1 /* $NetBSD: config.c,v 1.2 2017/01/28 21:31:44 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2007 Kungliga Tekniska Hgskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * 3. Neither the name of the Institute nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 #include "kdc_locl.h" 39 #include <krb5/getarg.h> 40 #include <krb5/parse_bytes.h> 41 42 struct dbinfo { 43 char *realm; 44 char *dbname; 45 char *mkey_file; 46 struct dbinfo *next; 47 }; 48 49 static char *config_file; /* location of kdc config file */ 50 51 static int require_preauth = -1; /* 1 == require preauth for all principals */ 52 static char *max_request_str; /* `max_request' as a string */ 53 54 static int disable_des = -1; 55 56 static int builtin_hdb_flag; 57 int testing_flag; 58 static int help_flag; 59 static int version_flag; 60 61 /* Should we enable the HTTP hack? */ 62 int enable_http = -1; 63 64 /* Log over requests to the KDC */ 65 const char *request_log; 66 67 /* A string describing on what ports to listen */ 68 const char *port_str; 69 70 krb5_addresses explicit_addresses; 71 72 size_t max_request_udp; 73 size_t max_request_tcp; 74 75 76 static struct getarg_strings addresses_str; /* addresses to listen on */ 77 78 char *runas_string; 79 char *chroot_string; 80 81 82 static struct getargs args[] = { 83 { 84 "config-file", 'c', arg_string, &config_file, 85 "location of config file", "file" 86 }, 87 { 88 "require-preauth", 'p', arg_negative_flag, &require_preauth, 89 "don't require pa-data in as-reqs", NULL 90 }, 91 { 92 "max-request", 0, arg_string, &max_request_str, 93 "max size for a kdc-request", "size" 94 }, 95 { "enable-http", 'H', arg_flag, &enable_http, "turn on HTTP support", 96 NULL }, 97 { "ports", 'P', arg_string, rk_UNCONST(&port_str), 98 "ports to listen to", "portspec" 99 }, 100 { 101 "detach", 0 , arg_flag, &detach_from_console, 102 "detach from console", NULL 103 }, 104 { 105 "daemon-child", 0 , arg_flag, &daemon_child, 106 "private argument, do not use", NULL 107 }, 108 #ifdef __APPLE__ 109 { 110 "bonjour", 0 , arg_flag, &do_bonjour, 111 "private argument, do not use", NULL 112 }, 113 #endif 114 { "addresses", 0, arg_strings, &addresses_str, 115 "addresses to listen on", "list of addresses" }, 116 { "disable-des", 0, arg_flag, &disable_des, 117 "disable DES", NULL }, 118 { "builtin-hdb", 0, arg_flag, &builtin_hdb_flag, 119 "list builtin hdb backends", NULL}, 120 { "runas-user", 0, arg_string, &runas_string, 121 "run as this user when connected to network", NULL 122 }, 123 { "chroot", 0, arg_string, &chroot_string, 124 "chroot directory to run in", NULL 125 }, 126 { "testing", 0, arg_flag, &testing_flag, NULL, NULL }, 127 { "help", 'h', arg_flag, &help_flag, NULL, NULL }, 128 { "version", 'v', arg_flag, &version_flag, NULL, NULL } 129 }; 130 131 static int num_args = sizeof(args) / sizeof(args[0]); 132 133 static void 134 usage(int ret) 135 { 136 arg_printusage (args, num_args, NULL, ""); 137 exit (ret); 138 } 139 140 static void 141 add_one_address (krb5_context context, const char *str, int first) 142 { 143 krb5_error_code ret; 144 krb5_addresses tmp; 145 146 ret = krb5_parse_address (context, str, &tmp); 147 if (ret) 148 krb5_err (context, 1, ret, "parse_address `%s'", str); 149 if (first) 150 krb5_copy_addresses(context, &tmp, &explicit_addresses); 151 else 152 krb5_append_addresses(context, &explicit_addresses, &tmp); 153 krb5_free_addresses (context, &tmp); 154 } 155 156 krb5_kdc_configuration * 157 configure(krb5_context context, int argc, char **argv, int *optidx) 158 { 159 krb5_kdc_configuration *config; 160 krb5_error_code ret; 161 162 const char *p; 163 164 *optidx = 0; 165 166 while (getarg(args, num_args, argc, argv, optidx)) 167 warnx("error at argument `%s'", argv[*optidx]); 168 169 if (help_flag) 170 usage (0); 171 172 if (version_flag) { 173 print_version(NULL); 174 exit(0); 175 } 176 177 if (builtin_hdb_flag) { 178 char *list; 179 ret = hdb_list_builtin(context, &list); 180 if (ret) 181 krb5_err(context, 1, ret, "listing builtin hdb backends"); 182 printf("builtin hdb backends: %s\n", list); 183 free(list); 184 exit(0); 185 } 186 187 if(detach_from_console == -1) 188 detach_from_console = krb5_config_get_bool_default(context, NULL, 189 FALSE, 190 "kdc", 191 "detach", NULL); 192 193 if (detach_from_console && daemon_child == -1) 194 roken_detach_prep(argc, argv, "--daemon-child"); 195 196 { 197 char **files; 198 int aret; 199 200 if (config_file == NULL) { 201 aret = asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context)); 202 if (aret == -1 || config_file == NULL) 203 errx(1, "out of memory"); 204 } 205 206 ret = krb5_prepend_config_files_default(config_file, &files); 207 if (ret) 208 krb5_err(context, 1, ret, "getting configuration files"); 209 210 ret = krb5_set_config_files(context, files); 211 krb5_free_config_files(files); 212 if(ret) 213 krb5_err(context, 1, ret, "reading configuration files"); 214 } 215 216 ret = krb5_kdc_get_config(context, &config); 217 if (ret) 218 krb5_err(context, 1, ret, "krb5_kdc_default_config"); 219 220 kdc_openlog(context, "kdc", config); 221 222 ret = krb5_kdc_set_dbinfo(context, config); 223 if (ret) 224 krb5_err(context, 1, ret, "krb5_kdc_set_dbinfo"); 225 226 if(max_request_str) 227 max_request_tcp = max_request_udp = parse_bytes(max_request_str, NULL); 228 229 if(max_request_tcp == 0){ 230 p = krb5_config_get_string (context, 231 NULL, 232 "kdc", 233 "max-request", 234 NULL); 235 if(p) 236 max_request_tcp = max_request_udp = parse_bytes(p, NULL); 237 } 238 239 if(require_preauth != -1) 240 config->require_preauth = require_preauth; 241 242 if(port_str == NULL){ 243 p = krb5_config_get_string(context, NULL, "kdc", "ports", NULL); 244 if (p != NULL) 245 port_str = strdup(p); 246 } 247 248 explicit_addresses.len = 0; 249 250 if (addresses_str.num_strings) { 251 int i; 252 253 for (i = 0; i < addresses_str.num_strings; ++i) 254 add_one_address (context, addresses_str.strings[i], i == 0); 255 free_getarg_strings (&addresses_str); 256 } else { 257 char **foo = krb5_config_get_strings (context, NULL, 258 "kdc", "addresses", NULL); 259 260 if (foo != NULL) { 261 add_one_address (context, *foo++, TRUE); 262 while (*foo) 263 add_one_address (context, *foo++, FALSE); 264 } 265 } 266 267 if(enable_http == -1) 268 enable_http = krb5_config_get_bool(context, NULL, "kdc", 269 "enable-http", NULL); 270 271 if(request_log == NULL) 272 request_log = krb5_config_get_string(context, NULL, 273 "kdc", 274 "kdc-request-log", 275 NULL); 276 277 if (krb5_config_get_string(context, NULL, "kdc", 278 "enforce-transited-policy", NULL)) 279 krb5_errx(context, 1, "enforce-transited-policy deprecated, " 280 "use [kdc]transited-policy instead"); 281 282 if(max_request_tcp == 0) 283 max_request_tcp = 64 * 1024; 284 if(max_request_udp == 0) 285 max_request_udp = 64 * 1024; 286 287 if (port_str == NULL) 288 port_str = "+"; 289 290 if(disable_des == -1) 291 disable_des = krb5_config_get_bool_default(context, NULL, 292 FALSE, 293 "kdc", 294 "disable-des", NULL); 295 if(disable_des) { 296 krb5_enctype_disable(context, ETYPE_DES_CBC_CRC); 297 krb5_enctype_disable(context, ETYPE_DES_CBC_MD4); 298 krb5_enctype_disable(context, ETYPE_DES_CBC_MD5); 299 krb5_enctype_disable(context, ETYPE_DES_CBC_NONE); 300 krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE); 301 krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE); 302 } 303 304 krb5_kdc_windc_init(context); 305 306 krb5_kdc_pkinit_config(context, config); 307 308 return config; 309 } 310
Indexes created Wed Aug 12 00:25:48 UTC 2026