2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadmin_locl.h"
35 #include <krb5-private.h>
38 kadmind_dispatch(void *kadm_handle, krb5_boolean initial,
39 krb5_data *in, krb5_data *out)
42 int32_t cmd, mask, tmp;
43 kadm5_server_context *context = kadm_handle;
44 char client[128], name[128], name2[128];
46 krb5_principal princ, princ2;
47 kadm5_principal_ent_rec ent;
48 char *password, *expression;
49 krb5_keyblock *new_keys;
55 krb5_unparse_name_fixed(context->context, context->caller,
56 client, sizeof(client));
58 sp = krb5_storage_from_data(in);
60 krb5_errx(context->context, 1, "out of memory");
62 krb5_ret_int32(sp, &cmd);
66 ret = krb5_ret_principal(sp, &princ);
69 ret = krb5_ret_int32(sp, &mask);
71 krb5_free_principal(context->context, princ);
74 mask |= KADM5_PRINCIPAL;
75 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
76 krb5_warnx(context->context, "%s: %s %s", client, op, name);
77 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_GET, princ);
79 krb5_free_principal(context->context, princ);
82 ret = kadm5_get_principal(kadm_handle, princ, &ent, mask);
83 krb5_storage_free(sp);
84 sp = krb5_storage_emem();
85 krb5_store_int32(sp, ret);
87 kadm5_store_principal_ent(sp, &ent);
88 kadm5_free_principal_ent(kadm_handle, &ent);
90 krb5_free_principal(context->context, princ);
95 ret = krb5_ret_principal(sp, &princ);
98 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
99 krb5_warnx(context->context, "%s: %s %s", client, op, name);
100 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_DELETE, princ);
102 krb5_free_principal(context->context, princ);
105 ret = kadm5_delete_principal(kadm_handle, princ);
106 krb5_free_principal(context->context, princ);
107 krb5_storage_free(sp);
108 sp = krb5_storage_emem();
109 krb5_store_int32(sp, ret);
114 ret = kadm5_ret_principal_ent(sp, &ent);
117 ret = krb5_ret_int32(sp, &mask);
119 kadm5_free_principal_ent(context->context, &ent);
122 ret = krb5_ret_string(sp, &password);
124 kadm5_free_principal_ent(context->context, &ent);
127 krb5_unparse_name_fixed(context->context, ent.principal,
129 krb5_warnx(context->context, "%s: %s %s", client, op, name);
130 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_ADD,
133 kadm5_free_principal_ent(context->context, &ent);
134 memset(password, 0, strlen(password));
138 ret = kadm5_create_principal(kadm_handle, &ent,
140 kadm5_free_principal_ent(kadm_handle, &ent);
141 memset(password, 0, strlen(password));
143 krb5_storage_free(sp);
144 sp = krb5_storage_emem();
145 krb5_store_int32(sp, ret);
150 ret = kadm5_ret_principal_ent(sp, &ent);
153 ret = krb5_ret_int32(sp, &mask);
155 kadm5_free_principal_ent(context, &ent);
158 krb5_unparse_name_fixed(context->context, ent.principal,
160 krb5_warnx(context->context, "%s: %s %s", client, op, name);
161 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_MODIFY,
164 kadm5_free_principal_ent(context, &ent);
167 ret = kadm5_modify_principal(kadm_handle, &ent, mask);
168 kadm5_free_principal_ent(kadm_handle, &ent);
169 krb5_storage_free(sp);
170 sp = krb5_storage_emem();
171 krb5_store_int32(sp, ret);
176 ret = krb5_ret_principal(sp, &princ);
179 ret = krb5_ret_principal(sp, &princ2);
181 krb5_free_principal(context->context, princ);
184 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
185 krb5_unparse_name_fixed(context->context, princ2, name2, sizeof(name2));
186 krb5_warnx(context->context, "%s: %s %s -> %s",
187 client, op, name, name2);
188 ret = _kadm5_acl_check_permission(context,
191 || _kadm5_acl_check_permission(context,
195 krb5_free_principal(context->context, princ);
196 krb5_free_principal(context->context, princ2);
199 ret = kadm5_rename_principal(kadm_handle, princ, princ2);
200 krb5_free_principal(context->context, princ);
201 krb5_free_principal(context->context, princ2);
202 krb5_storage_free(sp);
203 sp = krb5_storage_emem();
204 krb5_store_int32(sp, ret);
209 ret = krb5_ret_principal(sp, &princ);
212 ret = krb5_ret_string(sp, &password);
214 krb5_free_principal(context->context, princ);
217 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
218 krb5_warnx(context->context, "%s: %s %s", client, op, name);
221 * The change is allowed if at least one of:
223 * a) it's for the principal him/herself and this was an
224 * initial ticket, but then, check with the password quality
226 * b) the user is on the CPW ACL.
230 && krb5_principal_compare (context->context, context->caller,
234 const char *pwd_reason;
236 pwd_data.data = password;
237 pwd_data.length = strlen(password);
239 pwd_reason = kadm5_check_password_quality (context->context,
241 if (pwd_reason != NULL)
242 ret = KADM5_PASS_Q_DICT;
246 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ);
249 krb5_free_principal(context->context, princ);
250 memset(password, 0, strlen(password));
254 ret = kadm5_chpass_principal(kadm_handle, princ, password);
255 krb5_free_principal(context->context, princ);
256 memset(password, 0, strlen(password));
258 krb5_storage_free(sp);
259 sp = krb5_storage_emem();
260 krb5_store_int32(sp, ret);
263 case kadm_chpass_with_key:{
265 krb5_key_data *key_data;
268 op = "CHPASS_WITH_KEY";
269 ret = krb5_ret_principal(sp, &princ);
272 ret = krb5_ret_int32(sp, &n_key_data);
274 krb5_free_principal(context->context, princ);
277 /* n_key_data will be squeezed into an int16_t below. */
278 if (n_key_data < 0 || n_key_data >= 1 << 16 ||
279 n_key_data > UINT_MAX/sizeof(*key_data)) {
281 krb5_free_principal(context->context, princ);
285 key_data = malloc (n_key_data * sizeof(*key_data));
286 if (key_data == NULL && n_key_data != 0) {
288 krb5_free_principal(context->context, princ);
292 for (i = 0; i < n_key_data; ++i) {
293 ret = kadm5_ret_key_data (sp, &key_data[i]);
297 kadm5_free_key_data (context, &dummy, key_data);
299 krb5_free_principal(context->context, princ);
304 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
305 krb5_warnx(context->context, "%s: %s %s", client, op, name);
308 * The change is only allowed if the user is on the CPW ACL,
309 * this it to force password quality check on the user.
312 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ);
314 int16_t dummy = n_key_data;
316 kadm5_free_key_data (context, &dummy, key_data);
318 krb5_free_principal(context->context, princ);
321 ret = kadm5_chpass_principal_with_key(kadm_handle, princ,
322 n_key_data, key_data);
324 int16_t dummy = n_key_data;
325 kadm5_free_key_data (context, &dummy, key_data);
328 krb5_free_principal(context->context, princ);
329 krb5_storage_free(sp);
330 sp = krb5_storage_emem();
331 krb5_store_int32(sp, ret);
336 ret = krb5_ret_principal(sp, &princ);
339 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
340 krb5_warnx(context->context, "%s: %s %s", client, op, name);
342 * The change is allowed if at least one of:
343 * a) it's for the principal him/herself and this was an initial ticket
344 * b) the user is on the CPW ACL.
348 && krb5_principal_compare (context->context, context->caller,
352 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ);
355 krb5_free_principal(context->context, princ);
358 ret = kadm5_randkey_principal(kadm_handle, princ,
360 krb5_free_principal(context->context, princ);
361 krb5_storage_free(sp);
362 sp = krb5_storage_emem();
363 krb5_store_int32(sp, ret);
366 krb5_store_int32(sp, n_keys);
367 for(i = 0; i < n_keys; i++){
368 krb5_store_keyblock(sp, new_keys[i]);
369 krb5_free_keyblock_contents(context->context, &new_keys[i]);
375 case kadm_get_privs:{
377 ret = kadm5_get_privs(kadm_handle, &privs);
378 krb5_storage_free(sp);
379 sp = krb5_storage_emem();
380 krb5_store_int32(sp, ret);
382 krb5_store_uint32(sp, privs);
385 case kadm_get_princs:{
387 ret = krb5_ret_int32(sp, &tmp);
391 ret = krb5_ret_string(sp, &expression);
396 krb5_warnx(context->context, "%s: %s %s", client, op,
397 expression ? expression : "*");
398 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_LIST, NULL);
403 ret = kadm5_get_principals(kadm_handle, expression, &princs, &n_princs);
405 krb5_storage_free(sp);
406 sp = krb5_storage_emem();
407 krb5_store_int32(sp, ret);
410 krb5_store_int32(sp, n_princs);
411 for(i = 0; i < n_princs; i++)
412 krb5_store_string(sp, princs[i]);
413 kadm5_free_name_list(kadm_handle, princs, &n_princs);
418 krb5_warnx(context->context, "%s: UNKNOWN OP %d", client, cmd);
419 krb5_storage_free(sp);
420 sp = krb5_storage_emem();
421 krb5_store_int32(sp, KADM5_FAILURE);
424 krb5_storage_to_data(sp, out);
425 krb5_storage_free(sp);
428 krb5_warn(context->context, ret, "%s", op);
429 krb5_storage_seek(sp, 0, SEEK_SET);
430 krb5_store_int32(sp, ret);
431 krb5_storage_to_data(sp, out);
432 krb5_storage_free(sp);
437 v5_loop (krb5_context context,
438 krb5_auth_context ac,
439 krb5_boolean initial,
447 doing_useful_work = 0;
450 ret = krb5_read_priv_message(context, ac, &fd, &in);
451 if(ret == HEIM_ERR_EOF)
454 krb5_err(context, 1, ret, "krb5_read_priv_message");
455 doing_useful_work = 1;
456 kadmind_dispatch(kadm_handle, initial, &in, &out);
458 ret = krb5_write_priv_message(context, ac, &fd, &out);
460 krb5_err(context, 1, ret, "krb5_write_priv_message");
465 match_appl_version(const void *data, const char *appl_version)
468 if(sscanf(appl_version, "KADM0.%u", &minor) != 1)
470 *(unsigned*)data = minor;
475 handle_v5(krb5_context context,
484 krb5_boolean initial;
485 krb5_auth_context ac = NULL;
487 unsigned kadm_version;
488 kadm5_config_params realm_params;
490 ret = krb5_recvauth_match_version(context, &ac, &fd,
491 match_appl_version, &kadm_version,
492 NULL, KRB5_RECVAUTH_IGNORE_VERSION,
494 if(ret == KRB5_KT_NOTFOUND)
495 krb5_errx(context, 1, "krb5_recvauth: key not found");
497 krb5_err(context, 1, ret, "krb5_recvauth");
499 ret = krb5_unparse_name (context, ticket->server, &server_name);
501 krb5_err (context, 1, ret, "krb5_unparse_name");
503 if (strncmp (server_name, KADM5_ADMIN_SERVICE,
504 strlen(KADM5_ADMIN_SERVICE)) != 0)
505 krb5_errx (context, 1, "ticket for strange principal (%s)",
510 memset(&realm_params, 0, sizeof(realm_params));
512 if(kadm_version == 1) {
514 ret = krb5_read_priv_message(context, ac, &fd, ¶ms);
516 krb5_err(context, 1, ret, "krb5_read_priv_message");
517 _kadm5_unmarshal_params(context, ¶ms, &realm_params);
520 initial = ticket->ticket.flags.initial;
521 ret = krb5_unparse_name(context, ticket->client, &client);
523 krb5_err (context, 1, ret, "krb5_unparse_name");
524 krb5_free_ticket (context, ticket);
525 ret = kadm5_s_init_with_password_ctx(context,
533 krb5_err (context, 1, ret, "kadm5_init_with_password_ctx");
534 v5_loop (context, ac, initial, kadm_handle, fd);
538 kadmind_loop(krb5_context context,
542 u_char buf[sizeof(KRB5_SENDAUTH_VERSION) + 4];
546 n = krb5_net_read(context, &sock, buf, 4);
550 krb5_err(context, 1, errno, "read");
551 _krb5_get_int(buf, &len, 4);
553 if (len == sizeof(KRB5_SENDAUTH_VERSION)) {
555 n = krb5_net_read(context, &sock, buf + 4, len);
557 krb5_err (context, 1, errno, "reading sendauth version");
559 krb5_errx (context, 1, "EOF reading sendauth version");
561 if(memcmp(buf + 4, KRB5_SENDAUTH_VERSION, len) == 0) {
562 handle_v5(context, keytab, sock);
569 handle_mit(context, buf, len, sock);