utils/gssd/gss_util.c

   1 /*
   2  *  Adapted in part from MIT Kerberos 5-1.2.1 slave/kprop.c and from
   3  *  http://docs.sun.com/?p=/doc/816-1331/6m7oo9sms&a=view
   4  *
   5  *  Copyright (c) 2002 The Regents of the University of Michigan.
   6  *  All rights reserved.
   7  *
   8  *  Andy Adamson <andros@umich.edu>
   9  *  J. Bruce Fields <bfields@umich.edu>
  10  *  Marius Aamodt Eriksen <marius@umich.edu>
  11  */
  12
  13 /*
  14  * slave/kprop.c
  15  *
  16  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
  17  * All Rights Reserved.
  18  *
  19  * Export of this software from the United States of America may
  20  *   require a specific license from the United States Government.
  21  *   It is the responsibility of any person or organization contemplating
  22  *   export to obtain such a license before exporting.
  23  *
  24  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  25  * distribute this software and its documentation for any purpose and
  26  * without fee is hereby granted, provided that the above copyright
  27  * notice appear in all copies and that both that copyright notice and
  28  * this permission notice appear in supporting documentation, and that
  29  * the name of M.I.T. not be used in advertising or publicity pertaining
  30  * to distribution of the software without specific, written prior
  31  * permission.  Furthermore if you modify this software you must label
  32  * your software as modified software and not distribute it in such a
  33  * fashion that it might be confused with the original M.I.T. software.
  34  * M.I.T. makes no representations about the suitability of
  35  * this software for any purpose.  It is provided "as is" without express
  36  * or implied warranty.
  37  */
  38
  39 /*
  40  * Copyright 1994 by OpenVision Technologies, Inc.
  41  *
  42  * Permission to use, copy, modify, distribute, and sell this software
  43  * and its documentation for any purpose is hereby granted without fee,
  44  * provided that the above copyright notice appears in all copies and
  45  * that both that copyright notice and this permission notice appear in
  46  * supporting documentation, and that the name of OpenVision not be used
  47  * in advertising or publicity pertaining to distribution of the software
  48  * without specific, written prior permission. OpenVision makes no
  49  * representations about the suitability of this software for any
  50  * purpose.  It is provided "as is" without express or implied warranty.
  51  *
  52  * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
  53  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
  54  * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
  55  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
  56  * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
  57  * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  58  * PERFORMANCE OF THIS SOFTWARE.
  59  */
  60
  61 #ifdef HAVE_CONFIG_H
  62 #include <config.h>
  63 #endif  /* HAVE_CONFIG_H */
  64
  65 #include <errno.h>
  66 #include <stdio.h>
  67 #include <ctype.h>
  68 #include <sys/file.h>
  69 #include <signal.h>
  70 #include <string.h>
  71 #include <sys/types.h>
  72 #include <sys/time.h>
  73 #include <sys/stat.h>
  74 #include <sys/socket.h>
  75 #include <netinet/in.h>
  76 #include <sys/param.h>
  77 #include <netdb.h>
  78 #include <fcntl.h>
  79 #include <gssapi/gssapi.h>
  80 #if defined(HAVE_KRB5) && !defined(GSS_C_NT_HOSTBASED_SERVICE)
  81 #include <gssapi/gssapi_generic.h>
  82 #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
  83 #endif
  84 #include "gss_util.h"
  85 #include "err_util.h"
  86 #include "gssd.h"
  87 #ifdef HAVE_UNISTD_H
  88 #include <unistd.h>
  89 #endif
  90 #include <stdlib.h>
  91 #ifdef HAVE_COM_ERR_H
  92 #include <com_err.h>
  93 #endif
  94
  95 /* Global gssd_credentials handle */
  96 gss_cred_id_t gssd_creds;
  97
  98 gss_OID g_mechOid = GSS_C_NULL_OID;;
  99
 100 #if 0
 101 static void
 102 display_status_1(char *m, u_int32_t code, int type, const gss_OID mech)
 103 {
 104         u_int32_t maj_stat, min_stat;
 105         gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
 106         u_int32_t msg_ctx = 0;
 107         char *typestr;
 108
 109         switch (type) {
 110         case GSS_C_GSS_CODE:
 111                 typestr = "GSS";
 112                 break;
 113         case GSS_C_MECH_CODE:
 114                 typestr = "mechanism";
 115                 break;
 116         default:
 117                 return;
 118                 /* NOTREACHED */
 119         }
 120
 121         for (;;) {
 122                 maj_stat = gss_display_status(&min_stat, code,
 123                     type, mech, &msg_ctx, &msg);
 124                 if (maj_stat != GSS_S_COMPLETE) {
 125                         printerr(0, "ERROR: in call to "
 126                                 "gss_display_status called from %s\n", m);
 127                         break;
 128                 } else {
 129                         printerr(0, "ERROR: GSS-API: (%s) error in %s(): %s\n",
 130                             typestr, m, (char *)msg.value);
 131                 }
 132
 133                 if (msg.length != 0)
 134                         (void) gss_release_buffer(&min_stat, &msg);
 135
 136                 if (msg_ctx == 0)
 137                         break;
 138         }
 139 }
 140 #endif
 141 static char *
 142 gss_display_error(OM_uint32 status)
 143 {
 144                 char *error = NULL;
 145
 146                 switch(status) {
 147                 case GSS_S_COMPLETE:
 148                         error = "GSS_S_COMPLETE";
 149                         break;
 150                 case GSS_S_CALL_INACCESSIBLE_READ:
 151                         error = "GSS_S_CALL_INACCESSIBLE_READ";
 152                         break;
 153                 case GSS_S_CALL_INACCESSIBLE_WRITE:
 154                         error = "GSS_S_CALL_INACCESSIBLE_WRITE";
 155                         break;
 156                 case GSS_S_CALL_BAD_STRUCTURE:
 157                         error = "GSS_S_CALL_BAD_STRUCTURE";
 158                         break;
 159                 case  GSS_S_BAD_MECH:
 160                         error = "GSS_S_BAD_MECH";
 161                         break;
 162                 case  GSS_S_BAD_NAME:
 163                         error = "GSS_S_BAD_NAME";
 164                         break;
 165                 case  GSS_S_BAD_NAMETYPE:
 166                         error = "GSS_S_BAD_NAMETYPE";
 167                         break;
 168                 case  GSS_S_BAD_BINDINGS:
 169                         error = "GSS_S_BAD_BINDINGS";
 170                         break;
 171                 case  GSS_S_BAD_STATUS:
 172                         error = "GSS_S_BAD_STATUS";
 173                         break;
 174                 case  GSS_S_BAD_SIG:
 175                         error = "GSS_S_BAD_SIG";
 176                         break;
 177                 case  GSS_S_NO_CRED:
 178                         error = "GSS_S_NO_CRED";
 179                         break;
 180                 case  GSS_S_NO_CONTEXT:
 181                         error = "GSS_S_NO_CONTEXT";
 182                         break;
 183                 case  GSS_S_DEFECTIVE_TOKEN:
 184                         error = "GSS_S_DEFECTIVE_TOKEN";
 185                         break;
 186                 case  GSS_S_DEFECTIVE_CREDENTIAL:
 187                         error = "GSS_S_DEFECTIVE_CREDENTIAL";
 188                         break;
 189                 case  GSS_S_CREDENTIALS_EXPIRED:
 190                         error = "GSS_S_CREDENTIALS_EXPIRED";
 191                         break;
 192                 case  GSS_S_CONTEXT_EXPIRED:
 193                         error = "GSS_S_CONTEXT_EXPIRED";
 194                         break;
 195                 case  GSS_S_FAILURE:
 196                         error = "GSS_S_FAILURE";
 197                         break;
 198                 case  GSS_S_BAD_QOP:
 199                         error = "GSS_S_BAD_QOP";
 200                         break;
 201                 case  GSS_S_UNAUTHORIZED:
 202                         error = "GSS_S_UNAUTHORIZED";
 203                         break;
 204                 case  GSS_S_UNAVAILABLE:
 205                         error = "GSS_S_UNAVAILABLE";
 206                         break;
 207                 case  GSS_S_DUPLICATE_ELEMENT:
 208                         error = "GSS_S_DUPLICATE_ELEMENT";
 209                         break;
 210                 case  GSS_S_NAME_NOT_MN:
 211                         error = "GSS_S_NAME_NOT_MN";
 212                         break;
 213                 default:
 214                         error = "Not defined";
 215                 }
 216         return error;
 217 }
 218
 219 static void
 220 display_status_2(char *m, u_int32_t major, u_int32_t minor, const gss_OID mech)
 221 {
 222         u_int32_t maj_stat1, min_stat1;
 223         u_int32_t maj_stat2, min_stat2;
 224         gss_buffer_desc maj_gss_buf = GSS_C_EMPTY_BUFFER;
 225         gss_buffer_desc min_gss_buf = GSS_C_EMPTY_BUFFER;
 226         char maj_buf[30], min_buf[30];
 227         char *maj, *min;
 228         u_int32_t msg_ctx = 0;
 229         int msg_verbosity = 0;
 230
 231         /* Get major status message */
 232         maj_stat1 = gss_display_status(&min_stat1, major,
 233                 GSS_C_GSS_CODE, mech, &msg_ctx, &maj_gss_buf);
 234
 235         if (maj_stat1 != GSS_S_COMPLETE) {
 236                 snprintf(maj_buf, sizeof(maj_buf), "(0x%08x)", major);
 237                 maj = &maj_buf[0];
 238         } else {
 239                 maj = maj_gss_buf.value;
 240         }
 241
 242         /* Get minor status message */
 243         maj_stat2 = gss_display_status(&min_stat2, minor,
 244                 GSS_C_MECH_CODE, mech, &msg_ctx, &min_gss_buf);
 245
 246         if (maj_stat2 != GSS_S_COMPLETE) {
 247                 snprintf(min_buf, sizeof(min_buf), "(0x%08x)", minor);
 248                 min = &min_buf[0];
 249         } else {
 250                 min = min_gss_buf.value;
 251         }
 252
 253         if (major == GSS_S_CREDENTIALS_EXPIRED)
 254                 msg_verbosity = 1;
 255         printerr(msg_verbosity, "ERROR: GSS-API: error in %s(): %s (%s) - %s(%s)\n",
 256                  m, gss_display_error(major), maj, min);
 257
 258         if (maj_gss_buf.length != 0)
 259                 (void) gss_release_buffer(&min_stat1, &maj_gss_buf);
 260         if (min_gss_buf.length != 0)
 261                 (void) gss_release_buffer(&min_stat2, &min_gss_buf);
 262 }
 263
 264 void
 265 pgsserr(char *msg, u_int32_t maj_stat, u_int32_t min_stat, const gss_OID mech)
 266 {
 267         display_status_2(msg, maj_stat, min_stat, mech);
 268 }
 269
 270 int
 271 gssd_acquire_cred(char *server_name, const gss_OID oid)
 272 {
 273         gss_buffer_desc name;
 274         gss_name_t target_name;
 275         u_int32_t maj_stat, min_stat;
 276         u_int32_t ignore_maj_stat, ignore_min_stat;
 277         gss_buffer_desc pbuf;
 278
 279         /* If server_name is NULL, get cred for GSS_C_NO_NAME */
 280         if (server_name == NULL) {
 281                 target_name = GSS_C_NO_NAME;
 282         } else {
 283                 name.value = (void *)server_name;
 284                 name.length = strlen(server_name);
 285
 286                 maj_stat = gss_import_name(&min_stat, &name,
 287                                 oid,
 288                                 &target_name);
 289
 290                 if (maj_stat != GSS_S_COMPLETE) {
 291                         pgsserr("gss_import_name", maj_stat, min_stat, g_mechOid);
 292                         return (FALSE);
 293                 }
 294         }
 295
 296         maj_stat = gss_acquire_cred(&min_stat, target_name, GSS_C_INDEFINITE,
 297                         GSS_C_NO_OID_SET, GSS_C_ACCEPT,
 298                         &gssd_creds, NULL, NULL);
 299
 300         if (maj_stat != GSS_S_COMPLETE) {
 301                 pgsserr("gss_acquire_cred", maj_stat, min_stat, g_mechOid);
 302                 ignore_maj_stat = gss_display_name(&ignore_min_stat,
 303                                 target_name, &pbuf, NULL);
 304                 if (ignore_maj_stat == GSS_S_COMPLETE) {
 305                         printerr(1, "Unable to obtain credentials for '%.*s'\n",
 306                                  pbuf.length, pbuf.value);
 307                         ignore_maj_stat = gss_release_buffer(&ignore_min_stat,
 308                                                              &pbuf);
 309                 }
 310         }
 311
 312         ignore_maj_stat = gss_release_name(&ignore_min_stat, &target_name);
 313
 314         return (maj_stat == GSS_S_COMPLETE);
 315 }
 316
 317 int gssd_check_mechs(void)
 318 {
 319         u_int32_t maj_stat, min_stat;
 320         gss_OID_set supported_mechs = GSS_C_NO_OID_SET;
 321         int retval = -1;
 322
 323         maj_stat = gss_indicate_mechs(&min_stat, &supported_mechs);
 324         if (maj_stat != GSS_S_COMPLETE) {
 325                 printerr(0, "Unable to obtain list of supported mechanisms. "
 326                          "Check that gss library is properly configured.\n");
 327                 goto out;
 328         }
 329         if (supported_mechs == GSS_C_NO_OID_SET ||
 330             supported_mechs->count == 0) {
 331                 printerr(0, "Unable to obtain list of supported mechanisms. "
 332                          "Check that gss library is properly configured.\n");
 333                 goto out;
 334         }
 335         maj_stat = gss_release_oid_set(&min_stat, &supported_mechs);
 336         retval = 0;
 337 out:
 338         return retval;
 339 }
 340