2 * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 #include "send_to_kdc_plugin.h"
41 unsigned long tgs_req;
47 int detach_from_console = -1;
48 int daemon_child = -1;
51 static krb5_kdc_configuration *kdc_config;
52 static krb5_context kdc_context;
54 static struct sockaddr_storage sa;
55 static const char *astr = "0.0.0.0";
57 static void eval_object(heim_object_t);
64 static krb5_error_code
65 plugin_init(krb5_context context, void **pctx)
72 plugin_fini(void *ctx)
76 static krb5_error_code
77 plugin_send_to_kdc(krb5_context context,
84 return KRB5_PLUGIN_NO_HANDLE;
87 static krb5_error_code
88 plugin_send_to_realm(krb5_context context,
90 krb5_const_realm realm,
97 krb5_kdc_update_time(NULL);
99 ret = krb5_kdc_process_request(kdc_context, kdc_config,
100 in->data, in->length,
102 (struct sockaddr *)&sa, 0);
104 krb5_err(kdc_context, 1, ret, "krb5_kdc_process_request");
109 static krb5plugin_send_to_kdc_ftable send_to_kdc = {
110 KRB5_PLUGIN_SEND_TO_KDC_VERSION_2,
118 perf_start(struct perf *perf)
120 memset(perf, 0, sizeof(*perf));
122 gettimeofday(&perf->start, NULL);
128 perf_stop(struct perf *perf)
130 gettimeofday(&perf->stop, NULL);
134 ptop->as_req += perf->as_req;
135 ptop->tgs_req += perf->tgs_req;
138 timevalsub(&perf->stop, &perf->start);
139 printf("time: %lu.%06lu\n",
140 (unsigned long)perf->stop.tv_sec,
141 (unsigned long)perf->stop.tv_usec);
143 #define USEC_PER_SEC 1000000
147 as_ps = (perf->as_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
148 printf("as-req/s %.2lf (total %lu requests)\n", as_ps, perf->as_req);
153 tgs_ps = (perf->tgs_req * USEC_PER_SEC) / (double)((perf->stop.tv_sec * USEC_PER_SEC) + perf->stop.tv_usec);
154 printf("tgs-req/s %.2lf (total %lu requests)\n", tgs_ps, perf->tgs_req);
163 eval_repeat(heim_dict_t o)
165 heim_object_t or = heim_dict_get_value(o, HSTR("value"));
166 heim_number_t n = heim_dict_get_value(o, HSTR("num"));
172 heim_assert(or != NULL, "value missing");
173 heim_assert(n != NULL, "num missing");
175 num = heim_number_get_int(n);
176 heim_assert(num >= 0, "num >= 0");
178 for (i = 0; i < num; i++)
188 static krb5_error_code
189 copy_keytab(krb5_context context, krb5_keytab from, krb5_keytab to)
191 krb5_keytab_entry entry;
192 krb5_kt_cursor cursor;
195 ret = krb5_kt_start_seq_get(context, from, &cursor);
198 while((ret = krb5_kt_next_entry(context, from, &entry, &cursor)) == 0){
199 krb5_kt_add_entry(context, to, &entry);
200 krb5_kt_free_entry(context, &entry);
202 return krb5_kt_end_seq_get(context, from, &cursor);
210 eval_kinit(heim_dict_t o)
212 heim_string_t user, password, keytab, fast_armor_cc, pk_user_id, ccache;
213 krb5_get_init_creds_opt *opt;
214 krb5_init_creds_context ctx;
215 krb5_principal client;
216 krb5_keytab ktmem = NULL;
217 krb5_ccache fast_cc = NULL;
223 user = heim_dict_get_value(o, HSTR("client"));
225 krb5_errx(kdc_context, 1, "no client");
227 password = heim_dict_get_value(o, HSTR("password"));
228 keytab = heim_dict_get_value(o, HSTR("keytab"));
229 pk_user_id = heim_dict_get_value(o, HSTR("pkinit-user-cert-id"));
230 if (password == NULL && keytab == NULL && pk_user_id == NULL)
231 krb5_errx(kdc_context, 1, "password, keytab, nor PKINIT user cert ID");
233 ccache = heim_dict_get_value(o, HSTR("ccache"));
235 ret = krb5_parse_name(kdc_context, heim_string_get_utf8(user), &client);
237 krb5_err(kdc_context, 1, ret, "krb5_unparse_name");
240 ret = krb5_get_init_creds_opt_alloc (kdc_context, &opt);
242 krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_alloc");
245 heim_bool_t rsaobj = heim_dict_get_value(o, HSTR("pkinit-use-rsa"));
246 int use_rsa = rsaobj ? heim_bool_val(rsaobj) : 0;
248 ret = krb5_get_init_creds_opt_set_pkinit(kdc_context, opt,
250 heim_string_get_utf8(pk_user_id),
255 krb5_err(kdc_context, 1, ret, "krb5_get_init_creds_opt_set_pkinit");
258 ret = krb5_init_creds_init(kdc_context, client, NULL, NULL, 0, opt, &ctx);
260 krb5_err(kdc_context, 1, ret, "krb5_init_creds_init");
262 fast_armor_cc = heim_dict_get_value(o, HSTR("fast-armor-cc"));
265 ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(fast_armor_cc), &fast_cc);
267 krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
269 ret = krb5_init_creds_set_fast_ccache(kdc_context, ctx, fast_cc);
271 krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_fast_ccache");
277 ret = krb5_init_creds_set_password(kdc_context, ctx,
278 heim_string_get_utf8(password));
280 krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_password");
283 krb5_keytab kt = NULL;
285 ret = krb5_kt_resolve(kdc_context, heim_string_get_utf8(keytab), &kt);
287 krb5_err(kdc_context, 1, ret, "krb5_kt_resolve");
289 ret = krb5_kt_resolve(kdc_context, "MEMORY:keytab", &ktmem);
291 krb5_err(kdc_context, 1, ret, "krb5_kt_resolve(MEMORY)");
293 ret = copy_keytab(kdc_context, kt, ktmem);
295 krb5_err(kdc_context, 1, ret, "copy_keytab");
297 krb5_kt_close(kdc_context, kt);
299 ret = krb5_init_creds_set_keytab(kdc_context, ctx, ktmem);
301 krb5_err(kdc_context, 1, ret, "krb5_init_creds_set_keytab");
304 ret = krb5_init_creds_get(kdc_context, ctx);
306 krb5_err(kdc_context, 1, ret, "krb5_init_creds_get");
309 const char *name = heim_string_get_utf8(ccache);
313 ret = krb5_init_creds_get_creds(kdc_context, ctx, &cred);
315 krb5_err(kdc_context, 1, ret, "krb5_init_creds_get_creds");
317 ret = krb5_cc_resolve(kdc_context, name, &cc);
319 krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
321 krb5_init_creds_store(kdc_context, ctx, cc);
323 ret = krb5_cc_close(kdc_context, cc);
325 krb5_err(kdc_context, 1, ret, "krb5_cc_close");
327 krb5_free_cred_contents(kdc_context, &cred);
330 krb5_init_creds_free(kdc_context, ctx);
333 krb5_kt_close(kdc_context, ktmem);
335 krb5_cc_close(kdc_context, fast_cc);
343 eval_kgetcred(heim_dict_t o)
345 heim_string_t server, ccache;
346 krb5_get_creds_opt opt;
349 krb5_ccache cc = NULL;
351 krb5_creds *out = NULL;
356 server = heim_dict_get_value(o, HSTR("server"));
358 krb5_errx(kdc_context, 1, "no server");
360 ccache = heim_dict_get_value(o, HSTR("ccache"));
362 krb5_errx(kdc_context, 1, "no ccache");
364 nostore = heim_dict_get_value(o, HSTR("nostore"));
366 nostore = heim_bool_create(1);
368 ret = krb5_cc_resolve(kdc_context, heim_string_get_utf8(ccache), &cc);
370 krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
372 ret = krb5_parse_name(kdc_context, heim_string_get_utf8(server), &s);
374 krb5_err(kdc_context, 1, ret, "krb5_parse_name");
376 ret = krb5_get_creds_opt_alloc(kdc_context, &opt);
378 krb5_err(kdc_context, 1, ret, "krb5_get_creds_opt_alloc");
380 if (heim_bool_val(nostore))
381 krb5_get_creds_opt_add_options(kdc_context, opt, KRB5_GC_NO_STORE);
383 ret = krb5_get_creds(kdc_context, opt, cc, s, &out);
385 krb5_err(kdc_context, 1, ret, "krb5_get_creds");
387 krb5_free_creds(kdc_context, out);
388 krb5_free_principal(kdc_context, s);
389 krb5_get_creds_opt_free(kdc_context, opt);
390 krb5_cc_close(kdc_context, cc);
399 eval_kdestroy(heim_dict_t o)
401 heim_string_t ccache = heim_dict_get_value(o, HSTR("ccache"));;
406 heim_assert(ccache != NULL, "ccache_missing");
408 name = heim_string_get_utf8(ccache);
410 ret = krb5_cc_resolve(kdc_context, name, &cc);
412 krb5_err(kdc_context, 1, ret, "krb5_cc_resolve");
414 krb5_cc_destroy(kdc_context, cc);
423 eval_array_element(heim_object_t o, void *ptr, int *stop)
429 eval_object(heim_object_t o)
431 heim_tid_t t = heim_get_tid(o);
433 if (t == heim_array_get_type_id()) {
434 heim_array_iterate_f(o, NULL, eval_array_element);
435 } else if (t == heim_dict_get_type_id()) {
436 const char *op = heim_dict_get_value(o, HSTR("op"));
438 heim_assert(op != NULL, "op missing");
440 if (strcmp(op, "repeat") == 0) {
442 } else if (strcmp(op, "kinit") == 0) {
444 } else if (strcmp(op, "kgetcred") == 0) {
446 } else if (strcmp(op, "kdestroy") == 0) {
449 errx(1, "unsupported ops %s", op);
453 errx(1, "unsupported");
458 main(int argc, char **argv)
463 setprogname(argv[0]);
465 ret = krb5_init_context(&kdc_context);
466 if (ret == KRB5_CONFIG_BADFORMAT)
467 errx (1, "krb5_init_context failed to parse configuration file");
469 errx (1, "krb5_init_context failed: %d", ret);
471 ret = krb5_kt_register(kdc_context, &hdb_get_kt_ops);
473 errx (1, "krb5_kt_register(HDB) failed: %d", ret);
475 kdc_config = configure(kdc_context, argc, argv, &optidx);
481 errx(1, "missing operations");
483 krb5_plugin_register(kdc_context, PLUGIN_TYPE_DATA,
484 KRB5_PLUGIN_SEND_TO_KDC, &send_to_kdc);
491 if (rk_undumpdata(argv[0], &buf, &size))
492 errx(1, "undumpdata: %s", argv[0]);
494 o = heim_json_create_with_bytes(buf, size, 10, 0, NULL);
497 errx(1, "heim_json");
508 krb5_free_context(kdc_context);