xref: /freebsd/crypto/heimdal/lib/kafs/common.c (revision 830940567b49bb0c08dfaed40418999e76616909)
1 /*
2  * Copyright (c) 1997 - 2005 Kungliga Tekniska H�gskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "kafs_locl.h"
35 
36 RCSID("$Id: common.c 15461 2005-06-16 22:52:33Z lha $");
37 
38 #define AUTH_SUPERUSER "afs"
39 
40 /*
41  * Here only ASCII characters are relevant.
42  */
43 
44 #define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z')
45 
46 #define ToAsciiUpper(c) ((c) - 'a' + 'A')
47 
48 static void (*kafs_verbose)(void *, const char *);
49 static void *kafs_verbose_ctx;
50 
51 void
52 _kafs_foldup(char *a, const char *b)
53 {
54   for (; *b; a++, b++)
55     if (IsAsciiLower(*b))
56       *a = ToAsciiUpper(*b);
57     else
58       *a = *b;
59   *a = '\0';
60 }
61 
62 void
63 kafs_set_verbose(void (*f)(void *, const char *), void *ctx)
64 {
65     if (f) {
66 	kafs_verbose = f;
67 	kafs_verbose_ctx = ctx;
68     }
69 }
70 
71 int
72 kafs_settoken_rxkad(const char *cell, struct ClearToken *ct,
73 		    void *ticket, size_t ticket_len)
74 {
75     struct ViceIoctl parms;
76     char buf[2048], *t;
77     int32_t sizeof_x;
78 
79     t = buf;
80     /*
81      * length of secret token followed by secret token
82      */
83     sizeof_x = ticket_len;
84     memcpy(t, &sizeof_x, sizeof(sizeof_x));
85     t += sizeof(sizeof_x);
86     memcpy(t, ticket, sizeof_x);
87     t += sizeof_x;
88     /*
89      * length of clear token followed by clear token
90      */
91     sizeof_x = sizeof(*ct);
92     memcpy(t, &sizeof_x, sizeof(sizeof_x));
93     t += sizeof(sizeof_x);
94     memcpy(t, ct, sizeof_x);
95     t += sizeof_x;
96 
97     /*
98      * do *not* mark as primary cell
99      */
100     sizeof_x = 0;
101     memcpy(t, &sizeof_x, sizeof(sizeof_x));
102     t += sizeof(sizeof_x);
103     /*
104      * follow with cell name
105      */
106     sizeof_x = strlen(cell) + 1;
107     memcpy(t, cell, sizeof_x);
108     t += sizeof_x;
109 
110     /*
111      * Build argument block
112      */
113     parms.in = buf;
114     parms.in_size = t - buf;
115     parms.out = 0;
116     parms.out_size = 0;
117 
118     return k_pioctl(0, VIOCSETTOK, &parms, 0);
119 }
120 
121 void
122 _kafs_fixup_viceid(struct ClearToken *ct, uid_t uid)
123 {
124 #define ODD(x) ((x) & 1)
125     /* According to Transarc conventions ViceId is valid iff
126      * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime
127      * the transformations:
128      *
129      * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life)
130      * preserves the original values.
131      */
132     if (uid != 0)		/* valid ViceId */
133     {
134 	if (!ODD(ct->EndTimestamp - ct->BeginTimestamp))
135 	    ct->EndTimestamp--;
136     }
137     else			/* not valid ViceId */
138     {
139 	if (ODD(ct->EndTimestamp - ct->BeginTimestamp))
140 	    ct->EndTimestamp--;
141     }
142 }
143 
144 
145 int
146 _kafs_v4_to_kt(CREDENTIALS *c, uid_t uid, struct kafs_token *kt)
147 {
148     kt->ticket = NULL;
149 
150     if (c->ticket_st.length > MAX_KTXT_LEN)
151 	return EINVAL;
152 
153     kt->ticket = malloc(c->ticket_st.length);
154     if (kt->ticket == NULL)
155 	return ENOMEM;
156     kt->ticket_len = c->ticket_st.length;
157     memcpy(kt->ticket, c->ticket_st.dat, kt->ticket_len);
158 
159     /*
160      * Build a struct ClearToken
161      */
162     kt->ct.AuthHandle = c->kvno;
163     memcpy (kt->ct.HandShakeKey, c->session, sizeof(c->session));
164     kt->ct.ViceId = uid;
165     kt->ct.BeginTimestamp = c->issue_date;
166     kt->ct.EndTimestamp = krb_life_to_time(c->issue_date, c->lifetime);
167 
168     _kafs_fixup_viceid(&kt->ct, uid);
169 
170     return 0;
171 }
172 
173 /* Try to get a db-server for an AFS cell from a AFSDB record */
174 
175 static int
176 dns_find_cell(const char *cell, char *dbserver, size_t len)
177 {
178     struct dns_reply *r;
179     int ok = -1;
180     r = dns_lookup(cell, "afsdb");
181     if(r){
182 	struct resource_record *rr = r->head;
183 	while(rr){
184 	    if(rr->type == T_AFSDB && rr->u.afsdb->preference == 1){
185 		strlcpy(dbserver,
186 				rr->u.afsdb->domain,
187 				len);
188 		ok = 0;
189 		break;
190 	    }
191 	    rr = rr->next;
192 	}
193 	dns_free_data(r);
194     }
195     return ok;
196 }
197 
198 
199 /*
200  * Try to find the cells we should try to klog to in "file".
201  */
202 static void
203 find_cells(const char *file, char ***cells, int *idx)
204 {
205     FILE *f;
206     char cell[64];
207     int i;
208     int ind = *idx;
209 
210     f = fopen(file, "r");
211     if (f == NULL)
212 	return;
213     while (fgets(cell, sizeof(cell), f)) {
214 	char *t;
215 	t = cell + strlen(cell);
216 	for (; t >= cell; t--)
217 	  if (*t == '\n' || *t == '\t' || *t == ' ')
218 	    *t = 0;
219 	if (cell[0] == '\0' || cell[0] == '#')
220 	    continue;
221 	for(i = 0; i < ind; i++)
222 	    if(strcmp((*cells)[i], cell) == 0)
223 		break;
224 	if(i == ind){
225 	    char **tmp;
226 
227 	    tmp = realloc(*cells, (ind + 1) * sizeof(**cells));
228 	    if (tmp == NULL)
229 		break;
230 	    *cells = tmp;
231 	    (*cells)[ind] = strdup(cell);
232 	    if ((*cells)[ind] == NULL)
233 		break;
234 	    ++ind;
235 	}
236     }
237     fclose(f);
238     *idx = ind;
239 }
240 
241 /*
242  * Get tokens for all cells[]
243  */
244 static int
245 afslog_cells(struct kafs_data *data, char **cells, int max, uid_t uid,
246 	     const char *homedir)
247 {
248     int ret = 0;
249     int i;
250     for (i = 0; i < max; i++) {
251         int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir);
252 	if (er)
253 	    ret = er;
254     }
255     return ret;
256 }
257 
258 int
259 _kafs_afslog_all_local_cells(struct kafs_data *data,
260 			     uid_t uid, const char *homedir)
261 {
262     int ret;
263     char **cells = NULL;
264     int idx = 0;
265 
266     if (homedir == NULL)
267 	homedir = getenv("HOME");
268     if (homedir != NULL) {
269 	char home[MaxPathLen];
270 	snprintf(home, sizeof(home), "%s/.TheseCells", homedir);
271 	find_cells(home, &cells, &idx);
272     }
273     find_cells(_PATH_THESECELLS, &cells, &idx);
274     find_cells(_PATH_THISCELL, &cells, &idx);
275     find_cells(_PATH_ARLA_THESECELLS, &cells, &idx);
276     find_cells(_PATH_ARLA_THISCELL, &cells, &idx);
277     find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &idx);
278     find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &idx);
279     find_cells(_PATH_OPENAFS_MACOSX_THESECELLS, &cells, &idx);
280     find_cells(_PATH_OPENAFS_MACOSX_THISCELL, &cells, &idx);
281     find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &idx);
282     find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &idx);
283     find_cells(_PATH_ARLA_OPENBSD_THESECELLS, &cells, &idx);
284     find_cells(_PATH_ARLA_OPENBSD_THISCELL, &cells, &idx);
285 
286     ret = afslog_cells(data, cells, idx, uid, homedir);
287     while(idx > 0)
288 	free(cells[--idx]);
289     free(cells);
290     return ret;
291 }
292 
293 
294 static int
295 file_find_cell(struct kafs_data *data,
296 	       const char *cell, char **realm, int exact)
297 {
298     FILE *F;
299     char buf[1024];
300     char *p;
301     int ret = -1;
302 
303     if ((F = fopen(_PATH_CELLSERVDB, "r"))
304 	|| (F = fopen(_PATH_ARLA_CELLSERVDB, "r"))
305 	|| (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r"))
306 	|| (F = fopen(_PATH_OPENAFS_MACOSX_CELLSERVDB, "r"))
307 	|| (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) {
308 	while (fgets(buf, sizeof(buf), F)) {
309 	    int cmp;
310 
311 	    if (buf[0] != '>')
312 		continue; /* Not a cell name line, try next line */
313 	    p = buf;
314 	    strsep(&p, " \t\n#");
315 
316 	    if (exact)
317 		cmp = strcmp(buf + 1, cell);
318 	    else
319 		cmp = strncmp(buf + 1, cell, strlen(cell));
320 
321 	    if (cmp == 0) {
322 		/*
323 		 * We found the cell name we're looking for.
324 		 * Read next line on the form ip-address '#' hostname
325 		 */
326 		if (fgets(buf, sizeof(buf), F) == NULL)
327 		    break;	/* Read failed, give up */
328 		p = strchr(buf, '#');
329 		if (p == NULL)
330 		    break;	/* No '#', give up */
331 		p++;
332 		if (buf[strlen(buf) - 1] == '\n')
333 		    buf[strlen(buf) - 1] = '\0';
334 		*realm = (*data->get_realm)(data, p);
335 		if (*realm && **realm != '\0')
336 		    ret = 0;
337 		break;		/* Won't try any more */
338 	    }
339 	}
340 	fclose(F);
341     }
342     return ret;
343 }
344 
345 /* Find the realm associated with cell. Do this by opening CellServDB
346    file and getting the realm-of-host for the first VL-server for the
347    cell.
348 
349    This does not work when the VL-server is living in one realm, but
350    the cell it is serving is living in another realm.
351 
352    Return 0 on success, -1 otherwise.
353    */
354 
355 int
356 _kafs_realm_of_cell(struct kafs_data *data,
357 		    const char *cell, char **realm)
358 {
359     char buf[1024];
360     int ret;
361 
362     ret = file_find_cell(data, cell, realm, 1);
363     if (ret == 0)
364 	return ret;
365     if (dns_find_cell(cell, buf, sizeof(buf)) == 0) {
366 	*realm = (*data->get_realm)(data, buf);
367 	if(*realm != NULL)
368 	    return 0;
369     }
370     return file_find_cell(data, cell, realm, 0);
371 }
372 
373 static int
374 _kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell,
375 		   const char *realm, uid_t uid, struct kafs_token *kt)
376 {
377     int ret;
378 
379     ret = (*data->get_cred)(data, user, cell, realm, uid, kt);
380     if (kafs_verbose) {
381 	char *str;
382 	asprintf(&str, "%s tried afs%s%s@%s -> %d",
383 		 data->name, cell[0] == '\0' ? "" : "/",
384 		 cell, realm, ret);
385 	(*kafs_verbose)(kafs_verbose_ctx, str);
386 	free(str);
387     }
388 
389     return ret;
390 }
391 
392 
393 int
394 _kafs_get_cred(struct kafs_data *data,
395 	       const char *cell,
396 	       const char *realm_hint,
397 	       const char *realm,
398 	       uid_t uid,
399 	       struct kafs_token *kt)
400 {
401     int ret = -1;
402     char *vl_realm;
403     char CELL[64];
404 
405     /* We're about to find the realm that holds the key for afs in
406      * the specified cell. The problem is that null-instance
407      * afs-principals are common and that hitting the wrong realm might
408      * yield the wrong afs key. The following assumptions were made.
409      *
410      * Any realm passed to us is preferred.
411      *
412      * If there is a realm with the same name as the cell, it is most
413      * likely the correct realm to talk to.
414      *
415      * In most (maybe even all) cases the database servers of the cell
416      * will live in the realm we are looking for.
417      *
418      * Try the local realm, but if the previous cases fail, this is
419      * really a long shot.
420      *
421      */
422 
423     /* comments on the ordering of these tests */
424 
425     /* If the user passes a realm, she probably knows something we don't
426      * know and we should try afs@realm_hint.
427      */
428 
429     if (realm_hint) {
430 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
431 				 cell, realm_hint, uid, kt);
432 	if (ret == 0) return 0;
433 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
434 				 "", realm_hint, uid, kt);
435 	if (ret == 0) return 0;
436     }
437 
438     _kafs_foldup(CELL, cell);
439 
440     /*
441      * If cell == realm we don't need no cross-cell authentication.
442      * Try afs@REALM.
443      */
444     if (strcmp(CELL, realm) == 0) {
445         ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
446 				 "", realm, uid, kt);
447 	if (ret == 0) return 0;
448 	/* Try afs.cell@REALM below. */
449     }
450 
451     /*
452      * If the AFS servers have a file /usr/afs/etc/krb.conf containing
453      * REALM we still don't have to resort to cross-cell authentication.
454      * Try afs.cell@REALM.
455      */
456     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
457 			     cell, realm, uid, kt);
458     if (ret == 0) return 0;
459 
460     /*
461      * We failed to get ``first class tickets'' for afs,
462      * fall back to cross-cell authentication.
463      * Try afs@CELL.
464      * Try afs.cell@CELL.
465      */
466     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
467 			     "", CELL, uid, kt);
468     if (ret == 0) return 0;
469     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
470 			     cell, CELL, uid, kt);
471     if (ret == 0) return 0;
472 
473     /*
474      * Perhaps the cell doesn't correspond to any realm?
475      * Use realm of first volume location DB server.
476      * Try afs.cell@VL_REALM.
477      * Try afs@VL_REALM???
478      */
479     if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0
480 	&& strcmp(vl_realm, realm) != 0
481 	&& strcmp(vl_realm, CELL) != 0) {
482 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
483 				 cell, vl_realm, uid, kt);
484 	if (ret)
485 	    ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
486 				     "", vl_realm, uid, kt);
487 	free(vl_realm);
488 	if (ret == 0) return 0;
489     }
490 
491     return ret;
492 }
493