source: heimdal/trunk/lib/kafs/common.c@ 3

Last change on this file since 3 was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 11.9 KB
Line 
1/*
2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "kafs_locl.h"
35
36#define AUTH_SUPERUSER "afs"
37
38/*
39 * Here only ASCII characters are relevant.
40 */
41
42#define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z')
43
44#define ToAsciiUpper(c) ((c) - 'a' + 'A')
45
46static void (*kafs_verbose)(void *, const char *);
47static void *kafs_verbose_ctx;
48
49void
50_kafs_foldup(char *a, const char *b)
51{
52 for (; *b; a++, b++)
53 if (IsAsciiLower(*b))
54 *a = ToAsciiUpper(*b);
55 else
56 *a = *b;
57 *a = '\0';
58}
59
60void
61kafs_set_verbose(void (*f)(void *, const char *), void *ctx)
62{
63 if (f) {
64 kafs_verbose = f;
65 kafs_verbose_ctx = ctx;
66 }
67}
68
69int
70kafs_settoken_rxkad(const char *cell, struct ClearToken *ct,
71 void *ticket, size_t ticket_len)
72{
73 struct ViceIoctl parms;
74 char buf[2048], *t;
75 int32_t sizeof_x;
76
77 t = buf;
78 /*
79 * length of secret token followed by secret token
80 */
81 sizeof_x = ticket_len;
82 memcpy(t, &sizeof_x, sizeof(sizeof_x));
83 t += sizeof(sizeof_x);
84 memcpy(t, ticket, sizeof_x);
85 t += sizeof_x;
86 /*
87 * length of clear token followed by clear token
88 */
89 sizeof_x = sizeof(*ct);
90 memcpy(t, &sizeof_x, sizeof(sizeof_x));
91 t += sizeof(sizeof_x);
92 memcpy(t, ct, sizeof_x);
93 t += sizeof_x;
94
95 /*
96 * do *not* mark as primary cell
97 */
98 sizeof_x = 0;
99 memcpy(t, &sizeof_x, sizeof(sizeof_x));
100 t += sizeof(sizeof_x);
101 /*
102 * follow with cell name
103 */
104 sizeof_x = strlen(cell) + 1;
105 memcpy(t, cell, sizeof_x);
106 t += sizeof_x;
107
108 /*
109 * Build argument block
110 */
111 parms.in = buf;
112 parms.in_size = t - buf;
113 parms.out = 0;
114 parms.out_size = 0;
115
116 return k_pioctl(0, VIOCSETTOK, &parms, 0);
117}
118
119void
120_kafs_fixup_viceid(struct ClearToken *ct, uid_t uid)
121{
122#define ODD(x) ((x) & 1)
123 /* According to Transarc conventions ViceId is valid iff
124 * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime
125 * the transformations:
126 *
127 * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life)
128 * preserves the original values.
129 */
130 if (uid != 0) /* valid ViceId */
131 {
132 if (!ODD(ct->EndTimestamp - ct->BeginTimestamp))
133 ct->EndTimestamp--;
134 }
135 else /* not valid ViceId */
136 {
137 if (ODD(ct->EndTimestamp - ct->BeginTimestamp))
138 ct->EndTimestamp--;
139 }
140}
141
142/* Try to get a db-server for an AFS cell from a AFSDB record */
143
144static int
145dns_find_cell(const char *cell, char *dbserver, size_t len)
146{
147 struct rk_dns_reply *r;
148 int ok = -1;
149 r = rk_dns_lookup(cell, "afsdb");
150 if(r){
151 struct rk_resource_record *rr = r->head;
152 while(rr){
153 if(rr->type == rk_ns_t_afsdb && rr->u.afsdb->preference == 1){
154 strlcpy(dbserver,
155 rr->u.afsdb->domain,
156 len);
157 ok = 0;
158 break;
159 }
160 rr = rr->next;
161 }
162 rk_dns_free_data(r);
163 }
164 return ok;
165}
166
167
168/*
169 * Try to find the cells we should try to klog to in "file".
170 */
171static void
172find_cells(const char *file, char ***cells, int *idx)
173{
174 FILE *f;
175 char cell[64];
176 int i;
177 int ind = *idx;
178
179 f = fopen(file, "r");
180 if (f == NULL)
181 return;
182 while (fgets(cell, sizeof(cell), f)) {
183 char *t;
184 t = cell + strlen(cell);
185 for (; t >= cell; t--)
186 if (*t == '\n' || *t == '\t' || *t == ' ')
187 *t = 0;
188 if (cell[0] == '\0' || cell[0] == '#')
189 continue;
190 for(i = 0; i < ind; i++)
191 if(strcmp((*cells)[i], cell) == 0)
192 break;
193 if(i == ind){
194 char **tmp;
195
196 tmp = realloc(*cells, (ind + 1) * sizeof(**cells));
197 if (tmp == NULL)
198 break;
199 *cells = tmp;
200 (*cells)[ind] = strdup(cell);
201 if ((*cells)[ind] == NULL)
202 break;
203 ++ind;
204 }
205 }
206 fclose(f);
207 *idx = ind;
208}
209
210/*
211 * Get tokens for all cells[]
212 */
213static int
214afslog_cells(struct kafs_data *data, char **cells, int max, uid_t uid,
215 const char *homedir)
216{
217 int ret = 0;
218 int i;
219 for (i = 0; i < max; i++) {
220 int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir);
221 if (er)
222 ret = er;
223 }
224 return ret;
225}
226
227int
228_kafs_afslog_all_local_cells(struct kafs_data *data,
229 uid_t uid, const char *homedir)
230{
231 int ret;
232 char **cells = NULL;
233 int idx = 0;
234
235 if (homedir == NULL)
236 homedir = getenv("HOME");
237 if (homedir != NULL) {
238 char home[MaxPathLen];
239 snprintf(home, sizeof(home), "%s/.TheseCells", homedir);
240 find_cells(home, &cells, &idx);
241 }
242 find_cells(_PATH_THESECELLS, &cells, &idx);
243 find_cells(_PATH_THISCELL, &cells, &idx);
244 find_cells(_PATH_ARLA_THESECELLS, &cells, &idx);
245 find_cells(_PATH_ARLA_THISCELL, &cells, &idx);
246 find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &idx);
247 find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &idx);
248 find_cells(_PATH_OPENAFS_MACOSX_THESECELLS, &cells, &idx);
249 find_cells(_PATH_OPENAFS_MACOSX_THISCELL, &cells, &idx);
250 find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &idx);
251 find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &idx);
252 find_cells(_PATH_ARLA_OPENBSD_THESECELLS, &cells, &idx);
253 find_cells(_PATH_ARLA_OPENBSD_THISCELL, &cells, &idx);
254
255 ret = afslog_cells(data, cells, idx, uid, homedir);
256 while(idx > 0)
257 free(cells[--idx]);
258 free(cells);
259 return ret;
260}
261
262
263static int
264file_find_cell(struct kafs_data *data,
265 const char *cell, char **realm, int exact)
266{
267 FILE *F;
268 char buf[1024];
269 char *p;
270 int ret = -1;
271
272 if ((F = fopen(_PATH_CELLSERVDB, "r"))
273 || (F = fopen(_PATH_ARLA_CELLSERVDB, "r"))
274 || (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r"))
275 || (F = fopen(_PATH_OPENAFS_MACOSX_CELLSERVDB, "r"))
276 || (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) {
277 while (fgets(buf, sizeof(buf), F)) {
278 int cmp;
279
280 if (buf[0] != '>')
281 continue; /* Not a cell name line, try next line */
282 p = buf;
283 strsep(&p, " \t\n#");
284
285 if (exact)
286 cmp = strcmp(buf + 1, cell);
287 else
288 cmp = strncmp(buf + 1, cell, strlen(cell));
289
290 if (cmp == 0) {
291 /*
292 * We found the cell name we're looking for.
293 * Read next line on the form ip-address '#' hostname
294 */
295 if (fgets(buf, sizeof(buf), F) == NULL)
296 break; /* Read failed, give up */
297 p = strchr(buf, '#');
298 if (p == NULL)
299 break; /* No '#', give up */
300 p++;
301 if (buf[strlen(buf) - 1] == '\n')
302 buf[strlen(buf) - 1] = '\0';
303 *realm = (*data->get_realm)(data, p);
304 if (*realm && **realm != '\0')
305 ret = 0;
306 break; /* Won't try any more */
307 }
308 }
309 fclose(F);
310 }
311 return ret;
312}
313
314/* Find the realm associated with cell. Do this by opening CellServDB
315 file and getting the realm-of-host for the first VL-server for the
316 cell.
317
318 This does not work when the VL-server is living in one realm, but
319 the cell it is serving is living in another realm.
320
321 Return 0 on success, -1 otherwise.
322 */
323
324int
325_kafs_realm_of_cell(struct kafs_data *data,
326 const char *cell, char **realm)
327{
328 char buf[1024];
329 int ret;
330
331 ret = file_find_cell(data, cell, realm, 1);
332 if (ret == 0)
333 return ret;
334 if (dns_find_cell(cell, buf, sizeof(buf)) == 0) {
335 *realm = (*data->get_realm)(data, buf);
336 if(*realm != NULL)
337 return 0;
338 }
339 return file_find_cell(data, cell, realm, 0);
340}
341
342static int
343_kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell,
344 const char *realm, uid_t uid, struct kafs_token *kt)
345{
346 int ret;
347
348 ret = (*data->get_cred)(data, user, cell, realm, uid, kt);
349 if (kafs_verbose) {
350 const char *estr = (*data->get_error)(data, ret);
351 char *str;
352 asprintf(&str, "%s tried afs%s%s@%s -> %s (%d)",
353 data->name, cell ? "/" : "",
354 cell ? cell : "", realm, estr ? estr : "unknown", ret);
355 (*kafs_verbose)(kafs_verbose_ctx, str);
356 if (estr)
357 (*data->free_error)(data, estr);
358 free(str);
359 }
360
361 return ret;
362}
363
364
365int
366_kafs_get_cred(struct kafs_data *data,
367 const char *cell,
368 const char *realm_hint,
369 const char *realm,
370 uid_t uid,
371 struct kafs_token *kt)
372{
373 int ret = -1;
374 char *vl_realm;
375 char CELL[64];
376
377 /* We're about to find the realm that holds the key for afs in
378 * the specified cell. The problem is that null-instance
379 * afs-principals are common and that hitting the wrong realm might
380 * yield the wrong afs key. The following assumptions were made.
381 *
382 * Any realm passed to us is preferred.
383 *
384 * If there is a realm with the same name as the cell, it is most
385 * likely the correct realm to talk to.
386 *
387 * In most (maybe even all) cases the database servers of the cell
388 * will live in the realm we are looking for.
389 *
390 * Try the local realm, but if the previous cases fail, this is
391 * really a long shot.
392 *
393 */
394
395 /* comments on the ordering of these tests */
396
397 /* If the user passes a realm, she probably knows something we don't
398 * know and we should try afs@realm_hint.
399 */
400
401 if (realm_hint) {
402 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
403 cell, realm_hint, uid, kt);
404 if (ret == 0) return 0;
405 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
406 NULL, realm_hint, uid, kt);
407 if (ret == 0) return 0;
408 }
409
410 _kafs_foldup(CELL, cell);
411
412 /*
413 * If the AFS servers have a file /usr/afs/etc/krb.conf containing
414 * REALM we still don't have to resort to cross-cell authentication.
415 * Try afs.cell@REALM.
416 */
417 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
418 cell, realm, uid, kt);
419 if (ret == 0) return 0;
420
421 /*
422 * If cell == realm we don't need no cross-cell authentication.
423 * Try afs@REALM.
424 */
425 if (strcmp(CELL, realm) == 0) {
426 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
427 NULL, realm, uid, kt);
428 if (ret == 0) return 0;
429 }
430
431 /*
432 * We failed to get ``first class tickets'' for afs,
433 * fall back to cross-cell authentication.
434 * Try afs@CELL.
435 * Try afs.cell@CELL.
436 */
437 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
438 NULL, CELL, uid, kt);
439 if (ret == 0) return 0;
440 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
441 cell, CELL, uid, kt);
442 if (ret == 0) return 0;
443
444 /*
445 * Perhaps the cell doesn't correspond to any realm?
446 * Use realm of first volume location DB server.
447 * Try afs.cell@VL_REALM.
448 * Try afs@VL_REALM???
449 */
450 if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0
451 && strcmp(vl_realm, realm) != 0
452 && strcmp(vl_realm, CELL) != 0) {
453 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
454 cell, vl_realm, uid, kt);
455 if (ret)
456 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
457 NULL, vl_realm, uid, kt);
458 free(vl_realm);
459 if (ret == 0) return 0;
460 }
461
462 return ret;
463}
Note: See TracBrowser for help on using the repository browser.