2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadmin_locl.h"
35 #include <krb5-private.h>
37 RCSID("$Id: server.c 17611 2006-06-02 22:10:21Z lha $");
40 kadmind_dispatch(void *kadm_handle, krb5_boolean initial,
41 krb5_data *in, krb5_data *out)
44 int32_t cmd, mask, tmp;
45 kadm5_server_context *context = kadm_handle;
46 char client[128], name[128], name2[128];
48 krb5_principal princ, princ2;
49 kadm5_principal_ent_rec ent;
50 char *password, *expression;
51 krb5_keyblock *new_keys;
57 krb5_unparse_name_fixed(context->context, context->caller,
58 client, sizeof(client));
60 sp = krb5_storage_from_data(in);
62 krb5_ret_int32(sp, &cmd);
66 ret = krb5_ret_principal(sp, &princ);
69 ret = krb5_ret_int32(sp, &mask);
71 krb5_free_principal(context->context, princ);
74 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
75 krb5_warnx(context->context, "%s: %s %s", client, op, name);
76 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_GET, princ);
78 krb5_free_principal(context->context, princ);
81 ret = kadm5_get_principal(kadm_handle, princ, &ent, mask);
82 krb5_storage_free(sp);
83 sp = krb5_storage_emem();
84 krb5_store_int32(sp, ret);
86 kadm5_store_principal_ent(sp, &ent);
87 kadm5_free_principal_ent(kadm_handle, &ent);
89 krb5_free_principal(context->context, princ);
94 ret = krb5_ret_principal(sp, &princ);
97 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
98 krb5_warnx(context->context, "%s: %s %s", client, op, name);
99 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_DELETE, princ);
101 krb5_free_principal(context->context, princ);
104 ret = kadm5_delete_principal(kadm_handle, princ);
105 krb5_free_principal(context->context, princ);
106 krb5_storage_free(sp);
107 sp = krb5_storage_emem();
108 krb5_store_int32(sp, ret);
113 ret = kadm5_ret_principal_ent(sp, &ent);
116 ret = krb5_ret_int32(sp, &mask);
118 kadm5_free_principal_ent(context->context, &ent);
121 ret = krb5_ret_string(sp, &password);
123 kadm5_free_principal_ent(context->context, &ent);
126 krb5_unparse_name_fixed(context->context, ent.principal,
128 krb5_warnx(context->context, "%s: %s %s", client, op, name);
129 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_ADD,
132 kadm5_free_principal_ent(context->context, &ent);
133 memset(password, 0, strlen(password));
137 ret = kadm5_create_principal(kadm_handle, &ent,
139 kadm5_free_principal_ent(kadm_handle, &ent);
140 memset(password, 0, strlen(password));
142 krb5_storage_free(sp);
143 sp = krb5_storage_emem();
144 krb5_store_int32(sp, ret);
149 ret = kadm5_ret_principal_ent(sp, &ent);
152 ret = krb5_ret_int32(sp, &mask);
154 kadm5_free_principal_ent(context, &ent);
157 krb5_unparse_name_fixed(context->context, ent.principal,
159 krb5_warnx(context->context, "%s: %s %s", client, op, name);
160 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_MODIFY,
163 kadm5_free_principal_ent(context, &ent);
166 ret = kadm5_modify_principal(kadm_handle, &ent, mask);
167 kadm5_free_principal_ent(kadm_handle, &ent);
168 krb5_storage_free(sp);
169 sp = krb5_storage_emem();
170 krb5_store_int32(sp, ret);
175 ret = krb5_ret_principal(sp, &princ);
178 ret = krb5_ret_principal(sp, &princ2);
180 krb5_free_principal(context->context, princ);
183 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
184 krb5_unparse_name_fixed(context->context, princ2, name2, sizeof(name2));
185 krb5_warnx(context->context, "%s: %s %s -> %s",
186 client, op, name, name2);
187 ret = _kadm5_acl_check_permission(context,
190 || _kadm5_acl_check_permission(context,
194 krb5_free_principal(context->context, princ);
195 krb5_free_principal(context->context, princ2);
198 ret = kadm5_rename_principal(kadm_handle, princ, princ2);
199 krb5_free_principal(context->context, princ);
200 krb5_free_principal(context->context, princ2);
201 krb5_storage_free(sp);
202 sp = krb5_storage_emem();
203 krb5_store_int32(sp, ret);
208 ret = krb5_ret_principal(sp, &princ);
211 ret = krb5_ret_string(sp, &password);
213 krb5_free_principal(context->context, princ);
216 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
217 krb5_warnx(context->context, "%s: %s %s", client, op, name);
220 * The change is allowed if at least one of:
222 * a) it's for the principal him/herself and this was an
223 * initial ticket, but then, check with the password quality
225 * b) the user is on the CPW ACL.
229 && krb5_principal_compare (context->context, context->caller,
233 const char *pwd_reason;
235 pwd_data.data = password;
236 pwd_data.length = strlen(password);
238 pwd_reason = kadm5_check_password_quality (context->context,
240 if (pwd_reason != NULL)
241 ret = KADM5_PASS_Q_DICT;
245 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ);
248 krb5_free_principal(context->context, princ);
249 memset(password, 0, strlen(password));
253 ret = kadm5_chpass_principal(kadm_handle, princ, password);
254 krb5_free_principal(context->context, princ);
255 memset(password, 0, strlen(password));
257 krb5_storage_free(sp);
258 sp = krb5_storage_emem();
259 krb5_store_int32(sp, ret);
262 case kadm_chpass_with_key:{
264 krb5_key_data *key_data;
267 op = "CHPASS_WITH_KEY";
268 ret = krb5_ret_principal(sp, &princ);
271 ret = krb5_ret_int32(sp, &n_key_data);
273 krb5_free_principal(context->context, princ);
276 /* n_key_data will be squeezed into an int16_t below. */
277 if (n_key_data < 0 || n_key_data >= 1 << 16 ||
278 n_key_data > UINT_MAX/sizeof(*key_data)) {
280 krb5_free_principal(context->context, princ);
284 key_data = malloc (n_key_data * sizeof(*key_data));
285 if (key_data == NULL) {
287 krb5_free_principal(context->context, princ);
291 for (i = 0; i < n_key_data; ++i) {
292 ret = kadm5_ret_key_data (sp, &key_data[i]);
296 kadm5_free_key_data (context, &dummy, key_data);
298 krb5_free_principal(context->context, princ);
303 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
304 krb5_warnx(context->context, "%s: %s %s", client, op, name);
307 * The change is only allowed if the user is on the CPW ACL,
308 * this it to force password quality check on the user.
311 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ);
313 int16_t dummy = n_key_data;
315 kadm5_free_key_data (context, &dummy, key_data);
317 krb5_free_principal(context->context, princ);
320 ret = kadm5_chpass_principal_with_key(kadm_handle, princ,
321 n_key_data, key_data);
323 int16_t dummy = n_key_data;
324 kadm5_free_key_data (context, &dummy, key_data);
327 krb5_free_principal(context->context, princ);
328 krb5_storage_free(sp);
329 sp = krb5_storage_emem();
330 krb5_store_int32(sp, ret);
335 ret = krb5_ret_principal(sp, &princ);
338 krb5_unparse_name_fixed(context->context, princ, name, sizeof(name));
339 krb5_warnx(context->context, "%s: %s %s", client, op, name);
341 * The change is allowed if at least one of:
342 * a) it's for the principal him/herself and this was an initial ticket
343 * b) the user is on the CPW ACL.
347 && krb5_principal_compare (context->context, context->caller,
351 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ);
354 krb5_free_principal(context->context, princ);
357 ret = kadm5_randkey_principal(kadm_handle, princ,
359 krb5_free_principal(context->context, princ);
360 krb5_storage_free(sp);
361 sp = krb5_storage_emem();
362 krb5_store_int32(sp, ret);
365 krb5_store_int32(sp, n_keys);
366 for(i = 0; i < n_keys; i++){
367 krb5_store_keyblock(sp, new_keys[i]);
368 krb5_free_keyblock_contents(context->context, &new_keys[i]);
373 case kadm_get_privs:{
375 ret = kadm5_get_privs(kadm_handle, &privs);
376 krb5_storage_free(sp);
377 sp = krb5_storage_emem();
378 krb5_store_int32(sp, ret);
380 krb5_store_uint32(sp, privs);
383 case kadm_get_princs:{
385 ret = krb5_ret_int32(sp, &tmp);
389 ret = krb5_ret_string(sp, &expression);
394 krb5_warnx(context->context, "%s: %s %s", client, op,
395 expression ? expression : "*");
396 ret = _kadm5_acl_check_permission(context, KADM5_PRIV_LIST, NULL);
401 ret = kadm5_get_principals(kadm_handle, expression, &princs, &n_princs);
403 krb5_storage_free(sp);
404 sp = krb5_storage_emem();
405 krb5_store_int32(sp, ret);
408 krb5_store_int32(sp, n_princs);
409 for(i = 0; i < n_princs; i++)
410 krb5_store_string(sp, princs[i]);
411 kadm5_free_name_list(kadm_handle, princs, &n_princs);
416 krb5_warnx(context->context, "%s: UNKNOWN OP %d", client, cmd);
417 krb5_storage_free(sp);
418 sp = krb5_storage_emem();
419 krb5_store_int32(sp, KADM5_FAILURE);
422 krb5_storage_to_data(sp, out);
423 krb5_storage_free(sp);
426 krb5_warn(context->context, ret, "%s", op);
427 krb5_storage_seek(sp, 0, SEEK_SET);
428 krb5_store_int32(sp, ret);
429 krb5_storage_to_data(sp, out);
430 krb5_storage_free(sp);
435 v5_loop (krb5_context context,
436 krb5_auth_context ac,
437 krb5_boolean initial,
445 doing_useful_work = 0;
448 ret = krb5_read_priv_message(context, ac, &fd, &in);
449 if(ret == HEIM_ERR_EOF)
452 krb5_err(context, 1, ret, "krb5_read_priv_message");
453 doing_useful_work = 1;
454 kadmind_dispatch(kadm_handle, initial, &in, &out);
456 ret = krb5_write_priv_message(context, ac, &fd, &out);
458 krb5_err(context, 1, ret, "krb5_write_priv_message");
463 match_appl_version(const void *data, const char *appl_version)
466 if(sscanf(appl_version, "KADM0.%u", &minor) != 1)
468 *(unsigned*)data = minor;
473 handle_v5(krb5_context context,
474 krb5_auth_context ac,
480 u_char version[sizeof(KRB5_SENDAUTH_VERSION)];
486 krb5_boolean initial;
488 unsigned kadm_version;
489 kadm5_config_params realm_params;
491 if (len != sizeof(KRB5_SENDAUTH_VERSION))
492 krb5_errx(context, 1, "bad sendauth len %d", len);
493 n = krb5_net_read(context, &fd, version, len);
495 krb5_err (context, 1, errno, "reading sendauth version");
497 krb5_errx (context, 1, "EOF reading sendauth version");
498 if(memcmp(version, KRB5_SENDAUTH_VERSION, len) != 0)
499 krb5_errx(context, 1, "bad sendauth version %.8s", version);
501 ret = krb5_recvauth_match_version(context, &ac, &fd,
502 match_appl_version, &kadm_version,
503 NULL, KRB5_RECVAUTH_IGNORE_VERSION,
505 if(ret == KRB5_KT_NOTFOUND)
506 krb5_errx(context, 1, "krb5_recvauth: key not found");
508 krb5_err(context, 1, ret, "krb5_recvauth");
510 ret = krb5_unparse_name (context, ticket->server, &server_name);
512 krb5_err (context, 1, ret, "krb5_unparse_name");
514 if (strncmp (server_name, KADM5_ADMIN_SERVICE,
515 strlen(KADM5_ADMIN_SERVICE)) != 0)
516 krb5_errx (context, 1, "ticket for strange principal (%s)",
521 memset(&realm_params, 0, sizeof(realm_params));
523 if(kadm_version == 1) {
525 ret = krb5_read_priv_message(context, ac, &fd, ¶ms);
527 krb5_err(context, 1, ret, "krb5_read_priv_message");
528 _kadm5_unmarshal_params(context, ¶ms, &realm_params);
531 initial = ticket->ticket.flags.initial;
532 ret = krb5_unparse_name(context, ticket->client, &client);
534 krb5_err (context, 1, ret, "krb5_unparse_name");
535 krb5_free_ticket (context, ticket);
536 ret = kadm5_init_with_password_ctx(context,
544 krb5_err (context, 1, ret, "kadm5_init_with_password_ctx");
545 v5_loop (context, ac, initial, kadm_handle, fd);
549 kadmind_loop(krb5_context context,
550 krb5_auth_context ac,
554 unsigned char tmp[4];
558 n = krb5_net_read(context, &fd, tmp, 4);
562 krb5_err(context, 1, errno, "read");
563 _krb5_get_int(tmp, &len, 4);
564 /* this v4 test could probably also go away */
565 if(len > 0xffff && (len & 0xffff) == ('K' << 8) + 'A') {
566 unsigned char v4reply[] = {
568 'K', 'Y', 'O', 'U', 'L', 'O', 'S', 'E',
569 0x95, 0xb7, 0xa7, 0x08 /* KADM_BAD_VER */
571 krb5_net_write(context, &fd, v4reply, sizeof(v4reply));
572 krb5_errx(context, 1, "packet appears to be version 4");
574 handle_v5(context, ac, keytab, len, fd);