|
Packit |
fd8b60 |
/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
|
|
Packit |
fd8b60 |
/* kdc/policy.c - Policy decision routines for KDC */
|
|
Packit |
fd8b60 |
/*
|
|
Packit |
fd8b60 |
* Copyright (C) 2017 by Red Hat, Inc.
|
|
Packit |
fd8b60 |
* All rights reserved.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* Redistribution and use in source and binary forms, with or without
|
|
Packit |
fd8b60 |
* modification, are permitted provided that the following conditions
|
|
Packit |
fd8b60 |
* are met:
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* * Redistributions of source code must retain the above copyright
|
|
Packit |
fd8b60 |
* notice, this list of conditions and the following disclaimer.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* * Redistributions in binary form must reproduce the above copyright
|
|
Packit |
fd8b60 |
* notice, this list of conditions and the following disclaimer in
|
|
Packit |
fd8b60 |
* the documentation and/or other materials provided with the
|
|
Packit |
fd8b60 |
* distribution.
|
|
Packit |
fd8b60 |
*
|
|
Packit |
fd8b60 |
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
Packit |
fd8b60 |
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
Packit |
fd8b60 |
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
Packit |
fd8b60 |
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
Packit |
fd8b60 |
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
|
Packit |
fd8b60 |
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
Packit |
fd8b60 |
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
Packit |
fd8b60 |
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
Packit |
fd8b60 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
Packit |
fd8b60 |
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
Packit |
fd8b60 |
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
Packit |
fd8b60 |
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
Packit |
fd8b60 |
*/
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
#include "k5-int.h"
|
|
Packit |
fd8b60 |
#include "kdc_util.h"
|
|
Packit |
fd8b60 |
#include "extern.h"
|
|
Packit |
fd8b60 |
#include "policy.h"
|
|
Packit |
fd8b60 |
#include "adm_proto.h"
|
|
Packit |
fd8b60 |
#include <krb5/kdcpolicy_plugin.h>
|
|
Packit |
fd8b60 |
#include <syslog.h>
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
typedef struct kdcpolicy_handle_st {
|
|
Packit |
fd8b60 |
struct krb5_kdcpolicy_vtable_st vt;
|
|
Packit |
fd8b60 |
krb5_kdcpolicy_moddata moddata;
|
|
Packit |
fd8b60 |
} *kdcpolicy_handle;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static kdcpolicy_handle *handles;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
static void
|
|
Packit |
fd8b60 |
free_indicators(char **ais)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
size_t i;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
if (ais == NULL)
|
|
Packit |
fd8b60 |
return;
|
|
Packit |
fd8b60 |
for (i = 0; ais[i] != NULL; i++)
|
|
Packit |
fd8b60 |
free(ais[i]);
|
|
Packit |
fd8b60 |
free(ais);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Convert inds to a null-terminated list of C strings. */
|
|
Packit |
fd8b60 |
static krb5_error_code
|
|
Packit |
fd8b60 |
authind_strings(krb5_data *const *inds, char ***strs_out)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_error_code ret;
|
|
Packit |
fd8b60 |
char **list = NULL;
|
|
Packit |
fd8b60 |
size_t i, count;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
*strs_out = NULL;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
for (count = 0; inds != NULL && inds[count] != NULL; count++);
|
|
Packit |
fd8b60 |
list = k5calloc(count + 1, sizeof(*list), &ret;;
|
|
Packit |
fd8b60 |
if (list == NULL)
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
for (i = 0; i < count; i++) {
|
|
Packit |
fd8b60 |
list[i] = k5memdup0(inds[i]->data, inds[i]->length, &ret;;
|
|
Packit |
fd8b60 |
if (list[i] == NULL)
|
|
Packit |
fd8b60 |
goto error;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
*strs_out = list;
|
|
Packit |
fd8b60 |
return 0;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
error:
|
|
Packit |
fd8b60 |
free_indicators(list);
|
|
Packit |
fd8b60 |
return ret;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Constrain times->endtime to life and times->renew_till to rlife, relative to
|
|
Packit |
fd8b60 |
* now. */
|
|
Packit |
fd8b60 |
static void
|
|
Packit |
fd8b60 |
update_ticket_times(krb5_ticket_times *times, krb5_timestamp now,
|
|
Packit |
fd8b60 |
krb5_deltat life, krb5_deltat rlife)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
if (life)
|
|
Packit |
fd8b60 |
times->endtime = ts_min(ts_incr(now, life), times->endtime);
|
|
Packit |
fd8b60 |
if (rlife)
|
|
Packit |
fd8b60 |
times->renew_till = ts_min(ts_incr(now, rlife), times->renew_till);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/* Check an AS request against kdcpolicy modules, updating times with any
|
|
Packit |
fd8b60 |
* module endtime constraints. Set an appropriate status string on error. */
|
|
Packit |
fd8b60 |
krb5_error_code
|
|
Packit |
fd8b60 |
check_kdcpolicy_as(krb5_context context, const krb5_kdc_req *request,
|
|
Packit |
fd8b60 |
const krb5_db_entry *client, const krb5_db_entry *server,
|
|
Packit |
fd8b60 |
krb5_data *const *auth_indicators, krb5_timestamp kdc_time,
|
|
Packit |
fd8b60 |
krb5_ticket_times *times, const char **status)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_deltat life = 0, rlife = 0;
|
|
Packit |
fd8b60 |
krb5_error_code ret;
|
|
Packit |
fd8b60 |
kdcpolicy_handle *hp, h;
|
|
Packit |
fd8b60 |
char **ais = NULL;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
*status = NULL;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ret = authind_strings(auth_indicators, &ais);
|
|
Packit |
fd8b60 |
if (ret)
|
|
Packit |
fd8b60 |
goto done;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
for (hp = handles; *hp != NULL; hp++) {
|
|
Packit |
fd8b60 |
h = *hp;
|
|
Packit |
fd8b60 |
if (h->vt.check_as == NULL)
|
|
Packit |
fd8b60 |
continue;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ret = h->vt.check_as(context, h->moddata, request, client, server,
|
|
Packit |
fd8b60 |
(const char **)ais, status, &life, &rlife);
|
|
Packit |
fd8b60 |
if (ret)
|
|
Packit |
fd8b60 |
goto done;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
update_ticket_times(times, kdc_time, life, rlife);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
done:
|
|
Packit |
fd8b60 |
free_indicators(ais);
|
|
Packit |
fd8b60 |
return ret;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
/*
|
|
Packit |
fd8b60 |
* Check the TGS request against the local TGS policy. Accepts an
|
|
Packit |
fd8b60 |
* authentication indicator for the module policy decisions. Returns 0 and a
|
|
Packit |
fd8b60 |
* NULL status string on success.
|
|
Packit |
fd8b60 |
*/
|
|
Packit |
fd8b60 |
krb5_error_code
|
|
Packit |
fd8b60 |
check_kdcpolicy_tgs(krb5_context context, const krb5_kdc_req *request,
|
|
Packit |
fd8b60 |
const krb5_db_entry *server, const krb5_ticket *ticket,
|
|
Packit |
fd8b60 |
krb5_data *const *auth_indicators, krb5_timestamp kdc_time,
|
|
Packit |
fd8b60 |
krb5_ticket_times *times, const char **status)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_deltat life = 0, rlife = 0;
|
|
Packit |
fd8b60 |
krb5_error_code ret;
|
|
Packit |
fd8b60 |
kdcpolicy_handle *hp, h;
|
|
Packit |
fd8b60 |
char **ais = NULL;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
*status = NULL;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ret = authind_strings(auth_indicators, &ais);
|
|
Packit |
fd8b60 |
if (ret)
|
|
Packit |
fd8b60 |
goto done;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
for (hp = handles; *hp != NULL; hp++) {
|
|
Packit |
fd8b60 |
h = *hp;
|
|
Packit |
fd8b60 |
if (h->vt.check_tgs == NULL)
|
|
Packit |
fd8b60 |
continue;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ret = h->vt.check_tgs(context, h->moddata, request, server, ticket,
|
|
Packit |
fd8b60 |
(const char **)ais, status, &life, &rlife);
|
|
Packit |
fd8b60 |
if (ret)
|
|
Packit |
fd8b60 |
goto done;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
update_ticket_times(times, kdc_time, life, rlife);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
done:
|
|
Packit |
fd8b60 |
free_indicators(ais);
|
|
Packit |
fd8b60 |
return ret;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
void
|
|
Packit |
fd8b60 |
unload_kdcpolicy_plugins(krb5_context context)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
kdcpolicy_handle *hp, h;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
for (hp = handles; *hp != NULL; hp++) {
|
|
Packit |
fd8b60 |
h = *hp;
|
|
Packit |
fd8b60 |
if (h->vt.fini != NULL)
|
|
Packit |
fd8b60 |
h->vt.fini(context, h->moddata);
|
|
Packit |
fd8b60 |
free(h);
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
free(handles);
|
|
Packit |
fd8b60 |
handles = NULL;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
krb5_error_code
|
|
Packit |
fd8b60 |
load_kdcpolicy_plugins(krb5_context context)
|
|
Packit |
fd8b60 |
{
|
|
Packit |
fd8b60 |
krb5_error_code ret;
|
|
Packit |
fd8b60 |
krb5_plugin_initvt_fn *modules = NULL, *mod;
|
|
Packit |
fd8b60 |
kdcpolicy_handle h;
|
|
Packit |
fd8b60 |
size_t count;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ret = k5_plugin_load_all(context, PLUGIN_INTERFACE_KDCPOLICY, &modules);
|
|
Packit |
fd8b60 |
if (ret)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
for (count = 0; modules[count] != NULL; count++);
|
|
Packit |
fd8b60 |
handles = k5calloc(count + 1, sizeof(*handles), &ret;;
|
|
Packit |
fd8b60 |
if (handles == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
count = 0;
|
|
Packit |
fd8b60 |
for (mod = modules; *mod != NULL; mod++) {
|
|
Packit |
fd8b60 |
h = k5calloc(1, sizeof(*h), &ret;;
|
|
Packit |
fd8b60 |
if (h == NULL)
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ret = (*mod)(context, 1, 1, (krb5_plugin_vtable)&h->vt);
|
|
Packit |
fd8b60 |
if (ret) { /* Version mismatch. */
|
|
Packit |
fd8b60 |
TRACE_KDCPOLICY_VTINIT_FAIL(context, ret);
|
|
Packit |
fd8b60 |
free(h);
|
|
Packit |
fd8b60 |
continue;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
if (h->vt.init != NULL) {
|
|
Packit |
fd8b60 |
ret = h->vt.init(context, &h->moddata);
|
|
Packit |
fd8b60 |
if (ret == KRB5_PLUGIN_NO_HANDLE) {
|
|
Packit |
fd8b60 |
TRACE_KDCPOLICY_INIT_SKIP(context, h->vt.name);
|
|
Packit |
fd8b60 |
free(h);
|
|
Packit |
fd8b60 |
continue;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
if (ret) {
|
|
Packit |
fd8b60 |
kdc_err(context, ret, _("while loading policy module %s"),
|
|
Packit |
fd8b60 |
h->vt.name);
|
|
Packit |
fd8b60 |
free(h);
|
|
Packit |
fd8b60 |
goto cleanup;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
handles[count++] = h;
|
|
Packit |
fd8b60 |
}
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
ret = 0;
|
|
Packit |
fd8b60 |
|
|
Packit |
fd8b60 |
cleanup:
|
|
Packit |
fd8b60 |
if (ret)
|
|
Packit |
fd8b60 |
unload_kdcpolicy_plugins(context);
|
|
Packit |
fd8b60 |
k5_plugin_free_modules(context, modules);
|
|
Packit |
fd8b60 |
return ret;
|
|
Packit |
fd8b60 |
}
|