gssd.c revision 244604
1184588Sdfr/*- 2184588Sdfr * Copyright (c) 2008 Isilon Inc http://www.isilon.com/ 3184588Sdfr * Authors: Doug Rabson <dfr@rabson.org> 4184588Sdfr * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org> 5184588Sdfr * 6184588Sdfr * Redistribution and use in source and binary forms, with or without 7184588Sdfr * modification, are permitted provided that the following conditions 8184588Sdfr * are met: 9184588Sdfr * 1. Redistributions of source code must retain the above copyright 10184588Sdfr * notice, this list of conditions and the following disclaimer. 11184588Sdfr * 2. Redistributions in binary form must reproduce the above copyright 12184588Sdfr * notice, this list of conditions and the following disclaimer in the 13184588Sdfr * documentation and/or other materials provided with the distribution. 14184588Sdfr * 15184588Sdfr * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16184588Sdfr * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17184588Sdfr * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18184588Sdfr * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19184588Sdfr * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20184588Sdfr * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21184588Sdfr * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22184588Sdfr * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23184588Sdfr * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24184588Sdfr * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25184588Sdfr * SUCH DAMAGE. 26184588Sdfr */ 27184588Sdfr 28184588Sdfr#include <sys/cdefs.h> 29184588Sdfr__FBSDID("$FreeBSD: head/usr.sbin/gssd/gssd.c 244604 2012-12-22 23:21:17Z rmacklem $"); 30184588Sdfr 31184588Sdfr#include <sys/param.h> 32184588Sdfr#include <sys/stat.h> 33184588Sdfr#include <sys/linker.h> 34184588Sdfr#include <sys/module.h> 35184588Sdfr#include <sys/queue.h> 36244331Srmacklem#include <sys/syslog.h> 37184588Sdfr#include <ctype.h> 38244604Srmacklem#include <dirent.h> 39184588Sdfr#include <err.h> 40244604Srmacklem#include <krb5.h> 41184588Sdfr#include <pwd.h> 42184588Sdfr#include <stdio.h> 43184588Sdfr#include <stdlib.h> 44184588Sdfr#include <string.h> 45184588Sdfr#include <unistd.h> 46184588Sdfr#include <gssapi/gssapi.h> 47184588Sdfr#include <rpc/rpc.h> 48184588Sdfr#include <rpc/rpc_com.h> 49184588Sdfr 50184588Sdfr#include "gssd.h" 51184588Sdfr 52184588Sdfr#ifndef _PATH_GSS_MECH 53184588Sdfr#define _PATH_GSS_MECH "/etc/gss/mech" 54184588Sdfr#endif 55184588Sdfr#ifndef _PATH_GSSDSOCK 56184588Sdfr#define _PATH_GSSDSOCK "/var/run/gssd.sock" 57184588Sdfr#endif 58184588Sdfr 59184588Sdfrstruct gss_resource { 60184588Sdfr LIST_ENTRY(gss_resource) gr_link; 61184588Sdfr uint64_t gr_id; /* indentifier exported to kernel */ 62184588Sdfr void* gr_res; /* GSS-API resource pointer */ 63184588Sdfr}; 64184588SdfrLIST_HEAD(gss_resource_list, gss_resource) gss_resources; 65184588Sdfrint gss_resource_count; 66184588Sdfruint32_t gss_next_id; 67184588Sdfruint32_t gss_start_time; 68184588Sdfrint debug_level; 69244604Srmacklemstatic char ccfile_dirlist[PATH_MAX + 1], ccfile_substring[NAME_MAX + 1]; 70244604Srmacklemstatic char pref_realm[1024]; 71184588Sdfr 72184588Sdfrstatic void gssd_load_mech(void); 73244604Srmacklemstatic int find_ccache_file(const char *, uid_t, char *); 74244604Srmacklemstatic int is_a_valid_tgt_cache(const char *, uid_t, int *, time_t *); 75184588Sdfr 76184588Sdfrextern void gssd_1(struct svc_req *rqstp, SVCXPRT *transp); 77184588Sdfrextern int gssd_syscall(char *path); 78184588Sdfr 79184588Sdfrint 80184588Sdfrmain(int argc, char **argv) 81184588Sdfr{ 82184588Sdfr /* 83184588Sdfr * We provide an RPC service on a local-domain socket. The 84184588Sdfr * kernel's GSS-API code will pass what it can't handle 85184588Sdfr * directly to us. 86184588Sdfr */ 87184588Sdfr struct sockaddr_un sun; 88184588Sdfr int fd, oldmask, ch, debug; 89184588Sdfr SVCXPRT *xprt; 90184588Sdfr 91244604Srmacklem /* 92244604Srmacklem * Initialize the credential cache file name substring and the 93244604Srmacklem * search directory list. 94244604Srmacklem */ 95244604Srmacklem strlcpy(ccfile_substring, "krb5cc_", sizeof(ccfile_substring)); 96244604Srmacklem ccfile_dirlist[0] = '\0'; 97244604Srmacklem pref_realm[0] = '\0'; 98184588Sdfr debug = 0; 99244604Srmacklem while ((ch = getopt(argc, argv, "ds:c:r:")) != -1) { 100184588Sdfr switch (ch) { 101184588Sdfr case 'd': 102184588Sdfr debug_level++; 103184588Sdfr break; 104244604Srmacklem case 's': 105244604Srmacklem /* 106244604Srmacklem * Set the directory search list. This enables use of 107244604Srmacklem * find_ccache_file() to search the directories for a 108244604Srmacklem * suitable credentials cache file. 109244604Srmacklem */ 110244604Srmacklem strlcpy(ccfile_dirlist, optarg, sizeof(ccfile_dirlist)); 111244604Srmacklem break; 112244604Srmacklem case 'c': 113244604Srmacklem /* 114244604Srmacklem * Specify a non-default credential cache file 115244604Srmacklem * substring. 116244604Srmacklem */ 117244604Srmacklem strlcpy(ccfile_substring, optarg, 118244604Srmacklem sizeof(ccfile_substring)); 119244604Srmacklem break; 120244604Srmacklem case 'r': 121244604Srmacklem /* 122244604Srmacklem * Set the preferred realm for the credential cache tgt. 123244604Srmacklem */ 124244604Srmacklem strlcpy(pref_realm, optarg, sizeof(pref_realm)); 125244604Srmacklem break; 126184588Sdfr default: 127244604Srmacklem fprintf(stderr, 128244604Srmacklem "usage: %s [-d] [-s dir-list] [-c file-substring]" 129244604Srmacklem " [-r preferred-realm]\n", argv[0]); 130184588Sdfr exit(1); 131184588Sdfr break; 132184588Sdfr } 133184588Sdfr } 134184588Sdfr 135184588Sdfr gssd_load_mech(); 136184588Sdfr 137184588Sdfr if (!debug_level) 138184588Sdfr daemon(0, 0); 139184588Sdfr 140184588Sdfr memset(&sun, 0, sizeof sun); 141184588Sdfr sun.sun_family = AF_LOCAL; 142184588Sdfr unlink(_PATH_GSSDSOCK); 143184588Sdfr strcpy(sun.sun_path, _PATH_GSSDSOCK); 144184588Sdfr sun.sun_len = SUN_LEN(&sun); 145184588Sdfr fd = socket(AF_LOCAL, SOCK_STREAM, 0); 146184588Sdfr if (!fd) { 147244331Srmacklem if (debug_level == 0) { 148244331Srmacklem syslog(LOG_ERR, "Can't create local gssd socket"); 149244331Srmacklem exit(1); 150244331Srmacklem } 151184588Sdfr err(1, "Can't create local gssd socket"); 152184588Sdfr } 153184588Sdfr oldmask = umask(S_IXUSR|S_IRWXG|S_IRWXO); 154184588Sdfr if (bind(fd, (struct sockaddr *) &sun, sun.sun_len) < 0) { 155244331Srmacklem if (debug_level == 0) { 156244331Srmacklem syslog(LOG_ERR, "Can't bind local gssd socket"); 157244331Srmacklem exit(1); 158244331Srmacklem } 159184588Sdfr err(1, "Can't bind local gssd socket"); 160184588Sdfr } 161184588Sdfr umask(oldmask); 162184588Sdfr if (listen(fd, SOMAXCONN) < 0) { 163244331Srmacklem if (debug_level == 0) { 164244331Srmacklem syslog(LOG_ERR, "Can't listen on local gssd socket"); 165244331Srmacklem exit(1); 166244331Srmacklem } 167184588Sdfr err(1, "Can't listen on local gssd socket"); 168184588Sdfr } 169184588Sdfr xprt = svc_vc_create(fd, RPC_MAXDATASIZE, RPC_MAXDATASIZE); 170184588Sdfr if (!xprt) { 171244331Srmacklem if (debug_level == 0) { 172244331Srmacklem syslog(LOG_ERR, 173244331Srmacklem "Can't create transport for local gssd socket"); 174244331Srmacklem exit(1); 175244331Srmacklem } 176184588Sdfr err(1, "Can't create transport for local gssd socket"); 177184588Sdfr } 178184588Sdfr if (!svc_reg(xprt, GSSD, GSSDVERS, gssd_1, NULL)) { 179244331Srmacklem if (debug_level == 0) { 180244331Srmacklem syslog(LOG_ERR, 181244331Srmacklem "Can't register service for local gssd socket"); 182244331Srmacklem exit(1); 183244331Srmacklem } 184184588Sdfr err(1, "Can't register service for local gssd socket"); 185184588Sdfr } 186184588Sdfr 187184588Sdfr LIST_INIT(&gss_resources); 188184588Sdfr gss_next_id = 1; 189184588Sdfr gss_start_time = time(0); 190184588Sdfr 191184588Sdfr gssd_syscall(_PATH_GSSDSOCK); 192184588Sdfr svc_run(); 193184588Sdfr 194184588Sdfr return (0); 195184588Sdfr} 196184588Sdfr 197184588Sdfrstatic void 198184588Sdfrgssd_load_mech(void) 199184588Sdfr{ 200184588Sdfr FILE *fp; 201184588Sdfr char buf[256]; 202184588Sdfr char *p; 203184588Sdfr char *name, *oid, *lib, *kobj; 204184588Sdfr 205184588Sdfr fp = fopen(_PATH_GSS_MECH, "r"); 206184588Sdfr if (!fp) 207184588Sdfr return; 208184588Sdfr 209184588Sdfr while (fgets(buf, sizeof(buf), fp)) { 210184588Sdfr if (*buf == '#') 211184588Sdfr continue; 212184588Sdfr p = buf; 213184588Sdfr name = strsep(&p, "\t\n "); 214184588Sdfr if (p) while (isspace(*p)) p++; 215184588Sdfr oid = strsep(&p, "\t\n "); 216184588Sdfr if (p) while (isspace(*p)) p++; 217184588Sdfr lib = strsep(&p, "\t\n "); 218184588Sdfr if (p) while (isspace(*p)) p++; 219184588Sdfr kobj = strsep(&p, "\t\n "); 220184588Sdfr if (!name || !oid || !lib || !kobj) 221184588Sdfr continue; 222184588Sdfr 223184588Sdfr if (strcmp(kobj, "-")) { 224184588Sdfr /* 225184588Sdfr * Attempt to load the kernel module if its 226184588Sdfr * not already present. 227184588Sdfr */ 228184588Sdfr if (modfind(kobj) < 0) { 229184588Sdfr if (kldload(kobj) < 0) { 230184588Sdfr fprintf(stderr, 231184588Sdfr "%s: can't find or load kernel module %s for %s\n", 232184588Sdfr getprogname(), kobj, name); 233184588Sdfr } 234184588Sdfr } 235184588Sdfr } 236184588Sdfr } 237184588Sdfr fclose(fp); 238184588Sdfr} 239184588Sdfr 240184588Sdfrstatic void * 241184588Sdfrgssd_find_resource(uint64_t id) 242184588Sdfr{ 243184588Sdfr struct gss_resource *gr; 244184588Sdfr 245184588Sdfr if (!id) 246184588Sdfr return (NULL); 247184588Sdfr 248184588Sdfr LIST_FOREACH(gr, &gss_resources, gr_link) 249184588Sdfr if (gr->gr_id == id) 250184588Sdfr return (gr->gr_res); 251184588Sdfr 252184588Sdfr return (NULL); 253184588Sdfr} 254184588Sdfr 255184588Sdfrstatic uint64_t 256184588Sdfrgssd_make_resource(void *res) 257184588Sdfr{ 258184588Sdfr struct gss_resource *gr; 259184588Sdfr 260184588Sdfr if (!res) 261184588Sdfr return (0); 262184588Sdfr 263184588Sdfr gr = malloc(sizeof(struct gss_resource)); 264184588Sdfr if (!gr) 265184588Sdfr return (0); 266184588Sdfr gr->gr_id = (gss_next_id++) + ((uint64_t) gss_start_time << 32); 267184588Sdfr gr->gr_res = res; 268184588Sdfr LIST_INSERT_HEAD(&gss_resources, gr, gr_link); 269184588Sdfr gss_resource_count++; 270184588Sdfr if (debug_level > 1) 271184588Sdfr printf("%d resources allocated\n", gss_resource_count); 272184588Sdfr 273184588Sdfr return (gr->gr_id); 274184588Sdfr} 275184588Sdfr 276184588Sdfrstatic void 277184588Sdfrgssd_delete_resource(uint64_t id) 278184588Sdfr{ 279184588Sdfr struct gss_resource *gr; 280184588Sdfr 281184588Sdfr LIST_FOREACH(gr, &gss_resources, gr_link) { 282184588Sdfr if (gr->gr_id == id) { 283184588Sdfr LIST_REMOVE(gr, gr_link); 284184588Sdfr free(gr); 285184588Sdfr gss_resource_count--; 286184588Sdfr if (debug_level > 1) 287184588Sdfr printf("%d resources allocated\n", 288184588Sdfr gss_resource_count); 289184588Sdfr return; 290184588Sdfr } 291184588Sdfr } 292184588Sdfr} 293184588Sdfr 294184588Sdfrbool_t 295184588Sdfrgssd_null_1_svc(void *argp, void *result, struct svc_req *rqstp) 296184588Sdfr{ 297184588Sdfr 298184588Sdfr return (TRUE); 299184588Sdfr} 300184588Sdfr 301184588Sdfrbool_t 302184588Sdfrgssd_init_sec_context_1_svc(init_sec_context_args *argp, init_sec_context_res *result, struct svc_req *rqstp) 303184588Sdfr{ 304184588Sdfr gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; 305184588Sdfr gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; 306184588Sdfr gss_name_t name = GSS_C_NO_NAME; 307244604Srmacklem char ccname[PATH_MAX + 5 + 1], *cp, *cp2; 308244604Srmacklem int gotone; 309184588Sdfr 310244604Srmacklem memset(result, 0, sizeof(*result)); 311244604Srmacklem if (ccfile_dirlist[0] != '\0' && argp->cred == 0) { 312244604Srmacklem /* 313244604Srmacklem * For the "-s" case and no credentials provided as an 314244604Srmacklem * argument, search the directory list for an appropriate 315244604Srmacklem * credential cache file. If the search fails, return failure. 316244604Srmacklem */ 317244604Srmacklem gotone = 0; 318244604Srmacklem cp = ccfile_dirlist; 319244604Srmacklem do { 320244604Srmacklem cp2 = strchr(cp, ':'); 321244604Srmacklem if (cp2 != NULL) 322244604Srmacklem *cp2 = '\0'; 323244604Srmacklem gotone = find_ccache_file(cp, argp->uid, ccname); 324244604Srmacklem if (gotone != 0) 325244604Srmacklem break; 326244604Srmacklem if (cp2 != NULL) 327244604Srmacklem *cp2++ = ':'; 328244604Srmacklem cp = cp2; 329244604Srmacklem } while (cp != NULL && *cp != '\0'); 330244604Srmacklem if (gotone == 0) { 331244604Srmacklem result->major_status = GSS_S_CREDENTIALS_EXPIRED; 332244604Srmacklem return (TRUE); 333244604Srmacklem } 334244604Srmacklem } else { 335244604Srmacklem /* 336244604Srmacklem * If there wasn't a "-s" option or the credentials have 337244604Srmacklem * been provided as an argument, do it the old way. 338244604Srmacklem * When credentials are provided, the uid should be root. 339244604Srmacklem */ 340244604Srmacklem if (argp->cred != 0 && argp->uid != 0) { 341244604Srmacklem if (debug_level == 0) 342244604Srmacklem syslog(LOG_ERR, "gss_init_sec_context:" 343244604Srmacklem " cred for non-root"); 344244604Srmacklem else 345244604Srmacklem fprintf(stderr, "gss_init_sec_context:" 346244604Srmacklem " cred for non-root\n"); 347244604Srmacklem } 348244604Srmacklem snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d", 349244604Srmacklem (int) argp->uid); 350244604Srmacklem } 351184588Sdfr setenv("KRB5CCNAME", ccname, TRUE); 352184588Sdfr 353184588Sdfr if (argp->cred) { 354184588Sdfr cred = gssd_find_resource(argp->cred); 355184588Sdfr if (!cred) { 356184588Sdfr result->major_status = GSS_S_CREDENTIALS_EXPIRED; 357184588Sdfr return (TRUE); 358184588Sdfr } 359184588Sdfr } 360184588Sdfr if (argp->ctx) { 361184588Sdfr ctx = gssd_find_resource(argp->ctx); 362184588Sdfr if (!ctx) { 363184588Sdfr result->major_status = GSS_S_CONTEXT_EXPIRED; 364184588Sdfr return (TRUE); 365184588Sdfr } 366184588Sdfr } 367184588Sdfr if (argp->name) { 368184588Sdfr name = gssd_find_resource(argp->name); 369184588Sdfr if (!name) { 370184588Sdfr result->major_status = GSS_S_BAD_NAME; 371184588Sdfr return (TRUE); 372184588Sdfr } 373184588Sdfr } 374184588Sdfr 375184588Sdfr result->major_status = gss_init_sec_context(&result->minor_status, 376184588Sdfr cred, &ctx, name, argp->mech_type, 377184588Sdfr argp->req_flags, argp->time_req, argp->input_chan_bindings, 378184588Sdfr &argp->input_token, &result->actual_mech_type, 379184588Sdfr &result->output_token, &result->ret_flags, &result->time_rec); 380184588Sdfr 381184588Sdfr if (result->major_status == GSS_S_COMPLETE 382184588Sdfr || result->major_status == GSS_S_CONTINUE_NEEDED) { 383184588Sdfr if (argp->ctx) 384184588Sdfr result->ctx = argp->ctx; 385184588Sdfr else 386184588Sdfr result->ctx = gssd_make_resource(ctx); 387184588Sdfr } 388184588Sdfr 389184588Sdfr return (TRUE); 390184588Sdfr} 391184588Sdfr 392184588Sdfrbool_t 393184588Sdfrgssd_accept_sec_context_1_svc(accept_sec_context_args *argp, accept_sec_context_res *result, struct svc_req *rqstp) 394184588Sdfr{ 395184588Sdfr gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; 396184588Sdfr gss_cred_id_t cred = GSS_C_NO_CREDENTIAL; 397184588Sdfr gss_name_t src_name; 398184588Sdfr gss_cred_id_t delegated_cred_handle; 399184588Sdfr 400184588Sdfr memset(result, 0, sizeof(*result)); 401184588Sdfr if (argp->ctx) { 402184588Sdfr ctx = gssd_find_resource(argp->ctx); 403184588Sdfr if (!ctx) { 404184588Sdfr result->major_status = GSS_S_CONTEXT_EXPIRED; 405184588Sdfr return (TRUE); 406184588Sdfr } 407184588Sdfr } 408184588Sdfr if (argp->cred) { 409184588Sdfr cred = gssd_find_resource(argp->cred); 410184588Sdfr if (!cred) { 411184588Sdfr result->major_status = GSS_S_CREDENTIALS_EXPIRED; 412184588Sdfr return (TRUE); 413184588Sdfr } 414184588Sdfr } 415184588Sdfr 416184588Sdfr memset(result, 0, sizeof(*result)); 417184588Sdfr result->major_status = gss_accept_sec_context(&result->minor_status, 418184588Sdfr &ctx, cred, &argp->input_token, argp->input_chan_bindings, 419184588Sdfr &src_name, &result->mech_type, &result->output_token, 420184588Sdfr &result->ret_flags, &result->time_rec, 421184588Sdfr &delegated_cred_handle); 422184588Sdfr 423184588Sdfr if (result->major_status == GSS_S_COMPLETE 424184588Sdfr || result->major_status == GSS_S_CONTINUE_NEEDED) { 425184588Sdfr if (argp->ctx) 426184588Sdfr result->ctx = argp->ctx; 427184588Sdfr else 428184588Sdfr result->ctx = gssd_make_resource(ctx); 429184588Sdfr result->src_name = gssd_make_resource(src_name); 430184588Sdfr result->delegated_cred_handle = 431184588Sdfr gssd_make_resource(delegated_cred_handle); 432184588Sdfr } 433184588Sdfr 434184588Sdfr return (TRUE); 435184588Sdfr} 436184588Sdfr 437184588Sdfrbool_t 438184588Sdfrgssd_delete_sec_context_1_svc(delete_sec_context_args *argp, delete_sec_context_res *result, struct svc_req *rqstp) 439184588Sdfr{ 440184588Sdfr gss_ctx_id_t ctx = gssd_find_resource(argp->ctx); 441184588Sdfr 442184588Sdfr if (ctx) { 443184588Sdfr result->major_status = gss_delete_sec_context( 444184588Sdfr &result->minor_status, &ctx, &result->output_token); 445184588Sdfr gssd_delete_resource(argp->ctx); 446184588Sdfr } else { 447184588Sdfr result->major_status = GSS_S_COMPLETE; 448184588Sdfr result->minor_status = 0; 449184588Sdfr } 450184588Sdfr 451184588Sdfr return (TRUE); 452184588Sdfr} 453184588Sdfr 454184588Sdfrbool_t 455184588Sdfrgssd_export_sec_context_1_svc(export_sec_context_args *argp, export_sec_context_res *result, struct svc_req *rqstp) 456184588Sdfr{ 457184588Sdfr gss_ctx_id_t ctx = gssd_find_resource(argp->ctx); 458184588Sdfr 459184588Sdfr if (ctx) { 460184588Sdfr result->major_status = gss_export_sec_context( 461184588Sdfr &result->minor_status, &ctx, 462184588Sdfr &result->interprocess_token); 463184588Sdfr result->format = KGSS_HEIMDAL_1_1; 464184588Sdfr gssd_delete_resource(argp->ctx); 465184588Sdfr } else { 466184588Sdfr result->major_status = GSS_S_FAILURE; 467184588Sdfr result->minor_status = 0; 468184588Sdfr result->interprocess_token.length = 0; 469184588Sdfr result->interprocess_token.value = NULL; 470184588Sdfr } 471184588Sdfr 472184588Sdfr return (TRUE); 473184588Sdfr} 474184588Sdfr 475184588Sdfrbool_t 476184588Sdfrgssd_import_name_1_svc(import_name_args *argp, import_name_res *result, struct svc_req *rqstp) 477184588Sdfr{ 478184588Sdfr gss_name_t name; 479184588Sdfr 480184588Sdfr result->major_status = gss_import_name(&result->minor_status, 481184588Sdfr &argp->input_name_buffer, argp->input_name_type, &name); 482184588Sdfr 483184588Sdfr if (result->major_status == GSS_S_COMPLETE) 484184588Sdfr result->output_name = gssd_make_resource(name); 485184588Sdfr else 486184588Sdfr result->output_name = 0; 487184588Sdfr 488184588Sdfr return (TRUE); 489184588Sdfr} 490184588Sdfr 491184588Sdfrbool_t 492184588Sdfrgssd_canonicalize_name_1_svc(canonicalize_name_args *argp, canonicalize_name_res *result, struct svc_req *rqstp) 493184588Sdfr{ 494184588Sdfr gss_name_t name = gssd_find_resource(argp->input_name); 495184588Sdfr gss_name_t output_name; 496184588Sdfr 497184588Sdfr memset(result, 0, sizeof(*result)); 498184588Sdfr if (!name) { 499184588Sdfr result->major_status = GSS_S_BAD_NAME; 500184588Sdfr return (TRUE); 501184588Sdfr } 502184588Sdfr 503184588Sdfr result->major_status = gss_canonicalize_name(&result->minor_status, 504184588Sdfr name, argp->mech_type, &output_name); 505184588Sdfr 506184588Sdfr if (result->major_status == GSS_S_COMPLETE) 507184588Sdfr result->output_name = gssd_make_resource(output_name); 508184588Sdfr else 509184588Sdfr result->output_name = 0; 510184588Sdfr 511184588Sdfr return (TRUE); 512184588Sdfr} 513184588Sdfr 514184588Sdfrbool_t 515184588Sdfrgssd_export_name_1_svc(export_name_args *argp, export_name_res *result, struct svc_req *rqstp) 516184588Sdfr{ 517184588Sdfr gss_name_t name = gssd_find_resource(argp->input_name); 518184588Sdfr 519184588Sdfr memset(result, 0, sizeof(*result)); 520184588Sdfr if (!name) { 521184588Sdfr result->major_status = GSS_S_BAD_NAME; 522184588Sdfr return (TRUE); 523184588Sdfr } 524184588Sdfr 525184588Sdfr result->major_status = gss_export_name(&result->minor_status, 526184588Sdfr name, &result->exported_name); 527184588Sdfr 528184588Sdfr return (TRUE); 529184588Sdfr} 530184588Sdfr 531184588Sdfrbool_t 532184588Sdfrgssd_release_name_1_svc(release_name_args *argp, release_name_res *result, struct svc_req *rqstp) 533184588Sdfr{ 534184588Sdfr gss_name_t name = gssd_find_resource(argp->input_name); 535184588Sdfr 536184588Sdfr if (name) { 537184588Sdfr result->major_status = gss_release_name(&result->minor_status, 538184588Sdfr &name); 539184588Sdfr gssd_delete_resource(argp->input_name); 540184588Sdfr } else { 541184588Sdfr result->major_status = GSS_S_COMPLETE; 542184588Sdfr result->minor_status = 0; 543184588Sdfr } 544184588Sdfr 545184588Sdfr return (TRUE); 546184588Sdfr} 547184588Sdfr 548184588Sdfrbool_t 549184588Sdfrgssd_pname_to_uid_1_svc(pname_to_uid_args *argp, pname_to_uid_res *result, struct svc_req *rqstp) 550184588Sdfr{ 551184588Sdfr gss_name_t name = gssd_find_resource(argp->pname); 552184588Sdfr uid_t uid; 553184588Sdfr char buf[128]; 554184588Sdfr struct passwd pwd, *pw; 555184588Sdfr 556184588Sdfr memset(result, 0, sizeof(*result)); 557184588Sdfr if (name) { 558184588Sdfr result->major_status = 559184588Sdfr gss_pname_to_uid(&result->minor_status, 560184588Sdfr name, argp->mech, &uid); 561184588Sdfr if (result->major_status == GSS_S_COMPLETE) { 562184588Sdfr result->uid = uid; 563184588Sdfr getpwuid_r(uid, &pwd, buf, sizeof(buf), &pw); 564184588Sdfr if (pw) { 565184588Sdfr int len = NGRPS; 566184588Sdfr int groups[NGRPS]; 567184588Sdfr result->gid = pw->pw_gid; 568184588Sdfr getgrouplist(pw->pw_name, pw->pw_gid, 569184588Sdfr groups, &len); 570184588Sdfr result->gidlist.gidlist_len = len; 571184588Sdfr result->gidlist.gidlist_val = 572184588Sdfr mem_alloc(len * sizeof(int)); 573184588Sdfr memcpy(result->gidlist.gidlist_val, groups, 574184588Sdfr len * sizeof(int)); 575184588Sdfr } else { 576184588Sdfr result->gid = 65534; 577184588Sdfr result->gidlist.gidlist_len = 0; 578184588Sdfr result->gidlist.gidlist_val = NULL; 579184588Sdfr } 580184588Sdfr } 581184588Sdfr } else { 582184588Sdfr result->major_status = GSS_S_BAD_NAME; 583184588Sdfr result->minor_status = 0; 584184588Sdfr } 585184588Sdfr 586184588Sdfr return (TRUE); 587184588Sdfr} 588184588Sdfr 589184588Sdfrbool_t 590184588Sdfrgssd_acquire_cred_1_svc(acquire_cred_args *argp, acquire_cred_res *result, struct svc_req *rqstp) 591184588Sdfr{ 592184588Sdfr gss_name_t desired_name = GSS_C_NO_NAME; 593184588Sdfr gss_cred_id_t cred; 594244604Srmacklem char ccname[PATH_MAX + 5 + 1], *cp, *cp2; 595244604Srmacklem int gotone; 596184588Sdfr 597244604Srmacklem memset(result, 0, sizeof(*result)); 598244604Srmacklem if (ccfile_dirlist[0] != '\0' && argp->desired_name == 0) { 599244604Srmacklem /* 600244604Srmacklem * For the "-s" case and no name provided as an 601244604Srmacklem * argument, search the directory list for an appropriate 602244604Srmacklem * credential cache file. If the search fails, return failure. 603244604Srmacklem */ 604244604Srmacklem gotone = 0; 605244604Srmacklem cp = ccfile_dirlist; 606244604Srmacklem do { 607244604Srmacklem cp2 = strchr(cp, ':'); 608244604Srmacklem if (cp2 != NULL) 609244604Srmacklem *cp2 = '\0'; 610244604Srmacklem gotone = find_ccache_file(cp, argp->uid, ccname); 611244604Srmacklem if (gotone != 0) 612244604Srmacklem break; 613244604Srmacklem if (cp2 != NULL) 614244604Srmacklem *cp2++ = ':'; 615244604Srmacklem cp = cp2; 616244604Srmacklem } while (cp != NULL && *cp != '\0'); 617244604Srmacklem if (gotone == 0) { 618244604Srmacklem result->major_status = GSS_S_CREDENTIALS_EXPIRED; 619244604Srmacklem return (TRUE); 620244604Srmacklem } 621244604Srmacklem } else { 622244604Srmacklem /* 623244604Srmacklem * If there wasn't a "-s" option or the name has 624244604Srmacklem * been provided as an argument, do it the old way. 625244604Srmacklem * When a name is provided, it will normally exist in the 626244604Srmacklem * default keytab file and the uid will be root. 627244604Srmacklem */ 628244604Srmacklem if (argp->desired_name != 0 && argp->uid != 0) { 629244604Srmacklem if (debug_level == 0) 630244604Srmacklem syslog(LOG_ERR, "gss_acquire_cred:" 631244604Srmacklem " principal_name for non-root"); 632244604Srmacklem else 633244604Srmacklem fprintf(stderr, "gss_acquire_cred:" 634244604Srmacklem " principal_name for non-root\n"); 635244604Srmacklem } 636244604Srmacklem snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_%d", 637244604Srmacklem (int) argp->uid); 638244604Srmacklem } 639184588Sdfr setenv("KRB5CCNAME", ccname, TRUE); 640184588Sdfr 641184588Sdfr if (argp->desired_name) { 642184588Sdfr desired_name = gssd_find_resource(argp->desired_name); 643184588Sdfr if (!desired_name) { 644184588Sdfr result->major_status = GSS_S_BAD_NAME; 645184588Sdfr return (TRUE); 646184588Sdfr } 647184588Sdfr } 648184588Sdfr 649184588Sdfr result->major_status = gss_acquire_cred(&result->minor_status, 650184588Sdfr desired_name, argp->time_req, argp->desired_mechs, 651184588Sdfr argp->cred_usage, &cred, &result->actual_mechs, &result->time_rec); 652184588Sdfr 653184588Sdfr if (result->major_status == GSS_S_COMPLETE) 654184588Sdfr result->output_cred = gssd_make_resource(cred); 655184588Sdfr else 656184588Sdfr result->output_cred = 0; 657184588Sdfr 658184588Sdfr return (TRUE); 659184588Sdfr} 660184588Sdfr 661184588Sdfrbool_t 662184588Sdfrgssd_set_cred_option_1_svc(set_cred_option_args *argp, set_cred_option_res *result, struct svc_req *rqstp) 663184588Sdfr{ 664184588Sdfr gss_cred_id_t cred = gssd_find_resource(argp->cred); 665184588Sdfr 666184588Sdfr memset(result, 0, sizeof(*result)); 667184588Sdfr if (!cred) { 668184588Sdfr result->major_status = GSS_S_CREDENTIALS_EXPIRED; 669184588Sdfr return (TRUE); 670184588Sdfr } 671184588Sdfr 672184588Sdfr result->major_status = gss_set_cred_option(&result->minor_status, 673184588Sdfr &cred, argp->option_name, &argp->option_value); 674184588Sdfr 675184588Sdfr return (TRUE); 676184588Sdfr} 677184588Sdfr 678184588Sdfrbool_t 679184588Sdfrgssd_release_cred_1_svc(release_cred_args *argp, release_cred_res *result, struct svc_req *rqstp) 680184588Sdfr{ 681184588Sdfr gss_cred_id_t cred = gssd_find_resource(argp->cred); 682184588Sdfr 683184588Sdfr if (cred) { 684184588Sdfr result->major_status = gss_release_cred(&result->minor_status, 685184588Sdfr &cred); 686184588Sdfr gssd_delete_resource(argp->cred); 687184588Sdfr } else { 688184588Sdfr result->major_status = GSS_S_COMPLETE; 689184588Sdfr result->minor_status = 0; 690184588Sdfr } 691184588Sdfr 692184588Sdfr return (TRUE); 693184588Sdfr} 694184588Sdfr 695184588Sdfrbool_t 696184588Sdfrgssd_display_status_1_svc(display_status_args *argp, display_status_res *result, struct svc_req *rqstp) 697184588Sdfr{ 698184588Sdfr 699184588Sdfr result->message_context = argp->message_context; 700184588Sdfr result->major_status = gss_display_status(&result->minor_status, 701184588Sdfr argp->status_value, argp->status_type, argp->mech_type, 702184588Sdfr &result->message_context, &result->status_string); 703184588Sdfr 704184588Sdfr return (TRUE); 705184588Sdfr} 706184588Sdfr 707184588Sdfrint 708184588Sdfrgssd_1_freeresult(SVCXPRT *transp, xdrproc_t xdr_result, caddr_t result) 709184588Sdfr{ 710184588Sdfr /* 711184588Sdfr * We don't use XDR to free the results - anything which was 712184588Sdfr * allocated came from GSS-API. We use xdr_result to figure 713184588Sdfr * out what to do. 714184588Sdfr */ 715184588Sdfr OM_uint32 junk; 716184588Sdfr 717184588Sdfr if (xdr_result == (xdrproc_t) xdr_init_sec_context_res) { 718184588Sdfr init_sec_context_res *p = (init_sec_context_res *) result; 719184588Sdfr gss_release_buffer(&junk, &p->output_token); 720184588Sdfr } else if (xdr_result == (xdrproc_t) xdr_accept_sec_context_res) { 721184588Sdfr accept_sec_context_res *p = (accept_sec_context_res *) result; 722184588Sdfr gss_release_buffer(&junk, &p->output_token); 723184588Sdfr } else if (xdr_result == (xdrproc_t) xdr_delete_sec_context_res) { 724184588Sdfr delete_sec_context_res *p = (delete_sec_context_res *) result; 725184588Sdfr gss_release_buffer(&junk, &p->output_token); 726184588Sdfr } else if (xdr_result == (xdrproc_t) xdr_export_sec_context_res) { 727184588Sdfr export_sec_context_res *p = (export_sec_context_res *) result; 728184588Sdfr if (p->interprocess_token.length) 729184588Sdfr memset(p->interprocess_token.value, 0, 730184588Sdfr p->interprocess_token.length); 731184588Sdfr gss_release_buffer(&junk, &p->interprocess_token); 732184588Sdfr } else if (xdr_result == (xdrproc_t) xdr_export_name_res) { 733184588Sdfr export_name_res *p = (export_name_res *) result; 734184588Sdfr gss_release_buffer(&junk, &p->exported_name); 735184588Sdfr } else if (xdr_result == (xdrproc_t) xdr_acquire_cred_res) { 736184588Sdfr acquire_cred_res *p = (acquire_cred_res *) result; 737184588Sdfr gss_release_oid_set(&junk, &p->actual_mechs); 738184588Sdfr } else if (xdr_result == (xdrproc_t) xdr_pname_to_uid_res) { 739184588Sdfr pname_to_uid_res *p = (pname_to_uid_res *) result; 740184588Sdfr if (p->gidlist.gidlist_val) 741184588Sdfr free(p->gidlist.gidlist_val); 742184588Sdfr } else if (xdr_result == (xdrproc_t) xdr_display_status_res) { 743184588Sdfr display_status_res *p = (display_status_res *) result; 744184588Sdfr gss_release_buffer(&junk, &p->status_string); 745184588Sdfr } 746184588Sdfr 747184588Sdfr return (TRUE); 748184588Sdfr} 749244604Srmacklem 750244604Srmacklem/* 751244604Srmacklem * Search a directory for the most likely candidate to be used as the 752244604Srmacklem * credential cache for a uid. If successful, return 1 and fill the 753244604Srmacklem * file's path id into "rpath". Otherwise, return 0. 754244604Srmacklem */ 755244604Srmacklemstatic int 756244604Srmacklemfind_ccache_file(const char *dirpath, uid_t uid, char *rpath) 757244604Srmacklem{ 758244604Srmacklem DIR *dirp; 759244604Srmacklem struct dirent *dp; 760244604Srmacklem struct stat sb; 761244604Srmacklem time_t exptime, oexptime; 762244604Srmacklem int gotone, len, rating, orating; 763244604Srmacklem char namepath[PATH_MAX + 5 + 1]; 764244604Srmacklem char retpath[PATH_MAX + 5 + 1]; 765244604Srmacklem 766244604Srmacklem dirp = opendir(dirpath); 767244604Srmacklem if (dirp == NULL) 768244604Srmacklem return (0); 769244604Srmacklem gotone = 0; 770244604Srmacklem orating = 0; 771244604Srmacklem oexptime = 0; 772244604Srmacklem while ((dp = readdir(dirp)) != NULL) { 773244604Srmacklem len = snprintf(namepath, sizeof(namepath), "%s/%s", dirpath, 774244604Srmacklem dp->d_name); 775244604Srmacklem if (len < sizeof(namepath) && 776244604Srmacklem strstr(dp->d_name, ccfile_substring) != NULL && 777244604Srmacklem lstat(namepath, &sb) >= 0 && 778244604Srmacklem sb.st_uid == uid && 779244604Srmacklem S_ISREG(sb.st_mode)) { 780244604Srmacklem len = snprintf(namepath, sizeof(namepath), "FILE:%s/%s", 781244604Srmacklem dirpath, dp->d_name); 782244604Srmacklem if (len < sizeof(namepath) && 783244604Srmacklem is_a_valid_tgt_cache(namepath, uid, &rating, 784244604Srmacklem &exptime) != 0) { 785244604Srmacklem if (gotone == 0 || rating > orating || 786244604Srmacklem (rating == orating && exptime > oexptime)) { 787244604Srmacklem orating = rating; 788244604Srmacklem oexptime = exptime; 789244604Srmacklem strcpy(retpath, namepath); 790244604Srmacklem gotone = 1; 791244604Srmacklem } 792244604Srmacklem } 793244604Srmacklem } 794244604Srmacklem } 795244604Srmacklem closedir(dirp); 796244604Srmacklem if (gotone != 0) { 797244604Srmacklem strcpy(rpath, retpath); 798244604Srmacklem return (1); 799244604Srmacklem } 800244604Srmacklem return (0); 801244604Srmacklem} 802244604Srmacklem 803244604Srmacklem/* 804244604Srmacklem * Try to determine if the file is a valid tgt cache file. 805244604Srmacklem * Check that the file has a valid tgt for a principal. 806244604Srmacklem * If it does, return 1, otherwise return 0. 807244604Srmacklem * It also returns a "rating" and the expiry time for the TGT, when found. 808244604Srmacklem * This "rating" is higher based on heuristics that make it more 809244604Srmacklem * likely to be the correct credential cache file to use. It can 810244604Srmacklem * be used by the caller, along with expiry time, to select from 811244604Srmacklem * multiple credential cache files. 812244604Srmacklem */ 813244604Srmacklemstatic int 814244604Srmacklemis_a_valid_tgt_cache(const char *filepath, uid_t uid, int *retrating, 815244604Srmacklem time_t *retexptime) 816244604Srmacklem{ 817244604Srmacklem krb5_context context; 818244604Srmacklem krb5_principal princ; 819244604Srmacklem krb5_ccache ccache; 820244604Srmacklem krb5_error_code retval; 821244604Srmacklem krb5_cc_cursor curse; 822244604Srmacklem krb5_creds krbcred; 823244604Srmacklem int gotone, orating, rating, ret; 824244604Srmacklem struct passwd *pw; 825244604Srmacklem char *cp, *cp2, *pname; 826244604Srmacklem time_t exptime; 827244604Srmacklem 828244604Srmacklem /* Find a likely name for the uid principal. */ 829244604Srmacklem pw = getpwuid(uid); 830244604Srmacklem 831244604Srmacklem /* 832244604Srmacklem * Do a bunch of krb5 library stuff to try and determine if 833244604Srmacklem * this file is a credentials cache with an appropriate TGT 834244604Srmacklem * in it. 835244604Srmacklem */ 836244604Srmacklem retval = krb5_init_context(&context); 837244604Srmacklem if (retval != 0) 838244604Srmacklem return (0); 839244604Srmacklem retval = krb5_cc_resolve(context, filepath, &ccache); 840244604Srmacklem if (retval != 0) { 841244604Srmacklem krb5_free_context(context); 842244604Srmacklem return (0); 843244604Srmacklem } 844244604Srmacklem ret = 0; 845244604Srmacklem orating = 0; 846244604Srmacklem exptime = 0; 847244604Srmacklem retval = krb5_cc_start_seq_get(context, ccache, &curse); 848244604Srmacklem if (retval == 0) { 849244604Srmacklem while ((retval = krb5_cc_next_cred(context, ccache, &curse, 850244604Srmacklem &krbcred)) == 0) { 851244604Srmacklem gotone = 0; 852244604Srmacklem rating = 0; 853244604Srmacklem retval = krb5_unparse_name(context, krbcred.server, 854244604Srmacklem &pname); 855244604Srmacklem if (retval == 0) { 856244604Srmacklem cp = strchr(pname, '/'); 857244604Srmacklem if (cp != NULL) { 858244604Srmacklem *cp++ = '\0'; 859244604Srmacklem if (strcmp(pname, "krbtgt") == 0 && 860244604Srmacklem krbcred.times.endtime > time(NULL) 861244604Srmacklem ) { 862244604Srmacklem gotone = 1; 863244604Srmacklem /* 864244604Srmacklem * Test to see if this is a 865244604Srmacklem * tgt for cross-realm auth. 866244604Srmacklem * Rate it higher, if it is not. 867244604Srmacklem */ 868244604Srmacklem cp2 = strchr(cp, '@'); 869244604Srmacklem if (cp2 != NULL) { 870244604Srmacklem *cp2++ = '\0'; 871244604Srmacklem if (strcmp(cp, cp2) == 872244604Srmacklem 0) 873244604Srmacklem rating++; 874244604Srmacklem } 875244604Srmacklem } 876244604Srmacklem } 877244604Srmacklem free(pname); 878244604Srmacklem } 879244604Srmacklem if (gotone != 0) { 880244604Srmacklem retval = krb5_unparse_name(context, 881244604Srmacklem krbcred.client, &pname); 882244604Srmacklem if (retval == 0) { 883244604Srmacklem cp = strchr(pname, '@'); 884244604Srmacklem if (cp != NULL) { 885244604Srmacklem *cp++ = '\0'; 886244604Srmacklem if (pw != NULL && strcmp(pname, 887244604Srmacklem pw->pw_name) == 0) 888244604Srmacklem rating++; 889244604Srmacklem if (strchr(pname, '/') == NULL) 890244604Srmacklem rating++; 891244604Srmacklem if (pref_realm[0] != '\0' && 892244604Srmacklem strcmp(cp, pref_realm) == 0) 893244604Srmacklem rating++; 894244604Srmacklem } 895244604Srmacklem } 896244604Srmacklem free(pname); 897244604Srmacklem if (rating > orating) { 898244604Srmacklem orating = rating; 899244604Srmacklem exptime = krbcred.times.endtime; 900244604Srmacklem } else if (rating == orating && 901244604Srmacklem krbcred.times.endtime > exptime) 902244604Srmacklem exptime = krbcred.times.endtime; 903244604Srmacklem ret = 1; 904244604Srmacklem } 905244604Srmacklem krb5_free_cred_contents(context, &krbcred); 906244604Srmacklem } 907244604Srmacklem krb5_cc_end_seq_get(context, ccache, &curse); 908244604Srmacklem } 909244604Srmacklem krb5_cc_close(context, ccache); 910244604Srmacklem krb5_free_context(context); 911244604Srmacklem if (ret != 0) { 912244604Srmacklem *retrating = orating; 913244604Srmacklem *retexptime = exptime; 914244604Srmacklem } 915244604Srmacklem return (ret); 916244604Srmacklem} 917244604Srmacklem 918