ISC DHCP 4.4.3-P1
A reference DHCPv4 and DHCPv6 implementation
 
Loading...
Searching...
No Matches
ldap_krb_helper.c
Go to the documentation of this file.
1/* ldap_krb_helper.c
2
3 Helper routings for allowing LDAP to read configuration with GSSAPI/krb auth */
4
5/*
6 * Copyright (c) 2015-2017 by Internet Systems Consortium, Inc. ("ISC")
7 * Copyright (c) 2014 William B.
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 *
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of The Internet Software Consortium nor the names
20 * of its contributors may be used to endorse or promote products derived
21 * from this software without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INTERNET SOFTWARE CONSORTIUM AND
24 * CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
25 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
26 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
27 * DISCLAIMED. IN NO EVENT SHALL THE INTERNET SOFTWARE CONSORTIUM OR
28 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
29 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
30 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
31 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
32 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
33 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
34 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 *
37 * This helper was written by William Brown <william@adelaide.edu.au>,
38 * inspired by krb5_helper.c from bind-dyndb-ldap by Simo Sorce (Redhat)
39 */
40#if defined(LDAP_USE_GSSAPI)
41
42#include "dhcpd.h"
43#include "ldap_krb_helper.h"
44
45#include <string.h>
46#include <stdio.h>
47#include <unistd.h>
48#include <time.h>
49
50#define KRB_DEFAULT_KEYTAB "FILE:/etc/dhcp/dhcp.keytab"
51#define KRB_MIN_TIME 300
52
53#define CHECK_KRB5(ctx, err, msg, ...) \
54 do { \
55 if (err) { \
56 const char * errmsg = krb5_get_error_message(ctx, err); \
57 log_error("Err: %s -> %s\n", msg, errmsg); \
58 result = ISC_R_FAILURE; \
59 goto cleanup; \
60 } \
61 } while (0)
62
63#define CHECK(ret_code, msg) \
64 if (ret_code != 0) { \
65 log_error("Error, %i %s\n", ret_code, msg); \
66 goto cleanup; \
67 }
68
69static isc_result_t
71{
72 char *realm = NULL;
78
79 memset(&mcreds, 0, sizeof(mcreds));
80 memset(&creds, 0, sizeof(creds));
81
83 CHECK_KRB5(context, krberr, "Failed to retrieve default realm");
84
87 "krbtgt", realm, NULL);
88 CHECK_KRB5(context, krberr, "Failed to build 'krbtgt/REALM' principal");
89
90 mcreds.client = service;
91
93
94 if (krberr) {
96 log_error("Credentials are not present in cache (%s)\n", errmsg);
99 goto cleanup;
100 }
101 CHECK_KRB5(context, krberr, "Credentials are not present in cache ");
102
104 CHECK_KRB5(context, krberr, "Failed to get time of day");
105
106
107 if (now > (creds.times.endtime + KRB_MIN_TIME)) {
108 log_error("Credentials cache expired");
110 goto cleanup;
111 } else {
112 char buf[255];
113 char fill = ' ';
114 krb5_timestamp_to_sfstring(creds.times.endtime, buf, 16, &fill);
115 log_info("Credentials valid til %s\n", buf);
116 }
117
119
120cleanup:
122 if (mcreds.server) krb5_free_principal(context, mcreds.server);
124 return result;
125}
126
128krb5_get_tgt(const char *principal, const char *keyfile)
129{
131 char *ccname = NULL;
140 int ret;
141
142 if (keyfile == NULL || keyfile[0] == '\0') {
144 log_info("Using default keytab %s\n", keyfile);
145 } else {
146 if (strncmp(keyfile, "FILE:", 5) != 0) {
147 log_error("Unknown keytab path format: Does it start with FILE:?\n");
148 return ISC_R_FAILURE;
149 }
150 }
151
153 CHECK_KRB5(NULL, krberr, "Kerberos context initialization failed");
154
156
157 ccname = "MEMORY:dhcp_ld_krb5_cc";
158 log_info("Using ccache %s\n" , ccname);
159
160 ret = setenv("KRB5CCNAME", ccname, 1);
161 if (ret == -1) {
162 log_error("Failed to setup environment\n");
164 goto cleanup;
165 }
166
168 CHECK_KRB5(context, krberr, "Couldnt resolve ccache '%s'", ccname);
169
171 CHECK_KRB5(context, krberr, "Failed to parse princ '%s'", princpal);
172
174 if (result == ISC_R_SUCCESS) {
175 log_info("Found valid kerberos credentials\n");
176 goto cleanup;
177 } else {
178 log_error("No valid krb5 credentials\n");
179 }
180
183 "Failed to resolve kt files '%s'\n", keyfile);
184
185 memset(&my_creds, 0, sizeof(my_creds));
186 memset(&options, 0, sizeof(options));
187
192
194 keytab, 0, NULL, &options);
195 CHECK_KRB5(context, krberr, "Failed to get initial credentials TGT\n");
196
198
200 CHECK_KRB5(context, krberr, "Failed to init ccache\n");
201
203 CHECK_KRB5(context, krberr, "Failed to store credentials\n");
204
206 log_info("Successfully init krb tgt %s", principal);
207
208cleanup:
214 return result;
215}
216
217#endif /* defined(LDAP_USE_GSSAPI) */
#define cur_time
Definition dhcpd.h:2126
void cleanup(void)
#define ISC_R_SUCCESS
int log_error(const char *,...) __attribute__((__format__(__printf__
int int log_info(const char *,...) __attribute__((__format__(__printf__