source4/auth/kerberos/krb5_init_context.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Wrapper for krb5_init_context
   4
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   6    Copyright (C) Andrew Tridgell 2005
   7    Copyright (C) Stefan Metzmacher 2004
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "system/kerberos.h"
  26 #include "heimdal/lib/krb5/krb5_locl.h"
  27 #include "auth/kerberos/kerberos.h"
  28 #include "lib/socket/socket.h"
  29 #include "system/network.h"
  30 #include "lib/events/events.h"
  31 #include "roken.h"
  32
  33 /*
  34   context structure for operations on cldap packets
  35 */
  36 struct smb_krb5_socket {
  37         struct socket_context *sock;
  38
  39         /* the fd event */
  40         struct fd_event *fde;
  41
  42         BOOL timeout;
  43         NTSTATUS status;
  44         DATA_BLOB request, reply, partial;
  45
  46         size_t partial_read;
  47
  48         krb5_krbhst_info *hi;
  49 };
  50
  51 static int smb_krb5_context_destroy_1(struct smb_krb5_context *ctx)
  52 {
  53         krb5_free_context(ctx->krb5_context);
  54         return 0;
  55 }
  56
  57 static int smb_krb5_context_destroy_2(struct smb_krb5_context *ctx)
  58 {
  59         /* Otherwise krb5_free_context will try and close what we have already free()ed */
  60         krb5_set_warn_dest(ctx->krb5_context, NULL);
  61         krb5_closelog(ctx->krb5_context, ctx->logf);
  62         smb_krb5_context_destroy_1(ctx);
  63         return 0;
  64 }
  65
  66 /* We never close down the DEBUG system, and no need to unreference the use */
  67 static void smb_krb5_debug_close(void *private) {
  68         return;
  69 }
  70
  71 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private)
  72 {
  73         DEBUG(2, ("Kerberos: %s\n", msg));
  74 }
  75
  76 /*
  77   handle recv events on a smb_krb5 socket
  78 */
  79 static void smb_krb5_socket_recv(struct smb_krb5_socket *smb_krb5)
  80 {
  81         TALLOC_CTX *tmp_ctx = talloc_new(smb_krb5);
  82         DATA_BLOB blob;
  83         size_t nread, dsize;
  84
  85         switch (smb_krb5->hi->proto) {
  86         case KRB5_KRBHST_UDP:
  87                 smb_krb5->status = socket_pending(smb_krb5->sock, &dsize);
  88                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
  89                         talloc_free(tmp_ctx);
  90                         return;
  91                 }
  92
  93                 blob = data_blob_talloc(tmp_ctx, NULL, dsize);
  94                 if (blob.data == NULL && dsize != 0) {
  95                         smb_krb5->status = NT_STATUS_NO_MEMORY;
  96                         talloc_free(tmp_ctx);
  97                         return;
  98                 }
  99
 100                 smb_krb5->status = socket_recv(smb_krb5->sock, blob.data, blob.length, &nread);
 101                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
 102                         talloc_free(tmp_ctx);
 103                         return;
 104                 }
 105                 blob.length = nread;
 106
 107                 if (nread == 0) {
 108                         smb_krb5->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 109                         talloc_free(tmp_ctx);
 110                         return;
 111                 }
 112
 113                 DEBUG(2,("Received smb_krb5 packet of length %d\n",
 114                          (int)blob.length));
 115
 116                 talloc_steal(smb_krb5, blob.data);
 117                 smb_krb5->reply = blob;
 118                 talloc_free(tmp_ctx);
 119                 break;
 120         case KRB5_KRBHST_TCP:
 121                 if (smb_krb5->partial.length == 0) {
 122                         smb_krb5->partial = data_blob_talloc(smb_krb5, NULL, 4);
 123                         if (!smb_krb5->partial.data) {
 124                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
 125                                 return;
 126                         }
 127
 128                         smb_krb5->partial_read = 0;
 129                 }
 130
 131                 /* read in the packet length */
 132                 if (smb_krb5->partial_read < 4) {
 133                         uint32_t packet_length;
 134
 135                         smb_krb5->status = socket_recv(smb_krb5->sock,
 136                                              smb_krb5->partial.data + smb_krb5->partial_read,
 137                                              4 - smb_krb5->partial_read,
 138                                              &nread);
 139                         /* todo: this should be converted to the packet_*() routines */
 140                         if (!NT_STATUS_IS_OK(smb_krb5->status)) {
 141                                 return;
 142                         }
 143
 144                         smb_krb5->partial_read += nread;
 145                         if (smb_krb5->partial_read != 4) {
 146                                 return;
 147                         }
 148
 149                         packet_length = RIVAL(smb_krb5->partial.data, 0);
 150
 151                         smb_krb5->partial.data = talloc_realloc(smb_krb5, smb_krb5->partial.data,
 152                                                                 uint8_t, packet_length + 4);
 153                         if (!smb_krb5->partial.data)  {
 154                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
 155                                 return;
 156                         }
 157
 158                         smb_krb5->partial.length = packet_length + 4;
 159                 }
 160
 161                 /* read in the body */
 162                 smb_krb5->status = socket_recv(smb_krb5->sock,
 163                                      smb_krb5->partial.data + smb_krb5->partial_read,
 164                                      smb_krb5->partial.length - smb_krb5->partial_read,
 165                                      &nread);
 166                 if (!NT_STATUS_IS_OK(smb_krb5->status)) return;
 167
 168                 smb_krb5->partial_read += nread;
 169
 170                 if (smb_krb5->partial_read != smb_krb5->partial.length) return;
 171
 172                 smb_krb5->reply = data_blob_talloc(smb_krb5, smb_krb5->partial.data + 4, smb_krb5->partial.length - 4);
 173                 break;
 174         case KRB5_KRBHST_HTTP:
 175                 return;
 176         }
 177 }
 178
 179 /*
 180   handle request timeouts
 181 */
 182 static void smb_krb5_request_timeout(struct event_context *event_ctx,
 183                                   struct timed_event *te, struct timeval t,
 184                                   void *private)
 185 {
 186         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
 187         DEBUG(5,("Timed out smb_krb5 packet\n"));
 188         smb_krb5->timeout = True;
 189 }
 190
 191 /*
 192   handle send events on a smb_krb5 socket
 193 */
 194 static void smb_krb5_socket_send(struct smb_krb5_socket *smb_krb5)
 195 {
 196         NTSTATUS status;
 197
 198         size_t len;
 199
 200         len = smb_krb5->request.length;
 201         status = socket_send(smb_krb5->sock, &smb_krb5->request, &len);
 202
 203         if (!NT_STATUS_IS_OK(status)) return;
 204
 205         EVENT_FD_READABLE(smb_krb5->fde);
 206
 207         EVENT_FD_NOT_WRITEABLE(smb_krb5->fde);
 208         return;
 209 }
 210
 211
 212 /*
 213   handle fd events on a smb_krb5_socket
 214 */
 215 static void smb_krb5_socket_handler(struct event_context *ev, struct fd_event *fde,
 216                                  uint16_t flags, void *private)
 217 {
 218         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
 219         if (flags & EVENT_FD_WRITE) {
 220                 smb_krb5_socket_send(smb_krb5);
 221         }
 222         if (flags & EVENT_FD_READ) {
 223                 smb_krb5_socket_recv(smb_krb5);
 224         }
 225 }
 226
 227
 228 krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
 229                                             void *data,
 230                                             krb5_krbhst_info *hi,
 231                                             const krb5_data *send_buf,
 232                                             krb5_data *recv_buf)
 233 {
 234         krb5_error_code ret;
 235         NTSTATUS status;
 236         struct socket_address *remote_addr;
 237         const char *name;
 238         struct addrinfo *ai, *a;
 239         struct smb_krb5_socket *smb_krb5;
 240
 241         struct event_context *ev = talloc_get_type(data, struct event_context);
 242
 243         DATA_BLOB send_blob = data_blob_const(send_buf->data, send_buf->length);
 244
 245         ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
 246         if (ret) {
 247                 return ret;
 248         }
 249
 250         for (a = ai; a; a = ai->ai_next) {
 251                 smb_krb5 = talloc(NULL, struct smb_krb5_socket);
 252                 if (!smb_krb5) {
 253                         return ENOMEM;
 254                 }
 255                 smb_krb5->hi = hi;
 256
 257                 switch (a->ai_family) {
 258                 case PF_INET:
 259                         name = "ipv4";
 260                         break;
 261 #ifdef HAVE_SOCKET_IPV6
 262                 case PF_INET6:
 263                         name = "ipv6";
 264                         break;
 265 #endif
 266                 default:
 267                         talloc_free(smb_krb5);
 268                         return EINVAL;
 269                 }
 270
 271                 status = NT_STATUS_INVALID_PARAMETER;
 272                 switch (hi->proto) {
 273                 case KRB5_KRBHST_UDP:
 274                         if (lp_parm_bool(-1, "krb5", "udp", True)) {
 275                                 status = socket_create(name, SOCKET_TYPE_DGRAM, &smb_krb5->sock, 0);
 276                         }
 277                         break;
 278                 case KRB5_KRBHST_TCP:
 279                         if (lp_parm_bool(-1, "krb5", "tcp", True)) {
 280                                 status = socket_create(name, SOCKET_TYPE_STREAM, &smb_krb5->sock, 0);
 281                         }
 282                         break;
 283                 case KRB5_KRBHST_HTTP:
 284                         talloc_free(smb_krb5);
 285                         return EINVAL;
 286                 }
 287                 if (!NT_STATUS_IS_OK(status)) {
 288                         talloc_free(smb_krb5);
 289                         continue;
 290                 }
 291
 292                 talloc_steal(smb_krb5, smb_krb5->sock);
 293
 294                 remote_addr = socket_address_from_sockaddr(smb_krb5, a->ai_addr, a->ai_addrlen);
 295                 if (!remote_addr) {
 296                         talloc_free(smb_krb5);
 297                         continue;
 298                 }
 299
 300                 status = socket_connect_ev(smb_krb5->sock, NULL, remote_addr, 0, ev);
 301                 if (!NT_STATUS_IS_OK(status)) {
 302                         talloc_free(smb_krb5);
 303                         continue;
 304                 }
 305                 talloc_free(remote_addr);
 306
 307                 smb_krb5->fde = event_add_fd(ev, smb_krb5,
 308                                              socket_get_fd(smb_krb5->sock), 0,
 309                                              smb_krb5_socket_handler, smb_krb5);
 310
 311                 event_add_timed(ev, smb_krb5,
 312                                 timeval_current_ofs(context->kdc_timeout, 0),
 313                                 smb_krb5_request_timeout, smb_krb5);
 314
 315                 EVENT_FD_WRITEABLE(smb_krb5->fde);
 316
 317                 switch (hi->proto) {
 318                 case KRB5_KRBHST_UDP:
 319                         smb_krb5->request = send_blob;
 320                         break;
 321                 case KRB5_KRBHST_TCP:
 322                         smb_krb5->request = data_blob_talloc(smb_krb5, NULL, send_blob.length + 4);
 323                         RSIVAL(smb_krb5->request.data, 0, send_blob.length);
 324                         memcpy(smb_krb5->request.data+4, send_blob.data, send_blob.length);
 325                         break;
 326                 case KRB5_KRBHST_HTTP:
 327                         talloc_free(smb_krb5);
 328                         return EINVAL;
 329                 }
 330                 smb_krb5->timeout = False;
 331                 smb_krb5->status = NT_STATUS_OK;
 332                 smb_krb5->reply = data_blob(NULL, 0);
 333                 smb_krb5->partial = data_blob(NULL, 0);
 334
 335                 while (!smb_krb5->timeout && (NT_STATUS_IS_OK(smb_krb5->status)) && !smb_krb5->reply.length) {
 336                         if (event_loop_once(ev) != 0) {
 337                                 talloc_free(smb_krb5);
 338                                 return EINVAL;
 339                         }
 340                 }
 341                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
 342                         DEBUG(2,("Error reading smb_krb5 reply packet: %s\n", nt_errstr(smb_krb5->status)));
 343                         talloc_free(smb_krb5);
 344                         continue;
 345                 }
 346
 347                 if (smb_krb5->timeout) {
 348                         talloc_free(smb_krb5);
 349                         continue;
 350                 }
 351
 352                 ret = krb5_data_copy(recv_buf, smb_krb5->reply.data, smb_krb5->reply.length);
 353                 if (ret) {
 354                         talloc_free(smb_krb5);
 355                         return ret;
 356                 }
 357                 talloc_free(smb_krb5);
 358
 359                 break;
 360         }
 361         if (a) {
 362                 return 0;
 363         }
 364         return KRB5_KDC_UNREACH;
 365 }
 366
 367 krb5_error_code smb_krb5_init_context(void *parent_ctx,
 368                                        struct smb_krb5_context **smb_krb5_context)
 369 {
 370         krb5_error_code ret;
 371         TALLOC_CTX *tmp_ctx;
 372         struct event_context *ev;
 373         char **config_files;
 374         const char *config_file;
 375
 376         initialize_krb5_error_table();
 377
 378         tmp_ctx = talloc_new(parent_ctx);
 379         *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context);
 380
 381         if (!*smb_krb5_context || !tmp_ctx) {
 382                 talloc_free(tmp_ctx);
 383                 return ENOMEM;
 384         }
 385
 386         ret = krb5_init_context(&(*smb_krb5_context)->krb5_context);
 387         if (ret) {
 388                 DEBUG(1,("krb5_init_context failed (%s)\n",
 389                          error_message(ret)));
 390                 talloc_free(tmp_ctx);
 391                 return ret;
 392         }
 393
 394         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1);
 395
 396         config_file = config_path(tmp_ctx, "krb5.conf");
 397         if (!config_file) {
 398                 talloc_free(tmp_ctx);
 399                 return ENOMEM;
 400         }
 401
 402         /* Use our local krb5.conf file by default */
 403         ret = krb5_prepend_config_files_default(config_file, &config_files);
 404         if (ret) {
 405                 DEBUG(1,("krb5_prepend_config_files_default failed (%s)\n",
 406                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
 407                 talloc_free(tmp_ctx);
 408                 return ret;
 409         }
 410
 411         ret = krb5_set_config_files((*smb_krb5_context)->krb5_context,
 412                                     config_files);
 413         krb5_free_config_files(config_files);
 414         if (ret) {
 415                 DEBUG(1,("krb5_set_config_files failed (%s)\n",
 416                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
 417                 talloc_free(tmp_ctx);
 418                 return ret;
 419         }
 420
 421         if (lp_realm() && *lp_realm()) {
 422                 char *upper_realm = strupper_talloc(tmp_ctx, lp_realm());
 423                 if (!upper_realm) {
 424                         DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm()));
 425                         talloc_free(tmp_ctx);
 426                         return ENOMEM;
 427                 }
 428                 ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, upper_realm);
 429                 if (ret) {
 430                         DEBUG(1,("krb5_set_default_realm failed (%s)\n",
 431                                  smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
 432                         talloc_free(tmp_ctx);
 433                         return ret;
 434                 }
 435         }
 436
 437         /* TODO: Should we have a different name here? */
 438         ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
 439
 440         if (ret) {
 441                 DEBUG(1,("krb5_initlog failed (%s)\n",
 442                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
 443                 talloc_free(tmp_ctx);
 444                 return ret;
 445         }
 446
 447         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2);
 448
 449         ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */,
 450                                smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
 451         if (ret) {
 452                 DEBUG(1,("krb5_addlog_func failed (%s)\n",
 453                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
 454                 talloc_free(tmp_ctx);
 455                 return ret;
 456         }
 457         krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
 458
 459         ev = event_context_find(*smb_krb5_context);
 460         /* Set use of our socket lib */
 461         ret = krb5_set_send_to_kdc_func((*smb_krb5_context)->krb5_context,
 462                                         smb_krb5_send_and_recv_func,
 463                                         ev);
 464         if (ret) {
 465                 DEBUG(1,("krb5_set_send_recv_func failed (%s)\n",
 466                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
 467                 talloc_free(tmp_ctx);
 468                 return ret;
 469         }
 470
 471         talloc_steal(parent_ctx, *smb_krb5_context);
 472         talloc_free(tmp_ctx);
 473
 474         /* Set options in kerberos */
 475
 476         krb5_set_dns_canonicalize_hostname((*smb_krb5_context)->krb5_context, FALSE);
 477
 478         return 0;
 479 }
 480