kdc/kdc-plugin.c

   1 /*
   2  * Copyright (c) 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions (c) 2021, 2022 PADL Software Pty Ltd.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kdc_locl.h"
  37
  38 static int have_plugin = 0;
  39
  40 /*
  41  * Pick the first KDC plugin module that we find.
  42  */
  43
  44 static const char *kdc_plugin_deps[] = {
  45     "kdc",
  46     "krb5",
  47     "hdb",
  48     NULL
  49 };
  50
  51 static struct heim_plugin_data kdc_plugin_data = {
  52     "krb5",
  53     "kdc",
  54     KRB5_PLUGIN_KDC_VERSION_10,
  55     kdc_plugin_deps,
  56     kdc_get_instance
  57 };
  58
  59 static krb5_error_code KRB5_LIB_CALL
  60 load(krb5_context context, const void *plug, void *plugctx, void *userctx)
  61 {
  62     have_plugin = 1;
  63     return KRB5_PLUGIN_NO_HANDLE;
  64 }
  65
  66 KDC_LIB_FUNCTION krb5_error_code KDC_LIB_CALL
  67 krb5_kdc_plugin_init(krb5_context context)
  68 {
  69     (void)_krb5_plugin_run_f(context, &kdc_plugin_data, 0, NULL, load);
  70
  71     return 0;
  72 }
  73
  74 struct generate_uc {
  75     astgs_request_t r;
  76     hdb_entry *client;
  77     hdb_entry *server;
  78     const krb5_keyblock *reply_key;
  79     uint64_t pac_attributes;
  80     krb5_pac *pac;
  81 };
  82
  83 static krb5_error_code KRB5_LIB_CALL
  84 generate(krb5_context context, const void *plug, void *plugctx, void *userctx)
  85 {
  86     const krb5plugin_kdc_ftable *ft = (const krb5plugin_kdc_ftable *)plug;
  87     struct generate_uc *uc = (struct generate_uc *)userctx;
  88
  89     if (ft->pac_generate == NULL)
  90         return KRB5_PLUGIN_NO_HANDLE;
  91
  92     return ft->pac_generate((void *)plug,
  93                             uc->r,
  94                             uc->client,
  95                             uc->server,
  96                             uc->reply_key,
  97                             uc->pac_attributes,
  98                             uc->pac);
  99 }
 100
 101
 102 krb5_error_code
 103 _kdc_pac_generate(astgs_request_t r,
 104                   hdb_entry *client,
 105                   hdb_entry *server,
 106                   const krb5_keyblock *reply_key,
 107                   uint64_t pac_attributes,
 108                   krb5_pac *pac)
 109 {
 110     krb5_error_code ret = 0;
 111     struct generate_uc uc;
 112
 113     *pac = NULL;
 114
 115     if (krb5_config_get_bool_default(r->context, NULL, FALSE, "realms",
 116                                      client->principal->realm,
 117                                      "disable_pac", NULL))
 118         return 0;
 119
 120     if (have_plugin) {
 121         uc.r = r;
 122         uc.client = client;
 123         uc.server = server;
 124         uc.reply_key = reply_key;
 125         uc.pac = pac;
 126         uc.pac_attributes = pac_attributes;
 127
 128         ret = _krb5_plugin_run_f(r->context, &kdc_plugin_data,
 129                                  0, &uc, generate);
 130         if (ret != KRB5_PLUGIN_NO_HANDLE)
 131             return ret;
 132         ret = 0;
 133     }
 134
 135     if (*pac == NULL)
 136         ret = krb5_pac_init(r->context, pac);
 137
 138     return ret;
 139 }
 140
 141 struct verify_uc {
 142     astgs_request_t r;
 143     krb5_principal client_principal;
 144     krb5_principal delegated_proxy_principal;
 145     hdb_entry *client;
 146     hdb_entry *server;
 147     hdb_entry *krbtgt;
 148     krb5_pac *pac;
 149 };
 150
 151 static krb5_error_code KRB5_LIB_CALL
 152 verify(krb5_context context, const void *plug, void *plugctx, void *userctx)
 153 {
 154     const krb5plugin_kdc_ftable *ft = (const krb5plugin_kdc_ftable *)plug;
 155     struct verify_uc *uc = (struct verify_uc *)userctx;
 156     krb5_error_code ret;
 157
 158     if (ft->pac_verify == NULL)
 159         return KRB5_PLUGIN_NO_HANDLE;
 160
 161     ret = ft->pac_verify((void *)plug,
 162                          uc->r,
 163                          uc->client_principal,
 164                          uc->delegated_proxy_principal,
 165                          uc->client, uc->server, uc->krbtgt, uc->pac);
 166     return ret;
 167 }
 168
 169 krb5_error_code
 170 _kdc_pac_verify(astgs_request_t r,
 171                 const krb5_principal client_principal,
 172                 const krb5_principal delegated_proxy_principal,
 173                 hdb_entry *client,
 174                 hdb_entry *server,
 175                 hdb_entry *krbtgt,
 176                 krb5_pac *pac)
 177 {
 178     struct verify_uc uc;
 179
 180     if (!have_plugin)
 181         return KRB5_PLUGIN_NO_HANDLE;
 182
 183     uc.r = r;
 184     uc.client_principal = client_principal;
 185     uc.delegated_proxy_principal = delegated_proxy_principal;
 186     uc.client = client;
 187     uc.server = server;
 188     uc.krbtgt = krbtgt;
 189     uc.pac = pac;
 190
 191     return _krb5_plugin_run_f(r->context, &kdc_plugin_data,
 192                              0, &uc, verify);
 193 }
 194
 195 static krb5_error_code KRB5_LIB_CALL
 196 check(krb5_context context, const void *plug, void *plugctx, void *userctx)
 197 {
 198     const krb5plugin_kdc_ftable *ft = (const krb5plugin_kdc_ftable *)plug;
 199
 200     if (ft->client_access == NULL)
 201         return KRB5_PLUGIN_NO_HANDLE;
 202     return ft->client_access((void *)plug, userctx);
 203 }
 204
 205 krb5_error_code
 206 _kdc_check_access(astgs_request_t r)
 207 {
 208     krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
 209
 210     if (have_plugin) {
 211         ret = _krb5_plugin_run_f(r->context, &kdc_plugin_data,
 212                                  0, r, check);
 213     }
 214
 215     if (ret == KRB5_PLUGIN_NO_HANDLE)
 216         return kdc_check_flags(r, r->req.msg_type == krb_as_req,
 217                                r->client, r->server);
 218     return ret;
 219 }
 220
 221 static krb5_error_code KRB5_LIB_CALL
 222 referral_policy(krb5_context context, const void *plug, void *plugctx, void *userctx)
 223 {
 224     const krb5plugin_kdc_ftable *ft = (const krb5plugin_kdc_ftable *)plug;
 225
 226     if (ft->referral_policy == NULL)
 227         return KRB5_PLUGIN_NO_HANDLE;
 228     return ft->referral_policy((void *)plug, userctx);
 229 }
 230
 231 krb5_error_code
 232 _kdc_referral_policy(astgs_request_t r)
 233 {
 234     krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
 235
 236     if (have_plugin)
 237         ret = _krb5_plugin_run_f(r->context, &kdc_plugin_data, 0, r, referral_policy);
 238
 239     return ret;
 240 }
 241
 242 static krb5_error_code KRB5_LIB_CALL
 243 finalize_reply(krb5_context context, const void *plug, void *plugctx, void *userctx)
 244 {
 245     const krb5plugin_kdc_ftable *ft = (const krb5plugin_kdc_ftable *)plug;
 246
 247     if (ft->finalize_reply == NULL)
 248         return KRB5_PLUGIN_NO_HANDLE;
 249     return ft->finalize_reply((void *)plug, userctx);
 250 }
 251
 252 krb5_error_code
 253 _kdc_finalize_reply(astgs_request_t r)
 254 {
 255     krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
 256
 257     if (have_plugin)
 258         ret = _krb5_plugin_run_f(r->context, &kdc_plugin_data, 0, r, finalize_reply);
 259
 260     if (ret == KRB5_PLUGIN_NO_HANDLE)
 261         ret = 0;
 262
 263     return ret;
 264 }
 265
 266 static krb5_error_code KRB5_LIB_CALL
 267 audit(krb5_context context, const void *plug, void *plugctx, void *userctx)
 268 {
 269     const krb5plugin_kdc_ftable *ft = (const krb5plugin_kdc_ftable *)plug;
 270
 271     if (ft->audit == NULL)
 272         return KRB5_PLUGIN_NO_HANDLE;
 273     return ft->audit((void *)plug, userctx);
 274 }
 275
 276 krb5_error_code
 277 _kdc_plugin_audit(astgs_request_t r)
 278 {
 279     krb5_error_code ret = KRB5_PLUGIN_NO_HANDLE;
 280
 281     if (have_plugin)
 282         ret = _krb5_plugin_run_f(r->context, &kdc_plugin_data, 0, r, audit);
 283
 284     if (ret == KRB5_PLUGIN_NO_HANDLE)
 285         ret = 0;
 286
 287     return ret;
 288 }
 289
 290 KDC_LIB_FUNCTION uintptr_t KDC_LIB_CALL
 291 kdc_get_instance(const char *libname)
 292 {
 293     static const char *instance = "libkdc";
 294
 295     if (strcmp(libname, "kdc") == 0)
 296         return (uintptr_t)instance;
 297     else if (strcmp(libname, "hdb") == 0)
 298         return hdb_get_instance(libname);
 299     else if (strcmp(libname, "krb5") == 0)
 300         return krb5_get_instance(libname);
 301
 302     return 0;
 303 }
 304
 305 /*
 306  * Minimum API surface wrapper for libheimbase object types so it
 307  * may remain a private interface, yet plugins can interact with
 308  * objects.
 309  */
 310
 311 KDC_LIB_FUNCTION kdc_object_t KDC_LIB_CALL
 312 kdc_object_alloc(size_t size, const char *name, kdc_type_dealloc dealloc)
 313 {
 314     return heim_alloc(size, name, dealloc);
 315 }
 316
 317 KDC_LIB_FUNCTION kdc_object_t KDC_LIB_CALL
 318 kdc_object_retain(kdc_object_t o)
 319 {
 320     return heim_retain(o);
 321 }
 322
 323 KDC_LIB_FUNCTION void KDC_LIB_CALL
 324 kdc_object_release(kdc_object_t o)
 325 {
 326     heim_release(o);
 327 }
 328
 329 KDC_LIB_FUNCTION kdc_object_t KDC_LIB_CALL
 330 kdc_bool_create(krb5_boolean v)
 331 {
 332     return heim_bool_create(v);
 333 }
 334
 335 KDC_LIB_FUNCTION krb5_boolean KDC_LIB_CALL
 336 kdc_bool_get_value(kdc_object_t o)
 337 {
 338     return heim_bool_val(o);
 339 }
 340
 341 struct kdc_array_iterator_trampoline_data {
 342     kdc_array_iterator_t iter;
 343     void *data;
 344 };
 345
 346 /*
 347  * Calling convention shim to avoid needing to update all internal
 348  * consumers of heim_array_iterate_f()
 349  */
 350 static void
 351 _kdc_array_iterator_trampoline(kdc_object_t o, void *data, int *stop)
 352 {
 353     struct kdc_array_iterator_trampoline_data *t = data;
 354
 355     t->iter(o, t->data, stop);
 356 }
 357
 358 KDC_LIB_FUNCTION void KDC_LIB_CALL
 359 kdc_array_iterate(kdc_array_t a, void *d, kdc_array_iterator_t iter)
 360 {
 361     struct kdc_array_iterator_trampoline_data t;
 362
 363     t.iter = iter;
 364     t.data = d;
 365
 366     heim_array_iterate_f((heim_array_t)a, &t, _kdc_array_iterator_trampoline);
 367 }
 368
 369 KDC_LIB_FUNCTION size_t KDC_LIB_CALL
 370 kdc_array_get_length(kdc_array_t a)
 371 {
 372     return heim_array_get_length((heim_array_t)a);
 373 }
 374
 375 KDC_LIB_FUNCTION kdc_object_t KDC_LIB_CALL
 376 kdc_array_get_value(heim_array_t a, size_t i)
 377 {
 378     return heim_array_get_value((heim_array_t)a, i);
 379 }
 380
 381 KDC_LIB_FUNCTION kdc_object_t KDC_LIB_CALL
 382 kdc_array_copy_value(heim_array_t a, size_t i)
 383 {
 384     return heim_array_copy_value((heim_array_t)a, i);
 385 }
 386
 387 KDC_LIB_FUNCTION kdc_string_t KDC_LIB_CALL
 388 kdc_string_create(const char *s)
 389 {
 390     return (kdc_string_t)heim_string_create(s);
 391 }
 392
 393 KDC_LIB_FUNCTION const char * KDC_LIB_CALL
 394 kdc_string_get_utf8(kdc_string_t s)
 395 {
 396     return heim_string_get_utf8((heim_string_t)s);
 397 }
 398
 399 KDC_LIB_FUNCTION kdc_data_t
 400 kdc_data_create(const void *d, size_t len)
 401 {
 402     return (kdc_data_t)heim_data_create(d, len);
 403 }
 404
 405 KDC_LIB_FUNCTION const krb5_data * KDC_LIB_CALL
 406 kdc_data_get_data(kdc_data_t d)
 407 {
 408     return heim_data_get_data((heim_data_t)d);
 409 }
 410
 411 KDC_LIB_FUNCTION kdc_number_t KDC_LIB_CALL
 412 kdc_number_create(int64_t v)
 413 {
 414     return (kdc_number_t)heim_number_create(v);
 415 }
 416
 417 KDC_LIB_FUNCTION int64_t KDC_LIB_CALL
 418 kdc_number_get_value(kdc_number_t n)
 419 {
 420     return heim_number_get_long((heim_number_t)n);
 421 }
 422
 423 /*
 424  * Plugin accessors
 425  */
 426
 427 KDC_LIB_FUNCTION krb5_error_code KDC_LIB_CALL
 428 kdc_request_add_reply_padata(astgs_request_t r, PA_DATA *md)
 429 {
 430     heim_assert(r->rep.padata != NULL, "reply padata not allocated");
 431     return add_METHOD_DATA(r->rep.padata, md);
 432 }
 433
 434 KDC_LIB_FUNCTION krb5_error_code KDC_LIB_CALL
 435 kdc_request_add_encrypted_padata(astgs_request_t r, PA_DATA *md)
 436 {
 437     if (r->ek.encrypted_pa_data == NULL) {
 438         r->ek.encrypted_pa_data = calloc(1, sizeof *(r->ek.encrypted_pa_data));
 439         if (r->ek.encrypted_pa_data == NULL) {
 440             return ENOMEM;
 441         }
 442     }
 443
 444     return add_METHOD_DATA(r->ek.encrypted_pa_data, md);
 445 }
 446
 447 KDC_LIB_FUNCTION krb5_error_code KDC_LIB_CALL
 448 kdc_request_add_pac_buffer(astgs_request_t r,
 449                            uint32_t pactype,
 450                            const krb5_data *d)
 451 {
 452     krb5_error_code ret;
 453     krb5_pac pac;
 454
 455     if (r->pac == NULL) {
 456         ret = krb5_pac_init(r->context, &pac);
 457         if (ret)
 458             return ret;
 459     } else
 460         pac = heim_retain(r->pac);
 461
 462     ret = krb5_pac_add_buffer(r->context, pac, pactype, d);
 463     if (ret == 0 && r->pac == NULL)
 464         r->pac = pac;
 465     else
 466         heim_release(pac);
 467
 468     return ret;
 469 }
 470
 471 #undef _KDC_REQUEST_GET_ACCESSOR
 472 #define _KDC_REQUEST_GET_ACCESSOR(R, T, f)                  \
 473     KDC_LIB_FUNCTION T KDC_LIB_CALL                         \
 474     kdc_request_get_ ## f(R r)                              \
 475     {                                                       \
 476         return r->f;                                        \
 477     }
 478
 479 #undef _KDC_REQUEST_SET_ACCESSOR
 480 #define _KDC_REQUEST_SET_ACCESSOR(R, T, f)                  \
 481     KDC_LIB_FUNCTION void KDC_LIB_CALL                      \
 482     kdc_request_set_ ## f(R r, T v)                         \
 483     {                                                       \
 484         r->f = v;                                           \
 485     }
 486
 487 #undef _KDC_REQUEST_GET_ACCESSOR_PTR
 488 #define _KDC_REQUEST_GET_ACCESSOR_PTR(R, T,  f)             \
 489     KDC_LIB_FUNCTION const T KDC_LIB_CALL                   \
 490     kdc_request_get_ ## f(R r)                              \
 491     {                                                       \
 492         return r->f;                                        \
 493     }
 494
 495 #undef _KDC_REQUEST_SET_ACCESSOR_PTR
 496 #define _KDC_REQUEST_SET_ACCESSOR_PTR(R, T, t, f)           \
 497     KDC_LIB_FUNCTION krb5_error_code KDC_LIB_CALL           \
 498     kdc_request_set_ ## f(R r, const T v)                   \
 499     {                                                       \
 500         krb5_error_code ret;                                \
 501         T tmp;                                              \
 502                                                             \
 503         if (v == r->f)                                      \
 504             return 0;                                       \
 505         else if (v) {                                       \
 506             ret = copy_##t(v, &tmp);                        \
 507             if (ret)                                        \
 508                 return ret;                                 \
 509         } else                                              \
 510             tmp = NULL;                                     \
 511                                                             \
 512         free_##t(r->f);                                     \
 513         r->f = tmp;                                         \
 514                                                             \
 515         return 0;                                           \
 516     }
 517
 518 #undef _KDC_REQUEST_GET_ACCESSOR_STRUCT
 519 #define _KDC_REQUEST_GET_ACCESSOR_STRUCT(R, T, f)           \
 520     KDC_LIB_FUNCTION const T * KDC_LIB_CALL                 \
 521     kdc_request_get_ ## f(R r)                              \
 522     {                                                       \
 523         return &r->f;                                       \
 524     }
 525
 526 #undef _KDC_REQUEST_SET_ACCESSOR_STRUCT
 527 #define _KDC_REQUEST_SET_ACCESSOR_STRUCT(R, T, t, f)        \
 528     KDC_LIB_FUNCTION krb5_error_code KDC_LIB_CALL           \
 529     kdc_request_set_ ## f(R r, const T *v)                  \
 530     {                                                       \
 531         krb5_error_code ret;                                \
 532         T tmp;                                              \
 533                                                             \
 534         if (v == NULL)                                      \
 535             return EINVAL;                                  \
 536         else if (v == &r->f)                                \
 537             return 0;                                       \
 538                                                             \
 539         ret = copy_##t(v, &tmp);                            \
 540         if (ret)                                            \
 541             return ret;                                     \
 542                                                             \
 543         free_##t(&r->f);                                    \
 544         r->f = tmp;                                         \
 545                                                             \
 546         return 0;                                           \
 547     }
 548
 549 static krb5_error_code
 550 copy_string_ptr(const char *src, char **dst)
 551 {
 552     *dst = strdup(src);
 553     if (*dst == NULL)
 554         return ENOMEM;
 555
 556     return 0;
 557 }
 558
 559 static void
 560 free_string_ptr(char *s)
 561 {
 562     free(s);
 563 }
 564
 565 static krb5_error_code
 566 copy_Principal_ptr(krb5_const_principal src, krb5_principal *dst)
 567 {
 568     krb5_error_code ret;
 569     krb5_principal p;
 570
 571     *dst = NULL;
 572
 573     p = calloc(1, sizeof(*p));
 574     if (p == NULL)
 575         return ENOMEM;
 576
 577     ret = copy_Principal(src, p);
 578     if (ret == 0)
 579         *dst = p;
 580     else
 581         free(p);
 582
 583     return ret;
 584 }
 585
 586 static void
 587 free_Principal_ptr(krb5_principal p)
 588 {
 589     if (p) {
 590         free_Principal(p);
 591         free(p);
 592     }
 593 }
 594
 595 static krb5_error_code
 596 copy_pac(const struct krb5_pac_data *src, struct krb5_pac_data **dst)
 597 {
 598     /* FIXME use heim_copy() when it exists */
 599     *dst = (krb5_pac)heim_retain((heim_object_t)src);
 600     return 0;
 601 }
 602
 603 static void
 604 free_pac(struct krb5_pac_data *o)
 605 {
 606     heim_release(o);
 607 }
 608
 609 static krb5_error_code
 610 copy_keyblock(const EncryptionKey *src, EncryptionKey *dst)
 611 {
 612     return copy_EncryptionKey(src, dst);
 613 }
 614
 615 static void
 616 free_keyblock(EncryptionKey *key)
 617 {
 618     krb5_free_keyblock_contents(NULL, key);
 619 }
 620
 621 #undef HEIMDAL_KDC_KDC_ACCESSORS_H
 622 #include "kdc-accessors.h"
 623
 624 #undef _KDC_REQUEST_GET_ACCESSOR
 625 #undef _KDC_REQUEST_SET_ACCESSOR
 626
 627 #undef _KDC_REQUEST_GET_ACCESSOR_PTR
 628 #undef _KDC_REQUEST_SET_ACCESSOR_PTR
 629 #define _KDC_REQUEST_SET_ACCESSOR_PTR(R, T, t, f)           \
 630     void                                                    \
 631     _kdc_request_set_ ## f ## _nocopy(R r, T *v)            \
 632     {                                                       \
 633         if (*v != r->f) {                                   \
 634             free_##t(r->f);                                 \
 635             r->f = *v;                                      \
 636         }                                                   \
 637         *v = NULL;                                          \
 638     }
 639
 640 #undef _KDC_REQUEST_GET_ACCESSOR_STRUCT
 641 #undef _KDC_REQUEST_SET_ACCESSOR_STRUCT
 642 #define _KDC_REQUEST_SET_ACCESSOR_STRUCT(R, T, t, f)        \
 643     void                                                    \
 644     _kdc_request_set_ ## f ## _nocopy(R r, T *v)            \
 645     {                                                       \
 646         if (v != &r->f) {                                   \
 647             free_##t(&r->f);                                \
 648             r->f = *v;                                      \
 649         }                                                   \
 650         memset(v, 0, sizeof(*v));                           \
 651     }
 652
 653 #undef HEIMDAL_KDC_KDC_ACCESSORS_H
 654 #include "kdc-accessors.h"