1 /* $NetBSD: config.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * 3. Neither the name of the Institute nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 #include "kdc_locl.h" 39 #include <krb5/getarg.h> 40 #include <krb5/parse_bytes.h> 41 42 struct dbinfo { 43 char *realm; 44 char *dbname; 45 char *mkey_file; 46 struct dbinfo *next; 47 }; 48 49 static char *config_file; /* location of kdc config file */ 50 51 static int require_preauth = -1; /* 1 == require preauth for all principals */ 52 static char *max_request_str; /* `max_request' as a string */ 53 54 static int disable_des = -1; 55 56 static int builtin_hdb_flag; 57 static int help_flag; 58 static int version_flag; 59 60 static struct getarg_strings addresses_str; /* addresses to listen on */ 61 62 char *runas_string; 63 char *chroot_string; 64 65 66 static struct getargs args[] = { 67 { 68 "config-file", 'c', arg_string, &config_file, 69 "location of config file", "file" 70 }, 71 { 72 "require-preauth", 'p', arg_negative_flag, &require_preauth, 73 "don't require pa-data in as-reqs", NULL 74 }, 75 { 76 "max-request", 0, arg_string, &max_request_str, 77 "max size for a kdc-request", "size" 78 }, 79 { "enable-http", 'H', arg_flag, &enable_http, "turn on HTTP support", 80 NULL }, 81 { "ports", 'P', arg_string, rk_UNCONST(&port_str), 82 "ports to listen to", "portspec" 83 }, 84 #ifdef SUPPORT_DETACH 85 #if DETACH_IS_DEFAULT 86 { 87 "detach", 'D', arg_negative_flag, &detach_from_console, 88 "don't detach from console", NULL 89 }, 90 #else 91 { 92 "detach", 0 , arg_flag, &detach_from_console, 93 "detach from console", NULL 94 }, 95 #endif 96 #endif 97 { "addresses", 0, arg_strings, &addresses_str, 98 "addresses to listen on", "list of addresses" }, 99 { "disable-des", 0, arg_flag, &disable_des, 100 "disable DES", NULL }, 101 { "builtin-hdb", 0, arg_flag, &builtin_hdb_flag, 102 "list builtin hdb backends", NULL}, 103 { "runas-user", 0, arg_string, &runas_string, 104 "run as this user when connected to network", NULL 105 }, 106 { "chroot", 0, arg_string, &chroot_string, 107 "chroot directory to run in", NULL 108 }, 109 { "help", 'h', arg_flag, &help_flag, NULL, NULL }, 110 { "version", 'v', arg_flag, &version_flag, NULL, NULL } 111 }; 112 113 static int num_args = sizeof(args) / sizeof(args[0]); 114 115 static void 116 usage(int ret) 117 { 118 arg_printusage (args, num_args, NULL, ""); 119 exit (ret); 120 } 121 122 static void 123 add_one_address (krb5_context context, const char *str, int first) 124 { 125 krb5_error_code ret; 126 krb5_addresses tmp; 127 128 ret = krb5_parse_address (context, str, &tmp); 129 if (ret) 130 krb5_err (context, 1, ret, "parse_address `%s'", str); 131 if (first) 132 krb5_copy_addresses(context, &tmp, &explicit_addresses); 133 else 134 krb5_append_addresses(context, &explicit_addresses, &tmp); 135 krb5_free_addresses (context, &tmp); 136 } 137 138 krb5_kdc_configuration * 139 configure(krb5_context context, int argc, char **argv) 140 { 141 krb5_kdc_configuration *config; 142 krb5_error_code ret; 143 int optidx = 0; 144 const char *p; 145 146 while(getarg(args, num_args, argc, argv, &optidx)) 147 warnx("error at argument `%s'", argv[optidx]); 148 149 if(help_flag) 150 usage (0); 151 152 if (version_flag) { 153 print_version(NULL); 154 exit(0); 155 } 156 157 if (builtin_hdb_flag) { 158 char *list; 159 ret = hdb_list_builtin(context, &list); 160 if (ret) 161 krb5_err(context, 1, ret, "listing builtin hdb backends"); 162 printf("builtin hdb backends: %s\n", list); 163 free(list); 164 exit(0); 165 } 166 167 argc -= optidx; 168 argv += optidx; 169 170 if (argc != 0) 171 usage(1); 172 173 { 174 char **files; 175 176 if (config_file == NULL) { 177 asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context)); 178 if (config_file == NULL) 179 errx(1, "out of memory"); 180 } 181 182 ret = krb5_prepend_config_files_default(config_file, &files); 183 if (ret) 184 krb5_err(context, 1, ret, "getting configuration files"); 185 186 ret = krb5_set_config_files(context, files); 187 krb5_free_config_files(files); 188 if(ret) 189 krb5_err(context, 1, ret, "reading configuration files"); 190 } 191 192 ret = krb5_kdc_get_config(context, &config); 193 if (ret) 194 krb5_err(context, 1, ret, "krb5_kdc_default_config"); 195 196 kdc_openlog(context, "kdc", config); 197 198 ret = krb5_kdc_set_dbinfo(context, config); 199 if (ret) 200 krb5_err(context, 1, ret, "krb5_kdc_set_dbinfo"); 201 202 if(max_request_str) 203 max_request_tcp = max_request_udp = parse_bytes(max_request_str, NULL); 204 205 if(max_request_tcp == 0){ 206 p = krb5_config_get_string (context, 207 NULL, 208 "kdc", 209 "max-request", 210 NULL); 211 if(p) 212 max_request_tcp = max_request_udp = parse_bytes(p, NULL); 213 } 214 215 if(require_preauth != -1) 216 config->require_preauth = require_preauth; 217 218 if(port_str == NULL){ 219 p = krb5_config_get_string(context, NULL, "kdc", "ports", NULL); 220 if (p != NULL) 221 port_str = strdup(p); 222 } 223 224 explicit_addresses.len = 0; 225 226 if (addresses_str.num_strings) { 227 int i; 228 229 for (i = 0; i < addresses_str.num_strings; ++i) 230 add_one_address (context, addresses_str.strings[i], i == 0); 231 free_getarg_strings (&addresses_str); 232 } else { 233 char **foo = krb5_config_get_strings (context, NULL, 234 "kdc", "addresses", NULL); 235 236 if (foo != NULL) { 237 add_one_address (context, *foo++, TRUE); 238 while (*foo) 239 add_one_address (context, *foo++, FALSE); 240 } 241 } 242 243 if(enable_http == -1) 244 enable_http = krb5_config_get_bool(context, NULL, "kdc", 245 "enable-http", NULL); 246 247 if(request_log == NULL) 248 request_log = krb5_config_get_string(context, NULL, 249 "kdc", 250 "kdc-request-log", 251 NULL); 252 253 if (krb5_config_get_string(context, NULL, "kdc", 254 "enforce-transited-policy", NULL)) 255 krb5_errx(context, 1, "enforce-transited-policy deprecated, " 256 "use [kdc]transited-policy instead"); 257 258 #ifdef SUPPORT_DETACH 259 if(detach_from_console == -1) 260 detach_from_console = krb5_config_get_bool_default(context, NULL, 261 DETACH_IS_DEFAULT, 262 "kdc", 263 "detach", NULL); 264 #endif /* SUPPORT_DETACH */ 265 266 if(max_request_tcp == 0) 267 max_request_tcp = 64 * 1024; 268 if(max_request_udp == 0) 269 max_request_udp = 64 * 1024; 270 271 if (port_str == NULL) 272 port_str = "+"; 273 274 if(disable_des == -1) 275 disable_des = krb5_config_get_bool_default(context, NULL, 276 FALSE, 277 "kdc", 278 "disable-des", NULL); 279 if(disable_des) { 280 krb5_enctype_disable(context, ETYPE_DES_CBC_CRC); 281 krb5_enctype_disable(context, ETYPE_DES_CBC_MD4); 282 krb5_enctype_disable(context, ETYPE_DES_CBC_MD5); 283 krb5_enctype_disable(context, ETYPE_DES_CBC_NONE); 284 krb5_enctype_disable(context, ETYPE_DES_CFB64_NONE); 285 krb5_enctype_disable(context, ETYPE_DES_PCBC_NONE); 286 } 287 288 krb5_kdc_windc_init(context); 289 290 krb5_kdc_pkinit_config(context, config); 291 292 return config; 293 } 294