10Sstevel@tonic-gate /* 2*3641Ssemery * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 30Sstevel@tonic-gate * Use is subject to license terms. 40Sstevel@tonic-gate */ 50Sstevel@tonic-gate 60Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 70Sstevel@tonic-gate 80Sstevel@tonic-gate /* 90Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 100Sstevel@tonic-gate * 110Sstevel@tonic-gate * Openvision retains the copyright to derivative works of 120Sstevel@tonic-gate * this source code. Do *NOT* create a derivative of this 130Sstevel@tonic-gate * source code before consulting with your legal department. 140Sstevel@tonic-gate * Do *NOT* integrate *ANY* of this source code into another 150Sstevel@tonic-gate * product before consulting with your legal department. 160Sstevel@tonic-gate * 170Sstevel@tonic-gate * For further information, read the top-level Openvision 180Sstevel@tonic-gate * copyright which is contained in the top-level MIT Kerberos 190Sstevel@tonic-gate * copyright. 200Sstevel@tonic-gate * 210Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 220Sstevel@tonic-gate * 230Sstevel@tonic-gate */ 240Sstevel@tonic-gate 250Sstevel@tonic-gate 260Sstevel@tonic-gate /* 270Sstevel@tonic-gate * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved 280Sstevel@tonic-gate * 290Sstevel@tonic-gate */ 300Sstevel@tonic-gate 310Sstevel@tonic-gate #include <gssapi/gssapi.h> 320Sstevel@tonic-gate #include <gssapi_krb5.h> /* for gss_nt_krb5_name */ 330Sstevel@tonic-gate #include <krb5.h> 340Sstevel@tonic-gate #include <kadm5/admin.h> 350Sstevel@tonic-gate #include <kadm5/kadm_rpc.h> 360Sstevel@tonic-gate #include <kadm5/server_internal.h> 370Sstevel@tonic-gate #include <kadm5/srv/server_acl.h> 380Sstevel@tonic-gate #include <security/pam_appl.h> 390Sstevel@tonic-gate 400Sstevel@tonic-gate #include <syslog.h> 412881Smp153739 #include <arpa/inet.h> /* inet_ntoa */ 422881Smp153739 #include <krb5/adm_proto.h> /* krb5_klog_syslog */ 430Sstevel@tonic-gate #include <libintl.h> 440Sstevel@tonic-gate #include "misc.h" 450Sstevel@tonic-gate 462881Smp153739 #define LOG_UNAUTH gettext("Unauthorized request: %s, %s, " \ 470Sstevel@tonic-gate "client=%s, service=%s, addr=%s") 482881Smp153739 #define LOG_DONE gettext("Request: %s, %s, %s, client=%s, " \ 490Sstevel@tonic-gate "service=%s, addr=%s") 500Sstevel@tonic-gate 512881Smp153739 extern gss_name_t gss_changepw_name; 522881Smp153739 extern gss_name_t gss_oldchangepw_name; 532881Smp153739 extern void * global_server_handle; 540Sstevel@tonic-gate extern short l_port; 550Sstevel@tonic-gate 560Sstevel@tonic-gate char buf[33]; 570Sstevel@tonic-gate 582881Smp153739 #define CHANGEPW_SERVICE(rqstp) \ 590Sstevel@tonic-gate (cmp_gss_names_rel_1(acceptor_name(rqstp), gss_changepw_name) |\ 602881Smp153739 (gss_oldchangepw_name && \ 612881Smp153739 cmp_gss_names_rel_1(acceptor_name(rqstp), \ 620Sstevel@tonic-gate gss_oldchangepw_name))) 630Sstevel@tonic-gate 642881Smp153739 652881Smp153739 static int gss_to_krb5_name(kadm5_server_handle_t handle, 662881Smp153739 gss_name_t gss_name, krb5_principal *princ); 672881Smp153739 682881Smp153739 static int gss_name_to_string(gss_name_t gss_name, gss_buffer_desc *str); 692881Smp153739 702881Smp153739 static gss_name_t acceptor_name(struct svc_req * rqstp); 712881Smp153739 720Sstevel@tonic-gate kadm5_ret_t 730Sstevel@tonic-gate kadm5_get_priv(void *server_handle, 740Sstevel@tonic-gate long *privs, gss_name_t clnt); 750Sstevel@tonic-gate 760Sstevel@tonic-gate gss_name_t 770Sstevel@tonic-gate get_clnt_name(struct svc_req * rqstp) 780Sstevel@tonic-gate { 790Sstevel@tonic-gate OM_uint32 maj_stat, min_stat; 800Sstevel@tonic-gate gss_name_t name; 810Sstevel@tonic-gate rpc_gss_rawcred_t *raw_cred; 820Sstevel@tonic-gate void *cookie; 830Sstevel@tonic-gate gss_buffer_desc name_buff; 840Sstevel@tonic-gate 850Sstevel@tonic-gate rpc_gss_getcred(rqstp, &raw_cred, NULL, &cookie); 860Sstevel@tonic-gate name_buff.value = raw_cred->client_principal->name; 870Sstevel@tonic-gate name_buff.length = raw_cred->client_principal->len; 880Sstevel@tonic-gate maj_stat = gss_import_name(&min_stat, &name_buff, 890Sstevel@tonic-gate (gss_OID) GSS_C_NT_EXPORT_NAME, &name); 900Sstevel@tonic-gate if (maj_stat != GSS_S_COMPLETE) { 910Sstevel@tonic-gate return (NULL); 920Sstevel@tonic-gate } 930Sstevel@tonic-gate return (name); 940Sstevel@tonic-gate } 950Sstevel@tonic-gate 960Sstevel@tonic-gate char * 970Sstevel@tonic-gate client_addr(struct svc_req * req, char *buf) 980Sstevel@tonic-gate { 990Sstevel@tonic-gate struct sockaddr *ca; 1000Sstevel@tonic-gate u_char *b; 1010Sstevel@tonic-gate char *frontspace = " "; 1020Sstevel@tonic-gate 1030Sstevel@tonic-gate /* 1040Sstevel@tonic-gate * Convert the caller's IP address to a dotted string 1050Sstevel@tonic-gate */ 1060Sstevel@tonic-gate ca = (struct sockaddr *) 1070Sstevel@tonic-gate svc_getrpccaller(req->rq_xprt)->buf; 1080Sstevel@tonic-gate 1090Sstevel@tonic-gate if (ca->sa_family == AF_INET) { 1100Sstevel@tonic-gate b = (u_char *) & ((struct sockaddr_in *) ca)->sin_addr; 1110Sstevel@tonic-gate (void) sprintf(buf, "%s(%d.%d.%d.%d) ", frontspace, 1120Sstevel@tonic-gate b[0] & 0xFF, b[1] & 0xFF, b[2] & 0xFF, b[3] & 0xFF); 1130Sstevel@tonic-gate } else { 1140Sstevel@tonic-gate /* 1150Sstevel@tonic-gate * No IP address to print. If there was a host name 1160Sstevel@tonic-gate * printed, then we print a space. 1170Sstevel@tonic-gate */ 1180Sstevel@tonic-gate (void) sprintf(buf, frontspace); 1190Sstevel@tonic-gate } 1200Sstevel@tonic-gate 1210Sstevel@tonic-gate return (buf); 1220Sstevel@tonic-gate } 1230Sstevel@tonic-gate 1242881Smp153739 static int cmp_gss_names(gss_name_t n1, gss_name_t n2) 1250Sstevel@tonic-gate { 1262881Smp153739 OM_uint32 emaj, emin; 1272881Smp153739 int equal; 1280Sstevel@tonic-gate 1292881Smp153739 if (GSS_ERROR(emaj = gss_compare_name(&emin, n1, n2, &equal))) 1302881Smp153739 return(0); 1310Sstevel@tonic-gate 1322881Smp153739 return(equal); 1330Sstevel@tonic-gate } 1340Sstevel@tonic-gate 1350Sstevel@tonic-gate /* Does a comparison of the names and then releases the first entity */ 1360Sstevel@tonic-gate /* For use above in CHANGEPW_SERVICE */ 1372881Smp153739 static int cmp_gss_names_rel_1(gss_name_t n1, gss_name_t n2) 1380Sstevel@tonic-gate { 1390Sstevel@tonic-gate OM_uint32 min_stat; 1400Sstevel@tonic-gate int ret; 1412881Smp153739 1422881Smp153739 ret = cmp_gss_names(n1, n2); 1430Sstevel@tonic-gate if (n1) (void) gss_release_name(&min_stat, &n1); 1440Sstevel@tonic-gate return ret; 1450Sstevel@tonic-gate } 1460Sstevel@tonic-gate 1470Sstevel@tonic-gate /* 1480Sstevel@tonic-gate * Function check_handle 1490Sstevel@tonic-gate * 1500Sstevel@tonic-gate * Purpose: Check a server handle and return a com_err code if it is 1510Sstevel@tonic-gate * invalid or 0 if it is valid. 1520Sstevel@tonic-gate * 1530Sstevel@tonic-gate * Arguments: 1540Sstevel@tonic-gate * 1550Sstevel@tonic-gate * handle The server handle. 1560Sstevel@tonic-gate */ 1570Sstevel@tonic-gate 1582881Smp153739 static int check_handle(void *handle) 1590Sstevel@tonic-gate { 1602881Smp153739 CHECK_HANDLE(handle); 1612881Smp153739 return 0; 1620Sstevel@tonic-gate } 1630Sstevel@tonic-gate 1640Sstevel@tonic-gate /* 1650Sstevel@tonic-gate * Function: new_server_handle 1660Sstevel@tonic-gate * 1670Sstevel@tonic-gate * Purpose: Constructs a server handle suitable for passing into the 1680Sstevel@tonic-gate * server library API functions, by folding the client's API version 1690Sstevel@tonic-gate * and calling principal into the server handle returned by 1700Sstevel@tonic-gate * kadm5_init. 1710Sstevel@tonic-gate * 1720Sstevel@tonic-gate * Arguments: 1730Sstevel@tonic-gate * api_version (input) The API version specified by the client 1740Sstevel@tonic-gate * rqstp (input) The RPC request 1750Sstevel@tonic-gate * handle (output) The returned handle 1760Sstevel@tonic-gate * <return value> (output) An error code, or 0 if no error occurred 1772881Smp153739 * 1780Sstevel@tonic-gate * Effects: 1790Sstevel@tonic-gate * Returns a pointer to allocated storage containing the server 1800Sstevel@tonic-gate * handle. If an error occurs, then no allocated storage is 1810Sstevel@tonic-gate * returned, and the return value of the function will be a 1820Sstevel@tonic-gate * non-zero com_err code. 1832881Smp153739 * 1840Sstevel@tonic-gate * The allocated storage for the handle should be freed with 1850Sstevel@tonic-gate * free_server_handle (see below) when it is no longer needed. 1860Sstevel@tonic-gate */ 1870Sstevel@tonic-gate 1882881Smp153739 static kadm5_ret_t new_server_handle(krb5_ui_4 api_version, 1892881Smp153739 struct svc_req *rqstp, 1902881Smp153739 kadm5_server_handle_t 1912881Smp153739 *out_handle) 1920Sstevel@tonic-gate { 1932881Smp153739 kadm5_server_handle_t handle; 1940Sstevel@tonic-gate gss_name_t name; 1950Sstevel@tonic-gate OM_uint32 min_stat; 1960Sstevel@tonic-gate 1972881Smp153739 if (! (handle = (kadm5_server_handle_t) 1982881Smp153739 malloc(sizeof(*handle)))) 1992881Smp153739 return ENOMEM; 2000Sstevel@tonic-gate 2012881Smp153739 *handle = *(kadm5_server_handle_t)global_server_handle; 2022881Smp153739 handle->api_version = api_version; 2030Sstevel@tonic-gate 2042881Smp153739 if (!(name = get_clnt_name(rqstp))) { 2052881Smp153739 free(handle); 2062881Smp153739 return KADM5_FAILURE; 2072881Smp153739 } 2082881Smp153739 if (! gss_to_krb5_name(handle, name, &handle->current_caller)) { 2092881Smp153739 free(handle); 2100Sstevel@tonic-gate gss_release_name(&min_stat, &name); 2112881Smp153739 return KADM5_FAILURE; 2120Sstevel@tonic-gate } 2130Sstevel@tonic-gate gss_release_name(&min_stat, &name); 2140Sstevel@tonic-gate 2152881Smp153739 *out_handle = handle; 2162881Smp153739 return 0; 2170Sstevel@tonic-gate } 2180Sstevel@tonic-gate 2190Sstevel@tonic-gate /* 2200Sstevel@tonic-gate * Function: free_server_handle 2210Sstevel@tonic-gate * 2220Sstevel@tonic-gate * Purpose: Free handle memory allocated by new_server_handle 2230Sstevel@tonic-gate * 2240Sstevel@tonic-gate * Arguments: 2250Sstevel@tonic-gate * handle (input/output) The handle to free 2260Sstevel@tonic-gate */ 2272881Smp153739 static void free_server_handle(kadm5_server_handle_t handle) 2280Sstevel@tonic-gate { 2292881Smp153739 krb5_free_principal(handle->context, handle->current_caller); 2302881Smp153739 free(handle); 2310Sstevel@tonic-gate } 2320Sstevel@tonic-gate 2330Sstevel@tonic-gate /* 2340Sstevel@tonic-gate * Function: setup_gss_names 2350Sstevel@tonic-gate * 2360Sstevel@tonic-gate * Purpose: Create printable representations of the client and server 2370Sstevel@tonic-gate * names. 2380Sstevel@tonic-gate * 2390Sstevel@tonic-gate * Arguments: 2400Sstevel@tonic-gate * rqstp (r) the RPC request 2410Sstevel@tonic-gate * client_name (w) pointer to client_name string 2420Sstevel@tonic-gate * server_name (w) pointer to server_name string 2430Sstevel@tonic-gate * 2440Sstevel@tonic-gate * Effects: 2450Sstevel@tonic-gate * 2460Sstevel@tonic-gate * Unparses the client and server names into client_name and 2470Sstevel@tonic-gate * server_name, both of which must be freed by the caller. Returns 0 2480Sstevel@tonic-gate * on success and -1 on failure. On failure client_name and server_name 2490Sstevel@tonic-gate * will point to null. 2500Sstevel@tonic-gate */ 2512881Smp153739 /* SUNW14resync */ 2522881Smp153739 int setup_gss_names(struct svc_req *rqstp, 2530Sstevel@tonic-gate char **client_name, char **server_name) 2540Sstevel@tonic-gate { 2552881Smp153739 OM_uint32 maj_stat, min_stat; 2560Sstevel@tonic-gate rpc_gss_rawcred_t *raw_cred; 2570Sstevel@tonic-gate gss_buffer_desc name_buf; 2580Sstevel@tonic-gate char *tmp, *val; 2590Sstevel@tonic-gate size_t len; 2600Sstevel@tonic-gate gss_name_t name; 2610Sstevel@tonic-gate 2620Sstevel@tonic-gate *client_name = NULL; 2630Sstevel@tonic-gate 2640Sstevel@tonic-gate rpc_gss_getcred(rqstp, &raw_cred, NULL, NULL); 2650Sstevel@tonic-gate 2660Sstevel@tonic-gate /* Return a copy of the service principal from the raw_cred */ 2670Sstevel@tonic-gate *server_name = strdup(raw_cred->svc_principal); 2680Sstevel@tonic-gate 2690Sstevel@tonic-gate if (*server_name == NULL) 2700Sstevel@tonic-gate return (-1); 2710Sstevel@tonic-gate 2720Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 2730Sstevel@tonic-gate free(*server_name); 2740Sstevel@tonic-gate *server_name = NULL; 2750Sstevel@tonic-gate return (-1); 2760Sstevel@tonic-gate } 2770Sstevel@tonic-gate maj_stat = gss_display_name(&min_stat, name, &name_buf, NULL); 2780Sstevel@tonic-gate if (maj_stat != GSS_S_COMPLETE) { 2790Sstevel@tonic-gate free(*server_name); 2800Sstevel@tonic-gate gss_release_name(&min_stat, &name); 2810Sstevel@tonic-gate *server_name = NULL; 2820Sstevel@tonic-gate return (-1); 2830Sstevel@tonic-gate } 2840Sstevel@tonic-gate gss_release_name(&min_stat, &name); 2850Sstevel@tonic-gate 2860Sstevel@tonic-gate /* 2870Sstevel@tonic-gate * Allocate space to copy the client principal. We allocate an 2880Sstevel@tonic-gate * extra byte to make the string null terminated if we need to. 2890Sstevel@tonic-gate */ 2900Sstevel@tonic-gate 2910Sstevel@tonic-gate val = name_buf.value; 2920Sstevel@tonic-gate len = name_buf.length + (val[name_buf.length - 1] != '\0'); 2930Sstevel@tonic-gate 2940Sstevel@tonic-gate /* len is the length including the null terminating byte. */ 2950Sstevel@tonic-gate 2960Sstevel@tonic-gate tmp = malloc(len); 2970Sstevel@tonic-gate if (tmp) { 2980Sstevel@tonic-gate memcpy(tmp, val, len - 1); 2990Sstevel@tonic-gate tmp[len - 1] = '\0'; 3000Sstevel@tonic-gate } else { 3010Sstevel@tonic-gate free(*server_name); 3020Sstevel@tonic-gate *server_name = NULL; 3030Sstevel@tonic-gate } 3040Sstevel@tonic-gate 3050Sstevel@tonic-gate /* Were done with the GSS buffer */ 3060Sstevel@tonic-gate (void) gss_release_buffer(&min_stat, &name_buf); 3070Sstevel@tonic-gate 3080Sstevel@tonic-gate *client_name = tmp; 3090Sstevel@tonic-gate 3100Sstevel@tonic-gate return (tmp ? 0 : -1); 3110Sstevel@tonic-gate } 3120Sstevel@tonic-gate 3132881Smp153739 static gss_name_t acceptor_name(struct svc_req * rqstp) 3140Sstevel@tonic-gate { 3152881Smp153739 OM_uint32 maj_stat, min_stat; 3162881Smp153739 gss_name_t name; 3172881Smp153739 rpc_gss_rawcred_t *raw_cred; 3182881Smp153739 void *cookie; 3192881Smp153739 gss_buffer_desc name_buff; 3200Sstevel@tonic-gate 3212881Smp153739 rpc_gss_getcred(rqstp, &raw_cred, NULL, &cookie); 3222881Smp153739 name_buff.value = raw_cred->svc_principal; 3232881Smp153739 name_buff.length = strlen(raw_cred->svc_principal); 3242881Smp153739 maj_stat = gss_import_name(&min_stat, &name_buff, 3252881Smp153739 (gss_OID) gss_nt_krb5_name, &name); 3262881Smp153739 if (maj_stat != GSS_S_COMPLETE) { 3272881Smp153739 gss_release_buffer(&min_stat, &name_buff); 3282881Smp153739 return (NULL); 3292881Smp153739 } 3302881Smp153739 maj_stat = gss_display_name(&min_stat, name, &name_buff, NULL); 3312881Smp153739 if (maj_stat != GSS_S_COMPLETE) { 3322881Smp153739 gss_release_buffer(&min_stat, &name_buff); 3332881Smp153739 return (NULL); 3342881Smp153739 } 3352881Smp153739 gss_release_buffer(&min_stat, &name_buff); 3362881Smp153739 3372881Smp153739 return name; 3382881Smp153739 } 3392881Smp153739 3402881Smp153739 static int cmp_gss_krb5_name(kadm5_server_handle_t handle, 3412881Smp153739 gss_name_t gss_name, krb5_principal princ) 3422881Smp153739 { 3432881Smp153739 krb5_principal princ2; 3442881Smp153739 int status; 3452881Smp153739 3462881Smp153739 if (! gss_to_krb5_name(handle, gss_name, &princ2)) 3472881Smp153739 return 0; 3482881Smp153739 status = krb5_principal_compare(handle->context, princ, princ2); 3492881Smp153739 krb5_free_principal(handle->context, princ2); 3502881Smp153739 return status; 3510Sstevel@tonic-gate } 3520Sstevel@tonic-gate 3530Sstevel@tonic-gate 3540Sstevel@tonic-gate /* 3550Sstevel@tonic-gate * This routine primarily validates the username and password 3560Sstevel@tonic-gate * of the principal to be created, if a prior acl check for 3570Sstevel@tonic-gate * the 'u' privilege succeeds. Validation is done using 3580Sstevel@tonic-gate * the PAM `k5migrate' service. k5migrate normally stacks 3590Sstevel@tonic-gate * pam_unix_auth.so and pam_unix_account.so in its auth and 3600Sstevel@tonic-gate * account stacks respectively. 3610Sstevel@tonic-gate * 3620Sstevel@tonic-gate * Returns 1 (true), if validation is successful, 3630Sstevel@tonic-gate * else returns 0 (false). 3640Sstevel@tonic-gate */ 3650Sstevel@tonic-gate int verify_pam_pw(char *userdata, char *pwd) { 3660Sstevel@tonic-gate pam_handle_t *pamh; 3670Sstevel@tonic-gate int err = 0; 3680Sstevel@tonic-gate int result = 1; 3690Sstevel@tonic-gate char *user = NULL; 3700Sstevel@tonic-gate char *ptr = NULL; 3710Sstevel@tonic-gate 3720Sstevel@tonic-gate ptr = strchr(userdata, '@'); 3730Sstevel@tonic-gate if (ptr != NULL) { 3740Sstevel@tonic-gate user = (char *)malloc(ptr - userdata + 1); 3750Sstevel@tonic-gate (void) strlcpy(user, userdata, (ptr - userdata) + 1); 3760Sstevel@tonic-gate } else { 3770Sstevel@tonic-gate user = (char *)strdup(userdata); 3780Sstevel@tonic-gate } 3790Sstevel@tonic-gate 3800Sstevel@tonic-gate err = pam_start("k5migrate", user, NULL, &pamh); 3810Sstevel@tonic-gate if (err != PAM_SUCCESS) { 3820Sstevel@tonic-gate syslog(LOG_ERR, "verify_pam_pw: pam_start() failed, %s\n", 3830Sstevel@tonic-gate pam_strerror(pamh, err)); 3840Sstevel@tonic-gate if (user) 3850Sstevel@tonic-gate free(user); 3860Sstevel@tonic-gate return (0); 3870Sstevel@tonic-gate } 3880Sstevel@tonic-gate if (user) 3890Sstevel@tonic-gate free(user); 3900Sstevel@tonic-gate 3910Sstevel@tonic-gate err = pam_set_item(pamh, PAM_AUTHTOK, (void *)pwd); 3920Sstevel@tonic-gate if (err != PAM_SUCCESS) { 3930Sstevel@tonic-gate syslog(LOG_ERR, "verify_pam_pw: pam_set_item() failed, %s\n", 3940Sstevel@tonic-gate pam_strerror(pamh, err)); 3950Sstevel@tonic-gate (void) pam_end(pamh, err); 3960Sstevel@tonic-gate return (0); 3970Sstevel@tonic-gate } 3980Sstevel@tonic-gate 3990Sstevel@tonic-gate err = pam_authenticate(pamh, PAM_SILENT); 4000Sstevel@tonic-gate if (err != PAM_SUCCESS) { 4010Sstevel@tonic-gate syslog(LOG_ERR, "verify_pam_pw: pam_authenticate() " 4020Sstevel@tonic-gate "failed, %s\n", pam_strerror(pamh, err)); 4030Sstevel@tonic-gate (void) pam_end(pamh, err); 4040Sstevel@tonic-gate return (0); 4050Sstevel@tonic-gate } 4060Sstevel@tonic-gate 4070Sstevel@tonic-gate err = pam_acct_mgmt(pamh, PAM_SILENT); 4080Sstevel@tonic-gate if (err != PAM_SUCCESS) { 4090Sstevel@tonic-gate syslog(LOG_ERR, "verify_pam_pw: pam_acct_mgmt() failed, %s\n", 4100Sstevel@tonic-gate pam_strerror(pamh, err)); 4110Sstevel@tonic-gate (void) pam_end(pamh, err); 4120Sstevel@tonic-gate return (0); 4130Sstevel@tonic-gate } 4140Sstevel@tonic-gate 4150Sstevel@tonic-gate (void) pam_end(pamh, PAM_SUCCESS); 4160Sstevel@tonic-gate return (result); 4170Sstevel@tonic-gate } 4180Sstevel@tonic-gate 4192881Smp153739 static int gss_to_krb5_name(kadm5_server_handle_t handle, 4202881Smp153739 gss_name_t gss_name, krb5_principal *princ) 4210Sstevel@tonic-gate { 4222881Smp153739 OM_uint32 status, minor_stat; 4232881Smp153739 gss_buffer_desc gss_str; 4242881Smp153739 gss_OID gss_type; 4252881Smp153739 int success; 4260Sstevel@tonic-gate 4272881Smp153739 status = gss_display_name(&minor_stat, gss_name, &gss_str, &gss_type); 4282881Smp153739 if ((status != GSS_S_COMPLETE) || (!g_OID_equal(gss_type, gss_nt_krb5_name))) 4292881Smp153739 return 0; 4302881Smp153739 success = (krb5_parse_name(handle->context, gss_str.value, princ) == 0); 4312881Smp153739 gss_release_buffer(&minor_stat, &gss_str); 4322881Smp153739 return success; 4332881Smp153739 } 4340Sstevel@tonic-gate 4352881Smp153739 static int 4362881Smp153739 gss_name_to_string(gss_name_t gss_name, gss_buffer_desc *str) 4372881Smp153739 { 4382881Smp153739 OM_uint32 status, minor_stat; 4392881Smp153739 gss_OID gss_type; 4402881Smp153739 4412881Smp153739 status = gss_display_name(&minor_stat, gss_name, str, &gss_type); 4422881Smp153739 if ((status != GSS_S_COMPLETE) || (gss_type != gss_nt_krb5_name)) 4432881Smp153739 return 1; 4442881Smp153739 return 0; 4452881Smp153739 } 4460Sstevel@tonic-gate 4472881Smp153739 generic_ret * 4482881Smp153739 create_principal_1_svc(cprinc_arg *arg, struct svc_req *rqstp) 4492881Smp153739 { 4502881Smp153739 static generic_ret ret; 4512881Smp153739 char *prime_arg = NULL; 4522881Smp153739 char *client_name = NULL, *service_name = NULL; 4532881Smp153739 int policy_migrate = 0; 4540Sstevel@tonic-gate 4552881Smp153739 OM_uint32 minor_stat; 4562881Smp153739 kadm5_server_handle_t handle; 4572881Smp153739 kadm5_ret_t retval; 4582881Smp153739 restriction_t *rp; 4592881Smp153739 gss_name_t name = NULL; 4602881Smp153739 4612881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 4620Sstevel@tonic-gate 4632881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 4642881Smp153739 return &ret; 4652881Smp153739 4662881Smp153739 if ((ret.code = check_handle((void *)handle))) 4670Sstevel@tonic-gate goto error; 4682881Smp153739 ret.api_version = handle->api_version; 4692881Smp153739 4702881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 4712881Smp153739 ret.code = KADM5_FAILURE; 4722881Smp153739 goto error; 4732881Smp153739 } 4742881Smp153739 if (krb5_unparse_name(handle->context, arg->rec.principal, &prime_arg)) { 4752881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 4762881Smp153739 goto error; 4772881Smp153739 } 4780Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 4790Sstevel@tonic-gate ret.code = KADM5_FAILURE; 4800Sstevel@tonic-gate goto error; 4810Sstevel@tonic-gate } 4820Sstevel@tonic-gate 4832881Smp153739 if (kadm5int_acl_check(handle->context, name, ACL_MIGRATE, 4840Sstevel@tonic-gate arg->rec.principal, &rp) && 4850Sstevel@tonic-gate verify_pam_pw(prime_arg, arg->passwd)) { 4860Sstevel@tonic-gate policy_migrate = 1; 4870Sstevel@tonic-gate } 4880Sstevel@tonic-gate 4892881Smp153739 if (CHANGEPW_SERVICE(rqstp) 4902881Smp153739 || (!kadm5int_acl_check(handle->context, name, ACL_ADD, 4910Sstevel@tonic-gate arg->rec.principal, &rp) && 4920Sstevel@tonic-gate !(policy_migrate)) 4932881Smp153739 || kadm5int_acl_impose_restrictions(handle->context, 4942881Smp153739 &arg->rec, &arg->mask, rp)) { 4952881Smp153739 ret.code = KADM5_AUTH_ADD; 4960Sstevel@tonic-gate 4970Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 4980Sstevel@tonic-gate "kadm5_create_principal", 4990Sstevel@tonic-gate prime_arg, client_name); 5002881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal", 5012881Smp153739 prime_arg, client_name, 5020Sstevel@tonic-gate service_name, client_addr(rqstp, buf)); 5032881Smp153739 } else { 5042881Smp153739 ret.code = kadm5_create_principal((void *)handle, 5052881Smp153739 &arg->rec, arg->mask, 5062881Smp153739 arg->passwd); 5070Sstevel@tonic-gate 5080Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 5090Sstevel@tonic-gate "kadm5_create_principal", 5100Sstevel@tonic-gate prime_arg, client_name, ret.code); 5112881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal", 5122881Smp153739 prime_arg,((ret.code == 0) ? "success" : 5132881Smp153739 error_message(ret.code)), 5142881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 5150Sstevel@tonic-gate 5160Sstevel@tonic-gate if (policy_migrate && (ret.code == 0)) { 5170Sstevel@tonic-gate arg->rec.policy = strdup("default"); 5180Sstevel@tonic-gate if ((arg->mask & KADM5_PW_EXPIRATION)) { 5190Sstevel@tonic-gate arg->mask = 0; 5200Sstevel@tonic-gate arg->mask |= KADM5_POLICY; 5210Sstevel@tonic-gate arg->mask |= KADM5_PW_EXPIRATION; 5220Sstevel@tonic-gate } else { 5230Sstevel@tonic-gate arg->mask = 0; 5240Sstevel@tonic-gate arg->mask |= KADM5_POLICY; 5250Sstevel@tonic-gate } 5260Sstevel@tonic-gate 5270Sstevel@tonic-gate retval = kadm5_modify_principal((void *)handle, 5280Sstevel@tonic-gate &arg->rec, arg->mask); 5290Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, 5300Sstevel@tonic-gate "kadm5_modify_principal", 5310Sstevel@tonic-gate prime_arg, ((retval == 0) ? "success" : 5320Sstevel@tonic-gate error_message(retval)), client_name, 5330Sstevel@tonic-gate service_name, client_addr(rqstp, buf)); 5340Sstevel@tonic-gate } 5350Sstevel@tonic-gate } 5360Sstevel@tonic-gate 5370Sstevel@tonic-gate error: 5382881Smp153739 if (name) 5392881Smp153739 gss_release_name(&minor_stat, &name); 5402881Smp153739 free_server_handle(handle); 5412881Smp153739 if (prime_arg) 5422881Smp153739 free(prime_arg); 5432881Smp153739 if (client_name) 5442881Smp153739 free(client_name); 5452881Smp153739 if (service_name) 5462881Smp153739 free(service_name); 5472881Smp153739 return (&ret); 5480Sstevel@tonic-gate } 5490Sstevel@tonic-gate 5500Sstevel@tonic-gate generic_ret * 5512881Smp153739 create_principal3_1_svc(cprinc3_arg *arg, struct svc_req *rqstp) 5520Sstevel@tonic-gate { 5530Sstevel@tonic-gate static generic_ret ret; 5540Sstevel@tonic-gate char *prime_arg = NULL; 5550Sstevel@tonic-gate char *client_name = NULL, *service_name = NULL; 5560Sstevel@tonic-gate int policy_migrate = 0; 5570Sstevel@tonic-gate 5582881Smp153739 OM_uint32 minor_stat; 5590Sstevel@tonic-gate kadm5_server_handle_t handle; 5600Sstevel@tonic-gate kadm5_ret_t retval; 5610Sstevel@tonic-gate restriction_t *rp; 5620Sstevel@tonic-gate gss_name_t name = NULL; 5630Sstevel@tonic-gate 5640Sstevel@tonic-gate xdr_free(xdr_generic_ret, (char *) &ret); 5650Sstevel@tonic-gate 5662881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 5670Sstevel@tonic-gate return &ret; 5680Sstevel@tonic-gate 5692881Smp153739 if ((ret.code = check_handle((void *)handle))) 5700Sstevel@tonic-gate goto error; 5710Sstevel@tonic-gate ret.api_version = handle->api_version; 5720Sstevel@tonic-gate 5730Sstevel@tonic-gate if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 5742881Smp153739 ret.code = KADM5_FAILURE; 5750Sstevel@tonic-gate goto error; 5760Sstevel@tonic-gate } 5770Sstevel@tonic-gate if (krb5_unparse_name(handle->context, arg->rec.principal, &prime_arg)) { 5782881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 5790Sstevel@tonic-gate goto error; 5800Sstevel@tonic-gate } 5810Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 5820Sstevel@tonic-gate ret.code = KADM5_FAILURE; 5830Sstevel@tonic-gate goto error; 5840Sstevel@tonic-gate } 5850Sstevel@tonic-gate 5862881Smp153739 if (kadm5int_acl_check(handle->context, name, ACL_MIGRATE, 5870Sstevel@tonic-gate arg->rec.principal, &rp) && 5880Sstevel@tonic-gate verify_pam_pw(prime_arg, arg->passwd)) { 5890Sstevel@tonic-gate policy_migrate = 1; 5900Sstevel@tonic-gate } 5910Sstevel@tonic-gate 5920Sstevel@tonic-gate if (CHANGEPW_SERVICE(rqstp) 5932881Smp153739 || (!kadm5int_acl_check(handle->context, name, ACL_ADD, 5940Sstevel@tonic-gate arg->rec.principal, &rp) && 5950Sstevel@tonic-gate !(policy_migrate)) 5962881Smp153739 || kadm5int_acl_impose_restrictions(handle->context, 5970Sstevel@tonic-gate &arg->rec, &arg->mask, rp)) { 5980Sstevel@tonic-gate ret.code = KADM5_AUTH_ADD; 5990Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_principal", 6002881Smp153739 prime_arg, client_name, service_name, 6012881Smp153739 client_addr(rqstp, buf)); 6020Sstevel@tonic-gate } else { 6030Sstevel@tonic-gate ret.code = kadm5_create_principal_3((void *)handle, 6040Sstevel@tonic-gate &arg->rec, arg->mask, 6050Sstevel@tonic-gate arg->n_ks_tuple, 6060Sstevel@tonic-gate arg->ks_tuple, 6070Sstevel@tonic-gate arg->passwd); 6080Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_principal", 6092881Smp153739 prime_arg,((ret.code == 0) ? "success" : 6100Sstevel@tonic-gate error_message(ret.code)), 6110Sstevel@tonic-gate client_name, service_name, 6120Sstevel@tonic-gate client_addr(rqstp, buf)); 6130Sstevel@tonic-gate 6140Sstevel@tonic-gate if (policy_migrate && (ret.code == 0)) { 6150Sstevel@tonic-gate arg->rec.policy = strdup("default"); 6160Sstevel@tonic-gate if ((arg->mask & KADM5_PW_EXPIRATION)) { 6170Sstevel@tonic-gate arg->mask = 0; 6180Sstevel@tonic-gate arg->mask |= KADM5_POLICY; 6190Sstevel@tonic-gate arg->mask |= KADM5_PW_EXPIRATION; 6200Sstevel@tonic-gate } else { 6210Sstevel@tonic-gate arg->mask = 0; 6220Sstevel@tonic-gate arg->mask |= KADM5_POLICY; 6230Sstevel@tonic-gate } 6240Sstevel@tonic-gate 6250Sstevel@tonic-gate retval = kadm5_modify_principal((void *)handle, 6260Sstevel@tonic-gate &arg->rec, arg->mask); 6270Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, 6280Sstevel@tonic-gate "kadm5_modify_principal", 6290Sstevel@tonic-gate prime_arg, ((retval == 0) ? "success" : 6300Sstevel@tonic-gate error_message(retval)), client_name, 6310Sstevel@tonic-gate service_name, client_addr(rqstp, buf)); 6320Sstevel@tonic-gate } 6330Sstevel@tonic-gate } 6340Sstevel@tonic-gate 6350Sstevel@tonic-gate error: 6360Sstevel@tonic-gate if (name) 6372881Smp153739 gss_release_name(&minor_stat, &name); 6380Sstevel@tonic-gate free_server_handle(handle); 6390Sstevel@tonic-gate if (client_name) 6402881Smp153739 free(client_name); 6410Sstevel@tonic-gate if (service_name) 6422881Smp153739 free(service_name); 6430Sstevel@tonic-gate if (prime_arg) 6442881Smp153739 free(prime_arg); 6452881Smp153739 return &ret; 6462881Smp153739 } 6472881Smp153739 6482881Smp153739 generic_ret * 6492881Smp153739 delete_principal_1_svc(dprinc_arg *arg, struct svc_req *rqstp) 6502881Smp153739 { 6512881Smp153739 static generic_ret ret; 6522881Smp153739 char *prime_arg = NULL; 6532881Smp153739 char *client_name = NULL, *service_name = NULL; 6542881Smp153739 OM_uint32 min_stat; 6552881Smp153739 kadm5_server_handle_t handle; 6562881Smp153739 gss_name_t name = NULL; 6572881Smp153739 6582881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 6592881Smp153739 6602881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 6612881Smp153739 return &ret; 6622881Smp153739 6632881Smp153739 if ((ret.code = check_handle((void *)handle))) 6642881Smp153739 goto error; 6652881Smp153739 ret.api_version = handle->api_version; 6662881Smp153739 6672881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 6682881Smp153739 ret.code = KADM5_FAILURE; 6692881Smp153739 goto error; 6702881Smp153739 } 6712881Smp153739 if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 6722881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 6732881Smp153739 goto error; 6742881Smp153739 } 6752881Smp153739 if (!(name = get_clnt_name(rqstp))) { 6762881Smp153739 ret.code = KADM5_FAILURE; 6772881Smp153739 goto error; 6782881Smp153739 } 6792881Smp153739 6802881Smp153739 if (CHANGEPW_SERVICE(rqstp) 6812881Smp153739 || !kadm5int_acl_check(handle->context, name, ACL_DELETE, 6822881Smp153739 arg->princ, NULL)) { 6832881Smp153739 ret.code = KADM5_AUTH_DELETE; 6842881Smp153739 6852881Smp153739 audit_kadmind_unauth(rqstp->rq_xprt, l_port, 6862881Smp153739 "kadm5_delete_principal", 6872881Smp153739 prime_arg, client_name); 6882881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_principal", 6892881Smp153739 prime_arg, client_name, 6902881Smp153739 service_name, client_addr(rqstp, buf)); 6912881Smp153739 } else { 6922881Smp153739 ret.code = kadm5_delete_principal((void *)handle, arg->princ); 6932881Smp153739 6942881Smp153739 audit_kadmind_auth(rqstp->rq_xprt, l_port, 6952881Smp153739 "kadm5_delete_principal", 6962881Smp153739 prime_arg, client_name, ret.code); 6972881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_principal", prime_arg, 6982881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 6992881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 7002881Smp153739 } 7012881Smp153739 7022881Smp153739 error: 7032881Smp153739 if (name) 7042881Smp153739 gss_release_name(&min_stat, &name); 7052881Smp153739 if (prime_arg) 7062881Smp153739 free(prime_arg); 7072881Smp153739 free_server_handle(handle); 7082881Smp153739 if (client_name) 7092881Smp153739 free(client_name); 7102881Smp153739 if (service_name) 7112881Smp153739 free(service_name); 7122881Smp153739 return &ret; 7130Sstevel@tonic-gate } 7140Sstevel@tonic-gate 7150Sstevel@tonic-gate generic_ret * 7162881Smp153739 modify_principal_1_svc(mprinc_arg *arg, struct svc_req *rqstp) 7170Sstevel@tonic-gate { 7182881Smp153739 static generic_ret ret; 7192881Smp153739 char *prime_arg = NULL; 7202881Smp153739 char *client_name = NULL, *service_name = NULL; 7212881Smp153739 OM_uint32 min_stat; 7222881Smp153739 kadm5_server_handle_t handle; 7232881Smp153739 restriction_t *rp; 7242881Smp153739 gss_name_t name = NULL; 7252881Smp153739 7262881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 7270Sstevel@tonic-gate 7282881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 7292881Smp153739 return &ret; 7300Sstevel@tonic-gate 7312881Smp153739 if ((ret.code = check_handle((void *)handle))) 7322881Smp153739 goto error; 7332881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 7342881Smp153739 ret.code = KADM5_FAILURE; 7350Sstevel@tonic-gate goto error; 7362881Smp153739 } 7372881Smp153739 if (krb5_unparse_name(handle->context, arg->rec.principal, &prime_arg)) { 7382881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 7392881Smp153739 goto error; 7402881Smp153739 } 7412881Smp153739 if (!(name = get_clnt_name(rqstp))) { 7420Sstevel@tonic-gate ret.code = KADM5_FAILURE; 7430Sstevel@tonic-gate goto error; 7440Sstevel@tonic-gate } 7452881Smp153739 7462881Smp153739 if (CHANGEPW_SERVICE(rqstp) 7472881Smp153739 || !kadm5int_acl_check(handle->context, name, ACL_MODIFY, 7482881Smp153739 arg->rec.principal, &rp) 7492881Smp153739 || kadm5int_acl_impose_restrictions(handle->context, 7502881Smp153739 &arg->rec, &arg->mask, rp)) { 7512881Smp153739 ret.code = KADM5_AUTH_MODIFY; 7522881Smp153739 7532881Smp153739 audit_kadmind_unauth(rqstp->rq_xprt, l_port, 7542881Smp153739 "kadm5_modify_principal", 7552881Smp153739 prime_arg, client_name); 7562881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_principal", 7572881Smp153739 prime_arg, client_name, 7582881Smp153739 service_name, client_addr(rqstp, buf)); 7592881Smp153739 } else { 7602881Smp153739 ret.code = kadm5_modify_principal((void *)handle, &arg->rec, 7612881Smp153739 arg->mask); 7622881Smp153739 7632881Smp153739 audit_kadmind_auth(rqstp->rq_xprt, l_port, 7642881Smp153739 "kadm5_modify_principal", 7652881Smp153739 prime_arg, client_name, ret.code); 7662881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_principal", 7672881Smp153739 prime_arg, ((ret.code == 0) ? "success" : 7682881Smp153739 error_message(ret.code)), 7692881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 7702881Smp153739 } 7712881Smp153739 7722881Smp153739 error: 7732881Smp153739 if (name) 7742881Smp153739 gss_release_name(&min_stat, &name); 7752881Smp153739 free_server_handle(handle); 7762881Smp153739 if (prime_arg) 7772881Smp153739 free(prime_arg); 7782881Smp153739 if (client_name) 7792881Smp153739 free(client_name); 7802881Smp153739 if (service_name) 7812881Smp153739 free(service_name); 7822881Smp153739 return &ret; 7832881Smp153739 } 7842881Smp153739 7852881Smp153739 generic_ret * 7862881Smp153739 rename_principal_1_svc(rprinc_arg *arg, struct svc_req *rqstp) 7872881Smp153739 { 7882881Smp153739 static generic_ret ret; 7892881Smp153739 char *prime_arg1 = NULL, *prime_arg2 = NULL; 7902881Smp153739 char prime_arg[BUFSIZ]; 7912881Smp153739 char *client_name = NULL, *service_name = NULL; 7922881Smp153739 OM_uint32 min_stat; 7932881Smp153739 kadm5_server_handle_t handle; 7942881Smp153739 restriction_t *rp; 7952881Smp153739 gss_name_t name = NULL; 7962881Smp153739 7972881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 7982881Smp153739 7992881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 8002881Smp153739 return &ret; 8012881Smp153739 8022881Smp153739 if ((ret.code = check_handle((void *)handle))) 8032881Smp153739 goto error; 8042881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 8052881Smp153739 ret.code = KADM5_FAILURE; 8062881Smp153739 goto error; 8072881Smp153739 } 8082881Smp153739 if (krb5_unparse_name(handle->context, arg->src, &prime_arg1) || 8092881Smp153739 krb5_unparse_name(handle->context, arg->dest, &prime_arg2)) { 8102881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 8112881Smp153739 goto error; 8122881Smp153739 } 8132881Smp153739 sprintf(prime_arg, "%s to %s", prime_arg1, prime_arg2); 8142881Smp153739 8152881Smp153739 ret.code = KADM5_OK; 8162881Smp153739 8170Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 8180Sstevel@tonic-gate ret.code = KADM5_FAILURE; 8190Sstevel@tonic-gate goto error; 8200Sstevel@tonic-gate } 8210Sstevel@tonic-gate 8222881Smp153739 if (! CHANGEPW_SERVICE(rqstp)) { 8232881Smp153739 if (!kadm5int_acl_check(handle->context, name, 8242881Smp153739 ACL_DELETE, arg->src, NULL)) 8252881Smp153739 ret.code = KADM5_AUTH_DELETE; 8262881Smp153739 /* any restrictions at all on the ADD kills the RENAME */ 8272881Smp153739 if (!kadm5int_acl_check(handle->context, name, 8282881Smp153739 ACL_ADD, arg->dest, &rp)) { 8292881Smp153739 if (ret.code == KADM5_AUTH_DELETE) 8302881Smp153739 ret.code = KADM5_AUTH_INSUFFICIENT; 8312881Smp153739 else 8322881Smp153739 ret.code = KADM5_AUTH_ADD; 8332881Smp153739 } 8342881Smp153739 } else 8352881Smp153739 ret.code = KADM5_AUTH_INSUFFICIENT; 8362881Smp153739 if (ret.code != KADM5_OK) { 8372881Smp153739 8382881Smp153739 audit_kadmind_unauth(rqstp->rq_xprt, l_port, 8392881Smp153739 "kadm5_rename_principal", 8402881Smp153739 prime_arg, client_name); 8412881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_rename_principal", 8422881Smp153739 prime_arg, client_name, 8432881Smp153739 service_name, client_addr(rqstp, buf)); 8442881Smp153739 } else { 8452881Smp153739 ret.code = kadm5_rename_principal((void *)handle, arg->src, 8462881Smp153739 arg->dest); 8472881Smp153739 8482881Smp153739 audit_kadmind_auth(rqstp->rq_xprt, l_port, 8492881Smp153739 "kadm5_rename_principal", 8502881Smp153739 prime_arg, client_name, ret.code); 8512881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_rename_principal", 8522881Smp153739 prime_arg, ((ret.code == 0) ? "success" : 8532881Smp153739 error_message(ret.code)), 8542881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 8552881Smp153739 } 8562881Smp153739 8572881Smp153739 error: 8582881Smp153739 if (name) 8592881Smp153739 gss_release_name(&min_stat, &name); 8602881Smp153739 free_server_handle(handle); 8612881Smp153739 if (prime_arg1) 8622881Smp153739 free(prime_arg1); 8632881Smp153739 if (prime_arg2) 8642881Smp153739 free(prime_arg2); 8652881Smp153739 if (client_name) 8662881Smp153739 free(client_name); 8672881Smp153739 if (service_name) 8682881Smp153739 free(service_name); 8692881Smp153739 return &ret; 8702881Smp153739 } 8712881Smp153739 8722881Smp153739 gprinc_ret * 8732881Smp153739 get_principal_1_svc(gprinc_arg *arg, struct svc_req *rqstp) 8742881Smp153739 { 8752881Smp153739 static gprinc_ret ret; 8762881Smp153739 kadm5_principal_ent_t_v1 e; 8772881Smp153739 char *prime_arg = NULL, *funcname; 8782881Smp153739 char *client_name = NULL, *service_name = NULL; 8792881Smp153739 OM_uint32 min_stat; 8802881Smp153739 kadm5_server_handle_t handle; 8812881Smp153739 gss_name_t name = NULL; 8822881Smp153739 8832881Smp153739 xdr_free(xdr_gprinc_ret, (char *) &ret); 8842881Smp153739 8852881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 8862881Smp153739 return &ret; 8872881Smp153739 8882881Smp153739 if ((ret.code = check_handle((void *)handle))) 8892881Smp153739 goto error; 8902881Smp153739 ret.api_version = handle->api_version; 8912881Smp153739 8922881Smp153739 funcname = handle->api_version == KADM5_API_VERSION_1 ? 8932881Smp153739 "kadm5_get_principal (V1)" : "kadm5_get_principal"; 8942881Smp153739 8952881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 8962881Smp153739 ret.code = KADM5_FAILURE; 8972881Smp153739 goto error; 8982881Smp153739 } 8992881Smp153739 if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 9002881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 9012881Smp153739 goto error; 9022881Smp153739 } 9032881Smp153739 if (!(name = get_clnt_name(rqstp))) { 9042881Smp153739 ret.code = KADM5_FAILURE; 9052881Smp153739 goto error; 9062881Smp153739 } 9072881Smp153739 9082881Smp153739 if (! cmp_gss_krb5_name(handle, name, arg->princ) && 9092881Smp153739 (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context, 9102881Smp153739 name, 9112881Smp153739 ACL_INQUIRE, 9122881Smp153739 arg->princ, 9132881Smp153739 NULL))) { 9142881Smp153739 ret.code = KADM5_AUTH_GET; 9150Sstevel@tonic-gate 9160Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 9172881Smp153739 funcname, 9180Sstevel@tonic-gate prime_arg, client_name); 9192881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, 9202881Smp153739 prime_arg, client_name, service_name, 9212881Smp153739 client_addr(rqstp, buf)); 9222881Smp153739 } else { 9232881Smp153739 if (handle->api_version == KADM5_API_VERSION_1) { 9242881Smp153739 ret.code = kadm5_get_principal_v1((void *)handle, 9252881Smp153739 arg->princ, &e); 9262881Smp153739 if(ret.code == KADM5_OK) { 9272881Smp153739 memcpy(&ret.rec, e, sizeof(kadm5_principal_ent_rec_v1)); 9282881Smp153739 free(e); 9292881Smp153739 } 9302881Smp153739 } else { 9312881Smp153739 ret.code = kadm5_get_principal((void *)handle, 9322881Smp153739 arg->princ, &ret.rec, 9332881Smp153739 arg->mask); 9342881Smp153739 } 9352881Smp153739 9362881Smp153739 audit_kadmind_auth(rqstp->rq_xprt, l_port, 9372881Smp153739 funcname, 9382881Smp153739 prime_arg, client_name, ret.code); 9392881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, 9402881Smp153739 prime_arg, 9412881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 9422881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 9432881Smp153739 } 9442881Smp153739 9452881Smp153739 error: 9462881Smp153739 if (name) 9472881Smp153739 gss_release_name(&min_stat, &name); 9482881Smp153739 free_server_handle(handle); 9492881Smp153739 if (prime_arg) 9502881Smp153739 free(prime_arg); 9512881Smp153739 if (client_name) 9522881Smp153739 free(client_name); 9532881Smp153739 if (service_name) 9542881Smp153739 free(service_name); 9552881Smp153739 return &ret; 9562881Smp153739 } 9572881Smp153739 9582881Smp153739 gprincs_ret * 9592881Smp153739 get_princs_1_svc(gprincs_arg *arg, struct svc_req *rqstp) 9602881Smp153739 { 9612881Smp153739 static gprincs_ret ret; 9622881Smp153739 char *prime_arg = NULL; 9632881Smp153739 char *client_name = NULL, *service_name = NULL; 9642881Smp153739 OM_uint32 min_stat; 9652881Smp153739 kadm5_server_handle_t handle; 9662881Smp153739 gss_name_t name = NULL; 9672881Smp153739 9682881Smp153739 xdr_free(xdr_gprincs_ret, (char *) &ret); 9692881Smp153739 9702881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 9712881Smp153739 return &ret; 9722881Smp153739 9732881Smp153739 if ((ret.code = check_handle((void *)handle))) 9742881Smp153739 goto error; 9752881Smp153739 ret.api_version = handle->api_version; 9762881Smp153739 9772881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 9782881Smp153739 ret.code = KADM5_FAILURE; 9792881Smp153739 goto error; 9802881Smp153739 } 9812881Smp153739 prime_arg = arg->exp; 9822881Smp153739 if (prime_arg == NULL) 9832881Smp153739 prime_arg = "*"; 9842881Smp153739 9852881Smp153739 if (!(name = get_clnt_name(rqstp))) { 9862881Smp153739 ret.code = KADM5_FAILURE; 9872881Smp153739 goto error; 9882881Smp153739 } 9892881Smp153739 9902881Smp153739 if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context, 9912881Smp153739 name, 9922881Smp153739 ACL_LIST, 9932881Smp153739 NULL, 9942881Smp153739 NULL)) { 9952881Smp153739 ret.code = KADM5_AUTH_LIST; 9962881Smp153739 9972881Smp153739 audit_kadmind_unauth(rqstp->rq_xprt, l_port, 9982881Smp153739 "kadm5_get_principals", 9992881Smp153739 prime_arg, client_name); 10002881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_principals", 10012881Smp153739 prime_arg, client_name, 10022881Smp153739 service_name, client_addr(rqstp, buf)); 10032881Smp153739 } else { 10042881Smp153739 ret.code = kadm5_get_principals((void *)handle, 10052881Smp153739 arg->exp, &ret.princs, 10062881Smp153739 &ret.count); 10070Sstevel@tonic-gate 10080Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 10092881Smp153739 "kadm5_get_principals", 10100Sstevel@tonic-gate prime_arg, client_name, ret.code); 10112881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_principals", 10122881Smp153739 prime_arg, 10132881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 10142881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 10150Sstevel@tonic-gate } 10160Sstevel@tonic-gate 10170Sstevel@tonic-gate error: 10180Sstevel@tonic-gate if (name) 10190Sstevel@tonic-gate gss_release_name(&min_stat, &name); 10200Sstevel@tonic-gate free_server_handle(handle); 10210Sstevel@tonic-gate if (client_name) 10220Sstevel@tonic-gate free(client_name); 10230Sstevel@tonic-gate if (service_name) 10240Sstevel@tonic-gate free(service_name); 10250Sstevel@tonic-gate return (&ret); 10260Sstevel@tonic-gate } 10270Sstevel@tonic-gate 10280Sstevel@tonic-gate generic_ret * 10292881Smp153739 chpass_principal_1_svc(chpass_arg *arg, struct svc_req *rqstp) 10300Sstevel@tonic-gate { 10312881Smp153739 static generic_ret ret; 10322881Smp153739 char *prime_arg = NULL; 10332881Smp153739 char *client_name = NULL, *service_name = NULL; 10342881Smp153739 OM_uint32 min_stat; 10352881Smp153739 kadm5_server_handle_t handle; 10362881Smp153739 gss_name_t name = NULL; 10370Sstevel@tonic-gate 10382881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 10390Sstevel@tonic-gate 10402881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 10412881Smp153739 return &ret; 10420Sstevel@tonic-gate 10432881Smp153739 if ((ret.code = check_handle((void *)handle))) 10440Sstevel@tonic-gate goto error; 10452881Smp153739 ret.api_version = handle->api_version; 10462881Smp153739 10472881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 10482881Smp153739 ret.code = KADM5_FAILURE; 10490Sstevel@tonic-gate goto error; 10502881Smp153739 } 10512881Smp153739 if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 10522881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 10530Sstevel@tonic-gate goto error; 10540Sstevel@tonic-gate } 10550Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 10560Sstevel@tonic-gate ret.code = KADM5_FAILURE; 10570Sstevel@tonic-gate goto error; 10580Sstevel@tonic-gate } 10590Sstevel@tonic-gate 10602881Smp153739 if (cmp_gss_krb5_name(handle, name, arg->princ)) { 10612881Smp153739 ret.code = chpass_principal_wrapper_3((void *)handle, arg->princ, 10622881Smp153739 FALSE, 0, NULL, arg->pass); 10632881Smp153739 } else if (!(CHANGEPW_SERVICE(rqstp)) && 10642881Smp153739 kadm5int_acl_check(handle->context, name, 10652881Smp153739 ACL_CHANGEPW, arg->princ, NULL)) { 10662881Smp153739 ret.code = kadm5_chpass_principal((void *)handle, arg->princ, 10672881Smp153739 arg->pass); 10682881Smp153739 } else { 10690Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 10702881Smp153739 "kadm5_chpass_principal", 10710Sstevel@tonic-gate prime_arg, client_name); 10722881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal", 10732881Smp153739 prime_arg, client_name, 10740Sstevel@tonic-gate service_name, client_addr(rqstp, buf)); 10752881Smp153739 ret.code = KADM5_AUTH_CHANGEPW; 10762881Smp153739 } 10770Sstevel@tonic-gate 10782881Smp153739 if(ret.code != KADM5_AUTH_CHANGEPW) { 10790Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 10802881Smp153739 "kadm5_chpass_principal", 10810Sstevel@tonic-gate prime_arg, client_name, ret.code); 10822881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 10832881Smp153739 prime_arg, ((ret.code == 0) ? "success" : 10842881Smp153739 error_message(ret.code)), 10852881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 10862881Smp153739 } 10870Sstevel@tonic-gate 10880Sstevel@tonic-gate error: 10890Sstevel@tonic-gate if (name) 10900Sstevel@tonic-gate gss_release_name(&min_stat, &name); 10910Sstevel@tonic-gate free_server_handle(handle); 10920Sstevel@tonic-gate if (prime_arg) 10930Sstevel@tonic-gate free(prime_arg); 10940Sstevel@tonic-gate if (client_name) 10950Sstevel@tonic-gate free(client_name); 10960Sstevel@tonic-gate if (service_name) 10970Sstevel@tonic-gate free(service_name); 10980Sstevel@tonic-gate return (&ret); 10990Sstevel@tonic-gate } 11000Sstevel@tonic-gate 11010Sstevel@tonic-gate generic_ret * 11022881Smp153739 chpass_principal3_1_svc(chpass3_arg *arg, struct svc_req *rqstp) 11030Sstevel@tonic-gate { 11040Sstevel@tonic-gate static generic_ret ret; 11050Sstevel@tonic-gate char *prime_arg = NULL; 11060Sstevel@tonic-gate char *client_name = NULL, 11070Sstevel@tonic-gate *service_name = NULL; 11080Sstevel@tonic-gate OM_uint32 min_stat; 11090Sstevel@tonic-gate kadm5_server_handle_t handle; 11100Sstevel@tonic-gate gss_name_t name = NULL; 11110Sstevel@tonic-gate 11120Sstevel@tonic-gate xdr_free(xdr_generic_ret, (char *) &ret); 11130Sstevel@tonic-gate 11142881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 11150Sstevel@tonic-gate return &ret; 11160Sstevel@tonic-gate 11172881Smp153739 if ((ret.code = check_handle((void *)handle))) 11180Sstevel@tonic-gate goto error; 11190Sstevel@tonic-gate ret.api_version = handle->api_version; 11200Sstevel@tonic-gate 11210Sstevel@tonic-gate if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 11222881Smp153739 ret.code = KADM5_FAILURE; 11230Sstevel@tonic-gate goto error; 11240Sstevel@tonic-gate } 11250Sstevel@tonic-gate if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 11262881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 11270Sstevel@tonic-gate goto error; 11280Sstevel@tonic-gate } 11290Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 11300Sstevel@tonic-gate ret.code = KADM5_FAILURE; 11310Sstevel@tonic-gate goto error; 11320Sstevel@tonic-gate } 11330Sstevel@tonic-gate 11340Sstevel@tonic-gate if (cmp_gss_krb5_name(handle, name, arg->princ)) { 11352881Smp153739 ret.code = chpass_principal_wrapper_3((void *)handle, arg->princ, 11362881Smp153739 arg->keepold, 11372881Smp153739 arg->n_ks_tuple, 11382881Smp153739 arg->ks_tuple, 11392881Smp153739 arg->pass); 11400Sstevel@tonic-gate } else if (!(CHANGEPW_SERVICE(rqstp)) && 11412881Smp153739 kadm5int_acl_check(handle->context, name, 11420Sstevel@tonic-gate ACL_CHANGEPW, arg->princ, NULL)) { 11430Sstevel@tonic-gate ret.code = kadm5_chpass_principal_3((void *)handle, arg->princ, 11440Sstevel@tonic-gate arg->keepold, 11450Sstevel@tonic-gate arg->n_ks_tuple, 11460Sstevel@tonic-gate arg->ks_tuple, 11470Sstevel@tonic-gate arg->pass); 11480Sstevel@tonic-gate } else { 11490Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_chpass_principal", 11502881Smp153739 prime_arg, client_name, service_name, 11512881Smp153739 client_addr(rqstp, buf)); 11520Sstevel@tonic-gate ret.code = KADM5_AUTH_CHANGEPW; 11530Sstevel@tonic-gate } 11540Sstevel@tonic-gate 11550Sstevel@tonic-gate if(ret.code != KADM5_AUTH_CHANGEPW) { 11560Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_chpass_principal", 11572881Smp153739 prime_arg, ((ret.code == 0) ? "success" : 11580Sstevel@tonic-gate error_message(ret.code)), 11590Sstevel@tonic-gate client_name, service_name, 11600Sstevel@tonic-gate client_addr(rqstp, buf)); 11610Sstevel@tonic-gate } 11620Sstevel@tonic-gate 11630Sstevel@tonic-gate error: 11640Sstevel@tonic-gate if (name) 11650Sstevel@tonic-gate gss_release_name(&min_stat, &name); 11660Sstevel@tonic-gate free_server_handle(handle); 11670Sstevel@tonic-gate if (client_name) 11682881Smp153739 free(client_name); 11690Sstevel@tonic-gate if (service_name) 11702881Smp153739 free(service_name); 11710Sstevel@tonic-gate if (prime_arg) 11722881Smp153739 free(prime_arg); 11730Sstevel@tonic-gate return (&ret); 11740Sstevel@tonic-gate } 11750Sstevel@tonic-gate 11760Sstevel@tonic-gate #ifdef SUNWOFF 11770Sstevel@tonic-gate generic_ret * 11782881Smp153739 setv4key_principal_1_svc(setv4key_arg *arg, struct svc_req *rqstp) 11790Sstevel@tonic-gate { 11800Sstevel@tonic-gate static generic_ret ret; 11810Sstevel@tonic-gate char *prime_arg = NULL; 11820Sstevel@tonic-gate char *client_name = NULL, 11830Sstevel@tonic-gate *service_name = NULL; 11840Sstevel@tonic-gate OM_uint32 min_stat; 11850Sstevel@tonic-gate kadm5_server_handle_t handle; 11860Sstevel@tonic-gate gss_name_t name = NULL; 11870Sstevel@tonic-gate 11880Sstevel@tonic-gate xdr_free(xdr_generic_ret, (char *) &ret); 11890Sstevel@tonic-gate 11902881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 11910Sstevel@tonic-gate return &ret; 11920Sstevel@tonic-gate 11932881Smp153739 if ((ret.code = check_handle((void *)handle))) 11940Sstevel@tonic-gate goto error; 11950Sstevel@tonic-gate ret.api_version = handle->api_version; 11960Sstevel@tonic-gate 11970Sstevel@tonic-gate if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 11982881Smp153739 ret.code = KADM5_FAILURE; 11990Sstevel@tonic-gate goto error; 12000Sstevel@tonic-gate } 12010Sstevel@tonic-gate if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 12022881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 12030Sstevel@tonic-gate goto error; 12040Sstevel@tonic-gate } 12050Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 12060Sstevel@tonic-gate ret.code = KADM5_FAILURE; 12070Sstevel@tonic-gate goto error; 12080Sstevel@tonic-gate } 12090Sstevel@tonic-gate 12100Sstevel@tonic-gate if (!(CHANGEPW_SERVICE(rqstp)) && 12112881Smp153739 kadm5int_acl_check(handle->context, name, 12122881Smp153739 ACL_SETKEY, arg->princ, NULL)) { 12130Sstevel@tonic-gate ret.code = kadm5_setv4key_principal((void *)handle, arg->princ, 12140Sstevel@tonic-gate arg->keyblock); 12150Sstevel@tonic-gate } else { 12162881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setv4key_principal", 12172881Smp153739 prime_arg, client_name, service_name, 12182881Smp153739 client_addr(rqstp, buf)); 12190Sstevel@tonic-gate ret.code = KADM5_AUTH_SETKEY; 12200Sstevel@tonic-gate } 12210Sstevel@tonic-gate 12220Sstevel@tonic-gate if(ret.code != KADM5_AUTH_SETKEY) { 12230Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setv4key_principal", 12240Sstevel@tonic-gate prime_arg, ((ret.code == 0) ? "success" : 12250Sstevel@tonic-gate error_message(ret.code)), 12260Sstevel@tonic-gate client_name, service_name, 12270Sstevel@tonic-gate client_addr(rqstp, buf)); 12280Sstevel@tonic-gate } 12290Sstevel@tonic-gate 12300Sstevel@tonic-gate error: 12310Sstevel@tonic-gate if (name) 12320Sstevel@tonic-gate gss_release_name(&min_stat, &name); 12330Sstevel@tonic-gate free_server_handle(handle); 12340Sstevel@tonic-gate if (client_name) 12350Sstevel@tonic-gate free(client_name); 12360Sstevel@tonic-gate if (service_name) 12370Sstevel@tonic-gate free(service_name); 12380Sstevel@tonic-gate if (prime_arg) 12390Sstevel@tonic-gate free(prime_arg); 12400Sstevel@tonic-gate return (&ret); 12410Sstevel@tonic-gate } 12420Sstevel@tonic-gate #endif 12430Sstevel@tonic-gate 12440Sstevel@tonic-gate generic_ret * 12452881Smp153739 setkey_principal_1_svc(setkey_arg *arg, struct svc_req *rqstp) 12460Sstevel@tonic-gate { 12470Sstevel@tonic-gate static generic_ret ret; 12480Sstevel@tonic-gate char *prime_arg; 12490Sstevel@tonic-gate char *client_name, 12500Sstevel@tonic-gate *service_name; 12510Sstevel@tonic-gate OM_uint32 min_stat; 12520Sstevel@tonic-gate kadm5_server_handle_t handle; 12530Sstevel@tonic-gate gss_name_t name; 12540Sstevel@tonic-gate 12550Sstevel@tonic-gate xdr_free(xdr_generic_ret, (char *) &ret); 12560Sstevel@tonic-gate 12572881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 12580Sstevel@tonic-gate return &ret; 12590Sstevel@tonic-gate 12602881Smp153739 if ((ret.code = check_handle((void *)handle))) 12610Sstevel@tonic-gate goto error; 12620Sstevel@tonic-gate ret.api_version = handle->api_version; 12630Sstevel@tonic-gate 12640Sstevel@tonic-gate if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 12652881Smp153739 ret.code = KADM5_FAILURE; 12660Sstevel@tonic-gate goto error; 12670Sstevel@tonic-gate } 12680Sstevel@tonic-gate if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 12692881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 12700Sstevel@tonic-gate goto error; 12710Sstevel@tonic-gate } 12720Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 12732881Smp153739 ret.code = KADM5_FAILURE; 12740Sstevel@tonic-gate goto error; 12750Sstevel@tonic-gate } 12760Sstevel@tonic-gate 12770Sstevel@tonic-gate if (!(CHANGEPW_SERVICE(rqstp)) && 12782881Smp153739 kadm5int_acl_check(handle->context, name, ACL_SETKEY, arg->princ, NULL)) { 12790Sstevel@tonic-gate ret.code = kadm5_setkey_principal((void *)handle, arg->princ, 12800Sstevel@tonic-gate arg->keyblocks, arg->n_keys); 12810Sstevel@tonic-gate } else { 12820Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal", 12830Sstevel@tonic-gate prime_arg, client_name, service_name, 12840Sstevel@tonic-gate client_addr(rqstp, buf)); 12850Sstevel@tonic-gate ret.code = KADM5_AUTH_SETKEY; 12860Sstevel@tonic-gate } 12870Sstevel@tonic-gate 12880Sstevel@tonic-gate if(ret.code != KADM5_AUTH_SETKEY) { 12890Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 12900Sstevel@tonic-gate prime_arg, ((ret.code == 0) ? "success" : 12910Sstevel@tonic-gate error_message(ret.code)), 12920Sstevel@tonic-gate client_name, service_name, 12930Sstevel@tonic-gate client_addr(rqstp, buf)); 12940Sstevel@tonic-gate } 12950Sstevel@tonic-gate 12960Sstevel@tonic-gate error: 12970Sstevel@tonic-gate if (name) 12980Sstevel@tonic-gate gss_release_name(&min_stat, &name); 12990Sstevel@tonic-gate free_server_handle(handle); 13000Sstevel@tonic-gate if (client_name) 13012881Smp153739 free(client_name); 13020Sstevel@tonic-gate if (service_name) 13032881Smp153739 free(service_name); 13040Sstevel@tonic-gate if (prime_arg) 13052881Smp153739 free(prime_arg); 13060Sstevel@tonic-gate return (&ret); 13070Sstevel@tonic-gate } 13080Sstevel@tonic-gate 13090Sstevel@tonic-gate generic_ret * 13102881Smp153739 setkey_principal3_1_svc(setkey3_arg *arg, struct svc_req *rqstp) 13110Sstevel@tonic-gate { 13120Sstevel@tonic-gate static generic_ret ret; 13130Sstevel@tonic-gate char *prime_arg = NULL; 13140Sstevel@tonic-gate char *client_name = NULL, 13150Sstevel@tonic-gate *service_name = NULL; 13160Sstevel@tonic-gate OM_uint32 min_stat; 13170Sstevel@tonic-gate kadm5_server_handle_t handle; 13180Sstevel@tonic-gate gss_name_t name = NULL; 13190Sstevel@tonic-gate 13200Sstevel@tonic-gate xdr_free(xdr_generic_ret, (char *) &ret); 13210Sstevel@tonic-gate 13222881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 13230Sstevel@tonic-gate return &ret; 13240Sstevel@tonic-gate 13252881Smp153739 if ((ret.code = check_handle((void *)handle))) 13260Sstevel@tonic-gate goto error; 13270Sstevel@tonic-gate ret.api_version = handle->api_version; 13280Sstevel@tonic-gate 13290Sstevel@tonic-gate if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 13302881Smp153739 ret.code = KADM5_FAILURE; 13310Sstevel@tonic-gate goto error; 13320Sstevel@tonic-gate } 13330Sstevel@tonic-gate if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 13342881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 13350Sstevel@tonic-gate goto error; 13360Sstevel@tonic-gate } 13370Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 13382881Smp153739 ret.code = KADM5_FAILURE; 13390Sstevel@tonic-gate goto error; 13400Sstevel@tonic-gate } 13410Sstevel@tonic-gate 13420Sstevel@tonic-gate if (!(CHANGEPW_SERVICE(rqstp)) && 13432881Smp153739 kadm5int_acl_check(handle->context, name, 13442881Smp153739 ACL_SETKEY, arg->princ, NULL)) { 13450Sstevel@tonic-gate ret.code = kadm5_setkey_principal_3((void *)handle, arg->princ, 13460Sstevel@tonic-gate arg->keepold, 13470Sstevel@tonic-gate arg->n_ks_tuple, 13480Sstevel@tonic-gate arg->ks_tuple, 13490Sstevel@tonic-gate arg->keyblocks, arg->n_keys); 13500Sstevel@tonic-gate } else { 13510Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_setkey_principal", 13520Sstevel@tonic-gate prime_arg, client_name, service_name, 13530Sstevel@tonic-gate client_addr(rqstp, buf)); 13540Sstevel@tonic-gate ret.code = KADM5_AUTH_SETKEY; 13550Sstevel@tonic-gate } 13560Sstevel@tonic-gate 13570Sstevel@tonic-gate if(ret.code != KADM5_AUTH_SETKEY) { 13582881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_setkey_principal", 13590Sstevel@tonic-gate prime_arg, ((ret.code == 0) ? "success" : 13602881Smp153739 error_message(ret.code)), 13612881Smp153739 client_name, service_name, 13622881Smp153739 client_addr(rqstp, buf)); 13630Sstevel@tonic-gate } 13640Sstevel@tonic-gate 13650Sstevel@tonic-gate error: 13660Sstevel@tonic-gate if (name) 13670Sstevel@tonic-gate gss_release_name(&min_stat, &name); 13680Sstevel@tonic-gate free_server_handle(handle); 13690Sstevel@tonic-gate if (client_name) 13700Sstevel@tonic-gate free(client_name); 13710Sstevel@tonic-gate if (service_name) 13722881Smp153739 free(service_name); 13730Sstevel@tonic-gate if (prime_arg) 13742881Smp153739 free(prime_arg); 13752881Smp153739 return &ret; 13760Sstevel@tonic-gate } 13770Sstevel@tonic-gate 13780Sstevel@tonic-gate chrand_ret * 13792881Smp153739 chrand_principal_1_svc(chrand_arg *arg, struct svc_req *rqstp) 13800Sstevel@tonic-gate { 13812881Smp153739 static chrand_ret ret; 13822881Smp153739 krb5_keyblock *k; 13832881Smp153739 int nkeys; 13842881Smp153739 char *prime_arg = NULL, *funcname; 13852881Smp153739 char *client_name = NULL, *service_name = NULL; 13862881Smp153739 OM_uint32 min_stat; 13872881Smp153739 kadm5_server_handle_t handle; 13882881Smp153739 gss_name_t name = NULL; 13890Sstevel@tonic-gate 13902881Smp153739 xdr_free(xdr_chrand_ret, (char *) &ret); 13910Sstevel@tonic-gate 13922881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 13932881Smp153739 return &ret; 13940Sstevel@tonic-gate 13952881Smp153739 if ((ret.code = check_handle((void *)handle))) 13960Sstevel@tonic-gate goto error; 13972881Smp153739 13982881Smp153739 ret.api_version = handle->api_version; 13990Sstevel@tonic-gate 14002881Smp153739 funcname = handle->api_version == KADM5_API_VERSION_1 ? 14012881Smp153739 "kadm5_randkey_principal (V1)" : "kadm5_randkey_principal"; 14020Sstevel@tonic-gate 14032881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 14042881Smp153739 ret.code = KADM5_FAILURE; 14050Sstevel@tonic-gate goto error; 14062881Smp153739 } 14072881Smp153739 if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 14082881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 14090Sstevel@tonic-gate goto error; 14102881Smp153739 } 14110Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 14120Sstevel@tonic-gate ret.code = KADM5_FAILURE; 14130Sstevel@tonic-gate goto error; 14140Sstevel@tonic-gate } 14150Sstevel@tonic-gate 14162881Smp153739 if (cmp_gss_krb5_name(handle, name, arg->princ)) { 1417*3641Ssemery ret.code = randkey_principal_wrapper((void *)handle, arg->princ, &k, 1418*3641Ssemery &nkeys); 14192881Smp153739 } else if (!(CHANGEPW_SERVICE(rqstp)) && 14202881Smp153739 kadm5int_acl_check(handle->context, name, 14212881Smp153739 ACL_CHANGEPW, arg->princ, NULL)) { 14222881Smp153739 ret.code = kadm5_randkey_principal((void *)handle, arg->princ, 14232881Smp153739 &k, &nkeys); 14242881Smp153739 } else { 14250Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 14260Sstevel@tonic-gate funcname, prime_arg, client_name); 14272881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, 14282881Smp153739 prime_arg, client_name, service_name, 14292881Smp153739 client_addr(rqstp, buf)); 14302881Smp153739 ret.code = KADM5_AUTH_CHANGEPW; 14312881Smp153739 } 14320Sstevel@tonic-gate 14332881Smp153739 if(ret.code == KADM5_OK) { 14342881Smp153739 if (handle->api_version == KADM5_API_VERSION_1) { 14352881Smp153739 krb5_copy_keyblock_contents(handle->context, k, &ret.key); 14362881Smp153739 krb5_free_keyblock(handle->context, k); 14372881Smp153739 } else { 14382881Smp153739 ret.keys = k; 14392881Smp153739 ret.n_keys = nkeys; 14402881Smp153739 } 14412881Smp153739 } 14422881Smp153739 14432881Smp153739 if(ret.code != KADM5_AUTH_CHANGEPW) { 14440Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 14450Sstevel@tonic-gate funcname, prime_arg, client_name, ret.code); 14462881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, 14472881Smp153739 prime_arg, ((ret.code == 0) ? "success" : 14482881Smp153739 error_message(ret.code)), 14492881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 14502881Smp153739 } 14510Sstevel@tonic-gate 14520Sstevel@tonic-gate error: 14530Sstevel@tonic-gate if (name) 14540Sstevel@tonic-gate gss_release_name(&min_stat, &name); 14550Sstevel@tonic-gate free_server_handle(handle); 14560Sstevel@tonic-gate if (prime_arg) 14572881Smp153739 free(prime_arg); 14582881Smp153739 if (client_name) 14592881Smp153739 free(client_name); 14602881Smp153739 if (service_name) 14612881Smp153739 free(service_name); 14622881Smp153739 return &ret; 14630Sstevel@tonic-gate } 14640Sstevel@tonic-gate 14650Sstevel@tonic-gate chrand_ret * 14662881Smp153739 chrand_principal3_1_svc(chrand3_arg *arg, struct svc_req *rqstp) 14670Sstevel@tonic-gate { 14680Sstevel@tonic-gate static chrand_ret ret; 14690Sstevel@tonic-gate krb5_keyblock *k; 14700Sstevel@tonic-gate int nkeys; 14710Sstevel@tonic-gate char *prime_arg = NULL, *funcname; 14720Sstevel@tonic-gate char *client_name = NULL, 14730Sstevel@tonic-gate *service_name = NULL; 14740Sstevel@tonic-gate OM_uint32 min_stat; 14750Sstevel@tonic-gate kadm5_server_handle_t handle; 14760Sstevel@tonic-gate gss_name_t name = NULL; 14770Sstevel@tonic-gate 14780Sstevel@tonic-gate xdr_free(xdr_chrand_ret, (char *) &ret); 14790Sstevel@tonic-gate 14802881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 14810Sstevel@tonic-gate return &ret; 14820Sstevel@tonic-gate 14832881Smp153739 if ((ret.code = check_handle((void *)handle))) 14840Sstevel@tonic-gate goto error; 14850Sstevel@tonic-gate ret.api_version = handle->api_version; 14860Sstevel@tonic-gate 14870Sstevel@tonic-gate funcname = handle->api_version == KADM5_API_VERSION_1 ? 14880Sstevel@tonic-gate "kadm5_randkey_principal (V1)" : "kadm5_randkey_principal"; 14890Sstevel@tonic-gate 14900Sstevel@tonic-gate if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 14910Sstevel@tonic-gate ret.code = KADM5_FAILURE; 14920Sstevel@tonic-gate goto error; 14930Sstevel@tonic-gate } 14940Sstevel@tonic-gate if (krb5_unparse_name(handle->context, arg->princ, &prime_arg)) { 14952881Smp153739 ret.code = KADM5_BAD_PRINCIPAL; 14960Sstevel@tonic-gate goto error; 14970Sstevel@tonic-gate } 14980Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 14990Sstevel@tonic-gate ret.code = KADM5_FAILURE; 15000Sstevel@tonic-gate goto error; 15010Sstevel@tonic-gate } 15020Sstevel@tonic-gate 15030Sstevel@tonic-gate if (cmp_gss_krb5_name(handle, name, arg->princ)) { 15042881Smp153739 ret.code = randkey_principal_wrapper_3((void *)handle, arg->princ, 15052881Smp153739 arg->keepold, 15062881Smp153739 arg->n_ks_tuple, 15072881Smp153739 arg->ks_tuple, 15082881Smp153739 &k, &nkeys); 15090Sstevel@tonic-gate } else if (!(CHANGEPW_SERVICE(rqstp)) && 15102881Smp153739 kadm5int_acl_check(handle->context, name, 15110Sstevel@tonic-gate ACL_CHANGEPW, arg->princ, NULL)) { 15120Sstevel@tonic-gate ret.code = kadm5_randkey_principal_3((void *)handle, arg->princ, 15130Sstevel@tonic-gate arg->keepold, 15140Sstevel@tonic-gate arg->n_ks_tuple, 15150Sstevel@tonic-gate arg->ks_tuple, 15160Sstevel@tonic-gate &k, &nkeys); 15170Sstevel@tonic-gate } else { 15180Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, 15192881Smp153739 prime_arg, client_name, service_name, 15202881Smp153739 client_addr(rqstp, buf)); 15210Sstevel@tonic-gate ret.code = KADM5_AUTH_CHANGEPW; 15220Sstevel@tonic-gate } 15230Sstevel@tonic-gate 15240Sstevel@tonic-gate if(ret.code == KADM5_OK) { 15250Sstevel@tonic-gate if (handle->api_version == KADM5_API_VERSION_1) { 15260Sstevel@tonic-gate krb5_copy_keyblock_contents(handle->context, k, &ret.key); 15270Sstevel@tonic-gate krb5_free_keyblock(handle->context, k); 15280Sstevel@tonic-gate } else { 15290Sstevel@tonic-gate ret.keys = k; 15300Sstevel@tonic-gate ret.n_keys = nkeys; 15310Sstevel@tonic-gate } 15320Sstevel@tonic-gate } 15330Sstevel@tonic-gate 15340Sstevel@tonic-gate if(ret.code != KADM5_AUTH_CHANGEPW) { 15350Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, 15362881Smp153739 prime_arg, ((ret.code == 0) ? "success" : 15370Sstevel@tonic-gate error_message(ret.code)), 15382881Smp153739 client_name, service_name, 15392881Smp153739 client_addr(rqstp, buf)); 15400Sstevel@tonic-gate } 15410Sstevel@tonic-gate 15420Sstevel@tonic-gate error: 15430Sstevel@tonic-gate if (name) 15440Sstevel@tonic-gate gss_release_name(&min_stat, &name); 15450Sstevel@tonic-gate free_server_handle(handle); 15460Sstevel@tonic-gate if (client_name) 15470Sstevel@tonic-gate free(client_name); 15480Sstevel@tonic-gate if (service_name) 15490Sstevel@tonic-gate free(service_name); 15500Sstevel@tonic-gate if (prime_arg) 15510Sstevel@tonic-gate free(prime_arg); 15520Sstevel@tonic-gate return (&ret); 15530Sstevel@tonic-gate } 15540Sstevel@tonic-gate 15550Sstevel@tonic-gate generic_ret * 15562881Smp153739 create_policy_1_svc(cpol_arg *arg, struct svc_req *rqstp) 15570Sstevel@tonic-gate { 15582881Smp153739 static generic_ret ret; 15592881Smp153739 char *prime_arg = NULL; 15602881Smp153739 char *client_name = NULL, *service_name = NULL; 15612881Smp153739 OM_uint32 min_stat; 15622881Smp153739 kadm5_server_handle_t handle; 15632881Smp153739 gss_name_t name = NULL; 15640Sstevel@tonic-gate 15652881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 15660Sstevel@tonic-gate 15672881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 15682881Smp153739 return &ret; 15690Sstevel@tonic-gate 15702881Smp153739 if ((ret.code = check_handle((void *)handle))) 15710Sstevel@tonic-gate goto error; 15722881Smp153739 15732881Smp153739 ret.api_version = handle->api_version; 15740Sstevel@tonic-gate 15752881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 15762881Smp153739 ret.code = KADM5_FAILURE; 15770Sstevel@tonic-gate goto error; 15782881Smp153739 } 15792881Smp153739 prime_arg = arg->rec.policy; 15800Sstevel@tonic-gate 15810Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 15820Sstevel@tonic-gate ret.code = KADM5_FAILURE; 15830Sstevel@tonic-gate goto error; 15840Sstevel@tonic-gate } 15850Sstevel@tonic-gate 15862881Smp153739 if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context, 15872881Smp153739 name, 15882881Smp153739 ACL_ADD, NULL, NULL)) { 15892881Smp153739 ret.code = KADM5_AUTH_ADD; 15900Sstevel@tonic-gate 15910Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 15920Sstevel@tonic-gate "kadm5_create_policy", 15930Sstevel@tonic-gate prime_arg, client_name); 15942881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_create_policy", 15952881Smp153739 prime_arg, client_name, 15962881Smp153739 service_name, client_addr(rqstp, buf)); 15972881Smp153739 15982881Smp153739 } else { 15992881Smp153739 ret.code = kadm5_create_policy((void *)handle, &arg->rec, 16002881Smp153739 arg->mask); 16010Sstevel@tonic-gate 16020Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 16030Sstevel@tonic-gate "kadm5_create_policy", 16040Sstevel@tonic-gate prime_arg, client_name, ret.code); 16052881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_create_policy", 16062881Smp153739 ((prime_arg == NULL) ? "(null)" : prime_arg), 16072881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 16082881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 16092881Smp153739 } 16100Sstevel@tonic-gate 16110Sstevel@tonic-gate error: 16120Sstevel@tonic-gate if (name) 16130Sstevel@tonic-gate gss_release_name(&min_stat, &name); 16142881Smp153739 free_server_handle(handle); 16152881Smp153739 if (client_name) 16162881Smp153739 free(client_name); 16172881Smp153739 if (service_name) 16182881Smp153739 free(service_name); 16192881Smp153739 return &ret; 16200Sstevel@tonic-gate } 16210Sstevel@tonic-gate 16220Sstevel@tonic-gate generic_ret * 16232881Smp153739 delete_policy_1_svc(dpol_arg *arg, struct svc_req *rqstp) 16240Sstevel@tonic-gate { 16252881Smp153739 static generic_ret ret; 16262881Smp153739 char *prime_arg = NULL; 16272881Smp153739 char *client_name = NULL, *service_name = NULL; 16282881Smp153739 OM_uint32 min_stat; 16292881Smp153739 kadm5_server_handle_t handle; 16302881Smp153739 gss_name_t name = NULL; 16310Sstevel@tonic-gate 16322881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 16330Sstevel@tonic-gate 16342881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 16352881Smp153739 return &ret; 16360Sstevel@tonic-gate 16372881Smp153739 if ((ret.code = check_handle((void *)handle))) 16380Sstevel@tonic-gate goto error; 16392881Smp153739 ret.api_version = handle->api_version; 16400Sstevel@tonic-gate 16412881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 16422881Smp153739 ret.code = KADM5_FAILURE; 16430Sstevel@tonic-gate goto error; 16442881Smp153739 } 16452881Smp153739 prime_arg = arg->name; 16462881Smp153739 16470Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 16480Sstevel@tonic-gate ret.code = KADM5_FAILURE; 16490Sstevel@tonic-gate goto error; 16500Sstevel@tonic-gate } 16510Sstevel@tonic-gate 16522881Smp153739 if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context, 16530Sstevel@tonic-gate name, 16542881Smp153739 ACL_DELETE, NULL, NULL)) { 16550Sstevel@tonic-gate 16560Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 16570Sstevel@tonic-gate "kadm5_delete_policy", 16580Sstevel@tonic-gate prime_arg, client_name); 16592881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_delete_policy", 16602881Smp153739 prime_arg, client_name, service_name, 16612881Smp153739 client_addr(rqstp, buf)); 16622881Smp153739 ret.code = KADM5_AUTH_DELETE; 16632881Smp153739 } else { 16642881Smp153739 ret.code = kadm5_delete_policy((void *)handle, arg->name); 16650Sstevel@tonic-gate 16660Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 16670Sstevel@tonic-gate "kadm5_delete_policy", 16680Sstevel@tonic-gate prime_arg, client_name, ret.code); 16692881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_delete_policy", 16702881Smp153739 ((prime_arg == NULL) ? "(null)" : prime_arg), 16712881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 16722881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 16732881Smp153739 } 16742881Smp153739 16752881Smp153739 error: 16762881Smp153739 if (name) 16772881Smp153739 gss_release_name(&min_stat, &name); 16782881Smp153739 free_server_handle(handle); 16792881Smp153739 if (client_name) 16802881Smp153739 free(client_name); 16812881Smp153739 if (service_name) 16822881Smp153739 free(service_name); 16832881Smp153739 return &ret; 16842881Smp153739 } 16852881Smp153739 16862881Smp153739 generic_ret * 16872881Smp153739 modify_policy_1_svc(mpol_arg *arg, struct svc_req *rqstp) 16882881Smp153739 { 16892881Smp153739 static generic_ret ret; 16902881Smp153739 char *prime_arg = NULL; 16912881Smp153739 char *client_name = NULL, *service_name = NULL; 16922881Smp153739 OM_uint32 min_stat; 16932881Smp153739 kadm5_server_handle_t handle; 16942881Smp153739 gss_name_t name = NULL; 16952881Smp153739 16962881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 16972881Smp153739 16982881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 16992881Smp153739 return &ret; 17002881Smp153739 17012881Smp153739 if ((ret.code = check_handle((void *)handle))) 17022881Smp153739 goto error; 17032881Smp153739 ret.api_version = handle->api_version; 17042881Smp153739 17052881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 17062881Smp153739 ret.code = KADM5_FAILURE; 17072881Smp153739 goto error; 17082881Smp153739 } 17092881Smp153739 prime_arg = arg->rec.policy; 17102881Smp153739 17112881Smp153739 if (!(name = get_clnt_name(rqstp))) { 17122881Smp153739 ret.code = KADM5_FAILURE; 17132881Smp153739 goto error; 17142881Smp153739 } 17152881Smp153739 17162881Smp153739 if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context, 17172881Smp153739 name, 17182881Smp153739 ACL_MODIFY, NULL, NULL)) { 17192881Smp153739 17202881Smp153739 audit_kadmind_unauth(rqstp->rq_xprt, l_port, 17212881Smp153739 "kadm5_modify_policy", 17222881Smp153739 prime_arg, client_name); 17232881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_modify_policy", 17242881Smp153739 prime_arg, client_name, 17252881Smp153739 service_name, client_addr(rqstp, buf)); 17262881Smp153739 ret.code = KADM5_AUTH_MODIFY; 17272881Smp153739 } else { 17282881Smp153739 ret.code = kadm5_modify_policy((void *)handle, &arg->rec, 17292881Smp153739 arg->mask); 17302881Smp153739 17312881Smp153739 audit_kadmind_auth(rqstp->rq_xprt, l_port, 17322881Smp153739 "kadm5_modify_policy", 17332881Smp153739 prime_arg, client_name, ret.code); 17342881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_modify_policy", 17352881Smp153739 ((prime_arg == NULL) ? "(null)" : prime_arg), 17362881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 17372881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 17382881Smp153739 } 17390Sstevel@tonic-gate 17400Sstevel@tonic-gate error: 17410Sstevel@tonic-gate if (name) 17420Sstevel@tonic-gate gss_release_name(&min_stat, &name); 17430Sstevel@tonic-gate free_server_handle(handle); 17440Sstevel@tonic-gate if (client_name) 17450Sstevel@tonic-gate free(client_name); 17460Sstevel@tonic-gate if (service_name) 17470Sstevel@tonic-gate free(service_name); 17480Sstevel@tonic-gate return (&ret); 17490Sstevel@tonic-gate } 17500Sstevel@tonic-gate 17512881Smp153739 gpol_ret * 17522881Smp153739 get_policy_1_svc(gpol_arg *arg, struct svc_req *rqstp) 17530Sstevel@tonic-gate { 17542881Smp153739 static gpol_ret ret; 17552881Smp153739 kadm5_ret_t ret2; 17562881Smp153739 char *prime_arg = NULL, *funcname; 17572881Smp153739 char *client_name = NULL, *service_name = NULL; 17582881Smp153739 OM_uint32 min_stat; 17592881Smp153739 kadm5_policy_ent_t e; 17602881Smp153739 kadm5_principal_ent_rec caller_ent; 17612881Smp153739 krb5_principal caller; 17622881Smp153739 kadm5_server_handle_t handle; 17632881Smp153739 gss_name_t name = NULL; 17640Sstevel@tonic-gate 17652881Smp153739 xdr_free(xdr_gpol_ret, (char *) &ret); 17660Sstevel@tonic-gate 17672881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 17682881Smp153739 return &ret; 17690Sstevel@tonic-gate 17702881Smp153739 if ((ret.code = check_handle((void *) handle))) 17712881Smp153739 goto error; 17722881Smp153739 17732881Smp153739 ret.api_version = handle->api_version; 17740Sstevel@tonic-gate 17752881Smp153739 funcname = handle->api_version == KADM5_API_VERSION_1 ? 17762881Smp153739 "kadm5_get_policy (V1)" : "kadm5_get_policy"; 17770Sstevel@tonic-gate 17782881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 17792881Smp153739 ret.code = KADM5_FAILURE; 17800Sstevel@tonic-gate goto error; 17812881Smp153739 } 17822881Smp153739 prime_arg = arg->name; 17830Sstevel@tonic-gate ret.code = KADM5_AUTH_GET; 17840Sstevel@tonic-gate 17850Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 17860Sstevel@tonic-gate ret.code = KADM5_FAILURE; 17870Sstevel@tonic-gate goto error; 17880Sstevel@tonic-gate } 17890Sstevel@tonic-gate 17902881Smp153739 if (!CHANGEPW_SERVICE(rqstp) && kadm5int_acl_check(handle->context, 17910Sstevel@tonic-gate name, 17920Sstevel@tonic-gate ACL_INQUIRE, NULL, NULL)) 17930Sstevel@tonic-gate ret.code = KADM5_OK; 17940Sstevel@tonic-gate else { 17950Sstevel@tonic-gate ret.code = kadm5_get_principal(handle->lhandle, 17960Sstevel@tonic-gate handle->current_caller, 17970Sstevel@tonic-gate &caller_ent, 17980Sstevel@tonic-gate KADM5_PRINCIPAL_NORMAL_MASK); 17990Sstevel@tonic-gate if (ret.code == KADM5_OK) { 18000Sstevel@tonic-gate if (caller_ent.aux_attributes & KADM5_POLICY && 18010Sstevel@tonic-gate strcmp(caller_ent.policy, arg->name) == 0) { 18022881Smp153739 ret.code = KADM5_OK; 18032881Smp153739 } else ret.code = KADM5_AUTH_GET; 18042881Smp153739 ret2 = kadm5_free_principal_ent(handle->lhandle, 18052881Smp153739 &caller_ent); 18062881Smp153739 ret.code = ret.code ? ret.code : ret2; 18072881Smp153739 } 18082881Smp153739 } 18092881Smp153739 18102881Smp153739 if (ret.code == KADM5_OK) { 18112881Smp153739 if (handle->api_version == KADM5_API_VERSION_1) { 18122881Smp153739 ret.code = kadm5_get_policy_v1((void *)handle, arg->name, &e); 18132881Smp153739 if(ret.code == KADM5_OK) { 18142881Smp153739 memcpy(&ret.rec, e, sizeof(kadm5_policy_ent_rec)); 18152881Smp153739 free(e); 18162881Smp153739 } 18172881Smp153739 } else { 18182881Smp153739 ret.code = kadm5_get_policy((void *)handle, arg->name, 18192881Smp153739 &ret.rec); 18202881Smp153739 } 18212881Smp153739 18220Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 18230Sstevel@tonic-gate funcname, prime_arg, client_name, ret.code); 18242881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, funcname, 18252881Smp153739 ((prime_arg == NULL) ? "(null)" : prime_arg), 18262881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 18272881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 18280Sstevel@tonic-gate } else { 18290Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 18300Sstevel@tonic-gate funcname, prime_arg, client_name); 18312881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, funcname, 18322881Smp153739 prime_arg, client_name, 18332881Smp153739 service_name, client_addr(rqstp, buf)); 18342881Smp153739 } 18350Sstevel@tonic-gate 18360Sstevel@tonic-gate error: 18370Sstevel@tonic-gate if (name) 18380Sstevel@tonic-gate gss_release_name(&min_stat, &name); 18390Sstevel@tonic-gate free_server_handle(handle); 18400Sstevel@tonic-gate if (client_name) 18410Sstevel@tonic-gate free(client_name); 18420Sstevel@tonic-gate if (service_name) 18430Sstevel@tonic-gate free(service_name); 18440Sstevel@tonic-gate return (&ret); 18450Sstevel@tonic-gate 18460Sstevel@tonic-gate } 18470Sstevel@tonic-gate 18480Sstevel@tonic-gate gpols_ret * 18492881Smp153739 get_pols_1_svc(gpols_arg *arg, struct svc_req *rqstp) 18500Sstevel@tonic-gate { 18512881Smp153739 static gpols_ret ret; 18522881Smp153739 char *prime_arg = NULL; 18532881Smp153739 char *client_name = NULL, *service_name = NULL; 18542881Smp153739 OM_uint32 min_stat; 18552881Smp153739 kadm5_server_handle_t handle; 18562881Smp153739 gss_name_t name = NULL; 18570Sstevel@tonic-gate 18582881Smp153739 xdr_free(xdr_gpols_ret, (char *) &ret); 18590Sstevel@tonic-gate 18602881Smp153739 if ((ret.code = new_server_handle(arg->api_version, rqstp, &handle))) 18612881Smp153739 return &ret; 18620Sstevel@tonic-gate 18632881Smp153739 if ((ret.code = check_handle((void *)handle))) 18640Sstevel@tonic-gate goto error; 18652881Smp153739 18662881Smp153739 ret.api_version = handle->api_version; 18670Sstevel@tonic-gate 18682881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 18692881Smp153739 ret.code = KADM5_FAILURE; 18702881Smp153739 goto error; 18712881Smp153739 } 18722881Smp153739 prime_arg = arg->exp; 18732881Smp153739 if (prime_arg == NULL) 18742881Smp153739 prime_arg = "*"; 18750Sstevel@tonic-gate 18760Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 18770Sstevel@tonic-gate ret.code = KADM5_FAILURE; 18780Sstevel@tonic-gate goto error; 18790Sstevel@tonic-gate } 18800Sstevel@tonic-gate 18812881Smp153739 if (CHANGEPW_SERVICE(rqstp) || !kadm5int_acl_check(handle->context, 18822881Smp153739 name, 18832881Smp153739 ACL_LIST, NULL, NULL)) { 18842881Smp153739 ret.code = KADM5_AUTH_LIST; 18850Sstevel@tonic-gate 18860Sstevel@tonic-gate audit_kadmind_unauth(rqstp->rq_xprt, l_port, 18870Sstevel@tonic-gate "kadm5_get_policies", 18880Sstevel@tonic-gate prime_arg, client_name); 18892881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_UNAUTH, "kadm5_get_policies", 18902881Smp153739 prime_arg, client_name, service_name, 18912881Smp153739 client_addr(rqstp, buf)); 18922881Smp153739 } else { 18932881Smp153739 ret.code = kadm5_get_policies((void *)handle, 18940Sstevel@tonic-gate arg->exp, &ret.pols, 18950Sstevel@tonic-gate &ret.count); 18960Sstevel@tonic-gate 18970Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 18980Sstevel@tonic-gate "kadm5_get_policies", 18990Sstevel@tonic-gate prime_arg, client_name, ret.code); 19002881Smp153739 krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_policies", 19012881Smp153739 prime_arg, 19022881Smp153739 ((ret.code == 0) ? "success" : error_message(ret.code)), 19032881Smp153739 client_name, service_name, client_addr(rqstp, buf)); 19042881Smp153739 } 19050Sstevel@tonic-gate 19060Sstevel@tonic-gate error: 19070Sstevel@tonic-gate if (name) 19080Sstevel@tonic-gate gss_release_name(&min_stat, &name); 19090Sstevel@tonic-gate free_server_handle(handle); 19100Sstevel@tonic-gate if (client_name) 19110Sstevel@tonic-gate free(client_name); 19120Sstevel@tonic-gate if (service_name) 19130Sstevel@tonic-gate free(service_name); 19140Sstevel@tonic-gate return (&ret); 19150Sstevel@tonic-gate } 19160Sstevel@tonic-gate 19172881Smp153739 getprivs_ret * get_privs_1_svc(krb5_ui_4 *arg, struct svc_req *rqstp) 19180Sstevel@tonic-gate { 19192881Smp153739 static getprivs_ret ret; 19202881Smp153739 char *client_name = NULL, *service_name = NULL; 19212881Smp153739 OM_uint32 min_stat; 19222881Smp153739 kadm5_server_handle_t handle; 19232881Smp153739 gss_name_t name = NULL; 19240Sstevel@tonic-gate 19252881Smp153739 xdr_free(xdr_getprivs_ret, (char *) &ret); 19260Sstevel@tonic-gate 19272881Smp153739 if ((ret.code = new_server_handle(*arg, rqstp, &handle))) 19282881Smp153739 return &ret; 19290Sstevel@tonic-gate 19302881Smp153739 if ((ret.code = check_handle((void *)handle))) 19310Sstevel@tonic-gate goto error; 19322881Smp153739 19332881Smp153739 ret.api_version = handle->api_version; 19340Sstevel@tonic-gate 19352881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 19362881Smp153739 ret.code = KADM5_FAILURE; 19372881Smp153739 goto error; 19382881Smp153739 } 19390Sstevel@tonic-gate if (!(name = get_clnt_name(rqstp))) { 19400Sstevel@tonic-gate ret.code = KADM5_FAILURE; 19410Sstevel@tonic-gate goto error; 19420Sstevel@tonic-gate } 19430Sstevel@tonic-gate 19440Sstevel@tonic-gate ret.code = __kadm5_get_priv((void *) handle, &ret.privs, name); 19450Sstevel@tonic-gate 19460Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 19470Sstevel@tonic-gate "kadm5_get_privs", NULL, client_name, 19480Sstevel@tonic-gate ret.code); 19490Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, "kadm5_get_privs", 19500Sstevel@tonic-gate client_name, 19510Sstevel@tonic-gate ((ret.code == 0) ? "success" : error_message(ret.code)), 19520Sstevel@tonic-gate client_name, service_name, client_addr(rqstp, buf)); 19530Sstevel@tonic-gate 19540Sstevel@tonic-gate error: 19550Sstevel@tonic-gate if (name) 19560Sstevel@tonic-gate gss_release_name(&min_stat, &name); 19570Sstevel@tonic-gate free_server_handle(handle); 19580Sstevel@tonic-gate if (client_name) 19590Sstevel@tonic-gate free(client_name); 19600Sstevel@tonic-gate if (service_name) 19610Sstevel@tonic-gate free(service_name); 19620Sstevel@tonic-gate return (&ret); 19630Sstevel@tonic-gate } 19640Sstevel@tonic-gate 19652881Smp153739 generic_ret *init_1_svc(krb5_ui_4 *arg, struct svc_req *rqstp) 19660Sstevel@tonic-gate { 19672881Smp153739 static generic_ret ret; 19680Sstevel@tonic-gate char *client_name, *service_name; 19690Sstevel@tonic-gate kadm5_server_handle_t handle; 19700Sstevel@tonic-gate 19712881Smp153739 xdr_free(xdr_generic_ret, (char *) &ret); 19720Sstevel@tonic-gate 19732881Smp153739 if ((ret.code = new_server_handle(*arg, rqstp, &handle))) 19742881Smp153739 return &ret; 19752881Smp153739 if (! (ret.code = check_handle((void *)handle))) { 19762881Smp153739 ret.api_version = handle->api_version; 19772881Smp153739 } 19780Sstevel@tonic-gate 19792881Smp153739 free_server_handle(handle); 19802881Smp153739 19812881Smp153739 if (setup_gss_names(rqstp, &client_name, &service_name) < 0) { 19822881Smp153739 ret.code = KADM5_FAILURE; 19832881Smp153739 return &ret; 19842881Smp153739 } 19850Sstevel@tonic-gate 19860Sstevel@tonic-gate audit_kadmind_auth(rqstp->rq_xprt, l_port, 19870Sstevel@tonic-gate (ret.api_version == KADM5_API_VERSION_1 ? 19880Sstevel@tonic-gate "kadm5_init (V1)" : "kadm5_init"), 19890Sstevel@tonic-gate NULL, client_name, ret.code); 19900Sstevel@tonic-gate krb5_klog_syslog(LOG_NOTICE, LOG_DONE, 19910Sstevel@tonic-gate (ret.api_version == KADM5_API_VERSION_1 ? 19922881Smp153739 "kadm5_init (V1)" : "kadm5_init"), 19932881Smp153739 client_name, 19942881Smp153739 (ret.code == 0) ? "success" : error_message(ret.code), 19950Sstevel@tonic-gate client_name, service_name, client_addr(rqstp, buf)); 19960Sstevel@tonic-gate free(client_name); 19970Sstevel@tonic-gate free(service_name); 19980Sstevel@tonic-gate 19990Sstevel@tonic-gate return (&ret); 20000Sstevel@tonic-gate } 2001