source3/lib/afs.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Generate AFS tickets
   4  *  Copyright (C) Volker Lendecke 2003
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21
  22 #ifdef WITH_FAKE_KASERVER
  23
  24 #define NO_ASN1_TYPEDEFS 1
  25
  26 #include <afs/param.h>
  27 #include <afs/stds.h>
  28 #include <afs/afs.h>
  29 #include <afs/auth.h>
  30 #include <afs/venus.h>
  31 #include <asm/unistd.h>
  32 #include <openssl/des.h>
  33
  34 struct ClearToken {
  35         uint32 AuthHandle;
  36         char HandShakeKey[8];
  37         uint32 ViceId;
  38         uint32 BeginTimestamp;
  39         uint32 EndTimestamp;
  40 };
  41
  42 static char *afs_encode_token(const char *cell, const DATA_BLOB ticket,
  43                               const struct ClearToken *ct)
  44 {
  45         char *base64_ticket;
  46         char *result = NULL;
  47
  48         DATA_BLOB key = data_blob(ct->HandShakeKey, 8);
  49         char *base64_key;
  50         TALLOC_CTX *mem_ctx;
  51
  52         mem_ctx = talloc_stackframe();
  53         if (mem_ctx == NULL)
  54                 goto done;
  55
  56         base64_ticket = base64_encode_data_blob(mem_ctx, ticket);
  57         if (base64_ticket == NULL)
  58                 goto done;
  59
  60         base64_key = base64_encode_data_blob(mem_ctx, key);
  61         if (base64_key == NULL)
  62                 goto done;
  63
  64         asprintf(&result, "%s\n%u\n%s\n%u\n%u\n%u\n%s\n", cell,
  65                  ct->AuthHandle, base64_key, ct->ViceId, ct->BeginTimestamp,
  66                  ct->EndTimestamp, base64_ticket);
  67
  68         DEBUG(10, ("Got ticket string:\n%s\n", result));
  69
  70 done:
  71         TALLOC_FREE(mem_ctx);
  72
  73         return result;
  74 }
  75
  76 /* Create a ClearToken and an encrypted ticket. ClearToken has not yet the
  77  * ViceId set, this should be set by the caller. */
  78
  79 static bool afs_createtoken(const char *username, const char *cell,
  80                             DATA_BLOB *ticket, struct ClearToken *ct)
  81 {
  82         fstring clear_ticket;
  83         char *p = clear_ticket;
  84         uint32 len;
  85         uint32 now;
  86
  87         struct afs_key key;
  88         des_key_schedule key_schedule;
  89
  90         if (!secrets_init())
  91                 return False;
  92
  93         if (!secrets_fetch_afs_key(cell, &key)) {
  94                 DEBUG(1, ("Could not fetch AFS service key\n"));
  95                 return False;
  96         }
  97
  98         ct->AuthHandle = key.kvno;
  99
 100         /* Build the ticket. This is going to be encrypted, so in our
 101            way we fill in ct while we still have the unencrypted
 102            form. */
 103
 104         p = clear_ticket;
 105
 106         /* The byte-order */
 107         *p = 1;
 108         p += 1;
 109
 110         /* "Alice", the client username */
 111         strncpy(p, username, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 112         p += strlen(p)+1;
 113         strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 114         p += strlen(p)+1;
 115         strncpy(p, cell, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 116         p += strlen(p)+1;
 117
 118         /* Alice's network layer address. At least Openafs-1.2.10
 119            ignores this, so we fill in a dummy value here. */
 120         SIVAL(p, 0, 0);
 121         p += 4;
 122
 123         /* We need to create a session key */
 124         generate_random_buffer(p, 8);
 125
 126         /* Our client code needs the the key in the clear, it does not
 127            know the server-key ... */
 128         memcpy(ct->HandShakeKey, p, 8);
 129
 130         p += 8;
 131
 132         /* This is a kerberos 4 life time. The life time is expressed
 133          * in units of 5 minute intervals up to 38400 seconds, after
 134          * that a table is used up to lifetime 0xBF. Values between
 135          * 0xC0 and 0xFF is undefined. 0xFF is defined to be the
 136          * infinite time that never expire.
 137          *
 138          * So here we cheat and use the infinite time */
 139         *p = 255;
 140         p += 1;
 141
 142         /* Ticket creation time */
 143         now = time(NULL);
 144         SIVAL(p, 0, now);
 145         ct->BeginTimestamp = now;
 146
 147         if(lp_afs_token_lifetime() == 0)
 148                 ct->EndTimestamp = NEVERDATE;
 149         else
 150                 ct->EndTimestamp = now + lp_afs_token_lifetime();
 151
 152         if (((ct->EndTimestamp - ct->BeginTimestamp) & 1) == 1) {
 153                 ct->BeginTimestamp += 1; /* Lifetime must be even */
 154         }
 155         p += 4;
 156
 157         /* And here comes Bob's name and instance, in this case the
 158            AFS server. */
 159         strncpy(p, "afs", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 160         p += strlen(p)+1;
 161         strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
 162         p += strlen(p)+1;
 163
 164         /* And zero-pad to a multiple of 8 bytes */
 165         len = PTR_DIFF(p, clear_ticket);
 166         if (len & 7) {
 167                 uint32 extra_space = 8-(len & 7);
 168                 memset(p, 0, extra_space);
 169                 p+=extra_space;
 170         }
 171         len = PTR_DIFF(p, clear_ticket);
 172
 173         des_key_sched((const_des_cblock *)key.key, key_schedule);
 174         des_pcbc_encrypt(clear_ticket, clear_ticket,
 175                          len, key_schedule, (C_Block *)key.key, 1);
 176
 177         ZERO_STRUCT(key);
 178
 179         *ticket = data_blob(clear_ticket, len);
 180
 181         return True;
 182 }
 183
 184 char *afs_createtoken_str(const char *username, const char *cell)
 185 {
 186         DATA_BLOB ticket;
 187         struct ClearToken ct;
 188         char *result;
 189
 190         if (!afs_createtoken(username, cell, &ticket, &ct))
 191                 return NULL;
 192
 193         result = afs_encode_token(cell, ticket, &ct);
 194
 195         data_blob_free(&ticket);
 196
 197         return result;
 198 }
 199
 200 /*
 201   This routine takes a radical approach completely bypassing the
 202   Kerberos idea of security and using AFS simply as an intelligent
 203   file backend. Samba has persuaded itself somehow that the user is
 204   actually correctly identified and then we create a ticket that the
 205   AFS server hopefully accepts using its KeyFile that the admin has
 206   kindly stored to our secrets.tdb.
 207
 208   Thanks to the book "Network Security -- PRIVATE Communication in a
 209   PUBLIC World" by Charlie Kaufman, Radia Perlman and Mike Speciner
 210   Kerberos 4 tickets are not really hard to construct.
 211
 212   For the comments "Alice" is the User to be auth'ed, and "Bob" is the
 213   AFS server.  */
 214
 215 bool afs_login(connection_struct *conn)
 216 {
 217         DATA_BLOB ticket;
 218         char *afs_username = NULL;
 219         char *cell = NULL;
 220         bool result;
 221         char *ticket_str = NULL;
 222         const struct dom_sid *user_sid;
 223         TALLOC_CTX *ctx = talloc_tos();
 224
 225         struct ClearToken ct;
 226
 227         afs_username = talloc_strdup(ctx,
 228                                 lp_afs_username_map());
 229         if (!afs_username) {
 230                 return false;
 231         }
 232
 233         afs_username = talloc_sub_advanced(ctx,
 234                                 SNUM(conn), conn->session_info->unix_name,
 235                                 conn->connectpath, conn->session_info->utok.gid,
 236                                 conn->session_info->sanitized_username,
 237                                 pdb_get_domain(conn->session_info->sam_account),
 238                                 afs_username);
 239         if (!afs_username) {
 240                 return false;
 241         }
 242
 243         user_sid = &conn->session_info->security_token->user_sids[0];
 244         afs_username = talloc_string_sub(talloc_tos(),
 245                                         afs_username,
 246                                         "%s",
 247                                         sid_string_tos(user_sid));
 248         if (!afs_username) {
 249                 return false;
 250         }
 251
 252         /* The pts command always generates completely lower-case user
 253          * names. */
 254         strlower_m(afs_username);
 255
 256         cell = strchr(afs_username, '@');
 257
 258         if (cell == NULL) {
 259                 DEBUG(1, ("AFS username doesn't contain a @, "
 260                           "could not find cell\n"));
 261                 return false;
 262         }
 263
 264         *cell = '\0';
 265         cell += 1;
 266
 267         DEBUG(10, ("Trying to log into AFS for user %s@%s\n",
 268                    afs_username, cell));
 269
 270         if (!afs_createtoken(afs_username, cell, &ticket, &ct))
 271                 return False;
 272
 273         /* For which Unix-UID do we want to set the token? */
 274         ct.ViceId = getuid();
 275
 276         ticket_str = afs_encode_token(cell, ticket, &ct);
 277
 278         result = afs_settoken_str(ticket_str);
 279
 280         SAFE_FREE(ticket_str);
 281
 282         data_blob_free(&ticket);
 283
 284         return result;
 285 }
 286
 287 #else
 288
 289 bool afs_login(connection_struct *conn)
 290 {
 291         return True;
 292 }
 293
 294 char *afs_createtoken_str(const char *username, const char *cell)
 295 {
 296         return NULL;
 297 }
 298
 299 #endif /* WITH_FAKE_KASERVER */