static FILE *
open_stats(krb5_context context)
{
char *statfile = NULL;
const char *fn = NULL;
FILE *out = NULL;
/*
* krb5_config_get_string_default() returs default value as-is,
* delay free() of "statfile" until we're done with "fn".
*/
if (slave_stats_file)
fn = slave_stats_file;
else if (asprintf(&statfile, "%s/slaves-stats", hdb_db_dir(context)) != -1
&& statfile != NULL)
fn = krb5_config_get_string_default(context,
NULL,
statfile,
"kdc",
"iprop-stats",
NULL);
if (fn != NULL)
out = fopen(fn, "w");
if (statfile != NULL)
free(statfile);
return out;
}
static int
check_acl (krb5_context context, const char *name)
{
const char *fn;
FILE *fp;
char buf[256];
int ret = 1;
char *slavefile = NULL;
if (asprintf(&slavefile, "%s/slaves", hdb_db_dir(context)) == -1
|| slavefile == NULL)
errx(1, "out of memory");
fn = krb5_config_get_string_default(context,
NULL,
slavefile,
"kdc",
"iprop-acl",
NULL);
fp = fopen (fn, "r");
free(slavefile);
if (fp == NULL)
return 1;
while (fgets(buf, sizeof(buf), fp) != NULL) {
buf[strcspn(buf, "\r\n")] = '\0';
if (strcmp (buf, name) == 0) {
ret = 0;
break;
}
}
fclose (fp);
return ret;
}
static FILE *
open_stats(krb5_context context)
{
char *statfile = NULL;
const char *fn;
int ret;
if (slave_stats_file)
fn = slave_stats_file;
else {
ret = asprintf(&statfile, "%s/slaves-stats", hdb_db_dir(context));
if (ret == -1)
return NULL;
fn = krb5_config_get_string_default(context,
NULL,
statfile,
"kdc",
"iprop-stats",
NULL);
free(statfile);
}
if (fn == NULL)
return NULL;
return fopen(fn, "w");
}
static krb5_error_code
kcm_alloc(krb5_context context, const char *name, krb5_ccache *id)
{
krb5_kcmcache *k;
const char *path;
k = malloc(sizeof(*k));
if (k == NULL) {
krb5_set_error_string(context, "malloc: out of memory");
return KRB5_CC_NOMEM;
}
if (name != NULL) {
k->name = strdup(name);
if (k->name == NULL) {
free(k);
krb5_set_error_string(context, "malloc: out of memory");
return KRB5_CC_NOMEM;
}
} else
k->name = NULL;
path = krb5_config_get_string_default(context, NULL,
_PATH_KCM_SOCKET,
"libdefaults",
"kcm_socket",
NULL);
k->path.sun_family = AF_UNIX;
strlcpy(k->path.sun_path, path, sizeof(k->path.sun_path));
path = krb5_config_get_string_default(context, NULL,
_PATH_KCM_DOOR,
"libdefaults",
"kcm_door",
NULL);
k->door_path = strdup(path);
(*id)->data.data = k;
(*id)->data.length = sizeof(*k);
return 0;
}
const char *
kadm5_log_signal_socket(krb5_context context)
{
HEIMDAL_MUTEX_lock(&signal_mutex);
if (!default_signal)
asprintf(&default_signal, "%s/signal", hdb_db_dir(context));
HEIMDAL_MUTEX_unlock(&signal_mutex);
return krb5_config_get_string_default(context,
NULL,
default_signal,
"kdc",
"signal_socket",
NULL);
}
KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_appdefault_string(krb5_context context, const char *appname,
krb5_const_realm realm, const char *option,
const char *def_val, char **ret_val)
{
if(appname == NULL)
appname = getprogname();
def_val = krb5_config_get_string_default(context, NULL, def_val,
"libdefaults", option, NULL);
if(realm != NULL)
def_val = krb5_config_get_string_default(context, NULL, def_val,
"realms", realm, option, NULL);
def_val = krb5_config_get_string_default(context, NULL, def_val,
"appdefaults",
option,
NULL);
if(realm != NULL)
def_val = krb5_config_get_string_default(context, NULL, def_val,
"appdefaults",
realm,
option,
NULL);
if(appname != NULL) {
def_val = krb5_config_get_string_default(context, NULL, def_val,
"appdefaults",
appname,
option,
NULL);
if(realm != NULL)
def_val = krb5_config_get_string_default(context, NULL, def_val,
"appdefaults",
appname,
realm,
option,
NULL);
}
if(def_val != NULL)
*ret_val = strdup(def_val);
else
*ret_val = NULL;
}
krb5_error_code
krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
{
krb5_kdc_configuration *c;
c = calloc(1, sizeof(*c));
if (c == NULL) {
krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
return ENOMEM;
}
c->require_preauth = TRUE;
c->kdc_warn_pwexpire = 0;
c->encode_as_rep_as_tgs_rep = FALSE;
c->tgt_use_strongest_session_key = FALSE;
c->preauth_use_strongest_session_key = FALSE;
c->svc_use_strongest_session_key = FALSE;
c->use_strongest_server_key = TRUE;
c->check_ticket_addresses = TRUE;
c->allow_null_ticket_addresses = TRUE;
c->allow_anonymous = FALSE;
c->trpolicy = TRPOLICY_ALWAYS_CHECK;
c->enable_pkinit = FALSE;
c->pkinit_princ_in_cert = TRUE;
c->pkinit_require_binding = TRUE;
c->db = NULL;
c->num_db = 0;
c->logf = NULL;
c->require_preauth =
krb5_config_get_bool_default(context, NULL,
c->require_preauth,
"kdc", "require-preauth", NULL);
#ifdef DIGEST
c->enable_digest =
krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc", "enable-digest", NULL);
{
const char *digests;
digests = krb5_config_get_string(context, NULL,
"kdc",
"digests_allowed", NULL);
if (digests == NULL)
digests = "ntlm-v2";
c->digests_allowed = parse_flags(digests,_kdc_digestunits, 0);
if (c->digests_allowed == -1) {
kdc_log(context, c, 0,
"unparsable digest units (%s), turning off digest",
digests);
c->enable_digest = 0;
} else if (c->digests_allowed == 0) {
kdc_log(context, c, 0,
"no digest enable, turning digest off",
digests);
c->enable_digest = 0;
}
}
#endif
#ifdef KX509
c->enable_kx509 =
krb5_config_get_bool_default(context, NULL,
FALSE,
"kdc", "enable-kx509", NULL);
if (c->enable_kx509) {
c->kx509_template =
krb5_config_get_string(context, NULL,
"kdc", "kx509_template", NULL);
c->kx509_ca =
krb5_config_get_string(context, NULL,
"kdc", "kx509_ca", NULL);
if (c->kx509_ca == NULL || c->kx509_template == NULL) {
kdc_log(context, c, 0,
"missing kx509 configuration, turning off");
c->enable_kx509 = FALSE;
}
}
#endif
c->tgt_use_strongest_session_key =
krb5_config_get_bool_default(context, NULL,
c->tgt_use_strongest_session_key,
"kdc",
"tgt-use-strongest-session-key", NULL);
c->preauth_use_strongest_session_key =
krb5_config_get_bool_default(context, NULL,
c->preauth_use_strongest_session_key,
"kdc",
"preauth-use-strongest-session-key", NULL);
c->svc_use_strongest_session_key =
krb5_config_get_bool_default(context, NULL,
c->svc_use_strongest_session_key,
"kdc",
"svc-use-strongest-session-key", NULL);
c->use_strongest_server_key =
krb5_config_get_bool_default(context, NULL,
c->use_strongest_server_key,
"kdc",
"use-strongest-server-key", NULL);
c->check_ticket_addresses =
krb5_config_get_bool_default(context, NULL,
c->check_ticket_addresses,
"kdc",
"check-ticket-addresses", NULL);
c->allow_null_ticket_addresses =
krb5_config_get_bool_default(context, NULL,
c->allow_null_ticket_addresses,
"kdc",
"allow-null-ticket-addresses", NULL);
c->allow_anonymous =
krb5_config_get_bool_default(context, NULL,
c->allow_anonymous,
"kdc",
"allow-anonymous", NULL);
c->max_datagram_reply_length =
krb5_config_get_int_default(context,
NULL,
1400,
"kdc",
"max-kdc-datagram-reply-length",
NULL);
{
const char *trpolicy_str;
trpolicy_str =
krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc",
"transited-policy", NULL);
if(strcasecmp(trpolicy_str, "always-check") == 0) {
c->trpolicy = TRPOLICY_ALWAYS_CHECK;
} else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) {
c->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
} else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) {
c->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
} else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) {
/* default */
} else {
kdc_log(context, c, 0,
"unknown transited-policy: %s, "
"reverting to default (always-check)",
trpolicy_str);
}
}
c->encode_as_rep_as_tgs_rep =
krb5_config_get_bool_default(context, NULL,
c->encode_as_rep_as_tgs_rep,
"kdc",
"encode_as_rep_as_tgs_rep", NULL);
c->kdc_warn_pwexpire =
krb5_config_get_time_default (context, NULL,
c->kdc_warn_pwexpire,
"kdc", "kdc_warn_pwexpire", NULL);
c->enable_pkinit =
krb5_config_get_bool_default(context,
NULL,
c->enable_pkinit,
"kdc",
"enable-pkinit",
NULL);
c->pkinit_kdc_identity =
krb5_config_get_string(context, NULL,
"kdc", "pkinit_identity", NULL);
c->pkinit_kdc_anchors =
krb5_config_get_string(context, NULL,
"kdc", "pkinit_anchors", NULL);
c->pkinit_kdc_cert_pool =
krb5_config_get_strings(context, NULL,
"kdc", "pkinit_pool", NULL);
c->pkinit_kdc_revoke =
krb5_config_get_strings(context, NULL,
"kdc", "pkinit_revoke", NULL);
c->pkinit_kdc_ocsp_file =
krb5_config_get_string(context, NULL,
"kdc", "pkinit_kdc_ocsp", NULL);
c->pkinit_kdc_friendly_name =
krb5_config_get_string(context, NULL,
"kdc", "pkinit_kdc_friendly_name", NULL);
c->pkinit_princ_in_cert =
krb5_config_get_bool_default(context, NULL,
c->pkinit_princ_in_cert,
"kdc",
"pkinit_principal_in_certificate",
NULL);
c->pkinit_require_binding =
krb5_config_get_bool_default(context, NULL,
c->pkinit_require_binding,
"kdc",
"pkinit_win2k_require_binding",
NULL);
c->pkinit_dh_min_bits =
krb5_config_get_int_default(context, NULL,
0,
"kdc", "pkinit_dh_min_bits", NULL);
*config = c;
return 0;
}