dbcd979016c629ae3ad10cb418c27369a5d600af
[bbaumbach/samba-autobuild/.git] / source4 / auth / kerberos / krb5_init_context.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Wrapper for krb5_init_context
4
5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6    Copyright (C) Andrew Tridgell 2005
7    Copyright (C) Stefan Metzmacher 2004
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 2 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program; if not, write to the Free Software
21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25 #include "system/kerberos.h"
26 #include "auth/kerberos/kerberos.h"
27 #include "lib/socket/socket.h"
28 #include "system/network.h"
29 #include "lib/events/events.h"
30 #include "roken.h"
31
32 /*
33   context structure for operations on cldap packets
34 */
35 struct smb_krb5_socket {
36         struct socket_context *sock;
37
38         /* the fd event */
39         struct fd_event *fde;
40
41         BOOL timeout;
42         NTSTATUS status;
43         DATA_BLOB request, reply, partial;
44
45         size_t partial_read;
46
47         krb5_krbhst_info *hi;
48 };
49
50 static int smb_krb5_context_destroy_1(void *ptr) 
51 {
52         struct smb_krb5_context *ctx = ptr;
53         krb5_free_context(ctx->krb5_context); 
54         return 0;
55 }
56
57 static int smb_krb5_context_destroy_2(void *ptr) 
58 {
59         struct smb_krb5_context *ctx = ptr;
60
61         /* Otherwise krb5_free_context will try and close what we have already free()ed */
62         krb5_set_warn_dest(ctx->krb5_context, NULL);
63         krb5_closelog(ctx->krb5_context, ctx->logf);
64         smb_krb5_context_destroy_1(ptr);
65         return 0;
66 }
67
68 /* We never close down the DEBUG system, and no need to unreference the use */
69 static void smb_krb5_debug_close(void *private) {
70         return;
71 }
72
73 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private) 
74 {
75         DEBUG(3, ("Kerberos: %s\n", msg));
76 }
77
78 /*
79   handle recv events on a smb_krb5 socket
80 */
81 static void smb_krb5_socket_recv(struct smb_krb5_socket *smb_krb5)
82 {
83         TALLOC_CTX *tmp_ctx = talloc_new(smb_krb5);
84         DATA_BLOB blob;
85         size_t nread, dsize;
86
87         switch (smb_krb5->hi->proto) {
88         case KRB5_KRBHST_UDP:
89                 smb_krb5->status = socket_pending(smb_krb5->sock, &dsize);
90                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
91                         talloc_free(tmp_ctx);
92                         return;
93                 }
94
95                 blob = data_blob_talloc(tmp_ctx, NULL, dsize);
96                 if (blob.data == NULL && dsize != 0) {
97                         smb_krb5->status = NT_STATUS_NO_MEMORY;
98                         talloc_free(tmp_ctx);
99                         return;
100                 }
101                 
102                 smb_krb5->status = socket_recv(smb_krb5->sock, blob.data, blob.length, &nread, 0);
103                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
104                         talloc_free(tmp_ctx);
105                         return;
106                 }
107                 blob.length = nread;
108
109                 if (nread == 0) {
110                         smb_krb5->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
111                         talloc_free(tmp_ctx);
112                         return;
113                 }
114                 
115                 DEBUG(2,("Received smb_krb5 packet of length %d\n", 
116                          (int)blob.length));
117                 
118                 talloc_steal(smb_krb5, blob.data);
119                 smb_krb5->reply = blob;
120                 talloc_free(tmp_ctx);
121                 break;
122         case KRB5_KRBHST_TCP:
123                 if (smb_krb5->partial.length == 0) {
124                         smb_krb5->partial = data_blob_talloc(smb_krb5, NULL, 4);
125                         if (!smb_krb5->partial.data) {
126                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
127                                 return;
128                         }
129                         
130                         smb_krb5->partial_read = 0;
131                 }
132                 
133                 /* read in the packet length */
134                 if (smb_krb5->partial_read < 4) {
135                         uint32_t packet_length;
136                         
137                         smb_krb5->status = socket_recv(smb_krb5->sock, 
138                                              smb_krb5->partial.data + smb_krb5->partial_read,
139                                              4 - smb_krb5->partial_read,
140                                              &nread, 0);
141                         /* todo: this should be converted to the packet_*() routines */
142                         if (!NT_STATUS_IS_OK(smb_krb5->status)) {
143                                 return;
144                         }
145                         
146                         smb_krb5->partial_read += nread;
147                         if (smb_krb5->partial_read != 4) {
148                                 return;
149                         }
150                         
151                         packet_length = RIVAL(smb_krb5->partial.data, 0);
152                         
153                         smb_krb5->partial.data = talloc_realloc(smb_krb5, smb_krb5->partial.data, 
154                                                                 uint8_t, packet_length + 4);
155                         if (!smb_krb5->partial.data)  {
156                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
157                                 return;
158                         }
159                         
160                         smb_krb5->partial.length = packet_length + 4;
161                 }
162                 
163                 /* read in the body */
164                 smb_krb5->status = socket_recv(smb_krb5->sock, 
165                                      smb_krb5->partial.data + smb_krb5->partial_read,
166                                      smb_krb5->partial.length - smb_krb5->partial_read,
167                                      &nread, 0);
168                 if (!NT_STATUS_IS_OK(smb_krb5->status)) return;
169                 
170                 smb_krb5->partial_read += nread;
171
172                 if (smb_krb5->partial_read != smb_krb5->partial.length) return;
173
174                 smb_krb5->reply = data_blob_talloc(smb_krb5, smb_krb5->partial.data + 4, smb_krb5->partial.length - 4);
175                 break;
176         case KRB5_KRBHST_HTTP:
177                 return;
178         }
179 }
180
181 /*
182   handle request timeouts
183 */
184 static void smb_krb5_request_timeout(struct event_context *event_ctx, 
185                                   struct timed_event *te, struct timeval t,
186                                   void *private)
187 {
188         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
189         DEBUG(5,("Timed out smb_krb5 packet\n"));
190         smb_krb5->timeout = True;
191 }
192
193 /*
194   handle send events on a smb_krb5 socket
195 */
196 static void smb_krb5_socket_send(struct smb_krb5_socket *smb_krb5)
197 {
198         NTSTATUS status;
199
200         size_t len;
201         
202         len = smb_krb5->request.length;
203         status = socket_send(smb_krb5->sock, &smb_krb5->request, &len, 0);
204
205         if (!NT_STATUS_IS_OK(status)) return;
206         
207         EVENT_FD_READABLE(smb_krb5->fde);
208
209         EVENT_FD_NOT_WRITEABLE(smb_krb5->fde);
210         return;
211 }
212
213
214 /*
215   handle fd events on a smb_krb5_socket
216 */
217 static void smb_krb5_socket_handler(struct event_context *ev, struct fd_event *fde,
218                                  uint16_t flags, void *private)
219 {
220         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
221         if (flags & EVENT_FD_WRITE) {
222                 smb_krb5_socket_send(smb_krb5);
223         } 
224         if (flags & EVENT_FD_READ) {
225                 smb_krb5_socket_recv(smb_krb5);
226         }
227 }
228
229
230 static krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
231                                                    void *data,
232                                                    krb5_krbhst_info *hi,
233                                                    const krb5_data *send_buf,
234                                                    krb5_data *recv_buf)
235 {
236         krb5_error_code ret;
237         NTSTATUS status;
238         struct socket_address *remote_addr;
239         const char *name;
240         struct addrinfo *ai, *a;
241         struct smb_krb5_socket *smb_krb5;
242
243         struct event_context *ev = talloc_get_type(data, struct event_context);
244
245         DATA_BLOB send_blob = data_blob_const(send_buf->data, send_buf->length);
246
247         ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
248         if (ret) {
249                 return ret;
250         }
251
252         for (a = ai; a; a = ai->ai_next) {
253                 smb_krb5 = talloc(NULL, struct smb_krb5_socket);
254                 if (!smb_krb5) {
255                         return ENOMEM;
256                 }
257                 smb_krb5->hi = hi;
258                 
259                 switch (a->ai_family) {
260                 case PF_INET:
261                         name = "ipv4";
262                         break;
263                 case PF_INET6:
264                         name = "ipv6";
265                         break;
266                 default:
267                         talloc_free(smb_krb5);
268                         return EINVAL;
269                 }
270                 
271                 status = NT_STATUS_INVALID_PARAMETER;
272                 switch (hi->proto) {
273                 case KRB5_KRBHST_UDP:
274                         if (lp_parm_bool(-1, "krb5", "udp", True)) {
275                                 status = socket_create(name, SOCKET_TYPE_DGRAM, &smb_krb5->sock, 0);
276                         }
277                         break;
278                 case KRB5_KRBHST_TCP:
279                         if (lp_parm_bool(-1, "krb5", "tcp", True)) {
280                                 status = socket_create(name, SOCKET_TYPE_STREAM, &smb_krb5->sock, 0);
281                         }
282                         break;
283                 case KRB5_KRBHST_HTTP:
284                         talloc_free(smb_krb5);
285                         return EINVAL;
286                 }
287                 if (!NT_STATUS_IS_OK(status)) {
288                         talloc_free(smb_krb5);
289                         continue;
290                 }
291
292                 talloc_steal(smb_krb5, smb_krb5->sock);
293                 
294                 remote_addr = socket_address_from_sockaddr(smb_krb5, a->ai_addr, a->ai_addrlen); 
295                 if (!remote_addr) {
296                         talloc_free(smb_krb5);
297                         continue;
298                 }
299
300                 status = socket_connect_ev(smb_krb5->sock, NULL, remote_addr, 0, ev); 
301                 if (!NT_STATUS_IS_OK(status)) {
302                         talloc_free(smb_krb5);
303                         continue;
304                 }
305                 talloc_free(remote_addr);
306
307                 smb_krb5->fde = event_add_fd(ev, smb_krb5, 
308                                              socket_get_fd(smb_krb5->sock), 0,
309                                              smb_krb5_socket_handler, smb_krb5);
310
311                 event_add_timed(ev, smb_krb5, 
312                                 timeval_current_ofs(context->kdc_timeout, 0),
313                                 smb_krb5_request_timeout, smb_krb5);
314
315                 EVENT_FD_WRITEABLE(smb_krb5->fde);
316                 
317                 switch (hi->proto) {
318                 case KRB5_KRBHST_UDP:
319                         smb_krb5->request = send_blob;
320                         break;
321                 case KRB5_KRBHST_TCP:
322                         smb_krb5->request = data_blob_talloc(smb_krb5, NULL, send_blob.length + 4);
323                         RSIVAL(smb_krb5->request.data, 0, send_blob.length);
324                         memcpy(smb_krb5->request.data+4, send_blob.data, send_blob.length);
325                         break;
326                 case KRB5_KRBHST_HTTP:
327                         talloc_free(smb_krb5);
328                         return EINVAL;
329                 }
330                 smb_krb5->timeout = False;
331                 smb_krb5->status = NT_STATUS_OK;
332                 smb_krb5->reply = data_blob(NULL, 0);
333                 smb_krb5->partial = data_blob(NULL, 0);
334
335                 while (!smb_krb5->timeout && (NT_STATUS_IS_OK(smb_krb5->status)) && !smb_krb5->reply.length) {
336                         if (event_loop_once(ev) != 0) {
337                                 talloc_free(smb_krb5);
338                                 return EINVAL;
339                         }
340                 }
341                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
342                         DEBUG(2,("Error reading smb_krb5 reply packet: %s\n", nt_errstr(smb_krb5->status)));
343                         talloc_free(smb_krb5);
344                         continue;
345                 }
346
347                 if (smb_krb5->timeout) {
348                         talloc_free(smb_krb5);
349                         continue;
350                 }
351
352                 ret = krb5_data_copy(recv_buf, smb_krb5->reply.data, smb_krb5->reply.length);
353                 if (ret) {
354                         talloc_free(smb_krb5);
355                         return ret;
356                 }
357                 talloc_free(smb_krb5);
358                 
359                 break;
360         }
361         if (a) {
362                 return 0;
363         }
364         return KRB5_KDC_UNREACH;
365 }
366
367 /* NO internal data, so nothing to free */
368 static void smb_krb5_send_and_recv_close_func(krb5_context context, void *data) 
369 {
370         return;
371 }
372
373
374 krb5_error_code smb_krb5_init_context(void *parent_ctx, 
375                                        struct smb_krb5_context **smb_krb5_context) 
376 {
377         krb5_error_code ret;
378         TALLOC_CTX *tmp_ctx;
379         struct event_context *ev;
380         
381         initialize_krb5_error_table();
382         
383         tmp_ctx = talloc_new(parent_ctx);
384         *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context);
385
386         if (!*smb_krb5_context || !tmp_ctx) {
387                 talloc_free(*smb_krb5_context);
388                 talloc_free(tmp_ctx);
389                 return ENOMEM;
390         }
391
392         ret = krb5_init_context(&(*smb_krb5_context)->krb5_context);
393         if (ret) {
394                 DEBUG(1,("krb5_init_context failed (%s)\n", 
395                          error_message(ret)));
396                 return ret;
397         }
398
399         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1);
400
401         if (lp_realm() && *lp_realm()) {
402                 char *upper_realm = strupper_talloc(tmp_ctx, lp_realm());
403                 if (!upper_realm) {
404                         DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm()));
405                         talloc_free(tmp_ctx);
406                         return ENOMEM;
407                 }
408                 ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, upper_realm);
409                 if (ret) {
410                         DEBUG(1,("krb5_set_default_realm failed (%s)\n", 
411                                  smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
412                         talloc_free(tmp_ctx);
413                         return ret;
414                 }
415         }
416
417         /* TODO: Should we have a different name here? */
418         ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
419         
420         if (ret) {
421                 DEBUG(1,("krb5_initlog failed (%s)\n", 
422                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
423                 talloc_free(tmp_ctx);
424                 return ret;
425         }
426
427         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2);
428
429         ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */, 
430                                smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
431         if (ret) {
432                 DEBUG(1,("krb5_addlog_func failed (%s)\n", 
433                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
434                 talloc_free(tmp_ctx);
435                 return ret;
436         }
437         krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
438
439         ev = event_context_find(*smb_krb5_context);
440         /* Set use of our socket lib */
441         ret = krb5_set_send_recv_func((*smb_krb5_context)->krb5_context, 
442                                       smb_krb5_send_and_recv_func, 
443                                       smb_krb5_send_and_recv_close_func, ev);
444         if (ret) {
445                 DEBUG(1,("krb5_set_send_recv_func failed (%s)\n", 
446                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
447                 talloc_free(tmp_ctx);
448                 return ret;
449         }
450
451         (*smb_krb5_context)->krb5_context->mem_ctx = *smb_krb5_context;
452
453         talloc_steal(parent_ctx, *smb_krb5_context);
454         talloc_free(tmp_ctx);
455
456         /* Set options in kerberos */
457
458         (*smb_krb5_context)->krb5_context->fdns = FALSE;
459
460         return 0;
461 }
462
463  void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context) 
464 {
465         talloc_free(smb_krb5_context);
466 }