lib/afs/afs_funcs.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Generate AFS tickets
   4  *  Copyright (C) Volker Lendecke 2003
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "lib/afs/afs_funcs.h"
  22
  23 #ifdef WITH_FAKE_KASERVER
  24
  25 #define NO_ASN1_TYPEDEFS 1
  26
  27 #include "secrets.h"
  28 #include "passdb.h"
  29 #include "auth.h"
  30 #include "../librpc/gen_ndr/ndr_netlogon.h"
  31 #include "lib/afs/afs_settoken.h"
  32
  33 #include <afs/param.h>
  34 #include <afs/stds.h>
  35 #include <afs/auth.h>
  36 #include <afs/venus.h>
  37 #include <asm/unistd.h>
  38 #include <openssl/des.h>
  39
  40 struct ClearToken {
  41         uint32 AuthHandle;
  42         char HandShakeKey[8];
  43         uint32 ViceId;
  44         uint32 BeginTimestamp;
  45         uint32 EndTimestamp;
  46 };
  47
  48 static char *afs_encode_token(const char *cell, const DATA_BLOB ticket,
  49                               const struct ClearToken *ct)
  50 {
  51         char *base64_ticket;
  52         char *result = NULL;
  53
  54         DATA_BLOB key = data_blob(ct->HandShakeKey, 8);
  55         char *base64_key;
  56         TALLOC_CTX *mem_ctx;
  57
  58         mem_ctx = talloc_stackframe();
  59         if (mem_ctx == NULL)
  60                 goto done;
  61
  62         base64_ticket = base64_encode_data_blob(mem_ctx, ticket);
  63         if (base64_ticket == NULL)
  64                 goto done;
  65
  66         base64_key = base64_encode_data_blob(mem_ctx, key);
  67         if (base64_key == NULL)
  68                 goto done;
  69
  70         asprintf(&result, "%s\n%u\n%s\n%u\n%u\n%u\n%s\n", cell,
  71                  ct->AuthHandle, base64_key, ct->ViceId, ct->BeginTimestamp,
  72                  ct->EndTimestamp, base64_ticket);
  73
  74         DEBUG(10, ("Got ticket string:\n%s\n", result));
  75
  76 done:
  77         TALLOC_FREE(mem_ctx);
  78
  79         return result;
  80 }
  81
  82 /* Create a ClearToken and an encrypted ticket. ClearToken has not yet the
  83  * ViceId set, this should be set by the caller. */
  84
  85 static bool afs_createtoken(const char *username, const char *cell,
  86                             DATA_BLOB *ticket, struct ClearToken *ct)
  87 {
  88         fstring clear_ticket;
  89         char *p = clear_ticket;
  90         uint32 len;
  91         uint32 now;
  92
  93         struct afs_key key;
  94         des_key_schedule key_schedule;
  95
  96         if (!secrets_init())
  97                 return false;
  98
  99         if (!secrets_fetch_afs_key(cell, &key)) {
 100                 DEBUG(1, ("Could not fetch AFS service key\n"));
 101                 return false;
 102         }
 103
 104         ct->AuthHandle = key.kvno;
 105
 106         /* Build the ticket. This is going to be encrypted, so in our
 107            way we fill in ct while we still have the unencrypted
 108            form. */
 109
 110         p = clear_ticket;
 111
 112         /* The byte-order */
 113         *p = 1;
 114         p += 1;
 115
 116         /* "Alice", the client username */
 117         strncpy(p, username, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 118         p += strlen(p)+1;
 119         strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 120         p += strlen(p)+1;
 121         strncpy(p, cell, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 122         p += strlen(p)+1;
 123
 124         /* Alice's network layer address. At least Openafs-1.2.10
 125            ignores this, so we fill in a dummy value here. */
 126         SIVAL(p, 0, 0);
 127         p += 4;
 128
 129         /* We need to create a session key */
 130         generate_random_buffer((uint8_t *)p, 8);
 131
 132         /* Our client code needs the the key in the clear, it does not
 133            know the server-key ... */
 134         memcpy(ct->HandShakeKey, p, 8);
 135
 136         p += 8;
 137
 138         /* This is a kerberos 4 life time. The life time is expressed
 139          * in units of 5 minute intervals up to 38400 seconds, after
 140          * that a table is used up to lifetime 0xBF. Values between
 141          * 0xC0 and 0xFF is undefined. 0xFF is defined to be the
 142          * infinite time that never expire.
 143          *
 144          * So here we cheat and use the infinite time */
 145         *p = 255;
 146         p += 1;
 147
 148         /* Ticket creation time */
 149         now = time(NULL);
 150         SIVAL(p, 0, now);
 151         ct->BeginTimestamp = now;
 152
 153         if(lp_afs_token_lifetime() == 0)
 154                 ct->EndTimestamp = NEVERDATE;
 155         else
 156                 ct->EndTimestamp = now + lp_afs_token_lifetime();
 157
 158         if (((ct->EndTimestamp - ct->BeginTimestamp) & 1) == 1) {
 159                 ct->BeginTimestamp += 1; /* Lifetime must be even */
 160         }
 161         p += 4;
 162
 163         /* And here comes Bob's name and instance, in this case the
 164            AFS server. */
 165         strncpy(p, "afs", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 166         p += strlen(p)+1;
 167         strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 168         p += strlen(p)+1;
 169
 170         /* And zero-pad to a multiple of 8 bytes */
 171         len = PTR_DIFF(p, clear_ticket);
 172         if (len & 7) {
 173                 uint32 extra_space = 8-(len & 7);
 174                 memset(p, 0, extra_space);
 175                 p+=extra_space;
 176         }
 177         len = PTR_DIFF(p, clear_ticket);
 178
 179         des_key_sched((const_des_cblock *)key.key, key_schedule);
 180         des_pcbc_encrypt((const unsigned char*) clear_ticket,
 181                          (unsigned char*) clear_ticket,
 182                          len, key_schedule, (C_Block *)key.key, 1);
 183
 184         ZERO_STRUCT(key);
 185
 186         *ticket = data_blob(clear_ticket, len);
 187
 188         return true;
 189 }
 190
 191 char *afs_createtoken_str(const char *username, const char *cell)
 192 {
 193         DATA_BLOB ticket;
 194         struct ClearToken ct;
 195         char *result;
 196
 197         if (!afs_createtoken(username, cell, &ticket, &ct))
 198                 return NULL;
 199
 200         result = afs_encode_token(cell, ticket, &ct);
 201
 202         data_blob_free(&ticket);
 203
 204         return result;
 205 }
 206
 207 /*
 208   This routine takes a radical approach completely bypassing the
 209   Kerberos idea of security and using AFS simply as an intelligent
 210   file backend. Samba has persuaded itself somehow that the user is
 211   actually correctly identified and then we create a ticket that the
 212   AFS server hopefully accepts using its KeyFile that the admin has
 213   kindly stored to our secrets.tdb.
 214
 215   Thanks to the book "Network Security -- PRIVATE Communication in a
 216   PUBLIC World" by Charlie Kaufman, Radia Perlman and Mike Speciner
 217   Kerberos 4 tickets are not really hard to construct.
 218
 219   For the comments "Alice" is the User to be auth'ed, and "Bob" is the
 220   AFS server.  */
 221
 222 bool afs_login(connection_struct *conn)
 223 {
 224         const struct loadparm_substitution *lp_sub =
 225                 loadparm_s3_global_substitution();
 226         DATA_BLOB ticket;
 227         char *afs_username = NULL;
 228         char *cell = NULL;
 229         bool result;
 230         char *ticket_str = NULL;
 231         const struct dom_sid *user_sid;
 232         TALLOC_CTX *ctx = talloc_tos();
 233         struct dom_sid_buf buf;
 234
 235         struct ClearToken ct;
 236
 237         afs_username = talloc_strdup(ctx,
 238                                 lp_afs_username_map());
 239         if (!afs_username) {
 240                 return false;
 241         }
 242
 243         afs_username = talloc_sub_advanced(ctx,
 244                                 lp_servicename(ctx, lp_sub, SNUM(conn)),
 245                                 conn->session_info->unix_info->unix_name,
 246                                 conn->connectpath,
 247                                 conn->session_info->unix_token->gid,
 248                                 conn->session_info->unix_info->sanitized_username,
 249                                 conn->session_info->info->domain_name,
 250                                 afs_username);
 251         if (!afs_username) {
 252                 return false;
 253         }
 254
 255         user_sid = &conn->session_info->security_token->sids[0];
 256         afs_username = talloc_string_sub(talloc_tos(),
 257                                         afs_username,
 258                                         "%s",
 259                                         dom_sid_str_buf(user_sid, &buf));
 260         if (!afs_username) {
 261                 return false;
 262         }
 263
 264         /* The pts command always generates completely lower-case user
 265          * names. */
 266         if (!strlower_m(afs_username)) {
 267                 return false;
 268         }
 269
 270         cell = strchr(afs_username, '@');
 271
 272         if (cell == NULL) {
 273                 DEBUG(1, ("AFS username doesn't contain a @, "
 274                           "could not find cell\n"));
 275                 return false;
 276         }
 277
 278         *cell = '\0';
 279         cell += 1;
 280
 281         DEBUG(10, ("Trying to log into AFS for user %s@%s\n",
 282                    afs_username, cell));
 283
 284         if (!afs_createtoken(afs_username, cell, &ticket, &ct))
 285                 return false;
 286
 287         /* For which Unix-UID do we want to set the token? */
 288         ct.ViceId = getuid();
 289
 290         ticket_str = afs_encode_token(cell, ticket, &ct);
 291
 292         result = afs_settoken_str(ticket_str);
 293
 294         SAFE_FREE(ticket_str);
 295
 296         data_blob_free(&ticket);
 297
 298         return result;
 299 }
 300
 301 #else
 302
 303 bool afs_login(connection_struct *conn)
 304 {
 305         return true;
 306 }
 307
 308 char *afs_createtoken_str(const char *username, const char *cell)
 309 {
 310         return NULL;
 311 }
 312
 313 #endif /* WITH_FAKE_KASERVER */