c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny#include <sys/types.h>

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny#include <sys/stat.h>

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek#include <unistd.h>

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek#include <netdb.h>

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek#include <arpa/inet.h>

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny#include <ctype.h>

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny#include "providers/dp_backend.h"

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny#include "providers/krb5/krb5_common.h"

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozekstruct dp_option default_krb5_opts[] = {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek { "krb5_ccachedir", DP_OPT_STRING, { "/tmp" }, NULL_STRING },

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny { "krb5_ccname_template", DP_OPT_STRING, { "FILE:%d/krb5cc_%U_XXXXXX" }, NULL_STRING},

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny { "krb5_auth_timeout", DP_OPT_NUMBER, { .number = 15 }, NULL_NUMBER },

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny { "krb5_keytab", DP_OPT_STRING, { "/etc/krb5.keytab" }, NULL_STRING },

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek { "krb5_validate", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny { "krb5_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING },

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny { "krb5_renew_interval", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER },

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek { "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny { "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny};

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozekerrno_t check_and_export_lifetime(struct dp_option *opts, const int opt_id,

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek const char *env_name)

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek{

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny int ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek char *str;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek krb5_deltat lifetime;

bdbf4f169e4d5d00b0616df19f7a55debb407f78Pavel Březina bool free_str = false;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny str = dp_opt_get_string(opts, opt_id);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (str == NULL || *str == '\0') {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(5, ("No lifetime configured.\n"));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny return EOK;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (isdigit(str[strlen(str)-1])) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny str = talloc_asprintf(opts, "%ss", str);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (str == NULL) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("talloc_asprintf failed\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return ENOMEM;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny free_str = true;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = dp_opt_set_string(opts, opt_id, str);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("dp_opt_set_string failed\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek goto done;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = krb5_string_to_deltat(str, &lifetime);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (ret != 0) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("Invalid value [%s] for a lifetime.\n", str));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = EINVAL;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny goto done;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = setenv(env_name, str, 1);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (ret != EOK) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = errno;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(2, ("setenv [%s] failed.\n", env_name));

04e870d99e72aa3160bdb6ab05d986fb4005c3edPavel Březina goto done;

04e870d99e72aa3160bdb6ab05d986fb4005c3edPavel Březina }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret = EOK;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zelenydone:

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (free_str) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny talloc_free(str);

ef2455b63380ecd17bea94270ceaabe15dcf6456Jakub Hrozek }

ef2455b63380ecd17bea94270ceaabe15dcf6456Jakub Hrozek

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny return ret;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny}

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zelenyerrno_t check_and_export_options(struct dp_option *opts,

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny struct sss_domain_info *dom,

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny struct krb5_ctx *krb5_ctx)

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny{

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny int ret;

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov const char *realm;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny const char *dummy;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny char *use_fast_str;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny char *fast_principal;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny realm = dp_opt_get_cstring(opts, KRB5_REALM);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (realm == NULL) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = dp_opt_set_string(opts, KRB5_REALM, dom->name);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("dp_opt_set_string failed.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek realm = dom->name;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = setenv(SSSD_KRB5_REALM, realm, 1);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(2, ("setenv %s failed, authentication might fail.\n",

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek SSSD_KRB5_REALM));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = check_and_export_lifetime(opts, KRB5_RENEWABLE_LIFETIME,

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek SSSD_KRB5_RENEWABLE_LIFETIME);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("Failed to check value of krb5_renewable_lifetime. [%d][%s]\n",

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret, strerror(ret)));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = check_and_export_lifetime(opts, KRB5_LIFETIME,

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek SSSD_KRB5_LIFETIME);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("Failed to check value of krb5_lifetime. [%d][%s]\n",

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret, strerror(ret)));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek use_fast_str = dp_opt_get_string(opts, KRB5_USE_FAST);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (use_fast_str != NULL) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = check_fast(use_fast_str, &krb5_ctx->use_fast);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("check_fast failed.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (krb5_ctx->use_fast) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = setenv(SSSD_KRB5_USE_FAST, use_fast_str, 1);

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(2, ("setenv [%s] failed.\n", SSSD_KRB5_USE_FAST));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek } else {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek fast_principal = dp_opt_get_string(opts, KRB5_FAST_PRINCIPAL);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (fast_principal != NULL) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = setenv(SSSD_KRB5_FAST_PRINCIPAL, fast_principal, 1);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(2, ("setenv [%s] failed.\n", SSSD_KRB5_FAST_PRINCIPAL));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov }

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek dummy = dp_opt_get_cstring(opts, KRB5_KDC);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (dummy == NULL) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("No KDC explicitly configured, using defaults.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek dummy = dp_opt_get_cstring(opts, KRB5_KPASSWD);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (dummy == NULL) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("No kpasswd server explicitly configured, "

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek "using the KDC or defaults.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek dummy = dp_opt_get_cstring(opts, KRB5_CCNAME_TMPL);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (dummy == NULL) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("Missing credential cache name template.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return EINVAL;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (dummy[0] != '/' && strncmp(dummy, "FILE:", 5) != 0) {

877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek DEBUG(1, ("Currently only file based credential caches are supported "

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek "and krb5ccname_template must start with '/' or 'FILE:'\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return EINVAL;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return EOK;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek}

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozekerrno_t krb5_try_kdcip(TALLOC_CTX *memctx, struct confdb_ctx *cdb,

ef2455b63380ecd17bea94270ceaabe15dcf6456Jakub Hrozek const char *conf_path, struct dp_option *opts,

b6d5f2a91fbce15c7ef4d382fa6b52407adb26ddPavel Březina int opt_id)

b6d5f2a91fbce15c7ef4d382fa6b52407adb26ddPavel Březina{

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek char *krb5_servers = NULL;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek errno_t ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek krb5_servers = dp_opt_get_string(opts, opt_id);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (krb5_servers == NULL) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(4, ("No KDC found in configuration, trying legacy option\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = confdb_get_string(cdb, memctx, conf_path,

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek "krb5_kdcip", NULL, &krb5_servers);

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("confdb_get_string failed.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (krb5_servers != NULL)

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = dp_opt_set_string(opts, opt_id, krb5_servers);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(1, ("dp_opt_set_string failed.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek talloc_free(krb5_servers);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return ret;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(9, ("Set krb5 server [%s] based on legacy krb5_kdcip option\n",

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek krb5_servers));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek DEBUG(0, ("Your configuration uses the deprecated option 'krb5_kdcip' "

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek "to specify the KDC. Please change the configuration to use "

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny "the 'krb5_server' option instead.\n"));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek return EOK;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek}

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zelenyerrno_t krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny const char *conf_path, struct dp_option **_opts)

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny{

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek int ret;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny struct dp_option *opts;

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov opts = talloc_zero(memctx, struct dp_option);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (opts == NULL) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("talloc_zero failed.\n"));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny return ENOMEM;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = dp_get_options(opts, cdb, conf_path, default_krb5_opts,

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek KRB5_OPTS, &opts);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek DEBUG(1, ("dp_get_options failed.\n"));

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek goto done;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek /* If there is no KDC, try the deprecated krb5_kdcip option, too */

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose /* FIXME - this can be removed in a future version */

bdbf4f169e4d5d00b0616df19f7a55debb407f78Pavel Březina ret = krb5_try_kdcip(memctx, cdb, conf_path, opts, KRB5_KDC);

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek if (ret != EOK) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("sss_krb5_try_kdcip failed.\n"));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny goto done;

ef2455b63380ecd17bea94270ceaabe15dcf6456Jakub Hrozek }

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek *_opts = opts;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek ret = EOK;

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozekdone:

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (ret != EOK) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny talloc_zfree(opts);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny return ret;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny}

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozekerrno_t write_krb5info_file(const char *realm, const char *server,

8ba8222afca3026fd67af08e224b1d9e848aceaaJakub Hrozek const char *service)

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny{

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny int ret;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny int fd = -1;

65393a294e635822c1d7a15fe5853dc457ad8a2aSimo Sorce char *tmp_name = NULL;

65393a294e635822c1d7a15fe5853dc457ad8a2aSimo Sorce char *krb5info_name = NULL;

65393a294e635822c1d7a15fe5853dc457ad8a2aSimo Sorce TALLOC_CTX *tmp_ctx = NULL;

65393a294e635822c1d7a15fe5853dc457ad8a2aSimo Sorce const char *name_tmpl = NULL;

aac3ca699a09090072ae4d68bdda8dec990ae393Sumit Bose int server_len;

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ssize_t written;

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov

aac3ca699a09090072ae4d68bdda8dec990ae393Sumit Bose if (realm == NULL || *realm == '\0' || server == NULL || *server == '\0' ||

aac3ca699a09090072ae4d68bdda8dec990ae393Sumit Bose service == NULL || service == '\0') {

aac3ca699a09090072ae4d68bdda8dec990ae393Sumit Bose DEBUG(1, ("Missing or empty realm, server or service.\n"));

aac3ca699a09090072ae4d68bdda8dec990ae393Sumit Bose return EINVAL;

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce }

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce if (strcmp(service, SSS_KRB5KDC_FO_SRV) == 0) {

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce name_tmpl = KDCINFO_TMPL;

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce } else if (strcmp(service, SSS_KRB5KPASSWD_FO_SRV) == 0) {

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov name_tmpl = KPASSWDINFO_TMPL;

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce } else {

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce DEBUG(1, ("Unsupported service [%s]\n.", service));

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce return EINVAL;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny server_len = strlen(server);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny tmp_ctx = talloc_new(NULL);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (tmp_ctx == NULL) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("talloc_new failed.\n"));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny return ENOMEM;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny tmp_name = talloc_asprintf(tmp_ctx, PUBCONF_PATH"/.krb5info_dummy_XXXXXX");

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov if (tmp_name == NULL) {

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(1, ("talloc_asprintf failed.\n"));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = ENOMEM;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny goto done;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny krb5info_name = talloc_asprintf(tmp_ctx, name_tmpl, realm);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (krb5info_name == NULL) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("talloc_asprintf failed.\n"));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = ENOMEM;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny goto done;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny fd = mkstemp(tmp_name);

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose if (fd == -1) {

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose ret = errno;

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose DEBUG(1, ("mkstemp failed [%d][%s].\n", ret, strerror(ret)));

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose goto done;

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose }

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose written = 0;

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose while (written < server_len) {

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret = write(fd, server+written, server_len-written);

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov if (ret == -1) {

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose if (errno == EINTR || errno == EAGAIN) {

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose continue;

99bac83188601c2b07e0b141aac7dc7d882b464aSumit Bose }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = errno;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("write failed [%d][%s].\n", ret, strerror(ret)));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny goto done;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny else {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny written += ret;

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (written != server_len) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("Write error, wrote [%d] bytes, expected [%d]\n",

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny written, server_len));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = EIO;

877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek goto done;

877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek }

4f118e3e6a25762f40a43e6dbefb09f44adbef32Simo Sorce

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce ret = fchmod(fd, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce if (ret == -1) {

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce ret = errno;

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce DEBUG(1, ("fchmod failed [%d][%s].\n", ret, strerror(ret)));

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce goto done;

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce }

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce

bba1a5fd62cffcae076d1351df5a83fbc4a6ec17Simo Sorce ret = close(fd);

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny if (ret == -1) {

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = errno;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny DEBUG(1, ("close failed [%d][%s].\n", ret, strerror(ret)));

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny goto done;

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny }

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny

c0f9698cd951b7223f251ff2511c4b22a6e4ba60Jan Zeleny ret = rename(tmp_name, krb5info_name);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose if (ret == -1) {

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek ret = errno;

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek DEBUG(1, ("rename failed [%d][%s].\n", ret, strerror(ret)));

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek goto done;

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek }

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bosedone:

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose talloc_free(tmp_ctx);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose return ret;

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek}

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozekstatic void krb5_resolve_callback(void *private_data, struct fo_server *server)

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose{

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose struct krb5_service *krb5_service;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose struct resolv_hostent *srvaddr;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose char *address;

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek char *safe_address;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose int ret;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose TALLOC_CTX *tmp_ctx = NULL;

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek tmp_ctx = talloc_new(NULL);

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek if (tmp_ctx == NULL) {

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek DEBUG(1, ("talloc_new failed\n"));

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek return;

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek }

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek krb5_service = talloc_get_type(private_data, struct krb5_service);

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek if (!krb5_service) {

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose DEBUG(1, ("FATAL: Bad private_data\n"));

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose talloc_free(tmp_ctx);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose return;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose }

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose srvaddr = fo_get_server_hostent(server);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose if (!srvaddr) {

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose DEBUG(1, ("FATAL: No hostent available for server (%s)\n",

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek fo_get_server_name(server)));

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose talloc_free(tmp_ctx);

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek return;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose }

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose address = resolv_get_string_address(krb5_service, srvaddr);

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov if (address == NULL) {

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek DEBUG(1, ("resolv_get_string_address failed.\n"));

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose talloc_free(tmp_ctx);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose return;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose }

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose safe_address = sss_escape_ip_address(tmp_ctx,

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose srvaddr->family,

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose address);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose if (safe_address == NULL) {

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose DEBUG(1, ("sss_escape_ip_address failed.\n"));

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek talloc_free(tmp_ctx);

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek return;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose }

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek safe_address = talloc_asprintf_append(safe_address, ":%d",

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek fo_get_server_port(server));

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek if (safe_address == NULL) {

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek DEBUG(1, ("talloc_asprintf_append failed.\n"));

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek talloc_free(tmp_ctx);

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek return;

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek }

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose talloc_zfree(krb5_service->address);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose krb5_service->address = address;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose

a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov ret = write_krb5info_file(krb5_service->realm, safe_address,

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek krb5_service->name);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose if (ret != EOK) {

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose DEBUG(2, ("write_krb5info_file failed, authentication might fail.\n"));

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose }

0528fdec17d0031996e919fcd852459e86592c35Jakub Hrozek

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose talloc_free(tmp_ctx);

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose return;

909a86af4eb99f5d311d7136cab78dca535ae304Sumit Bose}

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozekint krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina const char *service_name, const char *servers,

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek const char *realm, struct krb5_service **_service)

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek{

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek TALLOC_CTX *tmp_ctx;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek struct krb5_service *service;

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina char **list = NULL;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek int ret;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek int i;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek char *port_str;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek long port;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek char *server_spec;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina char *endptr;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina struct servent *servent;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek tmp_ctx = talloc_new(memctx);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (!tmp_ctx) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek return ENOMEM;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek service = talloc_zero(tmp_ctx, struct krb5_service);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (!service) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = ENOMEM;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina ret = be_fo_add_service(ctx, service_name);

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina if (ret != EOK) {

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina DEBUG(1, ("Failed to create failover service!\n"));

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina goto done;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina }

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina service->name = talloc_strdup(service, service_name);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (!service->name) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = ENOMEM;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina goto done;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina }

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina service->realm = talloc_strdup(service, realm);

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina if (!service->realm) {

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina ret = ENOMEM;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina goto done;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina }

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina if (!servers) {

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina servers = BE_SRV_IDENTIFIER;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina }

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = split_on_separator(tmp_ctx, servers, ',', true, &list, NULL);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (ret != EOK) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(1, ("Failed to parse server list!\n"));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina for (i = 0; list[i]; i++) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek talloc_steal(service, list[i]);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek server_spec = talloc_strdup(service, list[i]);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (!server_spec) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = ENOMEM;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (be_fo_is_srv_identifier(server_spec)) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = be_fo_add_srv_server(ctx, service_name, service_name,

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek BE_FO_PROTO_UDP, true, NULL);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (ret) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(0, ("Failed to add server\n"));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(6, ("Added service lookup\n"));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek continue;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek port_str = strrchr(server_spec, ':');

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (port_str == NULL) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek port = 0;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek } else {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek *port_str = '\0';

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ++port_str;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (isdigit(*port_str)) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek errno = 0;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek port = strtol(port_str, &endptr, 10);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (errno != 0) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = errno;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(1, ("strtol failed on [%s]: [%d][%s].\n", port_str,

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret, strerror(ret)));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (*endptr != '\0') {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(1, ("Found additional characters [%s] in port number "

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek "[%s].\n", endptr, port_str));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = EINVAL;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (port < 1 || port > 65535) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(1, ("Illegal port number [%d].\n", port));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = EINVAL;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek } else if (isalpha(*port_str)) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek servent = getservbyname(port_str, NULL);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (servent == NULL) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(1, ("getservbyname cannot find service [%s].\n",

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek port_str));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = EINVAL;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina }

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek port = servent->s_port;

2b5704cd96a085b99d3b0d4f80f4414adc134750Pavel Březina } else {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(1, ("Unsupported port specifier in [%s].\n", list[i]));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = EINVAL;

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina goto done;

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina }

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina }

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina ret = be_fo_add_server(ctx, service_name, server_spec, (int) port,

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek list[i]);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (ret && ret != EEXIST) {

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina DEBUG(0, ("Failed to add server\n"));

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina goto done;

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina }

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina DEBUG(6, ("Added Server %s\n", list[i]));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = be_fo_service_add_callback(memctx, ctx, service_name,

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek krb5_resolve_callback, service);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (ret != EOK) {

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek DEBUG(1, ("Failed to add failover callback!\n"));

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek goto done;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek }

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek ret = EOK;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozekdone:

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek if (ret == EOK) {

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina *_service = talloc_steal(memctx, service);

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina }

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina talloc_zfree(tmp_ctx);

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek return ret;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek}

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozekerrno_t remove_krb5_info_files(TALLOC_CTX *mem_ctx, const char *realm)

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek{

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek int ret;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek errno_t err;

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek char *file;

28ebfa4373d1e7ce45b5d70a3619df1c074a661ePavel Březina

7caf7ed4f2eae1ec1c0717b4ee6ce78bdacd5926Jakub Hrozek file = talloc_asprintf(mem_ctx, KDCINFO_TMPL, realm);

if(file == NULL) {

DEBUG(1, ("talloc_asprintf failed.\n"));

return ENOMEM;

}

errno = 0;

ret = unlink(file);

if (ret == -1) {

err = errno;

DEBUG(5, ("Could not remove [%s], [%d][%s]\n", file,

err, strerror(err)));

}

file = talloc_asprintf(mem_ctx, KPASSWDINFO_TMPL, realm);

if(file == NULL) {

DEBUG(1, ("talloc_asprintf failed.\n"));

return ENOMEM;

}

errno = 0;

ret = unlink(file);

if (ret == -1) {

err = errno;

DEBUG(5, ("Could not remove [%s], [%d][%s]\n", file,

err, strerror(err)));

}

return EOK;

}

void remove_krb5_info_files_callback(void *pvt)

{

int ret;

TALLOC_CTX *tmp_ctx = NULL;

struct remove_info_files_ctx *ctx = talloc_get_type(pvt,

struct remove_info_files_ctx);

ret = be_fo_run_callbacks_at_next_request(ctx->be_ctx,

ctx->kdc_service_name);

if (ret != EOK) {

DEBUG(1, ("be_fo_run_callbacks_at_next_request failed, "

"krb5 info files will not be removed, because "

"it is unclear if they will be recreated properly.\n"));

return;

}

if (ctx->kpasswd_service_name != NULL) {

ret = be_fo_run_callbacks_at_next_request(ctx->be_ctx,

ctx->kpasswd_service_name);

if (ret != EOK) {

DEBUG(1, ("be_fo_run_callbacks_at_next_request failed, "

"krb5 info files will not be removed, because "

"it is unclear if they will be recreated properly.\n"));

return;

}

}

tmp_ctx = talloc_new(NULL);

if (tmp_ctx == NULL) {

DEBUG(1, ("talloc_new failed, cannot remove krb5 info files.\n"));

return;

}

ret = remove_krb5_info_files(tmp_ctx, ctx->realm);

if (ret != EOK) {

DEBUG(1, ("remove_krb5_info_files failed.\n"));

}

talloc_zfree(tmp_ctx);

}

void krb5_finalize(struct tevent_context *ev,

struct tevent_signal *se,

int signum,

int count,

void *siginfo,

void *private_data)

{

char *realm = (char *)private_data;

int ret;

ret = remove_krb5_info_files(se, realm);

if (ret != EOK) {

DEBUG(1, ("remove_krb5_info_files failed.\n"));

}

sig_term(signum);

}

errno_t krb5_install_offline_callback(struct be_ctx *be_ctx,

struct krb5_ctx *krb5_ctx)

{

int ret;

struct remove_info_files_ctx *ctx;

const char *krb5_realm;

if (krb5_ctx->service == NULL || krb5_ctx->service->name == NULL) {

DEBUG(1, ("Missing KDC service name!\n"));

return EINVAL;

}

ctx = talloc_zero(krb5_ctx, struct remove_info_files_ctx);

if (ctx == NULL) {

DEBUG(1, ("talloc_zfree failed.\n"));

return ENOMEM;

}

krb5_realm = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);

if (krb5_realm == NULL) {

DEBUG(1, ("Missing krb5_realm option!\n"));

ret = EINVAL;

goto done;

}

ctx->realm = talloc_strdup(ctx, krb5_realm);

if (ctx->realm == NULL) {

DEBUG(1, ("talloc_strdup failed!\n"));

ret = ENOMEM;

goto done;

}

ctx->be_ctx = be_ctx;

ctx->kdc_service_name = krb5_ctx->service->name;

if (krb5_ctx->kpasswd_service == NULL) {

ctx->kpasswd_service_name =NULL;

} else {

ctx->kpasswd_service_name = krb5_ctx->kpasswd_service->name;

}

ret = be_add_offline_cb(ctx, be_ctx, remove_krb5_info_files_callback, ctx,

NULL);

if (ret != EOK) {

DEBUG(1, ("be_add_offline_cb failed.\n"));

goto done;

}

ret = EOK;

done:

if (ret != EOK) {

talloc_zfree(ctx);

}

return ret;

}

errno_t krb5_install_sigterm_handler(struct tevent_context *ev,

struct krb5_ctx *krb5_ctx)

{

const char *krb5_realm;

char *sig_realm;

struct tevent_signal *sige;

BlockSignals(false, SIGTERM);

krb5_realm = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);

if (krb5_realm == NULL) {

DEBUG(1, ("Missing krb5_realm option!\n"));

return EINVAL;

}

sig_realm = talloc_strdup(krb5_ctx, krb5_realm);

if (sig_realm == NULL) {

DEBUG(1, ("talloc_strdup failed!\n"));

return ENOMEM;

}

sige = tevent_add_signal(ev, krb5_ctx, SIGTERM, SA_SIGINFO, krb5_finalize,

sig_realm);

if (sige == NULL) {

DEBUG(1, ("tevent_add_signal failed.\n"));

talloc_free(sig_realm);

return ENOMEM;

}

talloc_steal(sige, sig_realm);

return EOK;

}

errno_t krb5_get_simple_upn(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,

const char *username, const char **_upn)

{

const char *realm;

char *upn;

realm = dp_opt_get_cstring(krb5_ctx->opts, KRB5_REALM);

if (realm == NULL) {

DEBUG(1, ("Missing Kerberos realm.\n"));

return ENOENT;

}

/* NOTE: this is a hack, works only in some environments */

upn = talloc_asprintf(mem_ctx, "%s@%s", username, realm);

if (upn == NULL) {

DEBUG(1, ("talloc_asprintf failed.\n"));

return ENOMEM;

}

DEBUG(9, ("Using simple UPN [%s].\n", upn));

*_upn = upn;

return EOK;

}