From 62c1790bf5cf7266a53b7cc22dcbebeead5557b1 Mon Sep 17 00:00:00 2001 From: Luke Howard Date: Sun, 23 Dec 2018 19:18:29 +1100 Subject: [PATCH] kadm5: pre/post-commit plugin hook for kadm5 update operations (#397) This change adds plugin support to the kadmin libraries for performing actions before and after a password change is committed to the KDC database and after a change is made to the attributes of a principal (specifically, a change to DISALLOW_ALL_TIX). This change adds a hook_libraries configuration option to the [kadmin] section of krb5.conf (or kdc.conf if you use that file) that must be set to load the module. That configuration option is in the form: [kadmin] hook_libraries = /usr/local/lib/krb5/plugins/kadm5_hook/krb5_sync.so where the value is the full path to the plugin that you want to load. If this option is not present, kadmind will not load a plugin and the changes from the patch will be inactive. If this option is given and the plugin cannot be loaded, kadmind startup will abort with a (hopefully useful) error message in syslog. Any plugin used with this patch must expose a public function named kadm5_hook_init of type kadm5_hook_init_t that returns a kadm5_hook structure. See sample_hook.c for an example of this initialization function. typedef struct kadm5_hook { const char *name; uint32_t version; const char *vendor; void (KRB5_CALLCONV *fini)(krb5_context, void *data); krb5_error_code (KRB5_CALLCONV *chpass)(krb5_context context, void *data, enum kadm5_hook_stage stage, krb5_error_code code, krb5_const_principal princ, uint32_t flags, size_t n_ks_tuple, krb5_key_salt_tuple *ks_tuple, const char *password, char **error_msg); ... }; where enum kadm5_hook_stage is: enum kadm5_hook_stage { KADM5_HOOK_STAGE_PRECOMMIT, KADM5_HOOK_STAGE_POSTCOMMIT }; init creates a hook context that is passed into all subsequent calls. chpass is called for password changes, create is called for principal creation (with the newly-created principal in the kadm5_principal_ent_t argument), and modify is called when a principal is modified. The purpose of the remaining functions should be self-explanatory. returning 0 on success and a Kerberos error code on failure, setting the Kerberos error message in the provided context. The error code passed in is valid for post-commit hooks and contains the result of the update operation. This change is submitted under the following license Copyright 2012, 2013 The Board of Trustees of the Leland Stanford Junior University Portions Copyright 2018 AuriStor Inc. Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty. --- lib/kadm5/Makefile.am | 9 +- lib/kadm5/NTMakefile | 19 +++- lib/kadm5/chpass_s.c | 50 +++++++++++ lib/kadm5/context_s.c | 7 ++ lib/kadm5/create_s.c | 48 ++++++++++ lib/kadm5/delete_s.c | 36 ++++++++ lib/kadm5/destroy_s.c | 1 + lib/kadm5/kadm5-hook.h | 139 +++++++++++++++++++++++++++++ lib/kadm5/kadm5_err.et | 4 + lib/kadm5/modify_s.c | 39 +++++++++ lib/kadm5/private.h | 10 +++ lib/kadm5/randkey_s.c | 39 ++++++++- lib/kadm5/rename_s.c | 42 ++++++++- lib/kadm5/sample_hook.c | 185 +++++++++++++++++++++++++++++++++++++++ lib/kadm5/server_hooks.c | 183 ++++++++++++++++++++++++++++++++++++++ lib/kadm5/setkey3_s.c | 54 +++++++++++- 16 files changed, 855 insertions(+), 10 deletions(-) create mode 100644 lib/kadm5/kadm5-hook.h create mode 100644 lib/kadm5/sample_hook.c create mode 100644 lib/kadm5/server_hooks.c diff --git a/lib/kadm5/Makefile.am b/lib/kadm5/Makefile.am index de9a20822..6f16ec6e8 100644 --- a/lib/kadm5/Makefile.am +++ b/lib/kadm5/Makefile.am @@ -17,11 +17,14 @@ sbin_PROGRAMS = iprop-log check_PROGRAMS = default_keys noinst_PROGRAMS = test_pw_quality -noinst_LTLIBRARIES = sample_passwd_check.la +noinst_LTLIBRARIES = sample_passwd_check.la sample_hook.la sample_passwd_check_la_SOURCES = sample_passwd_check.c sample_passwd_check_la_LDFLAGS = -module +sample_hook_la_SOURCES = sample_hook.c +sample_hook_la_LDFLAGS = -module + libkadm5srv_la_LIBADD = \ $(LIB_com_err) ../krb5/libkrb5.la \ ../hdb/libhdb.la $(LIBADD_roken) @@ -35,7 +38,7 @@ default_keys_SOURCES = default_keys.c kadm5includedir = $(includedir)/kadm5 buildkadm5include = $(buildinclude)/kadm5 -dist_kadm5include_HEADERS = admin.h private.h kadm5-pwcheck.h +dist_kadm5include_HEADERS = admin.h private.h kadm5-hook.h kadm5-pwcheck.h dist_kadm5include_HEADERS += $(srcdir)/kadm5-protos.h $(srcdir)/kadm5-private.h nodist_kadm5include_HEADERS = kadm5_err.h @@ -108,6 +111,7 @@ dist_libkadm5srv_la_SOURCES = \ randkey_s.c \ rename_s.c \ server_glue.c \ + server_hooks.c \ setkey3_s.c \ set_keys.c \ set_modifier.c \ @@ -212,5 +216,6 @@ EXTRA_DIST = \ check-cracklib.pl \ flush.c \ sample_passwd_check.c \ + sample_hook.c \ version-script.map \ version-script-client.map diff --git a/lib/kadm5/NTMakefile b/lib/kadm5/NTMakefile index 392a88438..94d5d99fd 100644 --- a/lib/kadm5/NTMakefile +++ b/lib/kadm5/NTMakefile @@ -55,7 +55,8 @@ dist_libkadm5clnt_la_SOURCES = \ rename_c.c \ send_recv.c \ kadm5-pwcheck.h \ - admin.h + admin.h \ + kadm5-hook.h dist_libkadm5srv_la_SOURCES = \ acl.c \ @@ -85,11 +86,13 @@ dist_libkadm5srv_la_SOURCES = \ randkey_s.c \ rename_s.c \ server_glue.c \ + server_hooks.c \ set_keys.c \ setkey3_s.c \ set_modifier.c \ kadm5-pwcheck.h \ - admin.h + admin.h \ + kadm5-hook.h LIBKADM5CLNT_OBJS= \ $(OBJ)\ad.obj \ @@ -137,6 +140,7 @@ LIBKADM5SRV_OBJS= \ $(OBJ)\randkey_s.obj \ $(OBJ)\rename_s.obj \ $(OBJ)\server_glue.obj \ + $(OBJ)\server_hooks.obj \ $(OBJ)\set_keys.obj \ $(OBJ)\setkey3_s.obj \ $(OBJ)\set_modifier.obj \ @@ -178,6 +182,7 @@ INCFILES=\ $(KADM5INCDIR)\kadm5_err.h \ $(KADM5INCDIR)\admin.h \ $(KADM5INCDIR)\private.h \ + $(KADM5INCDIR)\kadm5-hook.h \ $(KADM5INCDIR)\kadm5-protos.h \ $(KADM5INCDIR)\kadm5-private.h \ $(OBJ)\iprop-commands.h @@ -239,7 +244,8 @@ test:: test-binaries test-run test-binaries: \ $(OBJ)\default_keys.exe \ $(OBJ)\test_pw_quality.exe \ - $(OBJ)\sample_passwd_check.dll + $(OBJ)\sample_passwd_check.dll \ + $(OBJ)\sample_hook.dll $(OBJ)\default_keys.exe: $(OBJ)\default_keys.obj $(LIBHEIMDAL) $(LIBROKEN) $(LIBHDB) $(EXECONLINK) @@ -258,6 +264,13 @@ EXPORTS << $(DLLPREP_NODIST) +$(OBJ)\sample_hook.dll: $(OBJ)\sample_hook.obj $(LIBHEIMDAL) + $(DLLGUILINK) /DEF:<< +EXPORTS + kadm5_hook_init +<< + $(DLLPREP_NODIST) + test-run: cd $(OBJ) -default_keys.exe diff --git a/lib/kadm5/chpass_s.c b/lib/kadm5/chpass_s.c index d1ed73207..726ab5f0a 100644 --- a/lib/kadm5/chpass_s.c +++ b/lib/kadm5/chpass_s.c @@ -35,6 +35,41 @@ RCSID("$Id$"); +static kadm5_ret_t +chpass_principal_hook(kadm5_server_context *context, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ, + uint32_t flags, + size_t n_ks_tuple, + krb5_key_salt_tuple *ks_tuple, + const char *password) +{ + krb5_error_code ret = 0; + size_t i; + + for (i = 0; i < context->num_hooks; i++) { + kadm5_hook_context *hook = context->hooks[i]; + + if (hook->hook->chpass != NULL) { + ret = hook->hook->chpass(context->context, hook->data, + stage, code, princ, flags, + n_ks_tuple, ks_tuple, password); + if (ret != 0) { + krb5_prepend_error_message(context->context, ret, + "chpass hook `%s' failed %scommit", + hook->hook->name, + stage == KADM5_HOOK_STAGE_PRECOMMIT + ? "pre" : "post"); + if (stage == KADM5_HOOK_STAGE_PRECOMMIT) + break; + } + } + } + + return ret; +} + static kadm5_ret_t change(void *server_handle, krb5_principal princ, @@ -50,6 +85,7 @@ change(void *server_handle, Key *keys; size_t num_keys; int existsp = 0; + uint32_t hook_flags = 0; memset(&ent, 0, sizeof(ent)); if (!context->keep_open) { @@ -67,6 +103,16 @@ change(void *server_handle, if (ret) goto out2; + if (keepold) + hook_flags |= KADM5_HOOK_FLAG_KEEPOLD; + if (cond) + hook_flags |= KADM5_HOOK_FLAG_CONDITIONAL; + ret = chpass_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, + 0, princ, hook_flags, + n_ks_tuple, ks_tuple, password); + if (ret) + goto out3; + if (keepold || cond) { /* * We save these for now so we can handle password history checking; @@ -149,6 +195,10 @@ change(void *server_handle, KADM5_KEY_DATA | KADM5_KVNO | KADM5_PW_EXPIRATION | KADM5_TL_DATA); + (void) chpass_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, + ret, princ, hook_flags, + n_ks_tuple, ks_tuple, password); + out3: hdb_free_entry(context->context, &ent); out2: diff --git a/lib/kadm5/context_s.c b/lib/kadm5/context_s.c index 7e8b6153c..55421b127 100644 --- a/lib/kadm5/context_s.c +++ b/lib/kadm5/context_s.c @@ -268,6 +268,13 @@ _kadm5_s_init_context(kadm5_server_context **ctx, find_db_spec(*ctx); + ret = _kadm5_s_init_hooks(*ctx); + if (ret != 0) { + kadm5_s_destroy(*ctx); + *ctx = NULL; + return ret; + } + /* PROFILE can't be specified for now */ /* KADMIND_PORT is supposed to be used on the server also, but this doesn't make sense */ diff --git a/lib/kadm5/create_s.c b/lib/kadm5/create_s.c index 7d8f89837..b1fe35d9c 100644 --- a/lib/kadm5/create_s.c +++ b/lib/kadm5/create_s.c @@ -102,6 +102,38 @@ create_principal(kadm5_server_context *context, &ent->entry.created_by.principal); } +static kadm5_ret_t +create_principal_hook(kadm5_server_context *context, + enum kadm5_hook_stage stage, + krb5_error_code code, + kadm5_principal_ent_t princ, + uint32_t mask, + const char *password) +{ + krb5_error_code ret = 0; + size_t i; + + for (i = 0; i < context->num_hooks; i++) { + kadm5_hook_context *hook = context->hooks[i]; + + if (hook->hook->create != NULL) { + ret = hook->hook->create(context->context, hook->data, + stage, code, princ, mask, password); + if (ret != 0) { + krb5_prepend_error_message(context->context, ret, + "create hook `%s' failed %scommit", + hook->hook->name, + stage == KADM5_HOOK_STAGE_PRECOMMIT + ? "pre" : "post"); + if (stage == KADM5_HOOK_STAGE_PRECOMMIT) + break; + } + } + } + + return ret; +} + kadm5_ret_t kadm5_s_create_principal_with_key(void *server_handle, kadm5_principal_ent_t princ, @@ -117,6 +149,11 @@ kadm5_s_create_principal_with_key(void *server_handle, mask |= KADM5_KVNO; } + ret = create_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, + 0, princ, mask, NULL); + if (ret) + return ret; + ret = create_principal(context, princ, mask, &ent, KADM5_PRINCIPAL | KADM5_KEY_DATA, KADM5_LAST_PWD_CHANGE | KADM5_MOD_TIME @@ -146,6 +183,9 @@ kadm5_s_create_principal_with_key(void *server_handle, /* This logs the change for iprop and writes to the HDB */ ret = kadm5_log_create(context, &ent.entry); + (void) create_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, + ret, princ, mask, NULL); + out2: (void) kadm5_log_end(context); out: @@ -178,6 +218,11 @@ kadm5_s_create_principal(void *server_handle, mask |= KADM5_KVNO; } + ret = create_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, + 0, princ, mask, password); + if (ret) + return ret; + ret = create_principal(context, princ, mask, &ent, KADM5_PRINCIPAL, KADM5_LAST_PWD_CHANGE | KADM5_MOD_TIME @@ -214,6 +259,9 @@ kadm5_s_create_principal(void *server_handle, /* This logs the change for iprop and writes to the HDB */ ret = kadm5_log_create(context, &ent.entry); + (void) create_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, + ret, princ, mask, password); + out2: (void) kadm5_log_end(context); out: diff --git a/lib/kadm5/delete_s.c b/lib/kadm5/delete_s.c index 2e4aeff53..55236fb5b 100644 --- a/lib/kadm5/delete_s.c +++ b/lib/kadm5/delete_s.c @@ -35,6 +35,36 @@ RCSID("$Id$"); +static kadm5_ret_t +delete_principal_hook(kadm5_server_context *context, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ) +{ + krb5_error_code ret = 0; + size_t i; + + for (i = 0; i < context->num_hooks; i++) { + kadm5_hook_context *hook = context->hooks[i]; + + if (hook->hook->delete != NULL) { + ret = hook->hook->delete(context->context, hook->data, + stage, code, princ); + if (ret != 0) { + krb5_prepend_error_message(context->context, ret, + "delete hook `%s' failed %scommit", + hook->hook->name, + stage == KADM5_HOOK_STAGE_PRECOMMIT + ? "pre" : "post"); + if (stage == KADM5_HOOK_STAGE_PRECOMMIT) + break; + } + } + } + + return ret; +} + kadm5_ret_t kadm5_s_delete_principal(void *server_handle, krb5_principal princ) { @@ -64,6 +94,10 @@ kadm5_s_delete_principal(void *server_handle, krb5_principal princ) goto out3; } + ret = delete_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, 0, princ); + if (ret) + goto out3; + ret = hdb_seal_keys(context->context, context->db, &ent.entry); if (ret) goto out3; @@ -71,6 +105,8 @@ kadm5_s_delete_principal(void *server_handle, krb5_principal princ) /* This logs the change for iprop and writes to the HDB */ ret = kadm5_log_delete(context, princ); + (void) delete_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, ret, princ); + out3: hdb_free_entry(context->context, &ent); out2: diff --git a/lib/kadm5/destroy_s.c b/lib/kadm5/destroy_s.c index 242436637..fc86e5960 100644 --- a/lib/kadm5/destroy_s.c +++ b/lib/kadm5/destroy_s.c @@ -77,6 +77,7 @@ kadm5_s_destroy(void *server_handle) kadm5_server_context *context = server_handle; krb5_context kcontext = context->context; + _kadm5_s_free_hooks(context); if (context->db != NULL) ret = context->db->hdb_destroy(kcontext, context->db); destroy_kadm5_log_context(&context->log_context); diff --git a/lib/kadm5/kadm5-hook.h b/lib/kadm5/kadm5-hook.h new file mode 100644 index 000000000..55755b85d --- /dev/null +++ b/lib/kadm5/kadm5-hook.h @@ -0,0 +1,139 @@ +/* + * Copyright 2010 + * The Board of Trustees of the Leland Stanford Junior University + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifndef KADM5_HOOK_H +#define KADM5_HOOK_H 1 + +#define KADM5_HOOK_VERSION_V1 1 + +/* + * Each hook is called before the operation using KADM5_STAGE_PRECOMMIT and + * then after the operation using KADM5_STAGE_POSTCOMMIT. If the hook returns + * failure during precommit, the operation is aborted without changes to the + * database. + */ +enum kadm5_hook_stage { + KADM5_HOOK_STAGE_PRECOMMIT, + KADM5_HOOK_STAGE_POSTCOMMIT +}; + +#define KADM5_HOOK_FLAG_KEEPOLD 0x1 /* keep old password */ +#define KADM5_HOOK_FLAG_CONDITIONAL 0x2 /* only change password if different */ + +/* + * libkadm5srv expects a symbol named kadm5_hook_init that must be a function + * of type kadm5_hook_init_t. The function will be called with the maximum + * version of the hook API supported by libkadm5; the plugin may return an + * earlier version. + */ +typedef struct kadm5_hook { + const char *name; + uint32_t version; + const char *vendor; + + /* + * Set this to krb5_init_context(): kadmin will use this to verify + * that we are linked against the same libkrb5. + */ + krb5_error_code (KRB5_CALLCONV *init_context)(krb5_context *); + + void (KRB5_CALLCONV *fini)(krb5_context, void *data); + + /* + * Hook functions; NULL functions are ignored. code is only valid on + * post-commit hooks and represents the result of the commit. Post- + * commit hooks are not called if a pre-commit hook aborted the call. + */ + krb5_error_code (KRB5_CALLCONV *chpass)(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ, + uint32_t flags, + size_t n_ks_tuple, + krb5_key_salt_tuple *ks_tuple, + const char *password); + + krb5_error_code (KRB5_CALLCONV *create)(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + kadm5_principal_ent_t ent, + uint32_t mask, + const char *password); + + krb5_error_code (KRB5_CALLCONV *modify)(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + kadm5_principal_ent_t ent, + uint32_t mask); + + krb5_error_code (KRB5_CALLCONV *delete)(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ); + + krb5_error_code (KRB5_CALLCONV *randkey)(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ); + + krb5_error_code (KRB5_CALLCONV *rename)(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal source, + krb5_const_principal target); + + krb5_error_code (KRB5_CALLCONV *set_keys)(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ, + uint32_t flags, + size_t n_ks_tuple, + krb5_key_salt_tuple *ks_tuple, + size_t n_keys, + krb5_keyblock *keyblocks); + +} kadm5_hook; + +typedef krb5_error_code +(KRB5_CALLCONV *kadm5_hook_init_t)(krb5_context context, + uint32_t kadm5_version_max, + const kadm5_hook **hook, + void **data); + +#endif /* !KADM5_HOOK_H */ diff --git a/lib/kadm5/kadm5_err.et b/lib/kadm5/kadm5_err.et index bcbaea846..42f4069e7 100644 --- a/lib/kadm5/kadm5_err.et +++ b/lib/kadm5/kadm5_err.et @@ -67,3 +67,7 @@ error_code ALREADY_LOCKED, "Database already locked" error_code NOT_LOCKED, "Database not locked" error_code LOG_CORRUPT, "Incremental propagation log got corrupted" error_code LOG_NEEDS_UPGRADE, "Incremental propagation log must be upgraded" +error_code BAD_SERVER_HOOK, "Bad KADM5 server hook" +error_code SERVER_HOOK_NOT_FOUND, "Cannot find KADM5 server hook" +error_code OLD_SERVER_HOOK_VERSION, "KADM5 server hook is too old for this version of Heimdal" +error_code NEW_SERVER_HOOK_VERSION, "KADM5 server hook is too new for this version of Heimdal" diff --git a/lib/kadm5/modify_s.c b/lib/kadm5/modify_s.c index e76dbdbbc..27d9f5dae 100644 --- a/lib/kadm5/modify_s.c +++ b/lib/kadm5/modify_s.c @@ -35,6 +35,37 @@ RCSID("$Id$"); +static kadm5_ret_t +modify_principal_hook(kadm5_server_context *context, + enum kadm5_hook_stage stage, + krb5_error_code code, + kadm5_principal_ent_t princ, + uint32_t mask) +{ + krb5_error_code ret = 0; + size_t i; + + for (i = 0; i < context->num_hooks; i++) { + kadm5_hook_context *hook = context->hooks[i]; + + if (hook->hook->modify != NULL) { + ret = hook->hook->modify(context->context, hook->data, + stage, code, princ, mask); + if (ret != 0) { + krb5_prepend_error_message(context->context, ret, + "modify hook `%s' failed %scommit", + hook->hook->name, + stage == KADM5_HOOK_STAGE_PRECOMMIT + ? "pre" : "post"); + if (stage == KADM5_HOOK_STAGE_PRECOMMIT) + break; + } + } + } + + return ret; +} + static kadm5_ret_t modify_principal(void *server_handle, kadm5_principal_ent_t princ, @@ -66,6 +97,11 @@ modify_principal(void *server_handle, princ->principal, HDB_F_GET_ANY|HDB_F_ADMIN_DATA, 0, &ent); if (ret) goto out2; + + ret = modify_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, + 0, princ, mask); + if (ret) + goto out3; ret = _kadm5_setup_entry(context, &ent, mask, princ, mask, NULL, 0); if (ret) goto out3; @@ -114,6 +150,9 @@ modify_principal(void *server_handle, ret = kadm5_log_modify(context, &ent.entry, mask | KADM5_MOD_NAME | KADM5_MOD_TIME); + (void) modify_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, + ret, princ, mask); + out3: hdb_free_entry(context->context, &ent); out2: diff --git a/lib/kadm5/private.h b/lib/kadm5/private.h index 0b14ebd68..69d1bdc8b 100644 --- a/lib/kadm5/private.h +++ b/lib/kadm5/private.h @@ -36,6 +36,8 @@ #ifndef __kadm5_privatex_h__ #define __kadm5_privatex_h__ +#include "kadm5-hook.h" + #ifdef HAVE_SYS_UN_H #include #endif @@ -67,6 +69,12 @@ struct kadm_func { krb5_keyblock *, int); }; +typedef struct kadm5_hook_context { + void *handle; + const kadm5_hook *hook; + void *data; +} kadm5_hook_context; + /* XXX should be integrated */ typedef struct kadm5_common_context { krb5_context context; @@ -108,6 +116,8 @@ typedef struct kadm5_server_context { krb5_principal caller; unsigned acl_flags; kadm5_log_context log_context; + size_t num_hooks; + kadm5_hook_context **hooks; } kadm5_server_context; typedef struct kadm5_client_context { diff --git a/lib/kadm5/randkey_s.c b/lib/kadm5/randkey_s.c index 64578ab49..61b390a58 100644 --- a/lib/kadm5/randkey_s.c +++ b/lib/kadm5/randkey_s.c @@ -35,6 +35,36 @@ RCSID("$Id$"); +static kadm5_ret_t +randkey_principal_hook(kadm5_server_context *context, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ) +{ + krb5_error_code ret = 0; + size_t i; + + for (i = 0; i < context->num_hooks; i++) { + kadm5_hook_context *hook = context->hooks[i]; + + if (hook->hook->randkey != NULL) { + ret = hook->hook->randkey(context->context, hook->data, + stage, code, princ); + if (ret != 0) { + krb5_prepend_error_message(context->context, ret, + "randkey hook `%s' failed %scommit", + hook->hook->name, + stage == KADM5_HOOK_STAGE_PRECOMMIT + ? "pre" : "post"); + if (stage == KADM5_HOOK_STAGE_PRECOMMIT) + break; + } + } + } + + return ret; +} + /* * Set the keys of `princ' to random values, returning the random keys * in `new_keys', `n_keys'. @@ -52,6 +82,7 @@ kadm5_s_randkey_principal(void *server_handle, kadm5_server_context *context = server_handle; hdb_entry_ex ent; kadm5_ret_t ret; + size_t i; memset(&ent, 0, sizeof(ent)); if (!context->keep_open) { @@ -69,6 +100,10 @@ kadm5_s_randkey_principal(void *server_handle, if(ret) goto out2; + ret = randkey_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, 0, princ); + if (ret) + goto out3; + if (keepold) { ret = hdb_add_current_keys_to_history(context->context, &ent.entry); if (ret) @@ -112,10 +147,10 @@ kadm5_s_randkey_principal(void *server_handle, KADM5_KEY_DATA | KADM5_KVNO | KADM5_PW_EXPIRATION | KADM5_TL_DATA); + (void) randkey_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, ret, princ); + out4: if (ret) { - int i; - for (i = 0; i < *n_keys; ++i) krb5_free_keyblock_contents(context->context, &(*new_keys)[i]); free (*new_keys); diff --git a/lib/kadm5/rename_s.c b/lib/kadm5/rename_s.c index c37aca768..78f28a3f1 100644 --- a/lib/kadm5/rename_s.c +++ b/lib/kadm5/rename_s.c @@ -35,6 +35,37 @@ RCSID("$Id$"); +static kadm5_ret_t +rename_principal_hook(kadm5_server_context *context, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal source, + krb5_const_principal target) +{ + krb5_error_code ret = 0; + size_t i; + + for (i = 0; i < context->num_hooks; i++) { + kadm5_hook_context *hook = context->hooks[i]; + + if (hook->hook->rename != NULL) { + ret = hook->hook->rename(context->context, hook->data, + stage, code, source, target); + if (ret != 0) { + krb5_prepend_error_message(context->context, ret, + "rename hook `%s' failed %scommit", + hook->hook->name, + stage == KADM5_HOOK_STAGE_PRECOMMIT + ? "pre" : "post"); + if (stage == KADM5_HOOK_STAGE_PRECOMMIT) + break; + } + } + } + + return ret; +} + kadm5_ret_t kadm5_s_rename_principal(void *server_handle, krb5_principal source, @@ -44,6 +75,7 @@ kadm5_s_rename_principal(void *server_handle, kadm5_ret_t ret; hdb_entry_ex ent; krb5_principal oldname; + size_t i; memset(&ent, 0, sizeof(ent)); if (krb5_principal_compare(context->context, source, target)) @@ -63,12 +95,17 @@ kadm5_s_rename_principal(void *server_handle, if (ret) goto out2; oldname = ent.entry.principal; + + ret = rename_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, + 0, source, target); + if (ret) + goto out3; + ret = _kadm5_set_modifier(context, &ent.entry); if (ret) goto out3; { /* fix salt */ - size_t i; Salt salt; krb5_salt salt2; memset(&salt, 0, sizeof(salt)); @@ -101,6 +138,9 @@ kadm5_s_rename_principal(void *server_handle, /* This logs the change for iprop and writes to the HDB */ ret = kadm5_log_rename(context, source, &ent.entry); + (void) rename_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, + ret, source, target); + out3: ent.entry.principal = oldname; /* Unborrow target */ hdb_free_entry(context->context, &ent); diff --git a/lib/kadm5/sample_hook.c b/lib/kadm5/sample_hook.c new file mode 100644 index 000000000..e2f9e4fd0 --- /dev/null +++ b/lib/kadm5/sample_hook.c @@ -0,0 +1,185 @@ +/* + * Copyright (c) 2018, AuriStor Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * + */ + +#include "kadm5_locl.h" + +static char sample_data[1]; + +static krb5_error_code +sample_log(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + const char *tag, + krb5_error_code code, + krb5_const_principal princ) +{ + char *p = NULL; + krb5_error_code ret; + + if (data != sample_data) + return EINVAL; + if (code != 0 && stage == KADM5_HOOK_STAGE_PRECOMMIT) + return EINVAL; + + if (princ) + ret = krb5_unparse_name(context, princ, &p); + + krb5_warn(context, code, "sample_hook: %s %s hook princ '%s'", tag, + stage == KADM5_HOOK_STAGE_PRECOMMIT ? "pre-commit" : "post-commit", + p != NULL ? p : ""); + + krb5_xfree(p); + + return 0; +} + +static void KRB5_CALLCONV +sample_fini(krb5_context context, void *data) +{ + krb5_warn(context, 0, "sample_hook: shutting down\n"); +} + +static krb5_error_code KRB5_CALLCONV +sample_chpass_hook(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ, + uint32_t flags, + size_t n_ks_tuple, + krb5_key_salt_tuple *ks_tuple, + const char *password) +{ + return sample_log(context, data, stage, "chpass", code, princ); +} + +static krb5_error_code KRB5_CALLCONV +sample_create_hook(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + kadm5_principal_ent_t ent, + uint32_t mask, + const char *password) +{ + return sample_log(context, data, stage, "create", code, ent->principal); +} + +static krb5_error_code KRB5_CALLCONV +sample_modify_hook(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + kadm5_principal_ent_t ent, + uint32_t mask) +{ + return sample_log(context, data, stage, "modify", code, ent->principal); +} + +static krb5_error_code KRB5_CALLCONV +sample_delete_hook(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ) +{ + return sample_log(context, data, stage, "delete", code, princ); +} + +static krb5_error_code KRB5_CALLCONV +sample_randkey_hook(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ) +{ + return sample_log(context, data, stage, "randkey", code, princ); +} + +static krb5_error_code KRB5_CALLCONV +sample_rename_hook(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal source, + krb5_const_principal target) +{ + return sample_log(context, data, stage, "rename", code, source); +} + +static krb5_error_code KRB5_CALLCONV +sample_set_keys_hook(krb5_context context, + void *data, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ, + uint32_t flags, + size_t n_ks_tuple, + krb5_key_salt_tuple *ks_tuple, + size_t n_keys, + krb5_keyblock *keyblocks) +{ + return sample_log(context, data, stage, "set_keys", code, princ); +} + +static struct kadm5_hook sample_hook = { + "sample-hook", + KADM5_HOOK_VERSION_V1, + "Heimdal", + krb5_init_context, + sample_fini, + sample_chpass_hook, + sample_create_hook, + sample_modify_hook, + sample_delete_hook, + sample_randkey_hook, + sample_rename_hook, + sample_set_keys_hook +}; + +krb5_error_code +kadm5_hook_init(krb5_context context, uint32_t vers_max, + const kadm5_hook **hook, void **data); + +krb5_error_code +kadm5_hook_init(krb5_context context, uint32_t vers_max, + const kadm5_hook **hook, void **data) +{ + if (vers_max < KADM5_HOOK_VERSION_V1) + return EINVAL; + + krb5_warn(context, 0, "sample_hook: init version %u\n", vers_max); + + *hook = &sample_hook; + *data = sample_data; + + return 0; +} diff --git a/lib/kadm5/server_hooks.c b/lib/kadm5/server_hooks.c new file mode 100644 index 000000000..5a3cc0c5c --- /dev/null +++ b/lib/kadm5/server_hooks.c @@ -0,0 +1,183 @@ +/* + * Copyright 2010 + * The Board of Trustees of the Leland Stanford Junior University + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "kadm5_locl.h" +#include + +#ifndef RTLD_NOW +# define RTLD_NOW 0 +#endif + +#ifndef RTLD_LOCAL + #define RTLD_LOCAL 0 +#endif + +#ifndef RTLD_GROUP + #define RTLD_GROUP 0 +#endif + +/* + * Load kadmin server hooks. + */ +#ifdef HAVE_DLOPEN + +kadm5_ret_t +_kadm5_s_init_hooks(kadm5_server_context *ctx) +{ + krb5_context context = ctx->context; + char **hooks; + size_t i; + void *handle = NULL; + struct kadm5_hook_context *hook_context = NULL; + struct kadm5_hook_context **tmp; + kadm5_ret_t ret = KADM5_BAD_SERVER_HOOK; + + hooks = krb5_config_get_strings(context, NULL, + "kadmin", "hooks", NULL); + if (hooks == NULL) + return 0; + + for (i = 0; hooks[i] != NULL; i++) { + const char *hookpath = hooks[i]; + kadm5_hook_init_t hook_init; + const struct kadm5_hook *hook = NULL; + void *data = NULL; + + handle = dlopen(hookpath, RTLD_NOW | RTLD_LOCAL | RTLD_GROUP); + if (handle == NULL) { + krb5_warnx(context, "failed to open `%s': %s", hookpath, dlerror()); + ret = KADM5_SERVER_HOOK_NOT_FOUND; + goto fail; + } + + hook_init = dlsym(handle, "kadm5_hook_init"); + if (hook_init == NULL) { + krb5_warnx(context, "didn't find `kadm5_hook_init' symbol in `%s':" + " %s", hookpath, dlerror()); + ret = KADM5_BAD_SERVER_HOOK; + goto fail; + } + + ret = hook_init(context, KADM5_HOOK_VERSION_V1, &hook, &data); + if (ret == 0 && hook == NULL) + ret = KADM5_BAD_SERVER_HOOK; + if (ret) { + krb5_warn(context, ret, "initialize of hook `%s' failed", hookpath); + goto fail; + } + + if (hook->version < KADM5_HOOK_VERSION_V1) + ret = KADM5_OLD_SERVER_HOOK_VERSION; + else if (hook->version > KADM5_HOOK_VERSION_V1) + ret = KADM5_NEW_SERVER_HOOK_VERSION; + if (ret) { + krb5_warnx(context, "version of loaded hook `%s' is %u" + " (supported versions %u to %u)", hookpath, hook->version, + KADM5_HOOK_VERSION_V1, KADM5_HOOK_VERSION_V1); + hook->fini(context, data); + goto fail; + } + + if (hook->init_context != krb5_init_context) { + krb5_warnx(context, "loaded hook `%s' is not linked against " + "this version of Heimdal", hookpath); + hook->fini(context, data); + goto fail; + } + + hook_context = calloc(1, sizeof(*hook_context)); + if (hook_context == NULL) { + ret = krb5_enomem(context); + hook->fini(context, data); + goto fail; + } + + hook_context->handle = handle; + hook_context->hook = hook; + hook_context->data = data; + + tmp = realloc(ctx->hooks, (ctx->num_hooks + 1) * sizeof(*tmp)); + if (tmp == NULL) { + ret = krb5_enomem(context); + hook->fini(context, data); + goto fail; + } + ctx->hooks = tmp; + ctx->hooks[ctx->num_hooks] = hook_context; + hook_context = NULL; + ctx->num_hooks++; + } + + return 0; + +fail: + _kadm5_s_free_hooks(ctx); + if (hook_context != NULL) + free(hook_context); + if (handle != NULL) + dlclose(handle); + krb5_config_free_strings(hooks); + + return ret; +} + +void +_kadm5_s_free_hooks(kadm5_server_context *ctx) +{ + int i; + + for (i = 0; i < ctx->num_hooks; i++) { + if (ctx->hooks[i]->hook->fini != NULL) + ctx->hooks[i]->hook->fini(ctx->context, ctx->hooks[i]->data); + dlclose(ctx->hooks[i]->handle); + free(ctx->hooks[i]); + } + free(ctx->hooks); + ctx->hooks = NULL; + ctx->num_hooks = 0; +} + +# else /* !HAVE_DLOPEN */ + +kadm5_ret_t +_kadm5_s_init_hooks(kadm5_server_context *ctx) +{ + return 0; +} + +void +_kadm5_s_free_hooks(kadm5_server_context *ctx) +{ + return 0; +} + +#endif /* !HAVE_DLOPEN */ diff --git a/lib/kadm5/setkey3_s.c b/lib/kadm5/setkey3_s.c index 03b5d8101..91df57f2d 100644 --- a/lib/kadm5/setkey3_s.c +++ b/lib/kadm5/setkey3_s.c @@ -33,6 +33,43 @@ #include "kadm5_locl.h" +static kadm5_ret_t +setkey_principal_hook(kadm5_server_context *context, + enum kadm5_hook_stage stage, + krb5_error_code code, + krb5_const_principal princ, + uint32_t flags, + size_t n_ks_tuple, + krb5_key_salt_tuple *ks_tuple, + size_t n_keys, + krb5_keyblock *keyblocks) +{ + krb5_error_code ret = 0; + size_t i; + + for (i = 0; i < context->num_hooks; i++) { + kadm5_hook_context *hook = context->hooks[i]; + + if (hook->hook->set_keys != NULL) { + ret = hook->hook->set_keys(context->context, hook->data, + stage, code, princ, + flags, n_ks_tuple, ks_tuple, + n_keys, keyblocks); + if (ret != 0) { + krb5_prepend_error_message(context->context, ret, + "setkey hook `%s' failed %scommit", + hook->hook->name, + stage == KADM5_HOOK_STAGE_PRECOMMIT + ? "pre" : "post"); + if (stage == KADM5_HOOK_STAGE_PRECOMMIT) + break; + } + } + } + + return ret; +} + /** * Server-side function to set new keys for a principal. */ @@ -47,6 +84,7 @@ kadm5_s_setkey_principal_3(void *server_handle, kadm5_server_context *context = server_handle; hdb_entry_ex ent; kadm5_ret_t ret = 0; + size_t i; memset(&ent, 0, sizeof(ent)); if (!context->keep_open) @@ -70,6 +108,16 @@ kadm5_s_setkey_principal_3(void *server_handle, return ret; } + ret = setkey_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT, 0, + princ, keepold ? KADM5_HOOK_FLAG_KEEPOLD : 0, + n_ks_tuple, ks_tuple, n_keys, keyblocks); + if (ret) { + (void) kadm5_log_end(context); + if (!context->keep_open) + context->db->hdb_close(context->context, context->db); + return ret; + } + if (keepold) { ret = hdb_add_current_keys_to_history(context->context, &ent.entry); } else @@ -84,8 +132,6 @@ kadm5_s_setkey_principal_3(void *server_handle, * each ks_tuple's enctype matches the corresponding key enctype. */ if (ret == 0) { - int i; - free_Keys(&ent.entry.keys); for (i = 0; i < n_keys; ++i) { Key k; @@ -127,6 +173,10 @@ kadm5_s_setkey_principal_3(void *server_handle, KADM5_PW_EXPIRATION | KADM5_TL_DATA); } + (void) setkey_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT, ret, + princ, keepold, n_ks_tuple, ks_tuple, + n_keys, keyblocks); + hdb_free_entry(context->context, &ent); (void) kadm5_log_end(context); if (!context->keep_open)