4 Copyright (c) 2000-2004 The Regents of the University of Michigan.
7 Copyright (c) 2000 Dug Song <dugsong@UMICH.EDU>.
8 Copyright (c) 2001 Andy Adamson <andros@UMICH.EDU>.
9 Copyright (c) 2002 Marius Aamodt Eriksen <marius@UMICH.EDU>.
10 Copyright (c) 2002 Bruce Fields <bfields@UMICH.EDU>
11 Copyright (c) 2004 Kevin Coffman <kwc@umich.edu>
12 All rights reserved, all wrongs reversed.
14 Redistribution and use in source and binary forms, with or without
15 modification, are permitted provided that the following conditions
18 1. Redistributions of source code must retain the above copyright
19 notice, this list of conditions and the following disclaimer.
20 2. Redistributions in binary form must reproduce the above copyright
21 notice, this list of conditions and the following disclaimer in the
22 documentation and/or other materials provided with the distribution.
23 3. Neither the name of the University nor the names of its
24 contributors may be used to endorse or promote products derived
25 from this software without specific prior written permission.
27 THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
28 WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
29 MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
30 DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
31 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
34 BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
35 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
36 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
37 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
43 #endif /* HAVE_CONFIG_H */
49 #include <sys/param.h>
52 #include <sys/socket.h>
53 #include <arpa/inet.h>
54 #include <sys/fsuid.h>
67 #include <gssapi/gssapi.h>
73 #include "krb5_util.h"
80 * array of struct pollfd suitable to pass to poll. initialized to
81 * zero - a zero struct is ignored by poll() because the events mask is 0.
84 * linked list of struct clnt_info which associates a clntXXX directory
85 * with an index into pollarray[], and other basic data about that client.
87 * Directory structure: created by the kernel
88 * {rpc_pipefs}/{dir}/clntXX : one per rpc_clnt struct in the kernel
89 * {rpc_pipefs}/{dir}/clntXX/krb5 : read uid for which kernel wants
90 * a context, write the resulting context
91 * {rpc_pipefs}/{dir}/clntXX/info : stores info such as server name
92 * {rpc_pipefs}/{dir}/clntXX/gssd : pipe for all gss mechanisms using
93 * a text-based string of parameters
96 * Poll all {rpc_pipefs}/{dir}/clntXX/YYYY files. When data is ready,
97 * read and process; performs rpcsec_gss context initialization protocol to
98 * get a cred for that user. Writes result to corresponding krb5 file
99 * in a form the kernel code will understand.
100 * In addition, we make sure we are notified whenever anything is
101 * created or destroyed in {rpc_pipefs} or in any of the clntXX directories,
102 * and rescan the whole {rpc_pipefs} when this happens.
105 struct pollfd * pollarray;
107 int pollsize; /* the size of pollaray (in pollfd's) */
110 * convert a presentation address string to a sockaddr_storage struct. Returns
111 * true on success or false on failure.
113 * Note that we do not populate the sin6_scope_id field here for IPv6 addrs.
114 * gssd nececessarily relies on hostname resolution and DNS AAAA records
115 * do not generally contain scope-id's. This means that GSSAPI auth really
116 * can't work with IPv6 link-local addresses.
118 * We *could* consider changing this if we did something like adopt the
119 * Microsoft "standard" of using the ipv6-literal.net domainname, but it's
120 * not really feasible at present.
123 addrstr_to_sockaddr(struct sockaddr *sa, const char *node, const char *port)
126 struct addrinfo *res;
127 struct addrinfo hints = { .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV };
129 #ifndef IPV6_SUPPORTED
130 hints.ai_family = AF_INET;
131 #endif /* IPV6_SUPPORTED */
133 rc = getaddrinfo(node, port, &hints, &res);
135 printerr(0, "ERROR: unable to convert %s|%s to sockaddr: %s\n",
136 node, port, rc == EAI_SYSTEM ? strerror(errno) :
141 #ifdef IPV6_SUPPORTED
143 * getnameinfo ignores the scopeid. If the address turns out to have
144 * a non-zero scopeid, we can't use it -- the resolved host might be
145 * completely different from the one intended.
147 if (res->ai_addr->sa_family == AF_INET6) {
148 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)res->ai_addr;
149 if (sin6->sin6_scope_id) {
150 printerr(0, "ERROR: address %s has non-zero "
151 "sin6_scope_id!\n", node);
156 #endif /* IPV6_SUPPORTED */
158 memcpy(sa, res->ai_addr, res->ai_addrlen);
164 * convert a sockaddr to a hostname
167 sockaddr_to_hostname(const struct sockaddr *sa, const char *addr)
172 char hbuf[NI_MAXHOST];
174 switch (sa->sa_family) {
176 addrlen = sizeof(struct sockaddr_in);
178 #ifdef IPV6_SUPPORTED
180 addrlen = sizeof(struct sockaddr_in6);
182 #endif /* IPV6_SUPPORTED */
184 printerr(0, "ERROR: unrecognized addr family %d\n",
189 err = getnameinfo(sa, addrlen, hbuf, sizeof(hbuf), NULL, 0,
192 printerr(0, "ERROR: unable to resolve %s to hostname: %s\n",
193 addr, err == EAI_SYSTEM ? strerror(err) :
198 hostname = strdup(hbuf);
203 /* XXX buffer problems: */
205 read_service_info(char *info_file_name, char **servicename, char **servername,
206 int *prog, int *vers, char **protocol,
207 struct sockaddr *addr) {
208 #define INFOBUFLEN 256
209 char buf[INFOBUFLEN + 1];
210 static char dummy[128];
212 static char service[128];
213 static char address[128];
222 *servicename = *servername = *protocol = NULL;
224 if ((fd = open(info_file_name, O_RDONLY)) == -1) {
225 printerr(0, "ERROR: can't open %s: %s\n", info_file_name,
229 if ((nbytes = read(fd, buf, INFOBUFLEN)) == -1)
234 numfields = sscanf(buf,"RPC server: %127s\n"
235 "service: %127s %15s version %15s\n"
239 service, program, version,
243 if (numfields == 5) {
244 strcpy(protoname, "tcp");
245 } else if (numfields != 6) {
250 if ((p = strstr(buf, "port")) != NULL)
251 sscanf(p, "port: %127s\n", port);
253 /* check service, program, and version */
254 if (memcmp(service, "nfs", 3) != 0)
256 *prog = atoi(program + 1); /* skip open paren */
257 *vers = atoi(version);
259 if (strlen(service) == 3 ) {
260 if ((*prog != 100003) || ((*vers != 2) && (*vers != 3) &&
263 } else if (memcmp(service, "nfs4_cb", 7) == 0) {
268 if (!addrstr_to_sockaddr(addr, address, port))
271 *servername = sockaddr_to_hostname(addr, address);
272 if (*servername == NULL)
275 nbytes = snprintf(buf, INFOBUFLEN, "%s@%s", service, *servername);
276 if (nbytes > INFOBUFLEN)
279 if (!(*servicename = calloc(strlen(buf) + 1, 1)))
281 memcpy(*servicename, buf, strlen(buf));
283 if (!(*protocol = strdup(protoname)))
287 printerr(0, "ERROR: failed to read service info\n");
288 if (fd != -1) close(fd);
292 *servicename = *servername = *protocol = NULL;
297 destroy_client(struct clnt_info *clp)
299 if (clp->krb5_poll_index != -1)
300 memset(&pollarray[clp->krb5_poll_index], 0,
301 sizeof(struct pollfd));
302 if (clp->spkm3_poll_index != -1)
303 memset(&pollarray[clp->spkm3_poll_index], 0,
304 sizeof(struct pollfd));
305 if (clp->gssd_poll_index != -1)
306 memset(&pollarray[clp->gssd_poll_index], 0,
307 sizeof(struct pollfd));
308 if (clp->dir_fd != -1) close(clp->dir_fd);
309 if (clp->krb5_fd != -1) close(clp->krb5_fd);
310 if (clp->spkm3_fd != -1) close(clp->spkm3_fd);
311 if (clp->gssd_fd != -1) close(clp->gssd_fd);
313 free(clp->servicename);
314 free(clp->servername);
319 static struct clnt_info *
320 insert_new_clnt(void)
322 struct clnt_info *clp = NULL;
324 if (!(clp = (struct clnt_info *)calloc(1,sizeof(struct clnt_info)))) {
325 printerr(0, "ERROR: can't malloc clnt_info: %s\n",
329 clp->krb5_poll_index = -1;
330 clp->spkm3_poll_index = -1;
331 clp->gssd_poll_index = -1;
337 TAILQ_INSERT_HEAD(&clnt_list, clp, list);
343 process_clnt_dir_files(struct clnt_info * clp)
346 char gname[PATH_MAX];
347 char info_file_name[PATH_MAX];
349 if (clp->gssd_fd == -1) {
350 snprintf(gname, sizeof(gname), "%s/gssd", clp->dirname);
351 clp->gssd_fd = open(gname, O_RDWR);
353 if (clp->gssd_fd == -1) {
354 if (clp->krb5_fd == -1) {
355 snprintf(name, sizeof(name), "%s/krb5", clp->dirname);
356 clp->krb5_fd = open(name, O_RDWR);
358 if (clp->spkm3_fd == -1) {
359 snprintf(name, sizeof(name), "%s/spkm3", clp->dirname);
360 clp->spkm3_fd = open(name, O_RDWR);
363 /* If we opened a gss-specific pipe, let's try opening
364 * the new upcall pipe again. If we succeed, close
365 * gss-specific pipe(s).
367 if (clp->krb5_fd != -1 || clp->spkm3_fd != -1) {
368 clp->gssd_fd = open(gname, O_RDWR);
369 if (clp->gssd_fd != -1) {
370 if (clp->krb5_fd != -1)
373 if (clp->spkm3_fd != -1)
374 close(clp->spkm3_fd);
380 if ((clp->krb5_fd == -1) && (clp->spkm3_fd == -1) &&
381 (clp->gssd_fd == -1))
383 snprintf(info_file_name, sizeof(info_file_name), "%s/info",
385 if ((clp->servicename == NULL) &&
386 read_service_info(info_file_name, &clp->servicename,
387 &clp->servername, &clp->prog, &clp->vers,
388 &clp->protocol, (struct sockaddr *) &clp->addr))
394 get_poll_index(int *ind)
399 for (i=0; i<FD_ALLOC_BLOCK; i++) {
400 if (pollarray[i].events == 0) {
406 printerr(0, "ERROR: No pollarray slots open\n");
414 insert_clnt_poll(struct clnt_info *clp)
416 if ((clp->gssd_fd != -1) && (clp->gssd_poll_index == -1)) {
417 if (get_poll_index(&clp->gssd_poll_index)) {
418 printerr(0, "ERROR: Too many gssd clients\n");
421 pollarray[clp->gssd_poll_index].fd = clp->gssd_fd;
422 pollarray[clp->gssd_poll_index].events |= POLLIN;
425 if ((clp->krb5_fd != -1) && (clp->krb5_poll_index == -1)) {
426 if (get_poll_index(&clp->krb5_poll_index)) {
427 printerr(0, "ERROR: Too many krb5 clients\n");
430 pollarray[clp->krb5_poll_index].fd = clp->krb5_fd;
431 pollarray[clp->krb5_poll_index].events |= POLLIN;
434 if ((clp->spkm3_fd != -1) && (clp->spkm3_poll_index == -1)) {
435 if (get_poll_index(&clp->spkm3_poll_index)) {
436 printerr(0, "ERROR: Too many spkm3 clients\n");
439 pollarray[clp->spkm3_poll_index].fd = clp->spkm3_fd;
440 pollarray[clp->spkm3_poll_index].events |= POLLIN;
447 process_clnt_dir(char *dir, char *pdir)
449 struct clnt_info * clp;
451 if (!(clp = insert_new_clnt()))
452 goto fail_destroy_client;
454 /* An extra for the '/', and an extra for the null */
455 if (!(clp->dirname = calloc(strlen(dir) + strlen(pdir) + 2, 1))) {
456 goto fail_destroy_client;
458 sprintf(clp->dirname, "%s/%s", pdir, dir);
459 if ((clp->dir_fd = open(clp->dirname, O_RDONLY)) == -1) {
460 printerr(0, "ERROR: can't open %s: %s\n",
461 clp->dirname, strerror(errno));
462 goto fail_destroy_client;
464 fcntl(clp->dir_fd, F_SETSIG, DNOTIFY_SIGNAL);
465 fcntl(clp->dir_fd, F_NOTIFY, DN_CREATE | DN_DELETE | DN_MULTISHOT);
467 if (process_clnt_dir_files(clp))
468 goto fail_keep_client;
470 if (insert_clnt_poll(clp))
471 goto fail_destroy_client;
477 TAILQ_REMOVE(&clnt_list, clp, list);
481 /* We couldn't find some subdirectories, but we keep the client
482 * around in case we get a notification on the directory when the
483 * subdirectories are created. */
488 init_client_list(void)
490 TAILQ_INIT(&clnt_list);
491 /* Eventually plan to grow/shrink poll array: */
492 pollsize = FD_ALLOC_BLOCK;
493 pollarray = calloc(pollsize, sizeof(struct pollfd));
497 * This is run after a DNOTIFY signal, and should clear up any
498 * directories that are no longer around, and re-scan any existing
499 * directories, since the DNOTIFY could have been in there.
502 update_old_clients(struct dirent **namelist, int size, char *pdir)
504 struct clnt_info *clp;
507 char fname[PATH_MAX];
509 for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
510 /* only compare entries in the global list that are from the
511 * same pipefs parent directory as "pdir"
513 if (strncmp(clp->dirname, pdir, strlen(pdir)) != 0) continue;
516 for (i=0; i < size; i++) {
517 snprintf(fname, sizeof(fname), "%s/%s",
518 pdir, namelist[i]->d_name);
519 if (strcmp(clp->dirname, fname) == 0) {
525 printerr(2, "destroying client %s\n", clp->dirname);
526 saveprev = clp->list.tqe_prev;
527 TAILQ_REMOVE(&clnt_list, clp, list);
532 for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
533 if (!process_clnt_dir_files(clp))
534 insert_clnt_poll(clp);
538 /* Search for a client by directory name, return 1 if found, 0 otherwise */
540 find_client(char *dirname, char *pdir)
542 struct clnt_info *clp;
543 char fname[PATH_MAX];
545 for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
546 snprintf(fname, sizeof(fname), "%s/%s", pdir, dirname);
547 if (strcmp(clp->dirname, fname) == 0)
554 process_pipedir(char *pipe_name)
556 struct dirent **namelist;
559 if (chdir(pipe_name) < 0) {
560 printerr(0, "ERROR: can't chdir to %s: %s\n",
561 pipe_name, strerror(errno));
565 j = scandir(pipe_name, &namelist, NULL, alphasort);
567 printerr(0, "ERROR: can't scandir %s: %s\n",
568 pipe_name, strerror(errno));
572 update_old_clients(namelist, j, pipe_name);
573 for (i=0; i < j; i++) {
574 if (i < FD_ALLOC_BLOCK
575 && !strncmp(namelist[i]->d_name, "clnt", 4)
576 && !find_client(namelist[i]->d_name, pipe_name))
577 process_clnt_dir(namelist[i]->d_name, pipe_name);
586 /* Used to read (and re-read) list of clients, set up poll array. */
588 update_client_list(void)
591 struct topdirs_info *tdi;
593 TAILQ_FOREACH(tdi, &topdirs_list, list) {
594 retval = process_pipedir(tdi->dirname);
596 printerr(1, "WARNING: error processing %s\n",
604 do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,
605 gss_buffer_desc *context_token)
607 char *buf = NULL, *p = NULL, *end = NULL;
608 unsigned int timeout = context_timeout;
609 unsigned int buf_size = 0;
611 printerr(1, "doing downcall\n");
612 buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) +
613 sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length +
614 sizeof(context_token->length) + context_token->length;
615 p = buf = malloc(buf_size);
616 end = buf + buf_size;
618 if (WRITE_BYTES(&p, end, uid)) goto out_err;
619 if (WRITE_BYTES(&p, end, timeout)) goto out_err;
620 if (WRITE_BYTES(&p, end, pd->pd_seq_win)) goto out_err;
621 if (write_buffer(&p, end, &pd->pd_ctx_hndl)) goto out_err;
622 if (write_buffer(&p, end, context_token)) goto out_err;
624 if (write(k5_fd, buf, p - buf) < p - buf) goto out_err;
629 printerr(1, "Failed to write downcall!\n");
634 do_error_downcall(int k5_fd, uid_t uid, int err)
637 char *p = buf, *end = buf + 1024;
638 unsigned int timeout = 0;
641 printerr(1, "doing error downcall\n");
643 if (WRITE_BYTES(&p, end, uid)) goto out_err;
644 if (WRITE_BYTES(&p, end, timeout)) goto out_err;
645 /* use seq_win = 0 to indicate an error: */
646 if (WRITE_BYTES(&p, end, zero)) goto out_err;
647 if (WRITE_BYTES(&p, end, err)) goto out_err;
649 if (write(k5_fd, buf, p - buf) < p - buf) goto out_err;
652 printerr(1, "Failed to write error downcall!\n");
657 * If the port isn't already set, do an rpcbind query to the remote server
658 * using the program and version and get the port.
660 * Newer kernels send the value of the port= mount option in the "info"
661 * file for the upcall or '0' for NFSv2/3. For NFSv4 it sends the value
662 * of the port= option or '2049'. The port field in a new sockaddr should
663 * reflect the value that was sent by the kernel.
666 populate_port(struct sockaddr *sa, const socklen_t salen,
667 const rpcprog_t program, const rpcvers_t version,
668 const unsigned short protocol)
670 struct sockaddr_in *s4 = (struct sockaddr_in *) sa;
671 #ifdef IPV6_SUPPORTED
672 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) sa;
673 #endif /* IPV6_SUPPORTED */
677 * Newer kernels send the port in the upcall. If we already have
678 * the port, there's no need to look it up.
680 switch (sa->sa_family) {
682 if (s4->sin_port != 0) {
683 printerr(2, "DEBUG: port already set to %d\n",
684 ntohs(s4->sin_port));
688 #ifdef IPV6_SUPPORTED
690 if (s6->sin6_port != 0) {
691 printerr(2, "DEBUG: port already set to %d\n",
692 ntohs(s6->sin6_port));
696 #endif /* IPV6_SUPPORTED */
698 printerr(0, "ERROR: unsupported address family %d\n",
704 * Newer kernels that send the port in the upcall set the value to
705 * 2049 for NFSv4 mounts when one isn't specified. The check below is
706 * only for kernels that don't send the port in the upcall. For those
707 * we either have to do an rpcbind query or set it to the standard
708 * port. Doing a query could be problematic (firewalls, etc), so take
709 * the latter approach.
711 if (program == 100003 && version == 4) {
716 port = nfs_getport(sa, salen, program, version, protocol);
718 printerr(0, "ERROR: unable to obtain port for prog %ld "
719 "vers %ld\n", program, version);
724 printerr(2, "DEBUG: setting port to %hu for prog %lu vers %lu\n", port,
727 switch (sa->sa_family) {
729 s4->sin_port = htons(port);
731 #ifdef IPV6_SUPPORTED
733 s6->sin6_port = htons(port);
735 #endif /* IPV6_SUPPORTED */
742 * Create an RPC connection and establish an authenticated
743 * gss context with a server.
745 int create_auth_rpc_client(struct clnt_info *clp,
746 CLIENT **clnt_return,
751 CLIENT *rpc_clnt = NULL;
752 struct rpc_gss_sec sec;
757 char rpc_errmsg[1024];
759 struct timeval timeout = {5, 0};
760 struct sockaddr *addr = (struct sockaddr *) &clp->addr;
763 /* Create the context as the user (not as root) */
764 save_uid = geteuid();
765 if (setfsuid(uid) != 0) {
766 printerr(0, "WARNING: Failed to setfsuid for "
767 "user with uid %d\n", uid);
770 printerr(2, "creating context using fsuid %d (save_uid %d)\n",
773 sec.qop = GSS_C_QOP_DEFAULT;
774 sec.svc = RPCSEC_GSS_SVC_NONE;
775 sec.cred = GSS_C_NO_CREDENTIAL;
777 if (authtype == AUTHTYPE_KRB5) {
778 sec.mech = (gss_OID)&krb5oid;
779 sec.req_flags = GSS_C_MUTUAL_FLAG;
781 else if (authtype == AUTHTYPE_SPKM3) {
782 sec.mech = (gss_OID)&spkm3oid;
783 /* XXX sec.req_flags = GSS_C_ANON_FLAG;
784 * Need a way to switch....
786 sec.req_flags = GSS_C_MUTUAL_FLAG;
789 printerr(0, "ERROR: Invalid authentication type (%d) "
790 "in create_auth_rpc_client\n", authtype);
795 if (authtype == AUTHTYPE_KRB5) {
796 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES
798 * Do this before creating rpc connection since we won't need
799 * rpc connection if it fails!
801 if (limit_krb5_enctypes(&sec, uid)) {
802 printerr(1, "WARNING: Failed while limiting krb5 "
803 "encryption types for user with uid %d\n",
810 /* create an rpc connection to the nfs server */
812 printerr(2, "creating %s client for server %s\n", clp->protocol,
815 if ((strcmp(clp->protocol, "tcp")) == 0) {
816 protocol = IPPROTO_TCP;
817 } else if ((strcmp(clp->protocol, "udp")) == 0) {
818 protocol = IPPROTO_UDP;
820 printerr(0, "WARNING: unrecognized protocol, '%s', requested "
821 "for connection to server %s for user with uid %d\n",
822 clp->protocol, clp->servername, uid);
826 switch (addr->sa_family) {
828 salen = sizeof(struct sockaddr_in);
830 #ifdef IPV6_SUPPORTED
832 salen = sizeof(struct sockaddr_in6);
834 #endif /* IPV6_SUPPORTED */
836 printerr(1, "ERROR: Unknown address family %d\n",
841 if (!populate_port(addr, salen, clp->prog, clp->vers, protocol))
844 rpc_clnt = nfs_get_rpcclient(addr, salen, protocol, clp->prog,
845 clp->vers, &timeout);
847 snprintf(rpc_errmsg, sizeof(rpc_errmsg),
848 "WARNING: can't create %s rpc_clnt to server %s for "
850 protocol == IPPROTO_TCP ? "tcp" : "udp",
851 clp->servername, uid);
853 clnt_spcreateerror(rpc_errmsg));
857 printerr(2, "creating context with server %s\n", clp->servicename);
858 auth = authgss_create_default(rpc_clnt, clp->servicename, &sec);
860 /* Our caller should print appropriate message */
861 printerr(2, "WARNING: Failed to create %s context for "
862 "user with uid %d for server %s\n",
863 (authtype == AUTHTYPE_KRB5 ? "krb5":"spkm3"),
864 uid, clp->servername);
869 rpc_clnt->cl_auth = auth;
870 *clnt_return = rpc_clnt;
875 if (sec.cred != GSS_C_NO_CREDENTIAL)
876 gss_release_cred(&min_stat, &sec.cred);
877 /* Restore euid to original value */
878 if ((save_uid != -1) && (setfsuid(save_uid) != uid)) {
879 printerr(0, "WARNING: Failed to restore fsuid"
880 " to uid %d from %d\n", save_uid, uid);
885 /* Only destroy here if failure. Otherwise, caller is responsible */
886 if (rpc_clnt) clnt_destroy(rpc_clnt);
892 * this code uses the userland rpcsec gss library to create a krb5
893 * context on behalf of the kernel
896 process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
899 CLIENT *rpc_clnt = NULL;
901 struct authgss_private_data pd;
902 gss_buffer_desc token;
903 char **credlist = NULL;
906 int create_resp = -1;
907 int err, downcall_err = -EACCES;
909 printerr(1, "handling krb5 upcall (%s)\n", clp->dirname);
912 if (clp->servicename) {
913 free(clp->servicename);
914 clp->servicename = strdup(tgtname);
919 memset(&pd, 0, sizeof(struct authgss_private_data));
922 * If "service" is specified, then the kernel is indicating that
923 * we must use machine credentials for this request. (Regardless
924 * of the uid value or the setting of root_uses_machine_creds.)
925 * If the service value is "*", then any service name can be used.
926 * Otherwise, it specifies the service name that should be used.
927 * (For now, the values of service will only be "*" or "nfs".)
929 * Restricting gssd to use "nfs" service name is needed for when
930 * the NFS server is doing a callback to the NFS client. In this
931 * case, the NFS server has to authenticate itself as "nfs" --
932 * even if there are other service keys such as "host" or "root"
935 * Another case when the kernel may specify the service attribute
936 * is when gssd is being asked to create the context for a
937 * SETCLIENT_ID operation. In this case, machine credentials
938 * must be used for the authentication. However, the service name
939 * used for this case is not important.
942 printerr(2, "%s: service is '%s'\n", __func__,
943 service ? service : "<null>");
944 if (uid != 0 || (uid == 0 && root_uses_machine_creds == 0 &&
946 /* Tell krb5 gss which credentials cache to use */
947 for (dirname = ccachesearch; *dirname != NULL; dirname++) {
948 err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
949 if (err == -EKEYEXPIRED)
950 downcall_err = -EKEYEXPIRED;
952 create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,
954 if (create_resp == 0)
958 if (create_resp != 0) {
959 if (uid == 0 && (root_uses_machine_creds == 1 ||
964 gssd_refresh_krb5_machine_credential(clp->servername,
967 * Get a list of credential cache names and try each
968 * of them until one works or we've tried them all
970 if (gssd_get_krb5_machine_cred_list(&credlist)) {
971 printerr(0, "ERROR: No credentials found "
972 "for connection to server %s\n",
974 goto out_return_error;
976 for (ccname = credlist; ccname && *ccname; ccname++) {
977 gssd_setup_krb5_machine_gss_ccache(*ccname);
978 if ((create_auth_rpc_client(clp, &rpc_clnt,
980 AUTHTYPE_KRB5)) == 0) {
985 printerr(2, "WARNING: Failed to create machine krb5 context "
986 "with credentials cache %s for server %s\n",
987 *ccname, clp->servername);
989 gssd_free_krb5_machine_cred_list(credlist);
993 printerr(2, "WARNING: Machine cache is prematurely expired or corrupted "
994 "trying to recreate cache for server %s\n", clp->servername);
996 printerr(1, "WARNING: Failed to create machine krb5 context "
997 "with any credentials cache for server %s\n",
999 goto out_return_error;
1004 printerr(1, "WARNING: Failed to create krb5 context "
1005 "for user with uid %d for server %s\n",
1006 uid, clp->servername);
1007 goto out_return_error;
1011 if (!authgss_get_private_data(auth, &pd)) {
1012 printerr(1, "WARNING: Failed to obtain authentication "
1013 "data for user with uid %d for server %s\n",
1014 uid, clp->servername);
1015 goto out_return_error;
1018 if (serialize_context_for_kernel(pd.pd_ctx, &token, &krb5oid, NULL)) {
1019 printerr(0, "WARNING: Failed to serialize krb5 context for "
1020 "user with uid %d for server %s\n",
1021 uid, clp->servername);
1022 goto out_return_error;
1025 do_downcall(fd, uid, &pd, &token);
1030 #ifndef HAVE_LIBTIRPC
1031 if (pd.pd_ctx_hndl.length != 0)
1032 authgss_free_private_data(&pd);
1037 clnt_destroy(rpc_clnt);
1041 do_error_downcall(fd, uid, downcall_err);
1046 * this code uses the userland rpcsec gss library to create an spkm3
1047 * context on behalf of the kernel
1050 process_spkm3_upcall(struct clnt_info *clp, uid_t uid, int fd)
1052 CLIENT *rpc_clnt = NULL;
1054 struct authgss_private_data pd;
1055 gss_buffer_desc token;
1057 printerr(2, "handling spkm3 upcall (%s)\n", clp->dirname);
1062 if (create_auth_rpc_client(clp, &rpc_clnt, &auth, uid, AUTHTYPE_SPKM3)) {
1063 printerr(0, "WARNING: Failed to create spkm3 context for "
1064 "user with uid %d\n", uid);
1065 goto out_return_error;
1068 if (!authgss_get_private_data(auth, &pd)) {
1069 printerr(0, "WARNING: Failed to obtain authentication "
1070 "data for user with uid %d for server %s\n",
1071 uid, clp->servername);
1072 goto out_return_error;
1075 if (serialize_context_for_kernel(pd.pd_ctx, &token, &spkm3oid, NULL)) {
1076 printerr(0, "WARNING: Failed to serialize spkm3 context for "
1077 "user with uid %d for server\n",
1078 uid, clp->servername);
1079 goto out_return_error;
1082 do_downcall(fd, uid, &pd, &token);
1090 clnt_destroy(rpc_clnt);
1094 do_error_downcall(fd, uid, -1);
1099 handle_krb5_upcall(struct clnt_info *clp)
1103 if (read(clp->krb5_fd, &uid, sizeof(uid)) < sizeof(uid)) {
1104 printerr(0, "WARNING: failed reading uid from krb5 "
1105 "upcall pipe: %s\n", strerror(errno));
1109 return process_krb5_upcall(clp, uid, clp->krb5_fd, NULL, NULL);
1113 handle_spkm3_upcall(struct clnt_info *clp)
1117 if (read(clp->spkm3_fd, &uid, sizeof(uid)) < sizeof(uid)) {
1118 printerr(0, "WARNING: failed reading uid from spkm3 "
1119 "upcall pipe: %s\n", strerror(errno));
1123 return process_spkm3_upcall(clp, uid, clp->spkm3_fd);
1127 handle_gssd_upcall(struct clnt_info *clp)
1134 char *target = NULL;
1135 char *service = NULL;
1137 printerr(1, "handling gssd upcall (%s)\n", clp->dirname);
1139 if (readline(clp->gssd_fd, &lbuf, &lbuflen) != 1) {
1140 printerr(0, "WARNING: handle_gssd_upcall: "
1141 "failed reading request\n");
1144 printerr(2, "%s: '%s'\n", __func__, lbuf);
1146 /* find the mechanism name */
1147 if ((p = strstr(lbuf, "mech=")) != NULL) {
1148 mech = malloc(lbuflen);
1151 if (sscanf(p, "mech=%s", mech) != 1) {
1152 printerr(0, "WARNING: handle_gssd_upcall: "
1153 "failed to parse gss mechanism name "
1154 "in upcall string '%s'\n", lbuf);
1158 printerr(0, "WARNING: handle_gssd_upcall: "
1159 "failed to find gss mechanism name "
1160 "in upcall string '%s'\n", lbuf);
1165 if ((p = strstr(lbuf, "uid=")) != NULL) {
1166 if (sscanf(p, "uid=%d", &uid) != 1) {
1167 printerr(0, "WARNING: handle_gssd_upcall: "
1168 "failed to parse uid "
1169 "in upcall string '%s'\n", lbuf);
1173 printerr(0, "WARNING: handle_gssd_upcall: "
1174 "failed to find uid "
1175 "in upcall string '%s'\n", lbuf);
1179 /* read target name */
1180 if ((p = strstr(lbuf, "target=")) != NULL) {
1181 target = malloc(lbuflen);
1184 if (sscanf(p, "target=%s", target) != 1) {
1185 printerr(0, "WARNING: handle_gssd_upcall: "
1186 "failed to parse target name "
1187 "in upcall string '%s'\n", lbuf);
1193 * read the service name
1195 * The presence of attribute "service=" indicates that machine
1196 * credentials should be used for this request. If the value
1197 * is "*", then any machine credentials available can be used.
1198 * If the value is anything else, then machine credentials for
1199 * the specified service name (always "nfs" for now) should be
1202 if ((p = strstr(lbuf, "service=")) != NULL) {
1203 service = malloc(lbuflen);
1206 if (sscanf(p, "service=%s", service) != 1) {
1207 printerr(0, "WARNING: handle_gssd_upcall: "
1208 "failed to parse service type "
1209 "in upcall string '%s'\n", lbuf);
1214 if (strcmp(mech, "krb5") == 0)
1215 process_krb5_upcall(clp, uid, clp->gssd_fd, target, service);
1216 else if (strcmp(mech, "spkm3") == 0)
1217 process_spkm3_upcall(clp, uid, clp->gssd_fd);
1219 printerr(0, "WARNING: handle_gssd_upcall: "
1220 "received unknown gss mech '%s'\n", mech);