1 /* $NetBSD: common.c,v 1.2 2017/01/28 21:31:49 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1997 - 2005 Kungliga Tekniska Hgskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include "kafs_locl.h" 37 38 #define AUTH_SUPERUSER "afs" 39 40 /* 41 * Here only ASCII characters are relevant. 42 */ 43 44 #define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z') 45 46 #define ToAsciiUpper(c) ((c) - 'a' + 'A') 47 48 static void (*kafs_verbose)(void *, const char *); 49 static void *kafs_verbose_ctx; 50 51 void 52 _kafs_foldup(char *a, const char *b) 53 { 54 for (; *b; a++, b++) 55 if (IsAsciiLower(*b)) 56 *a = ToAsciiUpper(*b); 57 else 58 *a = *b; 59 *a = '\0'; 60 } 61 62 void 63 kafs_set_verbose(void (*f)(void *, const char *), void *ctx) 64 { 65 if (f) { 66 kafs_verbose = f; 67 kafs_verbose_ctx = ctx; 68 } 69 } 70 71 int 72 kafs_settoken_rxkad(const char *cell, struct ClearToken *ct, 73 void *ticket, size_t ticket_len) 74 { 75 struct ViceIoctl parms; 76 char buf[2048], *t; 77 int32_t sizeof_x; 78 79 t = buf; 80 /* 81 * length of secret token followed by secret token 82 */ 83 sizeof_x = ticket_len; 84 memcpy(t, &sizeof_x, sizeof(sizeof_x)); 85 t += sizeof(sizeof_x); 86 memcpy(t, ticket, sizeof_x); 87 t += sizeof_x; 88 /* 89 * length of clear token followed by clear token 90 */ 91 sizeof_x = sizeof(*ct); 92 memcpy(t, &sizeof_x, sizeof(sizeof_x)); 93 t += sizeof(sizeof_x); 94 memcpy(t, ct, sizeof_x); 95 t += sizeof_x; 96 97 /* 98 * do *not* mark as primary cell 99 */ 100 sizeof_x = 0; 101 memcpy(t, &sizeof_x, sizeof(sizeof_x)); 102 t += sizeof(sizeof_x); 103 /* 104 * follow with cell name 105 */ 106 sizeof_x = strlen(cell) + 1; 107 memcpy(t, cell, sizeof_x); 108 t += sizeof_x; 109 110 /* 111 * Build argument block 112 */ 113 parms.in = buf; 114 parms.in_size = t - buf; 115 parms.out = 0; 116 parms.out_size = 0; 117 118 return k_pioctl(0, VIOCSETTOK, &parms, 0); 119 } 120 121 void 122 _kafs_fixup_viceid(struct ClearToken *ct, uid_t uid) 123 { 124 #define ODD(x) ((x) & 1) 125 /* According to Transarc conventions ViceId is valid iff 126 * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime 127 * the transformations: 128 * 129 * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life) 130 * preserves the original values. 131 */ 132 if (uid != 0) /* valid ViceId */ 133 { 134 if (!ODD(ct->EndTimestamp - ct->BeginTimestamp)) 135 ct->EndTimestamp--; 136 } 137 else /* not valid ViceId */ 138 { 139 if (ODD(ct->EndTimestamp - ct->BeginTimestamp)) 140 ct->EndTimestamp--; 141 } 142 } 143 144 /* Try to get a db-server for an AFS cell from a AFSDB record */ 145 146 static int 147 dns_find_cell(const char *cell, char *dbserver, size_t len) 148 { 149 struct rk_dns_reply *r; 150 int ok = -1; 151 r = rk_dns_lookup(cell, "afsdb"); 152 if(r){ 153 struct rk_resource_record *rr = r->head; 154 while(rr){ 155 if(rr->type == rk_ns_t_afsdb && rr->u.afsdb->preference == 1){ 156 strlcpy(dbserver, 157 rr->u.afsdb->domain, 158 len); 159 ok = 0; 160 break; 161 } 162 rr = rr->next; 163 } 164 rk_dns_free_data(r); 165 } 166 return ok; 167 } 168 169 170 /* 171 * Try to find the cells we should try to klog to in "file". 172 */ 173 static void 174 find_cells(const char *file, char ***cells, int *idx) 175 { 176 FILE *f; 177 char cell[64]; 178 int i; 179 int ind = *idx; 180 181 f = fopen(file, "r"); 182 if (f == NULL) 183 return; 184 while (fgets(cell, sizeof(cell), f)) { 185 char *t; 186 t = cell + strlen(cell); 187 for (; t >= cell; t--) 188 if (*t == '\n' || *t == '\t' || *t == ' ') 189 *t = 0; 190 if (cell[0] == '\0' || cell[0] == '#') 191 continue; 192 for(i = 0; i < ind; i++) 193 if(strcmp((*cells)[i], cell) == 0) 194 break; 195 if(i == ind){ 196 char **tmp; 197 198 tmp = realloc(*cells, (ind + 1) * sizeof(**cells)); 199 if (tmp == NULL) 200 break; 201 *cells = tmp; 202 (*cells)[ind] = strdup(cell); 203 if ((*cells)[ind] == NULL) 204 break; 205 ++ind; 206 } 207 } 208 fclose(f); 209 *idx = ind; 210 } 211 212 /* 213 * Get tokens for all cells[] 214 */ 215 static int 216 afslog_cells(struct kafs_data *data, char **cells, int max, uid_t uid, 217 const char *homedir) 218 { 219 int ret = 0; 220 int i; 221 for (i = 0; i < max; i++) { 222 int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir); 223 if (er) 224 ret = er; 225 } 226 return ret; 227 } 228 229 int 230 _kafs_afslog_all_local_cells(struct kafs_data *data, 231 uid_t uid, const char *homedir) 232 { 233 int ret; 234 char **cells = NULL; 235 int idx = 0; 236 237 if (homedir == NULL) 238 homedir = getenv("HOME"); 239 if (homedir != NULL) { 240 char home[MaxPathLen]; 241 snprintf(home, sizeof(home), "%s/.TheseCells", homedir); 242 find_cells(home, &cells, &idx); 243 } 244 find_cells(_PATH_THESECELLS, &cells, &idx); 245 find_cells(_PATH_THISCELL, &cells, &idx); 246 find_cells(_PATH_ARLA_THESECELLS, &cells, &idx); 247 find_cells(_PATH_ARLA_THISCELL, &cells, &idx); 248 find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &idx); 249 find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &idx); 250 find_cells(_PATH_OPENAFS_MACOSX_THESECELLS, &cells, &idx); 251 find_cells(_PATH_OPENAFS_MACOSX_THISCELL, &cells, &idx); 252 find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &idx); 253 find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &idx); 254 find_cells(_PATH_ARLA_OPENBSD_THESECELLS, &cells, &idx); 255 find_cells(_PATH_ARLA_OPENBSD_THISCELL, &cells, &idx); 256 257 ret = afslog_cells(data, cells, idx, uid, homedir); 258 while(idx > 0) 259 free(cells[--idx]); 260 free(cells); 261 return ret; 262 } 263 264 265 static int 266 file_find_cell(struct kafs_data *data, 267 const char *cell, char **realm, int exact) 268 { 269 FILE *F; 270 char buf[1024]; 271 char *p; 272 int ret = -1; 273 274 if ((F = fopen(_PATH_CELLSERVDB, "r")) 275 || (F = fopen(_PATH_ARLA_CELLSERVDB, "r")) 276 || (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r")) 277 || (F = fopen(_PATH_OPENAFS_MACOSX_CELLSERVDB, "r")) 278 || (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) { 279 while (fgets(buf, sizeof(buf), F)) { 280 int cmp; 281 282 if (buf[0] != '>') 283 continue; /* Not a cell name line, try next line */ 284 p = buf; 285 strsep(&p, " \t\n#"); 286 287 if (exact) 288 cmp = strcmp(buf + 1, cell); 289 else 290 cmp = strncmp(buf + 1, cell, strlen(cell)); 291 292 if (cmp == 0) { 293 /* 294 * We found the cell name we're looking for. 295 * Read next line on the form ip-address '#' hostname 296 */ 297 if (fgets(buf, sizeof(buf), F) == NULL) 298 break; /* Read failed, give up */ 299 p = strchr(buf, '#'); 300 if (p == NULL) 301 break; /* No '#', give up */ 302 p++; 303 if (buf[strlen(buf) - 1] == '\n') 304 buf[strlen(buf) - 1] = '\0'; 305 *realm = (*data->get_realm)(data, p); 306 if (*realm && **realm != '\0') 307 ret = 0; 308 break; /* Won't try any more */ 309 } 310 } 311 fclose(F); 312 } 313 return ret; 314 } 315 316 /* Find the realm associated with cell. Do this by opening CellServDB 317 file and getting the realm-of-host for the first VL-server for the 318 cell. 319 320 This does not work when the VL-server is living in one realm, but 321 the cell it is serving is living in another realm. 322 323 Return 0 on success, -1 otherwise. 324 */ 325 326 int 327 _kafs_realm_of_cell(struct kafs_data *data, 328 const char *cell, char **realm) 329 { 330 char buf[1024]; 331 int ret; 332 333 ret = file_find_cell(data, cell, realm, 1); 334 if (ret == 0) 335 return ret; 336 if (dns_find_cell(cell, buf, sizeof(buf)) == 0) { 337 *realm = (*data->get_realm)(data, buf); 338 if(*realm != NULL) 339 return 0; 340 } 341 return file_find_cell(data, cell, realm, 0); 342 } 343 344 static int 345 _kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell, 346 const char *realm, uid_t uid, struct kafs_token *kt) 347 { 348 int ret; 349 350 ret = (*data->get_cred)(data, user, cell, realm, uid, kt); 351 if (kafs_verbose) { 352 const char *estr = (*data->get_error)(data, ret); 353 char *str; 354 int aret; 355 356 aret = asprintf(&str, "%s tried afs%s%s@%s -> %s (%d)", 357 data->name, cell ? "/" : "", 358 cell ? cell : "", realm, estr ? estr : "unknown", ret); 359 if (aret != -1) { 360 (*kafs_verbose)(kafs_verbose_ctx, str); 361 free(str); 362 } else { 363 (*kafs_verbose)(kafs_verbose_ctx, "out of memory"); 364 } 365 if (estr) 366 (*data->free_error)(data, estr); 367 } 368 369 return ret; 370 } 371 372 373 int 374 _kafs_get_cred(struct kafs_data *data, 375 const char *cell, 376 const char *realm_hint, 377 const char *realm, 378 uid_t uid, 379 struct kafs_token *kt) 380 { 381 int ret = -1; 382 char *vl_realm; 383 char CELL[64]; 384 385 /* We're about to find the realm that holds the key for afs in 386 * the specified cell. The problem is that null-instance 387 * afs-principals are common and that hitting the wrong realm might 388 * yield the wrong afs key. The following assumptions were made. 389 * 390 * Any realm passed to us is preferred. 391 * 392 * If there is a realm with the same name as the cell, it is most 393 * likely the correct realm to talk to. 394 * 395 * In most (maybe even all) cases the database servers of the cell 396 * will live in the realm we are looking for. 397 * 398 * Try the local realm, but if the previous cases fail, this is 399 * really a long shot. 400 * 401 */ 402 403 /* comments on the ordering of these tests */ 404 405 /* If the user passes a realm, she probably knows something we don't 406 * know and we should try afs@realm_hint. 407 */ 408 409 if (realm_hint) { 410 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 411 cell, realm_hint, uid, kt); 412 if (ret == 0) return 0; 413 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 414 NULL, realm_hint, uid, kt); 415 if (ret == 0) return 0; 416 } 417 418 _kafs_foldup(CELL, cell); 419 420 /* 421 * If the AFS servers have a file /usr/afs/etc/krb.conf containing 422 * REALM we still don't have to resort to cross-cell authentication. 423 * Try afs.cell@REALM. 424 */ 425 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 426 cell, realm, uid, kt); 427 if (ret == 0) return 0; 428 429 /* 430 * If cell == realm we don't need no cross-cell authentication. 431 * Try afs@REALM. 432 */ 433 if (strcmp(CELL, realm) == 0) { 434 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 435 NULL, realm, uid, kt); 436 if (ret == 0) return 0; 437 } 438 439 /* 440 * We failed to get ``first class tickets'' for afs, 441 * fall back to cross-cell authentication. 442 * Try afs@CELL. 443 * Try afs.cell@CELL. 444 */ 445 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 446 NULL, CELL, uid, kt); 447 if (ret == 0) return 0; 448 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 449 cell, CELL, uid, kt); 450 if (ret == 0) return 0; 451 452 /* 453 * Perhaps the cell doesn't correspond to any realm? 454 * Use realm of first volume location DB server. 455 * Try afs.cell@VL_REALM. 456 * Try afs@VL_REALM??? 457 */ 458 if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0 459 && strcmp(vl_realm, realm) != 0 460 && strcmp(vl_realm, CELL) != 0) { 461 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 462 cell, vl_realm, uid, kt); 463 if (ret) 464 ret = _kafs_try_get_cred(data, AUTH_SUPERUSER, 465 NULL, vl_realm, uid, kt); 466 free(vl_realm); 467 if (ret == 0) return 0; 468 } 469 470 return ret; 471 } 472
Indexes created Sat Feb 28 05:31:39 UTC 2026