1 /* $NetBSD: default_config.c,v 1.1.1.1 2011/04/13 18:14:36 elric Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * 3. Neither the name of the Institute nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 #include "kdc_locl.h" 39 #include <krb5/getarg.h> 40 #include <krb5/parse_bytes.h> 41 42 krb5_error_code 43 krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config) 44 { 45 krb5_kdc_configuration *c; 46 47 c = calloc(1, sizeof(*c)); 48 if (c == NULL) { 49 krb5_set_error_message(context, ENOMEM, "malloc: out of memory"); 50 return ENOMEM; 51 } 52 53 c->require_preauth = TRUE; 54 c->kdc_warn_pwexpire = 0; 55 c->encode_as_rep_as_tgs_rep = FALSE; 56 c->check_ticket_addresses = TRUE; 57 c->allow_null_ticket_addresses = TRUE; 58 c->allow_anonymous = FALSE; 59 c->trpolicy = TRPOLICY_ALWAYS_CHECK; 60 c->enable_v4 = FALSE; 61 c->enable_kaserver = FALSE; 62 c->enable_524 = FALSE; 63 c->enable_v4_cross_realm = FALSE; 64 c->enable_pkinit = FALSE; 65 c->pkinit_princ_in_cert = TRUE; 66 c->pkinit_require_binding = TRUE; 67 c->db = NULL; 68 c->num_db = 0; 69 c->logf = NULL; 70 71 c->require_preauth = 72 krb5_config_get_bool_default(context, NULL, 73 c->require_preauth, 74 "kdc", "require-preauth", NULL); 75 c->enable_v4 = 76 krb5_config_get_bool_default(context, NULL, 77 c->enable_v4, 78 "kdc", "enable-kerberos4", NULL); 79 c->enable_v4_cross_realm = 80 krb5_config_get_bool_default(context, NULL, 81 c->enable_v4_cross_realm, 82 "kdc", 83 "enable-kerberos4-cross-realm", NULL); 84 c->enable_524 = 85 krb5_config_get_bool_default(context, NULL, 86 c->enable_v4, 87 "kdc", "enable-524", NULL); 88 #ifdef DIGEST 89 c->enable_digest = 90 krb5_config_get_bool_default(context, NULL, 91 FALSE, 92 "kdc", "enable-digest", NULL); 93 94 { 95 const char *digests; 96 97 digests = krb5_config_get_string(context, NULL, 98 "kdc", 99 "digests_allowed", NULL); 100 if (digests == NULL) 101 digests = "ntlm-v2"; 102 c->digests_allowed = parse_flags(digests,_kdc_digestunits, 0); 103 if (c->digests_allowed == -1) { 104 kdc_log(context, c, 0, 105 "unparsable digest units (%s), turning off digest", 106 digests); 107 c->enable_digest = 0; 108 } else if (c->digests_allowed == 0) { 109 kdc_log(context, c, 0, 110 "no digest enable, turning digest off", 111 digests); 112 c->enable_digest = 0; 113 } 114 } 115 #endif 116 117 #ifdef KX509 118 c->enable_kx509 = 119 krb5_config_get_bool_default(context, NULL, 120 FALSE, 121 "kdc", "enable-kx509", NULL); 122 123 if (c->enable_kx509) { 124 c->kx509_template = 125 krb5_config_get_string(context, NULL, 126 "kdc", "kx509_template", NULL); 127 c->kx509_ca = 128 krb5_config_get_string(context, NULL, 129 "kdc", "kx509_ca", NULL); 130 if (c->kx509_ca == NULL || c->kx509_template == NULL) { 131 kdc_log(context, c, 0, 132 "missing kx509 configuration, turning off"); 133 c->enable_kx509 = FALSE; 134 } 135 } 136 #endif 137 138 c->check_ticket_addresses = 139 krb5_config_get_bool_default(context, NULL, 140 c->check_ticket_addresses, 141 "kdc", 142 "check-ticket-addresses", NULL); 143 c->allow_null_ticket_addresses = 144 krb5_config_get_bool_default(context, NULL, 145 c->allow_null_ticket_addresses, 146 "kdc", 147 "allow-null-ticket-addresses", NULL); 148 149 c->allow_anonymous = 150 krb5_config_get_bool_default(context, NULL, 151 c->allow_anonymous, 152 "kdc", 153 "allow-anonymous", NULL); 154 155 c->max_datagram_reply_length = 156 krb5_config_get_int_default(context, 157 NULL, 158 1400, 159 "kdc", 160 "max-kdc-datagram-reply-length", 161 NULL); 162 163 { 164 const char *trpolicy_str; 165 166 trpolicy_str = 167 krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc", 168 "transited-policy", NULL); 169 if(strcasecmp(trpolicy_str, "always-check") == 0) { 170 c->trpolicy = TRPOLICY_ALWAYS_CHECK; 171 } else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) { 172 c->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL; 173 } else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) { 174 c->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST; 175 } else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) { 176 /* default */ 177 } else { 178 kdc_log(context, c, 0, 179 "unknown transited-policy: %s, " 180 "reverting to default (always-check)", 181 trpolicy_str); 182 } 183 } 184 185 { 186 const char *p; 187 p = krb5_config_get_string (context, NULL, 188 "kdc", 189 "v4-realm", 190 NULL); 191 if(p != NULL) { 192 c->v4_realm = strdup(p); 193 if (c->v4_realm == NULL) 194 krb5_errx(context, 1, "out of memory"); 195 } else { 196 c->v4_realm = NULL; 197 } 198 } 199 200 c->enable_kaserver = 201 krb5_config_get_bool_default(context, 202 NULL, 203 c->enable_kaserver, 204 "kdc", "enable-kaserver", NULL); 205 206 207 c->encode_as_rep_as_tgs_rep = 208 krb5_config_get_bool_default(context, NULL, 209 c->encode_as_rep_as_tgs_rep, 210 "kdc", 211 "encode_as_rep_as_tgs_rep", NULL); 212 213 c->kdc_warn_pwexpire = 214 krb5_config_get_time_default (context, NULL, 215 c->kdc_warn_pwexpire, 216 "kdc", "kdc_warn_pwexpire", NULL); 217 218 219 c->enable_pkinit = 220 krb5_config_get_bool_default(context, 221 NULL, 222 c->enable_pkinit, 223 "kdc", 224 "enable-pkinit", 225 NULL); 226 227 228 c->pkinit_kdc_identity = 229 krb5_config_get_string(context, NULL, 230 "kdc", "pkinit_identity", NULL); 231 c->pkinit_kdc_anchors = 232 krb5_config_get_string(context, NULL, 233 "kdc", "pkinit_anchors", NULL); 234 c->pkinit_kdc_cert_pool = 235 krb5_config_get_strings(context, NULL, 236 "kdc", "pkinit_pool", NULL); 237 c->pkinit_kdc_revoke = 238 krb5_config_get_strings(context, NULL, 239 "kdc", "pkinit_revoke", NULL); 240 c->pkinit_kdc_ocsp_file = 241 krb5_config_get_string(context, NULL, 242 "kdc", "pkinit_kdc_ocsp", NULL); 243 c->pkinit_kdc_friendly_name = 244 krb5_config_get_string(context, NULL, 245 "kdc", "pkinit_kdc_friendly_name", NULL); 246 c->pkinit_princ_in_cert = 247 krb5_config_get_bool_default(context, NULL, 248 c->pkinit_princ_in_cert, 249 "kdc", 250 "pkinit_principal_in_certificate", 251 NULL); 252 c->pkinit_require_binding = 253 krb5_config_get_bool_default(context, NULL, 254 c->pkinit_require_binding, 255 "kdc", 256 "pkinit_win2k_require_binding", 257 NULL); 258 c->pkinit_dh_min_bits = 259 krb5_config_get_int_default(context, NULL, 260 0, 261 "kdc", "pkinit_dh_min_bits", NULL); 262 263 *config = c; 264 265 return 0; 266 } 267 268 krb5_error_code 269 krb5_kdc_pkinit_config(krb5_context context, krb5_kdc_configuration *config) 270 { 271 #ifdef PKINIT 272 #ifdef __APPLE__ 273 config->enable_pkinit = 1; 274 275 if (config->pkinit_kdc_identity == NULL) { 276 if (config->pkinit_kdc_friendly_name == NULL) 277 config->pkinit_kdc_friendly_name = 278 strdup("O=System Identity,CN=com.apple.kerberos.kdc"); 279 config->pkinit_kdc_identity = strdup("KEYCHAIN:"); 280 } 281 if (config->pkinit_kdc_anchors == NULL) 282 config->pkinit_kdc_anchors = strdup("KEYCHAIN:"); 283 284 #endif /* __APPLE__ */ 285 286 if (config->enable_pkinit) { 287 if (config->pkinit_kdc_identity == NULL) 288 krb5_errx(context, 1, "pkinit enabled but no identity"); 289 290 if (config->pkinit_kdc_anchors == NULL) 291 krb5_errx(context, 1, "pkinit enabled but no X509 anchors"); 292 293 krb5_kdc_pk_initialize(context, config, 294 config->pkinit_kdc_identity, 295 config->pkinit_kdc_anchors, 296 config->pkinit_kdc_cert_pool, 297 config->pkinit_kdc_revoke); 298 299 } 300 301 return 0; 302 #endif /* PKINIT */ 303 } 304