1/*
2 *  Unix SMB/CIFS implementation.
3 *  Generate AFS tickets
4 *  Copyright (C) Volker Lendecke 2003
5 *
6 *  This program is free software; you can redistribute it and/or modify
7 *  it under the terms of the GNU General Public License as published by
8 *  the Free Software Foundation; either version 2 of the License, or
9 *  (at your option) any later version.
10 *
11 *  This program is distributed in the hope that it will be useful,
12 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 *  GNU General Public License for more details.
15 *
16 *  You should have received a copy of the GNU General Public License
17 *  along with this program; if not, write to the Free Software
18 *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 */
20
21#include "includes.h"
22
23#ifdef WITH_FAKE_KASERVER
24
25#include <afs/stds.h>
26#include <afs/afs.h>
27#include <afs/auth.h>
28#include <afs/venus.h>
29#include <asm/unistd.h>
30#include <openssl/des.h>
31
32struct ClearToken {
33	uint32 AuthHandle;
34	char HandShakeKey[8];
35	uint32 ViceId;
36	uint32 BeginTimestamp;
37	uint32 EndTimestamp;
38};
39
40static char *afs_encode_token(const char *cell, const DATA_BLOB ticket,
41			      const struct ClearToken *ct)
42{
43	char *base64_ticket;
44	char *result;
45
46	DATA_BLOB key = data_blob(ct->HandShakeKey, 8);
47	char *base64_key;
48
49	base64_ticket = base64_encode_data_blob(ticket);
50	if (base64_ticket == NULL)
51		return NULL;
52
53	base64_key = base64_encode_data_blob(key);
54	if (base64_key == NULL) {
55		free(base64_ticket);
56		return NULL;
57	}
58
59	asprintf(&result, "%s\n%u\n%s\n%u\n%u\n%u\n%s\n", cell,
60		 ct->AuthHandle, base64_key, ct->ViceId, ct->BeginTimestamp,
61		 ct->EndTimestamp, base64_ticket);
62
63	DEBUG(10, ("Got ticket string:\n%s\n", result));
64
65	free(base64_ticket);
66	free(base64_key);
67
68	return result;
69}
70
71/* Create a ClearToken and an encrypted ticket. ClearToken has not yet the
72 * ViceId set, this should be set by the caller. */
73
74static BOOL afs_createtoken(const char *username, const char *cell,
75			    DATA_BLOB *ticket, struct ClearToken *ct)
76{
77	fstring clear_ticket;
78	char *p = clear_ticket;
79	uint32 len;
80	uint32 now;
81
82	struct afs_key key;
83	des_key_schedule key_schedule;
84
85	if (!secrets_init())
86		return False;
87
88	if (!secrets_fetch_afs_key(cell, &key)) {
89		DEBUG(1, ("Could not fetch AFS service key\n"));
90		return False;
91	}
92
93	ct->AuthHandle = key.kvno;
94
95	/* Build the ticket. This is going to be encrypted, so in our
96           way we fill in ct while we still have the unencrypted
97           form. */
98
99	p = clear_ticket;
100
101	/* The byte-order */
102	*p = 1;
103	p += 1;
104
105	/* "Alice", the client username */
106	strncpy(p, username, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
107	p += strlen(p)+1;
108	strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
109	p += strlen(p)+1;
110	strncpy(p, cell, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
111	p += strlen(p)+1;
112
113	/* Alice's network layer address. At least Openafs-1.2.10
114           ignores this, so we fill in a dummy value here. */
115	SIVAL(p, 0, 0);
116	p += 4;
117
118	/* We need to create a session key */
119	generate_random_buffer(p, 8);
120
121	/* Our client code needs the the key in the clear, it does not
122           know the server-key ... */
123	memcpy(ct->HandShakeKey, p, 8);
124
125	p += 8;
126
127	/* This is a kerberos 4 life time. The life time is expressed
128	 * in units of 5 minute intervals up to 38400 seconds, after
129	 * that a table is used up to lifetime 0xBF. Values between
130	 * 0xC0 and 0xFF is undefined. 0xFF is defined to be the
131	 * infinite time that never expire.
132	 *
133	 * So here we cheat and use the infinite time */
134	*p = 255;
135	p += 1;
136
137	/* Ticket creation time */
138	now = time(NULL);
139	SIVAL(p, 0, now);
140	ct->BeginTimestamp = now;
141
142	if(lp_afs_token_lifetime() == 0)
143		ct->EndTimestamp = NEVERDATE;
144	else
145		ct->EndTimestamp = now + lp_afs_token_lifetime();
146
147	if (((ct->EndTimestamp - ct->BeginTimestamp) & 1) == 1) {
148		ct->BeginTimestamp += 1; /* Lifetime must be even */
149	}
150	p += 4;
151
152	/* And here comes Bob's name and instance, in this case the
153           AFS server. */
154	strncpy(p, "afs", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
155	p += strlen(p)+1;
156	strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1);
157	p += strlen(p)+1;
158
159	/* And zero-pad to a multiple of 8 bytes */
160	len = PTR_DIFF(p, clear_ticket);
161	if (len & 7) {
162		uint32 extra_space = 8-(len & 7);
163		memset(p, 0, extra_space);
164		p+=extra_space;
165	}
166	len = PTR_DIFF(p, clear_ticket);
167
168	des_key_sched((const_des_cblock *)key.key, key_schedule);
169	des_pcbc_encrypt(clear_ticket, clear_ticket,
170			 len, key_schedule, (C_Block *)key.key, 1);
171
172	ZERO_STRUCT(key);
173
174	*ticket = data_blob(clear_ticket, len);
175
176	return True;
177}
178
179char *afs_createtoken_str(const char *username, const char *cell)
180{
181	DATA_BLOB ticket;
182	struct ClearToken ct;
183	char *result;
184
185	if (!afs_createtoken(username, cell, &ticket, &ct))
186		return NULL;
187
188	result = afs_encode_token(cell, ticket, &ct);
189
190	data_blob_free(&ticket);
191
192	return result;
193}
194
195/*
196  This routine takes a radical approach completely bypassing the
197  Kerberos idea of security and using AFS simply as an intelligent
198  file backend. Samba has persuaded itself somehow that the user is
199  actually correctly identified and then we create a ticket that the
200  AFS server hopefully accepts using its KeyFile that the admin has
201  kindly stored to our secrets.tdb.
202
203  Thanks to the book "Network Security -- PRIVATE Communication in a
204  PUBLIC World" by Charlie Kaufman, Radia Perlman and Mike Speciner
205  Kerberos 4 tickets are not really hard to construct.
206
207  For the comments "Alice" is the User to be auth'ed, and "Bob" is the
208  AFS server.  */
209
210BOOL afs_login(connection_struct *conn)
211{
212	DATA_BLOB ticket;
213	pstring afs_username;
214	char *cell;
215	BOOL result;
216	char *ticket_str;
217	DOM_SID user_sid;
218
219	struct ClearToken ct;
220
221	pstrcpy(afs_username, lp_afs_username_map());
222	standard_sub_conn(conn, afs_username, sizeof(afs_username));
223
224	if (NT_STATUS_IS_OK(uid_to_sid(&user_sid, conn->uid)))
225		pstring_sub(afs_username, "%s", sid_string_static(&user_sid));
226
227	/* The pts command always generates completely lower-case user
228	 * names. */
229	strlower_m(afs_username);
230
231	cell = strchr(afs_username, '@');
232
233	if (cell == NULL) {
234		DEBUG(1, ("AFS username doesn't contain a @, "
235			  "could not find cell\n"));
236		return False;
237	}
238
239	*cell = '\0';
240	cell += 1;
241
242	DEBUG(10, ("Trying to log into AFS for user %s@%s\n",
243		   afs_username, cell));
244
245	if (!afs_createtoken(afs_username, cell, &ticket, &ct))
246		return False;
247
248	/* For which Unix-UID do we want to set the token? */
249	ct.ViceId = getuid();
250
251	ticket_str = afs_encode_token(cell, ticket, &ct);
252
253	result = afs_settoken_str(ticket_str);
254
255	SAFE_FREE(ticket_str);
256
257	data_blob_free(&ticket);
258
259	return result;
260}
261
262#else
263
264BOOL afs_login(connection_struct *conn)
265{
266	return True;
267}
268
269char *afs_createtoken_str(const char *username, const char *cell)
270{
271	return False;
272}
273
274#endif /* WITH_FAKE_KASERVER */
275