kdc/hprop.c

   1 /*
   2  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #define KRB5_DEPRECATED /* uses v4 functions that will die */
  35
  36 #include "hprop.h"
  37
  38 static int version_flag;
  39 static int help_flag;
  40 static const char *ktname = HPROP_KEYTAB;
  41 static const char *database;
  42 static char *mkeyfile;
  43 static int to_stdout;
  44 static int verbose_flag;
  45 static int encrypt_flag;
  46 static int decrypt_flag;
  47 static hdb_master_key mkey5;
  48
  49 static char *source_type;
  50
  51 static char *local_realm=NULL;
  52
  53 static int
  54 open_socket(krb5_context context, const char *hostname, const char *port)
  55 {
  56     struct addrinfo *ai, *a;
  57     struct addrinfo hints;
  58     int error;
  59
  60     memset (&hints, 0, sizeof(hints));
  61     hints.ai_socktype = SOCK_STREAM;
  62     hints.ai_protocol = IPPROTO_TCP;
  63
  64     if (krb5_config_get_bool(context, NULL, "libdefaults", "block_dns",
  65             NULL)) {
  66         hints.ai_flags &= ~AI_CANONNAME;
  67         hints.ai_flags |= AI_NUMERICHOST|AI_NUMERICSERV;
  68     }
  69     error = getaddrinfo (hostname, port, &hints, &ai);
  70     if (error) {
  71         warnx ("%s: %s", hostname, gai_strerror(error));
  72         return -1;
  73     }
  74
  75     for (a = ai; a != NULL; a = a->ai_next) {
  76         int s;
  77
  78         s = socket (a->ai_family, a->ai_socktype, a->ai_protocol);
  79         if (s < 0)
  80             continue;
  81         if (connect (s, a->ai_addr, a->ai_addrlen) < 0) {
  82             warn ("connect(%s)", hostname);
  83             close (s);
  84             continue;
  85         }
  86         freeaddrinfo (ai);
  87         return s;
  88     }
  89     warnx ("failed to contact %s", hostname);
  90     freeaddrinfo (ai);
  91     return -1;
  92 }
  93
  94 krb5_error_code
  95 v5_prop(krb5_context context, HDB *db, hdb_entry *entry, void *appdata)
  96 {
  97     krb5_error_code ret;
  98     struct prop_data *pd = appdata;
  99     krb5_data data;
 100
 101     if(encrypt_flag) {
 102         ret = hdb_seal_keys_mkey(context, entry, mkey5);
 103         if (ret) {
 104             krb5_warn(context, ret, "hdb_seal_keys_mkey");
 105             return ret;
 106         }
 107     }
 108     if(decrypt_flag) {
 109         ret = hdb_unseal_keys_mkey(context, entry, mkey5);
 110         if (ret) {
 111             krb5_warn(context, ret, "hdb_unseal_keys_mkey");
 112             return ret;
 113         }
 114     }
 115
 116     ret = hdb_entry2value(context, entry, &data);
 117     if(ret) {
 118         krb5_warn(context, ret, "hdb_entry2value");
 119         return ret;
 120     }
 121
 122     if(to_stdout)
 123         ret = krb5_write_message(context, &pd->sock, &data);
 124     else
 125         ret = krb5_write_priv_message(context, pd->auth_context,
 126                                       &pd->sock, &data);
 127     krb5_data_free(&data);
 128     return ret;
 129 }
 130
 131 struct getargs args[] = {
 132     { "master-key", 'm', arg_string, &mkeyfile, "v5 master key file", "file" },
 133     { "database", 'd',  arg_string, rk_UNCONST(&database), "database", "file" },
 134     { "source",   0,    arg_string, &source_type, "type of database to read",
 135       "heimdal"
 136       "|mit-dump"
 137     },
 138
 139     { "keytab",   'k',  arg_string, rk_UNCONST(&ktname),
 140       "keytab to use for authentication", "keytab" },
 141     { "v5-realm", 'R',  arg_string, &local_realm, "v5 realm to use", NULL },
 142     { "decrypt",  'D',  arg_flag,   &decrypt_flag,   "decrypt keys", NULL },
 143     { "encrypt",  'E',  arg_flag,   &encrypt_flag,   "encrypt keys", NULL },
 144     { "stdout",   'n',  arg_flag,   &to_stdout, "dump to stdout", NULL },
 145     { "verbose",  'v',  arg_flag, &verbose_flag, NULL, NULL },
 146     { "version",   0,   arg_flag, &version_flag, NULL, NULL },
 147     { "help",     'h',  arg_flag, &help_flag, NULL, NULL }
 148 };
 149
 150 static int num_args = sizeof(args) / sizeof(args[0]);
 151
 152 static void
 153 usage(int ret)
 154 {
 155     arg_printusage (args, num_args, NULL, "[host[:port]] ...");
 156     exit (ret);
 157 }
 158
 159 static void
 160 get_creds(krb5_context context, krb5_ccache *cache)
 161 {
 162     krb5_keytab keytab;
 163     krb5_principal client;
 164     krb5_error_code ret;
 165     krb5_get_init_creds_opt *init_opts;
 166     krb5_preauthtype preauth = KRB5_PADATA_ENC_TIMESTAMP;
 167     krb5_creds creds;
 168
 169     ret = krb5_kt_register(context, &hdb_get_kt_ops);
 170     if(ret) krb5_err(context, 1, ret, "krb5_kt_register");
 171
 172     ret = krb5_kt_resolve(context, ktname, &keytab);
 173     if(ret) krb5_err(context, 1, ret, "krb5_kt_resolve");
 174
 175     ret = krb5_make_principal(context, &client, NULL,
 176                               "kadmin", HPROP_NAME, NULL);
 177     if(ret) krb5_err(context, 1, ret, "krb5_make_principal");
 178
 179     ret = krb5_get_init_creds_opt_alloc(context, &init_opts);
 180     if(ret) krb5_err(context, 1, ret, "krb5_get_init_creds_opt_alloc");
 181     krb5_get_init_creds_opt_set_preauth_list(init_opts, &preauth, 1);
 182
 183     ret = krb5_get_init_creds_keytab(context, &creds, client, keytab, 0, NULL, init_opts);
 184     if(ret) krb5_err(context, 1, ret, "krb5_get_init_creds");
 185
 186     krb5_get_init_creds_opt_free(context, init_opts);
 187
 188     ret = krb5_kt_close(context, keytab);
 189     if(ret) krb5_err(context, 1, ret, "krb5_kt_close");
 190
 191     ret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, cache);
 192     if(ret) krb5_err(context, 1, ret, "krb5_cc_new_unique");
 193
 194     ret = krb5_cc_initialize(context, *cache, client);
 195     if(ret) krb5_err(context, 1, ret, "krb5_cc_initialize");
 196
 197     krb5_free_principal(context, client);
 198
 199     ret = krb5_cc_store_cred(context, *cache, &creds);
 200     if(ret) krb5_err(context, 1, ret, "krb5_cc_store_cred");
 201
 202     krb5_free_cred_contents(context, &creds);
 203 }
 204
 205 enum hprop_source {
 206     HPROP_HEIMDAL = 1,
 207     HPROP_MIT_DUMP
 208 };
 209
 210 struct {
 211     int type;
 212     const char *name;
 213 } types[] = {
 214     { HPROP_HEIMDAL,    "heimdal" },
 215     { HPROP_MIT_DUMP,   "mit-dump" }
 216 };
 217
 218 static int
 219 parse_source_type(const char *s)
 220 {
 221     size_t i;
 222     for(i = 0; i < sizeof(types) / sizeof(types[0]); i++) {
 223         if(strstr(types[i].name, s) == types[i].name)
 224             return types[i].type;
 225     }
 226     return 0;
 227 }
 228
 229 static int
 230 iterate (krb5_context context,
 231          const char *database_name,
 232          HDB *db,
 233          int type,
 234          struct prop_data *pd)
 235 {
 236     int ret;
 237
 238     switch(type) {
 239     case HPROP_MIT_DUMP:
 240         ret = mit_prop_dump(pd, database_name);
 241         if (ret)
 242             krb5_warn(context, ret, "mit_prop_dump");
 243         break;
 244     case HPROP_HEIMDAL:
 245         ret = hdb_foreach(context, db, HDB_F_DECRYPT, v5_prop, pd);
 246         if(ret)
 247             krb5_warn(context, ret, "hdb_foreach");
 248         break;
 249     default:
 250         krb5_errx(context, 1, "unknown prop type: %d", type);
 251     }
 252     return ret;
 253 }
 254
 255 static int
 256 dump_database (krb5_context context, int type,
 257                const char *database_name, HDB *db)
 258 {
 259     krb5_error_code ret;
 260     struct prop_data pd;
 261     krb5_data data;
 262
 263     pd.context      = context;
 264     pd.auth_context = NULL;
 265     pd.sock         = STDOUT_FILENO;
 266
 267     ret = iterate (context, database_name, db, type, &pd);
 268     if (ret)
 269         krb5_errx(context, 1, "iterate failure");
 270     krb5_data_zero (&data);
 271     ret = krb5_write_message (context, &pd.sock, &data);
 272     if (ret)
 273         krb5_err(context, 1, ret, "krb5_write_message");
 274
 275     return 0;
 276 }
 277
 278 static int
 279 propagate_database (krb5_context context, int type,
 280                     const char *database_name,
 281                     HDB *db, krb5_ccache ccache,
 282                     int optidx, int argc, char **argv)
 283 {
 284     krb5_principal server;
 285     krb5_error_code ret;
 286     int i, failed = 0;
 287
 288     for(i = optidx; i < argc; i++){
 289         krb5_auth_context auth_context;
 290         int fd;
 291         struct prop_data pd;
 292         krb5_data data;
 293
 294         char *port, portstr[NI_MAXSERV];
 295         char *host = argv[i];
 296
 297         port = strchr(host, ':');
 298         if(port == NULL) {
 299             snprintf(portstr, sizeof(portstr), "%u",
 300                      ntohs(krb5_getportbyname (context, "hprop", "tcp",
 301                                                HPROP_PORT)));
 302             port = portstr;
 303         } else
 304             *port++ = '\0';
 305
 306         fd = open_socket(context, host, port);
 307         if(fd < 0) {
 308             failed++;
 309             krb5_warn (context, errno, "connect %s", host);
 310             continue;
 311         }
 312
 313         ret = krb5_sname_to_principal(context, argv[i],
 314                                       HPROP_NAME, KRB5_NT_SRV_HST, &server);
 315         if(ret) {
 316             failed++;
 317             krb5_warn(context, ret, "krb5_sname_to_principal(%s)", host);
 318             close(fd);
 319             continue;
 320         }
 321
 322         if (local_realm) {
 323             krb5_realm my_realm;
 324             ret = krb5_get_default_realm(context,&my_realm);
 325             if (ret == 0) {
 326                 ret = krb5_principal_set_realm(context,server,my_realm);
 327                 krb5_xfree(my_realm);
 328             }
 329             if (ret) {
 330                 failed++;
 331                 krb5_warn(context, ret, "unable to obtain default or set realm");
 332                 krb5_free_principal(context, server);
 333                 close(fd);
 334                 continue;
 335             }
 336         }
 337
 338         auth_context = NULL;
 339         ret = krb5_sendauth(context,
 340                             &auth_context,
 341                             &fd,
 342                             HPROP_VERSION,
 343                             NULL,
 344                             server,
 345                             AP_OPTS_MUTUAL_REQUIRED | AP_OPTS_USE_SUBKEY,
 346                             NULL, /* in_data */
 347                             NULL, /* in_creds */
 348                             ccache,
 349                             NULL,
 350                             NULL,
 351                             NULL);
 352
 353         krb5_free_principal(context, server);
 354
 355         if(ret) {
 356             failed++;
 357             krb5_warn(context, ret, "krb5_sendauth (%s)", host);
 358             goto next_host;
 359         }
 360
 361         pd.context      = context;
 362         pd.auth_context = auth_context;
 363         pd.sock         = fd;
 364
 365         ret = iterate (context, database_name, db, type, &pd);
 366         if (ret) {
 367             krb5_warnx(context, "iterate to host %s failed", host);
 368             failed++;
 369             goto next_host;
 370         }
 371
 372         krb5_data_zero (&data);
 373         ret = krb5_write_priv_message(context, auth_context, &fd, &data);
 374         if(ret) {
 375             krb5_warn(context, ret, "krb5_write_priv_message");
 376             failed++;
 377             goto next_host;
 378         }
 379
 380         ret = krb5_read_priv_message(context, auth_context, &fd, &data);
 381         if(ret) {
 382             krb5_warn(context, ret, "krb5_read_priv_message: %s", host);
 383             failed++;
 384             goto next_host;
 385         } else
 386             krb5_data_free (&data);
 387
 388     next_host:
 389         krb5_auth_con_free(context, auth_context);
 390         close(fd);
 391     }
 392     if (failed)
 393         return 1;
 394     return 0;
 395 }
 396
 397 int
 398 main(int argc, char **argv)
 399 {
 400     krb5_error_code ret;
 401     krb5_context context;
 402     krb5_ccache ccache = NULL;
 403     HDB *db = NULL;
 404     int optidx = 0;
 405
 406     int type, exit_code;
 407
 408     setprogname(argv[0]);
 409
 410     if(getarg(args, num_args, argc, argv, &optidx))
 411         usage(1);
 412
 413     if(help_flag)
 414         usage(0);
 415
 416     if(version_flag){
 417         print_version(NULL);
 418         exit(0);
 419     }
 420
 421     ret = krb5_init_context(&context);
 422     if(ret)
 423         exit(1);
 424
 425     /* We may be reading an old database encrypted with a DES master key. */
 426     ret = krb5_allow_weak_crypto(context, 1);
 427     if(ret)
 428         krb5_err(context, 1, ret, "krb5_allow_weak_crypto");
 429
 430     if(local_realm)
 431         krb5_set_default_realm(context, local_realm);
 432
 433     if(encrypt_flag && decrypt_flag)
 434         krb5_errx(context, 1,
 435                   "only one of `--encrypt' and `--decrypt' is meaningful");
 436
 437     if(source_type != NULL) {
 438         type = parse_source_type(source_type);
 439         if(type == 0)
 440             krb5_errx(context, 1, "unknown source type `%s'", source_type);
 441     } else
 442         type = HPROP_HEIMDAL;
 443
 444     if(!to_stdout)
 445         get_creds(context, &ccache);
 446
 447     if(decrypt_flag || encrypt_flag) {
 448         ret = hdb_read_master_key(context, mkeyfile, &mkey5);
 449         if(ret && ret != ENOENT)
 450             krb5_err(context, 1, ret, "hdb_read_master_key");
 451         if(ret)
 452             krb5_errx(context, 1, "No master key file found");
 453     }
 454
 455     switch(type) {
 456     case HPROP_MIT_DUMP:
 457         if (database == NULL)
 458             krb5_errx(context, 1, "no dump file specified");
 459         break;
 460     case HPROP_HEIMDAL:
 461         ret = hdb_create (context, &db, database);
 462         if(ret)
 463             krb5_err(context, 1, ret, "hdb_create: %s", database);
 464         ret = db->hdb_open(context, db, O_RDONLY, 0);
 465         if(ret)
 466             krb5_err(context, 1, ret, "db->hdb_open");
 467         break;
 468     default:
 469         krb5_errx(context, 1, "unknown dump type `%d'", type);
 470         break;
 471     }
 472
 473     if (to_stdout)
 474         exit_code = dump_database (context, type, database, db);
 475     else
 476         exit_code = propagate_database (context, type, database,
 477                                         db, ccache, optidx, argc, argv);
 478
 479     if(ccache != NULL)
 480         krb5_cc_destroy(context, ccache);
 481
 482     if(db != NULL)
 483         (*db->hdb_destroy)(context, db);
 484
 485     krb5_free_context(context);
 486     return exit_code;
 487 }