2 * CIFS user-space helper.
3 * Copyright (C) Igor Mammedov (niallain@gmail.com) 2007
4 * Copyright (C) Jeff Layton (jlayton@redhat.com) 2009
6 * Used by /sbin/request-key for handling
7 * cifs upcall for kerberos authorization of access to share and
8 * cifs upcall for DFS srver name resolving (IPv4/IPv6 aware).
9 * You should have keyutils installed and add something like the
10 * following lines to /etc/request-key.conf file:
12 create cifs.spnego * * /usr/local/sbin/cifs.upcall %k
13 create dns_resolver * * /usr/local/sbin/cifs.upcall %k
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 #include "cifs_spnego.h"
33 const char *CIFSSPNEGO_VERSION
= "1.2";
34 static const char *prog
= "cifs.upcall";
35 typedef enum _secType
{
42 * given a process ID, get the value of the KRB5CCNAME environment variable
43 * in the context of that process. On error, just return NULL.
46 get_krb5_ccname(pid_t pid
)
52 * FIXME: sysconf for ARG_MAX instead? Kernel seems to be limited to a
53 * page however, so it may not matter.
56 char *p
, *value
= NULL
;
59 snprintf(buf
, 4095, "/proc/%d/environ", pid
);
60 fd
= open(buf
, O_RDONLY
);
62 syslog(LOG_DEBUG
, "%s: unable to open %s: %d", __func__
, buf
,
67 /* FIXME: don't assume that we get it all in the first read? */
68 len
= read(fd
, buf
, 4096);
71 syslog(LOG_DEBUG
, "%s: unable to read from /proc/%d/environ: "
72 "%d", __func__
, pid
, errno
);
79 /* can't have valid KRB5CCNAME if there are < 13 bytes left */
81 if (strncmp("KRB5CCNAME=", p
, 11)) {
82 p
+= strnlen(p
, left
);
89 value
= SMB_STRNDUP(p
, left
);
92 syslog(LOG_DEBUG
, "%s: KRB5CCNAME=%s", __func__
,
93 value
? value
: "(null)");
98 * Prepares AP-REQ data for mechToken and gets session key
99 * Uses credentials from cache. It will not ask for password
100 * you should receive credentials for yuor name manually using
101 * kinit or whatever you wish.
104 * oid - string with OID/ Could be OID_KERBEROS5
105 * or OID_KERBEROS5_OLD
106 * principal - Service name.
107 * Could be "cifs/FQDN" for KRB5 OID
108 * or for MS_KRB5 OID style server principal
109 * like "pdc$@YOUR.REALM.NAME"
112 * secblob - pointer for spnego wrapped AP-REQ data to be stored
113 * sess_key- pointer for SessionKey data to be stored
115 * ret: 0 - success, others - failure
118 handle_krb5_mech(const char *oid
, const char *principal
, DATA_BLOB
*secblob
,
119 DATA_BLOB
*sess_key
, const char *ccname
)
122 DATA_BLOB tkt
, tkt_wrapped
;
124 syslog(LOG_DEBUG
, "%s: getting service ticket for %s", __func__
,
127 /* get a kerberos ticket for the service and extract the session key */
128 retval
= cli_krb5_get_ticket(principal
, 0, &tkt
, sess_key
, 0, ccname
,
132 syslog(LOG_DEBUG
, "%s: failed to obtain service ticket (%d)",
137 syslog(LOG_DEBUG
, "%s: obtained service ticket", __func__
);
139 /* wrap that up in a nice GSS-API wrapping */
140 tkt_wrapped
= spnego_gen_krb5_wrap(tkt
, TOK_ID_KRB_AP_REQ
);
142 /* and wrap that in a shiny SPNEGO wrapper */
143 *secblob
= gen_negTokenInit(oid
, tkt_wrapped
);
145 data_blob_free(&tkt_wrapped
);
146 data_blob_free(&tkt
);
150 #define DKD_HAVE_HOSTNAME 0x1
151 #define DKD_HAVE_VERSION 0x2
152 #define DKD_HAVE_SEC 0x4
153 #define DKD_HAVE_IPV4 0x8
154 #define DKD_HAVE_IPV6 0x10
155 #define DKD_HAVE_UID 0x20
156 #define DKD_HAVE_PID 0x40
157 #define DKD_MUSTHAVE_SET (DKD_HAVE_HOSTNAME|DKD_HAVE_VERSION|DKD_HAVE_SEC)
160 decode_key_description(const char *desc
, int *ver
, secType_t
*sec
,
161 char **hostname
, uid_t
*uid
, pid_t
*pid
)
165 const char *tkn
= desc
;
168 pos
= index(tkn
, ';');
169 if (strncmp(tkn
, "host=", 5) == 0) {
178 SAFE_FREE(*hostname
);
179 *hostname
= SMB_XMALLOC_ARRAY(char, len
);
180 strlcpy(*hostname
, tkn
+ 5, len
);
181 retval
|= DKD_HAVE_HOSTNAME
;
182 } else if (strncmp(tkn
, "ipv4=", 5) == 0) {
183 /* BB: do we need it if we have hostname already? */
184 } else if (strncmp(tkn
, "ipv6=", 5) == 0) {
185 /* BB: do we need it if we have hostname already? */
186 } else if (strncmp(tkn
, "pid=", 4) == 0) {
188 *pid
= strtol(tkn
+ 4, NULL
, 0);
190 syslog(LOG_ERR
, "Invalid pid format: %s",
194 retval
|= DKD_HAVE_PID
;
196 } else if (strncmp(tkn
, "sec=", 4) == 0) {
197 if (strncmp(tkn
+ 4, "krb5", 4) == 0) {
198 retval
|= DKD_HAVE_SEC
;
200 } else if (strncmp(tkn
+ 4, "mskrb5", 6) == 0) {
201 retval
|= DKD_HAVE_SEC
;
204 } else if (strncmp(tkn
, "uid=", 4) == 0) {
206 *uid
= strtol(tkn
+ 4, NULL
, 16);
208 syslog(LOG_ERR
, "Invalid uid format: %s",
212 retval
|= DKD_HAVE_UID
;
214 } else if (strncmp(tkn
, "ver=", 4) == 0) { /* if version */
216 *ver
= strtol(tkn
+ 4, NULL
, 16);
218 syslog(LOG_ERR
, "Invalid version format: %s",
222 retval
|= DKD_HAVE_VERSION
;
233 cifs_resolver(const key_serial_t key
, const char *key_descr
)
236 struct addrinfo
*addr
;
237 char ip
[INET6_ADDRSTRLEN
];
239 const char *keyend
= key_descr
;
240 /* skip next 4 ';' delimiters to get to description */
241 for (c
= 1; c
<= 4; c
++) {
242 keyend
= index(keyend
+1, ';');
244 syslog(LOG_ERR
, "invalid key description: %s",
251 /* resolve name to ip */
252 c
= getaddrinfo(keyend
, NULL
, NULL
, &addr
);
254 syslog(LOG_ERR
, "unable to resolve hostname: %s [%s]",
255 keyend
, gai_strerror(c
));
259 /* conver ip to string form */
260 if (addr
->ai_family
== AF_INET
)
261 p
= &(((struct sockaddr_in
*)addr
->ai_addr
)->sin_addr
);
263 p
= &(((struct sockaddr_in6
*)addr
->ai_addr
)->sin6_addr
);
265 if (!inet_ntop(addr
->ai_family
, p
, ip
, sizeof(ip
))) {
266 syslog(LOG_ERR
, "%s: inet_ntop: %s", __func__
, strerror(errno
));
272 c
= keyctl_instantiate(key
, ip
, strlen(ip
)+1, 0);
274 syslog(LOG_ERR
, "%s: keyctl_instantiate: %s", __func__
,
287 syslog(LOG_INFO
, "Usage: %s [-c] [-v] key_serial", prog
);
288 fprintf(stderr
, "Usage: %s [-c] [-v] key_serial\n", prog
);
291 int main(const int argc
, char *const argv
[])
293 struct cifs_spnego_msg
*keydata
= NULL
;
294 DATA_BLOB secblob
= data_blob_null
;
295 DATA_BLOB sess_key
= data_blob_null
;
296 secType_t sectype
= NONE
;
297 key_serial_t key
= 0;
302 int kernel_upcall_version
= 0;
303 int c
, use_cifs_service_prefix
= 0;
304 char *buf
, *princ
, *ccname
= NULL
, *hostname
= NULL
;
307 openlog(prog
, 0, LOG_DAEMON
);
309 while ((c
= getopt(argc
, argv
, "cv")) != -1) {
312 use_cifs_service_prefix
= 1;
315 printf("version: %s\n", CIFSSPNEGO_VERSION
);
318 syslog(LOG_ERR
, "unknown option: %c", c
);
323 /* is there a key? */
324 if (argc
<= optind
) {
329 /* get key and keyring values */
331 key
= strtol(argv
[optind
], NULL
, 10);
334 syslog(LOG_ERR
, "Invalid key format: %s", strerror(errno
));
338 rc
= keyctl_describe_alloc(key
, &buf
);
340 syslog(LOG_ERR
, "keyctl_describe_alloc failed: %s",
346 syslog(LOG_DEBUG
, "key description: %s", buf
);
348 if ((strncmp(buf
, "cifs.resolver", sizeof("cifs.resolver")-1) == 0) ||
349 (strncmp(buf
, "dns_resolver", sizeof("dns_resolver")-1) == 0)) {
350 rc
= cifs_resolver(key
, buf
);
354 rc
= decode_key_description(buf
, &kernel_upcall_version
, §ype
,
355 &hostname
, &uid
, &pid
);
356 if ((rc
& DKD_MUSTHAVE_SET
) != DKD_MUSTHAVE_SET
) {
357 syslog(LOG_ERR
, "unable to get necessary params from key "
358 "description (0x%x)", rc
);
365 if (kernel_upcall_version
> CIFS_SPNEGO_UPCALL_VERSION
) {
366 syslog(LOG_ERR
, "incompatible kernel upcall version: 0x%x",
367 kernel_upcall_version
);
372 if (rc
& DKD_HAVE_PID
)
373 ccname
= get_krb5_ccname(pid
);
375 if (rc
& DKD_HAVE_UID
) {
378 syslog(LOG_ERR
, "setuid: %s", strerror(errno
));
383 // do mech specific authorization
387 /* for "cifs/" service name + terminating 0 */
388 datalen
= strlen(hostname
) + 5 + 1;
389 princ
= SMB_XMALLOC_ARRAY(char, datalen
);
395 if (use_cifs_service_prefix
)
396 strlcpy(princ
, "cifs/", datalen
);
398 strlcpy(princ
, "host/", datalen
);
400 strlcpy(princ
+ 5, hostname
, datalen
- 5);
402 if (sectype
== MS_KRB5
)
403 oid
= OID_KERBEROS5_OLD
;
407 rc
= handle_krb5_mech(oid
, princ
, &secblob
, &sess_key
, ccname
);
411 syslog(LOG_ERR
, "sectype: %d is not implemented", sectype
);
419 /* pack SecurityBLob and SessionKey into downcall packet */
421 sizeof(struct cifs_spnego_msg
) + secblob
.length
+ sess_key
.length
;
422 keydata
= (struct cifs_spnego_msg
*)SMB_XMALLOC_ARRAY(char, datalen
);
427 keydata
->version
= kernel_upcall_version
;
429 keydata
->sesskey_len
= sess_key
.length
;
430 keydata
->secblob_len
= secblob
.length
;
431 memcpy(&(keydata
->data
), sess_key
.data
, sess_key
.length
);
432 memcpy(&(keydata
->data
) + keydata
->sesskey_len
,
433 secblob
.data
, secblob
.length
);
436 rc
= keyctl_instantiate(key
, keydata
, datalen
, 0);
438 syslog(LOG_ERR
, "keyctl_instantiate: %s", strerror(errno
));
442 /* BB: maybe we need use timeout for key: for example no more then
443 * ticket lifietime? */
444 /* keyctl_set_timeout( key, 60); */
447 * on error, negatively instantiate the key ourselves so that we can
448 * make sure the kernel doesn't hang it off of a searchable keyring
449 * and interfere with the next attempt to instantiate the key.
451 if (rc
!= 0 && key
== 0)
452 keyctl_negate(key
, 1, KEY_REQKEY_DEFL_DEFAULT
);
453 data_blob_free(&secblob
);
454 data_blob_free(&sess_key
);