4 Copyright (c) 2000-2004 The Regents of the University of Michigan.
7 Copyright (c) 2000 Dug Song <dugsong@UMICH.EDU>.
8 Copyright (c) 2001 Andy Adamson <andros@UMICH.EDU>.
9 Copyright (c) 2002 Marius Aamodt Eriksen <marius@UMICH.EDU>.
10 Copyright (c) 2002 Bruce Fields <bfields@UMICH.EDU>
11 Copyright (c) 2004 Kevin Coffman <kwc@umich.edu>
12 All rights reserved, all wrongs reversed.
14 Redistribution and use in source and binary forms, with or without
15 modification, are permitted provided that the following conditions
18 1. Redistributions of source code must retain the above copyright
19 notice, this list of conditions and the following disclaimer.
20 2. Redistributions in binary form must reproduce the above copyright
21 notice, this list of conditions and the following disclaimer in the
22 documentation and/or other materials provided with the distribution.
23 3. Neither the name of the University nor the names of its
24 contributors may be used to endorse or promote products derived
25 from this software without specific prior written permission.
27 THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
28 WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
29 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
30 DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
31 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
34 BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
35 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
36 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
37 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
43 #endif /* HAVE_CONFIG_H */
49 #include <sys/param.h>
52 #include <sys/socket.h>
53 #include <arpa/inet.h>
54 #include <sys/fsuid.h>
67 #include <gssapi/gssapi.h>
73 #include "krb5_util.h"
80 * array of struct pollfd suitable to pass to poll. initialized to
81 * zero - a zero struct is ignored by poll() because the events mask is 0.
84 * linked list of struct clnt_info which associates a clntXXX directory
85 * with an index into pollarray[], and other basic data about that client.
87 * Directory structure: created by the kernel
88 * {rpc_pipefs}/{dir}/clntXX : one per rpc_clnt struct in the kernel
89 * {rpc_pipefs}/{dir}/clntXX/krb5 : read uid for which kernel wants
90 * a context, write the resulting context
91 * {rpc_pipefs}/{dir}/clntXX/info : stores info such as server name
92 * {rpc_pipefs}/{dir}/clntXX/gssd : pipe for all gss mechanisms using
93 * a text-based string of parameters
96 * Poll all {rpc_pipefs}/{dir}/clntXX/YYYY files. When data is ready,
97 * read and process; performs rpcsec_gss context initialization protocol to
98 * get a cred for that user. Writes result to corresponding krb5 file
99 * in a form the kernel code will understand.
100 * In addition, we make sure we are notified whenever anything is
101 * created or destroyed in {rpc_pipefs} or in any of the clntXX directories,
102 * and rescan the whole {rpc_pipefs} when this happens.
105 struct pollfd * pollarray;
107 int pollsize; /* the size of pollaray (in pollfd's) */
110 * convert a presentation address string to a sockaddr_storage struct. Returns
111 * true on success or false on failure.
113 * Note that we do not populate the sin6_scope_id field here for IPv6 addrs.
114 * gssd nececessarily relies on hostname resolution and DNS AAAA records
115 * do not generally contain scope-id's. This means that GSSAPI auth really
116 * can't work with IPv6 link-local addresses.
118 * We *could* consider changing this if we did something like adopt the
119 * Microsoft "standard" of using the ipv6-literal.net domainname, but it's
120 * not really feasible at present.
123 addrstr_to_sockaddr(struct sockaddr *sa, const char *node, const char *port)
126 struct addrinfo *res;
127 struct addrinfo hints = { .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV };
129 #ifndef IPV6_SUPPORTED
130 hints.ai_family = AF_INET;
131 #endif /* IPV6_SUPPORTED */
133 rc = getaddrinfo(node, port, &hints, &res);
135 printerr(0, "ERROR: unable to convert %s|%s to sockaddr: %s\n",
136 node, port, rc == EAI_SYSTEM ? strerror(errno) :
141 #ifdef IPV6_SUPPORTED
143 * getnameinfo ignores the scopeid. If the address turns out to have
144 * a non-zero scopeid, we can't use it -- the resolved host might be
145 * completely different from the one intended.
147 if (res->ai_addr->sa_family == AF_INET6) {
148 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)res->ai_addr;
149 if (sin6->sin6_scope_id) {
150 printerr(0, "ERROR: address %s has non-zero "
151 "sin6_scope_id!\n", node);
156 #endif /* IPV6_SUPPORTED */
158 memcpy(sa, res->ai_addr, res->ai_addrlen);
164 * convert a sockaddr to a hostname
167 sockaddr_to_hostname(const struct sockaddr *sa, const char *addr)
172 char hbuf[NI_MAXHOST];
174 switch (sa->sa_family) {
176 addrlen = sizeof(struct sockaddr_in);
178 #ifdef IPV6_SUPPORTED
180 addrlen = sizeof(struct sockaddr_in6);
182 #endif /* IPV6_SUPPORTED */
184 printerr(0, "ERROR: unrecognized addr family %d\n",
189 err = getnameinfo(sa, addrlen, hbuf, sizeof(hbuf), NULL, 0,
192 printerr(0, "ERROR: unable to resolve %s to hostname: %s\n",
193 addr, err == EAI_SYSTEM ? strerror(err) :
198 hostname = strdup(hbuf);
203 /* XXX buffer problems: */
205 read_service_info(char *info_file_name, char **servicename, char **servername,
206 int *prog, int *vers, char **protocol,
207 struct sockaddr *addr) {
208 #define INFOBUFLEN 256
209 char buf[INFOBUFLEN + 1];
210 static char dummy[128];
212 static char service[128];
213 static char address[128];
222 *servicename = *servername = *protocol = NULL;
224 if ((fd = open(info_file_name, O_RDONLY)) == -1) {
225 printerr(0, "ERROR: can't open %s: %s\n", info_file_name,
229 if ((nbytes = read(fd, buf, INFOBUFLEN)) == -1)
234 numfields = sscanf(buf,"RPC server: %127s\n"
235 "service: %127s %15s version %15s\n"
239 service, program, version,
243 if (numfields == 5) {
244 strcpy(protoname, "tcp");
245 } else if (numfields != 6) {
250 if ((p = strstr(buf, "port")) != NULL)
251 sscanf(p, "port: %127s\n", port);
253 /* check service, program, and version */
254 if (memcmp(service, "nfs", 3) != 0)
256 *prog = atoi(program + 1); /* skip open paren */
257 *vers = atoi(version);
259 if (strlen(service) == 3 ) {
260 if ((*prog != 100003) || ((*vers != 2) && (*vers != 3) &&
263 } else if (memcmp(service, "nfs4_cb", 7) == 0) {
268 if (!addrstr_to_sockaddr(addr, address, port))
271 *servername = sockaddr_to_hostname(addr, address);
272 if (*servername == NULL)
275 nbytes = snprintf(buf, INFOBUFLEN, "%s@%s", service, *servername);
276 if (nbytes > INFOBUFLEN)
279 if (!(*servicename = calloc(strlen(buf) + 1, 1)))
281 memcpy(*servicename, buf, strlen(buf));
283 if (!(*protocol = strdup(protoname)))
287 printerr(0, "ERROR: failed to read service info\n");
288 if (fd != -1) close(fd);
292 *servicename = *servername = *protocol = NULL;
297 destroy_client(struct clnt_info *clp)
299 if (clp->krb5_poll_index != -1)
300 memset(&pollarray[clp->krb5_poll_index], 0,
301 sizeof(struct pollfd));
302 if (clp->gssd_poll_index != -1)
303 memset(&pollarray[clp->gssd_poll_index], 0,
304 sizeof(struct pollfd));
305 if (clp->dir_fd != -1) close(clp->dir_fd);
306 if (clp->krb5_fd != -1) close(clp->krb5_fd);
307 if (clp->gssd_fd != -1) close(clp->gssd_fd);
309 free(clp->servicename);
310 free(clp->servername);
315 static struct clnt_info *
316 insert_new_clnt(void)
318 struct clnt_info *clp = NULL;
320 if (!(clp = (struct clnt_info *)calloc(1,sizeof(struct clnt_info)))) {
321 printerr(0, "ERROR: can't malloc clnt_info: %s\n",
325 clp->krb5_poll_index = -1;
326 clp->gssd_poll_index = -1;
331 TAILQ_INSERT_HEAD(&clnt_list, clp, list);
337 process_clnt_dir_files(struct clnt_info * clp)
340 char gname[PATH_MAX];
341 char info_file_name[PATH_MAX];
343 if (clp->gssd_fd == -1) {
344 snprintf(gname, sizeof(gname), "%s/gssd", clp->dirname);
345 clp->gssd_fd = open(gname, O_RDWR);
347 if (clp->gssd_fd == -1) {
348 if (clp->krb5_fd == -1) {
349 snprintf(name, sizeof(name), "%s/krb5", clp->dirname);
350 clp->krb5_fd = open(name, O_RDWR);
353 /* If we opened a gss-specific pipe, let's try opening
354 * the new upcall pipe again. If we succeed, close
355 * gss-specific pipe(s).
357 if (clp->krb5_fd != -1) {
358 clp->gssd_fd = open(gname, O_RDWR);
359 if (clp->gssd_fd != -1) {
360 if (clp->krb5_fd != -1)
367 if ((clp->krb5_fd == -1) && (clp->gssd_fd == -1))
369 snprintf(info_file_name, sizeof(info_file_name), "%s/info",
371 if ((clp->servicename == NULL) &&
372 read_service_info(info_file_name, &clp->servicename,
373 &clp->servername, &clp->prog, &clp->vers,
374 &clp->protocol, (struct sockaddr *) &clp->addr))
380 get_poll_index(int *ind)
385 for (i=0; i<FD_ALLOC_BLOCK; i++) {
386 if (pollarray[i].events == 0) {
392 printerr(0, "ERROR: No pollarray slots open\n");
400 insert_clnt_poll(struct clnt_info *clp)
402 if ((clp->gssd_fd != -1) && (clp->gssd_poll_index == -1)) {
403 if (get_poll_index(&clp->gssd_poll_index)) {
404 printerr(0, "ERROR: Too many gssd clients\n");
407 pollarray[clp->gssd_poll_index].fd = clp->gssd_fd;
408 pollarray[clp->gssd_poll_index].events |= POLLIN;
411 if ((clp->krb5_fd != -1) && (clp->krb5_poll_index == -1)) {
412 if (get_poll_index(&clp->krb5_poll_index)) {
413 printerr(0, "ERROR: Too many krb5 clients\n");
416 pollarray[clp->krb5_poll_index].fd = clp->krb5_fd;
417 pollarray[clp->krb5_poll_index].events |= POLLIN;
424 process_clnt_dir(char *dir, char *pdir)
426 struct clnt_info * clp;
428 if (!(clp = insert_new_clnt()))
429 goto fail_destroy_client;
431 /* An extra for the '/', and an extra for the null */
432 if (!(clp->dirname = calloc(strlen(dir) + strlen(pdir) + 2, 1))) {
433 goto fail_destroy_client;
435 sprintf(clp->dirname, "%s/%s", pdir, dir);
436 if ((clp->dir_fd = open(clp->dirname, O_RDONLY)) == -1) {
437 printerr(0, "ERROR: can't open %s: %s\n",
438 clp->dirname, strerror(errno));
439 goto fail_destroy_client;
441 fcntl(clp->dir_fd, F_SETSIG, DNOTIFY_SIGNAL);
442 fcntl(clp->dir_fd, F_NOTIFY, DN_CREATE | DN_DELETE | DN_MULTISHOT);
444 if (process_clnt_dir_files(clp))
445 goto fail_keep_client;
447 if (insert_clnt_poll(clp))
448 goto fail_destroy_client;
454 TAILQ_REMOVE(&clnt_list, clp, list);
458 /* We couldn't find some subdirectories, but we keep the client
459 * around in case we get a notification on the directory when the
460 * subdirectories are created. */
465 init_client_list(void)
467 TAILQ_INIT(&clnt_list);
468 /* Eventually plan to grow/shrink poll array: */
469 pollsize = FD_ALLOC_BLOCK;
470 pollarray = calloc(pollsize, sizeof(struct pollfd));
474 * This is run after a DNOTIFY signal, and should clear up any
475 * directories that are no longer around, and re-scan any existing
476 * directories, since the DNOTIFY could have been in there.
479 update_old_clients(struct dirent **namelist, int size, char *pdir)
481 struct clnt_info *clp;
484 char fname[PATH_MAX];
486 for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
487 /* only compare entries in the global list that are from the
488 * same pipefs parent directory as "pdir"
490 if (strncmp(clp->dirname, pdir, strlen(pdir)) != 0) continue;
493 for (i=0; i < size; i++) {
494 snprintf(fname, sizeof(fname), "%s/%s",
495 pdir, namelist[i]->d_name);
496 if (strcmp(clp->dirname, fname) == 0) {
502 printerr(2, "destroying client %s\n", clp->dirname);
503 saveprev = clp->list.tqe_prev;
504 TAILQ_REMOVE(&clnt_list, clp, list);
509 for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
510 if (!process_clnt_dir_files(clp))
511 insert_clnt_poll(clp);
515 /* Search for a client by directory name, return 1 if found, 0 otherwise */
517 find_client(char *dirname, char *pdir)
519 struct clnt_info *clp;
520 char fname[PATH_MAX];
522 for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
523 snprintf(fname, sizeof(fname), "%s/%s", pdir, dirname);
524 if (strcmp(clp->dirname, fname) == 0)
531 process_pipedir(char *pipe_name)
533 struct dirent **namelist;
536 if (chdir(pipe_name) < 0) {
537 printerr(0, "ERROR: can't chdir to %s: %s\n",
538 pipe_name, strerror(errno));
542 j = scandir(pipe_name, &namelist, NULL, alphasort);
544 printerr(0, "ERROR: can't scandir %s: %s\n",
545 pipe_name, strerror(errno));
549 update_old_clients(namelist, j, pipe_name);
550 for (i=0; i < j; i++) {
551 if (i < FD_ALLOC_BLOCK
552 && !strncmp(namelist[i]->d_name, "clnt", 4)
553 && !find_client(namelist[i]->d_name, pipe_name))
554 process_clnt_dir(namelist[i]->d_name, pipe_name);
563 /* Used to read (and re-read) list of clients, set up poll array. */
565 update_client_list(void)
568 struct topdirs_info *tdi;
570 TAILQ_FOREACH(tdi, &topdirs_list, list) {
571 retval = process_pipedir(tdi->dirname);
573 printerr(1, "WARNING: error processing %s\n",
580 /* Encryption types supported by the kernel rpcsec_gss code */
581 int num_krb5_enctypes = 0;
582 krb5_enctype *krb5_enctypes = NULL;
585 * Parse the supported encryption type information
588 parse_enctypes(char *enctypes)
593 static char *cached_types;
595 if (cached_types && strcmp(cached_types, enctypes) == 0)
599 if (krb5_enctypes != NULL) {
601 krb5_enctypes = NULL;
602 num_krb5_enctypes = 0;
605 /* count the number of commas */
606 for (curr = enctypes; curr && *curr != '\0'; curr = ++comma) {
607 comma = strchr(curr, ',');
613 /* If no more commas and we're not at the end, there's one more value */
617 /* Empty string, return an error */
621 /* Allocate space for enctypes array */
622 if ((krb5_enctypes = (int *) calloc(n, sizeof(int))) == NULL) {
626 /* Now parse each value into the array */
627 for (curr = enctypes, i = 0; curr && *curr != '\0'; curr = ++comma) {
628 krb5_enctypes[i++] = atoi(curr);
629 comma = strchr(curr, ',');
634 num_krb5_enctypes = n;
635 if ((cached_types = malloc(strlen(enctypes)+1)))
636 strcpy(cached_types, enctypes);
642 do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,
643 gss_buffer_desc *context_token)
645 char *buf = NULL, *p = NULL, *end = NULL;
646 unsigned int timeout = context_timeout;
647 unsigned int buf_size = 0;
649 printerr(1, "doing downcall\n");
650 buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) +
651 sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length +
652 sizeof(context_token->length) + context_token->length;
653 p = buf = malloc(buf_size);
654 end = buf + buf_size;
656 if (WRITE_BYTES(&p, end, uid)) goto out_err;
657 if (WRITE_BYTES(&p, end, timeout)) goto out_err;
658 if (WRITE_BYTES(&p, end, pd->pd_seq_win)) goto out_err;
659 if (write_buffer(&p, end, &pd->pd_ctx_hndl)) goto out_err;
660 if (write_buffer(&p, end, context_token)) goto out_err;
662 if (write(k5_fd, buf, p - buf) < p - buf) goto out_err;
667 printerr(1, "Failed to write downcall!\n");
672 do_error_downcall(int k5_fd, uid_t uid, int err)
675 char *p = buf, *end = buf + 1024;
676 unsigned int timeout = 0;
679 printerr(2, "doing error downcall\n");
681 if (WRITE_BYTES(&p, end, uid)) goto out_err;
682 if (WRITE_BYTES(&p, end, timeout)) goto out_err;
683 /* use seq_win = 0 to indicate an error: */
684 if (WRITE_BYTES(&p, end, zero)) goto out_err;
685 if (WRITE_BYTES(&p, end, err)) goto out_err;
687 if (write(k5_fd, buf, p - buf) < p - buf) goto out_err;
690 printerr(1, "Failed to write error downcall!\n");
695 * If the port isn't already set, do an rpcbind query to the remote server
696 * using the program and version and get the port.
698 * Newer kernels send the value of the port= mount option in the "info"
699 * file for the upcall or '0' for NFSv2/3. For NFSv4 it sends the value
700 * of the port= option or '2049'. The port field in a new sockaddr should
701 * reflect the value that was sent by the kernel.
704 populate_port(struct sockaddr *sa, const socklen_t salen,
705 const rpcprog_t program, const rpcvers_t version,
706 const unsigned short protocol)
708 struct sockaddr_in *s4 = (struct sockaddr_in *) sa;
709 #ifdef IPV6_SUPPORTED
710 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) sa;
711 #endif /* IPV6_SUPPORTED */
715 * Newer kernels send the port in the upcall. If we already have
716 * the port, there's no need to look it up.
718 switch (sa->sa_family) {
720 if (s4->sin_port != 0) {
721 printerr(2, "DEBUG: port already set to %d\n",
722 ntohs(s4->sin_port));
726 #ifdef IPV6_SUPPORTED
728 if (s6->sin6_port != 0) {
729 printerr(2, "DEBUG: port already set to %d\n",
730 ntohs(s6->sin6_port));
734 #endif /* IPV6_SUPPORTED */
736 printerr(0, "ERROR: unsupported address family %d\n",
742 * Newer kernels that send the port in the upcall set the value to
743 * 2049 for NFSv4 mounts when one isn't specified. The check below is
744 * only for kernels that don't send the port in the upcall. For those
745 * we either have to do an rpcbind query or set it to the standard
746 * port. Doing a query could be problematic (firewalls, etc), so take
747 * the latter approach.
749 if (program == 100003 && version == 4) {
754 port = nfs_getport(sa, salen, program, version, protocol);
756 printerr(0, "ERROR: unable to obtain port for prog %ld "
757 "vers %ld\n", program, version);
762 printerr(2, "DEBUG: setting port to %hu for prog %lu vers %lu\n", port,
765 switch (sa->sa_family) {
767 s4->sin_port = htons(port);
769 #ifdef IPV6_SUPPORTED
771 s6->sin6_port = htons(port);
773 #endif /* IPV6_SUPPORTED */
780 * Create an RPC connection and establish an authenticated
781 * gss context with a server.
783 int create_auth_rpc_client(struct clnt_info *clp,
784 CLIENT **clnt_return,
789 CLIENT *rpc_clnt = NULL;
790 struct rpc_gss_sec sec;
795 char rpc_errmsg[1024];
797 struct timeval timeout = {5, 0};
798 struct sockaddr *addr = (struct sockaddr *) &clp->addr;
801 /* Create the context as the user (not as root) */
802 save_uid = geteuid();
803 if (setfsuid(uid) != 0) {
804 printerr(0, "WARNING: Failed to setfsuid for "
805 "user with uid %d\n", uid);
808 printerr(2, "creating context using fsuid %d (save_uid %d)\n",
811 sec.qop = GSS_C_QOP_DEFAULT;
812 sec.svc = RPCSEC_GSS_SVC_NONE;
813 sec.cred = GSS_C_NO_CREDENTIAL;
815 if (authtype == AUTHTYPE_KRB5) {
816 sec.mech = (gss_OID)&krb5oid;
817 sec.req_flags = GSS_C_MUTUAL_FLAG;
820 printerr(0, "ERROR: Invalid authentication type (%d) "
821 "in create_auth_rpc_client\n", authtype);
826 if (authtype == AUTHTYPE_KRB5) {
827 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES
829 * Do this before creating rpc connection since we won't need
830 * rpc connection if it fails!
832 if (limit_krb5_enctypes(&sec)) {
833 printerr(1, "WARNING: Failed while limiting krb5 "
834 "encryption types for user with uid %d\n",
841 /* create an rpc connection to the nfs server */
843 printerr(2, "creating %s client for server %s\n", clp->protocol,
846 if ((strcmp(clp->protocol, "tcp")) == 0) {
847 protocol = IPPROTO_TCP;
848 } else if ((strcmp(clp->protocol, "udp")) == 0) {
849 protocol = IPPROTO_UDP;
851 printerr(0, "WARNING: unrecognized protocol, '%s', requested "
852 "for connection to server %s for user with uid %d\n",
853 clp->protocol, clp->servername, uid);
857 switch (addr->sa_family) {
859 salen = sizeof(struct sockaddr_in);
861 #ifdef IPV6_SUPPORTED
863 salen = sizeof(struct sockaddr_in6);
865 #endif /* IPV6_SUPPORTED */
867 printerr(1, "ERROR: Unknown address family %d\n",
872 if (!populate_port(addr, salen, clp->prog, clp->vers, protocol))
875 rpc_clnt = nfs_get_rpcclient(addr, salen, protocol, clp->prog,
876 clp->vers, &timeout);
878 snprintf(rpc_errmsg, sizeof(rpc_errmsg),
879 "WARNING: can't create %s rpc_clnt to server %s for "
881 protocol == IPPROTO_TCP ? "tcp" : "udp",
882 clp->servername, uid);
884 clnt_spcreateerror(rpc_errmsg));
888 printerr(2, "creating context with server %s\n", clp->servicename);
889 auth = authgss_create_default(rpc_clnt, clp->servicename, &sec);
891 /* Our caller should print appropriate message */
892 printerr(2, "WARNING: Failed to create krb5 context for "
893 "user with uid %d for server %s\n",
894 uid, clp->servername);
899 rpc_clnt->cl_auth = auth;
900 *clnt_return = rpc_clnt;
905 if (sec.cred != GSS_C_NO_CREDENTIAL)
906 gss_release_cred(&min_stat, &sec.cred);
907 /* Restore euid to original value */
908 if (((int)save_uid != -1) && (setfsuid(save_uid) != (int)uid)) {
909 printerr(0, "WARNING: Failed to restore fsuid"
910 " to uid %d from %d\n", save_uid, uid);
915 /* Only destroy here if failure. Otherwise, caller is responsible */
916 if (rpc_clnt) clnt_destroy(rpc_clnt);
922 user_cachedir(char *dirname, uid_t uid)
927 if ((pw = getpwuid(uid)) == NULL) {
928 printerr(0, "user_cachedir: Failed to find '%d' uid"
929 " for cache directory\n");
932 ptr = malloc(strlen(dirname)+strlen(pw->pw_name)+2);
934 sprintf(ptr, "%s/%s", dirname, pw->pw_name);
939 * this code uses the userland rpcsec gss library to create a krb5
940 * context on behalf of the kernel
943 process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
946 CLIENT *rpc_clnt = NULL;
948 struct authgss_private_data pd;
949 gss_buffer_desc token;
950 char **credlist = NULL;
952 char **dirname, *dir, *userdir;
953 int create_resp = -1;
954 int err, downcall_err = -EACCES;
956 printerr(2, "handling krb5 upcall (%s)\n", clp->dirname);
959 if (clp->servicename) {
960 free(clp->servicename);
961 clp->servicename = strdup(tgtname);
966 memset(&pd, 0, sizeof(struct authgss_private_data));
969 * If "service" is specified, then the kernel is indicating that
970 * we must use machine credentials for this request. (Regardless
971 * of the uid value or the setting of root_uses_machine_creds.)
972 * If the service value is "*", then any service name can be used.
973 * Otherwise, it specifies the service name that should be used.
974 * (For now, the values of service will only be "*" or "nfs".)
976 * Restricting gssd to use "nfs" service name is needed for when
977 * the NFS server is doing a callback to the NFS client. In this
978 * case, the NFS server has to authenticate itself as "nfs" --
979 * even if there are other service keys such as "host" or "root"
982 * Another case when the kernel may specify the service attribute
983 * is when gssd is being asked to create the context for a
984 * SETCLIENT_ID operation. In this case, machine credentials
985 * must be used for the authentication. However, the service name
986 * used for this case is not important.
989 printerr(2, "%s: service is '%s'\n", __func__,
990 service ? service : "<null>");
991 if (uid != 0 || (uid == 0 && root_uses_machine_creds == 0 &&
993 /* Tell krb5 gss which credentials cache to use */
994 for (dirname = ccachesearch; *dirname != NULL; dirname++) {
995 /* See if the user name is needed */
996 if (strncmp(*dirname, GSSD_USER_CRED_DIR,
997 strlen(GSSD_USER_CRED_DIR)) == 0) {
998 userdir = user_cachedir(*dirname, uid);
1005 err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, dir);
1011 if (err == -EKEYEXPIRED)
1012 downcall_err = -EKEYEXPIRED;
1014 create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,
1016 if (create_resp == 0)
1020 if (create_resp != 0) {
1021 if (uid == 0 && (root_uses_machine_creds == 1 ||
1026 gssd_refresh_krb5_machine_credential(clp->servername,
1029 * Get a list of credential cache names and try each
1030 * of them until one works or we've tried them all
1032 if (gssd_get_krb5_machine_cred_list(&credlist)) {
1033 printerr(0, "ERROR: No credentials found "
1034 "for connection to server %s\n",
1036 goto out_return_error;
1038 for (ccname = credlist; ccname && *ccname; ccname++) {
1039 gssd_setup_krb5_machine_gss_ccache(*ccname);
1040 if ((create_auth_rpc_client(clp, &rpc_clnt,
1042 AUTHTYPE_KRB5)) == 0) {
1047 printerr(2, "WARNING: Failed to create machine krb5 context "
1048 "with credentials cache %s for server %s\n",
1049 *ccname, clp->servername);
1051 gssd_free_krb5_machine_cred_list(credlist);
1055 printerr(2, "WARNING: Machine cache is prematurely expired or corrupted "
1056 "trying to recreate cache for server %s\n", clp->servername);
1058 printerr(1, "WARNING: Failed to create machine krb5 context "
1059 "with any credentials cache for server %s\n",
1061 goto out_return_error;
1066 printerr(1, "WARNING: Failed to create krb5 context "
1067 "for user with uid %d for server %s\n",
1068 uid, clp->servername);
1069 goto out_return_error;
1073 if (!authgss_get_private_data(auth, &pd)) {
1074 printerr(2, "WARNING: Failed to obtain authentication "
1075 "data for user with uid %d for server %s\n",
1076 uid, clp->servername);
1077 goto out_return_error;
1080 if (serialize_context_for_kernel(pd.pd_ctx, &token, &krb5oid, NULL)) {
1081 printerr(0, "WARNING: Failed to serialize krb5 context for "
1082 "user with uid %d for server %s\n",
1083 uid, clp->servername);
1084 goto out_return_error;
1087 do_downcall(fd, uid, &pd, &token);
1092 #ifndef HAVE_LIBTIRPC
1093 if (pd.pd_ctx_hndl.length != 0)
1094 authgss_free_private_data(&pd);
1099 clnt_destroy(rpc_clnt);
1103 do_error_downcall(fd, uid, downcall_err);
1108 handle_krb5_upcall(struct clnt_info *clp)
1112 if (read(clp->krb5_fd, &uid, sizeof(uid)) < (ssize_t)sizeof(uid)) {
1113 printerr(0, "WARNING: failed reading uid from krb5 "
1114 "upcall pipe: %s\n", strerror(errno));
1118 return process_krb5_upcall(clp, uid, clp->krb5_fd, NULL, NULL);
1122 handle_gssd_upcall(struct clnt_info *clp)
1129 char *target = NULL;
1130 char *service = NULL;
1131 char *enctypes = NULL;
1133 printerr(1, "handling gssd upcall (%s)\n", clp->dirname);
1135 if (readline(clp->gssd_fd, &lbuf, &lbuflen) != 1) {
1136 printerr(0, "WARNING: handle_gssd_upcall: "
1137 "failed reading request\n");
1140 printerr(2, "%s: '%s'\n", __func__, lbuf);
1142 /* find the mechanism name */
1143 if ((p = strstr(lbuf, "mech=")) != NULL) {
1144 mech = malloc(lbuflen);
1147 if (sscanf(p, "mech=%s", mech) != 1) {
1148 printerr(0, "WARNING: handle_gssd_upcall: "
1149 "failed to parse gss mechanism name "
1150 "in upcall string '%s'\n", lbuf);
1154 printerr(0, "WARNING: handle_gssd_upcall: "
1155 "failed to find gss mechanism name "
1156 "in upcall string '%s'\n", lbuf);
1161 if ((p = strstr(lbuf, "uid=")) != NULL) {
1162 if (sscanf(p, "uid=%d", &uid) != 1) {
1163 printerr(0, "WARNING: handle_gssd_upcall: "
1164 "failed to parse uid "
1165 "in upcall string '%s'\n", lbuf);
1169 printerr(0, "WARNING: handle_gssd_upcall: "
1170 "failed to find uid "
1171 "in upcall string '%s'\n", lbuf);
1175 /* read supported encryption types if supplied */
1176 if ((p = strstr(lbuf, "enctypes=")) != NULL) {
1177 enctypes = malloc(lbuflen);
1180 if (sscanf(p, "enctypes=%s", enctypes) != 1) {
1181 printerr(0, "WARNING: handle_gssd_upcall: "
1182 "failed to parse encryption types "
1183 "in upcall string '%s'\n", lbuf);
1186 if (parse_enctypes(enctypes) != 0) {
1187 printerr(0, "WARNING: handle_gssd_upcall: "
1188 "parsing encryption types failed: errno %d\n", errno);
1192 /* read target name */
1193 if ((p = strstr(lbuf, "target=")) != NULL) {
1194 target = malloc(lbuflen);
1197 if (sscanf(p, "target=%s", target) != 1) {
1198 printerr(0, "WARNING: handle_gssd_upcall: "
1199 "failed to parse target name "
1200 "in upcall string '%s'\n", lbuf);
1206 * read the service name
1208 * The presence of attribute "service=" indicates that machine
1209 * credentials should be used for this request. If the value
1210 * is "*", then any machine credentials available can be used.
1211 * If the value is anything else, then machine credentials for
1212 * the specified service name (always "nfs" for now) should be
1215 if ((p = strstr(lbuf, "service=")) != NULL) {
1216 service = malloc(lbuflen);
1219 if (sscanf(p, "service=%s", service) != 1) {
1220 printerr(0, "WARNING: handle_gssd_upcall: "
1221 "failed to parse service type "
1222 "in upcall string '%s'\n", lbuf);
1227 if (strcmp(mech, "krb5") == 0)
1228 process_krb5_upcall(clp, uid, clp->gssd_fd, target, service);
1230 printerr(0, "WARNING: handle_gssd_upcall: "
1231 "received unknown gss mech '%s'\n", mech);