1 /*	$NetBSD: common.c,v 1.1.1.1 2011/04/13 18:15:30 elric Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
5  * (Royal Institute of Technology, Stockholm, Sweden).
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * 3. Neither the name of the Institute nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 
36 #include "kafs_locl.h"
37 
38 #define AUTH_SUPERUSER "afs"
39 
40 /*
41  * Here only ASCII characters are relevant.
42  */
43 
44 #define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z')
45 
46 #define ToAsciiUpper(c) ((c) - 'a' + 'A')
47 
48 static void (*kafs_verbose)(void *, const char *);
49 static void *kafs_verbose_ctx;
50 
51 void
_kafs_foldup(char * a,const char * b)52 _kafs_foldup(char *a, const char *b)
53 {
54   for (; *b; a++, b++)
55     if (IsAsciiLower(*b))
56       *a = ToAsciiUpper(*b);
57     else
58       *a = *b;
59   *a = '\0';
60 }
61 
62 void
kafs_set_verbose(void (* f)(void *,const char *),void * ctx)63 kafs_set_verbose(void (*f)(void *, const char *), void *ctx)
64 {
65     if (f) {
66 	kafs_verbose = f;
67 	kafs_verbose_ctx = ctx;
68     }
69 }
70 
71 int
kafs_settoken_rxkad(const char * cell,struct ClearToken * ct,void * ticket,size_t ticket_len)72 kafs_settoken_rxkad(const char *cell, struct ClearToken *ct,
73 		    void *ticket, size_t ticket_len)
74 {
75     struct ViceIoctl parms;
76     char buf[2048], *t;
77     int32_t sizeof_x;
78 
79     t = buf;
80     /*
81      * length of secret token followed by secret token
82      */
83     sizeof_x = ticket_len;
84     memcpy(t, &sizeof_x, sizeof(sizeof_x));
85     t += sizeof(sizeof_x);
86     memcpy(t, ticket, sizeof_x);
87     t += sizeof_x;
88     /*
89      * length of clear token followed by clear token
90      */
91     sizeof_x = sizeof(*ct);
92     memcpy(t, &sizeof_x, sizeof(sizeof_x));
93     t += sizeof(sizeof_x);
94     memcpy(t, ct, sizeof_x);
95     t += sizeof_x;
96 
97     /*
98      * do *not* mark as primary cell
99      */
100     sizeof_x = 0;
101     memcpy(t, &sizeof_x, sizeof(sizeof_x));
102     t += sizeof(sizeof_x);
103     /*
104      * follow with cell name
105      */
106     sizeof_x = strlen(cell) + 1;
107     memcpy(t, cell, sizeof_x);
108     t += sizeof_x;
109 
110     /*
111      * Build argument block
112      */
113     parms.in = buf;
114     parms.in_size = t - buf;
115     parms.out = 0;
116     parms.out_size = 0;
117 
118     return k_pioctl(0, VIOCSETTOK, &parms, 0);
119 }
120 
121 void
_kafs_fixup_viceid(struct ClearToken * ct,uid_t uid)122 _kafs_fixup_viceid(struct ClearToken *ct, uid_t uid)
123 {
124 #define ODD(x) ((x) & 1)
125     /* According to Transarc conventions ViceId is valid iff
126      * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime
127      * the transformations:
128      *
129      * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life)
130      * preserves the original values.
131      */
132     if (uid != 0)		/* valid ViceId */
133     {
134 	if (!ODD(ct->EndTimestamp - ct->BeginTimestamp))
135 	    ct->EndTimestamp--;
136     }
137     else			/* not valid ViceId */
138     {
139 	if (ODD(ct->EndTimestamp - ct->BeginTimestamp))
140 	    ct->EndTimestamp--;
141     }
142 }
143 
144 /* Try to get a db-server for an AFS cell from a AFSDB record */
145 
146 static int
dns_find_cell(const char * cell,char * dbserver,size_t len)147 dns_find_cell(const char *cell, char *dbserver, size_t len)
148 {
149     struct rk_dns_reply *r;
150     int ok = -1;
151     r = rk_dns_lookup(cell, "afsdb");
152     if(r){
153 	struct rk_resource_record *rr = r->head;
154 	while(rr){
155 	    if(rr->type == rk_ns_t_afsdb && rr->u.afsdb->preference == 1){
156 		strlcpy(dbserver,
157 				rr->u.afsdb->domain,
158 				len);
159 		ok = 0;
160 		break;
161 	    }
162 	    rr = rr->next;
163 	}
164 	rk_dns_free_data(r);
165     }
166     return ok;
167 }
168 
169 
170 /*
171  * Try to find the cells we should try to klog to in "file".
172  */
173 static void
find_cells(const char * file,char *** cells,int * idx)174 find_cells(const char *file, char ***cells, int *idx)
175 {
176     FILE *f;
177     char cell[64];
178     int i;
179     int ind = *idx;
180 
181     f = fopen(file, "r");
182     if (f == NULL)
183 	return;
184     while (fgets(cell, sizeof(cell), f)) {
185 	char *t;
186 	t = cell + strlen(cell);
187 	for (; t >= cell; t--)
188 	  if (*t == '\n' || *t == '\t' || *t == ' ')
189 	    *t = 0;
190 	if (cell[0] == '\0' || cell[0] == '#')
191 	    continue;
192 	for(i = 0; i < ind; i++)
193 	    if(strcmp((*cells)[i], cell) == 0)
194 		break;
195 	if(i == ind){
196 	    char **tmp;
197 
198 	    tmp = realloc(*cells, (ind + 1) * sizeof(**cells));
199 	    if (tmp == NULL)
200 		break;
201 	    *cells = tmp;
202 	    (*cells)[ind] = strdup(cell);
203 	    if ((*cells)[ind] == NULL)
204 		break;
205 	    ++ind;
206 	}
207     }
208     fclose(f);
209     *idx = ind;
210 }
211 
212 /*
213  * Get tokens for all cells[]
214  */
215 static int
afslog_cells(struct kafs_data * data,char ** cells,int max,uid_t uid,const char * homedir)216 afslog_cells(struct kafs_data *data, char **cells, int max, uid_t uid,
217 	     const char *homedir)
218 {
219     int ret = 0;
220     int i;
221     for (i = 0; i < max; i++) {
222         int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir);
223 	if (er)
224 	    ret = er;
225     }
226     return ret;
227 }
228 
229 int
_kafs_afslog_all_local_cells(struct kafs_data * data,uid_t uid,const char * homedir)230 _kafs_afslog_all_local_cells(struct kafs_data *data,
231 			     uid_t uid, const char *homedir)
232 {
233     int ret;
234     char **cells = NULL;
235     int idx = 0;
236 
237     if (homedir == NULL)
238 	homedir = getenv("HOME");
239     if (homedir != NULL) {
240 	char home[MaxPathLen];
241 	snprintf(home, sizeof(home), "%s/.TheseCells", homedir);
242 	find_cells(home, &cells, &idx);
243     }
244     find_cells(_PATH_THESECELLS, &cells, &idx);
245     find_cells(_PATH_THISCELL, &cells, &idx);
246     find_cells(_PATH_ARLA_THESECELLS, &cells, &idx);
247     find_cells(_PATH_ARLA_THISCELL, &cells, &idx);
248     find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &idx);
249     find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &idx);
250     find_cells(_PATH_OPENAFS_MACOSX_THESECELLS, &cells, &idx);
251     find_cells(_PATH_OPENAFS_MACOSX_THISCELL, &cells, &idx);
252     find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &idx);
253     find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &idx);
254     find_cells(_PATH_ARLA_OPENBSD_THESECELLS, &cells, &idx);
255     find_cells(_PATH_ARLA_OPENBSD_THISCELL, &cells, &idx);
256 
257     ret = afslog_cells(data, cells, idx, uid, homedir);
258     while(idx > 0)
259 	free(cells[--idx]);
260     free(cells);
261     return ret;
262 }
263 
264 
265 static int
file_find_cell(struct kafs_data * data,const char * cell,char ** realm,int exact)266 file_find_cell(struct kafs_data *data,
267 	       const char *cell, char **realm, int exact)
268 {
269     FILE *F;
270     char buf[1024];
271     char *p;
272     int ret = -1;
273 
274     if ((F = fopen(_PATH_CELLSERVDB, "r"))
275 	|| (F = fopen(_PATH_ARLA_CELLSERVDB, "r"))
276 	|| (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r"))
277 	|| (F = fopen(_PATH_OPENAFS_MACOSX_CELLSERVDB, "r"))
278 	|| (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) {
279 	while (fgets(buf, sizeof(buf), F)) {
280 	    int cmp;
281 
282 	    if (buf[0] != '>')
283 		continue; /* Not a cell name line, try next line */
284 	    p = buf;
285 	    strsep(&p, " \t\n#");
286 
287 	    if (exact)
288 		cmp = strcmp(buf + 1, cell);
289 	    else
290 		cmp = strncmp(buf + 1, cell, strlen(cell));
291 
292 	    if (cmp == 0) {
293 		/*
294 		 * We found the cell name we're looking for.
295 		 * Read next line on the form ip-address '#' hostname
296 		 */
297 		if (fgets(buf, sizeof(buf), F) == NULL)
298 		    break;	/* Read failed, give up */
299 		p = strchr(buf, '#');
300 		if (p == NULL)
301 		    break;	/* No '#', give up */
302 		p++;
303 		if (buf[strlen(buf) - 1] == '\n')
304 		    buf[strlen(buf) - 1] = '\0';
305 		*realm = (*data->get_realm)(data, p);
306 		if (*realm && **realm != '\0')
307 		    ret = 0;
308 		break;		/* Won't try any more */
309 	    }
310 	}
311 	fclose(F);
312     }
313     return ret;
314 }
315 
316 /* Find the realm associated with cell. Do this by opening CellServDB
317    file and getting the realm-of-host for the first VL-server for the
318    cell.
319 
320    This does not work when the VL-server is living in one realm, but
321    the cell it is serving is living in another realm.
322 
323    Return 0 on success, -1 otherwise.
324    */
325 
326 int
_kafs_realm_of_cell(struct kafs_data * data,const char * cell,char ** realm)327 _kafs_realm_of_cell(struct kafs_data *data,
328 		    const char *cell, char **realm)
329 {
330     char buf[1024];
331     int ret;
332 
333     ret = file_find_cell(data, cell, realm, 1);
334     if (ret == 0)
335 	return ret;
336     if (dns_find_cell(cell, buf, sizeof(buf)) == 0) {
337 	*realm = (*data->get_realm)(data, buf);
338 	if(*realm != NULL)
339 	    return 0;
340     }
341     return file_find_cell(data, cell, realm, 0);
342 }
343 
344 static int
_kafs_try_get_cred(struct kafs_data * data,const char * user,const char * cell,const char * realm,uid_t uid,struct kafs_token * kt)345 _kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell,
346 		   const char *realm, uid_t uid, struct kafs_token *kt)
347 {
348     int ret;
349 
350     ret = (*data->get_cred)(data, user, cell, realm, uid, kt);
351     if (kafs_verbose) {
352 	const char *estr = (*data->get_error)(data, ret);
353 	char *str;
354 	asprintf(&str, "%s tried afs%s%s@%s -> %s (%d)",
355 		 data->name, cell ? "/" : "",
356 		 cell ? cell : "", realm, estr ? estr : "unknown", ret);
357 	(*kafs_verbose)(kafs_verbose_ctx, str);
358 	if (estr)
359 	    (*data->free_error)(data, estr);
360 	free(str);
361     }
362 
363     return ret;
364 }
365 
366 
367 int
_kafs_get_cred(struct kafs_data * data,const char * cell,const char * realm_hint,const char * realm,uid_t uid,struct kafs_token * kt)368 _kafs_get_cred(struct kafs_data *data,
369 	       const char *cell,
370 	       const char *realm_hint,
371 	       const char *realm,
372 	       uid_t uid,
373 	       struct kafs_token *kt)
374 {
375     int ret = -1;
376     char *vl_realm;
377     char CELL[64];
378 
379     /* We're about to find the realm that holds the key for afs in
380      * the specified cell. The problem is that null-instance
381      * afs-principals are common and that hitting the wrong realm might
382      * yield the wrong afs key. The following assumptions were made.
383      *
384      * Any realm passed to us is preferred.
385      *
386      * If there is a realm with the same name as the cell, it is most
387      * likely the correct realm to talk to.
388      *
389      * In most (maybe even all) cases the database servers of the cell
390      * will live in the realm we are looking for.
391      *
392      * Try the local realm, but if the previous cases fail, this is
393      * really a long shot.
394      *
395      */
396 
397     /* comments on the ordering of these tests */
398 
399     /* If the user passes a realm, she probably knows something we don't
400      * know and we should try afs@realm_hint.
401      */
402 
403     if (realm_hint) {
404 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
405 				 cell, realm_hint, uid, kt);
406 	if (ret == 0) return 0;
407 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
408 				 NULL, realm_hint, uid, kt);
409 	if (ret == 0) return 0;
410     }
411 
412     _kafs_foldup(CELL, cell);
413 
414     /*
415      * If the AFS servers have a file /usr/afs/etc/krb.conf containing
416      * REALM we still don't have to resort to cross-cell authentication.
417      * Try afs.cell@REALM.
418      */
419     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
420 			     cell, realm, uid, kt);
421     if (ret == 0) return 0;
422 
423     /*
424      * If cell == realm we don't need no cross-cell authentication.
425      * Try afs@REALM.
426      */
427     if (strcmp(CELL, realm) == 0) {
428         ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
429 				 NULL, realm, uid, kt);
430 	if (ret == 0) return 0;
431     }
432 
433     /*
434      * We failed to get ``first class tickets'' for afs,
435      * fall back to cross-cell authentication.
436      * Try afs@CELL.
437      * Try afs.cell@CELL.
438      */
439     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
440 			     NULL, CELL, uid, kt);
441     if (ret == 0) return 0;
442     ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
443 			     cell, CELL, uid, kt);
444     if (ret == 0) return 0;
445 
446     /*
447      * Perhaps the cell doesn't correspond to any realm?
448      * Use realm of first volume location DB server.
449      * Try afs.cell@VL_REALM.
450      * Try afs@VL_REALM???
451      */
452     if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0
453 	&& strcmp(vl_realm, realm) != 0
454 	&& strcmp(vl_realm, CELL) != 0) {
455 	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
456 				 cell, vl_realm, uid, kt);
457 	if (ret)
458 	    ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
459 				     NULL, vl_realm, uid, kt);
460 	free(vl_realm);
461 	if (ret == 0) return 0;
462     }
463 
464     return ret;
465 }
466