lib/kafs/afskrb5.c

   1 /*
   2  * Copyright (c) 1995-2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kafs_locl.h"
  35
  36 struct krb5_kafs_data {
  37     krb5_context context;
  38     krb5_ccache id;
  39     krb5_const_realm realm;
  40 };
  41
  42 enum {
  43     KAFS_RXKAD_2B_KVNO = 213,
  44     KAFS_RXKAD_K5_KVNO = 256
  45 };
  46
  47 static int
  48 v5_to_kt(krb5_creds *cred, uid_t uid, struct kafs_token *kt, int local524)
  49 {
  50     int kvno, ret;
  51
  52     kt->ticket = NULL;
  53
  54     /* check if des key */
  55     if (cred->session.keyvalue.length != 8)
  56         return EINVAL;
  57
  58     if (local524) {
  59         Ticket t;
  60         unsigned char *buf;
  61         size_t buf_len;
  62         size_t len;
  63
  64         kvno = KAFS_RXKAD_2B_KVNO;
  65
  66         ret = decode_Ticket(cred->ticket.data, cred->ticket.length, &t, &len);
  67         if (ret)
  68             return ret;
  69         if (t.tkt_vno != 5)
  70             return -1;
  71
  72         ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_len, &t.enc_part,
  73                            &len, ret);
  74         free_Ticket(&t);
  75         if (ret)
  76             return ret;
  77         if(buf_len != len) {
  78             free(buf);
  79             return KRB5KRB_ERR_GENERIC;
  80         }
  81
  82         kt->ticket = buf;
  83         kt->ticket_len = buf_len;
  84
  85     } else {
  86         kvno = KAFS_RXKAD_K5_KVNO;
  87         kt->ticket = malloc(cred->ticket.length);
  88         if (kt->ticket == NULL)
  89             return ENOMEM;
  90         kt->ticket_len = cred->ticket.length;
  91         memcpy(kt->ticket, cred->ticket.data, kt->ticket_len);
  92
  93         ret = 0;
  94     }
  95
  96
  97     /*
  98      * Build a struct ClearToken
  99      */
 100
 101     kt->ct.AuthHandle = kvno;
 102     memcpy(kt->ct.HandShakeKey, cred->session.keyvalue.data, 8);
 103     kt->ct.ViceId = uid;
 104     kt->ct.BeginTimestamp = cred->times.starttime;
 105     kt->ct.EndTimestamp = cred->times.endtime;
 106
 107     _kafs_fixup_viceid(&kt->ct, uid);
 108
 109     return 0;
 110 }
 111
 112 static krb5_error_code
 113 v5_convert(krb5_context context, krb5_ccache id,
 114            krb5_creds *cred, uid_t uid,
 115            const char *cell,
 116            struct kafs_token *kt)
 117 {
 118     krb5_error_code ret;
 119     char *c, *val;
 120
 121     c = strdup(cell);
 122     if (c == NULL)
 123         return ENOMEM;
 124     _kafs_foldup(c, c);
 125     krb5_appdefault_string (context, "libkafs",
 126                             c,
 127                             "afs-use-524", "2b", &val);
 128     free(c);
 129
 130     if (strcasecmp(val, "local") == 0 ||
 131         strcasecmp(val, "2b") == 0)
 132         ret = v5_to_kt(cred, uid, kt, 1);
 133     else if(strcasecmp(val, "yes") == 0 ||
 134             strcasecmp(val, "true") == 0 ||
 135             atoi(val)) {
 136         struct credentials cred4;
 137
 138         if (id == NULL)
 139             ret = krb524_convert_creds_kdc(context, cred, &cred4);
 140         else
 141             ret = krb524_convert_creds_kdc_ccache(context, id, cred, &cred4);
 142         if (ret)
 143             goto out;
 144
 145         ret = _kafs_v4_to_kt(&cred4, uid, kt);
 146     } else
 147         ret = v5_to_kt(cred, uid, kt, 0);
 148
 149  out:
 150     free(val);
 151     return ret;
 152 }
 153
 154
 155 /*
 156  *
 157  */
 158
 159 static int
 160 get_cred(struct kafs_data *data, const char *name, const char *inst,
 161          const char *realm, uid_t uid, struct kafs_token *kt)
 162 {
 163     krb5_error_code ret;
 164     krb5_creds in_creds, *out_creds;
 165     struct krb5_kafs_data *d = data->data;
 166     int invalid;
 167
 168     memset(&in_creds, 0, sizeof(in_creds));
 169
 170     ret = krb5_make_principal(d->context, &in_creds.server,
 171                               realm, name, inst, NULL);
 172     if(ret)
 173         return ret;
 174     ret = krb5_cc_get_principal(d->context, d->id, &in_creds.client);
 175     if(ret){
 176         krb5_free_principal(d->context, in_creds.server);
 177         return ret;
 178     }
 179
 180     in_creds.session.keytype = ETYPE_DES_CBC_CRC;
 181
 182     /* check if des is disable, and in that case enable it for afs */
 183     invalid = krb5_enctype_valid(d->context, in_creds.session.keytype);
 184     if (invalid)
 185         krb5_enctype_enable(d->context, in_creds.session.keytype);
 186
 187     ret = krb5_get_credentials(d->context, 0, d->id, &in_creds, &out_creds);
 188
 189     if (invalid)
 190         krb5_enctype_disable(d->context, in_creds.session.keytype);
 191
 192     krb5_free_principal(d->context, in_creds.server);
 193     krb5_free_principal(d->context, in_creds.client);
 194     if(ret)
 195         return ret;
 196
 197     ret = v5_convert(d->context, d->id, out_creds, uid,
 198                      (inst != NULL && inst[0] != '\0') ? inst : realm, kt);
 199     krb5_free_creds(d->context, out_creds);
 200
 201     return ret;
 202 }
 203
 204 static const char *
 205 get_error(struct kafs_data *data, int error)
 206 {
 207     struct krb5_kafs_data *d = data->data;
 208     return krb5_get_error_message(d->context, error);
 209 }
 210
 211 static void
 212 free_error(struct kafs_data *data, const char *str)
 213 {
 214     struct krb5_kafs_data *d = data->data;
 215     krb5_free_error_message(d->context, str);
 216 }
 217
 218 static krb5_error_code
 219 afslog_uid_int(struct kafs_data *data, const char *cell, const char *rh,
 220                uid_t uid, const char *homedir)
 221 {
 222     krb5_error_code ret;
 223     struct kafs_token kt;
 224     krb5_principal princ;
 225     const char *trealm; /* ticket realm */
 226     struct krb5_kafs_data *d = data->data;
 227
 228     if (cell == 0 || cell[0] == 0)
 229         return _kafs_afslog_all_local_cells (data, uid, homedir);
 230
 231     ret = krb5_cc_get_principal (d->context, d->id, &princ);
 232     if (ret)
 233         return ret;
 234
 235     trealm = krb5_principal_get_realm (d->context, princ);
 236
 237     kt.ticket = NULL;
 238     ret = _kafs_get_cred(data, cell, d->realm, trealm, uid, &kt);
 239     krb5_free_principal (d->context, princ);
 240
 241     if(ret == 0) {
 242         ret = kafs_settoken_rxkad(cell, &kt.ct, kt.ticket, kt.ticket_len);
 243         free(kt.ticket);
 244     }
 245     return ret;
 246 }
 247
 248 static char *
 249 get_realm(struct kafs_data *data, const char *host)
 250 {
 251     struct krb5_kafs_data *d = data->data;
 252     krb5_realm *realms;
 253     char *r;
 254     if(krb5_get_host_realm(d->context, host, &realms))
 255         return NULL;
 256     r = strdup(realms[0]);
 257     krb5_free_host_realm(d->context, realms);
 258     return r;
 259 }
 260
 261 krb5_error_code
 262 krb5_afslog_uid_home(krb5_context context,
 263                      krb5_ccache id,
 264                      const char *cell,
 265                      krb5_const_realm realm,
 266                      uid_t uid,
 267                      const char *homedir)
 268 {
 269     struct kafs_data kd;
 270     struct krb5_kafs_data d;
 271     krb5_error_code ret;
 272
 273     kd.name = "krb5";
 274     kd.afslog_uid = afslog_uid_int;
 275     kd.get_cred = get_cred;
 276     kd.get_realm = get_realm;
 277     kd.get_error = get_error;
 278     kd.free_error = free_error;
 279     kd.data = &d;
 280     if (context == NULL) {
 281         ret = krb5_init_context(&d.context);
 282         if (ret)
 283             return ret;
 284     } else
 285         d.context = context;
 286     if (id == NULL) {
 287         ret = krb5_cc_default(d.context, &d.id);
 288         if (ret)
 289             goto out;
 290     } else
 291         d.id = id;
 292     d.realm = realm;
 293     ret = afslog_uid_int(&kd, cell, 0, uid, homedir);
 294     if (id == NULL)
 295         krb5_cc_close(context, d.id);
 296  out:
 297     if (context == NULL)
 298         krb5_free_context(d.context);
 299     return ret;
 300 }
 301
 302 krb5_error_code
 303 krb5_afslog_uid(krb5_context context,
 304                 krb5_ccache id,
 305                 const char *cell,
 306                 krb5_const_realm realm,
 307                 uid_t uid)
 308 {
 309     return krb5_afslog_uid_home (context, id, cell, realm, uid, NULL);
 310 }
 311
 312 krb5_error_code
 313 krb5_afslog(krb5_context context,
 314             krb5_ccache id,
 315             const char *cell,
 316             krb5_const_realm realm)
 317 {
 318     return krb5_afslog_uid (context, id, cell, realm, getuid());
 319 }
 320
 321 krb5_error_code
 322 krb5_afslog_home(krb5_context context,
 323                  krb5_ccache id,
 324                  const char *cell,
 325                  krb5_const_realm realm,
 326                  const char *homedir)
 327 {
 328     return krb5_afslog_uid_home (context, id, cell, realm, getuid(), homedir);
 329 }
 330
 331 /*
 332  *
 333  */
 334
 335 krb5_error_code
 336 krb5_realm_of_cell(const char *cell, char **realm)
 337 {
 338     struct kafs_data kd;
 339
 340     kd.name = "krb5";
 341     kd.get_realm = get_realm;
 342     kd.get_error = get_error;
 343     kd.free_error = free_error;
 344     return _kafs_realm_of_cell(&kd, cell, realm);
 345 }
 346
 347 /*
 348  *
 349  */
 350
 351 int
 352 kafs_settoken5(krb5_context context, const char *cell, uid_t uid,
 353                krb5_creds *cred)
 354 {
 355     struct kafs_token kt;
 356     int ret;
 357
 358     ret = v5_convert(context, NULL, cred, uid, cell, &kt);
 359     if (ret)
 360         return ret;
 361
 362     ret = kafs_settoken_rxkad(cell, &kt.ct, kt.ticket, kt.ticket_len);
 363
 364     free(kt.ticket);
 365
 366     return ret;
 367 }