1 /* $NetBSD: config.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $ */
4 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of the Institute nor the names of its contributors
22 * may be used to endorse or promote products derived from this software
23 * without specific prior written permission.
25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 #include <krb5/getarg.h>
40 #include <krb5/parse_bytes.h>
49 static char *config_file
; /* location of kdc config file */
51 static int require_preauth
= -1; /* 1 == require preauth for all principals */
52 static char *max_request_str
; /* `max_request' as a string */
54 static int disable_des
= -1;
56 static int builtin_hdb_flag
;
58 static int version_flag
;
60 static struct getarg_strings addresses_str
; /* addresses to listen on */
66 static struct getargs args
[] = {
68 "config-file", 'c', arg_string
, &config_file
,
69 "location of config file", "file"
72 "require-preauth", 'p', arg_negative_flag
, &require_preauth
,
73 "don't require pa-data in as-reqs", NULL
76 "max-request", 0, arg_string
, &max_request_str
,
77 "max size for a kdc-request", "size"
79 { "enable-http", 'H', arg_flag
, &enable_http
, "turn on HTTP support",
81 { "ports", 'P', arg_string
, rk_UNCONST(&port_str
),
82 "ports to listen to", "portspec"
87 "detach", 'D', arg_negative_flag
, &detach_from_console
,
88 "don't detach from console", NULL
92 "detach", 0 , arg_flag
, &detach_from_console
,
93 "detach from console", NULL
97 { "addresses", 0, arg_strings
, &addresses_str
,
98 "addresses to listen on", "list of addresses" },
99 { "disable-des", 0, arg_flag
, &disable_des
,
100 "disable DES", NULL
},
101 { "builtin-hdb", 0, arg_flag
, &builtin_hdb_flag
,
102 "list builtin hdb backends", NULL
},
103 { "runas-user", 0, arg_string
, &runas_string
,
104 "run as this user when connected to network", NULL
106 { "chroot", 0, arg_string
, &chroot_string
,
107 "chroot directory to run in", NULL
109 { "help", 'h', arg_flag
, &help_flag
, NULL
, NULL
},
110 { "version", 'v', arg_flag
, &version_flag
, NULL
, NULL
}
113 static int num_args
= sizeof(args
) / sizeof(args
[0]);
118 arg_printusage (args
, num_args
, NULL
, "");
123 add_one_address (krb5_context context
, const char *str
, int first
)
128 ret
= krb5_parse_address (context
, str
, &tmp
);
130 krb5_err (context
, 1, ret
, "parse_address `%s'", str
);
132 krb5_copy_addresses(context
, &tmp
, &explicit_addresses
);
134 krb5_append_addresses(context
, &explicit_addresses
, &tmp
);
135 krb5_free_addresses (context
, &tmp
);
138 krb5_kdc_configuration
*
139 configure(krb5_context context
, int argc
, char **argv
)
141 krb5_kdc_configuration
*config
;
146 while(getarg(args
, num_args
, argc
, argv
, &optidx
))
147 warnx("error at argument `%s'", argv
[optidx
]);
157 if (builtin_hdb_flag
) {
159 ret
= hdb_list_builtin(context
, &list
);
161 krb5_err(context
, 1, ret
, "listing builtin hdb backends");
162 printf("builtin hdb backends: %s\n", list
);
176 if (config_file
== NULL
) {
177 asprintf(&config_file
, "%s/kdc.conf", hdb_db_dir(context
));
178 if (config_file
== NULL
)
179 errx(1, "out of memory");
182 ret
= krb5_prepend_config_files_default(config_file
, &files
);
184 krb5_err(context
, 1, ret
, "getting configuration files");
186 ret
= krb5_set_config_files(context
, files
);
187 krb5_free_config_files(files
);
189 krb5_err(context
, 1, ret
, "reading configuration files");
192 ret
= krb5_kdc_get_config(context
, &config
);
194 krb5_err(context
, 1, ret
, "krb5_kdc_default_config");
196 kdc_openlog(context
, "kdc", config
);
198 ret
= krb5_kdc_set_dbinfo(context
, config
);
200 krb5_err(context
, 1, ret
, "krb5_kdc_set_dbinfo");
203 max_request_tcp
= max_request_udp
= parse_bytes(max_request_str
, NULL
);
205 if(max_request_tcp
== 0){
206 p
= krb5_config_get_string (context
,
212 max_request_tcp
= max_request_udp
= parse_bytes(p
, NULL
);
215 if(require_preauth
!= -1)
216 config
->require_preauth
= require_preauth
;
218 if(port_str
== NULL
){
219 p
= krb5_config_get_string(context
, NULL
, "kdc", "ports", NULL
);
221 port_str
= strdup(p
);
224 explicit_addresses
.len
= 0;
226 if (addresses_str
.num_strings
) {
229 for (i
= 0; i
< addresses_str
.num_strings
; ++i
)
230 add_one_address (context
, addresses_str
.strings
[i
], i
== 0);
231 free_getarg_strings (&addresses_str
);
233 char **foo
= krb5_config_get_strings (context
, NULL
,
234 "kdc", "addresses", NULL
);
237 add_one_address (context
, *foo
++, TRUE
);
239 add_one_address (context
, *foo
++, FALSE
);
243 if(enable_http
== -1)
244 enable_http
= krb5_config_get_bool(context
, NULL
, "kdc",
245 "enable-http", NULL
);
247 if(request_log
== NULL
)
248 request_log
= krb5_config_get_string(context
, NULL
,
253 if (krb5_config_get_string(context
, NULL
, "kdc",
254 "enforce-transited-policy", NULL
))
255 krb5_errx(context
, 1, "enforce-transited-policy deprecated, "
256 "use [kdc]transited-policy instead");
258 #ifdef SUPPORT_DETACH
259 if(detach_from_console
== -1)
260 detach_from_console
= krb5_config_get_bool_default(context
, NULL
,
264 #endif /* SUPPORT_DETACH */
266 if(max_request_tcp
== 0)
267 max_request_tcp
= 64 * 1024;
268 if(max_request_udp
== 0)
269 max_request_udp
= 64 * 1024;
271 if (port_str
== NULL
)
274 if(disable_des
== -1)
275 disable_des
= krb5_config_get_bool_default(context
, NULL
,
278 "disable-des", NULL
);
280 krb5_enctype_disable(context
, ETYPE_DES_CBC_CRC
);
281 krb5_enctype_disable(context
, ETYPE_DES_CBC_MD4
);
282 krb5_enctype_disable(context
, ETYPE_DES_CBC_MD5
);
283 krb5_enctype_disable(context
, ETYPE_DES_CBC_NONE
);
284 krb5_enctype_disable(context
, ETYPE_DES_CFB64_NONE
);
285 krb5_enctype_disable(context
, ETYPE_DES_PCBC_NONE
);
288 krb5_kdc_windc_init(context
);
290 krb5_kdc_pkinit_config(context
, config
);