5ff16f1c783d74265d2b11f149bcb661030ff683
[nfs-utils.git] / utils / gssd / gss_util.c
1 /*
2  *  Adapted in part from MIT Kerberos 5-1.2.1 slave/kprop.c and from
3  *  http://docs.sun.com/?p=/doc/816-1331/6m7oo9sms&a=view
4  *
5  *  Copyright (c) 2002 The Regents of the University of Michigan.
6  *  All rights reserved.
7  *
8  *  Andy Adamson <andros@umich.edu>
9  *  J. Bruce Fields <bfields@umich.edu>
10  *  Marius Aamodt Eriksen <marius@umich.edu>
11  */
12
13 /*
14  * slave/kprop.c
15  *
16  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
17  * All Rights Reserved.
18  *
19  * Export of this software from the United States of America may
20  *   require a specific license from the United States Government.
21  *   It is the responsibility of any person or organization contemplating
22  *   export to obtain such a license before exporting.
23  *
24  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
25  * distribute this software and its documentation for any purpose and
26  * without fee is hereby granted, provided that the above copyright
27  * notice appear in all copies and that both that copyright notice and
28  * this permission notice appear in supporting documentation, and that
29  * the name of M.I.T. not be used in advertising or publicity pertaining
30  * to distribution of the software without specific, written prior
31  * permission.  Furthermore if you modify this software you must label
32  * your software as modified software and not distribute it in such a
33  * fashion that it might be confused with the original M.I.T. software.
34  * M.I.T. makes no representations about the suitability of
35  * this software for any purpose.  It is provided "as is" without express
36  * or implied warranty.
37  */
38
39 /*
40  * Copyright 1994 by OpenVision Technologies, Inc.
41  *
42  * Permission to use, copy, modify, distribute, and sell this software
43  * and its documentation for any purpose is hereby granted without fee,
44  * provided that the above copyright notice appears in all copies and
45  * that both that copyright notice and this permission notice appear in
46  * supporting documentation, and that the name of OpenVision not be used
47  * in advertising or publicity pertaining to distribution of the software
48  * without specific, written prior permission. OpenVision makes no
49  * representations about the suitability of this software for any
50  * purpose.  It is provided "as is" without express or implied warranty.
51  *
52  * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
53  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
54  * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
55  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
56  * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
57  * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
58  * PERFORMANCE OF THIS SOFTWARE.
59  */
60
61 #ifdef HAVE_CONFIG_H
62 #include <config.h>
63 #endif  /* HAVE_CONFIG_H */
64
65 #include <errno.h>
66 #include <stdio.h>
67 #include <ctype.h>
68 #include <sys/file.h>
69 #include <signal.h>
70 #include <string.h>
71 #include <sys/types.h>
72 #include <sys/time.h>
73 #include <sys/stat.h>
74 #include <sys/socket.h>
75 #include <netinet/in.h>
76 #include <sys/param.h>
77 #include <netdb.h>
78 #include <fcntl.h>
79 #include <gssapi/gssapi.h>
80 #if defined(HAVE_KRB5) && !defined(GSS_C_NT_HOSTBASED_SERVICE)
81 #include <gssapi/gssapi_generic.h>
82 #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
83 #endif
84 #include "gss_util.h"
85 #include "err_util.h"
86 #include "gssd.h"
87 #ifdef HAVE_UNISTD_H
88 #include <unistd.h>
89 #endif
90 #include <stdlib.h>
91 #ifdef HAVE_COM_ERR_H
92 #include <com_err.h>
93 #endif
94
95 /* Global gssd_credentials handle */
96 gss_cred_id_t gssd_creds;
97
98 gss_OID g_mechOid = GSS_C_NULL_OID;;
99
100 #if 0
101 static void
102 display_status_1(char *m, u_int32_t code, int type, const gss_OID mech)
103 {
104         u_int32_t maj_stat, min_stat;
105         gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
106         u_int32_t msg_ctx = 0;
107         char *typestr;
108
109         switch (type) {
110         case GSS_C_GSS_CODE:
111                 typestr = "GSS";
112                 break;
113         case GSS_C_MECH_CODE:
114                 typestr = "mechanism";
115                 break;
116         default:
117                 return;
118                 /* NOTREACHED */
119         }
120
121         for (;;) {
122                 maj_stat = gss_display_status(&min_stat, code,
123                     type, mech, &msg_ctx, &msg);
124                 if (maj_stat != GSS_S_COMPLETE) {
125                         printerr(0, "ERROR: in call to "
126                                 "gss_display_status called from %s\n", m);
127                         break;
128                 } else {
129                         printerr(2, "ERROR: GSS-API: (%s) error in %s(): %s\n",
130                             typestr, m, (char *)msg.value);
131                 }
132
133                 if (msg.length != 0)
134                         (void) gss_release_buffer(&min_stat, &msg);
135
136                 if (msg_ctx == 0)
137                         break;
138         }
139 }
140 #endif
141 static char *
142 gss_display_error(OM_uint32 status)
143 {
144                 char *error = NULL;
145
146                 switch(status) {
147                 case GSS_S_COMPLETE: 
148                         error = "GSS_S_COMPLETE";
149                         break;
150                 case GSS_S_CALL_INACCESSIBLE_READ: 
151                         error = "GSS_S_CALL_INACCESSIBLE_READ";
152                         break;
153                 case GSS_S_CALL_INACCESSIBLE_WRITE:
154                         error = "GSS_S_CALL_INACCESSIBLE_WRITE";
155                         break;
156                 case GSS_S_CALL_BAD_STRUCTURE:
157                         error = "GSS_S_CALL_BAD_STRUCTURE";
158                         break;
159                 case  GSS_S_BAD_MECH:
160                         error = "GSS_S_BAD_MECH";
161                         break;
162                 case  GSS_S_BAD_NAME:
163                         error = "GSS_S_BAD_NAME";
164                         break;
165                 case  GSS_S_BAD_NAMETYPE:
166                         error = "GSS_S_BAD_NAMETYPE";
167                         break;
168                 case  GSS_S_BAD_BINDINGS:
169                         error = "GSS_S_BAD_BINDINGS";
170                         break;
171                 case  GSS_S_BAD_STATUS:
172                         error = "GSS_S_BAD_STATUS";
173                         break;
174                 case  GSS_S_BAD_SIG:
175                         error = "GSS_S_BAD_SIG";
176                         break;
177                 case  GSS_S_NO_CRED:
178                         error = "GSS_S_NO_CRED";
179                         break;
180                 case  GSS_S_NO_CONTEXT:
181                         error = "GSS_S_NO_CONTEXT";
182                         break;
183                 case  GSS_S_DEFECTIVE_TOKEN:
184                         error = "GSS_S_DEFECTIVE_TOKEN";
185                         break;
186                 case  GSS_S_DEFECTIVE_CREDENTIAL:
187                         error = "GSS_S_DEFECTIVE_CREDENTIAL";
188                         break;
189                 case  GSS_S_CREDENTIALS_EXPIRED:
190                         error = "GSS_S_CREDENTIALS_EXPIRED";
191                         break;
192                 case  GSS_S_CONTEXT_EXPIRED:
193                         error = "GSS_S_CONTEXT_EXPIRED";
194                         break;
195                 case  GSS_S_FAILURE:
196                         error = "GSS_S_FAILURE";
197                         break;
198                 case  GSS_S_BAD_QOP:
199                         error = "GSS_S_BAD_QOP";
200                         break;
201                 case  GSS_S_UNAUTHORIZED:
202                         error = "GSS_S_UNAUTHORIZED";
203                         break;
204                 case  GSS_S_UNAVAILABLE:
205                         error = "GSS_S_UNAVAILABLE";
206                         break;
207                 case  GSS_S_DUPLICATE_ELEMENT:
208                         error = "GSS_S_DUPLICATE_ELEMENT";
209                         break;
210                 case  GSS_S_NAME_NOT_MN:
211                         error = "GSS_S_NAME_NOT_MN";
212                         break;
213                 default:
214                         error = "Not defined";
215                 }
216         return error;
217 }
218
219 static void
220 display_status_2(char *m, u_int32_t major, u_int32_t minor, const gss_OID mech)
221 {
222         u_int32_t maj_stat1, min_stat1;
223         u_int32_t maj_stat2, min_stat2;
224         gss_buffer_desc maj_gss_buf = GSS_C_EMPTY_BUFFER;
225         gss_buffer_desc min_gss_buf = GSS_C_EMPTY_BUFFER;
226         char maj_buf[30], min_buf[30];
227         char *maj, *min;
228         u_int32_t msg_ctx = 0;
229         int msg_verbosity = 0;
230
231         /* Get major status message */
232         maj_stat1 = gss_display_status(&min_stat1, major,
233                 GSS_C_GSS_CODE, mech, &msg_ctx, &maj_gss_buf);
234
235         if (maj_stat1 != GSS_S_COMPLETE) {
236                 snprintf(maj_buf, sizeof(maj_buf), "(0x%08x)", major);
237                 maj = &maj_buf[0];
238         } else {
239                 maj = maj_gss_buf.value;
240         }
241
242         /* Get minor status message */
243         maj_stat2 = gss_display_status(&min_stat2, minor,
244                 GSS_C_MECH_CODE, mech, &msg_ctx, &min_gss_buf);
245
246         if (maj_stat2 != GSS_S_COMPLETE) {
247                 snprintf(min_buf, sizeof(min_buf), "(0x%08x)", minor);
248                 min = &min_buf[0];
249         } else {
250                 min = min_gss_buf.value;
251         }
252
253         if (major == GSS_S_CREDENTIALS_EXPIRED)
254                 msg_verbosity = 1;
255
256         printerr(msg_verbosity, "ERROR: GSS-API: error in %s(): %s (%s) - %s\n",
257                  m, gss_display_error(major), maj, min);
258
259         if (maj_gss_buf.length != 0)
260                 (void) gss_release_buffer(&min_stat1, &maj_gss_buf);
261         if (min_gss_buf.length != 0)
262                 (void) gss_release_buffer(&min_stat2, &min_gss_buf);
263 }
264
265 void
266 pgsserr(char *msg, u_int32_t maj_stat, u_int32_t min_stat, const gss_OID mech)
267 {
268         display_status_2(msg, maj_stat, min_stat, mech);
269 }
270
271 int
272 gssd_acquire_cred(char *server_name, const gss_OID oid)
273 {
274         gss_buffer_desc name;
275         gss_name_t target_name;
276         u_int32_t maj_stat, min_stat;
277         u_int32_t ignore_maj_stat, ignore_min_stat;
278         gss_buffer_desc pbuf;
279
280         /* If server_name is NULL, get cred for GSS_C_NO_NAME */
281         if (server_name == NULL) {
282                 target_name = GSS_C_NO_NAME;
283         } else {
284                 name.value = (void *)server_name;
285                 name.length = strlen(server_name);
286
287                 maj_stat = gss_import_name(&min_stat, &name,
288                                 oid,
289                                 &target_name);
290
291                 if (maj_stat != GSS_S_COMPLETE) {
292                         pgsserr("gss_import_name", maj_stat, min_stat, g_mechOid);
293                         return (FALSE);
294                 }
295         }
296
297         maj_stat = gss_acquire_cred(&min_stat, target_name, GSS_C_INDEFINITE,
298                         GSS_C_NO_OID_SET, GSS_C_ACCEPT,
299                         &gssd_creds, NULL, NULL);
300
301         if (maj_stat != GSS_S_COMPLETE) {
302                 pgsserr("gss_acquire_cred", maj_stat, min_stat, g_mechOid);
303                 ignore_maj_stat = gss_display_name(&ignore_min_stat,
304                                 target_name, &pbuf, NULL);
305                 if (ignore_maj_stat == GSS_S_COMPLETE) {
306                         printerr(1, "Unable to obtain credentials for '%.*s'\n",
307                                  pbuf.length, pbuf.value);
308                         ignore_maj_stat = gss_release_buffer(&ignore_min_stat,
309                                                              &pbuf);
310                 }
311         }
312
313         ignore_maj_stat = gss_release_name(&ignore_min_stat, &target_name);
314
315         return (maj_stat == GSS_S_COMPLETE);
316 }
317
318 int gssd_check_mechs(void)
319 {
320         u_int32_t maj_stat, min_stat;
321         gss_OID_set supported_mechs = GSS_C_NO_OID_SET;
322         int retval = -1;
323
324         maj_stat = gss_indicate_mechs(&min_stat, &supported_mechs);
325         if (maj_stat != GSS_S_COMPLETE) {
326                 printerr(0, "Unable to obtain list of supported mechanisms. "
327                          "Check that gss library is properly configured.\n");
328                 goto out;
329         }
330         if (supported_mechs == GSS_C_NO_OID_SET ||
331             supported_mechs->count == 0) {
332                 printerr(0, "Unable to obtain list of supported mechanisms. "
333                          "Check that gss library is properly configured.\n");
334                 goto out;
335         }
336         maj_stat = gss_release_oid_set(&min_stat, &supported_mechs);
337         retval = 0;
338 out:
339         return retval;
340 }
341