Remove __contains__ from mock object for consistency with actual
[samba.git] / client / cifs.upcall.c
index 1645322297af503c7268f5720da7ecc220b264b0..42632a0da09308ebc1f54256932b489626253c18 100644 (file)
@@ -26,11 +26,18 @@ create dns_resolver * * /usr/local/sbin/cifs.upcall %k
 */
 
 #include "includes.h"
+#include "../libcli/auth/spnego.h"
+#include "smb_krb5.h"
 #include <keyutils.h>
 #include <getopt.h>
 
 #include "cifs_spnego.h"
 
+#define        CIFS_DEFAULT_KRB5_DIR           "/tmp"
+#define        CIFS_DEFAULT_KRB5_PREFIX        "krb5cc_"
+
+#define        MAX_CCNAME_LEN                  PATH_MAX + 5
+
 const char *CIFSSPNEGO_VERSION = "1.3";
 static const char *prog = "cifs.upcall";
 typedef enum _sectype {
@@ -39,60 +46,151 @@ typedef enum _sectype {
        MS_KRB5
 } sectype_t;
 
-/*
- * given a process ID, get the value of the KRB5CCNAME environment variable
- * in the context of that process. On error, just return NULL.
- */
-static char *
-get_krb5_ccname(pid_t pid)
-{
-       int fd;
-       ssize_t len, left;
+/* does the ccache have a valid TGT? */
+static time_t
+get_tgt_time(const char *ccname) {
+       krb5_context context;
+       krb5_ccache ccache;
+       krb5_cc_cursor cur;
+       krb5_creds creds;
+       krb5_principal principal;
+       time_t credtime = 0;
+       char *realm = NULL;
+       TALLOC_CTX *mem_ctx;
+
+       if (krb5_init_context(&context)) {
+               syslog(LOG_DEBUG, "%s: unable to init krb5 context", __func__);
+               return 0;
+       }
 
-       /*
-        * FIXME: sysconf for ARG_MAX instead? Kernel seems to be limited to a
-        * page however, so it may not matter.
-        */
-       char buf[4096];
-       char *p, *value = NULL;
-       
-       buf[4095] = '\0';
-       snprintf(buf, 4095, "/proc/%d/environ", pid);
-       fd = open(buf, O_RDONLY);
-       if (fd < 0) {
-               syslog(LOG_DEBUG, "%s: unable to open %s: %d", __func__, buf,
-                       errno);
-               return NULL;
+       if (krb5_cc_resolve(context, ccname, &ccache)) {
+               syslog(LOG_DEBUG, "%s: unable to resolve krb5 cache", __func__);
+               goto err_cache;
+       }
+
+       if (krb5_cc_set_flags(context, ccache, 0)) {
+               syslog(LOG_DEBUG, "%s: unable to set flags", __func__);
+               goto err_cache;
+       }
+
+       if (krb5_cc_get_principal(context, ccache, &principal)) {
+               syslog(LOG_DEBUG, "%s: unable to get principal", __func__);
+               goto err_princ;
        }
 
-       /* FIXME: don't assume that we get it all in the first read? */
-       len = read(fd, buf, 4096);
-       close(fd);
-       if (len < 0) {
-               syslog(LOG_DEBUG, "%s: unable to read from /proc/%d/environ: "
-                                 "%d", __func__, pid, errno);
+       if (krb5_cc_start_seq_get(context, ccache, &cur)) {
+               syslog(LOG_DEBUG, "%s: unable to seq start", __func__);
+               goto err_ccstart;
+       }
+
+       if ((realm = smb_krb5_principal_get_realm(context, principal)) == NULL) {
+               syslog(LOG_DEBUG, "%s: unable to get realm", __func__);
+               goto err_ccstart;
+       }
+
+       mem_ctx = talloc_init("cifs.upcall");
+       while (!credtime && !krb5_cc_next_cred(context, ccache, &cur, &creds)) {
+               char *name;
+               if (smb_krb5_unparse_name(mem_ctx, context, creds.server, &name)) {
+                       syslog(LOG_DEBUG, "%s: unable to unparse name", __func__);
+                       goto err_endseq;
+               }
+               if (krb5_realm_compare(context, creds.server, principal) &&
+                   strnequal(name, KRB5_TGS_NAME, KRB5_TGS_NAME_SIZE) &&
+                   strnequal(name+KRB5_TGS_NAME_SIZE+1, realm, strlen(realm)) &&
+                   creds.times.endtime > time(NULL))
+                       credtime = creds.times.endtime;
+                krb5_free_cred_contents(context, &creds);
+               TALLOC_FREE(name);
+        }
+err_endseq:
+       TALLOC_FREE(mem_ctx);
+        krb5_cc_end_seq_get(context, ccache, &cur);
+err_ccstart:
+       krb5_free_principal(context, principal);
+err_princ:
+#if defined(KRB5_TC_OPENCLOSE)
+       krb5_cc_set_flags(context, ccache, KRB5_TC_OPENCLOSE);
+#endif
+       krb5_cc_close(context, ccache);
+err_cache:
+       krb5_free_context(context);
+       return credtime;
+}
+
+static int
+krb5cc_filter(const struct dirent *dirent)
+{
+       if (strstr(dirent->d_name, CIFS_DEFAULT_KRB5_PREFIX))
+               return 1;
+       else
+               return 0;
+}
+
+/* search for a credcache that looks like a likely candidate */
+static char *
+find_krb5_cc(const char *dirname, uid_t uid)
+{
+       struct dirent **namelist;
+       struct stat sbuf;
+       char ccname[MAX_CCNAME_LEN], *credpath, *best_cache = NULL;
+       int i, n;
+       time_t cred_time, best_time = 0;
+
+       n = scandir(dirname, &namelist, krb5cc_filter, NULL);
+       if (n < 0) {
+               syslog(LOG_DEBUG, "%s: scandir error on directory '%s': %s",
+                                 __func__, dirname, strerror(errno));
                return NULL;
        }
 
-       left = len;
-       p = buf;
+       for (i = 0; i < n; i++) {
+               snprintf(ccname, sizeof(ccname), "FILE:%s/%s", dirname,
+                        namelist[i]->d_name);
+               credpath = ccname + 5;
+               syslog(LOG_DEBUG, "%s: considering %s", __func__, credpath);
 
-       /* can't have valid KRB5CCNAME if there are < 13 bytes left */
-       while (left > 12) {
-               if (strncmp("KRB5CCNAME=", p, 11)) {
-                       p += strnlen(p, left);
-                       ++p;
-                       left = buf + len - p;
+               if (lstat(credpath, &sbuf)) {
+                       syslog(LOG_DEBUG, "%s: stat error on '%s': %s",
+                                         __func__, credpath, strerror(errno));
+                       free(namelist[i]);
                        continue;
                }
-               p += 11;
-               left -= 11;
-               value = SMB_STRNDUP(p, left);
-               break;
+               if (sbuf.st_uid != uid) {
+                       syslog(LOG_DEBUG, "%s: %s is owned by %u, not %u",
+                                       __func__, credpath, sbuf.st_uid, uid);
+                       free(namelist[i]);
+                       continue;
+               }
+               if (!S_ISREG(sbuf.st_mode)) {
+                       syslog(LOG_DEBUG, "%s: %s is not a regular file",
+                                       __func__, credpath);
+                       free(namelist[i]);
+                       continue;
+               }
+               if (!(cred_time = get_tgt_time(ccname))) {
+                       syslog(LOG_DEBUG, "%s: %s is not a valid credcache.",
+                                       __func__, ccname);
+                       free(namelist[i]);
+                       continue;
+               }
+
+               if (cred_time <= best_time) {
+                       syslog(LOG_DEBUG, "%s: %s expires sooner than current "
+                                         "best.", __func__, ccname);
+                       free(namelist[i]);
+                       continue;
+               }
+
+               syslog(LOG_DEBUG, "%s: %s is valid ccache", __func__, ccname);
+               free(best_cache);
+               best_cache = SMB_STRNDUP(ccname, MAX_CCNAME_LEN);
+               best_time = cred_time;
+               free(namelist[i]);
        }
-       syslog(LOG_DEBUG, "%s: KRB5CCNAME=%s", __func__,
-                               value ? value : "(null)");
-       return value;
+       free(namelist);
+
+       return best_cache;
 }
 
 /*
@@ -127,7 +225,7 @@ handle_krb5_mech(const char *oid, const char *principal, DATA_BLOB *secblob,
 
        /* get a kerberos ticket for the service and extract the session key */
        retval = cli_krb5_get_ticket(principal, 0, &tkt, sess_key, 0, ccname,
-                                    NULL);
+                                    NULL, NULL);
 
        if (retval) {
                syslog(LOG_DEBUG, "%s: failed to obtain service ticket (%d)",
@@ -453,10 +551,9 @@ int main(const int argc, char *const argv[])
                        syslog(LOG_ERR, "setuid: %s", strerror(errno));
                        goto out;
                }
-       }
 
-       if (have & DKD_HAVE_PID)
-               ccname = get_krb5_ccname(arg.pid);
+               ccname = find_krb5_cc(CIFS_DEFAULT_KRB5_DIR, arg.uid);
+       }
 
        host = arg.hostname;