1/*
2 * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "kadm5_locl.h"
35#include <sys/types.h>
36#ifdef HAVE_SYS_SOCKET_H
37#include <sys/socket.h>
38#endif
39#ifdef HAVE_NETINET_IN_H
40#include <netinet/in.h>
41#endif
42#ifdef HAVE_NETDB_H
43#include <netdb.h>
44#endif
45
46RCSID("$Id$");
47
48static void
49set_funcs(kadm5_client_context *c)
50{
51#define SET(C, F) (C)->funcs.F = kadm5 ## _c_ ## F
52    SET(c, chpass_principal);
53    SET(c, chpass_principal_with_key);
54    SET(c, create_principal);
55    SET(c, delete_principal);
56    SET(c, destroy);
57    SET(c, flush);
58    SET(c, get_principal);
59    SET(c, get_principals);
60    SET(c, get_privs);
61    SET(c, modify_principal);
62    SET(c, randkey_principal);
63    SET(c, rename_principal);
64}
65
66kadm5_ret_t
67_kadm5_c_init_context(kadm5_client_context **ctx,
68		      kadm5_config_params *params,
69		      krb5_context context)
70{
71    krb5_error_code ret;
72    char *colon;
73
74    *ctx = malloc(sizeof(**ctx));
75    if(*ctx == NULL)
76	return ENOMEM;
77    memset(*ctx, 0, sizeof(**ctx));
78    krb5_add_et_list (context, initialize_kadm5_error_table_r);
79    set_funcs(*ctx);
80    (*ctx)->context = context;
81    if(params->mask & KADM5_CONFIG_REALM) {
82	ret = 0;
83	(*ctx)->realm = strdup(params->realm);
84	if ((*ctx)->realm == NULL)
85	    ret = ENOMEM;
86    } else
87	ret = krb5_get_default_realm((*ctx)->context, &(*ctx)->realm);
88    if (ret) {
89	free(*ctx);
90	return ret;
91    }
92    if(params->mask & KADM5_CONFIG_ADMIN_SERVER)
93	(*ctx)->admin_server = strdup(params->admin_server);
94    else {
95	char **hostlist;
96
97	ret = krb5_get_krb_admin_hst (context, &(*ctx)->realm, &hostlist);
98	if (ret) {
99	    free((*ctx)->realm);
100	    free(*ctx);
101	    return ret;
102	}
103	(*ctx)->admin_server = strdup(*hostlist);
104	krb5_free_krbhst (context, hostlist);
105    }
106
107    if ((*ctx)->admin_server == NULL) {
108	free((*ctx)->realm);
109	free(*ctx);
110	return ENOMEM;
111    }
112    colon = strchr ((*ctx)->admin_server, ':');
113    if (colon != NULL)
114	*colon++ = '\0';
115
116    (*ctx)->kadmind_port = 0;
117
118    if(params->mask & KADM5_CONFIG_KADMIND_PORT)
119	(*ctx)->kadmind_port = params->kadmind_port;
120    else if (colon != NULL) {
121	char *end;
122
123	(*ctx)->kadmind_port = htons(strtol (colon, &end, 0));
124    }
125    if ((*ctx)->kadmind_port == 0)
126	(*ctx)->kadmind_port = krb5_getportbyname (context, "kerberos-adm",
127						   "tcp", 749);
128    return 0;
129}
130
131static krb5_error_code
132get_kadm_ticket(krb5_context context,
133		krb5_ccache id,
134		krb5_principal client,
135		const char *server_name)
136{
137    krb5_error_code ret;
138    krb5_creds in, *out;
139
140    memset(&in, 0, sizeof(in));
141    in.client = client;
142    ret = krb5_parse_name(context, server_name, &in.server);
143    if(ret)
144	return ret;
145    ret = krb5_get_credentials(context, 0, id, &in, &out);
146    if(ret == 0)
147	krb5_free_creds(context, out);
148    krb5_free_principal(context, in.server);
149    return ret;
150}
151
152static krb5_error_code
153get_new_cache(krb5_context context,
154	      krb5_principal client,
155	      const char *password,
156	      krb5_prompter_fct prompter,
157	      const char *keytab,
158	      const char *server_name,
159	      krb5_ccache *ret_cache)
160{
161    krb5_error_code ret;
162    krb5_creds cred;
163    krb5_get_init_creds_opt *opt;
164    krb5_ccache id;
165
166    ret = krb5_get_init_creds_opt_alloc (context, &opt);
167    if (ret)
168	return ret;
169
170    krb5_get_init_creds_opt_set_default_flags(context, "kadmin",
171					      krb5_principal_get_realm(context,
172								       client),
173					      opt);
174
175
176    krb5_get_init_creds_opt_set_forwardable (opt, FALSE);
177    krb5_get_init_creds_opt_set_proxiable (opt, FALSE);
178
179    if(password == NULL && prompter == NULL) {
180	krb5_keytab kt;
181	if(keytab == NULL)
182	    ret = krb5_kt_default(context, &kt);
183	else
184	    ret = krb5_kt_resolve(context, keytab, &kt);
185	if(ret) {
186	    krb5_get_init_creds_opt_free(context, opt);
187	    return ret;
188	}
189	ret = krb5_get_init_creds_keytab (context,
190					  &cred,
191					  client,
192					  kt,
193					  0,
194					  server_name,
195					  opt);
196	krb5_kt_close(context, kt);
197    } else {
198	ret = krb5_get_init_creds_password (context,
199					    &cred,
200					    client,
201					    password,
202					    prompter,
203					    NULL,
204					    0,
205					    server_name,
206					    opt);
207    }
208    krb5_get_init_creds_opt_free(context, opt);
209    switch(ret){
210    case 0:
211	break;
212    case KRB5_LIBOS_PWDINTR:	/* don't print anything if it was just C-c:ed */
213    case KRB5KRB_AP_ERR_BAD_INTEGRITY:
214    case KRB5KRB_AP_ERR_MODIFIED:
215	return KADM5_BAD_PASSWORD;
216    default:
217	return ret;
218    }
219    ret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, &id);
220    if(ret)
221	return ret;
222    ret = krb5_cc_initialize (context, id, cred.client);
223    if (ret)
224	return ret;
225    ret = krb5_cc_store_cred (context, id, &cred);
226    if (ret)
227	return ret;
228    krb5_free_cred_contents (context, &cred);
229    *ret_cache = id;
230    return 0;
231}
232
233/*
234 * Check the credential cache `id´ to figure out what principal to use
235 * when talking to the kadmind. If there is a initial kadmin/admin@
236 * credential in the cache, use that client principal. Otherwise, use
237 * the client principals first component and add /admin to the
238 * principal.
239 */
240
241static krb5_error_code
242get_cache_principal(krb5_context context,
243		    krb5_ccache *id,
244		    krb5_principal *client)
245{
246    krb5_error_code ret;
247    const char *name, *inst;
248    krb5_principal p1, p2;
249
250    ret = krb5_cc_default(context, id);
251    if(ret) {
252	*id = NULL;
253	return ret;
254    }
255
256    ret = krb5_cc_get_principal(context, *id, &p1);
257    if(ret) {
258	krb5_cc_close(context, *id);
259	*id = NULL;
260	return ret;
261    }
262
263    ret = krb5_make_principal(context, &p2, NULL,
264			      "kadmin", "admin", NULL);
265    if (ret) {
266	krb5_cc_close(context, *id);
267	*id = NULL;
268	krb5_free_principal(context, p1);
269	return ret;
270    }
271
272    {
273	krb5_creds in, *out;
274	krb5_kdc_flags flags;
275
276	flags.i = 0;
277	memset(&in, 0, sizeof(in));
278
279	in.client = p1;
280	in.server = p2;
281
282	/* check for initial ticket kadmin/admin */
283	ret = krb5_get_credentials_with_flags(context, KRB5_GC_CACHED, flags,
284					      *id, &in, &out);
285	krb5_free_principal(context, p2);
286	if (ret == 0) {
287	    if (out->flags.b.initial) {
288		*client = p1;
289		krb5_free_creds(context, out);
290		return 0;
291	    }
292	    krb5_free_creds(context, out);
293	}
294    }
295    krb5_cc_close(context, *id);
296    *id = NULL;
297
298    name = krb5_principal_get_comp_string(context, p1, 0);
299    inst = krb5_principal_get_comp_string(context, p1, 1);
300    if(inst == NULL || strcmp(inst, "admin") != 0) {
301	ret = krb5_make_principal(context, &p2, NULL, name, "admin", NULL);
302	krb5_free_principal(context, p1);
303	if(ret != 0)
304	    return ret;
305
306	*client = p2;
307	return 0;
308    }
309
310    *client = p1;
311
312    return 0;
313}
314
315krb5_error_code
316_kadm5_c_get_cred_cache(krb5_context context,
317			const char *client_name,
318			const char *server_name,
319			const char *password,
320			krb5_prompter_fct prompter,
321			const char *keytab,
322			krb5_ccache ccache,
323			krb5_ccache *ret_cache)
324{
325    krb5_error_code ret;
326    krb5_ccache id = NULL;
327    krb5_principal default_client = NULL, client = NULL;
328
329    /* treat empty password as NULL */
330    if(password && *password == '\0')
331	password = NULL;
332    if(server_name == NULL)
333	server_name = KADM5_ADMIN_SERVICE;
334
335    if(client_name != NULL) {
336	ret = krb5_parse_name(context, client_name, &client);
337	if(ret)
338	    return ret;
339    }
340
341    if(ccache != NULL) {
342	id = ccache;
343	ret = krb5_cc_get_principal(context, id, &client);
344	if(ret)
345	    return ret;
346    } else {
347	/* get principal from default cache, ok if this doesn't work */
348
349	ret = get_cache_principal(context, &id, &default_client);
350	if (ret) {
351	    /*
352	     * No client was specified by the caller and we cannot
353	     * determine the client from a credentials cache.
354	     */
355	    const char *user;
356
357	    user = get_default_username ();
358
359	    if(user == NULL) {
360		krb5_set_error_message(context, KADM5_FAILURE, "Unable to find local user name");
361		return KADM5_FAILURE;
362	    }
363	    ret = krb5_make_principal(context, &default_client,
364				      NULL, user, "admin", NULL);
365	    if(ret)
366		return ret;
367	}
368    }
369
370
371    /*
372     * No client was specified by the caller, but we have a client
373     * from the default credentials cache.
374     */
375    if (client == NULL && default_client != NULL)
376	client = default_client;
377
378
379    if(id && client && (default_client == NULL ||
380	      krb5_principal_compare(context, client, default_client) != 0)) {
381	ret = get_kadm_ticket(context, id, client, server_name);
382	if(ret == 0) {
383	    *ret_cache = id;
384	    krb5_free_principal(context, default_client);
385	    if (default_client != client)
386		krb5_free_principal(context, client);
387	    return 0;
388	}
389	if(ccache != NULL)
390	    /* couldn't get ticket from cache */
391	    return -1;
392    }
393    /* get creds via AS request */
394    if(id && (id != ccache))
395	krb5_cc_close(context, id);
396    if (client != default_client)
397	krb5_free_principal(context, default_client);
398
399    ret = get_new_cache(context, client, password, prompter, keytab,
400			server_name, ret_cache);
401    krb5_free_principal(context, client);
402    return ret;
403}
404
405static kadm5_ret_t
406kadm_connect(kadm5_client_context *ctx)
407{
408    kadm5_ret_t ret;
409    krb5_principal server;
410    krb5_ccache cc;
411    rk_socket_t s = rk_INVALID_SOCKET;
412    struct addrinfo *ai, *a;
413    struct addrinfo hints;
414    int error;
415    char portstr[NI_MAXSERV];
416    char *hostname, *slash;
417    char *service_name;
418    krb5_context context = ctx->context;
419
420    memset (&hints, 0, sizeof(hints));
421    hints.ai_socktype = SOCK_STREAM;
422    hints.ai_protocol = IPPROTO_TCP;
423
424    snprintf (portstr, sizeof(portstr), "%u", ntohs(ctx->kadmind_port));
425
426    hostname = ctx->admin_server;
427    slash = strchr (hostname, '/');
428    if (slash != NULL)
429	hostname = slash + 1;
430
431    error = getaddrinfo (hostname, portstr, &hints, &ai);
432    if (error) {
433	krb5_clear_error_message(context);
434	return KADM5_BAD_SERVER_NAME;
435    }
436
437    for (a = ai; a != NULL; a = a->ai_next) {
438	s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
439	if (s < 0)
440	    continue;
441	if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
442	    krb5_clear_error_message(context);
443	    krb5_warn (context, errno, "connect(%s)", hostname);
444	    rk_closesocket (s);
445	    continue;
446	}
447	break;
448    }
449    if (a == NULL) {
450	freeaddrinfo (ai);
451	krb5_clear_error_message(context);
452	krb5_warnx (context, "failed to contact %s", hostname);
453	return KADM5_FAILURE;
454    }
455    ret = _kadm5_c_get_cred_cache(context,
456				  ctx->client_name,
457				  ctx->service_name,
458				  NULL, ctx->prompter, ctx->keytab,
459				  ctx->ccache, &cc);
460
461    if(ret) {
462	freeaddrinfo (ai);
463	rk_closesocket(s);
464	return ret;
465    }
466
467    if (ctx->realm)
468	asprintf(&service_name, "%s@%s", KADM5_ADMIN_SERVICE, ctx->realm);
469    else
470	asprintf(&service_name, "%s", KADM5_ADMIN_SERVICE);
471
472    if (service_name == NULL) {
473	freeaddrinfo (ai);
474	rk_closesocket(s);
475	krb5_clear_error_message(context);
476	return ENOMEM;
477    }
478
479    ret = krb5_parse_name(context, service_name, &server);
480    free(service_name);
481    if(ret) {
482	freeaddrinfo (ai);
483	if(ctx->ccache == NULL)
484	    krb5_cc_close(context, cc);
485	rk_closesocket(s);
486	return ret;
487    }
488    ctx->ac = NULL;
489
490    ret = krb5_sendauth(context, &ctx->ac, &s,
491			KADMIN_APPL_VERSION, NULL,
492			server, AP_OPTS_MUTUAL_REQUIRED,
493			NULL, NULL, cc, NULL, NULL, NULL);
494    if(ret == 0) {
495	krb5_data params;
496	kadm5_config_params p;
497	memset(&p, 0, sizeof(p));
498	if(ctx->realm) {
499	    p.mask |= KADM5_CONFIG_REALM;
500	    p.realm = ctx->realm;
501	}
502	ret = _kadm5_marshal_params(context, &p, &params);
503
504	ret = krb5_write_priv_message(context, ctx->ac, &s, &params);
505	krb5_data_free(&params);
506	if(ret) {
507	    freeaddrinfo (ai);
508	    rk_closesocket(s);
509	    if(ctx->ccache == NULL)
510		krb5_cc_close(context, cc);
511	    return ret;
512	}
513    } else if(ret == KRB5_SENDAUTH_BADAPPLVERS) {
514	rk_closesocket(s);
515
516	s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
517	if (s < 0) {
518	    freeaddrinfo (ai);
519	    krb5_clear_error_message(context);
520	    return errno;
521	}
522	if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
523	    rk_closesocket (s);
524	    freeaddrinfo (ai);
525	    krb5_clear_error_message(context);
526	    return errno;
527	}
528	ret = krb5_sendauth(context, &ctx->ac, &s,
529			    KADMIN_OLD_APPL_VERSION, NULL,
530			    server, AP_OPTS_MUTUAL_REQUIRED,
531			    NULL, NULL, cc, NULL, NULL, NULL);
532    }
533    freeaddrinfo (ai);
534    if(ret) {
535	rk_closesocket(s);
536	return ret;
537    }
538
539    krb5_free_principal(context, server);
540    if(ctx->ccache == NULL)
541	krb5_cc_close(context, cc);
542    ctx->sock = s;
543
544    return 0;
545}
546
547kadm5_ret_t
548_kadm5_connect(void *handle)
549{
550    kadm5_client_context *ctx = handle;
551    if(ctx->sock == -1)
552	return kadm_connect(ctx);
553    return 0;
554}
555
556static kadm5_ret_t
557kadm5_c_init_with_context(krb5_context context,
558			  const char *client_name,
559			  const char *password,
560			  krb5_prompter_fct prompter,
561			  const char *keytab,
562			  krb5_ccache ccache,
563			  const char *service_name,
564			  kadm5_config_params *realm_params,
565			  unsigned long struct_version,
566			  unsigned long api_version,
567			  void **server_handle)
568{
569    kadm5_ret_t ret;
570    kadm5_client_context *ctx;
571    krb5_ccache cc;
572
573    ret = _kadm5_c_init_context(&ctx, realm_params, context);
574    if(ret)
575	return ret;
576
577    if(password != NULL && *password != '\0') {
578	ret = _kadm5_c_get_cred_cache(context,
579				      client_name,
580				      service_name,
581				      password, prompter, keytab, ccache, &cc);
582	if(ret)
583	    return ret; /* XXX */
584	ccache = cc;
585    }
586
587
588    if (client_name != NULL)
589	ctx->client_name = strdup(client_name);
590    else
591	ctx->client_name = NULL;
592    if (service_name != NULL)
593	ctx->service_name = strdup(service_name);
594    else
595	ctx->service_name = NULL;
596    ctx->prompter = prompter;
597    ctx->keytab = keytab;
598    ctx->ccache = ccache;
599    /* maybe we should copy the params here */
600    ctx->sock = -1;
601
602    *server_handle = ctx;
603    return 0;
604}
605
606static kadm5_ret_t
607init_context(const char *client_name,
608	     const char *password,
609	     krb5_prompter_fct prompter,
610	     const char *keytab,
611	     krb5_ccache ccache,
612	     const char *service_name,
613	     kadm5_config_params *realm_params,
614	     unsigned long struct_version,
615	     unsigned long api_version,
616	     void **server_handle)
617{
618    krb5_context context;
619    kadm5_ret_t ret;
620    kadm5_server_context *ctx;
621
622    ret = krb5_init_context(&context);
623    if (ret)
624	return ret;
625    ret = kadm5_c_init_with_context(context,
626				    client_name,
627				    password,
628				    prompter,
629				    keytab,
630				    ccache,
631				    service_name,
632				    realm_params,
633				    struct_version,
634				    api_version,
635				    server_handle);
636    if(ret){
637	krb5_free_context(context);
638	return ret;
639    }
640    ctx = *server_handle;
641    ctx->my_context = 1;
642    return 0;
643}
644
645kadm5_ret_t
646kadm5_c_init_with_password_ctx(krb5_context context,
647			       const char *client_name,
648			       const char *password,
649			       const char *service_name,
650			       kadm5_config_params *realm_params,
651			       unsigned long struct_version,
652			       unsigned long api_version,
653			       void **server_handle)
654{
655    return kadm5_c_init_with_context(context,
656				     client_name,
657				     password,
658				     krb5_prompter_posix,
659				     NULL,
660				     NULL,
661				     service_name,
662				     realm_params,
663				     struct_version,
664				     api_version,
665				     server_handle);
666}
667
668kadm5_ret_t
669kadm5_c_init_with_password(const char *client_name,
670			   const char *password,
671			   const char *service_name,
672			   kadm5_config_params *realm_params,
673			   unsigned long struct_version,
674			   unsigned long api_version,
675			   void **server_handle)
676{
677    return init_context(client_name,
678			password,
679			krb5_prompter_posix,
680			NULL,
681			NULL,
682			service_name,
683			realm_params,
684			struct_version,
685			api_version,
686			server_handle);
687}
688
689kadm5_ret_t
690kadm5_c_init_with_skey_ctx(krb5_context context,
691			   const char *client_name,
692			   const char *keytab,
693			   const char *service_name,
694			   kadm5_config_params *realm_params,
695			   unsigned long struct_version,
696			   unsigned long api_version,
697			   void **server_handle)
698{
699    return kadm5_c_init_with_context(context,
700				     client_name,
701				     NULL,
702				     NULL,
703				     keytab,
704				     NULL,
705				     service_name,
706				     realm_params,
707				     struct_version,
708				     api_version,
709				     server_handle);
710}
711
712
713kadm5_ret_t
714kadm5_c_init_with_skey(const char *client_name,
715		     const char *keytab,
716		     const char *service_name,
717		     kadm5_config_params *realm_params,
718		     unsigned long struct_version,
719		     unsigned long api_version,
720		     void **server_handle)
721{
722    return init_context(client_name,
723			NULL,
724			NULL,
725			keytab,
726			NULL,
727			service_name,
728			realm_params,
729			struct_version,
730			api_version,
731			server_handle);
732}
733
734kadm5_ret_t
735kadm5_c_init_with_creds_ctx(krb5_context context,
736			    const char *client_name,
737			    krb5_ccache ccache,
738			    const char *service_name,
739			    kadm5_config_params *realm_params,
740			    unsigned long struct_version,
741			    unsigned long api_version,
742			    void **server_handle)
743{
744    return kadm5_c_init_with_context(context,
745				     client_name,
746				     NULL,
747				     NULL,
748				     NULL,
749				     ccache,
750				     service_name,
751				     realm_params,
752				     struct_version,
753				     api_version,
754				     server_handle);
755}
756
757kadm5_ret_t
758kadm5_c_init_with_creds(const char *client_name,
759			krb5_ccache ccache,
760			const char *service_name,
761			kadm5_config_params *realm_params,
762			unsigned long struct_version,
763			unsigned long api_version,
764			void **server_handle)
765{
766    return init_context(client_name,
767			NULL,
768			NULL,
769			NULL,
770			ccache,
771			service_name,
772			realm_params,
773			struct_version,
774			api_version,
775			server_handle);
776}
777
778#if 0
779kadm5_ret_t
780kadm5_init(char *client_name, char *pass,
781	   char *service_name,
782	   kadm5_config_params *realm_params,
783	   unsigned long struct_version,
784	   unsigned long api_version,
785	   void **server_handle)
786{
787}
788#endif
789
790