crypto/external/bsd/heimdal/dist/kpasswd/kpasswdd.c

   1 /*      $NetBSD: kpasswdd.c,v 1.3 2014/04/24 13:45:34 pettai Exp $      */
   2
   3 /*
   4  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
   5  * (Royal Institute of Technology, Stockholm, Sweden).
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kpasswd_locl.h"
  37 __RCSID("NetBSD");
  38
  39 #include <kadm5/admin.h>
  40 #ifdef HAVE_SYS_UN_H
  41 #include <sys/un.h>
  42 #endif
  43 #include <krb5/hdb.h>
  44 #include <kadm5/private.h>
  45
  46 static krb5_context context;
  47 static krb5_log_facility *log_facility;
  48
  49 static struct getarg_strings addresses_str;
  50 krb5_addresses explicit_addresses;
  51
  52 static sig_atomic_t exit_flag = 0;
  53
  54 static void
  55 add_one_address (const char *str, int first)
  56 {
  57     krb5_error_code ret;
  58     krb5_addresses tmp;
  59
  60     ret = krb5_parse_address (context, str, &tmp);
  61     if (ret)
  62         krb5_err (context, 1, ret, "parse_address `%s'", str);
  63     if (first)
  64         krb5_copy_addresses(context, &tmp, &explicit_addresses);
  65     else
  66         krb5_append_addresses(context, &explicit_addresses, &tmp);
  67     krb5_free_addresses (context, &tmp);
  68 }
  69
  70 static void
  71 send_reply (int s,
  72             struct sockaddr *sa,
  73             int sa_size,
  74             krb5_data *ap_rep,
  75             krb5_data *rest)
  76 {
  77     struct msghdr msghdr;
  78     struct iovec iov[3];
  79     uint16_t len, ap_rep_len;
  80     u_char header[6];
  81     u_char *p;
  82
  83     if (ap_rep)
  84         ap_rep_len = ap_rep->length;
  85     else
  86         ap_rep_len = 0;
  87
  88     len = 6 + ap_rep_len + rest->length;
  89     p = header;
  90     *p++ = (len >> 8) & 0xFF;
  91     *p++ = (len >> 0) & 0xFF;
  92     *p++ = 0;
  93     *p++ = 1;
  94     *p++ = (ap_rep_len >> 8) & 0xFF;
  95     *p++ = (ap_rep_len >> 0) & 0xFF;
  96
  97     memset (&msghdr, 0, sizeof(msghdr));
  98     msghdr.msg_name       = (void *)sa;
  99     msghdr.msg_namelen    = sa_size;
 100     msghdr.msg_iov        = iov;
 101     msghdr.msg_iovlen     = sizeof(iov)/sizeof(*iov);
 102 #if 0
 103     msghdr.msg_control    = NULL;
 104     msghdr.msg_controllen = 0;
 105 #endif
 106
 107     iov[0].iov_base       = (char *)header;
 108     iov[0].iov_len        = 6;
 109     if (ap_rep_len) {
 110         iov[1].iov_base   = ap_rep->data;
 111         iov[1].iov_len    = ap_rep->length;
 112     } else {
 113         iov[1].iov_base   = NULL;
 114         iov[1].iov_len    = 0;
 115     }
 116     iov[2].iov_base       = rest->data;
 117     iov[2].iov_len        = rest->length;
 118
 119     if (sendmsg (s, &msghdr, 0) < 0)
 120         krb5_warn (context, errno, "sendmsg");
 121 }
 122
 123 static int
 124 make_result (krb5_data *data,
 125              uint16_t result_code,
 126              const char *expl)
 127 {
 128     krb5_error_code ret;
 129     krb5_storage *sp;
 130
 131     sp = krb5_storage_emem();
 132     if (sp == NULL) goto out;
 133     ret = krb5_store_uint16(sp, result_code);
 134     if (ret) goto out;
 135     ret = krb5_store_stringz(sp, expl);
 136     if (ret) goto out;
 137     ret = krb5_storage_to_data(sp, data);
 138     if (ret) goto out;
 139     krb5_storage_free(sp);
 140
 141     return 0;
 142  out:
 143     if (sp)
 144         krb5_storage_free(sp);
 145
 146     krb5_warnx (context, "Out of memory generating error reply");
 147     return 1;
 148 }
 149
 150 static void
 151 reply_error (krb5_realm realm,
 152              int s,
 153              struct sockaddr *sa,
 154              int sa_size,
 155              krb5_error_code error_code,
 156              uint16_t result_code,
 157              const char *expl)
 158 {
 159     krb5_error_code ret;
 160     krb5_data error_data;
 161     krb5_data e_data;
 162     krb5_principal server = NULL;
 163
 164     if (make_result(&e_data, result_code, expl))
 165         return;
 166
 167     if (realm) {
 168         ret = krb5_make_principal (context, &server, realm,
 169                                    "kadmin", "changepw", NULL);
 170         if (ret) {
 171             krb5_data_free (&e_data);
 172             return;
 173         }
 174     }
 175
 176     ret = krb5_mk_error (context,
 177                          error_code,
 178                          NULL,
 179                          &e_data,
 180                          NULL,
 181                          server,
 182                          NULL,
 183                          NULL,
 184                          &error_data);
 185     if (server)
 186         krb5_free_principal(context, server);
 187     krb5_data_free (&e_data);
 188     if (ret) {
 189         krb5_warn (context, ret, "Could not even generate error reply");
 190         return;
 191     }
 192     send_reply (s, sa, sa_size, NULL, &error_data);
 193     krb5_data_free (&error_data);
 194 }
 195
 196 static void
 197 reply_priv (krb5_auth_context auth_context,
 198             int s,
 199             struct sockaddr *sa,
 200             int sa_size,
 201             uint16_t result_code,
 202             const char *expl)
 203 {
 204     krb5_error_code ret;
 205     krb5_data krb_priv_data;
 206     krb5_data ap_rep_data;
 207     krb5_data e_data;
 208
 209     ret = krb5_mk_rep (context,
 210                        auth_context,
 211                        &ap_rep_data);
 212     if (ret) {
 213         krb5_warn (context, ret, "Could not even generate error reply");
 214         return;
 215     }
 216
 217     if (make_result(&e_data, result_code, expl))
 218         return;
 219
 220     ret = krb5_mk_priv (context,
 221                         auth_context,
 222                         &e_data,
 223                         &krb_priv_data,
 224                         NULL);
 225     krb5_data_free (&e_data);
 226     if (ret) {
 227         krb5_warn (context, ret, "Could not even generate error reply");
 228         return;
 229     }
 230     send_reply (s, sa, sa_size, &ap_rep_data, &krb_priv_data);
 231     krb5_data_free (&ap_rep_data);
 232     krb5_data_free (&krb_priv_data);
 233 }
 234
 235 /*
 236  * Change the password for `principal', sending the reply back on `s'
 237  * (`sa', `sa_size') to `pwd_data'.
 238  */
 239
 240 static void
 241 change (krb5_auth_context auth_context,
 242         krb5_principal admin_principal,
 243         uint16_t version,
 244         int s,
 245         struct sockaddr *sa,
 246         int sa_size,
 247         krb5_data *in_data)
 248 {
 249     krb5_error_code ret;
 250     char *client = NULL, *admin = NULL;
 251     const char *pwd_reason;
 252     kadm5_config_params conf;
 253     void *kadm5_handle = NULL;
 254     krb5_principal principal = NULL;
 255     krb5_data *pwd_data = NULL;
 256     char *tmp;
 257     ChangePasswdDataMS chpw;
 258
 259     memset (&conf, 0, sizeof(conf));
 260     memset(&chpw, 0, sizeof(chpw));
 261
 262     if (version == KRB5_KPASSWD_VERS_CHANGEPW) {
 263         ret = krb5_copy_data(context, in_data, &pwd_data);
 264         if (ret) {
 265             krb5_warn (context, ret, "krb5_copy_data");
 266             reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
 267                         "out out memory copying password");
 268             return;
 269         }
 270         principal = admin_principal;
 271     } else if (version == KRB5_KPASSWD_VERS_SETPW) {
 272         size_t len;
 273
 274         ret = decode_ChangePasswdDataMS(in_data->data, in_data->length,
 275                                         &chpw, &len);
 276         if (ret) {
 277             krb5_warn (context, ret, "decode_ChangePasswdDataMS");
 278             reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
 279                         "malformed ChangePasswdData");
 280             return;
 281         }
 282
 283
 284         ret = krb5_copy_data(context, &chpw.newpasswd, &pwd_data);
 285         if (ret) {
 286             krb5_warn (context, ret, "krb5_copy_data");
 287             reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
 288                         "out out memory copying password");
 289             goto out;
 290         }
 291
 292         if (chpw.targname == NULL && chpw.targrealm != NULL) {
 293             krb5_warn (context, ret, "kadm5_init_with_password_ctx");
 294             reply_priv (auth_context, s, sa, sa_size,
 295                         KRB5_KPASSWD_MALFORMED,
 296                         "targrealm but not targname");
 297             goto out;
 298         }
 299
 300         if (chpw.targname) {
 301             krb5_principal_data princ;
 302
 303             princ.name = *chpw.targname;
 304             princ.realm = *chpw.targrealm;
 305             if (princ.realm == NULL) {
 306                 ret = krb5_get_default_realm(context, &princ.realm);
 307
 308                 if (ret) {
 309                     krb5_warnx (context,
 310                                 "kadm5_init_with_password_ctx: "
 311                                 "failed to allocate realm");
 312                     reply_priv (auth_context, s, sa, sa_size,
 313                                 KRB5_KPASSWD_SOFTERROR,
 314                                 "failed to allocate realm");
 315                     goto out;
 316                 }
 317             }
 318             ret = krb5_copy_principal(context, &princ, &principal);
 319             if (*chpw.targrealm == NULL)
 320                 free(princ.realm);
 321             if (ret) {
 322                 krb5_warn(context, ret, "krb5_copy_principal");
 323                 reply_priv(auth_context, s, sa, sa_size,
 324                            KRB5_KPASSWD_HARDERROR,
 325                            "failed to allocate principal");
 326                 goto out;
 327             }
 328         } else
 329             principal = admin_principal;
 330     } else {
 331         krb5_warnx (context, "kadm5_init_with_password_ctx: unknown proto");
 332         reply_priv (auth_context, s, sa, sa_size,
 333                     KRB5_KPASSWD_HARDERROR,
 334                     "Unknown protocol used");
 335         return;
 336     }
 337
 338     ret = krb5_unparse_name (context, admin_principal, &admin);
 339     if (ret) {
 340         krb5_warn (context, ret, "unparse_name failed");
 341         reply_priv (auth_context, s, sa, sa_size,
 342                     KRB5_KPASSWD_HARDERROR, "out of memory error");
 343         goto out;
 344     }
 345
 346     conf.realm = principal->realm;
 347     conf.mask |= KADM5_CONFIG_REALM;
 348
 349     ret = kadm5_init_with_password_ctx(context,
 350                                        admin,
 351                                        NULL,
 352                                        KADM5_ADMIN_SERVICE,
 353                                        &conf, 0, 0,
 354                                        &kadm5_handle);
 355     if (ret) {
 356         krb5_warn (context, ret, "kadm5_init_with_password_ctx");
 357         reply_priv (auth_context, s, sa, sa_size, 2,
 358                     "Internal error");
 359         goto out;
 360     }
 361
 362     ret = krb5_unparse_name(context, principal, &client);
 363     if (ret) {
 364         krb5_warn (context, ret, "unparse_name failed");
 365         reply_priv (auth_context, s, sa, sa_size,
 366                     KRB5_KPASSWD_HARDERROR, "out of memory error");
 367         goto out;
 368     }
 369
 370     /*
 371      * Check password quality if not changing as administrator
 372      */
 373
 374     if (krb5_principal_compare(context, admin_principal, principal) == TRUE) {
 375
 376         pwd_reason = kadm5_check_password_quality (context, principal,
 377                                                    pwd_data);
 378         if (pwd_reason != NULL ) {
 379             krb5_warnx (context,
 380                         "%s didn't pass password quality check with error: %s",
 381                         client, pwd_reason);
 382             reply_priv (auth_context, s, sa, sa_size,
 383                         KRB5_KPASSWD_SOFTERROR, pwd_reason);
 384             goto out;
 385         }
 386         krb5_warnx (context, "Changing password for %s", client);
 387     } else {
 388         ret = _kadm5_acl_check_permission(kadm5_handle, KADM5_PRIV_CPW,
 389                                           principal);
 390         if (ret) {
 391             krb5_warn (context, ret,
 392                        "Check ACL failed for %s for changing %s password",
 393                        admin, client);
 394             reply_priv (auth_context, s, sa, sa_size,
 395                         KRB5_KPASSWD_HARDERROR, "permission denied");
 396             goto out;
 397         }
 398         krb5_warnx (context, "%s is changing password for %s", admin, client);
 399     }
 400
 401     ret = krb5_data_realloc(pwd_data, pwd_data->length + 1);
 402     if (ret) {
 403         krb5_warn (context, ret, "malloc: out of memory");
 404         reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_HARDERROR,
 405                     "Internal error");
 406         goto out;
 407     }
 408     tmp = pwd_data->data;
 409     tmp[pwd_data->length - 1] = '\0';
 410
 411     ret = kadm5_s_chpass_principal_cond (kadm5_handle, principal, tmp);
 412     krb5_free_data (context, pwd_data);
 413     pwd_data = NULL;
 414     if (ret) {
 415         const char *str = krb5_get_error_message(context, ret);
 416         krb5_warnx(context, "kadm5_s_chpass_principal_cond: %s", str);
 417         reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SOFTERROR,
 418                     str ? str : "Internal error");
 419         krb5_free_error_message(context, str);
 420         goto out;
 421     }
 422     reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SUCCESS,
 423                 "Password changed");
 424 out:
 425     free_ChangePasswdDataMS(&chpw);
 426     if (principal != admin_principal)
 427         krb5_free_principal(context, principal);
 428     if (admin)
 429         free(admin);
 430     if (client)
 431         free(client);
 432     if (pwd_data)
 433         krb5_free_data(context, pwd_data);
 434     if (kadm5_handle)
 435         kadm5_destroy (kadm5_handle);
 436 }
 437
 438 static int
 439 verify (krb5_auth_context *auth_context,
 440         krb5_realm *realms,
 441         krb5_keytab keytab,
 442         krb5_ticket **ticket,
 443         krb5_data *out_data,
 444         uint16_t *version,
 445         int s,
 446         struct sockaddr *sa,
 447         int sa_size,
 448         u_char *msg,
 449         size_t len,
 450         krb5_address *client_addr)
 451 {
 452     krb5_error_code ret;
 453     uint16_t pkt_len, pkt_ver, ap_req_len;
 454     krb5_data ap_req_data;
 455     krb5_data krb_priv_data;
 456     krb5_realm *r;
 457
 458     /*
 459      * Only send an error reply if the request passes basic length
 460      * verification.  Otherwise, kpasswdd would reply to every UDP packet,
 461      * allowing an attacker to set up a ping-pong DoS attack via a spoofed UDP
 462      * packet with a source address of another UDP service that also replies
 463      * to every packet.
 464      *
 465      * Also suppress the error reply if ap_req_len is 0, which indicates
 466      * either an invalid request or an error packet.  An error packet may be
 467      * the result of a ping-pong attacker pointing us at another kpasswdd.
 468      */
 469     pkt_len = (msg[0] << 8) | (msg[1]);
 470     pkt_ver = (msg[2] << 8) | (msg[3]);
 471     ap_req_len = (msg[4] << 8) | (msg[5]);
 472     if (pkt_len != len) {
 473         krb5_warnx (context, "Strange len: %ld != %ld",
 474                     (long)pkt_len, (long)len);
 475         return 1;
 476     }
 477     if (ap_req_len == 0) {
 478         krb5_warnx (context, "Request is error packet (ap_req_len == 0)");
 479         return 1;
 480     }
 481     if (pkt_ver != KRB5_KPASSWD_VERS_CHANGEPW &&
 482         pkt_ver != KRB5_KPASSWD_VERS_SETPW) {
 483         krb5_warnx (context, "Bad version (%d)", pkt_ver);
 484         reply_error (NULL, s, sa, sa_size, 0, 1, "Wrong program version");
 485         return 1;
 486     }
 487     *version = pkt_ver;
 488
 489     ap_req_data.data   = msg + 6;
 490     ap_req_data.length = ap_req_len;
 491
 492     ret = krb5_rd_req (context,
 493                        auth_context,
 494                        &ap_req_data,
 495                        NULL,
 496                        keytab,
 497                        NULL,
 498                        ticket);
 499     if (ret) {
 500         krb5_warn (context, ret, "krb5_rd_req");
 501         reply_error (NULL, s, sa, sa_size, ret, 3, "Authentication failed");
 502         return 1;
 503     }
 504
 505     /* verify realm and principal */
 506     for (r = realms; *r != NULL; r++) {
 507         krb5_principal principal;
 508         krb5_boolean same;
 509
 510         ret = krb5_make_principal (context,
 511                                    &principal,
 512                                    *r,
 513                                    "kadmin",
 514                                    "changepw",
 515                                    NULL);
 516         if (ret)
 517             krb5_err (context, 1, ret, "krb5_make_principal");
 518
 519         same = krb5_principal_compare(context, principal, (*ticket)->server);
 520         krb5_free_principal(context, principal);
 521         if (same == TRUE)
 522             break;
 523     }
 524     if (*r == NULL) {
 525         char *str;
 526         krb5_unparse_name(context, (*ticket)->server, &str);
 527         krb5_warnx (context, "client used not valid principal %s", str);
 528         free(str);
 529         reply_error (NULL, s, sa, sa_size, ret, 1,
 530                      "Bad request");
 531         goto out;
 532     }
 533
 534     if (strcmp((*ticket)->server->realm, (*ticket)->client->realm) != 0) {
 535         krb5_warnx (context, "server realm (%s) not same a client realm (%s)",
 536                     (*ticket)->server->realm, (*ticket)->client->realm);
 537         reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 1,
 538                      "Bad request");
 539         goto out;
 540     }
 541
 542     if (!(*ticket)->ticket.flags.initial) {
 543         krb5_warnx (context, "initial flag not set");
 544         reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 1,
 545                      "Bad request");
 546         goto out;
 547     }
 548     krb_priv_data.data   = msg + 6 + ap_req_len;
 549     krb_priv_data.length = len - 6 - ap_req_len;
 550
 551     /*
 552      * Only enforce client addresses on on tickets with addresses.  If
 553      * its addressless, we are guessing its behind NAT and really
 554      * can't know this information.
 555      */
 556
 557     if ((*ticket)->ticket.caddr && (*ticket)->ticket.caddr->len > 0) {
 558         ret = krb5_auth_con_setaddrs (context, *auth_context,
 559                                       NULL, client_addr);
 560         if (ret) {
 561             krb5_warn (context, ret, "krb5_auth_con_setaddr(this)");
 562             goto out;
 563         }
 564     }
 565
 566     ret = krb5_rd_priv (context,
 567                         *auth_context,
 568                         &krb_priv_data,
 569                         out_data,
 570                         NULL);
 571
 572     if (ret) {
 573         krb5_warn (context, ret, "krb5_rd_priv");
 574         reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 3,
 575                      "Bad request");
 576         goto out;
 577     }
 578     return 0;
 579 out:
 580     krb5_free_ticket (context, *ticket);
 581     ticket = NULL;
 582     return 1;
 583 }
 584
 585 static void
 586 process (krb5_realm *realms,
 587          krb5_keytab keytab,
 588          int s,
 589          krb5_address *this_addr,
 590          struct sockaddr *sa,
 591          int sa_size,
 592          u_char *msg,
 593          int len)
 594 {
 595     krb5_error_code ret;
 596     krb5_auth_context auth_context = NULL;
 597     krb5_data out_data;
 598     krb5_ticket *ticket;
 599     krb5_address other_addr;
 600     uint16_t version;
 601
 602     memset(&other_addr, 0, sizeof(other_addr));
 603     krb5_data_zero (&out_data);
 604
 605     ret = krb5_auth_con_init (context, &auth_context);
 606     if (ret) {
 607         krb5_warn (context, ret, "krb5_auth_con_init");
 608         return;
 609     }
 610
 611     krb5_auth_con_setflags (context, auth_context,
 612                             KRB5_AUTH_CONTEXT_DO_SEQUENCE);
 613
 614     ret = krb5_sockaddr2address (context, sa, &other_addr);
 615     if (ret) {
 616         krb5_warn (context, ret, "krb5_sockaddr2address");
 617         goto out;
 618     }
 619
 620     ret = krb5_auth_con_setaddrs (context, auth_context, this_addr, NULL);
 621     if (ret) {
 622         krb5_warn (context, ret, "krb5_auth_con_setaddr(this)");
 623         goto out;
 624     }
 625
 626     if (verify (&auth_context, realms, keytab, &ticket, &out_data,
 627                 &version, s, sa, sa_size, msg, len, &other_addr) == 0)
 628     {
 629         /*
 630          * We always set the client_addr, to assume that the client
 631          * can ignore it if it choose to do so (just the server does
 632          * so for addressless tickets).
 633          */
 634         ret = krb5_auth_con_setaddrs (context, auth_context,
 635                                       this_addr, &other_addr);
 636         if (ret) {
 637             krb5_warn (context, ret, "krb5_auth_con_setaddr(other)");
 638             goto out;
 639         }
 640
 641         change (auth_context,
 642                 ticket->client,
 643                 version,
 644                 s,
 645                 sa, sa_size,
 646                 &out_data);
 647         memset (out_data.data, 0, out_data.length);
 648         krb5_free_ticket (context, ticket);
 649     }
 650
 651 out:
 652     krb5_free_address(context, &other_addr);
 653     krb5_data_free(&out_data);
 654     krb5_auth_con_free(context, auth_context);
 655 }
 656
 657 #ifdef INETD_SUPPORT
 658 /*
 659  * XXX this code relies on getsockname() returning a valid local
 660  * address for a "connected" DGRAM socket. This is true for most, but
 661  * probably not all systems. For some systems, this could be done
 662  * cleaner by using the IP_RECVDSTADDR option + recvmsg().
 663  */
 664 static int
 665 get_local_addr(struct sockaddr *remote, int remlen,
 666                struct sockaddr *local, socklen_t *loclen)
 667 {
 668         int s, ret;
 669
 670         s = socket(remote->sa_family, SOCK_DGRAM, 0);
 671         if (s < 0)
 672                 return -1;
 673
 674         if (connect(s, remote, remlen) < 0) {
 675                 close(s);
 676                 return -1;
 677         }
 678
 679         ret = getsockname(s, local, loclen);
 680         close(s);
 681         return ret;
 682 }
 683 #endif
 684
 685 static int
 686 doit (krb5_keytab keytab, int port)
 687 {
 688     krb5_error_code ret;
 689     int *sockets;
 690     int maxfd;
 691     krb5_realm *realms;
 692     krb5_addresses addrs;
 693     krb5_address *my_addrp;
 694     unsigned n, i;
 695     fd_set real_fdset;
 696     struct sockaddr_storage __ss;
 697     struct sockaddr *sa = (struct sockaddr *)&__ss;
 698 #ifdef INETD_SUPPORT
 699     int fdz;
 700     int from_inetd;
 701     socklen_t fromlen;
 702     krb5_address my_addr;
 703     struct sockaddr_storage __local;
 704     struct sockaddr *localsa = (struct sockaddr *)&__local;
 705 #endif
 706
 707     ret = krb5_get_default_realms(context, &realms);
 708     if (ret)
 709         krb5_err (context, 1, ret, "krb5_get_default_realms");
 710
 711 #ifdef INETD_SUPPORT
 712     fromlen = sizeof __ss;
 713     from_inetd = (getsockname(0, sa, &fromlen) == 0);
 714
 715     if (!from_inetd) {
 716 #endif
 717     if (explicit_addresses.len) {
 718         addrs = explicit_addresses;
 719     } else {
 720         ret = krb5_get_all_server_addrs (context, &addrs);
 721         if (ret)
 722             krb5_err (context, 1, ret, "krb5_get_all_server_addrs");
 723     }
 724     n = addrs.len;
 725
 726     sockets = malloc (n * sizeof(*sockets));
 727     if (sockets == NULL)
 728         krb5_errx (context, 1, "out of memory");
 729     maxfd = -1;
 730     FD_ZERO(&real_fdset);
 731     for (i = 0; i < n; ++i) {
 732         krb5_socklen_t sa_size = sizeof(__ss);
 733
 734         krb5_addr2sockaddr (context, &addrs.val[i], sa, &sa_size, port);
 735
 736         sockets[i] = socket (sa->sa_family, SOCK_DGRAM, 0);
 737         if (sockets[i] < 0)
 738             krb5_err (context, 1, errno, "socket");
 739         if (bind (sockets[i], sa, sa_size) < 0) {
 740             char str[128];
 741             size_t len;
 742             int save_errno = errno;
 743
 744             ret = krb5_print_address (&addrs.val[i], str, sizeof(str), &len);
 745             if (ret)
 746                 strlcpy(str, "unknown address", sizeof(str));
 747             krb5_warn (context, save_errno, "bind(%s)", str);
 748             continue;
 749         }
 750         maxfd = max (maxfd, sockets[i]);
 751         if (maxfd >= FD_SETSIZE)
 752             krb5_errx (context, 1, "fd too large");
 753         FD_SET(sockets[i], &real_fdset);
 754     }
 755 #ifdef INETD_SUPPORT
 756     } else {
 757         n = 1;
 758         maxfd = 0;
 759         fdz = 0;
 760         sockets = &fdz;
 761         FD_ZERO(&real_fdset);
 762         FD_SET(0, &real_fdset);
 763     }
 764 #endif
 765     if (maxfd == -1)
 766         krb5_errx (context, 1, "No sockets!");
 767
 768     while(exit_flag == 0) {
 769         krb5_ssize_t retx;
 770         fd_set fdset = real_fdset;
 771
 772         retx = select (maxfd + 1, &fdset, NULL, NULL, NULL);
 773         if (retx < 0) {
 774             if (errno == EINTR)
 775                 continue;
 776             else
 777                 krb5_err (context, 1, errno, "select");
 778         }
 779         for (i = 0; i < n; ++i)
 780             if (FD_ISSET(sockets[i], &fdset)) {
 781                 u_char buf[BUFSIZ];
 782                 socklen_t addrlen = sizeof(__ss);
 783
 784                 retx = recvfrom(sockets[i], buf, sizeof(buf), 0,
 785                                 sa, &addrlen);
 786                 if (retx < 0) {
 787                     if(errno == EINTR)
 788                         break;
 789                     else
 790                         krb5_err (context, 1, errno, "recvfrom");
 791                 }
 792 #ifdef INETD_SUPPORT
 793                 if (from_inetd) {
 794                         socklen_t loclen = sizeof(__local);
 795                         int ret2;
 796
 797                         ret2 = get_local_addr(sa, addrlen, localsa, &loclen);
 798                         if (ret2 < 0)
 799                                 krb5_errx (context, errno, "get_local_addr");
 800                         ret2 = krb5_sockaddr2address(context, localsa,
 801                             &my_addr);
 802                         if (ret2)
 803                                 krb5_errx (context, ret2,
 804                                     "krb5_sockaddr2address");
 805                         my_addrp = &my_addr;
 806                 } else
 807 #endif
 808                 my_addrp = &addrs.val[i];
 809
 810                 process (realms, keytab, sockets[i],
 811                          my_addrp,
 812                          sa, addrlen,
 813                          buf, retx);
 814 #ifdef INETD_SUPPORT
 815                 if (from_inetd) {
 816                     krb5_free_address(context, &my_addr);
 817                 }
 818 #endif
 819             }
 820 #ifdef INETD_SUPPORT
 821         if (from_inetd)
 822             break;
 823 #endif
 824     }
 825
 826     for (i = 0; i < n; ++i)
 827         close(sockets[i]);
 828     free(sockets);
 829
 830 #ifdef INETD_SUPPORT
 831     if (!from_inetd)
 832 #endif
 833         krb5_free_addresses (context, &addrs);
 834     krb5_free_host_realm (context, realms);
 835     krb5_free_context (context);
 836     return 0;
 837 }
 838
 839 static RETSIGTYPE
 840 sigterm(int sig)
 841 {
 842     exit_flag = 1;
 843 }
 844
 845 static const char *check_library  = NULL;
 846 static const char *check_function = NULL;
 847 static getarg_strings policy_libraries = { 0, NULL };
 848 static char sHDB[] = "HDB:";
 849 static char *keytab_str = sHDB;
 850 static char *realm_str;
 851 static int version_flag;
 852 static int help_flag;
 853 static char *port_str;
 854 static char *config_file;
 855
 856 struct getargs args[] = {
 857 #ifdef HAVE_DLOPEN
 858     { "check-library", 0, arg_string, &check_library,
 859       "library to load password check function from", "library" },
 860     { "check-function", 0, arg_string, &check_function,
 861       "password check function to load", "function" },
 862     { "policy-libraries", 0, arg_strings, &policy_libraries,
 863       "password check function to load", "function" },
 864 #endif
 865     { "addresses",      0,      arg_strings, &addresses_str,
 866       "addresses to listen on", "list of addresses" },
 867     { "keytab", 'k', arg_string, &keytab_str,
 868       "keytab to get authentication key from", "kspec" },
 869     { "config-file", 'c', arg_string, &config_file, NULL, NULL },
 870     { "realm", 'r', arg_string, &realm_str, "default realm", "realm" },
 871     { "port",  'p', arg_string, &port_str, "port", NULL },
 872     { "version", 0, arg_flag, &version_flag, NULL, NULL },
 873     { "help", 0, arg_flag, &help_flag, NULL, NULL }
 874 };
 875 int num_args = sizeof(args) / sizeof(args[0]);
 876
 877 int
 878 main (int argc, char **argv)
 879 {
 880     krb5_keytab keytab;
 881     krb5_error_code ret;
 882     char **files;
 883     int port, i;
 884
 885     krb5_program_setup(&context, argc, argv, args, num_args, NULL);
 886
 887     if(help_flag)
 888         krb5_std_usage(0, args, num_args);
 889     if(version_flag) {
 890         print_version(NULL);
 891         exit(0);
 892     }
 893
 894     if (config_file == NULL) {
 895         asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
 896         if (config_file == NULL)
 897             errx(1, "out of memory");
 898     }
 899
 900     ret = krb5_prepend_config_files_default(config_file, &files);
 901     if (ret)
 902         krb5_err(context, 1, ret, "getting configuration files");
 903
 904     ret = krb5_set_config_files(context, files);
 905     krb5_free_config_files(files);
 906     if (ret)
 907         krb5_err(context, 1, ret, "reading configuration files");
 908
 909     if(realm_str)
 910         krb5_set_default_realm(context, realm_str);
 911
 912     krb5_openlog (context, "kpasswdd", &log_facility);
 913     krb5_set_warn_dest(context, log_facility);
 914
 915     if (port_str != NULL) {
 916         struct servent *s = roken_getservbyname (port_str, "udp");
 917
 918         if (s != NULL)
 919             port = s->s_port;
 920         else {
 921             char *ptr;
 922
 923             port = strtol (port_str, &ptr, 10);
 924             if (port == 0 && ptr == port_str)
 925                 krb5_errx (context, 1, "bad port `%s'", port_str);
 926             port = htons(port);
 927         }
 928     } else
 929         port = krb5_getportbyname (context, "kpasswd", "udp", KPASSWD_PORT);
 930
 931     ret = krb5_kt_register(context, &hdb_kt_ops);
 932     if(ret)
 933         krb5_err(context, 1, ret, "krb5_kt_register");
 934
 935     ret = krb5_kt_resolve(context, keytab_str, &keytab);
 936     if(ret)
 937         krb5_err(context, 1, ret, "%s", keytab_str);
 938
 939     kadm5_setup_passwd_quality_check (context, check_library, check_function);
 940
 941     for (i = 0; i < policy_libraries.num_strings; i++) {
 942         ret = kadm5_add_passwd_quality_verifier(context,
 943                                                 policy_libraries.strings[i]);
 944         if (ret)
 945             krb5_err(context, 1, ret, "kadm5_add_passwd_quality_verifier");
 946     }
 947     ret = kadm5_add_passwd_quality_verifier(context, NULL);
 948     if (ret)
 949         krb5_err(context, 1, ret, "kadm5_add_passwd_quality_verifier");
 950
 951
 952     explicit_addresses.len = 0;
 953
 954     if (addresses_str.num_strings) {
 955         int j;
 956
 957         for (j = 0; j < addresses_str.num_strings; ++j)
 958             add_one_address (addresses_str.strings[j], j == 0);
 959         free_getarg_strings (&addresses_str);
 960     } else {
 961         char **foo = krb5_config_get_strings (context, NULL,
 962                                               "kdc", "addresses", NULL);
 963
 964         if (foo != NULL) {
 965             add_one_address (*foo++, TRUE);
 966             while (*foo)
 967                 add_one_address (*foo++, FALSE);
 968         }
 969     }
 970
 971 #ifdef HAVE_SIGACTION
 972     {
 973         struct sigaction sa;
 974
 975         sa.sa_flags = 0;
 976         sa.sa_handler = sigterm;
 977         sigemptyset(&sa.sa_mask);
 978
 979         sigaction(SIGINT,  &sa, NULL);
 980         sigaction(SIGTERM, &sa, NULL);
 981     }
 982 #else
 983     signal(SIGINT,  sigterm);
 984     signal(SIGTERM, sigterm);
 985 #endif
 986
 987     pidfile(NULL);
 988
 989     return doit (keytab, port);
 990 }