1/* 2 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36#include "kdc_locl.h" 37#include <getarg.h> 38#include <parse_bytes.h> 39 40struct dbinfo { 41 char *realm; 42 char *dbname; 43 char *mkey_file; 44 struct dbinfo *next; 45}; 46 47static char *config_file; /* location of kdc config file */ 48 49static int require_preauth = -1; /* 1 == require preauth for all principals */ 50static char *max_request_str; /* `max_request' as a string */ 51 52static int disable_des = -1; 53 54static int builtin_hdb_flag; 55static int help_flag; 56static int version_flag; 57 58static struct getarg_strings addresses_str; /* addresses to listen on */ 59 60char *runas_string; 61char *chroot_string; 62 63int listen_on_ipc = 1; 64int listen_on_network = 1; 65 66 67static struct getargs args[] = { 68 { 69 "config-file", 'c', arg_string, &config_file, 70 "location of config file", "file" 71 }, 72 { 73 "require-preauth", 'p', arg_negative_flag, &require_preauth, 74 "don't require pa-data in as-reqs", NULL 75 }, 76 { 77 "max-request", 0, arg_string, &max_request_str, 78 "max size for a kdc-request", "size" 79 }, 80 { "enable-http", 'H', arg_flag, &enable_http, "turn on HTTP support" }, 81 { "listen-on-ipc", 0, arg_flag, &listen_on_ipc, "listen on local IPC requests" }, 82 { "listen-on-network", 0, arg_flag, &listen_on_network, "listen on network requests" }, 83 84 { "ports", 'P', arg_string, &port_str, 85 "ports to listen to", "portspec" 86 }, 87#ifdef __APPLE__ 88 { "sandbox", 0, arg_negative_flag, &sandbox_flag, 89 "use sandbox or not" 90 }, 91#endif /* __APPLE__ */ 92#ifdef SUPPORT_DETACH 93#if DETACH_IS_DEFAULT 94 { 95 "detach", 'D', arg_negative_flag, &detach_from_console, 96 "don't detach from console", NULL 97 }, 98#else 99 { 100 "detach", 0 , arg_flag, &detach_from_console, 101 "detach from console", NULL 102 }, 103#endif 104#endif 105 { "addresses", 0, arg_strings, &addresses_str, 106 "addresses to listen on", "list of addresses" }, 107 { "disable-des", 0, arg_flag, &disable_des, 108 "disable DES", NULL }, 109 { "builtin-hdb", 0, arg_flag, &builtin_hdb_flag, 110 "list builtin hdb backends", NULL}, 111 { "runas-user", 0, arg_string, &runas_string, 112 "run as this user when connected to network", NULL 113 }, 114 { "chroot", 0, arg_string, &chroot_string, 115 "chroot directory to run in", NULL 116 }, 117 { "help", 'h', arg_flag, &help_flag, NULL, NULL }, 118 { "version", 'v', arg_flag, &version_flag, NULL, NULL } 119}; 120 121static int num_args = sizeof(args) / sizeof(args[0]); 122 123static void 124usage(int ret) 125{ 126 arg_printusage (args, num_args, NULL, ""); 127 exit (ret); 128} 129 130static void 131add_one_address (krb5_context context, const char *str, int first) 132{ 133 krb5_error_code ret; 134 krb5_addresses tmp; 135 136 ret = krb5_parse_address (context, str, &tmp); 137 if (ret) 138 krb5_err (context, 1, ret, "parse_address `%s'", str); 139 if (first) 140 krb5_copy_addresses(context, &tmp, &explicit_addresses); 141 else 142 krb5_append_addresses(context, &explicit_addresses, &tmp); 143 krb5_free_addresses (context, &tmp); 144} 145 146krb5_kdc_configuration * 147configure(krb5_context context, int argc, char **argv) 148{ 149 krb5_kdc_configuration *config; 150 krb5_error_code ret; 151 int optidx = 0; 152 const char *p; 153 154 while(getarg(args, num_args, argc, argv, &optidx)) 155 warnx("error at argument `%s'", argv[optidx]); 156 157 if(help_flag) 158 usage (0); 159 160 if (version_flag) { 161 print_version(NULL); 162 exit(0); 163 } 164 165 if (builtin_hdb_flag) { 166 char *list; 167 ret = hdb_list_builtin(context, &list); 168 if (ret) 169 krb5_err(context, 1, ret, "listing builtin hdb backends"); 170 printf("builtin hdb backends: %s\n", list); 171 free(list); 172 exit(0); 173 } 174 175 argc -= optidx; 176 177 if (argc != 0) 178 usage(1); 179 180 { 181 char **files; 182 183 if (config_file == NULL) { 184 asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context)); 185 if (config_file == NULL) 186 errx(1, "out of memory"); 187 } 188 189 ret = krb5_prepend_config_files_default(config_file, &files); 190 if (ret) 191 krb5_err(context, 1, ret, "getting configuration files"); 192 193 ret = krb5_set_config_files(context, files); 194 krb5_free_config_files(files); 195 if(ret) 196 krb5_err(context, 1, ret, "reading configuration files"); 197 } 198 199 ret = krb5_kdc_get_config(context, &config); 200 if (ret) 201 krb5_err(context, 1, ret, "krb5_kdc_default_config"); 202 203 kdc_openlog(context, "kdc", config); 204 205 ret = krb5_kdc_set_dbinfo(context, config); 206 if (ret) 207 krb5_err(context, 1, ret, "krb5_kdc_set_dbinfo"); 208 209 if(max_request_str) 210 max_request_tcp = max_request_udp = parse_bytes(max_request_str, NULL); 211 212 if(max_request_tcp == 0){ 213 p = krb5_config_get_string (context, 214 NULL, 215 "kdc", 216 "max-request", 217 NULL); 218 if(p) 219 max_request_tcp = max_request_udp = parse_bytes(p, NULL); 220 } 221 222 if(require_preauth != -1) 223 config->require_preauth = require_preauth; 224 225 if(port_str == NULL){ 226 p = krb5_config_get_string(context, NULL, "kdc", "ports", NULL); 227 if (p != NULL) 228 port_str = strdup(p); 229 } 230 231 explicit_addresses.len = 0; 232 233 if (addresses_str.num_strings) { 234 int i; 235 236 for (i = 0; i < addresses_str.num_strings; ++i) 237 add_one_address (context, addresses_str.strings[i], i == 0); 238 free_getarg_strings (&addresses_str); 239 } else { 240 char **foo = krb5_config_get_strings (context, NULL, 241 "kdc", "addresses", NULL); 242 243 if (foo != NULL) { 244 add_one_address (context, *foo++, TRUE); 245 while (*foo) 246 add_one_address (context, *foo++, FALSE); 247 } 248 } 249 250 if(enable_http == -1) 251 enable_http = krb5_config_get_bool(context, NULL, "kdc", 252 "enable-http", NULL); 253 254 if(request_log == NULL) 255 request_log = krb5_config_get_string(context, NULL, 256 "kdc", 257 "kdc-request-log", 258 NULL); 259 260 if (krb5_config_get_string(context, NULL, "kdc", 261 "enforce-transited-policy", NULL)) 262 krb5_errx(context, 1, "enforce-transited-policy deprecated, " 263 "use [kdc]transited-policy instead"); 264 265#ifdef SUPPORT_DETACH 266 if(detach_from_console == -1) 267 detach_from_console = krb5_config_get_bool_default(context, NULL, 268 DETACH_IS_DEFAULT, 269 "kdc", 270 "detach", NULL); 271#endif /* SUPPORT_DETACH */ 272 273 if(max_request_tcp == 0) 274 max_request_tcp = 64 * 1024; 275 if(max_request_udp == 0) 276 max_request_udp = 64 * 1024; 277 278 if (port_str == NULL) 279 port_str = "+"; 280 281#ifdef __APPLE__ 282 if (config->lkdc_realm == NULL) { 283 unsigned int n; 284 285 for (n = 0; n < config->num_db; n++) { 286 char **realms = NULL, **r; 287 288 if (config->db[n]->hdb_get_realms == NULL) 289 continue; 290 291 ret = (config->db[n]->hdb_get_realms)(context, config->db[n], &realms); 292 if (ret == 0 && realms) { 293 for (r = realms; *r; r++) { 294 if (krb5_realm_is_lkdc(*r)) { 295 config->lkdc_realm = strdup(*r); 296 break; 297 } 298 } 299 krb5_free_host_realm(context, realms); 300 } 301 if (config->lkdc_realm) 302 break; 303 } 304 } 305#endif 306 307 308 if(disable_des == -1) 309 disable_des = krb5_config_get_bool_default(context, NULL, 310 FALSE, 311 "kdc", 312 "disable-des", NULL); 313 if(disable_des) { 314 krb5_enctype_disable(context, ETYPE_DES_CBC_CRC); 315 krb5_enctype_disable(context, ETYPE_DES_CBC_MD4); 316 krb5_enctype_disable(context, ETYPE_DES_CBC_MD5); 317 krb5_enctype_disable(context, ETYPE_DES_CBC_NONE); 318 krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE); 319 krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE); 320 } 321 322 krb5_kdc_windc_init(context); 323 324 krb5_kdc_pkinit_config(context, config); 325 326 return config; 327} 328