config.c revision 120945 
1/*
2 * Copyright (c) 1997-2003 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "kdc_locl.h"
35#include <getarg.h>
36#include <parse_bytes.h>
37
38RCSID("$Id: config.c,v 1.46 2003/03/18 00:22:23 lha Exp $");
39
40static const char *config_file;	/* location of kdc config file */
41
42int require_preauth = -1;	/* 1 == require preauth for all principals */
43
44size_t max_request;		/* maximal size of a request */
45
46static char *max_request_str;	/* `max_request' as a string */
47
48time_t kdc_warn_pwexpire;	/* time before expiration to print a warning */
49
50struct dbinfo *databases;
51HDB **db;
52int num_db;
53
54const char *port_str;
55
56#ifdef HAVE_DAEMON
57int detach_from_console = -1;
58#define DETACH_IS_DEFAULT FALSE
59#endif
60
61int enable_http = -1;
62krb5_boolean encode_as_rep_as_tgs_rep; /* bug compatibility */
63
64krb5_boolean check_ticket_addresses;
65krb5_boolean allow_null_ticket_addresses;
66krb5_boolean allow_anonymous;
67
68static struct getarg_strings addresses_str;	/* addresses to listen on */
69krb5_addresses explicit_addresses;
70
71#ifdef KRB4
72char *v4_realm;
73int enable_v4 = -1;
74int enable_kaserver = -1;
75#endif
76
77int enable_524 = -1;
78int enable_v4_cross_realm = -1;
79
80static int help_flag;
81static int version_flag;
82
83static struct getargs args[] = {
84    {
85	"config-file",	'c',	arg_string,	&config_file,
86	"location of config file",	"file"
87    },
88    {
89	"require-preauth",	'p',	arg_negative_flag, &require_preauth,
90	"don't require pa-data in as-reqs"
91    },
92    {
93	"max-request",	0,	arg_string, &max_request,
94	"max size for a kdc-request", "size"
95    },
96#if 0
97    {
98	"database",	'd', 	arg_string, &databases,
99	"location of database", "database"
100    },
101#endif
102    { "enable-http", 'H', arg_flag, &enable_http, "turn on HTTP support" },
103    {	"524",		0, 	arg_negative_flag, &enable_524,
104	"don't respond to 524 requests"
105    },
106#ifdef KRB4
107    {
108	"kaserver", 'K', arg_flag,   &enable_kaserver,
109	"enable kaserver support"
110    },
111    {	"kerberos4",	0, 	arg_flag, &enable_v4,
112	"respond to kerberos 4 requests"
113    },
114    {
115	"v4-realm",	'r',	arg_string, &v4_realm,
116	"realm to serve v4-requests for"
117    },
118#endif
119    {	"kerberos4-cross-realm",	0, 	arg_flag,
120	&enable_v4_cross_realm,
121	"respond to kerberos 4 requests from foreign realms"
122    },
123    {	"ports",	'P', 	arg_string, &port_str,
124	"ports to listen to", "portspec"
125    },
126#ifdef HAVE_DAEMON
127#if DETACH_IS_DEFAULT
128    {
129	"detach",       'D',      arg_negative_flag, &detach_from_console,
130	"don't detach from console"
131    },
132#else
133    {
134	"detach",       0 ,      arg_flag, &detach_from_console,
135	"detach from console"
136    },
137#endif
138#endif
139    {	"addresses",	0,	arg_strings, &addresses_str,
140	"addresses to listen on", "list of addresses" },
141    {	"help",		'h',	arg_flag,   &help_flag },
142    {	"version",	'v',	arg_flag,   &version_flag }
143};
144
145static int num_args = sizeof(args) / sizeof(args[0]);
146
147static void
148usage(int ret)
149{
150    arg_printusage (args, num_args, NULL, "");
151    exit (ret);
152}
153
154static void
155get_dbinfo(void)
156{
157    const krb5_config_binding *top_binding = NULL;
158    const krb5_config_binding *db_binding;
159    const krb5_config_binding *default_binding = NULL;
160    struct dbinfo *di, **dt;
161    const char *default_dbname = HDB_DEFAULT_DB;
162    const char *default_mkey = HDB_DB_DIR "/m-key";
163    const char *p;
164
165    databases = NULL;
166    dt = &databases;
167    while((db_binding = (const krb5_config_binding *)
168	   krb5_config_get_next(context, NULL, &top_binding,
169				krb5_config_list,
170				"kdc",
171				"database",
172				NULL))) {
173	p = krb5_config_get_string(context, db_binding, "realm", NULL);
174	if(p == NULL) {
175	    if(default_binding) {
176		krb5_warnx(context, "WARNING: more than one realm-less "
177			   "database specification");
178		krb5_warnx(context, "WARNING: using the first encountered");
179	    } else
180		default_binding = db_binding;
181	    continue;
182	}
183	di = calloc(1, sizeof(*di));
184	di->realm = strdup(p);
185	p = krb5_config_get_string(context, db_binding, "dbname", NULL);
186	if(p)
187	    di->dbname = strdup(p);
188	p = krb5_config_get_string(context, db_binding, "mkey_file", NULL);
189	if(p)
190	    di->mkey_file = strdup(p);
191	*dt = di;
192	dt = &di->next;
193    }
194    if(default_binding) {
195	di = calloc(1, sizeof(*di));
196	p = krb5_config_get_string(context, default_binding, "dbname", NULL);
197	if(p) {
198	    di->dbname = strdup(p);
199	    default_dbname = p;
200	}
201	p = krb5_config_get_string(context, default_binding, "mkey_file", NULL);
202	if(p) {
203	    di->mkey_file = strdup(p);
204	    default_mkey = p;
205	}
206	*dt = di;
207	dt = &di->next;
208    } else if(databases == NULL) {
209	/* if there are none specified, use some default */
210	di = calloc(1, sizeof(*di));
211	di->dbname = strdup(default_dbname);
212	di->mkey_file = strdup(default_mkey);
213	*dt = di;
214	dt = &di->next;
215    }
216    for(di = databases; di; di = di->next) {
217	if(di->dbname == NULL)
218	    di->dbname = strdup(default_dbname);
219	if(di->mkey_file == NULL) {
220	    p = strrchr(di->dbname, '.');
221	    if(p == NULL || strchr(p, '/') != NULL)
222		/* final pathname component does not contain a . */
223		asprintf(&di->mkey_file, "%s.mkey", di->dbname);
224	    else
225		/* the filename is something.else, replace .else with
226                   .mkey */
227		asprintf(&di->mkey_file, "%.*s.mkey",
228			 (int)(p - di->dbname), di->dbname);
229	}
230    }
231}
232
233static void
234add_one_address (const char *str, int first)
235{
236    krb5_error_code ret;
237    krb5_addresses tmp;
238
239    ret = krb5_parse_address (context, str, &tmp);
240    if (ret)
241	krb5_err (context, 1, ret, "parse_address `%s'", str);
242    if (first)
243	krb5_copy_addresses(context, &tmp, &explicit_addresses);
244    else
245	krb5_append_addresses(context, &explicit_addresses, &tmp);
246    krb5_free_addresses (context, &tmp);
247}
248
249void
250configure(int argc, char **argv)
251{
252    int optind = 0;
253    int e;
254    const char *p;
255
256    while((e = getarg(args, num_args, argc, argv, &optind)))
257	warnx("error at argument `%s'", argv[optind]);
258
259    if(help_flag)
260	usage (0);
261
262    if (version_flag) {
263	print_version(NULL);
264	exit(0);
265    }
266
267    argc -= optind;
268    argv += optind;
269
270    if (argc != 0)
271	usage(1);
272
273    {
274	krb5_error_code ret;
275	char **files;
276	char *tmp;
277	if(config_file == NULL)
278	    config_file = _PATH_KDC_CONF;
279	asprintf(&tmp, "%s:%s", config_file, krb5_config_file);
280	if(tmp == NULL)
281	    krb5_errx(context, 1, "out of memory");
282
283	krb5_config_file = tmp;
284
285	ret = krb5_get_default_config_files(&files);
286	if(ret)
287	    krb5_err(context, 1, ret, "reading configuration files");
288	ret = krb5_set_config_files(context, files);
289	krb5_free_config_files(files);
290	if(ret)
291	    krb5_err(context, 1, ret, "reading configuration files");
292    }
293
294    get_dbinfo();
295
296    if(max_request_str){
297	max_request = parse_bytes(max_request_str, NULL);
298    }
299
300    if(max_request == 0){
301	p = krb5_config_get_string (context,
302				    NULL,
303				    "kdc",
304				    "max-request",
305				    NULL);
306	if(p)
307	    max_request = parse_bytes(p, NULL);
308    }
309
310    if(require_preauth == -1)
311	require_preauth = krb5_config_get_bool(context, NULL, "kdc",
312					       "require-preauth", NULL);
313
314    if(port_str == NULL){
315	p = krb5_config_get_string(context, NULL, "kdc", "ports", NULL);
316	if (p != NULL)
317	    port_str = strdup(p);
318    }
319
320    explicit_addresses.len = 0;
321
322    if (addresses_str.num_strings) {
323	int i;
324
325	for (i = 0; i < addresses_str.num_strings; ++i)
326	    add_one_address (addresses_str.strings[i], i == 0);
327	free_getarg_strings (&addresses_str);
328    } else {
329	char **foo = krb5_config_get_strings (context, NULL,
330					      "kdc", "addresses", NULL);
331
332	if (foo != NULL) {
333	    add_one_address (*foo++, TRUE);
334	    while (*foo)
335		add_one_address (*foo++, FALSE);
336	}
337    }
338
339#ifdef KRB4
340    if(enable_v4 == -1)
341	enable_v4 = krb5_config_get_bool_default(context, NULL, FALSE, "kdc",
342					 "enable-kerberos4", NULL);
343#else
344#define enable_v4 0
345#endif
346    if(enable_v4_cross_realm == -1)
347	enable_v4_cross_realm =
348	    krb5_config_get_bool_default(context, NULL,
349					 FALSE, "kdc",
350					 "enable-kerberos4-cross-realm",
351					 NULL);
352    if(enable_524 == -1)
353	enable_524 = krb5_config_get_bool_default(context, NULL, enable_v4,
354						  "kdc", "enable-524", NULL);
355
356    if(enable_http == -1)
357	enable_http = krb5_config_get_bool(context, NULL, "kdc",
358					   "enable-http", NULL);
359    check_ticket_addresses =
360	krb5_config_get_bool_default(context, NULL, TRUE, "kdc",
361				     "check-ticket-addresses", NULL);
362    allow_null_ticket_addresses =
363	krb5_config_get_bool_default(context, NULL, TRUE, "kdc",
364				     "allow-null-ticket-addresses", NULL);
365
366    allow_anonymous =
367	krb5_config_get_bool(context, NULL, "kdc",
368			     "allow-anonymous", NULL);
369#ifdef KRB4
370    if(v4_realm == NULL){
371	p = krb5_config_get_string (context, NULL,
372				    "kdc",
373				    "v4-realm",
374				    NULL);
375	if(p != NULL) {
376	    v4_realm = strdup(p);
377	    if (v4_realm == NULL)
378		krb5_errx(context, 1, "out of memory");
379	}
380    }
381    if (enable_kaserver == -1)
382	enable_kaserver = krb5_config_get_bool_default(context, NULL, FALSE,
383						       "kdc",
384						       "enable-kaserver",
385						       NULL);
386#endif
387
388    encode_as_rep_as_tgs_rep = krb5_config_get_bool(context, NULL, "kdc",
389						    "encode_as_rep_as_tgs_rep",
390						    NULL);
391
392    kdc_warn_pwexpire = krb5_config_get_time (context, NULL,
393					      "kdc",
394					      "kdc_warn_pwexpire",
395					      NULL);
396
397#ifdef HAVE_DAEMON
398    if(detach_from_console == -1)
399	detach_from_console = krb5_config_get_bool_default(context, NULL,
400							   DETACH_IS_DEFAULT,
401							   "kdc",
402							   "detach", NULL);
403#endif
404    kdc_openlog();
405    if(max_request == 0)
406	max_request = 64 * 1024;
407    if(require_preauth == -1)
408	require_preauth = 1;
409    if (port_str == NULL)
410	port_str = "+";
411#ifdef KRB4
412    if(v4_realm == NULL){
413	v4_realm = malloc(40); /* REALM_SZ */
414	if (v4_realm == NULL)
415	    krb5_errx(context, 1, "out of memory");
416	krb_get_lrealm(v4_realm, 1);
417    }
418#endif
419}
420