1 /* 2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "kafs_locl.h" 35 36 #define AUTH_SUPERUSER "afs" 37 38 /* 39 * Here only ASCII characters are relevant. 40 */ 41 42 #define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z') 43 44 #define ToAsciiUpper(c) ((c) - 'a' + 'A') 45 46 static void (*kafs_verbose)(void *, const char *); 47 static void *kafs_verbose_ctx; 48 49 void 50 _kafs_foldup(char *a, const char *b) 51 { 52 for (; *b; a++, b++) 53 if (IsAsciiLower(*b)) 54 *a = ToAsciiUpper(*b); 55 else 56 *a = *b; 57 *a = '\0'; 58 } 59 60 void 61 kafs_set_verbose(void (*f)(void *, const char *), void *ctx) 62 { 63 if (f) { 64 kafs_verbose = f; 65 kafs_verbose_ctx = ctx; 66 } 67 } 68 69 int 70 kafs_settoken_rxkad(const char *cell, struct ClearToken *ct, 71 void *ticket, size_t ticket_len) 72 { 73 struct ViceIoctl parms; 74 char buf[2048], *t; 75 int32_t sizeof_x; 76 77 t = buf; 78 /* 79 * length of secret token followed by secret token 80 */ 81 sizeof_x = ticket_len; 82 memcpy(t, &sizeof_x, sizeof(sizeof_x)); 83 t += sizeof(sizeof_x); 84 memcpy(t, ticket, sizeof_x); 85 t += sizeof_x; 86 /* 87 * length of clear token followed by clear token 88 */ 89 sizeof_x = sizeof(*ct); 90 memcpy(t, &sizeof_x, sizeof(sizeof_x)); 91 t += sizeof(sizeof_x); 92 memcpy(t, ct, sizeof_x); 93 t += sizeof_x; 94 95 /* 96 * do *not* mark as primary cell 97 */ 98 sizeof_x = 0; 99 memcpy(t, &sizeof_x, sizeof(sizeof_x)); 100 t += sizeof(sizeof_x); 101 /* 102 * follow with cell name 103 */ 104 sizeof_x = strlen(cell) + 1; 105 memcpy(t, cell, sizeof_x); 106 t += sizeof_x; 107 108 /* 109 * Build argument block 110 */ 111 parms.in = buf; 112 parms.in_size = t - buf; 113 parms.out = 0; 114 parms.out_size = 0; 115 116 return k_pioctl(0, VIOCSETTOK, &parms, 0); 117 } 118 119 void 120 _kafs_fixup_viceid(struct ClearToken *ct, uid_t uid) 121 { 122 #define ODD(x) ((x) & 1) 123 /* According to Transarc conventions ViceId is valid iff 124 * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime 125 * the transformations: 126 * 127 * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life) 128 * preserves the original values. 129 */ 130 if (uid != 0) /* valid ViceId */ 131 { 132 if (!ODD(ct->EndTimestamp - ct->BeginTimestamp)) 133 ct->EndTimestamp--; 134 } 135 else /* not valid ViceId */ 136 { 137 if (ODD(ct->EndTimestamp - ct->BeginTimestamp)) 138 ct->EndTimestamp--; 139 } 140 } 141 142 /* Try to get a db-server for an AFS cell from a AFSDB record */ 143 144 static int 145 dns_find_cell(const char *cell, char *dbserver, size_t len) 146 { 147 struct rk_dns_reply *r; 148 int ok = -1; 149 r = rk_dns_lookup(cell, "afsdb"); 150 if(r){ 151 struct rk_resource_record *rr = r->head; 152 while(rr){ 153 if(rr->type == rk_ns_t_afsdb && rr->u.afsdb->preference == 1){ 154 strlcpy(dbserver, 155 rr->u.afsdb->domain, 156 len); 157 ok = 0; 158 break; 159 } 160 rr = rr->next; 161 } 162 rk_dns_free_data(r); 163 } 164 return ok; 165 } 166 167 168 /* 169 * Try to find the cells we should try to klog to in "file". 170 */ 171 static void 172 find_cells(const char *file, char ***cells, int *idx) 173 { 174 FILE *f; 175 char cell[64]; 176 int i; 177 int ind = *idx; 178 179 f = fopen(file, "r"); 180 if (f == NULL) 181 return; 182 while (fgets(cell, sizeof(cell), f)) { 183 char *t; 184 t = cell + strlen(cell); 185 for (; t >= cell; t--) 186 if (*t == '\n' || *t == '\t' || *t == ' ') 187 *t = 0; 188 if (cell[0] == '\0' || cell[0] == '#') 189 continue; 190 for(i = 0; i < ind; i++) 191 if(strcmp((*cells)[i], cell) == 0) 192 break; 193 if(i == ind){ 194 char **tmp; 195 196 tmp = realloc(*cells, (ind + 1) * sizeof(**cells)); 197 if (tmp == NULL) 198 break; 199 *cells = tmp; 200 (*cells)[ind] = strdup(cell); 201 if ((*cells)[ind] == NULL) 202 break; 203 ++ind; 204 } 205 } 206 fclose(f); 207 *idx = ind; 208 } 209 210 /* 211 * Get tokens for all cells[] 212 */ 213 static int 214 afslog_cells(struct kafs_data *data, char **cells, int max, uid_t uid, 215 const char *homedir) 216 { 217 int ret = 0; 218 int i; 219 for (i = 0; i < max; i++) { 220 int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir); 221 if (er) 222 ret = er; 223 } 224 return ret; 225 } 226 227 int 228 _kafs_afslog_all_local_cells(struct kafs_data *data, 229 uid_t uid, const char *homedir) 230 { 231 int ret; 232 char **cells = NULL; 233 int idx = 0; 234 235 if (homedir == NULL) 236 homedir = getenv("HOME"); 237 if (homedir != NULL) { 238 char home[MaxPathLen]; 239 snprintf(home, sizeof(home), "%s/.TheseCells", homedir); 240 find_cells(home, &cells, &idx); 241 } 242 find_cells(_PATH_THESECELLS, &cells, &idx); 243 find_cells(_PATH_THISCELL, &cells, &idx); 244 find_cells(_PATH_ARLA_THESECELLS, &cells, &idx); 245 find_cells(_PATH_ARLA_THISCELL, &cells, &idx); 246 find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &idx); 247 find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &idx); 248 find_cells(_PATH_OPENAFS_MACOSX_THESECELLS, &cells, &idx); 249 find_cells(_PATH_OPENAFS_MACOSX_THISCELL, &cells, &idx); 250 find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &idx); 251 find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &idx); 252 find_cells(_PATH_ARLA_OPENBSD_THESECELLS, &cells, &idx); 253 find_cells(_PATH_ARLA_OPENBSD_THISCELL, &cells, &idx); 254 255 ret = afslog_cells(data, cells, idx, uid, homedir); 256 while(idx > 0) 257 free(cells[--idx]); 258 free(cells); 259 return ret; 260 } 261 262 263 static int 264 file_find_cell(struct kafs_data *data, 265 const char *cell, char **realm, int exact) 266 { 267 FILE *F; 268 char buf[1024]; 269 char *p; 270 int ret = -1; 271 272 if ((F = fopen(_PATH_CELLSERVDB, "r")) 273 || (F = fopen(_PATH_ARLA_CELLSERVDB, "r")) 274 || (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r")) 275 || (F = fopen(_PATH_OPENAFS_MACOSX_CELLSERVDB, "r")) 276 || (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) { 277 while (fgets(buf, sizeof(buf), F)) { 278 int cmp; 279 280 if (buf[0] != '>') 281 continue; /* Not a cell name line, try next line */ 282 p = buf; 283 strsep(&p, " \t\n#"); 284 285 if (exact) 286 cmp = strcmp(buf + 1, cell); 287 else 288 cmp = strncmp(buf + 1, cell, strlen(cell)); 289 290 if (cmp == 0) { 291 /* 292 * We found the cell name we're looking for. 293 * Read next line on the form ip-address '#' hostname 294 */ 295 if (fgets(buf, sizeof(buf), F) == NULL) 296 break; /* Read failed, give up */ 297 p = strchr(buf, '#'); 298 if (p == NULL) 299 break; /* No '#', give up */ 300 p++; 301 if (buf[strlen(buf) - 1] == '\n') 302 buf[strlen(buf) - 1] = '\0'; 303 *realm = (*data->get_realm)(data, p); 304 if (*realm && **realm != '\0') 305 ret = 0; 306 break; /* Won't try any more */ 307 } 308 } 309 fclose(F); 310 } 311 return ret; 312 } 313 314 /* Find the realm associated with cell. Do this by opening CellServDB 315 file and getting the realm-of-host for the first VL-server for the 316 cell. 317 318 This does not work when the VL-server is living in one realm, but 319 the cell it is serving is living in another realm. 320 321 Return 0 on success, -1 otherwise. 322 */ 323 324 int 325 _kafs_realm_of_cell(struct kafs_data *data, 326 const char *cell, char **realm) 327 { 328 char buf[1024]; 329 int ret; 330 331 ret = file_find_cell(data, cell, realm, 1); 332 if (ret == 0) 333 return ret; 334 if (dns_find_cell(cell, buf, sizeof(buf)) == 0) { 335 *realm = (*data->get_realm)(data, buf); 336 if(*realm != NULL) 337 return 0; 338 } 339 return file_find_cell(data, cell, realm, 0); 340 } 341 342 static int 343 _kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell, 344 const char *realm, uid_t uid, struct kafs_token *kt) 345 { 346 int ret; 347 348 ret = (*data->get_cred)(data, user, cell, realm, uid, kt); 349 if (kafs_verbose) { 350 const char *estr = (*data->get_error)(data, ret); 351 char *str; 352 asprintf(&str, "%s tried afs%s%s@%s -> %s (%d)", 353 data->name, cell ? "/" : "", 354 cell ? cell : "", realm, estr ? estr : "unknown", ret); 355 (*kafs_verbose)(kafs_verbose_ctx, str); 356 if (estr) 357 (*data->free_error)(data, estr); 358 free(str); 359 } 360 361 return ret; 362 } 363 364 365 int 366 _kafs_get_cred(struct kafs_data *data, 367 const char *cell, 368 const char *realm_hint, 369 const char *realm, 370 uid_t uid, 371 struct kafs_token *kt) 372 { 373 int ret = -1; 374 char *vl_realm; 375 char CELL[64]; 376 377 /* We're about to find the realm that holds the key for afs in 378 * the specified cell. The problem is that null-instance 379 * afs-principals are common and that hitting the wrong realm might 380 * yield the wrong afs key. The following assumptions were made. 381 * 382 * Any realm passed to us is preferred. 383 * 384 * If there is a realm with the same name as the cell, it is most 385 * likely the correct realm to talk to. 386 * 387 * In most (maybe even all) cases the database servers of the cell 388 * will live in the realm we are looking for. 389 * 390 * Try the local realm, but if the previous cases fail, this is 391 * really a long shot. 392 * 393 */ 394 395 /* comments on the ordering of these tests */ 396 397 /* If the user passes a realm, she probably knows something we don't 398 * know and we should try afs@realm_hint. 399 */ 400 401 if (realm_hint) { 402 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 403 cell, realm_hint, uid, kt); 404 if (ret == 0) return 0; 405 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 406 NULL, realm_hint, uid, kt); 407 if (ret == 0) return 0; 408 } 409 410 _kafs_foldup(CELL, cell); 411 412 /* 413 * If the AFS servers have a file /usr/afs/etc/krb.conf containing 414 * REALM we still don't have to resort to cross-cell authentication. 415 * Try afs.cell@REALM. 416 */ 417 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 418 cell, realm, uid, kt); 419 if (ret == 0) return 0; 420 421 /* 422 * If cell == realm we don't need no cross-cell authentication. 423 * Try afs@REALM. 424 */ 425 if (strcmp(CELL, realm) == 0) { 426 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 427 NULL, realm, uid, kt); 428 if (ret == 0) return 0; 429 } 430 431 /* 432 * We failed to get ``first class tickets'' for afs, 433 * fall back to cross-cell authentication. 434 * Try afs@CELL. 435 * Try afs.cell@CELL. 436 */ 437 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 438 NULL, CELL, uid, kt); 439 if (ret == 0) return 0; 440 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 441 cell, CELL, uid, kt); 442 if (ret == 0) return 0; 443 444 /* 445 * Perhaps the cell doesn't correspond to any realm? 446 * Use realm of first volume location DB server. 447 * Try afs.cell@VL_REALM. 448 * Try afs@VL_REALM??? 449 */ 450 if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0 451 && strcmp(vl_realm, realm) != 0 452 && strcmp(vl_realm, CELL) != 0) { 453 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 454 cell, vl_realm, uid, kt); 455 if (ret) 456 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 457 NULL, vl_realm, uid, kt); 458 free(vl_realm); 459 if (ret == 0) return 0; 460 } 461 462 return ret; 463 } 464