xref: /illumos-gate/usr/src/lib/libgss/gssd_pname_to_uid.c (revision ad091ee10b4de077c116313fba8195f16565e722)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <pwd.h>
27 #include <grp.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <unistd.h>
31 #include <thread.h>
32 #include <synch.h>
33 #include <syslog.h>
34 #include <deflt.h>
35 #include <mechglueP.h>
36 #include "../../cmd/gss/gsscred/gsscred.h"
37 
38 static mutex_t uid_map_lock = DEFAULTMUTEX;
39 static int uid_map_opt = 0;
40 
41 extern int _getgroupsbymember(const char *, gid_t[], int, int);
42 
43 /* local function used to call a mechanisms pname_to_uid */
44 static OM_uint32 gss_pname_to_uid(OM_uint32*, const gss_name_t,
45 			const gss_OID, uid_t *);
46 
47 static OM_uint32 private_gsscred_expname_to_unix_cred(const gss_buffer_t,
48 			uid_t *, gid_t *, gid_t **, int *);
49 
50 /*
51  * The gsscred functions will first attempt to call the
52  * mechanism'm pname_to_uid function.  In case this function
53  * returns an error or if it is not provided by a mechanism
54  * then the functions will attempt to look up the principal
55  * in the gsscred table.
56  * It is envisioned that the pname_to_uid function will be
57  * provided by only a few mechanism, which may have the principal
58  * name to unix credential mapping inherently present.
59  */
60 
61 /*
62  * Fetch gsscred options from conf file.
63  */
64 static void
65 get_conf_options(int *uid_map)
66 {
67 	int  flags;
68 	char *ptr;
69 	void	*defp;
70 	static char *conffile = "/etc/gss/gsscred.conf";
71 
72 	*uid_map = 0;
73 	if ((defp = defopen_r(conffile)) != NULL) {
74 		flags = defcntl_r(DC_GETFLAGS, 0, defp);
75 		/* ignore case */
76 		TURNOFF(flags, DC_CASE);
77 		(void) defcntl_r(DC_SETFLAGS, flags, defp);
78 
79 		if ((ptr = defread_r("SYSLOG_UID_MAPPING=", defp)) != NULL &&
80 		    strcasecmp("yes", ptr) == 0) {
81 			*uid_map = 1;
82 		}
83 		defclose_r(defp);
84 	}
85 }
86 
87 void
88 gsscred_set_options()
89 {
90 	int u;
91 
92 	get_conf_options(&u);
93 	(void) mutex_lock(&uid_map_lock);
94 	uid_map_opt = u;
95 	(void) mutex_unlock(&uid_map_lock);
96 }
97 
98 static int
99 get_uid_map_opt()
100 {
101 	int u;
102 
103 	(void) mutex_lock(&uid_map_lock);
104 	u = uid_map_opt;
105 	(void) mutex_unlock(&uid_map_lock);
106 	return (u);
107 }
108 
109 /*
110  * This routine accepts a name in export name format and retrieves
111  * unix credentials associated with it.
112  */
113 
114 OM_uint32
115 gsscred_expname_to_unix_cred_ext(
116 	const gss_buffer_t expName,
117 	uid_t *uidOut,
118 	gid_t *gidOut,
119 	gid_t *gids[],
120 	int *gidsLen,
121 	int try_mech)
122 {
123 	gss_name_t intName;
124 	OM_uint32 minor, major;
125 	const char *mechStr = NULL;
126 	char *nameStr = NULL;
127 	char *whoami = "gsscred_expname_to_unix_cred";
128 	gss_buffer_desc namebuf;
129 	int debug = get_uid_map_opt();
130 
131 	if (uidOut == NULL)
132 		return (GSS_S_CALL_INACCESSIBLE_WRITE);
133 
134 	if (expName == NULL)
135 		return (GSS_S_CALL_INACCESSIBLE_READ);
136 
137 	/* first check the mechanism for the mapping */
138 	if (gss_import_name(&minor, expName, (gss_OID)GSS_C_NT_EXPORT_NAME,
139 	    &intName) == GSS_S_COMPLETE) {
140 
141 		if (debug) {
142 			gss_union_name_t uintName = (gss_union_name_t)intName;
143 
144 			if (uintName->mech_type)
145 				mechStr = __gss_oid_to_mech(
146 				    uintName->mech_type);
147 
148 			major = gss_display_name(&minor, intName,
149 			    &namebuf, NULL);
150 			if (major == GSS_S_COMPLETE) {
151 				nameStr = strdup(namebuf.value);
152 				(void) gss_release_buffer(&minor, &namebuf);
153 			}
154 		}
155 
156 		if (try_mech) {
157 			major = gss_pname_to_uid(&minor, intName,
158 			    NULL, uidOut);
159 			if (major == GSS_S_COMPLETE) {
160 
161 				if (debug) {
162 					syslog(LOG_AUTH|LOG_DEBUG,
163 					    "%s: mech provided local name"
164 					    " mapping (%s, %s, %d)", whoami,
165 					    mechStr ? mechStr : "<null>",
166 					    nameStr ? nameStr : "<null>",
167 					    *uidOut);
168 					free(nameStr);
169 				}
170 
171 				(void) gss_release_name(&minor, &intName);
172 				if (gids && gidsLen && gidOut)
173 					return (gss_get_group_info(*uidOut,
174 					    gidOut, gids, gidsLen));
175 				return (GSS_S_COMPLETE);
176 			}
177 		}
178 
179 		(void) gss_release_name(&minor, &intName);
180 	}
181 
182 	/*
183 	 * we fall back onto the gsscred table to provide the mapping
184 	 * start by making sure that the expName is an export name buffer
185 	 */
186 	major = private_gsscred_expname_to_unix_cred(expName, uidOut, gidOut,
187 	    gids, gidsLen);
188 
189 	if (debug && major == GSS_S_COMPLETE) {
190 		syslog(LOG_AUTH|LOG_DEBUG,
191 		    "%s: gsscred tbl provided"
192 		    " local name mapping (%s, %s, %d)",
193 		    whoami,
194 		    mechStr ? mechStr : "<unknown>",
195 		    nameStr ? nameStr : "<unknown>",
196 		    *uidOut);
197 		free(nameStr);
198 	} else if (debug) {
199 		syslog(LOG_AUTH|LOG_DEBUG,
200 		    "%s: gsscred tbl could NOT"
201 		    " provide local name mapping (%s, %s)",
202 		    whoami,
203 		    mechStr ? mechStr : "<unknown>",
204 		    nameStr ? nameStr : "<unknown>");
205 		free(nameStr);
206 	}
207 
208 	return (major);
209 
210 } /* gsscred_expname_to_unix_cred */
211 
212 OM_uint32
213 gsscred_expname_to_unix_cred(
214 	const gss_buffer_t expName,
215 	uid_t *uidOut,
216 	gid_t *gidOut,
217 	gid_t *gids[],
218 	int *gidsLen)
219 {
220 	return (gsscred_expname_to_unix_cred_ext(expName, uidOut, gidOut, gids,
221 	    gidsLen, 1));
222 }
223 
224 
225 static const char *expNameTokId = "\x04\x01";
226 static const int expNameTokIdLen = 2;
227 /*
228  * private routine added to be called from gsscred_name_to_unix_cred
229  * and gsscred_expName_to_unix_cred.
230  */
231 static OM_uint32
232 private_gsscred_expname_to_unix_cred(expName, uidOut, gidOut, gids, gidsLen)
233 const gss_buffer_t expName;
234 uid_t *uidOut;
235 gid_t *gidOut;
236 gid_t *gids[];
237 int *gidsLen;
238 {
239 
240 	if (expName->length < expNameTokIdLen ||
241 		(memcmp(expName->value, expNameTokId, expNameTokIdLen) != 0))
242 		return (GSS_S_DEFECTIVE_TOKEN);
243 
244 	if (!gss_getGssCredEntry(expName, uidOut))
245 		return (GSS_S_FAILURE);
246 
247 	/* did caller request group info also ? */
248 	if (gids && gidsLen && gidOut)
249 		return (gss_get_group_info(*uidOut, gidOut, gids, gidsLen));
250 
251 	return (GSS_S_COMPLETE);
252 }
253 
254 /*
255  * Return a string of the authenticated name.
256  * It's a bit of hack/workaround/longroad but the current intName
257  * passed to gss_display_name insists on returning an empty string.
258  *
259  * Caller must free string memory.
260  */
261 static
262 char *make_name_str(
263 	const gss_name_t intName,
264 	const gss_OID mechType)
265 
266 {
267 	gss_buffer_desc expName = GSS_C_EMPTY_BUFFER;
268 	OM_uint32 major, minor;
269 	gss_name_t canonName;
270 	gss_name_t iName;
271 	gss_buffer_desc namebuf;
272 
273 	if (major = gss_canonicalize_name(&minor, intName,
274 				mechType, &canonName))
275 		return (NULL);
276 
277 	major = gss_export_name(&minor, canonName, &expName);
278 	(void) gss_release_name(&minor, &canonName);
279 	if (major)
280 		return (NULL);
281 
282 	if (gss_import_name(&minor, &expName,
283 			    (gss_OID)GSS_C_NT_EXPORT_NAME,
284 			    &iName) == GSS_S_COMPLETE) {
285 
286 		major = gss_display_name(&minor, iName, &namebuf, NULL);
287 		if (major == GSS_S_COMPLETE) {
288 			char *s;
289 
290 			if (namebuf.value)
291 				s = strdup(namebuf.value);
292 
293 			(void) gss_release_buffer(&minor, &namebuf);
294 			(void) gss_release_buffer(&minor, &expName);
295 			(void) gss_release_buffer(&minor, (gss_buffer_t)iName);
296 			return (s);
297 		}
298 		(void) gss_release_buffer(&minor, (gss_buffer_t)iName);
299 	}
300 
301 	(void) gss_release_buffer(&minor, &expName);
302 	return (NULL);
303 }
304 
305 /*
306  * This routine accepts a name in gss internal name format together with
307  * a mechanim OID and retrieves a unix credentials for that entity.
308  */
309 OM_uint32
310 gsscred_name_to_unix_cred_ext(
311 	const gss_name_t intName,
312 	const gss_OID mechType,
313 	uid_t *uidOut,
314 	gid_t *gidOut,
315 	gid_t *gids[],
316 	int *gidsLen,
317 	int try_mech)
318 {
319 	gss_name_t canonName;
320 	gss_buffer_desc expName = GSS_C_EMPTY_BUFFER;
321 	OM_uint32 major, minor;
322 	int debug = get_uid_map_opt();
323 
324 	const char *mechStr;
325 	char *whoami = "gsscred_name_to_unix_cred";
326 	gss_buffer_desc namebuf;
327 
328 	if (intName == NULL || mechType == NULL)
329 		return (GSS_S_CALL_INACCESSIBLE_READ);
330 
331 	if (uidOut == NULL)
332 		return (GSS_S_CALL_INACCESSIBLE_WRITE);
333 
334 	mechStr = __gss_oid_to_mech(mechType);
335 
336 	/* first try the mechanism provided mapping */
337 	if (try_mech && gss_pname_to_uid(&minor, intName, mechType, uidOut)
338 	    == GSS_S_COMPLETE) {
339 
340 		if (debug) {
341 			char *s = make_name_str(intName, mechType);
342 			syslog(LOG_AUTH|LOG_DEBUG,
343 			    "%s: mech provided local name"
344 			    " mapping (%s, %s, %d)", whoami,
345 			    mechStr ? mechStr : "<null>",
346 			    s ? s : "<null>",
347 			    *uidOut);
348 			free(s);
349 		}
350 
351 		if (gids && gidsLen && gidOut)
352 			return (gss_get_group_info(*uidOut, gidOut, gids,
353 			    gidsLen));
354 		return (GSS_S_COMPLETE);
355 	}
356 	/*
357 	 * falling back onto the gsscred table to provide the mapping
358 	 * start by canonicalizing the passed in name and then export it
359 	 */
360 	if (major = gss_canonicalize_name(&minor, intName,
361 	    mechType, &canonName))
362 		return (major);
363 
364 	major = gss_export_name(&minor, canonName, &expName);
365 	(void) gss_release_name(&minor, &canonName);
366 	if (major)
367 		return (major);
368 
369 	major = private_gsscred_expname_to_unix_cred(&expName, uidOut, gidOut,
370 	    gids, gidsLen);
371 
372 
373 	if (debug) {
374 		gss_name_t iName;
375 		OM_uint32 maj;
376 		char *nameStr = NULL;
377 
378 		if (gss_import_name(&minor, &expName,
379 		    (gss_OID)GSS_C_NT_EXPORT_NAME, &iName) == GSS_S_COMPLETE) {
380 
381 			maj = gss_display_name(&minor, iName, &namebuf,
382 			    NULL);
383 			(void) gss_release_buffer(&minor, (gss_buffer_t)iName);
384 			if (maj == GSS_S_COMPLETE) {
385 				nameStr = strdup(namebuf.value);
386 				(void) gss_release_buffer(&minor, &namebuf);
387 			}
388 		}
389 
390 		if (major == GSS_S_COMPLETE)
391 			syslog(LOG_AUTH|LOG_DEBUG,
392 			    "%s: gsscred tbl provided"
393 			    " local name mapping (%s, %s, %d)",
394 			    whoami,
395 			    mechStr ? mechStr : "<unknown>",
396 			    nameStr ? nameStr : "<unknown>",
397 			    *uidOut);
398 		else
399 			syslog(LOG_AUTH|LOG_DEBUG,
400 			    "%s: gsscred tbl could NOT"
401 			    " provide local name mapping (%s, %s)",
402 			    whoami,
403 			    mechStr ? mechStr : "<unknown>",
404 			    nameStr ? nameStr : "<unknown>");
405 
406 		free(nameStr);
407 	}
408 
409 	(void) gss_release_buffer(&minor, &expName);
410 	return (major);
411 } /* gsscred_name_to_unix_cred */
412 
413 
414 OM_uint32
415 gsscred_name_to_unix_cred(
416 	const gss_name_t intName,
417 	const gss_OID mechType,
418 	uid_t *uidOut,
419 	gid_t *gidOut,
420 	gid_t *gids[],
421 	int *gidsLen)
422 {
423 	return (gsscred_name_to_unix_cred_ext(intName, mechType,
424 	    uidOut, gidOut, gids, gidsLen, 1));
425 }
426 
427 
428 
429 /*
430  * This routine accepts a unix uid, and retrieves the group id
431  * and supplamentery group ids for that uid.
432  * Callers should be aware that the supplamentary group ids
433  * array may be empty even when this function returns success.
434  */
435 OM_uint32
436 gss_get_group_info(uid, gidOut, gids, gidsLen)
437 const uid_t uid;
438 gid_t *gidOut;
439 gid_t *gids[];
440 int *gidsLen;
441 {
442 	struct passwd *pw;
443 	int maxgroups;
444 
445 	/* check for output parameters */
446 	if (gidOut == NULL || gids == NULL || gidsLen == NULL)
447 		return (GSS_S_CALL_INACCESSIBLE_WRITE);
448 
449 	*gids = NULL;
450 	*gidsLen = 0;
451 
452 	/* determine maximum number of groups possible */
453 	maxgroups = sysconf(_SC_NGROUPS_MAX);
454 	if (maxgroups < 1)
455 	    maxgroups = 16;
456 
457 	if ((pw = getpwuid(uid)) == NULL)
458 	    return (GSS_S_FAILURE);
459 
460 	/*
461 	 * we allocate for the maximum number of groups
462 	 * we do not reclaim the space when the actual number
463 	 * is lower, just set the size approprately.
464 	 */
465 	*gids = (gid_t *)calloc(maxgroups, sizeof (gid_t));
466 	if (*gids == NULL)
467 	    return (GSS_S_FAILURE);
468 
469 	*gidOut = pw->pw_gid;
470 	(*gids)[0] = pw->pw_gid;
471 	*gidsLen = _getgroupsbymember(pw->pw_name, *gids, maxgroups, 1);
472 	/*
473 	 * we will try to remove the duplicate entry from the groups
474 	 * array.  This can cause the group array to be empty.
475 	 */
476 	if (*gidsLen < 1)
477 	{
478 		free(*gids);
479 		*gids = NULL;
480 		return (GSS_S_FAILURE);
481 	} else if (*gidsLen == 1) {
482 		free(*gids);
483 		*gids = NULL;
484 		*gidsLen = 0;
485 	} else {
486 		/* length is atleast 2 */
487 		*gidsLen = *gidsLen -1;
488 		(*gids)[0] = (*gids)[*gidsLen];
489 	}
490 
491 	return (GSS_S_COMPLETE);
492 } /* gss_get_group_info */
493 
494 
495 static OM_uint32
496 gss_pname_to_uid(minor, name, mech_type, uidOut)
497 OM_uint32 *minor;
498 const gss_name_t name;
499 const gss_OID mech_type;
500 uid_t *uidOut;
501 {
502 	gss_mechanism mech;
503 	gss_union_name_t intName;
504 	gss_name_t mechName = NULL;
505 	OM_uint32 major, tmpMinor;
506 
507 	if (!minor)
508 		return (GSS_S_CALL_INACCESSIBLE_WRITE);
509 
510 	*minor = 0;
511 
512 	if (uidOut == NULL)
513 		return (GSS_S_CALL_INACCESSIBLE_WRITE);
514 
515 	if (name == NULL)
516 		return (GSS_S_CALL_INACCESSIBLE_READ);
517 
518 	intName = (gss_union_name_t)name;
519 
520 	if (mech_type != NULL)
521 		mech = __gss_get_mechanism(mech_type);
522 	else {
523 		/*
524 		 * if this is a MN, then try using the mech
525 		 * from the name; otherwise ask for default
526 		 */
527 		mech = __gss_get_mechanism(intName->mech_type);
528 	}
529 
530 	if (mech == NULL || mech->pname_to_uid == NULL)
531 		return (GSS_S_UNAVAILABLE);
532 
533 	/* may need to import the name if this is not MN */
534 	if (intName->mech_type == NULL) {
535 		major = __gss_import_internal_name(minor,
536 				mech_type, intName,
537 				&mechName);
538 		if (major != GSS_S_COMPLETE)
539 			return (major);
540 	} else
541 		mechName = intName->mech_name;
542 
543 
544 	/* now call the mechanism's pname function to do the work */
545 	major = mech->pname_to_uid(mech->context, minor, mechName, uidOut);
546 
547 	if (intName->mech_name != mechName)
548 		(void) __gss_release_internal_name(&tmpMinor, &mech->mech_type,
549 				&mechName);
550 
551 	return (major);
552 } /* gss_pname_to_uid */
553