1 /*	$NetBSD: default_config.c,v 1.1.1.1 2011/04/13 18:14:36 elric Exp $	*/
2 
3 /*
4  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
5  * (Royal Institute of Technology, Stockholm, Sweden).
6  * All rights reserved.
7  *
8  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  *
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * 3. Neither the name of the Institute nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 #include "kdc_locl.h"
39 #include <krb5/getarg.h>
40 #include <krb5/parse_bytes.h>
41 
42 krb5_error_code
43 krb5_kdc_get_config(krb5_context context, krb5_kdc_configuration **config)
44 {
45     krb5_kdc_configuration *c;
46 
47     c = calloc(1, sizeof(*c));
48     if (c == NULL) {
49 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
50 	return ENOMEM;
51     }
52 
53     c->require_preauth = TRUE;
54     c->kdc_warn_pwexpire = 0;
55     c->encode_as_rep_as_tgs_rep = FALSE;
56     c->check_ticket_addresses = TRUE;
57     c->allow_null_ticket_addresses = TRUE;
58     c->allow_anonymous = FALSE;
59     c->trpolicy = TRPOLICY_ALWAYS_CHECK;
60     c->enable_v4 = FALSE;
61     c->enable_kaserver = FALSE;
62     c->enable_524 = FALSE;
63     c->enable_v4_cross_realm = FALSE;
64     c->enable_pkinit = FALSE;
65     c->pkinit_princ_in_cert = TRUE;
66     c->pkinit_require_binding = TRUE;
67     c->db = NULL;
68     c->num_db = 0;
69     c->logf = NULL;
70 
71     c->require_preauth =
72 	krb5_config_get_bool_default(context, NULL,
73 				     c->require_preauth,
74 				     "kdc", "require-preauth", NULL);
75     c->enable_v4 =
76 	krb5_config_get_bool_default(context, NULL,
77 				     c->enable_v4,
78 				     "kdc", "enable-kerberos4", NULL);
79     c->enable_v4_cross_realm =
80 	krb5_config_get_bool_default(context, NULL,
81 				     c->enable_v4_cross_realm,
82 				     "kdc",
83 				     "enable-kerberos4-cross-realm", NULL);
84     c->enable_524 =
85 	krb5_config_get_bool_default(context, NULL,
86 				     c->enable_v4,
87 				     "kdc", "enable-524", NULL);
88 #ifdef DIGEST
89     c->enable_digest =
90 	krb5_config_get_bool_default(context, NULL,
91 				     FALSE,
92 				     "kdc", "enable-digest", NULL);
93 
94     {
95 	const char *digests;
96 
97 	digests = krb5_config_get_string(context, NULL,
98 					 "kdc",
99 					 "digests_allowed", NULL);
100 	if (digests == NULL)
101 	    digests = "ntlm-v2";
102 	c->digests_allowed = parse_flags(digests,_kdc_digestunits, 0);
103 	if (c->digests_allowed == -1) {
104 	    kdc_log(context, c, 0,
105 		    "unparsable digest units (%s), turning off digest",
106 		    digests);
107 	    c->enable_digest = 0;
108 	} else if (c->digests_allowed == 0) {
109 	    kdc_log(context, c, 0,
110 		    "no digest enable, turning digest off",
111 		    digests);
112 	    c->enable_digest = 0;
113 	}
114     }
115 #endif
116 
117 #ifdef KX509
118     c->enable_kx509 =
119 	krb5_config_get_bool_default(context, NULL,
120 				     FALSE,
121 				     "kdc", "enable-kx509", NULL);
122 
123     if (c->enable_kx509) {
124 	c->kx509_template =
125 	    krb5_config_get_string(context, NULL,
126 				   "kdc", "kx509_template", NULL);
127 	c->kx509_ca =
128 	    krb5_config_get_string(context, NULL,
129 				   "kdc", "kx509_ca", NULL);
130 	if (c->kx509_ca == NULL || c->kx509_template == NULL) {
131 	    kdc_log(context, c, 0,
132 		    "missing kx509 configuration, turning off");
133 	    c->enable_kx509 = FALSE;
134 	}
135     }
136 #endif
137 
138     c->check_ticket_addresses =
139 	krb5_config_get_bool_default(context, NULL,
140 				     c->check_ticket_addresses,
141 				     "kdc",
142 				     "check-ticket-addresses", NULL);
143     c->allow_null_ticket_addresses =
144 	krb5_config_get_bool_default(context, NULL,
145 				     c->allow_null_ticket_addresses,
146 				     "kdc",
147 				     "allow-null-ticket-addresses", NULL);
148 
149     c->allow_anonymous =
150 	krb5_config_get_bool_default(context, NULL,
151 				     c->allow_anonymous,
152 				     "kdc",
153 				     "allow-anonymous", NULL);
154 
155     c->max_datagram_reply_length =
156 	krb5_config_get_int_default(context,
157 				    NULL,
158 				    1400,
159 				    "kdc",
160 				    "max-kdc-datagram-reply-length",
161 				    NULL);
162 
163     {
164 	const char *trpolicy_str;
165 
166 	trpolicy_str =
167 	    krb5_config_get_string_default(context, NULL, "DEFAULT", "kdc",
168 					   "transited-policy", NULL);
169 	if(strcasecmp(trpolicy_str, "always-check") == 0) {
170 	    c->trpolicy = TRPOLICY_ALWAYS_CHECK;
171 	} else if(strcasecmp(trpolicy_str, "allow-per-principal") == 0) {
172 	    c->trpolicy = TRPOLICY_ALLOW_PER_PRINCIPAL;
173 	} else if(strcasecmp(trpolicy_str, "always-honour-request") == 0) {
174 	    c->trpolicy = TRPOLICY_ALWAYS_HONOUR_REQUEST;
175 	} else if(strcasecmp(trpolicy_str, "DEFAULT") == 0) {
176 	    /* default */
177 	} else {
178 	    kdc_log(context, c, 0,
179 		    "unknown transited-policy: %s, "
180 		    "reverting to default (always-check)",
181 		    trpolicy_str);
182 	}
183     }
184 
185     {
186 	const char *p;
187 	p = krb5_config_get_string (context, NULL,
188 				    "kdc",
189 				    "v4-realm",
190 				    NULL);
191 	if(p != NULL) {
192 	    c->v4_realm = strdup(p);
193 	    if (c->v4_realm == NULL)
194 		krb5_errx(context, 1, "out of memory");
195 	} else {
196 	    c->v4_realm = NULL;
197 	}
198     }
199 
200     c->enable_kaserver =
201 	krb5_config_get_bool_default(context,
202 				     NULL,
203 				     c->enable_kaserver,
204 				     "kdc", "enable-kaserver", NULL);
205 
206 
207     c->encode_as_rep_as_tgs_rep =
208 	krb5_config_get_bool_default(context, NULL,
209 				     c->encode_as_rep_as_tgs_rep,
210 				     "kdc",
211 				     "encode_as_rep_as_tgs_rep", NULL);
212 
213     c->kdc_warn_pwexpire =
214 	krb5_config_get_time_default (context, NULL,
215 				      c->kdc_warn_pwexpire,
216 				      "kdc", "kdc_warn_pwexpire", NULL);
217 
218 
219     c->enable_pkinit =
220 	krb5_config_get_bool_default(context,
221 				     NULL,
222 				     c->enable_pkinit,
223 				     "kdc",
224 				     "enable-pkinit",
225 				     NULL);
226 
227 
228     c->pkinit_kdc_identity =
229 	krb5_config_get_string(context, NULL,
230 			       "kdc", "pkinit_identity", NULL);
231     c->pkinit_kdc_anchors =
232 	krb5_config_get_string(context, NULL,
233 			       "kdc", "pkinit_anchors", NULL);
234     c->pkinit_kdc_cert_pool =
235 	krb5_config_get_strings(context, NULL,
236 				"kdc", "pkinit_pool", NULL);
237     c->pkinit_kdc_revoke =
238 	krb5_config_get_strings(context, NULL,
239 				"kdc", "pkinit_revoke", NULL);
240     c->pkinit_kdc_ocsp_file =
241 	krb5_config_get_string(context, NULL,
242 			       "kdc", "pkinit_kdc_ocsp", NULL);
243     c->pkinit_kdc_friendly_name =
244 	krb5_config_get_string(context, NULL,
245 			       "kdc", "pkinit_kdc_friendly_name", NULL);
246     c->pkinit_princ_in_cert =
247 	krb5_config_get_bool_default(context, NULL,
248 				     c->pkinit_princ_in_cert,
249 				     "kdc",
250 				     "pkinit_principal_in_certificate",
251 				     NULL);
252     c->pkinit_require_binding =
253 	krb5_config_get_bool_default(context, NULL,
254 				     c->pkinit_require_binding,
255 				     "kdc",
256 				     "pkinit_win2k_require_binding",
257 				     NULL);
258     c->pkinit_dh_min_bits =
259 	krb5_config_get_int_default(context, NULL,
260 				    0,
261 				    "kdc", "pkinit_dh_min_bits", NULL);
262 
263     *config = c;
264 
265     return 0;
266 }
267 
268 krb5_error_code
269 krb5_kdc_pkinit_config(krb5_context context, krb5_kdc_configuration *config)
270 {
271 #ifdef PKINIT
272 #ifdef __APPLE__
273     config->enable_pkinit = 1;
274 
275     if (config->pkinit_kdc_identity == NULL) {
276 	if (config->pkinit_kdc_friendly_name == NULL)
277 	    config->pkinit_kdc_friendly_name =
278 		strdup("O=System Identity,CN=com.apple.kerberos.kdc");
279 	config->pkinit_kdc_identity = strdup("KEYCHAIN:");
280     }
281     if (config->pkinit_kdc_anchors == NULL)
282 	config->pkinit_kdc_anchors = strdup("KEYCHAIN:");
283 
284 #endif /* __APPLE__ */
285 
286     if (config->enable_pkinit) {
287 	if (config->pkinit_kdc_identity == NULL)
288 	    krb5_errx(context, 1, "pkinit enabled but no identity");
289 
290 	if (config->pkinit_kdc_anchors == NULL)
291 	    krb5_errx(context, 1, "pkinit enabled but no X509 anchors");
292 
293 	krb5_kdc_pk_initialize(context, config,
294 			       config->pkinit_kdc_identity,
295 			       config->pkinit_kdc_anchors,
296 			       config->pkinit_kdc_cert_pool,
297 			       config->pkinit_kdc_revoke);
298 
299     }
300 
301     return 0;
302 #endif /* PKINIT */
303 }
304