d895d7a3369767a4773401353298de4a041111d8
[kai/samba-autobuild/.git] / source4 / auth / kerberos / krb5_init_context.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Wrapper for krb5_init_context
4
5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6    Copyright (C) Andrew Tridgell 2005
7    Copyright (C) Stefan Metzmacher 2004
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 2 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program; if not, write to the Free Software
21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25 #include "system/kerberos.h"
26 #include "auth/kerberos/kerberos.h"
27 #include "lib/socket/socket.h"
28 #include "system/network.h"
29 #include "lib/events/events.h"
30 #include "roken.h"
31
32 /*
33   context structure for operations on cldap packets
34 */
35 struct smb_krb5_socket {
36         struct socket_context *sock;
37
38         /* the fd event */
39         struct fd_event *fde;
40
41         BOOL timeout;
42         NTSTATUS status;
43         DATA_BLOB request, reply, partial;
44
45         size_t partial_read;
46
47         krb5_krbhst_info *hi;
48 };
49
50 static int smb_krb5_context_destroy_1(struct smb_krb5_context *ctx)
51 {
52         krb5_free_context(ctx->krb5_context); 
53         return 0;
54 }
55
56 static int smb_krb5_context_destroy_2(struct smb_krb5_context *ctx)
57 {
58         /* Otherwise krb5_free_context will try and close what we have already free()ed */
59         krb5_set_warn_dest(ctx->krb5_context, NULL);
60         krb5_closelog(ctx->krb5_context, ctx->logf);
61         smb_krb5_context_destroy_1(ctx);
62         return 0;
63 }
64
65 /* We never close down the DEBUG system, and no need to unreference the use */
66 static void smb_krb5_debug_close(void *private) {
67         return;
68 }
69
70 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private) 
71 {
72         DEBUG(3, ("Kerberos: %s\n", msg));
73 }
74
75 /*
76   handle recv events on a smb_krb5 socket
77 */
78 static void smb_krb5_socket_recv(struct smb_krb5_socket *smb_krb5)
79 {
80         TALLOC_CTX *tmp_ctx = talloc_new(smb_krb5);
81         DATA_BLOB blob;
82         size_t nread, dsize;
83
84         switch (smb_krb5->hi->proto) {
85         case KRB5_KRBHST_UDP:
86                 smb_krb5->status = socket_pending(smb_krb5->sock, &dsize);
87                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
88                         talloc_free(tmp_ctx);
89                         return;
90                 }
91
92                 blob = data_blob_talloc(tmp_ctx, NULL, dsize);
93                 if (blob.data == NULL && dsize != 0) {
94                         smb_krb5->status = NT_STATUS_NO_MEMORY;
95                         talloc_free(tmp_ctx);
96                         return;
97                 }
98                 
99                 smb_krb5->status = socket_recv(smb_krb5->sock, blob.data, blob.length, &nread);
100                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
101                         talloc_free(tmp_ctx);
102                         return;
103                 }
104                 blob.length = nread;
105
106                 if (nread == 0) {
107                         smb_krb5->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
108                         talloc_free(tmp_ctx);
109                         return;
110                 }
111                 
112                 DEBUG(2,("Received smb_krb5 packet of length %d\n", 
113                          (int)blob.length));
114                 
115                 talloc_steal(smb_krb5, blob.data);
116                 smb_krb5->reply = blob;
117                 talloc_free(tmp_ctx);
118                 break;
119         case KRB5_KRBHST_TCP:
120                 if (smb_krb5->partial.length == 0) {
121                         smb_krb5->partial = data_blob_talloc(smb_krb5, NULL, 4);
122                         if (!smb_krb5->partial.data) {
123                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
124                                 return;
125                         }
126                         
127                         smb_krb5->partial_read = 0;
128                 }
129                 
130                 /* read in the packet length */
131                 if (smb_krb5->partial_read < 4) {
132                         uint32_t packet_length;
133                         
134                         smb_krb5->status = socket_recv(smb_krb5->sock, 
135                                              smb_krb5->partial.data + smb_krb5->partial_read,
136                                              4 - smb_krb5->partial_read,
137                                              &nread);
138                         /* todo: this should be converted to the packet_*() routines */
139                         if (!NT_STATUS_IS_OK(smb_krb5->status)) {
140                                 return;
141                         }
142                         
143                         smb_krb5->partial_read += nread;
144                         if (smb_krb5->partial_read != 4) {
145                                 return;
146                         }
147                         
148                         packet_length = RIVAL(smb_krb5->partial.data, 0);
149                         
150                         smb_krb5->partial.data = talloc_realloc(smb_krb5, smb_krb5->partial.data, 
151                                                                 uint8_t, packet_length + 4);
152                         if (!smb_krb5->partial.data)  {
153                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
154                                 return;
155                         }
156                         
157                         smb_krb5->partial.length = packet_length + 4;
158                 }
159                 
160                 /* read in the body */
161                 smb_krb5->status = socket_recv(smb_krb5->sock, 
162                                      smb_krb5->partial.data + smb_krb5->partial_read,
163                                      smb_krb5->partial.length - smb_krb5->partial_read,
164                                      &nread);
165                 if (!NT_STATUS_IS_OK(smb_krb5->status)) return;
166                 
167                 smb_krb5->partial_read += nread;
168
169                 if (smb_krb5->partial_read != smb_krb5->partial.length) return;
170
171                 smb_krb5->reply = data_blob_talloc(smb_krb5, smb_krb5->partial.data + 4, smb_krb5->partial.length - 4);
172                 break;
173         case KRB5_KRBHST_HTTP:
174                 return;
175         }
176 }
177
178 /*
179   handle request timeouts
180 */
181 static void smb_krb5_request_timeout(struct event_context *event_ctx, 
182                                   struct timed_event *te, struct timeval t,
183                                   void *private)
184 {
185         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
186         DEBUG(5,("Timed out smb_krb5 packet\n"));
187         smb_krb5->timeout = True;
188 }
189
190 /*
191   handle send events on a smb_krb5 socket
192 */
193 static void smb_krb5_socket_send(struct smb_krb5_socket *smb_krb5)
194 {
195         NTSTATUS status;
196
197         size_t len;
198         
199         len = smb_krb5->request.length;
200         status = socket_send(smb_krb5->sock, &smb_krb5->request, &len);
201
202         if (!NT_STATUS_IS_OK(status)) return;
203         
204         EVENT_FD_READABLE(smb_krb5->fde);
205
206         EVENT_FD_NOT_WRITEABLE(smb_krb5->fde);
207         return;
208 }
209
210
211 /*
212   handle fd events on a smb_krb5_socket
213 */
214 static void smb_krb5_socket_handler(struct event_context *ev, struct fd_event *fde,
215                                  uint16_t flags, void *private)
216 {
217         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
218         if (flags & EVENT_FD_WRITE) {
219                 smb_krb5_socket_send(smb_krb5);
220         } 
221         if (flags & EVENT_FD_READ) {
222                 smb_krb5_socket_recv(smb_krb5);
223         }
224 }
225
226
227 static krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
228                                                    void *data,
229                                                    krb5_krbhst_info *hi,
230                                                    const krb5_data *send_buf,
231                                                    krb5_data *recv_buf)
232 {
233         krb5_error_code ret;
234         NTSTATUS status;
235         struct socket_address *remote_addr;
236         const char *name;
237         struct addrinfo *ai, *a;
238         struct smb_krb5_socket *smb_krb5;
239
240         struct event_context *ev = talloc_get_type(data, struct event_context);
241
242         DATA_BLOB send_blob = data_blob_const(send_buf->data, send_buf->length);
243
244         ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
245         if (ret) {
246                 return ret;
247         }
248
249         for (a = ai; a; a = ai->ai_next) {
250                 smb_krb5 = talloc(NULL, struct smb_krb5_socket);
251                 if (!smb_krb5) {
252                         return ENOMEM;
253                 }
254                 smb_krb5->hi = hi;
255                 
256                 switch (a->ai_family) {
257                 case PF_INET:
258                         name = "ipv4";
259                         break;
260 #ifdef HAVE_SOCKET_IPV6
261                 case PF_INET6:
262                         name = "ipv6";
263                         break;
264 #endif
265                 default:
266                         talloc_free(smb_krb5);
267                         return EINVAL;
268                 }
269                 
270                 status = NT_STATUS_INVALID_PARAMETER;
271                 switch (hi->proto) {
272                 case KRB5_KRBHST_UDP:
273                         if (lp_parm_bool(-1, "krb5", "udp", True)) {
274                                 status = socket_create(name, SOCKET_TYPE_DGRAM, &smb_krb5->sock, 0);
275                         }
276                         break;
277                 case KRB5_KRBHST_TCP:
278                         if (lp_parm_bool(-1, "krb5", "tcp", True)) {
279                                 status = socket_create(name, SOCKET_TYPE_STREAM, &smb_krb5->sock, 0);
280                         }
281                         break;
282                 case KRB5_KRBHST_HTTP:
283                         talloc_free(smb_krb5);
284                         return EINVAL;
285                 }
286                 if (!NT_STATUS_IS_OK(status)) {
287                         talloc_free(smb_krb5);
288                         continue;
289                 }
290
291                 talloc_steal(smb_krb5, smb_krb5->sock);
292                 
293                 remote_addr = socket_address_from_sockaddr(smb_krb5, a->ai_addr, a->ai_addrlen); 
294                 if (!remote_addr) {
295                         talloc_free(smb_krb5);
296                         continue;
297                 }
298
299                 status = socket_connect_ev(smb_krb5->sock, NULL, remote_addr, 0, ev); 
300                 if (!NT_STATUS_IS_OK(status)) {
301                         talloc_free(smb_krb5);
302                         continue;
303                 }
304                 talloc_free(remote_addr);
305
306                 smb_krb5->fde = event_add_fd(ev, smb_krb5, 
307                                              socket_get_fd(smb_krb5->sock), 0,
308                                              smb_krb5_socket_handler, smb_krb5);
309
310                 event_add_timed(ev, smb_krb5, 
311                                 timeval_current_ofs(context->kdc_timeout, 0),
312                                 smb_krb5_request_timeout, smb_krb5);
313
314                 EVENT_FD_WRITEABLE(smb_krb5->fde);
315                 
316                 switch (hi->proto) {
317                 case KRB5_KRBHST_UDP:
318                         smb_krb5->request = send_blob;
319                         break;
320                 case KRB5_KRBHST_TCP:
321                         smb_krb5->request = data_blob_talloc(smb_krb5, NULL, send_blob.length + 4);
322                         RSIVAL(smb_krb5->request.data, 0, send_blob.length);
323                         memcpy(smb_krb5->request.data+4, send_blob.data, send_blob.length);
324                         break;
325                 case KRB5_KRBHST_HTTP:
326                         talloc_free(smb_krb5);
327                         return EINVAL;
328                 }
329                 smb_krb5->timeout = False;
330                 smb_krb5->status = NT_STATUS_OK;
331                 smb_krb5->reply = data_blob(NULL, 0);
332                 smb_krb5->partial = data_blob(NULL, 0);
333
334                 while (!smb_krb5->timeout && (NT_STATUS_IS_OK(smb_krb5->status)) && !smb_krb5->reply.length) {
335                         if (event_loop_once(ev) != 0) {
336                                 talloc_free(smb_krb5);
337                                 return EINVAL;
338                         }
339                 }
340                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
341                         DEBUG(2,("Error reading smb_krb5 reply packet: %s\n", nt_errstr(smb_krb5->status)));
342                         talloc_free(smb_krb5);
343                         continue;
344                 }
345
346                 if (smb_krb5->timeout) {
347                         talloc_free(smb_krb5);
348                         continue;
349                 }
350
351                 ret = krb5_data_copy(recv_buf, smb_krb5->reply.data, smb_krb5->reply.length);
352                 if (ret) {
353                         talloc_free(smb_krb5);
354                         return ret;
355                 }
356                 talloc_free(smb_krb5);
357                 
358                 break;
359         }
360         if (a) {
361                 return 0;
362         }
363         return KRB5_KDC_UNREACH;
364 }
365
366 /* NO internal data, so nothing to free */
367 static void smb_krb5_send_and_recv_close_func(krb5_context context, void *data) 
368 {
369         return;
370 }
371
372
373 krb5_error_code smb_krb5_init_context(void *parent_ctx, 
374                                        struct smb_krb5_context **smb_krb5_context) 
375 {
376         krb5_error_code ret;
377         TALLOC_CTX *tmp_ctx;
378         struct event_context *ev;
379         
380         initialize_krb5_error_table();
381         
382         tmp_ctx = talloc_new(parent_ctx);
383         *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context);
384
385         if (!*smb_krb5_context || !tmp_ctx) {
386                 talloc_free(*smb_krb5_context);
387                 talloc_free(tmp_ctx);
388                 return ENOMEM;
389         }
390
391         ret = krb5_init_context(&(*smb_krb5_context)->krb5_context);
392         if (ret) {
393                 DEBUG(1,("krb5_init_context failed (%s)\n", 
394                          error_message(ret)));
395                 return ret;
396         }
397
398         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1);
399
400         if (lp_realm() && *lp_realm()) {
401                 char *upper_realm = strupper_talloc(tmp_ctx, lp_realm());
402                 if (!upper_realm) {
403                         DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm()));
404                         talloc_free(tmp_ctx);
405                         return ENOMEM;
406                 }
407                 ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, upper_realm);
408                 if (ret) {
409                         DEBUG(1,("krb5_set_default_realm failed (%s)\n", 
410                                  smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
411                         talloc_free(tmp_ctx);
412                         return ret;
413                 }
414         }
415
416         /* TODO: Should we have a different name here? */
417         ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
418         
419         if (ret) {
420                 DEBUG(1,("krb5_initlog failed (%s)\n", 
421                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
422                 talloc_free(tmp_ctx);
423                 return ret;
424         }
425
426         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2);
427
428         ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */, 
429                                smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
430         if (ret) {
431                 DEBUG(1,("krb5_addlog_func failed (%s)\n", 
432                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
433                 talloc_free(tmp_ctx);
434                 return ret;
435         }
436         krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
437
438         ev = event_context_find(*smb_krb5_context);
439         /* Set use of our socket lib */
440         ret = krb5_set_send_recv_func((*smb_krb5_context)->krb5_context, 
441                                       smb_krb5_send_and_recv_func, 
442                                       smb_krb5_send_and_recv_close_func, ev);
443         if (ret) {
444                 DEBUG(1,("krb5_set_send_recv_func failed (%s)\n", 
445                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
446                 talloc_free(tmp_ctx);
447                 return ret;
448         }
449
450         (*smb_krb5_context)->krb5_context->mem_ctx = *smb_krb5_context;
451
452         talloc_steal(parent_ctx, *smb_krb5_context);
453         talloc_free(tmp_ctx);
454
455         /* Set options in kerberos */
456
457         (*smb_krb5_context)->krb5_context->fdns = FALSE;
458
459         return 0;
460 }
461
462  void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context) 
463 {
464         talloc_free(smb_krb5_context);
465 }