r15853: started the process of removing the warnings now that
[kai/samba-autobuild/.git] / source4 / auth / kerberos / krb5_init_context.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Wrapper for krb5_init_context
4
5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6    Copyright (C) Andrew Tridgell 2005
7    Copyright (C) Stefan Metzmacher 2004
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 2 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program; if not, write to the Free Software
21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25 #include "system/kerberos.h"
26 #include "auth/kerberos/kerberos.h"
27 #include "lib/socket/socket.h"
28 #include "system/network.h"
29 #include "lib/events/events.h"
30 #include "roken.h"
31
32 /*
33   context structure for operations on cldap packets
34 */
35 struct smb_krb5_socket {
36         struct socket_context *sock;
37
38         /* the fd event */
39         struct fd_event *fde;
40
41         BOOL timeout;
42         NTSTATUS status;
43         DATA_BLOB request, reply, partial;
44
45         size_t partial_read;
46
47         krb5_krbhst_info *hi;
48 };
49
50 static int smb_krb5_context_destroy_1(struct smb_krb5_context *ctx)
51 {
52         krb5_free_context(ctx->krb5_context); 
53         return 0;
54 }
55
56 static int smb_krb5_context_destroy_2(struct smb_krb5_context *ctx)
57 {
58         /* Otherwise krb5_free_context will try and close what we have already free()ed */
59         krb5_set_warn_dest(ctx->krb5_context, NULL);
60         krb5_closelog(ctx->krb5_context, ctx->logf);
61         smb_krb5_context_destroy_1(ctx);
62         return 0;
63 }
64
65 /* We never close down the DEBUG system, and no need to unreference the use */
66 static void smb_krb5_debug_close(void *private) {
67         return;
68 }
69
70 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private) 
71 {
72         DEBUG(3, ("Kerberos: %s\n", msg));
73 }
74
75 /*
76   handle recv events on a smb_krb5 socket
77 */
78 static void smb_krb5_socket_recv(struct smb_krb5_socket *smb_krb5)
79 {
80         TALLOC_CTX *tmp_ctx = talloc_new(smb_krb5);
81         DATA_BLOB blob;
82         size_t nread, dsize;
83
84         switch (smb_krb5->hi->proto) {
85         case KRB5_KRBHST_UDP:
86                 smb_krb5->status = socket_pending(smb_krb5->sock, &dsize);
87                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
88                         talloc_free(tmp_ctx);
89                         return;
90                 }
91
92                 blob = data_blob_talloc(tmp_ctx, NULL, dsize);
93                 if (blob.data == NULL && dsize != 0) {
94                         smb_krb5->status = NT_STATUS_NO_MEMORY;
95                         talloc_free(tmp_ctx);
96                         return;
97                 }
98                 
99                 smb_krb5->status = socket_recv(smb_krb5->sock, blob.data, blob.length, &nread);
100                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
101                         talloc_free(tmp_ctx);
102                         return;
103                 }
104                 blob.length = nread;
105
106                 if (nread == 0) {
107                         smb_krb5->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
108                         talloc_free(tmp_ctx);
109                         return;
110                 }
111                 
112                 DEBUG(2,("Received smb_krb5 packet of length %d\n", 
113                          (int)blob.length));
114                 
115                 talloc_steal(smb_krb5, blob.data);
116                 smb_krb5->reply = blob;
117                 talloc_free(tmp_ctx);
118                 break;
119         case KRB5_KRBHST_TCP:
120                 if (smb_krb5->partial.length == 0) {
121                         smb_krb5->partial = data_blob_talloc(smb_krb5, NULL, 4);
122                         if (!smb_krb5->partial.data) {
123                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
124                                 return;
125                         }
126                         
127                         smb_krb5->partial_read = 0;
128                 }
129                 
130                 /* read in the packet length */
131                 if (smb_krb5->partial_read < 4) {
132                         uint32_t packet_length;
133                         
134                         smb_krb5->status = socket_recv(smb_krb5->sock, 
135                                              smb_krb5->partial.data + smb_krb5->partial_read,
136                                              4 - smb_krb5->partial_read,
137                                              &nread);
138                         /* todo: this should be converted to the packet_*() routines */
139                         if (!NT_STATUS_IS_OK(smb_krb5->status)) {
140                                 return;
141                         }
142                         
143                         smb_krb5->partial_read += nread;
144                         if (smb_krb5->partial_read != 4) {
145                                 return;
146                         }
147                         
148                         packet_length = RIVAL(smb_krb5->partial.data, 0);
149                         
150                         smb_krb5->partial.data = talloc_realloc(smb_krb5, smb_krb5->partial.data, 
151                                                                 uint8_t, packet_length + 4);
152                         if (!smb_krb5->partial.data)  {
153                                 smb_krb5->status = NT_STATUS_NO_MEMORY;
154                                 return;
155                         }
156                         
157                         smb_krb5->partial.length = packet_length + 4;
158                 }
159                 
160                 /* read in the body */
161                 smb_krb5->status = socket_recv(smb_krb5->sock, 
162                                      smb_krb5->partial.data + smb_krb5->partial_read,
163                                      smb_krb5->partial.length - smb_krb5->partial_read,
164                                      &nread);
165                 if (!NT_STATUS_IS_OK(smb_krb5->status)) return;
166                 
167                 smb_krb5->partial_read += nread;
168
169                 if (smb_krb5->partial_read != smb_krb5->partial.length) return;
170
171                 smb_krb5->reply = data_blob_talloc(smb_krb5, smb_krb5->partial.data + 4, smb_krb5->partial.length - 4);
172                 break;
173         case KRB5_KRBHST_HTTP:
174                 return;
175         }
176 }
177
178 /*
179   handle request timeouts
180 */
181 static void smb_krb5_request_timeout(struct event_context *event_ctx, 
182                                   struct timed_event *te, struct timeval t,
183                                   void *private)
184 {
185         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
186         DEBUG(5,("Timed out smb_krb5 packet\n"));
187         smb_krb5->timeout = True;
188 }
189
190 /*
191   handle send events on a smb_krb5 socket
192 */
193 static void smb_krb5_socket_send(struct smb_krb5_socket *smb_krb5)
194 {
195         NTSTATUS status;
196
197         size_t len;
198         
199         len = smb_krb5->request.length;
200         status = socket_send(smb_krb5->sock, &smb_krb5->request, &len);
201
202         if (!NT_STATUS_IS_OK(status)) return;
203         
204         EVENT_FD_READABLE(smb_krb5->fde);
205
206         EVENT_FD_NOT_WRITEABLE(smb_krb5->fde);
207         return;
208 }
209
210
211 /*
212   handle fd events on a smb_krb5_socket
213 */
214 static void smb_krb5_socket_handler(struct event_context *ev, struct fd_event *fde,
215                                  uint16_t flags, void *private)
216 {
217         struct smb_krb5_socket *smb_krb5 = talloc_get_type(private, struct smb_krb5_socket);
218         if (flags & EVENT_FD_WRITE) {
219                 smb_krb5_socket_send(smb_krb5);
220         } 
221         if (flags & EVENT_FD_READ) {
222                 smb_krb5_socket_recv(smb_krb5);
223         }
224 }
225
226
227 static krb5_error_code smb_krb5_send_and_recv_func(krb5_context context,
228                                                    void *data,
229                                                    krb5_krbhst_info *hi,
230                                                    const krb5_data *send_buf,
231                                                    krb5_data *recv_buf)
232 {
233         krb5_error_code ret;
234         NTSTATUS status;
235         struct socket_address *remote_addr;
236         const char *name;
237         struct addrinfo *ai, *a;
238         struct smb_krb5_socket *smb_krb5;
239
240         struct event_context *ev = talloc_get_type(data, struct event_context);
241
242         DATA_BLOB send_blob = data_blob_const(send_buf->data, send_buf->length);
243
244         ret = krb5_krbhst_get_addrinfo(context, hi, &ai);
245         if (ret) {
246                 return ret;
247         }
248
249         for (a = ai; a; a = ai->ai_next) {
250                 smb_krb5 = talloc(NULL, struct smb_krb5_socket);
251                 if (!smb_krb5) {
252                         return ENOMEM;
253                 }
254                 smb_krb5->hi = hi;
255                 
256                 switch (a->ai_family) {
257                 case PF_INET:
258                         name = "ipv4";
259                         break;
260                 case PF_INET6:
261                         name = "ipv6";
262                         break;
263                 default:
264                         talloc_free(smb_krb5);
265                         return EINVAL;
266                 }
267                 
268                 status = NT_STATUS_INVALID_PARAMETER;
269                 switch (hi->proto) {
270                 case KRB5_KRBHST_UDP:
271                         if (lp_parm_bool(-1, "krb5", "udp", True)) {
272                                 status = socket_create(name, SOCKET_TYPE_DGRAM, &smb_krb5->sock, 0);
273                         }
274                         break;
275                 case KRB5_KRBHST_TCP:
276                         if (lp_parm_bool(-1, "krb5", "tcp", True)) {
277                                 status = socket_create(name, SOCKET_TYPE_STREAM, &smb_krb5->sock, 0);
278                         }
279                         break;
280                 case KRB5_KRBHST_HTTP:
281                         talloc_free(smb_krb5);
282                         return EINVAL;
283                 }
284                 if (!NT_STATUS_IS_OK(status)) {
285                         talloc_free(smb_krb5);
286                         continue;
287                 }
288
289                 talloc_steal(smb_krb5, smb_krb5->sock);
290                 
291                 remote_addr = socket_address_from_sockaddr(smb_krb5, a->ai_addr, a->ai_addrlen); 
292                 if (!remote_addr) {
293                         talloc_free(smb_krb5);
294                         continue;
295                 }
296
297                 status = socket_connect_ev(smb_krb5->sock, NULL, remote_addr, 0, ev); 
298                 if (!NT_STATUS_IS_OK(status)) {
299                         talloc_free(smb_krb5);
300                         continue;
301                 }
302                 talloc_free(remote_addr);
303
304                 smb_krb5->fde = event_add_fd(ev, smb_krb5, 
305                                              socket_get_fd(smb_krb5->sock), 0,
306                                              smb_krb5_socket_handler, smb_krb5);
307
308                 event_add_timed(ev, smb_krb5, 
309                                 timeval_current_ofs(context->kdc_timeout, 0),
310                                 smb_krb5_request_timeout, smb_krb5);
311
312                 EVENT_FD_WRITEABLE(smb_krb5->fde);
313                 
314                 switch (hi->proto) {
315                 case KRB5_KRBHST_UDP:
316                         smb_krb5->request = send_blob;
317                         break;
318                 case KRB5_KRBHST_TCP:
319                         smb_krb5->request = data_blob_talloc(smb_krb5, NULL, send_blob.length + 4);
320                         RSIVAL(smb_krb5->request.data, 0, send_blob.length);
321                         memcpy(smb_krb5->request.data+4, send_blob.data, send_blob.length);
322                         break;
323                 case KRB5_KRBHST_HTTP:
324                         talloc_free(smb_krb5);
325                         return EINVAL;
326                 }
327                 smb_krb5->timeout = False;
328                 smb_krb5->status = NT_STATUS_OK;
329                 smb_krb5->reply = data_blob(NULL, 0);
330                 smb_krb5->partial = data_blob(NULL, 0);
331
332                 while (!smb_krb5->timeout && (NT_STATUS_IS_OK(smb_krb5->status)) && !smb_krb5->reply.length) {
333                         if (event_loop_once(ev) != 0) {
334                                 talloc_free(smb_krb5);
335                                 return EINVAL;
336                         }
337                 }
338                 if (!NT_STATUS_IS_OK(smb_krb5->status)) {
339                         DEBUG(2,("Error reading smb_krb5 reply packet: %s\n", nt_errstr(smb_krb5->status)));
340                         talloc_free(smb_krb5);
341                         continue;
342                 }
343
344                 if (smb_krb5->timeout) {
345                         talloc_free(smb_krb5);
346                         continue;
347                 }
348
349                 ret = krb5_data_copy(recv_buf, smb_krb5->reply.data, smb_krb5->reply.length);
350                 if (ret) {
351                         talloc_free(smb_krb5);
352                         return ret;
353                 }
354                 talloc_free(smb_krb5);
355                 
356                 break;
357         }
358         if (a) {
359                 return 0;
360         }
361         return KRB5_KDC_UNREACH;
362 }
363
364 /* NO internal data, so nothing to free */
365 static void smb_krb5_send_and_recv_close_func(krb5_context context, void *data) 
366 {
367         return;
368 }
369
370
371 krb5_error_code smb_krb5_init_context(void *parent_ctx, 
372                                        struct smb_krb5_context **smb_krb5_context) 
373 {
374         krb5_error_code ret;
375         TALLOC_CTX *tmp_ctx;
376         struct event_context *ev;
377         
378         initialize_krb5_error_table();
379         
380         tmp_ctx = talloc_new(parent_ctx);
381         *smb_krb5_context = talloc(tmp_ctx, struct smb_krb5_context);
382
383         if (!*smb_krb5_context || !tmp_ctx) {
384                 talloc_free(*smb_krb5_context);
385                 talloc_free(tmp_ctx);
386                 return ENOMEM;
387         }
388
389         ret = krb5_init_context(&(*smb_krb5_context)->krb5_context);
390         if (ret) {
391                 DEBUG(1,("krb5_init_context failed (%s)\n", 
392                          error_message(ret)));
393                 return ret;
394         }
395
396         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_1);
397
398         if (lp_realm() && *lp_realm()) {
399                 char *upper_realm = strupper_talloc(tmp_ctx, lp_realm());
400                 if (!upper_realm) {
401                         DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm()));
402                         talloc_free(tmp_ctx);
403                         return ENOMEM;
404                 }
405                 ret = krb5_set_default_realm((*smb_krb5_context)->krb5_context, upper_realm);
406                 if (ret) {
407                         DEBUG(1,("krb5_set_default_realm failed (%s)\n", 
408                                  smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
409                         talloc_free(tmp_ctx);
410                         return ret;
411                 }
412         }
413
414         /* TODO: Should we have a different name here? */
415         ret = krb5_initlog((*smb_krb5_context)->krb5_context, "Samba", &(*smb_krb5_context)->logf);
416         
417         if (ret) {
418                 DEBUG(1,("krb5_initlog failed (%s)\n", 
419                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
420                 talloc_free(tmp_ctx);
421                 return ret;
422         }
423
424         talloc_set_destructor(*smb_krb5_context, smb_krb5_context_destroy_2);
425
426         ret = krb5_addlog_func((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf, 0 /* min */, -1 /* max */, 
427                                smb_krb5_debug_wrapper, smb_krb5_debug_close, NULL);
428         if (ret) {
429                 DEBUG(1,("krb5_addlog_func failed (%s)\n", 
430                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
431                 talloc_free(tmp_ctx);
432                 return ret;
433         }
434         krb5_set_warn_dest((*smb_krb5_context)->krb5_context, (*smb_krb5_context)->logf);
435
436         ev = event_context_find(*smb_krb5_context);
437         /* Set use of our socket lib */
438         ret = krb5_set_send_recv_func((*smb_krb5_context)->krb5_context, 
439                                       smb_krb5_send_and_recv_func, 
440                                       smb_krb5_send_and_recv_close_func, ev);
441         if (ret) {
442                 DEBUG(1,("krb5_set_send_recv_func failed (%s)\n", 
443                          smb_get_krb5_error_message((*smb_krb5_context)->krb5_context, ret, tmp_ctx)));
444                 talloc_free(tmp_ctx);
445                 return ret;
446         }
447
448         (*smb_krb5_context)->krb5_context->mem_ctx = *smb_krb5_context;
449
450         talloc_steal(parent_ctx, *smb_krb5_context);
451         talloc_free(tmp_ctx);
452
453         /* Set options in kerberos */
454
455         (*smb_krb5_context)->krb5_context->fdns = FALSE;
456
457         return 0;
458 }
459
460  void smb_krb5_free_context(struct smb_krb5_context *smb_krb5_context) 
461 {
462         talloc_free(smb_krb5_context);
463 }