1 /* $NetBSD: hpropd.c,v 1.2 2017/01/28 21:31:44 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include "hprop.h" 37 38 static int inetd_flag = -1; 39 static int help_flag; 40 static int version_flag; 41 static int print_dump; 42 static const char *database; 43 static int from_stdin; 44 static char *local_realm; 45 static char *ktname = NULL; 46 47 struct getargs args[] = { 48 { "database", 'd', arg_string, rk_UNCONST(&database), "database", "file" }, 49 { "stdin", 'n', arg_flag, &from_stdin, "read from stdin", NULL }, 50 { "print", 0, arg_flag, &print_dump, "print dump to stdout", NULL }, 51 #ifdef SUPPORT_INETD 52 { "inetd", 'i', arg_negative_flag, &inetd_flag, 53 "Not started from inetd", NULL }, 54 #endif 55 { "keytab", 'k', arg_string, &ktname, "keytab to use for authentication", "keytab" }, 56 { "realm", 'r', arg_string, &local_realm, "realm to use", NULL }, 57 { "version", 0, arg_flag, &version_flag, NULL, NULL }, 58 { "help", 'h', arg_flag, &help_flag, NULL, NULL} 59 }; 60 61 static int num_args = sizeof(args) / sizeof(args[0]); 62 static char unparseable_name[] = "unparseable name"; 63 64 static void 65 usage(int ret) 66 { 67 arg_printusage (args, num_args, NULL, ""); 68 exit (ret); 69 } 70 71 int 72 main(int argc, char **argv) 73 { 74 krb5_error_code ret; 75 krb5_context context; 76 krb5_auth_context ac = NULL; 77 krb5_principal c1, c2; 78 krb5_authenticator authent; 79 krb5_keytab keytab; 80 krb5_socket_t sock = rk_INVALID_SOCKET; 81 HDB *db = NULL; 82 int optidx = 0; 83 char *tmp_db; 84 krb5_log_facility *fac; 85 int nprincs; 86 87 setprogname(argv[0]); 88 89 ret = krb5_init_context(&context); 90 if (ret) 91 exit(1); 92 93 ret = krb5_openlog(context, "hpropd", &fac); 94 if (ret) 95 errx(1, "krb5_openlog"); 96 krb5_set_warn_dest(context, fac); 97 98 if (getarg(args, num_args, argc, argv, &optidx)) 99 usage(1); 100 101 if (local_realm != NULL) 102 krb5_set_default_realm(context, local_realm); 103 104 if (help_flag) 105 usage(0); 106 if (version_flag) { 107 print_version(NULL); 108 exit(0); 109 } 110 111 argc -= optidx; 112 argv += optidx; 113 114 if (argc != 0) 115 usage(1); 116 117 if (database == NULL) 118 database = hdb_default_db(context); 119 120 if (from_stdin) { 121 sock = STDIN_FILENO; 122 } else { 123 struct sockaddr_storage ss; 124 struct sockaddr *sa = (struct sockaddr *)&ss; 125 socklen_t sin_len = sizeof(ss); 126 char addr_name[256]; 127 krb5_ticket *ticket; 128 char *server; 129 130 sock = STDIN_FILENO; 131 #ifdef SUPPORT_INETD 132 if (inetd_flag == -1) { 133 if (getpeername (sock, sa, &sin_len) < 0) { 134 inetd_flag = 0; 135 } else { 136 inetd_flag = 1; 137 } 138 } 139 #else 140 inetd_flag = 0; 141 #endif 142 if (!inetd_flag) { 143 mini_inetd (krb5_getportbyname (context, "hprop", "tcp", 144 HPROP_PORT), &sock); 145 } 146 sin_len = sizeof(ss); 147 if (getpeername(sock, sa, &sin_len) < 0) 148 krb5_err(context, 1, errno, "getpeername"); 149 150 if (inet_ntop(ss.ss_family, 151 socket_get_address (sa), 152 addr_name, 153 sizeof(addr_name)) == NULL) 154 strlcpy (addr_name, "unknown address", 155 sizeof(addr_name)); 156 157 krb5_log(context, fac, 0, "Connection from %s", addr_name); 158 159 ret = krb5_kt_register(context, &hdb_get_kt_ops); 160 if (ret) 161 krb5_err(context, 1, ret, "krb5_kt_register"); 162 163 if (ktname != NULL) { 164 ret = krb5_kt_resolve(context, ktname, &keytab); 165 if (ret) 166 krb5_err (context, 1, ret, "krb5_kt_resolve %s", ktname); 167 } else { 168 ret = krb5_kt_default (context, &keytab); 169 if (ret) 170 krb5_err (context, 1, ret, "krb5_kt_default"); 171 } 172 173 ret = krb5_recvauth(context, &ac, &sock, HPROP_VERSION, NULL, 174 0, keytab, &ticket); 175 if (ret) 176 krb5_err(context, 1, ret, "krb5_recvauth"); 177 178 ret = krb5_unparse_name(context, ticket->server, &server); 179 if (ret) 180 krb5_err(context, 1, ret, "krb5_unparse_name"); 181 if (strncmp(server, "hprop/", 5) != 0) 182 krb5_errx(context, 1, "ticket not for hprop (%s)", server); 183 184 free(server); 185 krb5_free_ticket (context, ticket); 186 187 ret = krb5_auth_con_getauthenticator(context, ac, &authent); 188 if (ret) 189 krb5_err(context, 1, ret, "krb5_auth_con_getauthenticator"); 190 191 ret = krb5_make_principal(context, &c1, NULL, "kadmin", "hprop", NULL); 192 if (ret) 193 krb5_err(context, 1, ret, "krb5_make_principal"); 194 _krb5_principalname2krb5_principal(context, &c2, 195 authent->cname, authent->crealm); 196 if (!krb5_principal_compare(context, c1, c2)) { 197 char *s; 198 ret = krb5_unparse_name(context, c2, &s); 199 if (ret) 200 s = unparseable_name; 201 krb5_errx(context, 1, "Unauthorized connection from %s", s); 202 } 203 krb5_free_principal(context, c1); 204 krb5_free_principal(context, c2); 205 206 ret = krb5_kt_close(context, keytab); 207 if (ret) 208 krb5_err(context, 1, ret, "krb5_kt_close"); 209 } 210 211 if (!print_dump) { 212 int aret; 213 214 aret = asprintf(&tmp_db, "%s~", database); 215 if (aret == -1) 216 krb5_errx(context, 1, "hdb_create: out of memory"); 217 218 ret = hdb_create(context, &db, tmp_db); 219 if (ret) 220 krb5_err(context, 1, ret, "hdb_create(%s)", tmp_db); 221 ret = db->hdb_open(context, db, O_RDWR | O_CREAT | O_TRUNC, 0600); 222 if (ret) 223 krb5_err(context, 1, ret, "hdb_open(%s)", tmp_db); 224 } 225 226 nprincs = 0; 227 while (1){ 228 krb5_data data; 229 hdb_entry_ex entry; 230 231 if (from_stdin) { 232 ret = krb5_read_message(context, &sock, &data); 233 if (ret != 0 && ret != HEIM_ERR_EOF) 234 krb5_err(context, 1, ret, "krb5_read_message"); 235 } else { 236 ret = krb5_read_priv_message(context, ac, &sock, &data); 237 if (ret) 238 krb5_err(context, 1, ret, "krb5_read_priv_message"); 239 } 240 241 if (ret == HEIM_ERR_EOF || data.length == 0) { 242 if (!from_stdin) { 243 data.data = NULL; 244 data.length = 0; 245 krb5_write_priv_message(context, ac, &sock, &data); 246 } 247 if (!print_dump) { 248 ret = db->hdb_close(context, db); 249 if (ret) 250 krb5_err(context, 1, ret, "db_close"); 251 ret = db->hdb_rename(context, db, database); 252 if (ret) 253 krb5_err(context, 1, ret, "db_rename"); 254 } 255 break; 256 } 257 memset(&entry, 0, sizeof(entry)); 258 ret = hdb_value2entry(context, &data, &entry.entry); 259 krb5_data_free(&data); 260 if (ret) 261 krb5_err(context, 1, ret, "hdb_value2entry"); 262 if (print_dump) { 263 struct hdb_print_entry_arg parg; 264 265 parg.out = stdout; 266 parg.fmt = HDB_DUMP_HEIMDAL; 267 hdb_print_entry(context, db, &entry, &parg); 268 } else { 269 ret = db->hdb_store(context, db, 0, &entry); 270 if (ret == HDB_ERR_EXISTS) { 271 char *s; 272 ret = krb5_unparse_name(context, entry.entry.principal, &s); 273 if (ret) 274 s = strdup(unparseable_name); 275 krb5_warnx(context, "Entry exists: %s", s); 276 free(s); 277 } else if (ret) 278 krb5_err(context, 1, ret, "db_store"); 279 else 280 nprincs++; 281 } 282 hdb_free_entry(context, &entry); 283 } 284 if (!print_dump) 285 krb5_log(context, fac, 0, "Received %d principals", nprincs); 286 287 if (inetd_flag == 0) 288 rk_closesocket(sock); 289 290 exit(0); 291 } 292