hpropd.c revision 102644 
1/*
2 * Copyright (c) 1997-2002 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "hprop.h"
35
36RCSID("$Id: hpropd.c,v 1.35 2002/04/18 10:18:50 joda Exp $");
37
38#ifdef KRB4
39static des_cblock mkey4;
40static des_key_schedule msched4;
41
42static char *
43time2str(time_t t)
44{
45    static char buf[128];
46    strftime(buf, sizeof(buf), "%Y%m%d%H%M", gmtime(&t));
47    return buf;
48}
49
50static int
51dump_krb4(krb5_context context, hdb_entry *ent, int fd)
52{
53    char name[ANAME_SZ];
54    char instance[INST_SZ];
55    char realm[REALM_SZ];
56    char buf[1024];
57    char *p;
58    int i;
59    int ret;
60    char *princ_name;
61    Event *modifier;
62    krb5_realm *realms;
63    int cmp;
64
65    ret = krb5_524_conv_principal(context, ent->principal,
66				  name, instance, realm);
67    if (ret) {
68	krb5_unparse_name(context, ent->principal, &princ_name);
69	krb5_warn(context, ret, "%s", princ_name);
70	free(princ_name);
71	return -1;
72    }
73
74    ret = krb5_get_default_realms (context, &realms);
75    if (ret) {
76	krb5_warn(context, ret, "krb5_get_default_realms");
77	return -1;
78    }
79
80    cmp = strcmp (realms[0], ent->principal->realm);
81    krb5_free_host_realm (context, realms);
82    if (cmp != 0)
83        return -1;
84
85    snprintf (buf, sizeof(buf), "%s %s ", name,
86	      (strlen(instance) != 0) ? instance : "*");
87
88    if (ent->max_life) {
89	asprintf(&p, "%d", krb_time_to_life(0, *ent->max_life));
90	strcat(buf, p);
91	free(p);
92    } else
93	strcat(buf, "255");
94    strcat(buf, " ");
95
96    i = 0;
97    while (i < ent->keys.len &&
98	   ent->keys.val[i].key.keytype != KEYTYPE_DES)
99	++i;
100
101    if (i == ent->keys.len) {
102	krb5_warnx(context, "No DES key for %s.%s", name, instance);
103	return -1;
104    }
105
106    if (ent->keys.val[i].mkvno)
107	asprintf(&p, "%d ", *ent->keys.val[i].mkvno);
108    else
109	asprintf(&p, "%d ", 1);
110    strcat(buf, p);
111    free(p);
112
113    asprintf(&p, "%d ", ent->kvno);
114    strcat(buf, p);
115    free(p);
116
117    asprintf(&p, "%d ", 0); /* Attributes are always 0*/
118    strcat(buf, p);
119    free(p);
120
121    {
122	u_int32_t *key = ent->keys.val[i].key.keyvalue.data;
123	kdb_encrypt_key((des_cblock*)key, (des_cblock*)key,
124			&mkey4, msched4, DES_ENCRYPT);
125	asprintf(&p, "%x %x ", (int)htonl(*key), (int)htonl(*(key+1)));
126	strcat(buf, p);
127	free(p);
128    }
129
130    if (ent->valid_end == NULL)
131	strcat(buf, time2str(60*60*24*365*50)); /* no expiration */
132    else
133	strcat(buf, time2str(*ent->valid_end));
134    strcat(buf, " ");
135
136    if (ent->modified_by == NULL)
137	modifier = &ent->created_by;
138    else
139	modifier = ent->modified_by;
140
141    ret = krb5_524_conv_principal(context, modifier->principal,
142				  name, instance, realm);
143    if (ret) {
144	krb5_unparse_name(context, modifier->principal, &princ_name);
145	krb5_warn(context, ret, "%s", princ_name);
146	free(princ_name);
147	return -1;
148    }
149    asprintf(&p, "%s %s %s\n", time2str(modifier->time),
150	     (strlen(name) != 0) ? name : "*",
151	     (strlen(instance) != 0) ? instance : "*");
152    strcat(buf, p);
153    free(p);
154
155    ret = write(fd, buf, strlen(buf));
156    if (ret == -1)
157	krb5_warnx(context, "write");
158    return 0;
159}
160#endif /* KRB4 */
161
162static int inetd_flag = -1;
163static int help_flag;
164static int version_flag;
165static int print_dump;
166static const char *database = HDB_DEFAULT_DB;
167static int from_stdin;
168static char *local_realm;
169#ifdef KRB4
170static int v4dump;
171#endif
172static char *ktname = NULL;
173
174struct getargs args[] = {
175    { "database", 'd', arg_string, &database, "database", "file" },
176    { "stdin",    'n', arg_flag, &from_stdin, "read from stdin" },
177    { "print",	    0, arg_flag, &print_dump, "print dump to stdout" },
178    { "inetd",	   'i',	arg_negative_flag,	&inetd_flag,
179      "Not started from inetd" },
180    { "keytab",   'k',	arg_string, &ktname,	"keytab to use for authentication", "keytab" },
181    { "realm",   'r',	arg_string, &local_realm, "realm to use" },
182#ifdef KRB4
183    { "v4dump",       '4',  arg_flag, &v4dump, "create v4 type DB" },
184#endif
185    { "version",    0, arg_flag, &version_flag, NULL, NULL },
186    { "help",    'h',  arg_flag, &help_flag, NULL, NULL}
187};
188
189static int num_args = sizeof(args) / sizeof(args[0]);
190
191static void
192usage(int ret)
193{
194    arg_printusage (args, num_args, NULL, "");
195    exit (ret);
196}
197
198int
199main(int argc, char **argv)
200{
201    krb5_error_code ret;
202    krb5_context context;
203    krb5_auth_context ac = NULL;
204    krb5_principal c1, c2;
205    krb5_authenticator authent;
206    krb5_keytab keytab;
207    int fd;
208    HDB *db;
209    int optind = 0;
210    char *tmp_db;
211    krb5_log_facility *fac;
212    int nprincs;
213#ifdef KRB4
214    int e;
215    int fd_out = -1;
216#endif
217
218    setprogname(argv[0]);
219
220    ret = krb5_init_context(&context);
221    if(ret)
222	exit(1);
223
224    ret = krb5_openlog(context, "hpropd", &fac);
225    if(ret)
226	;
227    krb5_set_warn_dest(context, fac);
228
229    if(getarg(args, num_args, argc, argv, &optind))
230	usage(1);
231
232#ifdef KRB4
233    if (v4dump && database == HDB_DEFAULT_DB)
234       database = "/var/kerberos/524_dump";
235#endif /* KRB4 */
236
237    if(local_realm != NULL)
238	krb5_set_default_realm(context, local_realm);
239
240    if(help_flag)
241	usage(0);
242    if(version_flag) {
243	print_version(NULL);
244	exit(0);
245    }
246
247    argc -= optind;
248    argv += optind;
249
250    if (argc != 0)
251	usage(1);
252
253    if(from_stdin)
254	fd = STDIN_FILENO;
255    else {
256	struct sockaddr_storage ss;
257	struct sockaddr *sa = (struct sockaddr *)&ss;
258	socklen_t sin_len = sizeof(ss);
259	char addr_name[256];
260	krb5_ticket *ticket;
261	char *server;
262
263	fd = STDIN_FILENO;
264	if (inetd_flag == -1) {
265	    if (getpeername (fd, sa, &sin_len) < 0)
266		inetd_flag = 0;
267	    else
268		inetd_flag = 1;
269	}
270	if (!inetd_flag) {
271	    mini_inetd (krb5_getportbyname (context, "hprop", "tcp",
272					    HPROP_PORT));
273	}
274	sin_len = sizeof(ss);
275	if(getpeername(fd, sa, &sin_len) < 0)
276	    krb5_err(context, 1, errno, "getpeername");
277
278	if (inet_ntop(sa->sa_family,
279		      socket_get_address (sa),
280		      addr_name,
281		      sizeof(addr_name)) == NULL)
282	    strlcpy (addr_name, "unknown address",
283			     sizeof(addr_name));
284
285	krb5_log(context, fac, 0, "Connection from %s", addr_name);
286
287	ret = krb5_kt_register(context, &hdb_kt_ops);
288	if(ret)
289	    krb5_err(context, 1, ret, "krb5_kt_register");
290
291	if (ktname != NULL) {
292	    ret = krb5_kt_resolve(context, ktname, &keytab);
293	    if (ret)
294		krb5_err (context, 1, ret, "krb5_kt_resolve %s", ktname);
295	} else {
296	    ret = krb5_kt_default (context, &keytab);
297	    if (ret)
298		krb5_err (context, 1, ret, "krb5_kt_default");
299	}
300
301	ret = krb5_recvauth(context, &ac, &fd, HPROP_VERSION, NULL,
302			    0, keytab, &ticket);
303	if(ret)
304	    krb5_err(context, 1, ret, "krb5_recvauth");
305
306	ret = krb5_unparse_name(context, ticket->server, &server);
307	if (ret)
308	    krb5_err(context, 1, ret, "krb5_unparse_name");
309	if (strncmp(server, "hprop/", 5) != 0)
310	    krb5_errx(context, 1, "ticket not for hprop (%s)", server);
311
312	free(server);
313	krb5_free_ticket (context, ticket);
314
315	ret = krb5_auth_con_getauthenticator(context, ac, &authent);
316	if(ret)
317	    krb5_err(context, 1, ret, "krb5_auth_con_getauthenticator");
318
319	ret = krb5_make_principal(context, &c1, NULL, "kadmin", "hprop", NULL);
320	if(ret)
321	    krb5_err(context, 1, ret, "krb5_make_principal");
322	principalname2krb5_principal(&c2, authent->cname, authent->crealm);
323	if(!krb5_principal_compare(context, c1, c2)) {
324	    char *s;
325	    krb5_unparse_name(context, c2, &s);
326	    krb5_errx(context, 1, "Unauthorized connection from %s", s);
327	}
328	krb5_free_principal(context, c1);
329	krb5_free_principal(context, c2);
330
331	ret = krb5_kt_close(context, keytab);
332	if(ret)
333	    krb5_err(context, 1, ret, "krb5_kt_close");
334    }
335
336    if(!print_dump) {
337	asprintf(&tmp_db, "%s~", database);
338#ifdef KRB4
339	if (v4dump) {
340	    fd_out = open(tmp_db, O_WRONLY | O_CREAT | O_TRUNC, 0600);
341	    if (fd_out == -1)
342		krb5_errx(context, 1, "%s", strerror(errno));
343	}
344	else
345#endif /* KRB4 */
346	{
347	    ret = hdb_create(context, &db, tmp_db);
348	    if(ret)
349		krb5_err(context, 1, ret, "hdb_create(%s)", tmp_db);
350	    ret = db->open(context, db, O_RDWR | O_CREAT | O_TRUNC, 0600);
351	    if(ret)
352		krb5_err(context, 1, ret, "hdb_open(%s)", tmp_db);
353	}
354    }
355
356#ifdef KRB4
357    if (v4dump) {
358	e = kdb_get_master_key(0, &mkey4, msched4);
359	if(e)
360	    krb5_errx(context, 1, "kdb_get_master_key: %s",
361		      krb_get_err_text(e));
362    }
363#endif /* KRB4 */
364
365    nprincs = 0;
366    while(1){
367	krb5_data data;
368	hdb_entry entry;
369
370	if(from_stdin) {
371	    ret = krb5_read_message(context, &fd, &data);
372	    if(ret != 0 && ret != HEIM_ERR_EOF)
373		krb5_err(context, 1, ret, "krb5_read_message");
374	} else {
375	    ret = krb5_read_priv_message(context, ac, &fd, &data);
376	    if(ret)
377		krb5_err(context, 1, ret, "krb5_read_priv_message");
378	}
379
380	if(ret == HEIM_ERR_EOF || data.length == 0) {
381	    if(!from_stdin) {
382		data.data = NULL;
383		data.length = 0;
384		krb5_write_priv_message(context, ac, &fd, &data);
385	    }
386	    if(!print_dump) {
387#ifdef KRB4
388		if (v4dump) {
389		    ret = rename(tmp_db, database);
390		    if (ret)
391			krb5_errx(context, 1, "rename");
392		    ret = close(fd_out);
393		    if (ret)
394			krb5_errx(context, 1, "close");
395		} else
396#endif /* KRB4 */
397		{
398		    ret = db->rename(context, db, database);
399		    if(ret)
400			krb5_err(context, 1, ret, "db_rename");
401		    ret = db->close(context, db);
402		    if(ret)
403			krb5_err(context, 1, ret, "db_close");
404		}
405	    }
406	    break;
407	}
408	ret = hdb_value2entry(context, &data, &entry);
409	if(ret)
410	    krb5_err(context, 1, ret, "hdb_value2entry");
411	if(print_dump)
412	    hdb_print_entry(context, db, &entry, stdout);
413	else {
414#ifdef KRB4
415	    if (v4dump) {
416		ret = dump_krb4(context, &entry, fd_out);
417		if(!ret) nprincs++;
418	    }
419	    else
420#endif /* KRB4 */
421	    {
422		ret = db->store(context, db, 0, &entry);
423		if(ret == HDB_ERR_EXISTS) {
424		    char *s;
425		    krb5_unparse_name(context, entry.principal, &s);
426		    krb5_warnx(context, "Entry exists: %s", s);
427		    free(s);
428		} else if(ret)
429		    krb5_err(context, 1, ret, "db_store");
430		else
431		    nprincs++;
432	    }
433	}
434	hdb_free_entry(context, &entry);
435    }
436    if (!print_dump)
437	krb5_log(context, fac, 0, "Received %d principals", nprincs);
438    exit(0);
439}
440