lib/kafs/common.c

   1 /*
   2  * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kafs_locl.h"
  35
  36 RCSID("$Id$");
  37
  38 #define AUTH_SUPERUSER "afs"
  39
  40 /*
  41  * Here only ASCII characters are relevant.
  42  */
  43
  44 #define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z')
  45
  46 #define ToAsciiUpper(c) ((c) - 'a' + 'A')
  47
  48 static void (*kafs_verbose)(void *, const char *);
  49 static void *kafs_verbose_ctx;
  50
  51 void
  52 _kafs_foldup(char *a, const char *b)
  53 {
  54   for (; *b; a++, b++)
  55     if (IsAsciiLower(*b))
  56       *a = ToAsciiUpper(*b);
  57     else
  58       *a = *b;
  59   *a = '\0';
  60 }
  61
  62 void
  63 kafs_set_verbose(void (*f)(void *, const char *), void *ctx)
  64 {
  65     if (f) {
  66         kafs_verbose = f;
  67         kafs_verbose_ctx = ctx;
  68     }
  69 }
  70
  71 int
  72 kafs_settoken_rxkad(const char *cell, struct ClearToken *ct,
  73                     void *ticket, size_t ticket_len)
  74 {
  75     struct ViceIoctl parms;
  76     char buf[2048], *t;
  77     int32_t sizeof_x;
  78
  79     t = buf;
  80     /*
  81      * length of secret token followed by secret token
  82      */
  83     sizeof_x = ticket_len;
  84     memcpy(t, &sizeof_x, sizeof(sizeof_x));
  85     t += sizeof(sizeof_x);
  86     memcpy(t, ticket, sizeof_x);
  87     t += sizeof_x;
  88     /*
  89      * length of clear token followed by clear token
  90      */
  91     sizeof_x = sizeof(*ct);
  92     memcpy(t, &sizeof_x, sizeof(sizeof_x));
  93     t += sizeof(sizeof_x);
  94     memcpy(t, ct, sizeof_x);
  95     t += sizeof_x;
  96
  97     /*
  98      * do *not* mark as primary cell
  99      */
 100     sizeof_x = 0;
 101     memcpy(t, &sizeof_x, sizeof(sizeof_x));
 102     t += sizeof(sizeof_x);
 103     /*
 104      * follow with cell name
 105      */
 106     sizeof_x = strlen(cell) + 1;
 107     memcpy(t, cell, sizeof_x);
 108     t += sizeof_x;
 109
 110     /*
 111      * Build argument block
 112      */
 113     parms.in = buf;
 114     parms.in_size = t - buf;
 115     parms.out = 0;
 116     parms.out_size = 0;
 117
 118     return k_pioctl(0, VIOCSETTOK, &parms, 0);
 119 }
 120
 121 void
 122 _kafs_fixup_viceid(struct ClearToken *ct, uid_t uid)
 123 {
 124 #define ODD(x) ((x) & 1)
 125     /* According to Transarc conventions ViceId is valid iff
 126      * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime
 127      * the transformations:
 128      *
 129      * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life)
 130      * preserves the original values.
 131      */
 132     if (uid != 0)               /* valid ViceId */
 133     {
 134         if (!ODD(ct->EndTimestamp - ct->BeginTimestamp))
 135             ct->EndTimestamp--;
 136     }
 137     else                        /* not valid ViceId */
 138     {
 139         if (ODD(ct->EndTimestamp - ct->BeginTimestamp))
 140             ct->EndTimestamp--;
 141     }
 142 }
 143
 144
 145 int
 146 _kafs_v4_to_kt(CREDENTIALS *c, uid_t uid, struct kafs_token *kt)
 147 {
 148     kt->ticket = NULL;
 149
 150     if (c->ticket_st.length > MAX_KTXT_LEN)
 151         return EINVAL;
 152
 153     kt->ticket = malloc(c->ticket_st.length);
 154     if (kt->ticket == NULL)
 155         return ENOMEM;
 156     kt->ticket_len = c->ticket_st.length;
 157     memcpy(kt->ticket, c->ticket_st.dat, kt->ticket_len);
 158
 159     /*
 160      * Build a struct ClearToken
 161      */
 162     kt->ct.AuthHandle = c->kvno;
 163     memcpy (kt->ct.HandShakeKey, c->session, sizeof(c->session));
 164     kt->ct.ViceId = uid;
 165     kt->ct.BeginTimestamp = c->issue_date;
 166     kt->ct.EndTimestamp = krb_life_to_time(c->issue_date, c->lifetime);
 167
 168     _kafs_fixup_viceid(&kt->ct, uid);
 169
 170     return 0;
 171 }
 172
 173 /* Try to get a db-server for an AFS cell from a AFSDB record */
 174
 175 static int
 176 dns_find_cell(const char *cell, char *dbserver, size_t len)
 177 {
 178     struct dns_reply *r;
 179     int ok = -1;
 180     r = dns_lookup(cell, "afsdb");
 181     if(r){
 182         struct resource_record *rr = r->head;
 183         while(rr){
 184             if(rr->type == T_AFSDB && rr->u.afsdb->preference == 1){
 185                 strlcpy(dbserver,
 186                                 rr->u.afsdb->domain,
 187                                 len);
 188                 ok = 0;
 189                 break;
 190             }
 191             rr = rr->next;
 192         }
 193         dns_free_data(r);
 194     }
 195     return ok;
 196 }
 197
 198
 199 /*
 200  * Try to find the cells we should try to klog to in "file".
 201  */
 202 static void
 203 find_cells(const char *file, char ***cells, int *index)
 204 {
 205     FILE *f;
 206     char cell[64];
 207     int i;
 208     int ind = *index;
 209
 210     f = fopen(file, "r");
 211     if (f == NULL)
 212         return;
 213     while (fgets(cell, sizeof(cell), f)) {
 214         char *t;
 215         t = cell + strlen(cell);
 216         for (; t >= cell; t--)
 217           if (*t == '\n' || *t == '\t' || *t == ' ')
 218             *t = 0;
 219         if (cell[0] == '\0' || cell[0] == '#')
 220             continue;
 221         for(i = 0; i < ind; i++)
 222             if(strcmp((*cells)[i], cell) == 0)
 223                 break;
 224         if(i == ind){
 225             char **tmp;
 226
 227             tmp = realloc(*cells, (ind + 1) * sizeof(**cells));
 228             if (tmp == NULL)
 229                 break;
 230             *cells = tmp;
 231             (*cells)[ind] = strdup(cell);
 232             if ((*cells)[ind] == NULL)
 233                 break;
 234             ++ind;
 235         }
 236     }
 237     fclose(f);
 238     *index = ind;
 239 }
 240
 241 /*
 242  * Get tokens for all cells[]
 243  */
 244 static int
 245 afslog_cells(kafs_data *data, char **cells, int max, uid_t uid,
 246              const char *homedir)
 247 {
 248     int ret = 0;
 249     int i;
 250     for (i = 0; i < max; i++) {
 251         int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir);
 252         if (er)
 253             ret = er;
 254     }
 255     return ret;
 256 }
 257
 258 int
 259 _kafs_afslog_all_local_cells(kafs_data *data, uid_t uid, const char *homedir)
 260 {
 261     int ret;
 262     char **cells = NULL;
 263     int index = 0;
 264
 265     if (homedir == NULL)
 266         homedir = getenv("HOME");
 267     if (homedir != NULL) {
 268         char home[MaxPathLen];
 269         snprintf(home, sizeof(home), "%s/.TheseCells", homedir);
 270         find_cells(home, &cells, &index);
 271     }
 272     find_cells(_PATH_THESECELLS, &cells, &index);
 273     find_cells(_PATH_THISCELL, &cells, &index);
 274     find_cells(_PATH_ARLA_THESECELLS, &cells, &index);
 275     find_cells(_PATH_ARLA_THISCELL, &cells, &index);
 276     find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &index);
 277     find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &index);
 278     find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &index);
 279     find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &index);
 280
 281     ret = afslog_cells(data, cells, index, uid, homedir);
 282     while(index > 0)
 283         free(cells[--index]);
 284     free(cells);
 285     return ret;
 286 }
 287
 288
 289 static int
 290 file_find_cell(kafs_data *data, const char *cell, char **realm, int exact)
 291 {
 292     FILE *F;
 293     char buf[1024];
 294     char *p;
 295     int ret = -1;
 296
 297     if ((F = fopen(_PATH_CELLSERVDB, "r"))
 298         || (F = fopen(_PATH_ARLA_CELLSERVDB, "r"))
 299         || (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r"))
 300         || (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) {
 301         while (fgets(buf, sizeof(buf), F)) {
 302             int cmp;
 303
 304             if (buf[0] != '>')
 305                 continue; /* Not a cell name line, try next line */
 306             p = buf;
 307             strsep(&p, " \t\n#");
 308
 309             if (exact)
 310                 cmp = strcmp(buf + 1, cell);
 311             else
 312                 cmp = strncmp(buf + 1, cell, strlen(cell));
 313
 314             if (cmp == 0) {
 315                 /*
 316                  * We found the cell name we're looking for.
 317                  * Read next line on the form ip-address '#' hostname
 318                  */
 319                 if (fgets(buf, sizeof(buf), F) == NULL)
 320                     break;      /* Read failed, give up */
 321                 p = strchr(buf, '#');
 322                 if (p == NULL)
 323                     break;      /* No '#', give up */
 324                 p++;
 325                 if (buf[strlen(buf) - 1] == '\n')
 326                     buf[strlen(buf) - 1] = '\0';
 327                 *realm = (*data->get_realm)(data, p);
 328                 if (*realm && **realm != '\0')
 329                     ret = 0;
 330                 break;          /* Won't try any more */
 331             }
 332         }
 333         fclose(F);
 334     }
 335     return ret;
 336 }
 337
 338 /* Find the realm associated with cell. Do this by opening
 339    /usr/vice/etc/CellServDB and getting the realm-of-host for the
 340    first VL-server for the cell.
 341
 342    This does not work when the VL-server is living in one realm, but
 343    the cell it is serving is living in another realm.
 344
 345    Return 0 on success, -1 otherwise.
 346    */
 347
 348 int
 349 _kafs_realm_of_cell(kafs_data *data, const char *cell, char **realm)
 350 {
 351     char buf[1024];
 352     int ret;
 353
 354     ret = file_find_cell(data, cell, realm, 1);
 355     if (ret == 0)
 356         return ret;
 357     if (dns_find_cell(cell, buf, sizeof(buf)) == 0) {
 358         *realm = (*data->get_realm)(data, buf);
 359         if(*realm != NULL)
 360             return 0;
 361     }
 362     return file_find_cell(data, cell, realm, 0);
 363 }
 364
 365 static int
 366 _kafs_try_get_cred(kafs_data *data, const char *user, const char *cell,
 367                    const char *realm, uid_t uid, struct kafs_token *kt)
 368 {
 369     int ret;
 370
 371     ret = (*data->get_cred)(data, user, cell, realm, uid, kt);
 372     if (kafs_verbose) {
 373         char *str;
 374         asprintf(&str, "%s tried afs%s%s@%s -> %d",
 375                  data->name, cell[0] == '\0' ? "" : "/",
 376                  cell, realm, ret);
 377         (*kafs_verbose)(kafs_verbose_ctx, str);
 378         free(str);
 379     }
 380
 381     return ret;
 382 }
 383
 384
 385 int
 386 _kafs_get_cred(kafs_data *data,
 387                const char *cell,
 388                const char *realm_hint,
 389                const char *realm,
 390                uid_t uid,
 391                struct kafs_token *kt)
 392 {
 393     int ret = -1;
 394     char *vl_realm;
 395     char CELL[64];
 396
 397     /* We're about to find the the realm that holds the key for afs in
 398      * the specified cell. The problem is that null-instance
 399      * afs-principals are common and that hitting the wrong realm might
 400      * yield the wrong afs key. The following assumptions were made.
 401      *
 402      * Any realm passed to us is preferred.
 403      *
 404      * If there is a realm with the same name as the cell, it is most
 405      * likely the correct realm to talk to.
 406      *
 407      * In most (maybe even all) cases the database servers of the cell
 408      * will live in the realm we are looking for.
 409      *
 410      * Try the local realm, but if the previous cases fail, this is
 411      * really a long shot.
 412      *
 413      */
 414
 415     /* comments on the ordering of these tests */
 416
 417     /* If the user passes a realm, she probably knows something we don't
 418      * know and we should try afs@realm_hint.
 419      */
 420
 421     if (realm_hint) {
 422         ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 423                                  cell, realm_hint, uid, kt);
 424         if (ret == 0) return 0;
 425         ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 426                                  "", realm_hint, uid, kt);
 427         if (ret == 0) return 0;
 428     }
 429
 430     _kafs_foldup(CELL, cell);
 431
 432     /*
 433      * If cell == realm we don't need no cross-cell authentication.
 434      * Try afs@REALM.
 435      */
 436     if (strcmp(CELL, realm) == 0) {
 437         ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 438                                  "", realm, uid, kt);
 439         if (ret == 0) return 0;
 440         /* Try afs.cell@REALM below. */
 441     }
 442
 443     /*
 444      * If the AFS servers have a file /usr/afs/etc/krb.conf containing
 445      * REALM we still don't have to resort to cross-cell authentication.
 446      * Try afs.cell@REALM.
 447      */
 448     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 449                              cell, realm, uid, kt);
 450     if (ret == 0) return 0;
 451
 452     /*
 453      * We failed to get ``first class tickets'' for afs,
 454      * fall back to cross-cell authentication.
 455      * Try afs@CELL.
 456      * Try afs.cell@CELL.
 457      */
 458     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 459                              "", CELL, uid, kt);
 460     if (ret == 0) return 0;
 461     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 462                              cell, CELL, uid, kt);
 463     if (ret == 0) return 0;
 464
 465     /*
 466      * Perhaps the cell doesn't correspond to any realm?
 467      * Use realm of first volume location DB server.
 468      * Try afs.cell@VL_REALM.
 469      * Try afs@VL_REALM???
 470      */
 471     if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0
 472         && strcmp(vl_realm, realm) != 0
 473         && strcmp(vl_realm, CELL) != 0) {
 474         ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 475                                  cell, vl_realm, uid, kt);
 476         if (ret)
 477             ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
 478                                      "", vl_realm, uid, kt);
 479         free(vl_realm);
 480         if (ret == 0) return 0;
 481     }
 482
 483     return ret;
 484 }