent
);
163 ret
= krb5_ret_string(sp
, &password
);
165 kadm5_free_principal_ent(contextp
->context
, &ent
);
168 krb5_unparse_name_fixed(contextp
->context
, ent
.principal
,
170 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
, name
);
171 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_ADD
,
174 kadm5_free_principal_ent(contextp
->context
, &ent
);
175 memset(password
, 0, strlen(password
));
179 ret
= kadm5_create_principal(kadm_handlep
, &ent
,
181 kadm5_free_principal_ent(kadm_handlep
, &ent
);
182 memset(password
, 0, strlen(password
));
184 krb5_storage_free(sp
);
185 sp
= krb5_storage_emem();
186 krb5_store_int32(sp
, ret
);
191 ret
= kadm5_ret_principal_ent(sp
, &ent
);
194 ret
= krb5_ret_int32(sp
, &mask
);
196 kadm5_free_principal_ent(contextp
, &ent
);
199 krb5_unparse_name_fixed(contextp
->context
, ent
.principal
,
201 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
, name
);
202 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_MODIFY
,
205 kadm5_free_principal_ent(contextp
, &ent
);
208 ret
= kadm5_modify_principal(kadm_handlep
, &ent
, mask
);
209 kadm5_free_principal_ent(kadm_handlep
, &ent
);
210 krb5_storage_free(sp
);
211 sp
= krb5_storage_emem();
212 krb5_store_int32(sp
, ret
);
217 ret
= krb5_ret_principal(sp
, &princ
);
220 ret
= krb5_ret_principal(sp
, &princ2
);
222 krb5_free_principal(contextp
->context
, princ
);
225 krb5_unparse_name_fixed(contextp
->context
, princ
, name
, sizeof(name
));
226 krb5_unparse_name_fixed(contextp
->context
, princ2
, name2
, sizeof(name2
));
227 krb5_warnx(contextp
->context
, "%s: %s %s -> %s",
228 client
, op
, name
, name2
);
229 ret
= _kadm5_acl_check_permission(contextp
,
232 || _kadm5_acl_check_permission(contextp
,
236 krb5_free_principal(contextp
->context
, princ
);
237 krb5_free_principal(contextp
->context
, princ2
);
240 ret
= kadm5_rename_principal(kadm_handlep
, princ
, princ2
);
241 krb5_free_principal(contextp
->context
, princ
);
242 krb5_free_principal(contextp
->context
, princ2
);
243 krb5_storage_free(sp
);
244 sp
= krb5_storage_emem();
245 krb5_store_int32(sp
, ret
);
250 ret
= krb5_ret_principal(sp
, &princ
);
253 ret
= krb5_ret_string(sp
, &password
);
255 krb5_free_principal(contextp
->context
, princ
);
258 ret
= krb5_ret_int32(sp
, &keepold
);
259 if (ret
&& ret
!= HEIM_ERR_EOF
) {
260 krb5_free_principal(contextp
->context
, princ
);
263 krb5_unparse_name_fixed(contextp
->context
, princ
, name
, sizeof(name
));
264 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
, name
);
267 * The change is allowed if at least one of:
269 * a) allowed by sysadmin
270 * b) it's for the principal him/herself and this was an
271 * initial ticket, but then, check with the password quality
273 * c) the user is on the CPW ACL.
276 if (krb5_config_get_bool_default(contextp
->context
, NULL
, TRUE
,
277 "kadmin", "allow_self_change_password", NULL
)
279 && krb5_principal_compare (contextp
->context
, contextp
->caller
,
283 const char *pwd_reason
;
285 pwd_data
.data
= password
;
286 pwd_data
.length
= strlen(password
);
288 pwd_reason
= kadm5_check_password_quality (contextp
->context
,
290 if (pwd_reason
!= NULL
)
291 ret
= KADM5_PASS_Q_DICT
;
295 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_CPW
, princ
);
298 krb5_free_principal(contextp
->context
, princ
);
299 memset(password
, 0, strlen(password
));
303 ret
= kadm5_chpass_principal_3(kadm_handlep
, princ
, keepold
, 0, NULL
,
305 krb5_free_principal(contextp
->context
, princ
);
306 memset(password
, 0, strlen(password
));
308 krb5_storage_free(sp
);
309 sp
= krb5_storage_emem();
310 krb5_store_int32(sp
, ret
);
313 case kadm_chpass_with_key
:{
315 krb5_key_data
*key_data
;
318 op
= "CHPASS_WITH_KEY";
319 ret
= krb5_ret_principal(sp
, &princ
);
322 ret
= krb5_ret_int32(sp
, &n_key_data
);
324 krb5_free_principal(contextp
->context
, princ
);
327 ret
= krb5_ret_int32(sp
, &keepold
);
328 if (ret
&& ret
!= HEIM_ERR_EOF
) {
329 krb5_free_principal(contextp
->context
, princ
);
332 /* n_key_data will be squeezed into an int16_t below. */
333 if (n_key_data
< 0 || n_key_data
>= 1 << 16 ||
334 (size_t)n_key_data
> UINT_MAX
/sizeof(*key_data
)) {
336 krb5_free_principal(contextp
->context
, princ
);
340 key_data
= malloc (n_key_data
* sizeof(*key_data
));
341 if (key_data
== NULL
&& n_key_data
!= 0) {
343 krb5_free_principal(contextp
->context
, princ
);
347 for (i
= 0; i
< n_key_data
; ++i
) {
348 ret
= kadm5_ret_key_data (sp
, &key_data
[i
]);
352 kadm5_free_key_data (contextp
, &dummy
, key_data
);
354 krb5_free_principal(contextp
->context
, princ
);
359 krb5_unparse_name_fixed(contextp
->context
, princ
, name
, sizeof(name
));
360 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
, name
);
363 * The change is only allowed if the user is on the CPW ACL,
364 * this it to force password quality check on the user.
367 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_CPW
, princ
);
369 int16_t dummy
= n_key_data
;
371 kadm5_free_key_data (contextp
, &dummy
, key_data
);
373 krb5_free_principal(contextp
->context
, princ
);
376 ret
= kadm5_chpass_principal_with_key_3(kadm_handlep
, princ
, keepold
,
377 n_key_data
, key_data
);
379 int16_t dummy
= n_key_data
;
380 kadm5_free_key_data (contextp
, &dummy
, key_data
);
383 krb5_free_principal(contextp
->context
, princ
);
384 krb5_storage_free(sp
);
385 sp
= krb5_storage_emem();
386 krb5_store_int32(sp
, ret
);
391 ret
= krb5_ret_principal(sp
, &princ
);
394 krb5_unparse_name_fixed(contextp
->context
, princ
, name
, sizeof(name
));
395 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
, name
);
397 * The change is allowed if at least one of:
398 * a) it's for the principal him/herself and this was an initial ticket
399 * b) the user is on the CPW ACL.
403 && krb5_principal_compare (contextp
->context
, contextp
->caller
,
407 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_CPW
, princ
);
410 krb5_free_principal(contextp
->context
, princ
);
415 * See comments in kadm5_c_randkey_principal() regarding the
418 ret
= krb5_ret_int32(sp
, &keepold
);
419 if (ret
!= 0 && ret
!= HEIM_ERR_EOF
) {
420 krb5_free_principal(contextp
->context
, princ
);
424 ret
= krb5_ret_int32(sp
, &n_ks_tuple
);
425 if (ret
!= 0 && ret
!= HEIM_ERR_EOF
) {
426 krb5_free_principal(contextp
->context
, princ
);
428 } else if (ret
== 0) {
431 if (n_ks_tuple
< 0) {
433 krb5_free_principal(contextp
->context
, princ
);
437 if ((ks_tuple
= calloc(n_ks_tuple
, sizeof (*ks_tuple
))) == NULL
) {
439 krb5_free_principal(contextp
->context
, princ
);
443 for (i
= 0; i
< n_ks_tuple
; i
++) {
444 ret
= krb5_ret_int32(sp
, &ks_tuple
[i
].ks_enctype
);
446 krb5_free_principal(contextp
->context
, princ
);
449 ret
= krb5_ret_int32(sp
, &ks_tuple
[i
].ks_salttype
);
451 krb5_free_principal(contextp
->context
, princ
);
456 ret
= kadm5_randkey_principal_3(kadm_handlep
, princ
, keepold
,
457 n_ks_tuple
, ks_tuple
, &new_keys
,
459 krb5_free_principal(contextp
->context
, princ
);
461 krb5_storage_free(sp
);
462 sp
= krb5_storage_emem();
463 krb5_store_int32(sp
, ret
);
466 krb5_store_int32(sp
, n_keys
);
467 for(i
= 0; i
< n_keys
; i
++){
468 krb5_store_keyblock(sp
, new_keys
[i
]);
469 krb5_free_keyblock_contents(contextp
->context
, &new_keys
[i
]);
475 case kadm_get_privs
:{
477 ret
= kadm5_get_privs(kadm_handlep
, &privs
);
478 krb5_storage_free(sp
);
479 sp
= krb5_storage_emem();
480 krb5_store_int32(sp
, ret
);
482 krb5_store_uint32(sp
, privs
);
485 case kadm_get_princs
:{
487 ret
= krb5_ret_int32(sp
, &tmp
);
491 ret
= krb5_ret_string(sp
, &expression
);
496 krb5_warnx(contextp
->context
, "%s: %s %s", client
, op
,
497 expression
? expression
: "*");
498 ret
= _kadm5_acl_check_permission(contextp
, KADM5_PRIV_LIST
, NULL
);
503 ret
= kadm5_get_principals(kadm_handlep
, expression
, &princs
, &n_princs
);
505 krb5_storage_free(sp
);
506 sp
= krb5_storage_emem();
507 krb5_store_int32(sp
, ret
);
510 krb5_store_int32(sp
, n_princs
);
511 for(i
= 0; i
< n_princs
; i
++)
512 krb5_store_string(sp
, princs
[i
]);
513 kadm5_free_name_list(kadm_handlep
, princs
, &n_princs
);
518 krb5_warnx(contextp
->context
, "%s: UNKNOWN OP %d", client
, cmd
);
519 krb5_storage_free(sp
);
520 sp
= krb5_storage_emem();
521 krb5_store_int32(sp
, KADM5_FAILURE
);
524 krb5_storage_to_data(sp
, out
);
525 krb5_storage_free(sp
);
528 krb5_warn(contextp
->context
, ret
, "%s", op
);
529 krb5_storage_seek(sp
, 0, SEEK_SET
);
530 krb5_store_int32(sp
, ret
);
531 krb5_storage_to_data(sp
, out
);
532 krb5_storage_free(sp
);
537 v5_loop (krb5_context contextp
,
538 krb5_auth_context ac
,
539 krb5_boolean initial
,
547 doing_useful_work
= 0;
550 ret
= krb5_read_priv_message(contextp
, ac
, &fd
, &in
);
551 if(ret
== HEIM_ERR_EOF
)
554 krb5_err(contextp
, 1, ret
, "krb5_read_priv_message");
555 doing_useful_work
= 1;
556 kadmind_dispatch(kadm_handlep
, initial
, &in
, &out
);
558 ret
= krb5_write_priv_message(contextp
, ac
, &fd
, &out
);
560 krb5_err(contextp
, 1, ret
, "krb5_write_priv_message");
565 match_appl_version(const void *data
, const char *appl_version
)
568 if(sscanf(appl_version
, "KADM0.%u", &minor
) != 1)
571 *(unsigned*)(intptr_t)data
= minor
;
576 handle_v5(krb5_context contextp
,
585 krb5_boolean initial
;
586 krb5_auth_context ac
= NULL
;
588 unsigned kadm_version
;
589 kadm5_config_params realm_params
;
591 ret
= krb5_recvauth_match_version(contextp
, &ac
, &fd
,
592 match_appl_version
, &kadm_version
,
593 NULL
, KRB5_RECVAUTH_IGNORE_VERSION
,
596 krb5_err(contextp
, 1, ret
, "krb5_recvauth");
598 ret
= krb5_unparse_name (contextp
, ticket
->server
, &server_name
);
600 krb5_err (contextp
, 1, ret
, "krb5_unparse_name");
602 if (strncmp (server_name
, KADM5_ADMIN_SERVICE
,
603 strlen(KADM5_ADMIN_SERVICE
)) != 0)
604 krb5_errx (contextp
, 1, "ticket for strange principal (%s)",
609 memset(&realm_params
, 0, sizeof(realm_params
));
611 if(kadm_version
== 1) {
613 ret
= krb5_read_priv_message(contextp
, ac
, &fd
, ¶ms
);
615 krb5_err(contextp
, 1, ret
, "krb5_read_priv_message");
616 _kadm5_unmarshal_params(contextp
, ¶ms
, &realm_params
);
619 initial
= ticket
->ticket
.flags
.initial
;
620 ret
= krb5_unparse_name(contextp
, ticket
->client
, &client
);
622 krb5_err (contextp
, 1, ret
, "krb5_unparse_name");
623 krb5_free_ticket (contextp
, ticket
);
624 ret
= kadm5_s_init_with_password_ctx(contextp
,
632 krb5_err (contextp
, 1, ret
, "kadm5_init_with_password_ctx");
633 v5_loop (contextp
, ac
, initial
, kadm_handlep
, fd
);
637 kadmind_loop(krb5_context contextp
,
641 u_char buf
[sizeof(KRB5_SENDAUTH_VERSION
) + 4];
645 n
= krb5_net_read(contextp
, &sock
, buf
, 4);
649 krb5_err(contextp
, 1, errno
, "read");
650 _krb5_get_int(buf
, &len
, 4);
652 if (len
== sizeof(KRB5_SENDAUTH_VERSION
)) {
654 n
= krb5_net_read(contextp
, &sock
, buf
+ 4, len
);
656 krb5_err (contextp
, 1, errno
, "reading sendauth version");
658 krb5_errx (contextp
, 1, "EOF reading sendauth version");
660 if(memcmp(buf
+ 4, KRB5_SENDAUTH_VERSION
, len
) == 0) {
661 handle_v5(contextp
, keytab
, sock
);
668 handle_mit(contextp
, buf
, len
, sock
);