1/*
2 * Copyright (c) 1997 - 2005 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "kafs_locl.h"
35
36RCSID("$Id: common.c 15461 2005-06-16 22:52:33Z lha $");
37
38#define AUTH_SUPERUSER "afs"
39
40/*
41 * Here only ASCII characters are relevant.
42 */
43
44#define IsAsciiLower(c) ('a' <= (c) && (c) <= 'z')
45
46#define ToAsciiUpper(c) ((c) - 'a' + 'A')
47
48static void (*kafs_verbose)(void *, const char *);
49static void *kafs_verbose_ctx;
50
51void
52_kafs_foldup(char *a, const char *b)
53{
54  for (; *b; a++, b++)
55    if (IsAsciiLower(*b))
56      *a = ToAsciiUpper(*b);
57    else
58      *a = *b;
59  *a = '\0';
60}
61
62void
63kafs_set_verbose(void (*f)(void *, const char *), void *ctx)
64{
65    if (f) {
66	kafs_verbose = f;
67	kafs_verbose_ctx = ctx;
68    }
69}
70
71int
72kafs_settoken_rxkad(const char *cell, struct ClearToken *ct,
73		    void *ticket, size_t ticket_len)
74{
75    struct ViceIoctl parms;
76    char buf[2048], *t;
77    int32_t sizeof_x;
78
79    t = buf;
80    /*
81     * length of secret token followed by secret token
82     */
83    sizeof_x = ticket_len;
84    memcpy(t, &sizeof_x, sizeof(sizeof_x));
85    t += sizeof(sizeof_x);
86    memcpy(t, ticket, sizeof_x);
87    t += sizeof_x;
88    /*
89     * length of clear token followed by clear token
90     */
91    sizeof_x = sizeof(*ct);
92    memcpy(t, &sizeof_x, sizeof(sizeof_x));
93    t += sizeof(sizeof_x);
94    memcpy(t, ct, sizeof_x);
95    t += sizeof_x;
96
97    /*
98     * do *not* mark as primary cell
99     */
100    sizeof_x = 0;
101    memcpy(t, &sizeof_x, sizeof(sizeof_x));
102    t += sizeof(sizeof_x);
103    /*
104     * follow with cell name
105     */
106    sizeof_x = strlen(cell) + 1;
107    memcpy(t, cell, sizeof_x);
108    t += sizeof_x;
109
110    /*
111     * Build argument block
112     */
113    parms.in = buf;
114    parms.in_size = t - buf;
115    parms.out = 0;
116    parms.out_size = 0;
117
118    return k_pioctl(0, VIOCSETTOK, &parms, 0);
119}
120
121void
122_kafs_fixup_viceid(struct ClearToken *ct, uid_t uid)
123{
124#define ODD(x) ((x) & 1)
125    /* According to Transarc conventions ViceId is valid iff
126     * (EndTimestamp - BeginTimestamp) is odd. By decrementing EndTime
127     * the transformations:
128     *
129     * (issue_date, life) -> (StartTime, EndTime) -> (issue_date, life)
130     * preserves the original values.
131     */
132    if (uid != 0)		/* valid ViceId */
133    {
134	if (!ODD(ct->EndTimestamp - ct->BeginTimestamp))
135	    ct->EndTimestamp--;
136    }
137    else			/* not valid ViceId */
138    {
139	if (ODD(ct->EndTimestamp - ct->BeginTimestamp))
140	    ct->EndTimestamp--;
141    }
142}
143
144
145int
146_kafs_v4_to_kt(CREDENTIALS *c, uid_t uid, struct kafs_token *kt)
147{
148    kt->ticket = NULL;
149
150    if (c->ticket_st.length > MAX_KTXT_LEN)
151	return EINVAL;
152
153    kt->ticket = malloc(c->ticket_st.length);
154    if (kt->ticket == NULL)
155	return ENOMEM;
156    kt->ticket_len = c->ticket_st.length;
157    memcpy(kt->ticket, c->ticket_st.dat, kt->ticket_len);
158
159    /*
160     * Build a struct ClearToken
161     */
162    kt->ct.AuthHandle = c->kvno;
163    memcpy (kt->ct.HandShakeKey, c->session, sizeof(c->session));
164    kt->ct.ViceId = uid;
165    kt->ct.BeginTimestamp = c->issue_date;
166    kt->ct.EndTimestamp = krb_life_to_time(c->issue_date, c->lifetime);
167
168    _kafs_fixup_viceid(&kt->ct, uid);
169
170    return 0;
171}
172
173/* Try to get a db-server for an AFS cell from a AFSDB record */
174
175static int
176dns_find_cell(const char *cell, char *dbserver, size_t len)
177{
178    struct dns_reply *r;
179    int ok = -1;
180    r = dns_lookup(cell, "afsdb");
181    if(r){
182	struct resource_record *rr = r->head;
183	while(rr){
184	    if(rr->type == T_AFSDB && rr->u.afsdb->preference == 1){
185		strlcpy(dbserver,
186				rr->u.afsdb->domain,
187				len);
188		ok = 0;
189		break;
190	    }
191	    rr = rr->next;
192	}
193	dns_free_data(r);
194    }
195    return ok;
196}
197
198
199/*
200 * Try to find the cells we should try to klog to in "file".
201 */
202static void
203find_cells(const char *file, char ***cells, int *idx)
204{
205    FILE *f;
206    char cell[64];
207    int i;
208    int ind = *idx;
209
210    f = fopen(file, "r");
211    if (f == NULL)
212	return;
213    while (fgets(cell, sizeof(cell), f)) {
214	char *t;
215	t = cell + strlen(cell);
216	for (; t >= cell; t--)
217	  if (*t == '\n' || *t == '\t' || *t == ' ')
218	    *t = 0;
219	if (cell[0] == '\0' || cell[0] == '#')
220	    continue;
221	for(i = 0; i < ind; i++)
222	    if(strcmp((*cells)[i], cell) == 0)
223		break;
224	if(i == ind){
225	    char **tmp;
226
227	    tmp = realloc(*cells, (ind + 1) * sizeof(**cells));
228	    if (tmp == NULL)
229		break;
230	    *cells = tmp;
231	    (*cells)[ind] = strdup(cell);
232	    if ((*cells)[ind] == NULL)
233		break;
234	    ++ind;
235	}
236    }
237    fclose(f);
238    *idx = ind;
239}
240
241/*
242 * Get tokens for all cells[]
243 */
244static int
245afslog_cells(struct kafs_data *data, char **cells, int max, uid_t uid,
246	     const char *homedir)
247{
248    int ret = 0;
249    int i;
250    for (i = 0; i < max; i++) {
251        int er = (*data->afslog_uid)(data, cells[i], 0, uid, homedir);
252	if (er)
253	    ret = er;
254    }
255    return ret;
256}
257
258int
259_kafs_afslog_all_local_cells(struct kafs_data *data,
260			     uid_t uid, const char *homedir)
261{
262    int ret;
263    char **cells = NULL;
264    int idx = 0;
265
266    if (homedir == NULL)
267	homedir = getenv("HOME");
268    if (homedir != NULL) {
269	char home[MaxPathLen];
270	snprintf(home, sizeof(home), "%s/.TheseCells", homedir);
271	find_cells(home, &cells, &idx);
272    }
273    find_cells(_PATH_THESECELLS, &cells, &idx);
274    find_cells(_PATH_THISCELL, &cells, &idx);
275    find_cells(_PATH_ARLA_THESECELLS, &cells, &idx);
276    find_cells(_PATH_ARLA_THISCELL, &cells, &idx);
277    find_cells(_PATH_OPENAFS_DEBIAN_THESECELLS, &cells, &idx);
278    find_cells(_PATH_OPENAFS_DEBIAN_THISCELL, &cells, &idx);
279    find_cells(_PATH_OPENAFS_MACOSX_THESECELLS, &cells, &idx);
280    find_cells(_PATH_OPENAFS_MACOSX_THISCELL, &cells, &idx);
281    find_cells(_PATH_ARLA_DEBIAN_THESECELLS, &cells, &idx);
282    find_cells(_PATH_ARLA_DEBIAN_THISCELL, &cells, &idx);
283    find_cells(_PATH_ARLA_OPENBSD_THESECELLS, &cells, &idx);
284    find_cells(_PATH_ARLA_OPENBSD_THISCELL, &cells, &idx);
285
286    ret = afslog_cells(data, cells, idx, uid, homedir);
287    while(idx > 0)
288	free(cells[--idx]);
289    free(cells);
290    return ret;
291}
292
293
294static int
295file_find_cell(struct kafs_data *data,
296	       const char *cell, char **realm, int exact)
297{
298    FILE *F;
299    char buf[1024];
300    char *p;
301    int ret = -1;
302
303    if ((F = fopen(_PATH_CELLSERVDB, "r"))
304	|| (F = fopen(_PATH_ARLA_CELLSERVDB, "r"))
305	|| (F = fopen(_PATH_OPENAFS_DEBIAN_CELLSERVDB, "r"))
306	|| (F = fopen(_PATH_OPENAFS_MACOSX_CELLSERVDB, "r"))
307	|| (F = fopen(_PATH_ARLA_DEBIAN_CELLSERVDB, "r"))) {
308	while (fgets(buf, sizeof(buf), F)) {
309	    int cmp;
310
311	    if (buf[0] != '>')
312		continue; /* Not a cell name line, try next line */
313	    p = buf;
314	    strsep(&p, " \t\n#");
315
316	    if (exact)
317		cmp = strcmp(buf + 1, cell);
318	    else
319		cmp = strncmp(buf + 1, cell, strlen(cell));
320
321	    if (cmp == 0) {
322		/*
323		 * We found the cell name we're looking for.
324		 * Read next line on the form ip-address '#' hostname
325		 */
326		if (fgets(buf, sizeof(buf), F) == NULL)
327		    break;	/* Read failed, give up */
328		p = strchr(buf, '#');
329		if (p == NULL)
330		    break;	/* No '#', give up */
331		p++;
332		if (buf[strlen(buf) - 1] == '\n')
333		    buf[strlen(buf) - 1] = '\0';
334		*realm = (*data->get_realm)(data, p);
335		if (*realm && **realm != '\0')
336		    ret = 0;
337		break;		/* Won't try any more */
338	    }
339	}
340	fclose(F);
341    }
342    return ret;
343}
344
345/* Find the realm associated with cell. Do this by opening CellServDB
346   file and getting the realm-of-host for the first VL-server for the
347   cell.
348
349   This does not work when the VL-server is living in one realm, but
350   the cell it is serving is living in another realm.
351
352   Return 0 on success, -1 otherwise.
353   */
354
355int
356_kafs_realm_of_cell(struct kafs_data *data,
357		    const char *cell, char **realm)
358{
359    char buf[1024];
360    int ret;
361
362    ret = file_find_cell(data, cell, realm, 1);
363    if (ret == 0)
364	return ret;
365    if (dns_find_cell(cell, buf, sizeof(buf)) == 0) {
366	*realm = (*data->get_realm)(data, buf);
367	if(*realm != NULL)
368	    return 0;
369    }
370    return file_find_cell(data, cell, realm, 0);
371}
372
373static int
374_kafs_try_get_cred(struct kafs_data *data, const char *user, const char *cell,
375		   const char *realm, uid_t uid, struct kafs_token *kt)
376{
377    int ret;
378
379    ret = (*data->get_cred)(data, user, cell, realm, uid, kt);
380    if (kafs_verbose) {
381	char *str;
382	asprintf(&str, "%s tried afs%s%s@%s -> %d",
383		 data->name, cell[0] == '\0' ? "" : "/",
384		 cell, realm, ret);
385	(*kafs_verbose)(kafs_verbose_ctx, str);
386	free(str);
387    }
388
389    return ret;
390}
391
392
393int
394_kafs_get_cred(struct kafs_data *data,
395	       const char *cell,
396	       const char *realm_hint,
397	       const char *realm,
398	       uid_t uid,
399	       struct kafs_token *kt)
400{
401    int ret = -1;
402    char *vl_realm;
403    char CELL[64];
404
405    /* We're about to find the realm that holds the key for afs in
406     * the specified cell. The problem is that null-instance
407     * afs-principals are common and that hitting the wrong realm might
408     * yield the wrong afs key. The following assumptions were made.
409     *
410     * Any realm passed to us is preferred.
411     *
412     * If there is a realm with the same name as the cell, it is most
413     * likely the correct realm to talk to.
414     *
415     * In most (maybe even all) cases the database servers of the cell
416     * will live in the realm we are looking for.
417     *
418     * Try the local realm, but if the previous cases fail, this is
419     * really a long shot.
420     *
421     */
422
423    /* comments on the ordering of these tests */
424
425    /* If the user passes a realm, she probably knows something we don't
426     * know and we should try afs@realm_hint.
427     */
428
429    if (realm_hint) {
430	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
431				 cell, realm_hint, uid, kt);
432	if (ret == 0) return 0;
433	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
434				 "", realm_hint, uid, kt);
435	if (ret == 0) return 0;
436    }
437
438    _kafs_foldup(CELL, cell);
439
440    /*
441     * If cell == realm we don't need no cross-cell authentication.
442     * Try afs@REALM.
443     */
444    if (strcmp(CELL, realm) == 0) {
445        ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
446				 "", realm, uid, kt);
447	if (ret == 0) return 0;
448	/* Try afs.cell@REALM below. */
449    }
450
451    /*
452     * If the AFS servers have a file /usr/afs/etc/krb.conf containing
453     * REALM we still don't have to resort to cross-cell authentication.
454     * Try afs.cell@REALM.
455     */
456    ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
457			     cell, realm, uid, kt);
458    if (ret == 0) return 0;
459
460    /*
461     * We failed to get ``first class tickets'' for afs,
462     * fall back to cross-cell authentication.
463     * Try afs@CELL.
464     * Try afs.cell@CELL.
465     */
466    ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
467			     "", CELL, uid, kt);
468    if (ret == 0) return 0;
469    ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
470			     cell, CELL, uid, kt);
471    if (ret == 0) return 0;
472
473    /*
474     * Perhaps the cell doesn't correspond to any realm?
475     * Use realm of first volume location DB server.
476     * Try afs.cell@VL_REALM.
477     * Try afs@VL_REALM???
478     */
479    if (_kafs_realm_of_cell(data, cell, &vl_realm) == 0
480	&& strcmp(vl_realm, realm) != 0
481	&& strcmp(vl_realm, CELL) != 0) {
482	ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
483				 cell, vl_realm, uid, kt);
484	if (ret)
485	    ret = _kafs_try_get_cred(data, AUTH_SUPERUSER,
486				     "", vl_realm, uid, kt);
487	free(vl_realm);
488	if (ret == 0) return 0;
489    }
490
491    return ret;
492}
493