gssd.c revision 244604
168349Sobrien/*- 2133359Sobrien * Copyright (c) 2008 Isilon Inc http://www.isilon.com/ 3133359Sobrien * Authors: Doug Rabson <dfr@rabson.org> 4133359Sobrien * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org> 5133359Sobrien * 6133359Sobrien * Redistribution and use in source and binary forms, with or without 7133359Sobrien * modification, are permitted provided that the following conditions 8133359Sobrien * are met: 9133359Sobrien * 1. Redistributions of source code must retain the above copyright 10133359Sobrien * notice, this list of conditions and the following disclaimer. 11133359Sobrien * 2. Redistributions in binary form must reproduce the above copyright 12133359Sobrien * notice, this list of conditions and the following disclaimer in the 13133359Sobrien * documentation and/or other materials provided with the distribution. 14133359Sobrien * 15133359Sobrien * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16133359Sobrien * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17133359Sobrien * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18133359Sobrien * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19133359Sobrien * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20133359Sobrien * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21133359Sobrien * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22133359Sobrien * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23133359Sobrien * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24133359Sobrien * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25133359Sobrien * SUCH DAMAGE. 26133359Sobrien */ 27133359Sobrien 28133359Sobrien#include <sys/cdefs.h> 2968349Sobrien__FBSDID("$FreeBSD: head/usr.sbin/gssd/gssd.c 244604 2012-12-22 23:21:17Z rmacklem $"); 3068349Sobrien 3168349Sobrien#include <sys/param.h> 3268349Sobrien#include <sys/stat.h> 3368349Sobrien#include <sys/linker.h> 3468349Sobrien#include <sys/module.h> 3568349Sobrien#include <sys/queue.h> 36191736Sobrien#include <sys/syslog.h> 37191736Sobrien#include <ctype.h> 38267843Sdelphij#include <dirent.h> 39191736Sobrien#include <err.h> 40191736Sobrien#include <krb5.h> 41133359Sobrien#include <pwd.h> 4268349Sobrien#include <stdio.h> 4368349Sobrien#include <stdlib.h> 4468349Sobrien#include <string.h> 4568349Sobrien#include <unistd.h> 4668349Sobrien#include <gssapi/gssapi.h> 47133359Sobrien#include <rpc/rpc.h> 48226048Sobrien#include <rpc/rpc_com.h> 49169942Sobrien 50226048Sobrien#include "gssd.h" 5168349Sobrien 5268349Sobrien#ifndef _PATH_GSS_MECH 5368349Sobrien#define _PATH_GSS_MECH "/etc/gss/mech" 54169962Sobrien#endif 55169962Sobrien#ifndef _PATH_GSSDSOCK 56169962Sobrien#define _PATH_GSSDSOCK "/var/run/gssd.sock" 57175296Sobrien#endif 58175296Sobrien 59103373Sobrienstruct gss_resource { 60103373Sobrien LIST_ENTRY(gss_resource) gr_link; 61103373Sobrien uint64_t gr_id; /* indentifier exported to kernel */ 62186690Sobrien void* gr_res; /* GSS-API resource pointer */ 63186690Sobrien}; 64133359SobrienLIST_HEAD(gss_resource_list, gss_resource) gss_resources; 65186690Sobrienint gss_resource_count; 66133359Sobrienuint32_t gss_next_id; 6768349Sobrienuint32_t gss_start_time; 6868349Sobrienint debug_level; 6975937Sobrienstatic char ccfile_dirlist[PATH_MAX + 1], ccfile_substring[NAME_MAX + 1]; 7075937Sobrienstatic char pref_realm[1024]; 7175937Sobrien 7268349Sobrienstatic void gssd_load_mech(void); 7368349Sobrienstatic int find_ccache_file(const char *, uid_t, char *); 7468349Sobrienstatic int is_a_valid_tgt_cache(const char *, uid_t, int *, time_t *); 7568349Sobrien 7668349Sobrienextern void gssd_1(struct svc_req *rqstp, SVCXPRT *transp); 77159764Sobrienextern int gssd_syscall(char *path); 78159764Sobrien 7980588Sobrienint 80191736Sobrienmain(int argc, char **argv) 81192348Sdelphij{ 82226048Sobrien /* 83267843Sdelphij * We provide an RPC service on a local-domain socket. The 8468349Sobrien * kernel's GSS-API code will pass what it can't handle 8568349Sobrien * directly to us. 86169942Sobrien */ 8768349Sobrien struct sockaddr_un sun; 88133359Sobrien int fd, oldmask, ch, debug; 89226048Sobrien SVCXPRT *xprt; 90226048Sobrien 91159764Sobrien /* 92159764Sobrien * Initialize the credential cache file name substring and the 93175296Sobrien * search directory list. 94133359Sobrien */ 95133359Sobrien strlcpy(ccfile_substring, "krb5cc_", sizeof(ccfile_substring)); 96103373Sobrien ccfile_dirlist[0] = '\0'; 9768349Sobrien pref_realm[0] = '\0'; 98133359Sobrien debug = 0; 99169962Sobrien while ((ch = getopt(argc, argv, "ds:c:r:")) != -1) { 100169962Sobrien switch (ch) { 10168349Sobrien case 'd': 102133359Sobrien debug_level++; 103133359Sobrien break; 104133359Sobrien case 's': 105175296Sobrien /* 10668349Sobrien * Set the directory search list. This enables use of 107133359Sobrien * find_ccache_file() to search the directories for a 108133359Sobrien * suitable credentials cache file. 109133359Sobrien */ 11068349Sobrien strlcpy(ccfile_dirlist, optarg, sizeof(ccfile_dirlist)); 11168349Sobrien break; 11268349Sobrien case 'c': 11368349Sobrien /* 114159764Sobrien * Specify a non-default credential cache file 115169942Sobrien * substring. 116133359Sobrien */ 117133359Sobrien strlcpy(ccfile_substring, optarg, 118169962Sobrien sizeof(ccfile_substring)); 119133359Sobrien break; 120175296Sobrien case 'r': 121175296Sobrien /* 122175296Sobrien * Set the preferred realm for the credential cache tgt. 123175296Sobrien */ 124175296Sobrien strlcpy(pref_realm, optarg, sizeof(pref_realm)); 125267843Sdelphij break; 126267843Sdelphij default: 127267843Sdelphij fprintf(stderr, 128267843Sdelphij "usage: %s [-d] [-s dir-list] [-c file-substring]" 129175296Sobrien " [-r preferred-realm]\n", argv[0]); 130175296Sobrien exit(1); 131133359Sobrien break; 132133359Sobrien } 13368349Sobrien } 13468349Sobrien 135133359Sobrien gssd_load_mech(); 136234250Sobrien 137133359Sobrien if (!debug_level) 138133359Sobrien daemon(0, 0); 13968349Sobrien 140226048Sobrien memset(&sun, 0, sizeof sun); 14175937Sobrien sun.sun_family = AF_LOCAL; 14275937Sobrien unlink(_PATH_GSSDSOCK); 14375937Sobrien strcpy(sun.sun_path, _PATH_GSSDSOCK); 144133359Sobrien sun.sun_len = SUN_LEN(&sun); 145103373Sobrien fd = socket(AF_LOCAL, SOCK_STREAM, 0); 14675937Sobrien if (!fd) { 147226048Sobrien if (debug_level == 0) { 14875937Sobrien syslog(LOG_ERR, "Can't create local gssd socket"); 14968349Sobrien exit(1); 15075937Sobrien } 15175937Sobrien err(1, "Can't create local gssd socket"); 15275937Sobrien } 15375937Sobrien oldmask = umask(S_IXUSR|S_IRWXG|S_IRWXO); 15475937Sobrien if (bind(fd, (struct sockaddr *) &sun, sun.sun_len) < 0) { 15575937Sobrien if (debug_level == 0) { 15675937Sobrien syslog(LOG_ERR, "Can't bind local gssd socket"); 15775937Sobrien exit(1); 158226048Sobrien } 15975937Sobrien err(1, "Can't bind local gssd socket"); 16075937Sobrien } 16175937Sobrien umask(oldmask); 16275937Sobrien if (listen(fd, SOMAXCONN) < 0) { 16375937Sobrien if (debug_level == 0) { 16475937Sobrien syslog(LOG_ERR, "Can't listen on local gssd socket"); 16575937Sobrien exit(1); 16675937Sobrien } 16775937Sobrien err(1, "Can't listen on local gssd socket"); 16875937Sobrien } 169169942Sobrien xprt = svc_vc_create(fd, RPC_MAXDATASIZE, RPC_MAXDATASIZE); 170267843Sdelphij if (!xprt) { 17175937Sobrien if (debug_level == 0) { 172226048Sobrien syslog(LOG_ERR, 173169942Sobrien "Can't create transport for local gssd socket"); 174169942Sobrien exit(1); 175169942Sobrien } 17675937Sobrien err(1, "Can't create transport for local gssd socket"); 17775937Sobrien } 178169942Sobrien if (!svc_reg(xprt, GSSD, GSSDVERS, gssd_1, NULL)) { 179169942Sobrien if (debug_level == 0) { 180169942Sobrien syslog(LOG_ERR, 181169942Sobrien "Can't register service for local gssd socket"); 182267843Sdelphij exit(1); 183169942Sobrien } 184267843Sdelphij err(1, "Can't register service for local gssd socket"); 185169962Sobrien } 186169942Sobrien 187169942Sobrien LIST_INIT(&gss_resources); 188169962Sobrien gss_next_id = 1; 189169942Sobrien gss_start_time = time(0); 190169942Sobrien 191169942Sobrien gssd_syscall(_PATH_GSSDSOCK); 192169942Sobrien svc_run(); 193169942Sobrien 194169942Sobrien return (0); 195169942Sobrien} 196169942Sobrien 197169962Sobrienstatic void 198169962Sobriengssd_load_mech(void) 199169942Sobrien{ 200169942Sobrien FILE *fp; 201169962Sobrien char buf[256]; 202169942Sobrien char *p; 203169962Sobrien char *name, *oid, *lib, *kobj; 204169962Sobrien 205169942Sobrien fp = fopen(_PATH_GSS_MECH, "r"); 206169942Sobrien if (!fp) 207169942Sobrien return; 208169942Sobrien 209169942Sobrien while (fgets(buf, sizeof(buf), fp)) { 210169942Sobrien if (*buf == '#') 211169942Sobrien continue; 212169942Sobrien p = buf; 213169942Sobrien name = strsep(&p, "\t\n "); 214169942Sobrien if (p) while (isspace(*p)) p++; 215169942Sobrien oid = strsep(&p, "\t\n "); 216169942Sobrien if (p) while (isspace(*p)) p++; 21775937Sobrien lib = strsep(&p, "\t\n "); 218169942Sobrien if (p) while (isspace(*p)) p++; 21975937Sobrien kobj = strsep(&p, "\t\n "); 22075937Sobrien if (!name || !oid || !lib || !kobj) 22175937Sobrien continue; 22275937Sobrien 223103373Sobrien if (strcmp(kobj, "-")) { 224103373Sobrien /* 22575937Sobrien * Attempt to load the kernel module if its 22675937Sobrien * not already present. 22775937Sobrien */ 22875937Sobrien if (modfind(kobj) < 0) { 22975937Sobrien if (kldload(kobj) < 0) { 23075937Sobrien fprintf(stderr, 23175937Sobrien "%s: can't find or load kernel module %s for %s\n", 23275937Sobrien getprogname(), kobj, name); 23375937Sobrien } 234133359Sobrien } 235133359Sobrien } 236133359Sobrien } 237103373Sobrien fclose(fp); 238103373Sobrien} 239226048Sobrien 240226048Sobrienstatic void * 241103373Sobriengssd_find_resource(uint64_t id) 242191736Sobrien{ 243103373Sobrien struct gss_resource *gr; 244103373Sobrien 245103373Sobrien if (!id) 246103373Sobrien return (NULL); 247103373Sobrien 248103373Sobrien LIST_FOREACH(gr, &gss_resources, gr_link) 249103373Sobrien if (gr->gr_id == id) 250103373Sobrien return (gr->gr_res); 251103373Sobrien 252267843Sdelphij return (NULL); 253267843Sdelphij} 254267843Sdelphij 255267843Sdelphijstatic uint64_t 256267843Sdelphijgssd_make_resource(void *res) 257267843Sdelphij{ 258267843Sdelphij struct gss_resource *gr; 259103373Sobrien 260103373Sobrien if (!res) 261133359Sobrien return (0); 262133359Sobrien 263133359Sobrien gr = malloc(sizeof(struct gss_resource)); 264103373Sobrien if (!gr) 265103373Sobrien return (0); 266133359Sobrien gr->gr_id = (gss_next_id++) + ((uint64_t) gss_start_time << 32); 267103373Sobrien gr->gr_res = res; 268103373Sobrien LIST_INSERT_HEAD(&gss_resources, gr, gr_link); 269169962Sobrien gss_resource_count++; 270133359Sobrien if (debug_level > 1) 271103373Sobrien printf("%d resources allocated\n", gss_resource_count); 272103373Sobrien 273103373Sobrien return (gr->gr_id); 274103373Sobrien} 275103373Sobrien 276133359Sobrienstatic void 277133359Sobriengssd_delete_resource(uint64_t id) 278103373Sobrien{ 279103373Sobrien struct gss_resource *gr; 280103373Sobrien 281133359Sobrien LIST_FOREACH(gr, &gss_resources, gr_link) { 282133359Sobrien if (gr->gr_id == id) { 283103373Sobrien LIST_REMOVE(gr, gr_link); 284103373Sobrien free(gr); 285103373Sobrien gss_resource_count--; 286103373Sobrien if (debug_level > 1) 287103373Sobrien printf("%d resources allocated\n", 288103373Sobrien gss_resource_count); 289103373Sobrien return; 290103373Sobrien } 291133359Sobrien } 292133359Sobrien} 293103373Sobrien 294103373Sobrienbool_t 295103373Sobriengssd_null_1_svc(void *argp, void *result, struct svc_req *rqstp) 296133359Sobrien{ 297133359Sobrien 298103373Sobrien return (TRUE); 299103373Sobrien} 300103373Sobrien 301226048Sobrienbool_t 302175296Sobriengssd_init_sec_context_1_svc(init_sec_context_args *argp, init_sec_context_res *result, struct svc_req *rqstp) 303103373Sobrien{ 304103373Sobrien gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; 305103373Sobrien gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; 306103373Sobrien gss_name_t name = GSS_C_NO_NAME; 307103373Sobrien char ccname[PATH_MAX + 5 + 1], *cp, *cp2; 308103373Sobrien int gotone; 309133359Sobrien 310133359Sobrien memset(result, 0, sizeof(*result)); 311133359Sobrien if (ccfile_dirlist[0] != '\0' && argp->cred == 0) { 31268349Sobrien /* 313103373Sobrien * For the "-s" case and no credentials provided as an 314133359Sobrien * argument, search the directory list for an appropriate 315103373Sobrien * credential cache file. If the search fails, return failure. 316103373Sobrien */ 317103373Sobrien gotone = 0; 318133359Sobrien cp = ccfile_dirlist; 319133359Sobrien do { 320133359Sobrien cp2 = strchr(cp, ':'); 321103373Sobrien if (cp2 != NULL) 322133359Sobrien *cp2 = '\0'; 323103373Sobrien gotone = find_ccache_file(cp, argp->uid, ccname); 324133359Sobrien if (gotone != 0) 325103373Sobrien break; 326103373Sobrien if (cp2 != NULL) 327103373Sobrien *cp2++ = ':'; 328103373Sobrien cp = cp2; 329133359Sobrien } while (cp != NULL && *cp != '\0'); 330103373Sobrien if (gotone == 0) { 331103373Sobrien result->major_status = GSS_S_CREDENTIALS_EXPIRED; 332103373Sobrien return (TRUE); 333103373Sobrien } 334103373Sobrien } else { 335103373Sobrien /* 336133359Sobrien * If there wasn't a "-s" option or the credentials have 337133359Sobrien * been provided as an argument, do it the old way. 338186690Sobrien * When credentials are provided, the uid should be root. 339103373Sobrien */ 340103373Sobrien if (argp->cred != 0 && argp->uid != 0) { 341103373Sobrien if (debug_level == 0) 342133359Sobrien syslog(LOG_ERR, "gss_init_sec_context:" 343133359Sobrien " cred for non-root"); 344133359Sobrien else 345226048Sobrien fprintf(stderr, "gss_init_sec_context:" 346103373Sobrien " cred for non-root\n"); 347103373Sobrien } 348103373Sobrien snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d", 349103373Sobrien (int) argp->uid); 350103373Sobrien } 351103373Sobrien setenv("KRB5CCNAME", ccname, TRUE); 352226048Sobrien 353103373Sobrien if (argp->cred) { 354103373Sobrien cred = gssd_find_resource(argp->cred); 355133359Sobrien if (!cred) { 356103373Sobrien result->major_status = GSS_S_CREDENTIALS_EXPIRED; 357103373Sobrien return (TRUE); 358103373Sobrien } 359103373Sobrien } 360103373Sobrien if (argp->ctx) { 361133359Sobrien ctx = gssd_find_resource(argp->ctx); 362103373Sobrien if (!ctx) { 363103373Sobrien result->major_status = GSS_S_CONTEXT_EXPIRED; 364103373Sobrien return (TRUE); 365133359Sobrien } 366169962Sobrien } 367103373Sobrien if (argp->name) { 368103373Sobrien name = gssd_find_resource(argp->name); 369169942Sobrien if (!name) { 370103373Sobrien result->major_status = GSS_S_BAD_NAME; 371103373Sobrien return (TRUE); 372103373Sobrien } 373103373Sobrien } 374103373Sobrien 375133359Sobrien result->major_status = gss_init_sec_context(&result->minor_status, 376159764Sobrien cred, &ctx, name, argp->mech_type, 377159764Sobrien argp->req_flags, argp->time_req, argp->input_chan_bindings, 378103373Sobrien &argp->input_token, &result->actual_mech_type, 37968349Sobrien &result->output_token, &result->ret_flags, &result->time_rec); 380226048Sobrien 381226048Sobrien if (result->major_status == GSS_S_COMPLETE 38268349Sobrien || result->major_status == GSS_S_CONTINUE_NEEDED) { 383175296Sobrien if (argp->ctx) 384186690Sobrien result->ctx = argp->ctx; 385103373Sobrien else 386133359Sobrien result->ctx = gssd_make_resource(ctx); 387103373Sobrien } 388159764Sobrien 389159764Sobrien return (TRUE); 390103373Sobrien} 391159764Sobrien 392133359Sobrienbool_t 393169942Sobriengssd_accept_sec_context_1_svc(accept_sec_context_args *argp, accept_sec_context_res *result, struct svc_req *rqstp) 39468349Sobrien{ 395226048Sobrien gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; 39668349Sobrien gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; 39768349Sobrien gss_name_t src_name; 398159764Sobrien gss_cred_id_t delegated_cred_handle; 399267843Sdelphij 400267843Sdelphij memset(result, 0, sizeof(*result)); 401159764Sobrien if (argp->ctx) { 402159764Sobrien ctx = gssd_find_resource(argp->ctx); 403267843Sdelphij if (!ctx) { 404267843Sdelphij result->major_status = GSS_S_CONTEXT_EXPIRED; 405159764Sobrien return (TRUE); 406159764Sobrien } 407159764Sobrien } 40868349Sobrien if (argp->cred) { 40968349Sobrien cred = gssd_find_resource(argp->cred); 410267843Sdelphij if (!cred) { 411267843Sdelphij result->major_status = GSS_S_CREDENTIALS_EXPIRED; 41268349Sobrien return (TRUE); 41368349Sobrien } 414159764Sobrien } 41568349Sobrien 416159764Sobrien memset(result, 0, sizeof(*result)); 417159764Sobrien result->major_status = gss_accept_sec_context(&result->minor_status, 41868349Sobrien &ctx, cred, &argp->input_token, argp->input_chan_bindings, 419169962Sobrien &src_name, &result->mech_type, &result->output_token, 420169962Sobrien &result->ret_flags, &result->time_rec, 421159764Sobrien &delegated_cred_handle); 422159764Sobrien 423159764Sobrien if (result->major_status == GSS_S_COMPLETE 424159764Sobrien || result->major_status == GSS_S_CONTINUE_NEEDED) { 42568349Sobrien if (argp->ctx) 42668349Sobrien result->ctx = argp->ctx; 42768349Sobrien else 428133359Sobrien result->ctx = gssd_make_resource(ctx); 429169942Sobrien result->src_name = gssd_make_resource(src_name); 43068349Sobrien result->delegated_cred_handle = 43168349Sobrien gssd_make_resource(delegated_cred_handle); 43268349Sobrien } 433159764Sobrien 434159764Sobrien return (TRUE); 435159764Sobrien} 436159764Sobrien 437159764Sobrienbool_t 438159764Sobriengssd_delete_sec_context_1_svc(delete_sec_context_args *argp, delete_sec_context_res *result, struct svc_req *rqstp) 439159764Sobrien{ 440159764Sobrien gss_ctx_id_t ctx = gssd_find_resource(argp->ctx); 441159764Sobrien 442169962Sobrien if (ctx) { 443159764Sobrien result->major_status = gss_delete_sec_context( 444159764Sobrien &result->minor_status, &ctx, &result->output_token); 445159764Sobrien gssd_delete_resource(argp->ctx); 446159764Sobrien } else { 447159764Sobrien result->major_status = GSS_S_COMPLETE; 448159764Sobrien result->minor_status = 0; 449159764Sobrien } 450159764Sobrien 451159764Sobrien return (TRUE); 452159764Sobrien} 453159764Sobrien 454159764Sobrienbool_t 455159764Sobriengssd_export_sec_context_1_svc(export_sec_context_args *argp, export_sec_context_res *result, struct svc_req *rqstp) 456159764Sobrien{ 457159764Sobrien gss_ctx_id_t ctx = gssd_find_resource(argp->ctx); 458133359Sobrien 459159764Sobrien if (ctx) { 460133359Sobrien result->major_status = gss_export_sec_context( 461159764Sobrien &result->minor_status, &ctx, 462159764Sobrien &result->interprocess_token); 463159764Sobrien result->format = KGSS_HEIMDAL_1_1; 464159764Sobrien gssd_delete_resource(argp->ctx); 465159764Sobrien } else { 466159764Sobrien result->major_status = GSS_S_FAILURE; 467133359Sobrien result->minor_status = 0; 468103373Sobrien result->interprocess_token.length = 0; 469159764Sobrien result->interprocess_token.value = NULL; 470159764Sobrien } 471159764Sobrien 472159764Sobrien return (TRUE); 47375937Sobrien} 47475937Sobrien 47575937Sobrienbool_t 476169962Sobriengssd_import_name_1_svc(import_name_args *argp, import_name_res *result, struct svc_req *rqstp) 477159764Sobrien{ 478159764Sobrien gss_name_t name; 479159764Sobrien 480159764Sobrien result->major_status = gss_import_name(&result->minor_status, 48168349Sobrien &argp->input_name_buffer, argp->input_name_type, &name); 48275937Sobrien 483267843Sdelphij if (result->major_status == GSS_S_COMPLETE) 48475937Sobrien result->output_name = gssd_make_resource(name); 485133359Sobrien else 486133359Sobrien result->output_name = 0; 48768349Sobrien 488103373Sobrien return (TRUE); 489169942Sobrien} 49075937Sobrien 49175937Sobrienbool_t 49275937Sobriengssd_canonicalize_name_1_svc(canonicalize_name_args *argp, canonicalize_name_res *result, struct svc_req *rqstp) 49368349Sobrien{ 494133359Sobrien gss_name_t name = gssd_find_resource(argp->input_name); 495226048Sobrien gss_name_t output_name; 496133359Sobrien 497133359Sobrien memset(result, 0, sizeof(*result)); 498133359Sobrien if (!name) { 499133359Sobrien result->major_status = GSS_S_BAD_NAME; 500192348Sdelphij return (TRUE); 501192348Sdelphij } 50268349Sobrien 50368349Sobrien result->major_status = gss_canonicalize_name(&result->minor_status, 50468349Sobrien name, argp->mech_type, &output_name); 505226048Sobrien 506 if (result->major_status == GSS_S_COMPLETE) 507 result->output_name = gssd_make_resource(output_name); 508 else 509 result->output_name = 0; 510 511 return (TRUE); 512} 513 514bool_t 515gssd_export_name_1_svc(export_name_args *argp, export_name_res *result, struct svc_req *rqstp) 516{ 517 gss_name_t name = gssd_find_resource(argp->input_name); 518 519 memset(result, 0, sizeof(*result)); 520 if (!name) { 521 result->major_status = GSS_S_BAD_NAME; 522 return (TRUE); 523 } 524 525 result->major_status = gss_export_name(&result->minor_status, 526 name, &result->exported_name); 527 528 return (TRUE); 529} 530 531bool_t 532gssd_release_name_1_svc(release_name_args *argp, release_name_res *result, struct svc_req *rqstp) 533{ 534 gss_name_t name = gssd_find_resource(argp->input_name); 535 536 if (name) { 537 result->major_status = gss_release_name(&result->minor_status, 538 &name); 539 gssd_delete_resource(argp->input_name); 540 } else { 541 result->major_status = GSS_S_COMPLETE; 542 result->minor_status = 0; 543 } 544 545 return (TRUE); 546} 547 548bool_t 549gssd_pname_to_uid_1_svc(pname_to_uid_args *argp, pname_to_uid_res *result, struct svc_req *rqstp) 550{ 551 gss_name_t name = gssd_find_resource(argp->pname); 552 uid_t uid; 553 char buf[128]; 554 struct passwd pwd, *pw; 555 556 memset(result, 0, sizeof(*result)); 557 if (name) { 558 result->major_status = 559 gss_pname_to_uid(&result->minor_status, 560 name, argp->mech, &uid); 561 if (result->major_status == GSS_S_COMPLETE) { 562 result->uid = uid; 563 getpwuid_r(uid, &pwd, buf, sizeof(buf), &pw); 564 if (pw) { 565 int len = NGRPS; 566 int groups[NGRPS]; 567 result->gid = pw->pw_gid; 568 getgrouplist(pw->pw_name, pw->pw_gid, 569 groups, &len); 570 result->gidlist.gidlist_len = len; 571 result->gidlist.gidlist_val = 572 mem_alloc(len * sizeof(int)); 573 memcpy(result->gidlist.gidlist_val, groups, 574 len * sizeof(int)); 575 } else { 576 result->gid = 65534; 577 result->gidlist.gidlist_len = 0; 578 result->gidlist.gidlist_val = NULL; 579 } 580 } 581 } else { 582 result->major_status = GSS_S_BAD_NAME; 583 result->minor_status = 0; 584 } 585 586 return (TRUE); 587} 588 589bool_t 590gssd_acquire_cred_1_svc(acquire_cred_args *argp, acquire_cred_res *result, struct svc_req *rqstp) 591{ 592 gss_name_t desired_name = GSS_C_NO_NAME; 593 gss_cred_id_t cred; 594 char ccname[PATH_MAX + 5 + 1], *cp, *cp2; 595 int gotone; 596 597 memset(result, 0, sizeof(*result)); 598 if (ccfile_dirlist[0] != '\0' && argp->desired_name == 0) { 599 /* 600 * For the "-s" case and no name provided as an 601 * argument, search the directory list for an appropriate 602 * credential cache file. If the search fails, return failure. 603 */ 604 gotone = 0; 605 cp = ccfile_dirlist; 606 do { 607 cp2 = strchr(cp, ':'); 608 if (cp2 != NULL) 609 *cp2 = '\0'; 610 gotone = find_ccache_file(cp, argp->uid, ccname); 611 if (gotone != 0) 612 break; 613 if (cp2 != NULL) 614 *cp2++ = ':'; 615 cp = cp2; 616 } while (cp != NULL && *cp != '\0'); 617 if (gotone == 0) { 618 result->major_status = GSS_S_CREDENTIALS_EXPIRED; 619 return (TRUE); 620 } 621 } else { 622 /* 623 * If there wasn't a "-s" option or the name has 624 * been provided as an argument, do it the old way. 625 * When a name is provided, it will normally exist in the 626 * default keytab file and the uid will be root. 627 */ 628 if (argp->desired_name != 0 && argp->uid != 0) { 629 if (debug_level == 0) 630 syslog(LOG_ERR, "gss_acquire_cred:" 631 " principal_name for non-root"); 632 else 633 fprintf(stderr, "gss_acquire_cred:" 634 " principal_name for non-root\n"); 635 } 636 snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d", 637 (int) argp->uid); 638 } 639 setenv("KRB5CCNAME", ccname, TRUE); 640 641 if (argp->desired_name) { 642 desired_name = gssd_find_resource(argp->desired_name); 643 if (!desired_name) { 644 result->major_status = GSS_S_BAD_NAME; 645 return (TRUE); 646 } 647 } 648 649 result->major_status = gss_acquire_cred(&result->minor_status, 650 desired_name, argp->time_req, argp->desired_mechs, 651 argp->cred_usage, &cred, &result->actual_mechs, &result->time_rec); 652 653 if (result->major_status == GSS_S_COMPLETE) 654 result->output_cred = gssd_make_resource(cred); 655 else 656 result->output_cred = 0; 657 658 return (TRUE); 659} 660 661bool_t 662gssd_set_cred_option_1_svc(set_cred_option_args *argp, set_cred_option_res *result, struct svc_req *rqstp) 663{ 664 gss_cred_id_t cred = gssd_find_resource(argp->cred); 665 666 memset(result, 0, sizeof(*result)); 667 if (!cred) { 668 result->major_status = GSS_S_CREDENTIALS_EXPIRED; 669 return (TRUE); 670 } 671 672 result->major_status = gss_set_cred_option(&result->minor_status, 673 &cred, argp->option_name, &argp->option_value); 674 675 return (TRUE); 676} 677 678bool_t 679gssd_release_cred_1_svc(release_cred_args *argp, release_cred_res *result, struct svc_req *rqstp) 680{ 681 gss_cred_id_t cred = gssd_find_resource(argp->cred); 682 683 if (cred) { 684 result->major_status = gss_release_cred(&result->minor_status, 685 &cred); 686 gssd_delete_resource(argp->cred); 687 } else { 688 result->major_status = GSS_S_COMPLETE; 689 result->minor_status = 0; 690 } 691 692 return (TRUE); 693} 694 695bool_t 696gssd_display_status_1_svc(display_status_args *argp, display_status_res *result, struct svc_req *rqstp) 697{ 698 699 result->message_context = argp->message_context; 700 result->major_status = gss_display_status(&result->minor_status, 701 argp->status_value, argp->status_type, argp->mech_type, 702 &result->message_context, &result->status_string); 703 704 return (TRUE); 705} 706 707int 708gssd_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, caddr_t result) 709{ 710 /* 711 * We don't use XDR to free the results - anything which was 712 * allocated came from GSS-API. We use xdr_result to figure 713 * out what to do. 714 */ 715 OM_uint32 junk; 716 717 if (xdr_result == (xdrproc_t) xdr_init_sec_context_res) { 718 init_sec_context_res *p = (init_sec_context_res *) result; 719 gss_release_buffer(&junk, &p->output_token); 720 } else if (xdr_result == (xdrproc_t) xdr_accept_sec_context_res) { 721 accept_sec_context_res *p = (accept_sec_context_res *) result; 722 gss_release_buffer(&junk, &p->output_token); 723 } else if (xdr_result == (xdrproc_t) xdr_delete_sec_context_res) { 724 delete_sec_context_res *p = (delete_sec_context_res *) result; 725 gss_release_buffer(&junk, &p->output_token); 726 } else if (xdr_result == (xdrproc_t) xdr_export_sec_context_res) { 727 export_sec_context_res *p = (export_sec_context_res *) result; 728 if (p->interprocess_token.length) 729 memset(p->interprocess_token.value, 0, 730 p->interprocess_token.length); 731 gss_release_buffer(&junk, &p->interprocess_token); 732 } else if (xdr_result == (xdrproc_t) xdr_export_name_res) { 733 export_name_res *p = (export_name_res *) result; 734 gss_release_buffer(&junk, &p->exported_name); 735 } else if (xdr_result == (xdrproc_t) xdr_acquire_cred_res) { 736 acquire_cred_res *p = (acquire_cred_res *) result; 737 gss_release_oid_set(&junk, &p->actual_mechs); 738 } else if (xdr_result == (xdrproc_t) xdr_pname_to_uid_res) { 739 pname_to_uid_res *p = (pname_to_uid_res *) result; 740 if (p->gidlist.gidlist_val) 741 free(p->gidlist.gidlist_val); 742 } else if (xdr_result == (xdrproc_t) xdr_display_status_res) { 743 display_status_res *p = (display_status_res *) result; 744 gss_release_buffer(&junk, &p->status_string); 745 } 746 747 return (TRUE); 748} 749 750/* 751 * Search a directory for the most likely candidate to be used as the 752 * credential cache for a uid. If successful, return 1 and fill the 753 * file's path id into "rpath". Otherwise, return 0. 754 */ 755static int 756find_ccache_file(const char *dirpath, uid_t uid, char *rpath) 757{ 758 DIR *dirp; 759 struct dirent *dp; 760 struct stat sb; 761 time_t exptime, oexptime; 762 int gotone, len, rating, orating; 763 char namepath[PATH_MAX + 5 + 1]; 764 char retpath[PATH_MAX + 5 + 1]; 765 766 dirp = opendir(dirpath); 767 if (dirp == NULL) 768 return (0); 769 gotone = 0; 770 orating = 0; 771 oexptime = 0; 772 while ((dp = readdir(dirp)) != NULL) { 773 len = snprintf(namepath, sizeof(namepath), "%s/%s", dirpath, 774 dp->d_name); 775 if (len < sizeof(namepath) && 776 strstr(dp->d_name, ccfile_substring) != NULL && 777 lstat(namepath, &sb) >= 0 && 778 sb.st_uid == uid && 779 S_ISREG(sb.st_mode)) { 780 len = snprintf(namepath, sizeof(namepath), "FILE:%s/%s", 781 dirpath, dp->d_name); 782 if (len < sizeof(namepath) && 783 is_a_valid_tgt_cache(namepath, uid, &rating, 784 &exptime) != 0) { 785 if (gotone == 0 || rating > orating || 786 (rating == orating && exptime > oexptime)) { 787 orating = rating; 788 oexptime = exptime; 789 strcpy(retpath, namepath); 790 gotone = 1; 791 } 792 } 793 } 794 } 795 closedir(dirp); 796 if (gotone != 0) { 797 strcpy(rpath, retpath); 798 return (1); 799 } 800 return (0); 801} 802 803/* 804 * Try to determine if the file is a valid tgt cache file. 805 * Check that the file has a valid tgt for a principal. 806 * If it does, return 1, otherwise return 0. 807 * It also returns a "rating" and the expiry time for the TGT, when found. 808 * This "rating" is higher based on heuristics that make it more 809 * likely to be the correct credential cache file to use. It can 810 * be used by the caller, along with expiry time, to select from 811 * multiple credential cache files. 812 */ 813static int 814is_a_valid_tgt_cache(const char *filepath, uid_t uid, int *retrating, 815 time_t *retexptime) 816{ 817 krb5_context context; 818 krb5_principal princ; 819 krb5_ccache ccache; 820 krb5_error_code retval; 821 krb5_cc_cursor curse; 822 krb5_creds krbcred; 823 int gotone, orating, rating, ret; 824 struct passwd *pw; 825 char *cp, *cp2, *pname; 826 time_t exptime; 827 828 /* Find a likely name for the uid principal. */ 829 pw = getpwuid(uid); 830 831 /* 832 * Do a bunch of krb5 library stuff to try and determine if 833 * this file is a credentials cache with an appropriate TGT 834 * in it. 835 */ 836 retval = krb5_init_context(&context); 837 if (retval != 0) 838 return (0); 839 retval = krb5_cc_resolve(context, filepath, &ccache); 840 if (retval != 0) { 841 krb5_free_context(context); 842 return (0); 843 } 844 ret = 0; 845 orating = 0; 846 exptime = 0; 847 retval = krb5_cc_start_seq_get(context, ccache, &curse); 848 if (retval == 0) { 849 while ((retval = krb5_cc_next_cred(context, ccache, &curse, 850 &krbcred)) == 0) { 851 gotone = 0; 852 rating = 0; 853 retval = krb5_unparse_name(context, krbcred.server, 854 &pname); 855 if (retval == 0) { 856 cp = strchr(pname, '/'); 857 if (cp != NULL) { 858 *cp++ = '\0'; 859 if (strcmp(pname, "krbtgt") == 0 && 860 krbcred.times.endtime > time(NULL) 861 ) { 862 gotone = 1; 863 /* 864 * Test to see if this is a 865 * tgt for cross-realm auth. 866 * Rate it higher, if it is not. 867 */ 868 cp2 = strchr(cp, '@'); 869 if (cp2 != NULL) { 870 *cp2++ = '\0'; 871 if (strcmp(cp, cp2) == 872 0) 873 rating++; 874 } 875 } 876 } 877 free(pname); 878 } 879 if (gotone != 0) { 880 retval = krb5_unparse_name(context, 881 krbcred.client, &pname); 882 if (retval == 0) { 883 cp = strchr(pname, '@'); 884 if (cp != NULL) { 885 *cp++ = '\0'; 886 if (pw != NULL && strcmp(pname, 887 pw->pw_name) == 0) 888 rating++; 889 if (strchr(pname, '/') == NULL) 890 rating++; 891 if (pref_realm[0] != '\0' && 892 strcmp(cp, pref_realm) == 0) 893 rating++; 894 } 895 } 896 free(pname); 897 if (rating > orating) { 898 orating = rating; 899 exptime = krbcred.times.endtime; 900 } else if (rating == orating && 901 krbcred.times.endtime > exptime) 902 exptime = krbcred.times.endtime; 903 ret = 1; 904 } 905 krb5_free_cred_contents(context, &krbcred); 906 } 907 krb5_cc_end_seq_get(context, ccache, &curse); 908 } 909 krb5_cc_close(context, ccache); 910 krb5_free_context(context); 911 if (ret != 0) { 912 *retrating = orating; 913 *retexptime = exptime; 914 } 915 return (ret); 916} 917 918