1 /*- 2 * Copyright (c) 2008 Isilon Inc http://www.isilon.com/ 3 * Authors: Doug Rabson <dfr@rabson.org> 4 * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org> 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 __FBSDID("$FreeBSD$"); 30 31 #include <sys/param.h> 32 #include <sys/stat.h> 33 #include <sys/linker.h> 34 #include <sys/module.h> 35 #include <sys/queue.h> 36 #include <sys/syslog.h> 37 #include <ctype.h> 38 #include <err.h> 39 #include <pwd.h> 40 #include <stdio.h> 41 #include <stdlib.h> 42 #include <string.h> 43 #include <unistd.h> 44 #include <gssapi/gssapi.h> 45 #include <rpc/rpc.h> 46 #include <rpc/rpc_com.h> 47 48 #include "gssd.h" 49 50 #ifndef _PATH_GSS_MECH 51 #define _PATH_GSS_MECH "/etc/gss/mech" 52 #endif 53 #ifndef _PATH_GSSDSOCK 54 #define _PATH_GSSDSOCK "/var/run/gssd.sock" 55 #endif 56 57 struct gss_resource { 58 LIST_ENTRY(gss_resource) gr_link; 59 uint64_t gr_id; /* indentifier exported to kernel */ 60 void* gr_res; /* GSS-API resource pointer */ 61 }; 62 LIST_HEAD(gss_resource_list, gss_resource) gss_resources; 63 int gss_resource_count; 64 uint32_t gss_next_id; 65 uint32_t gss_start_time; 66 int debug_level; 67 68 static void gssd_load_mech(void); 69 70 extern void gssd_1(struct svc_req *rqstp, SVCXPRT *transp); 71 extern int gssd_syscall(char *path); 72 73 int 74 main(int argc, char **argv) 75 { 76 /* 77 * We provide an RPC service on a local-domain socket. The 78 * kernel's GSS-API code will pass what it can't handle 79 * directly to us. 80 */ 81 struct sockaddr_un sun; 82 int fd, oldmask, ch, debug; 83 SVCXPRT *xprt; 84 85 debug = 0; 86 while ((ch = getopt(argc, argv, "d")) != -1) { 87 switch (ch) { 88 case 'd': 89 debug_level++; 90 break; 91 default: 92 fprintf(stderr, "usage: %s [-d]\n", argv[0]); 93 exit(1); 94 break; 95 } 96 } 97 98 gssd_load_mech(); 99 100 if (!debug_level) 101 daemon(0, 0); 102 103 memset(&sun, 0, sizeof sun); 104 sun.sun_family = AF_LOCAL; 105 unlink(_PATH_GSSDSOCK); 106 strcpy(sun.sun_path, _PATH_GSSDSOCK); 107 sun.sun_len = SUN_LEN(&sun); 108 fd = socket(AF_LOCAL, SOCK_STREAM, 0); 109 if (!fd) { 110 if (debug_level == 0) { 111 syslog(LOG_ERR, "Can't create local gssd socket"); 112 exit(1); 113 } 114 err(1, "Can't create local gssd socket"); 115 } 116 oldmask = umask(S_IXUSR|S_IRWXG|S_IRWXO); 117 if (bind(fd, (struct sockaddr *) &sun, sun.sun_len) < 0) { 118 if (debug_level == 0) { 119 syslog(LOG_ERR, "Can't bind local gssd socket"); 120 exit(1); 121 } 122 err(1, "Can't bind local gssd socket"); 123 } 124 umask(oldmask); 125 if (listen(fd, SOMAXCONN) < 0) { 126 if (debug_level == 0) { 127 syslog(LOG_ERR, "Can't listen on local gssd socket"); 128 exit(1); 129 } 130 err(1, "Can't listen on local gssd socket"); 131 } 132 xprt = svc_vc_create(fd, RPC_MAXDATASIZE, RPC_MAXDATASIZE); 133 if (!xprt) { 134 if (debug_level == 0) { 135 syslog(LOG_ERR, 136 "Can't create transport for local gssd socket"); 137 exit(1); 138 } 139 err(1, "Can't create transport for local gssd socket"); 140 } 141 if (!svc_reg(xprt, GSSD, GSSDVERS, gssd_1, NULL)) { 142 if (debug_level == 0) { 143 syslog(LOG_ERR, 144 "Can't register service for local gssd socket"); 145 exit(1); 146 } 147 err(1, "Can't register service for local gssd socket"); 148 } 149 150 LIST_INIT(&gss_resources); 151 gss_next_id = 1; 152 gss_start_time = time(0); 153 154 gssd_syscall(_PATH_GSSDSOCK); 155 svc_run(); 156 157 return (0); 158 } 159 160 static void 161 gssd_load_mech(void) 162 { 163 FILE *fp; 164 char buf[256]; 165 char *p; 166 char *name, *oid, *lib, *kobj; 167 168 fp = fopen(_PATH_GSS_MECH, "r"); 169 if (!fp) 170 return; 171 172 while (fgets(buf, sizeof(buf), fp)) { 173 if (*buf == '#') 174 continue; 175 p = buf; 176 name = strsep(&p, "\t\n "); 177 if (p) while (isspace(*p)) p++; 178 oid = strsep(&p, "\t\n "); 179 if (p) while (isspace(*p)) p++; 180 lib = strsep(&p, "\t\n "); 181 if (p) while (isspace(*p)) p++; 182 kobj = strsep(&p, "\t\n "); 183 if (!name || !oid || !lib || !kobj) 184 continue; 185 186 if (strcmp(kobj, "-")) { 187 /* 188 * Attempt to load the kernel module if its 189 * not already present. 190 */ 191 if (modfind(kobj) < 0) { 192 if (kldload(kobj) < 0) { 193 fprintf(stderr, 194 "%s: can't find or load kernel module %s for %s\n", 195 getprogname(), kobj, name); 196 } 197 } 198 } 199 } 200 fclose(fp); 201 } 202 203 static void * 204 gssd_find_resource(uint64_t id) 205 { 206 struct gss_resource *gr; 207 208 if (!id) 209 return (NULL); 210 211 LIST_FOREACH(gr, &gss_resources, gr_link) 212 if (gr->gr_id == id) 213 return (gr->gr_res); 214 215 return (NULL); 216 } 217 218 static uint64_t 219 gssd_make_resource(void *res) 220 { 221 struct gss_resource *gr; 222 223 if (!res) 224 return (0); 225 226 gr = malloc(sizeof(struct gss_resource)); 227 if (!gr) 228 return (0); 229 gr->gr_id = (gss_next_id++) + ((uint64_t) gss_start_time << 32); 230 gr->gr_res = res; 231 LIST_INSERT_HEAD(&gss_resources, gr, gr_link); 232 gss_resource_count++; 233 if (debug_level > 1) 234 printf("%d resources allocated\n", gss_resource_count); 235 236 return (gr->gr_id); 237 } 238 239 static void 240 gssd_delete_resource(uint64_t id) 241 { 242 struct gss_resource *gr; 243 244 LIST_FOREACH(gr, &gss_resources, gr_link) { 245 if (gr->gr_id == id) { 246 LIST_REMOVE(gr, gr_link); 247 free(gr); 248 gss_resource_count--; 249 if (debug_level > 1) 250 printf("%d resources allocated\n", 251 gss_resource_count); 252 return; 253 } 254 } 255 } 256 257 bool_t 258 gssd_null_1_svc(void *argp, void *result, struct svc_req *rqstp) 259 { 260 261 return (TRUE); 262 } 263 264 bool_t 265 gssd_init_sec_context_1_svc(init_sec_context_args *argp, init_sec_context_res *result, struct svc_req *rqstp) 266 { 267 gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; 268 gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; 269 gss_name_t name = GSS_C_NO_NAME; 270 char ccname[strlen("FILE:/tmp/krb5cc_") + 6 + 1]; 271 272 snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d", 273 (int) argp->uid); 274 setenv("KRB5CCNAME", ccname, TRUE); 275 276 memset(result, 0, sizeof(*result)); 277 if (argp->cred) { 278 cred = gssd_find_resource(argp->cred); 279 if (!cred) { 280 result->major_status = GSS_S_CREDENTIALS_EXPIRED; 281 return (TRUE); 282 } 283 } 284 if (argp->ctx) { 285 ctx = gssd_find_resource(argp->ctx); 286 if (!ctx) { 287 result->major_status = GSS_S_CONTEXT_EXPIRED; 288 return (TRUE); 289 } 290 } 291 if (argp->name) { 292 name = gssd_find_resource(argp->name); 293 if (!name) { 294 result->major_status = GSS_S_BAD_NAME; 295 return (TRUE); 296 } 297 } 298 299 memset(result, 0, sizeof(*result)); 300 result->major_status = gss_init_sec_context(&result->minor_status, 301 cred, &ctx, name, argp->mech_type, 302 argp->req_flags, argp->time_req, argp->input_chan_bindings, 303 &argp->input_token, &result->actual_mech_type, 304 &result->output_token, &result->ret_flags, &result->time_rec); 305 306 if (result->major_status == GSS_S_COMPLETE 307 || result->major_status == GSS_S_CONTINUE_NEEDED) { 308 if (argp->ctx) 309 result->ctx = argp->ctx; 310 else 311 result->ctx = gssd_make_resource(ctx); 312 } 313 314 return (TRUE); 315 } 316 317 bool_t 318 gssd_accept_sec_context_1_svc(accept_sec_context_args *argp, accept_sec_context_res *result, struct svc_req *rqstp) 319 { 320 gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; 321 gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; 322 gss_name_t src_name; 323 gss_cred_id_t delegated_cred_handle; 324 325 memset(result, 0, sizeof(*result)); 326 if (argp->ctx) { 327 ctx = gssd_find_resource(argp->ctx); 328 if (!ctx) { 329 result->major_status = GSS_S_CONTEXT_EXPIRED; 330 return (TRUE); 331 } 332 } 333 if (argp->cred) { 334 cred = gssd_find_resource(argp->cred); 335 if (!cred) { 336 result->major_status = GSS_S_CREDENTIALS_EXPIRED; 337 return (TRUE); 338 } 339 } 340 341 memset(result, 0, sizeof(*result)); 342 result->major_status = gss_accept_sec_context(&result->minor_status, 343 &ctx, cred, &argp->input_token, argp->input_chan_bindings, 344 &src_name, &result->mech_type, &result->output_token, 345 &result->ret_flags, &result->time_rec, 346 &delegated_cred_handle); 347 348 if (result->major_status == GSS_S_COMPLETE 349 || result->major_status == GSS_S_CONTINUE_NEEDED) { 350 if (argp->ctx) 351 result->ctx = argp->ctx; 352 else 353 result->ctx = gssd_make_resource(ctx); 354 result->src_name = gssd_make_resource(src_name); 355 result->delegated_cred_handle = 356 gssd_make_resource(delegated_cred_handle); 357 } 358 359 return (TRUE); 360 } 361 362 bool_t 363 gssd_delete_sec_context_1_svc(delete_sec_context_args *argp, delete_sec_context_res *result, struct svc_req *rqstp) 364 { 365 gss_ctx_id_t ctx = gssd_find_resource(argp->ctx); 366 367 if (ctx) { 368 result->major_status = gss_delete_sec_context( 369 &result->minor_status, &ctx, &result->output_token); 370 gssd_delete_resource(argp->ctx); 371 } else { 372 result->major_status = GSS_S_COMPLETE; 373 result->minor_status = 0; 374 } 375 376 return (TRUE); 377 } 378 379 bool_t 380 gssd_export_sec_context_1_svc(export_sec_context_args *argp, export_sec_context_res *result, struct svc_req *rqstp) 381 { 382 gss_ctx_id_t ctx = gssd_find_resource(argp->ctx); 383 384 if (ctx) { 385 result->major_status = gss_export_sec_context( 386 &result->minor_status, &ctx, 387 &result->interprocess_token); 388 result->format = KGSS_HEIMDAL_1_1; 389 gssd_delete_resource(argp->ctx); 390 } else { 391 result->major_status = GSS_S_FAILURE; 392 result->minor_status = 0; 393 result->interprocess_token.length = 0; 394 result->interprocess_token.value = NULL; 395 } 396 397 return (TRUE); 398 } 399 400 bool_t 401 gssd_import_name_1_svc(import_name_args *argp, import_name_res *result, struct svc_req *rqstp) 402 { 403 gss_name_t name; 404 405 result->major_status = gss_import_name(&result->minor_status, 406 &argp->input_name_buffer, argp->input_name_type, &name); 407 408 if (result->major_status == GSS_S_COMPLETE) 409 result->output_name = gssd_make_resource(name); 410 else 411 result->output_name = 0; 412 413 return (TRUE); 414 } 415 416 bool_t 417 gssd_canonicalize_name_1_svc(canonicalize_name_args *argp, canonicalize_name_res *result, struct svc_req *rqstp) 418 { 419 gss_name_t name = gssd_find_resource(argp->input_name); 420 gss_name_t output_name; 421 422 memset(result, 0, sizeof(*result)); 423 if (!name) { 424 result->major_status = GSS_S_BAD_NAME; 425 return (TRUE); 426 } 427 428 result->major_status = gss_canonicalize_name(&result->minor_status, 429 name, argp->mech_type, &output_name); 430 431 if (result->major_status == GSS_S_COMPLETE) 432 result->output_name = gssd_make_resource(output_name); 433 else 434 result->output_name = 0; 435 436 return (TRUE); 437 } 438 439 bool_t 440 gssd_export_name_1_svc(export_name_args *argp, export_name_res *result, struct svc_req *rqstp) 441 { 442 gss_name_t name = gssd_find_resource(argp->input_name); 443 444 memset(result, 0, sizeof(*result)); 445 if (!name) { 446 result->major_status = GSS_S_BAD_NAME; 447 return (TRUE); 448 } 449 450 result->major_status = gss_export_name(&result->minor_status, 451 name, &result->exported_name); 452 453 return (TRUE); 454 } 455 456 bool_t 457 gssd_release_name_1_svc(release_name_args *argp, release_name_res *result, struct svc_req *rqstp) 458 { 459 gss_name_t name = gssd_find_resource(argp->input_name); 460 461 if (name) { 462 result->major_status = gss_release_name(&result->minor_status, 463 &name); 464 gssd_delete_resource(argp->input_name); 465 } else { 466 result->major_status = GSS_S_COMPLETE; 467 result->minor_status = 0; 468 } 469 470 return (TRUE); 471 } 472 473 bool_t 474 gssd_pname_to_uid_1_svc(pname_to_uid_args *argp, pname_to_uid_res *result, struct svc_req *rqstp) 475 { 476 gss_name_t name = gssd_find_resource(argp->pname); 477 uid_t uid; 478 char buf[128]; 479 struct passwd pwd, *pw; 480 481 memset(result, 0, sizeof(*result)); 482 if (name) { 483 result->major_status = 484 gss_pname_to_uid(&result->minor_status, 485 name, argp->mech, &uid); 486 if (result->major_status == GSS_S_COMPLETE) { 487 result->uid = uid; 488 getpwuid_r(uid, &pwd, buf, sizeof(buf), &pw); 489 if (pw) { 490 int len = NGRPS; 491 int groups[NGRPS]; 492 result->gid = pw->pw_gid; 493 getgrouplist(pw->pw_name, pw->pw_gid, 494 groups, &len); 495 result->gidlist.gidlist_len = len; 496 result->gidlist.gidlist_val = 497 mem_alloc(len * sizeof(int)); 498 memcpy(result->gidlist.gidlist_val, groups, 499 len * sizeof(int)); 500 } else { 501 result->gid = 65534; 502 result->gidlist.gidlist_len = 0; 503 result->gidlist.gidlist_val = NULL; 504 } 505 } 506 } else { 507 result->major_status = GSS_S_BAD_NAME; 508 result->minor_status = 0; 509 } 510 511 return (TRUE); 512 } 513 514 bool_t 515 gssd_acquire_cred_1_svc(acquire_cred_args *argp, acquire_cred_res *result, struct svc_req *rqstp) 516 { 517 gss_name_t desired_name = GSS_C_NO_NAME; 518 gss_cred_id_t cred; 519 char ccname[strlen("FILE:/tmp/krb5cc_") + 6 + 1]; 520 521 snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d", 522 (int) argp->uid); 523 setenv("KRB5CCNAME", ccname, TRUE); 524 525 memset(result, 0, sizeof(*result)); 526 if (argp->desired_name) { 527 desired_name = gssd_find_resource(argp->desired_name); 528 if (!desired_name) { 529 result->major_status = GSS_S_BAD_NAME; 530 return (TRUE); 531 } 532 } 533 534 result->major_status = gss_acquire_cred(&result->minor_status, 535 desired_name, argp->time_req, argp->desired_mechs, 536 argp->cred_usage, &cred, &result->actual_mechs, &result->time_rec); 537 538 if (result->major_status == GSS_S_COMPLETE) 539 result->output_cred = gssd_make_resource(cred); 540 else 541 result->output_cred = 0; 542 543 return (TRUE); 544 } 545 546 bool_t 547 gssd_set_cred_option_1_svc(set_cred_option_args *argp, set_cred_option_res *result, struct svc_req *rqstp) 548 { 549 gss_cred_id_t cred = gssd_find_resource(argp->cred); 550 551 memset(result, 0, sizeof(*result)); 552 if (!cred) { 553 result->major_status = GSS_S_CREDENTIALS_EXPIRED; 554 return (TRUE); 555 } 556 557 result->major_status = gss_set_cred_option(&result->minor_status, 558 &cred, argp->option_name, &argp->option_value); 559 560 return (TRUE); 561 } 562 563 bool_t 564 gssd_release_cred_1_svc(release_cred_args *argp, release_cred_res *result, struct svc_req *rqstp) 565 { 566 gss_cred_id_t cred = gssd_find_resource(argp->cred); 567 568 if (cred) { 569 result->major_status = gss_release_cred(&result->minor_status, 570 &cred); 571 gssd_delete_resource(argp->cred); 572 } else { 573 result->major_status = GSS_S_COMPLETE; 574 result->minor_status = 0; 575 } 576 577 return (TRUE); 578 } 579 580 bool_t 581 gssd_display_status_1_svc(display_status_args *argp, display_status_res *result, struct svc_req *rqstp) 582 { 583 584 result->message_context = argp->message_context; 585 result->major_status = gss_display_status(&result->minor_status, 586 argp->status_value, argp->status_type, argp->mech_type, 587 &result->message_context, &result->status_string); 588 589 return (TRUE); 590 } 591 592 int 593 gssd_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, caddr_t result) 594 { 595 /* 596 * We don't use XDR to free the results - anything which was 597 * allocated came from GSS-API. We use xdr_result to figure 598 * out what to do. 599 */ 600 OM_uint32 junk; 601 602 if (xdr_result == (xdrproc_t) xdr_init_sec_context_res) { 603 init_sec_context_res *p = (init_sec_context_res *) result; 604 gss_release_buffer(&junk, &p->output_token); 605 } else if (xdr_result == (xdrproc_t) xdr_accept_sec_context_res) { 606 accept_sec_context_res *p = (accept_sec_context_res *) result; 607 gss_release_buffer(&junk, &p->output_token); 608 } else if (xdr_result == (xdrproc_t) xdr_delete_sec_context_res) { 609 delete_sec_context_res *p = (delete_sec_context_res *) result; 610 gss_release_buffer(&junk, &p->output_token); 611 } else if (xdr_result == (xdrproc_t) xdr_export_sec_context_res) { 612 export_sec_context_res *p = (export_sec_context_res *) result; 613 if (p->interprocess_token.length) 614 memset(p->interprocess_token.value, 0, 615 p->interprocess_token.length); 616 gss_release_buffer(&junk, &p->interprocess_token); 617 } else if (xdr_result == (xdrproc_t) xdr_export_name_res) { 618 export_name_res *p = (export_name_res *) result; 619 gss_release_buffer(&junk, &p->exported_name); 620 } else if (xdr_result == (xdrproc_t) xdr_acquire_cred_res) { 621 acquire_cred_res *p = (acquire_cred_res *) result; 622 gss_release_oid_set(&junk, &p->actual_mechs); 623 } else if (xdr_result == (xdrproc_t) xdr_pname_to_uid_res) { 624 pname_to_uid_res *p = (pname_to_uid_res *) result; 625 if (p->gidlist.gidlist_val) 626 free(p->gidlist.gidlist_val); 627 } else if (xdr_result == (xdrproc_t) xdr_display_status_res) { 628 display_status_res *p = (display_status_res *) result; 629 gss_release_buffer(&junk, &p->status_string); 630 } 631 632 return (TRUE); 633 } 634