xref: /freebsd/crypto/heimdal/lib/kafs/common.c (revision dd41de95a84d979615a2ef11df6850622bf6184e)
1 /*
2  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "kafs_locl.h"
35 
36 #define AUTH_SUPERUSER "afs"
37 
38 /*
39  * Here only ASCII characters are relevant.
40  */
41 
42 #define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z')
43 
44 #define ToAsciiUpper(c) ((c) - 'a' + 'A')
45 
46 static void (*kafs_verbose)(void *, const char *);
47 static void *kafs_verbose_ctx;
48 
49 void
50 _kafs_foldup(char *a, const char *b)
51 {
52   for (; *b; a++, b++)
53     if (IsAsciiLower(*b))
54       *a = ToAsciiUpper(*b);
55     else
56       *a = *b;
57   *a = '\0';
58 }
59 
60 void
61 kafs_set_verbose(void (*f)(void *, const char *), void *ctx)
62 {
63     if (f) {
64 	kafs_verbose = f;
65 	kafs_verbose_ctx = ctx;
66     }
67 }
68 
69 int
70 kafs_settoken_rxkad(const char *cell, struct ClearToken *ct,
71 		    void *ticket, size_t ticket_len)
72 {
73     struct ViceIoctl parms;
74     char buf[2048], *t;
75     int32_t sizeof_x;
76 
77     t = buf;
78     /*
79      * length of secret token followed by secret token
80      */
81     sizeof_x = ticket_len;
82     memcpy(t, &sizeof_x, sizeof(sizeof_x));
83     t += sizeof(sizeof_x);
84     memcpy(t, ticket, sizeof_x);
85     t += sizeof_x;
86     /*
87      * length of clear token followed by clear token
88      */
89     sizeof_x = sizeof(*ct);
90     memcpy(t, &sizeof_x, sizeof(sizeof_x));
91     t += sizeof(sizeof_x);
92     memcpy(t, ct, sizeof_x);
93     t += sizeof_x;
94 
95     /*
96      * do *not* mark as primary cell
97      */
98     sizeof_x = 0;
99     memcpy(t, &sizeof_x, sizeof(sizeof_x));
100     t += sizeof(sizeof_x);
101     /*
102      * follow with cell name
103      */
104     sizeof_x = strlen(cell) + 1;
105     memcpy(t, cell, sizeof_x);
106     t += sizeof_x;
107 
108     /*
109      * Build argument block
110      */
111     parms.in = buf;
112     parms.in_size = t - buf;
113     parms.out = 0;
114     parms.out_size = 0;
115 
116     return k_pioctl(0, VIOCSETTOK, &parms, 0);
117 }
118 
119 void
120 _kafs_fixup_viceid(struct ClearToken *ct, uid_t uid)
121 {
122 #define ODD(x) ((x) & 1)
123     /* According to Transarc conventions ViceId is valid iff
124      * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime
125      * the transformations:
126      *
127      * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life)
128      * preserves the original values.
129      */
130     if (uid != 0)		/* valid ViceId */
131     {
132 	if (!ODD(ct->EndTimestamp - ct->BeginTimestamp))
133 	    ct->EndTimestamp--;
134     }
135     else			/* not valid ViceId */
136     {
137 	if (ODD(ct->EndTimestamp - ct->BeginTimestamp))
138 	    ct->EndTimestamp--;
139     }
140 }
141 
142 /* Try to get a db-server for an AFS cell from a AFSDB record */
143 
144 static int
145 dns_find_cell(const char *cell, char *dbserver, size_t len)
146 {
147     struct rk_dns_reply *r;
148     int ok = -1;
149     r = rk_dns_lookup(cell, "afsdb");
150     if(r){
151 	struct rk_resource_record *rr = r->head;
152 	while(rr){
153 	    if(rr->type == rk_ns_t_afsdb && rr->u.afsdb->preference == 1){
154 		strlcpy(dbserver,
155 				rr->u.afsdb->domain,
156 				len);
157 		ok = 0;
158 		break;
159 	    }
160 	    rr = rr->next;
161 	}
162 	rk_dns_free_data(r);
163     }
164     return ok;
165 }
166 
167 
168 /*
169  * Try to find the cells we should try to klog to in "file".
170  */
171 static void
172 find_cells(const char *file, char ***cells, int *idx)
173 {
174     FILE *f;
175     char cell[64];
176     int i;
177     int ind = *idx;
178 
179     f = fopen(file, "r");
180     if (f == NULL)
181 	return;
182     while (fgets(cell, sizeof(cell), f)) {
183 	char *t;
184 	t = cell + strlen(cell);
185 	for (; t >= cell; t--)
186 	  if (*t == '\n' || *t == '\t' || *t == ' ')
187 	    *t = 0;
188 	if (cell[0] == '\0' || cell[0] == '#')
189 	    continue;
190 	for(i = 0; i < ind; i++)
191 	    if(strcmp((*cells)[i], cell) == 0)
192 		break;
193 	if(i == ind){
194 	    char **tmp;
195 
196 	    tmp = realloc(*cells, (ind + 1) * sizeof(**cells));
197 	    if (tmp == NULL)
198 		break;
199 	    *cells = tmp;
200 	    (*cells)[ind] = strdup(cell);
201 	    if ((*cells)[ind] == NULL)
202 		break;
203 	    ++ind;
204 	}
205     }
206     fclose(f);
207     *idx = ind;
208 }
209 
210 /*
211  * Get tokens for all cells[]
212  */
213 static int
214 afslog_cells(struct kafs_data *data, char **cells, int max, uid_t uid,
215 	     const char *homedir)
216 {
217     int ret = 0;
218     int i;
219     for (i = 0; i < max; i++) {
220         int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir);
221 	if (er)
222 	    ret = er;
223     }
224     return ret;
225 }
226 
227 int
228 _kafs_afslog_all_local_cells(struct kafs_data *data,
229 			     uid_t uid, const char *homedir)
230 {
231     int ret;
232     char **cells = NULL;
233     int idx = 0;
234 
235     if (homedir == NULL)
236 	homedir = getenv("HOME");
237     if (homedir != NULL) {
238 	char home[MaxPathLen];
239 	snprintf(home, sizeof(home), "%s/.TheseCells", homedir);
240 	find_cells(home, &cells, &idx);
241     }
242     find_cells(_PATH_THESECELLS, &cells, &idx);
243     find_cells(_PATH_THISCELL, &cells, &idx);
244     find_cells(_PATH_ARLA_THESECELLS, &cells, &idx);
245     find_cells(_PATH_ARLA_THISCELL, &cells, &idx);
246     find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &idx);
247     find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &idx);
248     find_cells(_PATH_OPENAFS_MACOSX_THESECELLS, &cells, &idx);
249     find_cells(_PATH_OPENAFS_MACOSX_THISCELL, &cells, &idx);
250     find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &idx);
251     find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &idx);
252     find_cells(_PATH_ARLA_OPENBSD_THESECELLS, &cells, &idx);
253     find_cells(_PATH_ARLA_OPENBSD_THISCELL, &cells, &idx);
254 
255     ret = afslog_cells(data, cells, idx, uid, homedir);
256     while(idx > 0)
257 	free(cells[--idx]);
258     free(cells);
259     return ret;
260 }
261 
262 
263 static int
264 file_find_cell(struct kafs_data *data,
265 	       const char *cell, char **realm, int exact)
266 {
267     FILE *F;
268     char buf[1024];
269     char *p;
270     int ret = -1;
271 
272     if ((F = fopen(_PATH_CELLSERVDB, "r"))
273 	|| (F = fopen(_PATH_ARLA_CELLSERVDB, "r"))
274 	|| (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r"))
275 	|| (F = fopen(_PATH_OPENAFS_MACOSX_CELLSERVDB, "r"))
276 	|| (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) {
277 	while (fgets(buf, sizeof(buf), F)) {
278 	    int cmp;
279 
280 	    if (buf[0] != '>')
281 		continue; /* Not a cell name line, try next line */
282 	    p = buf;
283 	    strsep(&p, " \t\n#");
284 
285 	    if (exact)
286 		cmp = strcmp(buf + 1, cell);
287 	    else
288 		cmp = strncmp(buf + 1, cell, strlen(cell));
289 
290 	    if (cmp == 0) {
291 		/*
292 		 * We found the cell name we're looking for.
293 		 * Read next line on the form ip-address '#' hostname
294 		 */
295 		if (fgets(buf, sizeof(buf), F) == NULL)
296 		    break;	/* Read failed, give up */
297 		p = strchr(buf, '#');
298 		if (p == NULL)
299 		    break;	/* No '#', give up */
300 		p++;
301 		if (buf[strlen(buf) - 1] == '\n')
302 		    buf[strlen(buf) - 1] = '\0';
303 		*realm = (*data->get_realm)(data, p);
304 		if (*realm && **realm != '\0')
305 		    ret = 0;
306 		break;		/* Won't try any more */
307 	    }
308 	}
309 	fclose(F);
310     }
311     return ret;
312 }
313 
314 /* Find the realm associated with cell. Do this by opening CellServDB
315    file and getting the realm-of-host for the first VL-server for the
316    cell.
317 
318    This does not work when the VL-server is living in one realm, but
319    the cell it is serving is living in another realm.
320 
321    Return 0 on success, -1 otherwise.
322    */
323 
324 int
325 _kafs_realm_of_cell(struct kafs_data *data,
326 		    const char *cell, char **realm)
327 {
328     char buf[1024];
329     int ret;
330 
331     ret = file_find_cell(data, cell, realm, 1);
332     if (ret == 0)
333 	return ret;
334     if (dns_find_cell(cell, buf, sizeof(buf)) == 0) {
335 	*realm = (*data->get_realm)(data, buf);
336 	if(*realm != NULL)
337 	    return 0;
338     }
339     return file_find_cell(data, cell, realm, 0);
340 }
341 
342 static int
343 _kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell,
344 		   const char *realm, uid_t uid, struct kafs_token *kt)
345 {
346     int ret;
347 
348     ret = (*data->get_cred)(data, user, cell, realm, uid, kt);
349     if (kafs_verbose) {
350 	const char *estr = (*data->get_error)(data, ret);
351 	char *str;
352 	asprintf(&str, "%s tried afs%s%s@%s -> %s (%d)",
353 		 data->name, cell ? "/" : "",
354 		 cell ? cell : "", realm, estr ? estr : "unknown", ret);
355 	(*kafs_verbose)(kafs_verbose_ctx, str);
356 	if (estr)
357 	    (*data->free_error)(data, estr);
358 	free(str);
359     }
360 
361     return ret;
362 }
363 
364 
365 int
366 _kafs_get_cred(struct kafs_data *data,
367 	       const char *cell,
368 	       const char *realm_hint,
369 	       const char *realm,
370 	       uid_t uid,
371 	       struct kafs_token *kt)
372 {
373     int ret = -1;
374     char *vl_realm;
375     char CELL[64];
376 
377     /* We're about to find the realm that holds the key for afs in
378      * the specified cell. The problem is that null-instance
379      * afs-principals are common and that hitting the wrong realm might
380      * yield the wrong afs key. The following assumptions were made.
381      *
382      * Any realm passed to us is preferred.
383      *
384      * If there is a realm with the same name as the cell, it is most
385      * likely the correct realm to talk to.
386      *
387      * In most (maybe even all) cases the database servers of the cell
388      * will live in the realm we are looking for.
389      *
390      * Try the local realm, but if the previous cases fail, this is
391      * really a long shot.
392      *
393      */
394 
395     /* comments on the ordering of these tests */
396 
397     /* If the user passes a realm, she probably knows something we don't
398      * know and we should try afs@realm_hint.
399      */
400 
401     if (realm_hint) {
402 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
403 				 cell, realm_hint, uid, kt);
404 	if (ret == 0) return 0;
405 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
406 				 NULL, realm_hint, uid, kt);
407 	if (ret == 0) return 0;
408     }
409 
410     _kafs_foldup(CELL, cell);
411 
412     /*
413      * If the AFS servers have a file /usr/afs/etc/krb.conf containing
414      * REALM we still don't have to resort to cross-cell authentication.
415      * Try afs.cell@REALM.
416      */
417     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
418 			     cell, realm, uid, kt);
419     if (ret == 0) return 0;
420 
421     /*
422      * If cell == realm we don't need no cross-cell authentication.
423      * Try afs@REALM.
424      */
425     if (strcmp(CELL, realm) == 0) {
426         ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
427 				 NULL, realm, uid, kt);
428 	if (ret == 0) return 0;
429     }
430 
431     /*
432      * We failed to get ``first class tickets'' for afs,
433      * fall back to cross-cell authentication.
434      * Try afs@CELL.
435      * Try afs.cell@CELL.
436      */
437     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
438 			     NULL, CELL, uid, kt);
439     if (ret == 0) return 0;
440     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
441 			     cell, CELL, uid, kt);
442     if (ret == 0) return 0;
443 
444     /*
445      * Perhaps the cell doesn't correspond to any realm?
446      * Use realm of first volume location DB server.
447      * Try afs.cell@VL_REALM.
448      * Try afs@VL_REALM???
449      */
450     if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0
451 	&& strcmp(vl_realm, realm) != 0
452 	&& strcmp(vl_realm, CELL) != 0) {
453 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
454 				 cell, vl_realm, uid, kt);
455 	if (ret)
456 	    ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
457 				     NULL, vl_realm, uid, kt);
458 	free(vl_realm);
459 	if (ret == 0) return 0;
460     }
461 
462     return ret;
463 }
464