crypto/external/bsd/heimdal/dist/kdc/default_config.c

   1 /*      $NetBSD: default_config.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $    */
   2
   3 /*
   4  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
   5  * (Royal Institute of Technology, Stockholm, Sweden).
   6  * All rights reserved.
   7  *
   8  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  *
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  *
  21  * 3. Neither the name of the Institute nor the names of its contributors
  22  *    may be used to endorse or promote products derived from this software
  23  *    without specific prior written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  35  * SUCH DAMAGE.
  36  */
  37
  38 #include "kdc_locl.h"
  39 #include <krb5/getarg.h>
  40 #include <krb5/parse_bytes.h>
  41
  42 krb5_error_code
  43 krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
  44 {
  45     krb5_kdc_configuration *c;
  46
  47     c = calloc(1, sizeof(*c));
  48     if (c == NULL) {
  49         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
  50         return ENOMEM;
  51     }
  52
  53     c->require_preauth = TRUE;
  54     c->kdc_warn_pwexpire = 0;
  55     c->encode_as_rep_as_tgs_rep = FALSE;
  56     c->tgt_use_strongest_session_key = FALSE;
  57     c->preauth_use_strongest_session_key = FALSE;
  58     c->svc_use_strongest_session_key = FALSE;
  59     c->use_strongest_server_key = TRUE;
  60     c->check_ticket_addresses = TRUE;
  61     c->allow_null_ticket_addresses = TRUE;
  62     c->allow_anonymous = FALSE;
  63     c->trpolicy = TRPOLICY_ALWAYS_CHECK;
  64     c->enable_pkinit = FALSE;
  65     c->pkinit_princ_in_cert = TRUE;
  66     c->pkinit_require_binding = TRUE;
  67     c->db = NULL;
  68     c->num_db = 0;
  69     c->logf = NULL;
  70
  71     c->require_preauth =
  72         krb5_config_get_bool_default(context, NULL,
  73                                      c->require_preauth,
  74                                      "kdc", "require-preauth", NULL);
  75 #ifdef DIGEST
  76     c->enable_digest =
  77         krb5_config_get_bool_default(context, NULL,
  78                                      FALSE,
  79                                      "kdc", "enable-digest", NULL);
  80
  81     {
  82         const char *digests;
  83
  84         digests = krb5_config_get_string(context, NULL,
  85                                          "kdc",
  86                                          "digests_allowed", NULL);
  87         if (digests == NULL)
  88             digests = "ntlm-v2";
  89         c->digests_allowed = parse_flags(digests,_kdc_digestunits, 0);
  90         if (c->digests_allowed == -1) {
  91             kdc_log(context, c, 0,
  92                     "unparsable digest units (%s), turning off digest",
  93                     digests);
  94             c->enable_digest = 0;
  95         } else if (c->digests_allowed == 0) {
  96             kdc_log(context, c, 0,
  97                     "no digest enable, turning digest off",
  98                     digests);
  99             c->enable_digest = 0;
 100         }
 101     }
 102 #endif
 103
 104 #ifdef KX509
 105     c->enable_kx509 =
 106         krb5_config_get_bool_default(context, NULL,
 107                                      FALSE,
 108                                      "kdc", "enable-kx509", NULL);
 109
 110     if (c->enable_kx509) {
 111         c->kx509_template =
 112             krb5_config_get_string(context, NULL,
 113                                    "kdc", "kx509_template", NULL);
 114         c->kx509_ca =
 115             krb5_config_get_string(context, NULL,
 116                                    "kdc", "kx509_ca", NULL);
 117         if (c->kx509_ca == NULL || c->kx509_template == NULL) {
 118             kdc_log(context, c, 0,
 119                     "missing kx509 configuration, turning off");
 120             c->enable_kx509 = FALSE;
 121         }
 122     }
 123 #endif
 124
 125     c->tgt_use_strongest_session_key =
 126         krb5_config_get_bool_default(context, NULL,
 127                                      c->tgt_use_strongest_session_key,
 128                                      "kdc",
 129                                      "tgt-use-strongest-session-key", NULL);
 130     c->preauth_use_strongest_session_key =
 131         krb5_config_get_bool_default(context, NULL,
 132                                      c->preauth_use_strongest_session_key,
 133                                      "kdc",
 134                                      "preauth-use-strongest-session-key", NULL);
 135     c->svc_use_strongest_session_key =
 136         krb5_config_get_bool_default(context, NULL,
 137                                      c->svc_use_strongest_session_key,
 138                                      "kdc",
 139                                      "svc-use-strongest-session-key", NULL);
 140     c->use_strongest_server_key =
 141         krb5_config_get_bool_default(context, NULL,
 142                                      c->use_strongest_server_key,
 143                                      "kdc",
 144                                      "use-strongest-server-key", NULL);
 145
 146     c->check_ticket_addresses =
 147         krb5_config_get_bool_default(context, NULL,
 148                                      c->check_ticket_addresses,
 149                                      "kdc",
 150                                      "check-ticket-addresses", NULL);
 151     c->allow_null_ticket_addresses =
 152         krb5_config_get_bool_default(context, NULL,
 153                                      c->allow_null_ticket_addresses,
 154                                      "kdc",
 155                                      "allow-null-ticket-addresses", NULL);
 156
 157     c->allow_anonymous =
 158         krb5_config_get_bool_default(context, NULL,
 159                                      c->allow_anonymous,
 160                                      "kdc",
 161                                      "allow-anonymous", NULL);
 162
 163     c->max_datagram_reply_length =
 164         krb5_config_get_int_default(context,
 165                                     NULL,
 166                                     1400,
 167                                     "kdc",
 168                                     "max-kdc-datagram-reply-length",
 169                                     NULL);
 170
 171     {
 172         const char *trpolicy_str;
 173
 174         trpolicy_str =
 175             krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc",
 176                                            "transited-policy", NULL);
 177         if(strcasecmp(trpolicy_str, "always-check") == 0) {
 178             c->trpolicy = TRPOLICY_ALWAYS_CHECK;
 179         } else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) {
 180             c->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
 181         } else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) {
 182             c->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
 183         } else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) {
 184             /* default */
 185         } else {
 186             kdc_log(context, c, 0,
 187                     "unknown transited-policy: %s, "
 188                     "reverting to default (always-check)",
 189                     trpolicy_str);
 190         }
 191     }
 192
 193     c->encode_as_rep_as_tgs_rep =
 194         krb5_config_get_bool_default(context, NULL,
 195                                      c->encode_as_rep_as_tgs_rep,
 196                                      "kdc",
 197                                      "encode_as_rep_as_tgs_rep", NULL);
 198
 199     c->kdc_warn_pwexpire =
 200         krb5_config_get_time_default (context, NULL,
 201                                       c->kdc_warn_pwexpire,
 202                                       "kdc", "kdc_warn_pwexpire", NULL);
 203
 204
 205     c->enable_pkinit =
 206         krb5_config_get_bool_default(context,
 207                                      NULL,
 208                                      c->enable_pkinit,
 209                                      "kdc",
 210                                      "enable-pkinit",
 211                                      NULL);
 212
 213
 214     c->pkinit_kdc_identity =
 215         krb5_config_get_string(context, NULL,
 216                                "kdc", "pkinit_identity", NULL);
 217     c->pkinit_kdc_anchors =
 218         krb5_config_get_string(context, NULL,
 219                                "kdc", "pkinit_anchors", NULL);
 220     c->pkinit_kdc_cert_pool =
 221         krb5_config_get_strings(context, NULL,
 222                                 "kdc", "pkinit_pool", NULL);
 223     c->pkinit_kdc_revoke =
 224         krb5_config_get_strings(context, NULL,
 225                                 "kdc", "pkinit_revoke", NULL);
 226     c->pkinit_kdc_ocsp_file =
 227         krb5_config_get_string(context, NULL,
 228                                "kdc", "pkinit_kdc_ocsp", NULL);
 229     c->pkinit_kdc_friendly_name =
 230         krb5_config_get_string(context, NULL,
 231                                "kdc", "pkinit_kdc_friendly_name", NULL);
 232     c->pkinit_princ_in_cert =
 233         krb5_config_get_bool_default(context, NULL,
 234                                      c->pkinit_princ_in_cert,
 235                                      "kdc",
 236                                      "pkinit_principal_in_certificate",
 237                                      NULL);
 238     c->pkinit_require_binding =
 239         krb5_config_get_bool_default(context, NULL,
 240                                      c->pkinit_require_binding,
 241                                      "kdc",
 242                                      "pkinit_win2k_require_binding",
 243                                      NULL);
 244     c->pkinit_dh_min_bits =
 245         krb5_config_get_int_default(context, NULL,
 246                                     0,
 247                                     "kdc", "pkinit_dh_min_bits", NULL);
 248
 249     *config = c;
 250
 251     return 0;
 252 }
 253
 254 krb5_error_code
 255 krb5_kdc_pkinit_config(krb5_context context, krb5_kdc_configuration *config)
 256 {
 257 #ifdef PKINIT
 258 #ifdef __APPLE__
 259     config->enable_pkinit = 1;
 260
 261     if (config->pkinit_kdc_identity == NULL) {
 262         if (config->pkinit_kdc_friendly_name == NULL)
 263             config->pkinit_kdc_friendly_name =
 264                 strdup("O=System Identity,CN=com.apple.kerberos.kdc");
 265         config->pkinit_kdc_identity = strdup("KEYCHAIN:");
 266     }
 267     if (config->pkinit_kdc_anchors == NULL)
 268         config->pkinit_kdc_anchors = strdup("KEYCHAIN:");
 269
 270 #endif /* __APPLE__ */
 271
 272     if (config->enable_pkinit) {
 273         if (config->pkinit_kdc_identity == NULL)
 274             krb5_errx(context, 1, "pkinit enabled but no identity");
 275
 276         if (config->pkinit_kdc_anchors == NULL)
 277             krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
 278
 279         krb5_kdc_pk_initialize(context, config,
 280                                config->pkinit_kdc_identity,
 281                                config->pkinit_kdc_anchors,
 282                                config->pkinit_kdc_cert_pool,
 283                                config->pkinit_kdc_revoke);
 284
 285     }
 286
 287     return 0;
 288 #endif /* PKINIT */
 289 }