oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Call out to Heimdal's krb5.conf processing to configure many aspects

Browse Source 
of KDC behaviour.  This should allow PKINIT to be turned on and
managed with reasonable sanity.

From Andrew Bartlet



git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@20447 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2007-04-19 18:22:41 +00:00
parent e52db253f9
commit 0c2182a3ba
4 changed files with 342 additions and 323 deletions
Download Patch File Download Diff File Expand all files Collapse all files

333
kdc/config.c
View File

@@ -46,26 +46,14 @@ struct dbinfo {
};
static const char *config_file; /* location of kdc config file */
static int require_preauth = -1; /* 1 == require preauth for all principals */
static char *max_request_str; /* `max_request' as a string */
static const char *trpolicy_str;
static int disable_des = -1;
static int enable_v4 = -1;
static int enable_kaserver = -1;
static int enable_524 = -1;
static int enable_v4_cross_realm = -1;
static int builtin_hdb_flag;
static int help_flag;
static int version_flag;
static struct getarg_strings addresses_str; /* addresses to listen on */
static char *v4_realm;
static struct getargs args[] = {
{
"config-file", 'c', arg_string, &config_file,
@@ -257,17 +245,11 @@ add_one_address (krb5_context context, const char *str, int first)
krb5_kdc_configuration *
configure(krb5_context context, int argc, char **argv)
{
krb5_kdc_configuration *config = malloc(sizeof(*config));
const char *p;
krb5_kdc_configuration *config;
krb5_error_code ret;
int optidx = 0;
const char *p;
if (!config) {
return NULL;
}
krb5_kdc_default_config(config);
while(getarg(args, num_args, argc, argv, &optidx))
warnx("error at argument `%s'", argv[optidx]);
@@ -311,10 +293,6 @@ configure(krb5_context context, int argc, char **argv)
krb5_err(context, 1, ret, "reading configuration files");
}
kdc_openlog(context, config);
get_dbinfo(context, config);
if(max_request_str)
max_request = parse_bytes(max_request_str, NULL);
@@ -328,14 +306,8 @@ configure(krb5_context context, int argc, char **argv)
max_request = parse_bytes(p, NULL);
}
if(require_preauth == -1) {
config->require_preauth = krb5_config_get_bool_default(context, NULL,
config->require_preauth,
"kdc",
"require-preauth", NULL);
} else {
config->require_preauth = require_preauth;
}
if(max_request == 0)
max_request = 64 * 1024;
if(port_str == NULL){
p = krb5_config_get_string(context, NULL, "kdc", "ports", NULL);
@@ -343,6 +315,9 @@ configure(krb5_context context, int argc, char **argv)
port_str = strdup(p);
}
if (port_str == NULL)
port_str = "+";
explicit_addresses.len = 0;
if (addresses_str.num_strings) {
@@ -362,299 +337,23 @@ configure(krb5_context context, int argc, char **argv)
}
}
if(enable_v4 == -1) {
config->enable_v4 = krb5_config_get_bool_default(context, NULL,
config->enable_v4,
"kdc",
"enable-kerberos4",
NULL);
} else {
config->enable_v4 = enable_v4;
}
if(enable_v4_cross_realm == -1) {
config->enable_v4_cross_realm =
krb5_config_get_bool_default(context, NULL,
config->enable_v4_cross_realm,
"kdc",
"enable-kerberos4-cross-realm",
NULL);
} else {
config->enable_v4_cross_realm = enable_v4_cross_realm;
}
if(enable_524 == -1) {
config->enable_524 = krb5_config_get_bool_default(context, NULL,
config->enable_v4,
"kdc", "enable-524",
NULL);
} else {
config->enable_524 = enable_524;
}
if(enable_http == -1)
enable_http = krb5_config_get_bool(context, NULL, "kdc",
"enable-http", NULL);
config->enable_digest =
krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc",
"enable-digest", NULL);
config = malloc(sizeof(*config));
{
const char *digests;
digests = krb5_config_get_string(context, NULL,
"kdc",
"digests_allowed", NULL);
if (digests == NULL)
digests = "ntlm-v2";
config->digests_allowed = parse_flags(digests,
_kdc_digestunits,
0);
if (config->digests_allowed == -1) {
kdc_log(context, config, 0,
"unparsable digest units (%s), turning off digest",
digests);
config->enable_digest = 0;
} else if (config->digests_allowed == 0) {
kdc_log(context, config, 0,
"no digest enable, turning digest off",
digests);
config->enable_digest = 0;
}
if (!config) {
return NULL;
}
krb5_kdc_default_config(config);
config->enable_kx509 =
krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc",
"enable-kx509", NULL);
kdc_openlog(context, config);
if (config->enable_kx509) {
config->kx509_template = krb5_config_get_string(context, NULL,
"kdc",
"kx509_template",
NULL);
config->kx509_ca = krb5_config_get_string(context, NULL,
"kdc",
"kx509_ca",
NULL);
if (config->kx509_ca == NULL || config->kx509_template == NULL) {
kdc_log(context, config, 0,
"missing kx509 configuration, turning off");
config->enable_kx509 = FALSE;
}
}
config->check_ticket_addresses =
krb5_config_get_bool_default(context, NULL,
config->check_ticket_addresses,
"kdc",
"check-ticket-addresses", NULL);
config->allow_null_ticket_addresses =
krb5_config_get_bool_default(context, NULL,
config->allow_null_ticket_addresses,
"kdc",
"allow-null-ticket-addresses", NULL);
config->allow_anonymous =
krb5_config_get_bool_default(context, NULL,
config->allow_anonymous,
"kdc",
"allow-anonymous", NULL);
config->max_datagram_reply_length =
krb5_config_get_int_default(context,
NULL,
1400,
"kdc",
"max-kdc-datagram-reply-length",
NULL);
trpolicy_str =
krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc",
"transited-policy", NULL);
if(strcasecmp(trpolicy_str, "always-check") == 0) {
config->trpolicy = TRPOLICY_ALWAYS_CHECK;
} else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) {
config->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
} else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) {
config->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
} else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) {
/* default */
} else {
kdc_log(context, config,
0, "unknown transited-policy: %s, reverting to default (always-check)",
trpolicy_str);
}
if (krb5_config_get_string(context, NULL, "kdc",
"enforce-transited-policy", NULL))
krb5_errx(context, 1, "enforce-transited-policy deprecated, "
"use [kdc]transited-policy instead");
if(v4_realm == NULL){
p = krb5_config_get_string (context, NULL,
"kdc",
"v4-realm",
NULL);
if(p != NULL) {
config->v4_realm = strdup(p);
if (config->v4_realm == NULL)
krb5_errx(context, 1, "out of memory");
} else {
config->v4_realm = NULL;
}
} else {
config->v4_realm = v4_realm;
}
if (enable_kaserver == -1) {
config->enable_kaserver =
krb5_config_get_bool_default(context,
NULL,
config->enable_kaserver,
"kdc",
"enable-kaserver",
NULL);
} else {
config->enable_kaserver = enable_kaserver;
}
config->encode_as_rep_as_tgs_rep =
krb5_config_get_bool_default(context, NULL,
config->encode_as_rep_as_tgs_rep,
"kdc",
"encode_as_rep_as_tgs_rep",
NULL);
config->kdc_warn_pwexpire =
krb5_config_get_time_default (context, NULL,
config->kdc_warn_pwexpire,
"kdc",
"kdc_warn_pwexpire",
NULL);
if(detach_from_console == -1)
detach_from_console = krb5_config_get_bool_default(context, NULL,
DETACH_IS_DEFAULT,
"kdc",
"detach", NULL);
if(max_request == 0)
max_request = 64 * 1024;
if(require_preauth != -1) {
config->require_preauth = require_preauth;
}
if (port_str == NULL)
port_str = "+";
#ifdef PKINIT
config->enable_pkinit =
krb5_config_get_bool_default(context,
NULL,
config->enable_pkinit,
"kdc",
"enable-pkinit",
NULL);
if (config->enable_pkinit) {
const char *user_id, *anchors, *ocsp_file;
char **pool_list, **revoke_list;
user_id = krb5_config_get_string(context, NULL,
"kdc",
"pkinit_identity",
NULL);
if (user_id == NULL)
krb5_errx(context, 1, "pkinit enabled but no identity");
anchors = krb5_config_get_string(context, NULL,
"kdc",
"pkinit_anchors",
NULL);
if (anchors == NULL)
krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
pool_list = krb5_config_get_strings(context, NULL,
"kdc",
"pkinit_pool",
NULL);
revoke_list = krb5_config_get_strings(context, NULL,
"kdc",
"pkinit_revoke",
NULL);
ocsp_file =
krb5_config_get_string(context, NULL,
"kdc",
"pkinit_kdc_ocsp",
NULL);
if (ocsp_file) {
config->pkinit_kdc_ocsp_file = strdup(ocsp_file);
if (config->pkinit_kdc_ocsp_file == NULL)
krb5_errx(context, 1, "out of memory");
}
_kdc_pk_initialize(context, config, user_id, anchors,
pool_list, revoke_list);
krb5_config_free_strings(pool_list);
krb5_config_free_strings(revoke_list);
config->enable_pkinit_princ_in_cert =
krb5_config_get_bool_default(context,
NULL,
config->enable_pkinit_princ_in_cert,
"kdc",
"pkinit_principal_in_certificate",
NULL);
}
config->pkinit_dh_min_bits =
krb5_config_get_int_default(context,
NULL,
0,
"kdc",
"pkinit_dh_min_bits",
NULL);
#endif
if(config->v4_realm == NULL && (config->enable_kaserver || config->enable_v4)){
#ifdef KRB4
config->v4_realm = malloc(40); /* REALM_SZ */
if (config->v4_realm == NULL)
krb5_errx(context, 1, "out of memory");
krb_get_lrealm(config->v4_realm, 1);
#else
krb5_errx(context, 1, "No Kerberos 4 realm configured");
#endif
}
if(disable_des == -1)
disable_des = krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc",
"disable-des", NULL);
if(disable_des) {
krb5_enctype_disable(context, ETYPE_DES_CBC_CRC);
krb5_enctype_disable(context, ETYPE_DES_CBC_MD4);
krb5_enctype_disable(context, ETYPE_DES_CBC_MD5);
krb5_enctype_disable(context, ETYPE_DES_CBC_NONE);
krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE);
krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE);
kdc_log(context, config,
0, "DES was disabled, turned off Kerberos V4, 524 "
"and kaserver");
config->enable_v4 = 0;
config->enable_524 = 0;
config->enable_kaserver = 0;
}
_kdc_windc_init(context);
get_dbinfo(context, config);
krb5_kdc_configure(context, config);
return config;
}

316
kdc/default_config.c
View File

@@ -1,6 +1,7 @@
/*
* Copyright (c) 2005 Andrew Bartlett <abartlet@samba.org>
*
* Copyright (c) 1997-2005 Kungliga Tekniska H<>gskolan
* (Royal Institute of Technology, Stockholm, Sweden).
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -14,10 +15,14 @@
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* 3. Neither the name of the Institute nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
@@ -29,6 +34,19 @@
#include "kdc_locl.h"
int require_preauth = -1; /* 1 == require preauth for all principals */
const char *trpolicy_str;
int disable_des = -1;
int enable_v4 = -1;
int enable_kaserver = -1;
int enable_524 = -1;
int enable_v4_cross_realm = -1;
int detach_from_console = -1;
char *v4_realm;
/*
* Setup some of the defaults for the KDC configuration.
*
@@ -60,3 +78,293 @@ krb5_kdc_default_config(krb5_kdc_configuration *config)
config->num_db = 0;
config->logf = NULL;
}
/*
* Setup some valudes for the KDC configuration, from the config file
*
* Note: Caller must also fill in:
* - db
* - num_db
* - logf
*
*/
void krb5_kdc_configure(krb5_context context, krb5_kdc_configuration *config)
{
const char *p;
if(require_preauth == -1) {
config->require_preauth = krb5_config_get_bool_default(context, NULL,
config->require_preauth,
"kdc",
"require-preauth", NULL);
} else {
config->require_preauth = require_preauth;
}
if(enable_v4 == -1) {
config->enable_v4 = krb5_config_get_bool_default(context, NULL,
config->enable_v4,
"kdc",
"enable-kerberos4",
NULL);
} else {
config->enable_v4 = enable_v4;
}
if(enable_v4_cross_realm == -1) {
config->enable_v4_cross_realm =
krb5_config_get_bool_default(context, NULL,
config->enable_v4_cross_realm,
"kdc",
"enable-kerberos4-cross-realm",
NULL);
} else {
config->enable_v4_cross_realm = enable_v4_cross_realm;
}
if(enable_524 == -1) {
config->enable_524 = krb5_config_get_bool_default(context, NULL,
config->enable_v4,
"kdc", "enable-524",
NULL);
} else {
config->enable_524 = enable_524;
}
config->enable_digest =
krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc",
"enable-digest", NULL);
{
const char *digests;
digests = krb5_config_get_string(context, NULL,
"kdc",
"digests_allowed", NULL);
if (digests == NULL)
digests = "ntlm-v2";
config->digests_allowed = parse_flags(digests,
_kdc_digestunits,
0);
if (config->digests_allowed == -1) {
kdc_log(context, config, 0,
"unparsable digest units (%s), turning off digest",
digests);
config->enable_digest = 0;
} else if (config->digests_allowed == 0) {
kdc_log(context, config, 0,
"no digest enable, turning digest off",
digests);
config->enable_digest = 0;
}
}
config->enable_kx509 =
krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc",
"enable-kx509", NULL);
config->check_ticket_addresses =
krb5_config_get_bool_default(context, NULL,
config->check_ticket_addresses,
"kdc",
"check-ticket-addresses", NULL);
config->allow_null_ticket_addresses =
krb5_config_get_bool_default(context, NULL,
config->allow_null_ticket_addresses,
"kdc",
"allow-null-ticket-addresses", NULL);
config->allow_anonymous =
krb5_config_get_bool_default(context, NULL,
config->allow_anonymous,
"kdc",
"allow-anonymous", NULL);
config->max_datagram_reply_length =
krb5_config_get_int_default(context,
NULL,
1400,
"kdc",
"max-kdc-datagram-reply-length",
NULL);
trpolicy_str =
krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc",
"transited-policy", NULL);
if(strcasecmp(trpolicy_str, "always-check") == 0) {
config->trpolicy = TRPOLICY_ALWAYS_CHECK;
} else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) {
config->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
} else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) {
config->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
} else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) {
/* default */
} else {
kdc_log(context, config,
0, "unknown transited-policy: %s, reverting to default (always-check)",
trpolicy_str);
}
if (krb5_config_get_string(context, NULL, "kdc",
"enforce-transited-policy", NULL))
krb5_errx(context, 1, "enforce-transited-policy deprecated, "
"use [kdc]transited-policy instead");
if(v4_realm == NULL){
p = krb5_config_get_string (context, NULL,
"kdc",
"v4-realm",
NULL);
if(p != NULL) {
config->v4_realm = strdup(p);
if (config->v4_realm == NULL)
krb5_errx(context, 1, "out of memory");
} else {
config->v4_realm = NULL;
}
} else {
config->v4_realm = v4_realm;
}
if (enable_kaserver == -1) {
config->enable_kaserver =
krb5_config_get_bool_default(context,
NULL,
config->enable_kaserver,
"kdc",
"enable-kaserver",
NULL);
} else {
config->enable_kaserver = enable_kaserver;
}
config->encode_as_rep_as_tgs_rep =
krb5_config_get_bool_default(context, NULL,
config->encode_as_rep_as_tgs_rep,
"kdc",
"encode_as_rep_as_tgs_rep",
NULL);
config->kdc_warn_pwexpire =
krb5_config_get_time_default (context, NULL,
config->kdc_warn_pwexpire,
"kdc",
"kdc_warn_pwexpire",
NULL);
if(detach_from_console == -1)
detach_from_console = krb5_config_get_bool_default(context, NULL,
DETACH_IS_DEFAULT,
"kdc",
"detach", NULL);
#ifdef PKINIT
config->enable_pkinit =
krb5_config_get_bool_default(context,
NULL,
config->enable_pkinit,
"kdc",
"enable-pkinit",
NULL);
if (config->enable_pkinit) {
const char *user_id, *anchors, *ocsp_file;
char **pool_list, **revoke_list;
user_id = krb5_config_get_string(context, NULL,
"kdc",
"pkinit_identity",
NULL);
if (user_id == NULL)
krb5_errx(context, 1, "pkinit enabled but no identity");
anchors = krb5_config_get_string(context, NULL,
"kdc",
"pkinit_anchors",
NULL);
if (anchors == NULL)
krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
pool_list = krb5_config_get_strings(context, NULL,
"kdc",
"pkinit_pool",
NULL);
revoke_list = krb5_config_get_strings(context, NULL,
"kdc",
"pkinit_revoke",
NULL);
ocsp_file =
krb5_config_get_string(context, NULL,
"kdc",
"pkinit_kdc_ocsp",
NULL);
if (ocsp_file) {
config->pkinit_kdc_ocsp_file = strdup(ocsp_file);
if (config->pkinit_kdc_ocsp_file == NULL)
krb5_errx(context, 1, "out of memory");
}
_kdc_pk_initialize(context, config, user_id, anchors,
pool_list, revoke_list);
krb5_config_free_strings(pool_list);
krb5_config_free_strings(revoke_list);
config->enable_pkinit_princ_in_cert =
krb5_config_get_bool_default(context,
NULL,
config->enable_pkinit_princ_in_cert,
"kdc",
"pkinit_principal_in_certificate",
NULL);
}
config->pkinit_dh_min_bits =
krb5_config_get_int_default(context,
NULL,
0,
"kdc",
"pkinit_dh_min_bits",
NULL);
#endif
if(config->v4_realm == NULL && (config->enable_kaserver || config->enable_v4)){
#ifdef KRB4
config->v4_realm = malloc(40); /* REALM_SZ */
if (config->v4_realm == NULL)
krb5_errx(context, 1, "out of memory");
krb_get_lrealm(config->v4_realm, 1);
#else
krb5_errx(context, 1, "No Kerberos 4 realm configured");
#endif
}
if(disable_des == -1)
disable_des = krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc",
"disable-des", NULL);
if(disable_des) {
krb5_enctype_disable(context, ETYPE_DES_CBC_CRC);
krb5_enctype_disable(context, ETYPE_DES_CBC_MD4);
krb5_enctype_disable(context, ETYPE_DES_CBC_MD5);
krb5_enctype_disable(context, ETYPE_DES_CBC_NONE);
krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE);
krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE);
kdc_log(context, config,
0, "DES was disabled, turned off Kerberos V4, 524 "
"and kaserver");
config->enable_v4 = 0;
config->enable_524 = 0;
config->enable_kaserver = 0;
}
_kdc_windc_init(context);
}

14
kdc/kdc_locl.h
View File

@@ -55,6 +55,18 @@ extern int enable_http;
extern int detach_from_console;
extern int require_preauth; /* 1 == require preauth for all principals */
extern const char *trpolicy_str;
extern int disable_des;
extern int enable_v4;
extern int enable_kaserver;
extern int enable_524;
extern int enable_v4_cross_realm;
extern char *v4_realm;
extern const struct units _kdc_digestunits[];
#define _PATH_KDC_CONF HDB_DB_DIR "/kdc.conf"
@@ -69,4 +81,6 @@ loop(krb5_context context, krb5_kdc_configuration *config);
krb5_kdc_configuration *
configure(krb5_context context, int argc, char **argv);
void krb5_kdc_configure(krb5_context context, krb5_kdc_configuration *config);
#endif /* __KDC_LOCL_H__ */

2
kdc/main.c
View File

@@ -40,8 +40,6 @@ RCSID("$Id$");
sig_atomic_t exit_flag = 0;
int detach_from_console = -1;
static RETSIGTYPE
sigterm(int sig)
{