2 * Copyright (c) 1995-2003 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kafs_locl.h"
36 struct krb5_kafs_data
{
39 krb5_const_realm realm
;
43 KAFS_RXKAD_2B_KVNO
= 213,
44 KAFS_RXKAD_K5_KVNO
= 256
48 v5_to_kt(krb5_creds
*cred
, uid_t uid
, struct kafs_token
*kt
, int local524
)
60 kvno
= KAFS_RXKAD_2B_KVNO
;
62 ret
= decode_Ticket(cred
->ticket
.data
, cred
->ticket
.length
, &t
, &len
);
68 ASN1_MALLOC_ENCODE(EncryptedData
, buf
, buf_len
, &t
.enc_part
,
75 return KRB5KRB_ERR_GENERIC
;
79 kt
->ticket_len
= buf_len
;
82 kvno
= KAFS_RXKAD_K5_KVNO
;
83 kt
->ticket
= malloc(cred
->ticket
.length
);
84 if (kt
->ticket
== NULL
)
86 kt
->ticket_len
= cred
->ticket
.length
;
87 memcpy(kt
->ticket
, cred
->ticket
.data
, kt
->ticket_len
);
94 * Build a struct ClearToken
97 ret
= _kafs_derive_des_key(cred
->session
.keytype
,
98 cred
->session
.keyvalue
.data
,
99 cred
->session
.keyvalue
.length
,
100 kt
->ct
.HandShakeKey
);
106 kt
->ct
.AuthHandle
= kvno
;
108 kt
->ct
.BeginTimestamp
= cred
->times
.starttime
;
109 kt
->ct
.EndTimestamp
= cred
->times
.endtime
;
111 _kafs_fixup_viceid(&kt
->ct
, uid
);
116 static krb5_error_code
117 v5_convert(krb5_context context
, krb5_ccache id
,
118 krb5_creds
*cred
, uid_t uid
,
120 struct kafs_token
*kt
)
129 krb5_appdefault_string (context
, "libkafs",
131 "afs-use-524", "2b", &val
);
134 if (strcasecmp(val
, "local") == 0 ||
135 strcasecmp(val
, "2b") == 0)
136 ret
= v5_to_kt(cred
, uid
, kt
, 1);
138 ret
= v5_to_kt(cred
, uid
, kt
, 0);
150 get_cred(struct kafs_data
*data
, const char *name
, const char *inst
,
151 const char *realm
, uid_t uid
, struct kafs_token
*kt
)
154 krb5_creds in_creds
, *out_creds
;
155 struct krb5_kafs_data
*d
= data
->data
;
158 memset(&in_creds
, 0, sizeof(in_creds
));
160 ret
= krb5_make_principal(d
->context
, &in_creds
.server
,
161 realm
, name
, inst
, NULL
);
164 ret
= krb5_cc_get_principal(d
->context
, d
->id
, &in_creds
.client
);
166 krb5_free_principal(d
->context
, in_creds
.server
);
170 /* check if des is disable, and in that case enable it for afs */
171 invalid
= krb5_enctype_valid(d
->context
, ETYPE_DES_CBC_CRC
);
173 krb5_enctype_enable(d
->context
, ETYPE_DES_CBC_CRC
);
175 ret
= krb5_get_credentials(d
->context
, 0, d
->id
, &in_creds
, &out_creds
);
178 krb5_enctype_disable(d
->context
, ETYPE_DES_CBC_CRC
);
180 krb5_free_principal(d
->context
, in_creds
.server
);
181 krb5_free_principal(d
->context
, in_creds
.client
);
185 ret
= v5_convert(d
->context
, d
->id
, out_creds
, uid
,
186 (inst
!= NULL
&& inst
[0] != '\0') ? inst
: realm
, kt
);
187 krb5_free_creds(d
->context
, out_creds
);
193 get_error(struct kafs_data
*data
, int error
)
195 struct krb5_kafs_data
*d
= data
->data
;
196 return krb5_get_error_message(d
->context
, error
);
200 free_error(struct kafs_data
*data
, const char *str
)
202 struct krb5_kafs_data
*d
= data
->data
;
203 krb5_free_error_message(d
->context
, str
);
206 static krb5_error_code
207 afslog_uid_int(struct kafs_data
*data
, const char *cell
, const char *rh
,
208 uid_t uid
, const char *homedir
)
211 struct kafs_token kt
;
212 krb5_principal princ
;
213 const char *trealm
; /* ticket realm */
214 struct krb5_kafs_data
*d
= data
->data
;
216 if (cell
== 0 || cell
[0] == 0)
217 return _kafs_afslog_all_local_cells (data
, uid
, homedir
);
219 ret
= krb5_cc_get_principal (d
->context
, d
->id
, &princ
);
223 trealm
= krb5_principal_get_realm (d
->context
, princ
);
226 ret
= _kafs_get_cred(data
, cell
, d
->realm
, trealm
, uid
, &kt
);
227 krb5_free_principal (d
->context
, princ
);
230 ret
= kafs_settoken_rxkad(cell
, &kt
.ct
, kt
.ticket
, kt
.ticket_len
);
237 get_realm(struct kafs_data
*data
, const char *host
)
239 struct krb5_kafs_data
*d
= data
->data
;
242 if(krb5_get_host_realm(d
->context
, host
, &realms
))
244 r
= strdup(realms
[0]);
245 krb5_free_host_realm(d
->context
, realms
);
250 krb5_afslog_uid_home(krb5_context context
,
253 krb5_const_realm realm
,
258 struct krb5_kafs_data d
;
262 kd
.afslog_uid
= afslog_uid_int
;
263 kd
.get_cred
= get_cred
;
264 kd
.get_realm
= get_realm
;
265 kd
.get_error
= get_error
;
266 kd
.free_error
= free_error
;
268 if (context
== NULL
) {
269 ret
= krb5_init_context(&d
.context
);
275 ret
= krb5_cc_default(d
.context
, &d
.id
);
281 ret
= afslog_uid_int(&kd
, cell
, 0, uid
, homedir
);
283 krb5_cc_close(context
, d
.id
);
286 krb5_free_context(d
.context
);
291 krb5_afslog_uid(krb5_context context
,
294 krb5_const_realm realm
,
297 return krb5_afslog_uid_home (context
, id
, cell
, realm
, uid
, NULL
);
301 krb5_afslog(krb5_context context
,
304 krb5_const_realm realm
)
306 return krb5_afslog_uid (context
, id
, cell
, realm
, getuid());
310 krb5_afslog_home(krb5_context context
,
313 krb5_const_realm realm
,
316 return krb5_afslog_uid_home (context
, id
, cell
, realm
, getuid(), homedir
);
324 krb5_realm_of_cell(const char *cell
, char **realm
)
329 kd
.get_realm
= get_realm
;
330 kd
.get_error
= get_error
;
331 kd
.free_error
= free_error
;
332 return _kafs_realm_of_cell(&kd
, cell
, realm
);
340 kafs_settoken5(krb5_context context
, const char *cell
, uid_t uid
,
343 struct kafs_token kt
;
346 ret
= v5_convert(context
, NULL
, cred
, uid
, cell
, &kt
);
350 ret
= kafs_settoken_rxkad(cell
, &kt
.ct
, kt
.ticket
, kt
.ticket_len
);