From 1c38391c704756c31c1d8d7f84f9ac6ffcaeda34 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sun, 7 Sep 2003 16:36:13 +0000 Subject: Nobody complained on the team-list, so commit it ... This implements some kind of improved AFS support for Samba on Linux with OpenAFS 1.2.10. ./configure --with-fake-kaserver assumes that you have OpenAFS on your machine. To use this, you have to put the AFS server's KeyFile into secrets.tdb with 'net afskey'. If this is done, on each tree connect smbd creates a Kerberos V4 ticket suitable for use by the AFS client and gives it to the kernel via the AFS syscall. This is meant to be very light-weight, so I did not link in a whole lot of libraries to be more platform-independent using the ka_SetToken function call. Volker (This used to be commit 5775690ee8e17d3e98355b5147e4aed47e8dc213) --- source3/lib/afs.c | 248 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 248 insertions(+) create mode 100644 source3/lib/afs.c (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c new file mode 100644 index 0000000000..b96703e986 --- /dev/null +++ b/source3/lib/afs.c @@ -0,0 +1,248 @@ +/* + * Unix SMB/CIFS implementation. + * Generate AFS tickets + * Copyright (C) Volker Lendecke 2003 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +#ifdef WITH_FAKE_KASERVER + +#include +#include +#include +#include +#include +#include + +_syscall5(int, afs_syscall, int, subcall, + char *, path, + int, cmd, + char *, cmarg, + int, follow); + +char *afs_cell(void) +{ + static char *cell = NULL; + + if (cell == NULL) { + cell = strdup(lp_realm()); + strlower_m(cell); + } + + return cell; +} + +struct ClearToken { + uint32 AuthHandle; + char HandShakeKey[8]; + uint32 ViceId; + uint32 BeginTimestamp; + uint32 EndTimestamp; +}; + +/* + Put an AFS token into the Kernel so that it can authenticate against + the AFS server. This assumes correct local uid settings. + + This is currently highly Linux and OpenAFS-specific. The correct API + call for this would be ktc_SetToken. But to do that we would have to + import a REALLY big bunch of libraries which I would currently like + to avoid. +*/ + +static BOOL afs_settoken(char *username, const struct ClearToken *ctok, + char *v4tkt_data, int v4tkt_length) +{ + int ret; + struct { + char *in, *out; + uint16 in_size, out_size; + } iob; + + char buf[1024]; + char *p = buf; + int tmp; + + memcpy(p, &v4tkt_length, sizeof(uint32)); + p += sizeof(uint32); + memcpy(p, v4tkt_data, v4tkt_length); + p += v4tkt_length; + + tmp = sizeof(struct ClearToken); + memcpy(p, &tmp, sizeof(uint32)); + p += sizeof(uint32); + memcpy(p, ctok, tmp); + p += tmp; + + tmp = 0; + + memcpy(p, &tmp, sizeof(uint32)); + p += sizeof(uint32); + + tmp = strlen(afs_cell()); + if (tmp >= MAXKTCREALMLEN) { + DEBUG(1, ("Realm too long\n")); + return False; + } + + strncpy(p, afs_cell(), tmp); + p += tmp; + *p = 0; + p +=1; + + iob.in = buf; + iob.in_size = PTR_DIFF(p,buf); + iob.out = buf; + iob.out_size = sizeof(buf); + +#if 0 + file_save("/tmp/ioctlbuf", iob.in, iob.in_size); +#endif + + ret = afs_syscall(AFSCALL_PIOCTL, 0, VIOCSETTOK, (char *)&iob, 0); + + DEBUG(10, ("afs VIOCSETTOK returned %d\n", ret)); + return (ret == 0); +} + +/* + This routine takes a radical approach completely defeating the + Kerberos idea of security and using AFS simply as an intelligent + file backend. Samba has persuaded itself somehow that the user is + actually correctly identified and then we create a ticket that the + AFS server hopefully accepts using its KeyFile that the admin has + kindly stored to our secrets.tdb. + + Thanks to the book "Network Security -- PRIVATE Communication in a + PUBLIC World" by Charlie Kaufman, Radia Perlman and Mike Speciner + Kerberos 4 tickets are not really hard to construct. + + For the comments "Alice" is the User to be auth'ed, and "Bob" is the + AFS server. */ + +BOOL afs_login(char *username) +{ + fstring ticket; + char *p = ticket; + uint32 len; + struct afs_key key; + + struct ClearToken ct; + + uint32 now; /* I assume time() returns 32 bit */ + + des_key_schedule key_schedule; + + DEBUG(10, ("Trying to log into AFS for user %s@%s\n", + username, afs_cell())); + + if (!secrets_init()) + return False; + + if (!secrets_fetch_afs_key(afs_cell(), &key)) { + DEBUG(5, ("Could not fetch AFS service key\n")); + return False; + } + + ct.AuthHandle = key.kvno; + + /* Build the ticket. This is going to be encrypted, so in our + way we fill in ct while we still have the unencrypted + form. */ + + p = ticket; + + /* The byte-order */ + *p = 1; + p += 1; + + /* "Alice", the client username */ + strncpy(p, username, sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + strncpy(p, afs_cell(), sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + + ct.ViceId = getuid(); + DEBUG(10, ("Creating Token for uid %d\n", ct.ViceId)); + + /* Alice's network layer address. At least Openafs-1.2.10 + ignores this, so we fill in a dummy value here. */ + SIVAL(p, 0, 0); + p += 4; + + /* We need to create a session key */ + generate_random_buffer(p, 8, False); + + /* Our client code needs the the key in the clear, it does not + know the server-key ... */ + memcpy(ct.HandShakeKey, p, 8); + + p += 8; + + /* Ticket lifetime. We fake everything here, so go as long as + possible. This is in 5-minute intervals, so 255 is 21 hours + and 15 minutes.*/ + *p = 255; + p += 1; + + /* Ticket creation time */ + now = time(NULL); + SIVAL(p, 0, now); + ct.BeginTimestamp = now; + + ct.EndTimestamp = now + (255*60*5); + if (((ct.EndTimestamp - ct.BeginTimestamp) & 1) == 1) { + ct.BeginTimestamp += 1; /* Lifetime must be even */ + } + p += 4; + + /* And here comes Bob's name and instance, in this case the + AFS server. */ + strncpy(p, "afs", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + + /* And zero-pad to a multiple of 8 bytes */ + len = PTR_DIFF(p, ticket); + if (len & 7) { + uint32 extra_space = 8-(len & 7); + memset(p, 0, extra_space); + p+=extra_space; + } + len = PTR_DIFF(p, ticket); + + des_key_sched((const_des_cblock *)key.key, key_schedule); + des_pcbc_encrypt(ticket, ticket, + len, key_schedule, (C_Block *)key.key, 1); + + ZERO_STRUCT(key); + + return afs_settoken(username, &ct, ticket, len); +} + +#else + +BOOL afs_login(char *username) +{ + return True; +} + +#endif /* WITH_FAKE_KASERVER */ -- cgit From c716385220f5ce63fafffd4cff1e9480c5991d02 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Tue, 23 Sep 2003 14:52:21 +0000 Subject: This only touches the fake kaserver support. It adds two parameters: afs share -- this is an AFS share, do AFS magic things afs username map -- We need a way to specify the cell and possibly weird username codings for several windows domains in the afs cell Volker (This used to be commit 4a3f7a9356cd5068d9ed4fd6e2336d9bf7923fbd) --- source3/lib/afs.c | 60 +++++++++++++++++++++++++++++++++---------------------- 1 file changed, 36 insertions(+), 24 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index b96703e986..882442a79f 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -35,18 +35,6 @@ _syscall5(int, afs_syscall, int, subcall, char *, cmarg, int, follow); -char *afs_cell(void) -{ - static char *cell = NULL; - - if (cell == NULL) { - cell = strdup(lp_realm()); - strlower_m(cell); - } - - return cell; -} - struct ClearToken { uint32 AuthHandle; char HandShakeKey[8]; @@ -65,7 +53,8 @@ struct ClearToken { to avoid. */ -static BOOL afs_settoken(char *username, const struct ClearToken *ctok, +static BOOL afs_settoken(const char *username, const char *cell, + const struct ClearToken *ctok, char *v4tkt_data, int v4tkt_length) { int ret; @@ -94,13 +83,13 @@ static BOOL afs_settoken(char *username, const struct ClearToken *ctok, memcpy(p, &tmp, sizeof(uint32)); p += sizeof(uint32); - tmp = strlen(afs_cell()); + tmp = strlen(cell); if (tmp >= MAXKTCREALMLEN) { DEBUG(1, ("Realm too long\n")); return False; } - strncpy(p, afs_cell(), tmp); + strncpy(p, cell, tmp); p += tmp; *p = 0; p +=1; @@ -135,12 +124,14 @@ static BOOL afs_settoken(char *username, const struct ClearToken *ctok, For the comments "Alice" is the User to be auth'ed, and "Bob" is the AFS server. */ -BOOL afs_login(char *username) +BOOL afs_login(connection_struct *conn) { fstring ticket; char *p = ticket; uint32 len; struct afs_key key; + pstring afs_username; + char *cell; struct ClearToken ct; @@ -148,13 +139,28 @@ BOOL afs_login(char *username) des_key_schedule key_schedule; - DEBUG(10, ("Trying to log into AFS for user %s@%s\n", - username, afs_cell())); + pstrcpy(afs_username, lp_afs_username_map()); + standard_sub_conn(conn, afs_username, sizeof(afs_username)); + + cell = strchr(afs_username, '@'); + + if (cell == NULL) { + DEBUG(1, ("AFS username doesn't contain a @, " + "could not find cell\n")); + return False; + } + + *cell = '\0'; + cell += 1; + strlower_m(cell); + + DEBUG(10, ("Trying to log into AFS for user %s@%s\n", + afs_username, cell)); if (!secrets_init()) return False; - if (!secrets_fetch_afs_key(afs_cell(), &key)) { + if (!secrets_fetch_afs_key(cell, &key)) { DEBUG(5, ("Could not fetch AFS service key\n")); return False; } @@ -172,14 +178,20 @@ BOOL afs_login(char *username) p += 1; /* "Alice", the client username */ - strncpy(p, username, sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, afs_username, sizeof(ticket)-PTR_DIFF(p,ticket)-1); p += strlen(p)+1; strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); p += strlen(p)+1; - strncpy(p, afs_cell(), sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, cell, sizeof(ticket)-PTR_DIFF(p,ticket)-1); p += strlen(p)+1; - ct.ViceId = getuid(); + /* As long as we still only use the effective UID we need to set the + * token for it here as well. This involves patching AFS in two + * places. Once we start using the real uid where we have the + * setresuid function, we can use getuid() here which would be more + * correct. */ + + ct.ViceId = geteuid(); DEBUG(10, ("Creating Token for uid %d\n", ct.ViceId)); /* Alice's network layer address. At least Openafs-1.2.10 @@ -235,12 +247,12 @@ BOOL afs_login(char *username) ZERO_STRUCT(key); - return afs_settoken(username, &ct, ticket, len); + return afs_settoken(afs_username, cell, &ct, ticket, len); } #else -BOOL afs_login(char *username) +BOOL afs_login(connection_struct *conn) { return True; } -- cgit From 4f62277d89bacff1f42e73bd86342f25116d8643 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 23 Oct 2003 16:49:46 +0000 Subject: After a phonecall with jra finally commit this. This changes our behaviour when the setresuid call is available. We now not only change the effective uid but also the real uid when becoming unprivileged. This is mainly for improved AFS compatibility, as AFS selects the token to send to the server based on the real uid of the process. I tested this with a W2k server with two non-root 'runas' sessions. They come in via a single smbd as two different users using two session setups. Samba on Linux can still switch between the two uids, proved by two different files created via those sessions. Volker (This used to be commit 556c62f93535c606122b22e7e843d9da9a1cd438) --- source3/lib/afs.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 882442a79f..fc78950f39 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -185,13 +185,9 @@ BOOL afs_login(connection_struct *conn) strncpy(p, cell, sizeof(ticket)-PTR_DIFF(p,ticket)-1); p += strlen(p)+1; - /* As long as we still only use the effective UID we need to set the - * token for it here as well. This involves patching AFS in two - * places. Once we start using the real uid where we have the - * setresuid function, we can use getuid() here which would be more - * correct. */ - - ct.ViceId = geteuid(); + /* This assumes that we have setresuid and set the real uid as well as + the effective uid in set_effective_uid(). */ + ct.ViceId = getuid(); DEBUG(10, ("Creating Token for uid %d\n", ct.ViceId)); /* Alice's network layer address. At least Openafs-1.2.10 -- cgit From 0ac7dcce6ba47517cd279907071cb50b16b82d16 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Tue, 30 Dec 2003 16:00:56 +0000 Subject: The AFS pts command always generates completely lower-case user names. As case is not significant in windows user names we should not lose information by lower-casing the name before handing it to AFS. Volker (This used to be commit 6d2285b6d1599648661be47abaaa888419700d22) --- source3/lib/afs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index fc78950f39..789afcdd83 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -142,6 +142,10 @@ BOOL afs_login(connection_struct *conn) pstrcpy(afs_username, lp_afs_username_map()); standard_sub_conn(conn, afs_username, sizeof(afs_username)); + /* The pts command always generates completely lower-case user + * names. */ + strlower_m(afs_username); + cell = strchr(afs_username, '@'); if (cell == NULL) { @@ -152,7 +156,6 @@ BOOL afs_login(connection_struct *conn) *cell = '\0'; cell += 1; - strlower_m(cell); DEBUG(10, ("Trying to log into AFS for user %s@%s\n", afs_username, cell)); -- cgit From 56e7c149babcf41e5c510104a8e0cdca56f227f0 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Thu, 1 Apr 2004 12:31:50 +0000 Subject: This restructures lib/afs.c so that the token data can be but into a stream. This is to implement wbinfo -k that asks winbind for authentication which then creates the AFS token for the authenticated user. Volker (This used to be commit 2df6750a079820826013360fb9e47f90bc8223a5) --- source3/lib/afs.c | 361 ++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 294 insertions(+), 67 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 789afcdd83..ce972ec27b 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -43,6 +43,130 @@ struct ClearToken { uint32 EndTimestamp; }; +static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, + const struct ClearToken *ct) +{ + char *base64_ticket; + char *result; + + DATA_BLOB key = data_blob(ct->HandShakeKey, 8); + char *base64_key; + + base64_ticket = base64_encode_data_blob(ticket); + if (base64_ticket == NULL) + return NULL; + + base64_key = base64_encode_data_blob(key); + if (base64_key == NULL) { + free(base64_ticket); + return NULL; + } + + asprintf(&result, "%s\n%u\n%s\n%u\n%u\n%u\n%s\n", cell, + ct->AuthHandle, base64_key, ct->ViceId, ct->BeginTimestamp, + ct->EndTimestamp, base64_ticket); + + DEBUG(10, ("Got ticket string:\n%s\n", result)); + + free(base64_ticket); + free(base64_key); + + return result; +} + +static BOOL afs_decode_token(const char *string, char **cell, + DATA_BLOB *ticket, struct ClearToken *ct) +{ + DATA_BLOB blob; + struct ClearToken result_ct; + + char *s = strdup(string); + + char *t; + + if ((t = strtok(s, "\n")) == NULL) { + DEBUG(10, ("strtok failed\n")); + return False; + } + + *cell = strdup(t); + + if ((t = strtok(NULL, "\n")) == NULL) { + DEBUG(10, ("strtok failed\n")); + return False; + } + + if (sscanf(t, "%u", &result_ct.AuthHandle) != 1) { + DEBUG(10, ("sscanf AuthHandle failed\n")); + return False; + } + + if ((t = strtok(NULL, "\n")) == NULL) { + DEBUG(10, ("strtok failed\n")); + return False; + } + + blob = base64_decode_data_blob(t); + + if ( (blob.data == NULL) || + (blob.length != sizeof(result_ct.HandShakeKey) )) { + DEBUG(10, ("invalid key: %x/%d\n", (uint32)blob.data, + blob.length)); + return False; + } + + memcpy(result_ct.HandShakeKey, blob.data, blob.length); + + data_blob_free(&blob); + + if ((t = strtok(NULL, "\n")) == NULL) { + DEBUG(10, ("strtok failed\n")); + return False; + } + + if (sscanf(t, "%u", &result_ct.ViceId) != 1) { + DEBUG(10, ("sscanf ViceId failed\n")); + return False; + } + + if ((t = strtok(NULL, "\n")) == NULL) { + DEBUG(10, ("strtok failed\n")); + return False; + } + + if (sscanf(t, "%u", &result_ct.BeginTimestamp) != 1) { + DEBUG(10, ("sscanf BeginTimestamp failed\n")); + return False; + } + + if ((t = strtok(NULL, "\n")) == NULL) { + DEBUG(10, ("strtok failed\n")); + return False; + } + + if (sscanf(t, "%u", &result_ct.EndTimestamp) != 1) { + DEBUG(10, ("sscanf EndTimestamp failed\n")); + return False; + } + + if ((t = strtok(NULL, "\n")) == NULL) { + DEBUG(10, ("strtok failed\n")); + return False; + } + + blob = base64_decode_data_blob(t); + + if (blob.data == NULL) { + DEBUG(10, ("Could not get ticket\n")); + return False; + } + + *ticket = blob; + *ct = result_ct; + + return True; +} + /* Put an AFS token into the Kernel so that it can authenticate against the AFS server. This assumes correct local uid settings. @@ -53,9 +177,9 @@ struct ClearToken { to avoid. */ -static BOOL afs_settoken(const char *username, const char *cell, +static BOOL afs_settoken(const char *cell, const struct ClearToken *ctok, - char *v4tkt_data, int v4tkt_length) + DATA_BLOB ticket) { int ret; struct { @@ -67,10 +191,10 @@ static BOOL afs_settoken(const char *username, const char *cell, char *p = buf; int tmp; - memcpy(p, &v4tkt_length, sizeof(uint32)); + memcpy(p, &ticket.length, sizeof(uint32)); p += sizeof(uint32); - memcpy(p, v4tkt_data, v4tkt_length); - p += v4tkt_length; + memcpy(p, ticket.data, ticket.length); + p += ticket.length; tmp = sizeof(struct ClearToken); memcpy(p, &tmp, sizeof(uint32)); @@ -109,90 +233,69 @@ static BOOL afs_settoken(const char *username, const char *cell, return (ret == 0); } -/* - This routine takes a radical approach completely defeating the - Kerberos idea of security and using AFS simply as an intelligent - file backend. Samba has persuaded itself somehow that the user is - actually correctly identified and then we create a ticket that the - AFS server hopefully accepts using its KeyFile that the admin has - kindly stored to our secrets.tdb. - - Thanks to the book "Network Security -- PRIVATE Communication in a - PUBLIC World" by Charlie Kaufman, Radia Perlman and Mike Speciner - Kerberos 4 tickets are not really hard to construct. - - For the comments "Alice" is the User to be auth'ed, and "Bob" is the - AFS server. */ - -BOOL afs_login(connection_struct *conn) +BOOL afs_settoken_str(const char *token_string) { - fstring ticket; - char *p = ticket; - uint32 len; - struct afs_key key; - pstring afs_username; - char *cell; - + DATA_BLOB ticket; struct ClearToken ct; + BOOL result; + char *cell; - uint32 now; /* I assume time() returns 32 bit */ + if (!afs_decode_token(token_string, &cell, &ticket, &ct)) + return False; - des_key_schedule key_schedule; + if (geteuid() != 0) + ct.ViceId = getuid(); - pstrcpy(afs_username, lp_afs_username_map()); - standard_sub_conn(conn, afs_username, sizeof(afs_username)); + result = afs_settoken(cell, &ct, ticket); - /* The pts command always generates completely lower-case user - * names. */ - strlower_m(afs_username); + SAFE_FREE(cell); + data_blob_free(&ticket); - cell = strchr(afs_username, '@'); - - if (cell == NULL) { - DEBUG(1, ("AFS username doesn't contain a @, " - "could not find cell\n")); - return False; + return result; } - *cell = '\0'; - cell += 1; +/* Create a ClearToken and an encrypted ticket. ClearToken has not yet the + * ViceId set, this should be set by the caller. */ - DEBUG(10, ("Trying to log into AFS for user %s@%s\n", - afs_username, cell)); +static BOOL afs_createtoken(const char *username, const char *cell, + DATA_BLOB *ticket, struct ClearToken *ct) +{ + fstring clear_ticket; + char *p = clear_ticket; + uint32 len; + uint32 now; + + struct afs_key key; + des_key_schedule key_schedule; if (!secrets_init()) return False; if (!secrets_fetch_afs_key(cell, &key)) { - DEBUG(5, ("Could not fetch AFS service key\n")); + DEBUG(1, ("Could not fetch AFS service key\n")); return False; } - ct.AuthHandle = key.kvno; + ct->AuthHandle = key.kvno; /* Build the ticket. This is going to be encrypted, so in our way we fill in ct while we still have the unencrypted form. */ - p = ticket; + p = clear_ticket; /* The byte-order */ *p = 1; p += 1; /* "Alice", the client username */ - strncpy(p, afs_username, sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, username, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1); p += strlen(p)+1; - strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1); p += strlen(p)+1; - strncpy(p, cell, sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, cell, sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1); p += strlen(p)+1; - /* This assumes that we have setresuid and set the real uid as well as - the effective uid in set_effective_uid(). */ - ct.ViceId = getuid(); - DEBUG(10, ("Creating Token for uid %d\n", ct.ViceId)); - /* Alice's network layer address. At least Openafs-1.2.10 ignores this, so we fill in a dummy value here. */ SIVAL(p, 0, 0); @@ -203,7 +306,7 @@ BOOL afs_login(connection_struct *conn) /* Our client code needs the the key in the clear, it does not know the server-key ... */ - memcpy(ct.HandShakeKey, p, 8); + memcpy(ct->HandShakeKey, p, 8); p += 8; @@ -216,37 +319,151 @@ BOOL afs_login(connection_struct *conn) /* Ticket creation time */ now = time(NULL); SIVAL(p, 0, now); - ct.BeginTimestamp = now; + ct->BeginTimestamp = now; - ct.EndTimestamp = now + (255*60*5); - if (((ct.EndTimestamp - ct.BeginTimestamp) & 1) == 1) { - ct.BeginTimestamp += 1; /* Lifetime must be even */ + ct->EndTimestamp = now + (255*60*5); + if (((ct->EndTimestamp - ct->BeginTimestamp) & 1) == 1) { + ct->BeginTimestamp += 1; /* Lifetime must be even */ } p += 4; /* And here comes Bob's name and instance, in this case the AFS server. */ - strncpy(p, "afs", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, "afs", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1); p += strlen(p)+1; - strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, "", sizeof(clear_ticket)-PTR_DIFF(p,clear_ticket)-1); p += strlen(p)+1; /* And zero-pad to a multiple of 8 bytes */ - len = PTR_DIFF(p, ticket); + len = PTR_DIFF(p, clear_ticket); if (len & 7) { uint32 extra_space = 8-(len & 7); memset(p, 0, extra_space); p+=extra_space; } - len = PTR_DIFF(p, ticket); + len = PTR_DIFF(p, clear_ticket); des_key_sched((const_des_cblock *)key.key, key_schedule); - des_pcbc_encrypt(ticket, ticket, + des_pcbc_encrypt(clear_ticket, clear_ticket, len, key_schedule, (C_Block *)key.key, 1); ZERO_STRUCT(key); - return afs_settoken(afs_username, cell, &ct, ticket, len); + *ticket = data_blob(clear_ticket, len); + + return True; +} + +char *afs_createtoken_str(const char *username, const char *cell) +{ + DATA_BLOB ticket; + struct ClearToken ct; + char *result; + + if (!afs_createtoken(username, cell, &ticket, &ct)) + return NULL; + + result = afs_encode_token(cell, ticket, &ct); + + data_blob_free(&ticket); + + return result; +} + +/* + This routine takes a radical approach completely bypassing the + Kerberos idea of security and using AFS simply as an intelligent + file backend. Samba has persuaded itself somehow that the user is + actually correctly identified and then we create a ticket that the + AFS server hopefully accepts using its KeyFile that the admin has + kindly stored to our secrets.tdb. + + Thanks to the book "Network Security -- PRIVATE Communication in a + PUBLIC World" by Charlie Kaufman, Radia Perlman and Mike Speciner + Kerberos 4 tickets are not really hard to construct. + + For the comments "Alice" is the User to be auth'ed, and "Bob" is the + AFS server. */ + +BOOL afs_login(connection_struct *conn) +{ + DATA_BLOB ticket; + pstring afs_username; + char *cell; + BOOL result; + + struct ClearToken ct; + + pstrcpy(afs_username, lp_afs_username_map()); + standard_sub_conn(conn, afs_username, sizeof(afs_username)); + + /* The pts command always generates completely lower-case user + * names. */ + strlower_m(afs_username); + + cell = strchr(afs_username, '@'); + + if (cell == NULL) { + DEBUG(1, ("AFS username doesn't contain a @, " + "could not find cell\n")); + return False; + } + + *cell = '\0'; + cell += 1; + + DEBUG(10, ("Trying to log into AFS for user %s@%s\n", + afs_username, cell)); + + if (!afs_createtoken(afs_username, cell, &ticket, &ct)) + return False; + + /* For which Unix-UID do we want to set the token? */ + ct.ViceId = getuid(); + + { + char *str, *new_cell; + DATA_BLOB test_ticket; + struct ClearToken test_ct; + + hex_encode(ct.HandShakeKey, sizeof(ct.HandShakeKey), &str); + DEBUG(10, ("Key: %s\n", str)); + free(str); + + str = afs_encode_token(cell, ticket, &ct); + + if (!afs_decode_token(str, &new_cell, &test_ticket, + &test_ct)) { + DEBUG(0, ("Could not decode token")); + goto decode_failed; + } + + if (strcmp(cell, new_cell) != 0) { + DEBUG(0, ("cell changed\n")); + } + + if ((ticket.length != test_ticket.length) || + (memcmp(ticket.data, test_ticket.data, + ticket.length) != 0)) { + DEBUG(0, ("Ticket changed\n")); + } + + if (memcmp(&ct, &test_ct, sizeof(ct)) != 0) { + DEBUG(0, ("ClearToken changed\n")); + } + + data_blob_free(&test_ticket); + + decode_failed: + SAFE_FREE(str); + SAFE_FREE(new_cell); + } + + result = afs_settoken(cell, &ct, ticket); + + data_blob_free(&ticket); + + return result; } #else @@ -256,4 +473,14 @@ BOOL afs_login(connection_struct *conn) return True; } +BOOL afs_settoken_str(const char *token_string) +{ + return False; +} + +char *afs_createtoken_str(const char *username, const char *cell) +{ + return False; +} + #endif /* WITH_FAKE_KASERVER */ -- cgit From 68938182ff7ced3dd7fee30f9e7f090da2b53238 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sun, 2 May 2004 12:13:16 +0000 Subject: r449: Two AFS-related things: Split off the non-crypto related parts of lib/afs.c into lib/afs_settoken.c. This makes wbinfo link without -lcrypto. Commit vfs_afsacl.c, display & set AFS acls via the NT security editor. Volker (This used to be commit 43870a3fc1073cf7d60f1becae5c2ff98ab49439) --- source3/lib/afs.c | 232 +----------------------------------------------------- 1 file changed, 4 insertions(+), 228 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index ce972ec27b..0830a3a0e7 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -29,12 +29,6 @@ #include #include -_syscall5(int, afs_syscall, int, subcall, - char *, path, - int, cmd, - char *, cmarg, - int, follow); - struct ClearToken { uint32 AuthHandle; char HandShakeKey[8]; @@ -74,186 +68,6 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, return result; } -static BOOL afs_decode_token(const char *string, char **cell, - DATA_BLOB *ticket, struct ClearToken *ct) -{ - DATA_BLOB blob; - struct ClearToken result_ct; - - char *s = strdup(string); - - char *t; - - if ((t = strtok(s, "\n")) == NULL) { - DEBUG(10, ("strtok failed\n")); - return False; - } - - *cell = strdup(t); - - if ((t = strtok(NULL, "\n")) == NULL) { - DEBUG(10, ("strtok failed\n")); - return False; - } - - if (sscanf(t, "%u", &result_ct.AuthHandle) != 1) { - DEBUG(10, ("sscanf AuthHandle failed\n")); - return False; - } - - if ((t = strtok(NULL, "\n")) == NULL) { - DEBUG(10, ("strtok failed\n")); - return False; - } - - blob = base64_decode_data_blob(t); - - if ( (blob.data == NULL) || - (blob.length != sizeof(result_ct.HandShakeKey) )) { - DEBUG(10, ("invalid key: %x/%d\n", (uint32)blob.data, - blob.length)); - return False; - } - - memcpy(result_ct.HandShakeKey, blob.data, blob.length); - - data_blob_free(&blob); - - if ((t = strtok(NULL, "\n")) == NULL) { - DEBUG(10, ("strtok failed\n")); - return False; - } - - if (sscanf(t, "%u", &result_ct.ViceId) != 1) { - DEBUG(10, ("sscanf ViceId failed\n")); - return False; - } - - if ((t = strtok(NULL, "\n")) == NULL) { - DEBUG(10, ("strtok failed\n")); - return False; - } - - if (sscanf(t, "%u", &result_ct.BeginTimestamp) != 1) { - DEBUG(10, ("sscanf BeginTimestamp failed\n")); - return False; - } - - if ((t = strtok(NULL, "\n")) == NULL) { - DEBUG(10, ("strtok failed\n")); - return False; - } - - if (sscanf(t, "%u", &result_ct.EndTimestamp) != 1) { - DEBUG(10, ("sscanf EndTimestamp failed\n")); - return False; - } - - if ((t = strtok(NULL, "\n")) == NULL) { - DEBUG(10, ("strtok failed\n")); - return False; - } - - blob = base64_decode_data_blob(t); - - if (blob.data == NULL) { - DEBUG(10, ("Could not get ticket\n")); - return False; - } - - *ticket = blob; - *ct = result_ct; - - return True; -} - -/* - Put an AFS token into the Kernel so that it can authenticate against - the AFS server. This assumes correct local uid settings. - - This is currently highly Linux and OpenAFS-specific. The correct API - call for this would be ktc_SetToken. But to do that we would have to - import a REALLY big bunch of libraries which I would currently like - to avoid. -*/ - -static BOOL afs_settoken(const char *cell, - const struct ClearToken *ctok, - DATA_BLOB ticket) -{ - int ret; - struct { - char *in, *out; - uint16 in_size, out_size; - } iob; - - char buf[1024]; - char *p = buf; - int tmp; - - memcpy(p, &ticket.length, sizeof(uint32)); - p += sizeof(uint32); - memcpy(p, ticket.data, ticket.length); - p += ticket.length; - - tmp = sizeof(struct ClearToken); - memcpy(p, &tmp, sizeof(uint32)); - p += sizeof(uint32); - memcpy(p, ctok, tmp); - p += tmp; - - tmp = 0; - - memcpy(p, &tmp, sizeof(uint32)); - p += sizeof(uint32); - - tmp = strlen(cell); - if (tmp >= MAXKTCREALMLEN) { - DEBUG(1, ("Realm too long\n")); - return False; - } - - strncpy(p, cell, tmp); - p += tmp; - *p = 0; - p +=1; - - iob.in = buf; - iob.in_size = PTR_DIFF(p,buf); - iob.out = buf; - iob.out_size = sizeof(buf); - -#if 0 - file_save("/tmp/ioctlbuf", iob.in, iob.in_size); -#endif - - ret = afs_syscall(AFSCALL_PIOCTL, 0, VIOCSETTOK, (char *)&iob, 0); - - DEBUG(10, ("afs VIOCSETTOK returned %d\n", ret)); - return (ret == 0); -} - -BOOL afs_settoken_str(const char *token_string) -{ - DATA_BLOB ticket; - struct ClearToken ct; - BOOL result; - char *cell; - - if (!afs_decode_token(token_string, &cell, &ticket, &ct)) - return False; - - if (geteuid() != 0) - ct.ViceId = getuid(); - - result = afs_settoken(cell, &ct, ticket); - - SAFE_FREE(cell); - data_blob_free(&ticket); - - return result; - } - /* Create a ClearToken and an encrypted ticket. ClearToken has not yet the * ViceId set, this should be set by the caller. */ @@ -391,6 +205,7 @@ BOOL afs_login(connection_struct *conn) pstring afs_username; char *cell; BOOL result; + char *ticket_str; struct ClearToken ct; @@ -421,45 +236,11 @@ BOOL afs_login(connection_struct *conn) /* For which Unix-UID do we want to set the token? */ ct.ViceId = getuid(); - { - char *str, *new_cell; - DATA_BLOB test_ticket; - struct ClearToken test_ct; - - hex_encode(ct.HandShakeKey, sizeof(ct.HandShakeKey), &str); - DEBUG(10, ("Key: %s\n", str)); - free(str); - - str = afs_encode_token(cell, ticket, &ct); + ticket_str = afs_encode_token(cell, ticket, &ct); - if (!afs_decode_token(str, &new_cell, &test_ticket, - &test_ct)) { - DEBUG(0, ("Could not decode token")); - goto decode_failed; - } + result = afs_settoken_str(ticket_str); - if (strcmp(cell, new_cell) != 0) { - DEBUG(0, ("cell changed\n")); - } - - if ((ticket.length != test_ticket.length) || - (memcmp(ticket.data, test_ticket.data, - ticket.length) != 0)) { - DEBUG(0, ("Ticket changed\n")); - } - - if (memcmp(&ct, &test_ct, sizeof(ct)) != 0) { - DEBUG(0, ("ClearToken changed\n")); - } - - data_blob_free(&test_ticket); - - decode_failed: - SAFE_FREE(str); - SAFE_FREE(new_cell); - } - - result = afs_settoken(cell, &ct, ticket); + SAFE_FREE(ticket_str); data_blob_free(&ticket); @@ -473,11 +254,6 @@ BOOL afs_login(connection_struct *conn) return True; } -BOOL afs_settoken_str(const char *token_string) -{ - return False; -} - char *afs_createtoken_str(const char *username, const char *cell) { return False; -- cgit From 9d0783bf211dffe58845b36b0669f05bf8bf25b5 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 14 Jul 2004 04:36:01 +0000 Subject: r1492: Rework our random number generation system. On systems with /dev/urandom, this avoids a change to secrets.tdb for every fork(). For other systems, we now only re-seed after a fork, and on startup. No need to do it per-operation. This removes the 'need_reseed' parameter from generate_random_buffer(). Andrew Bartlett (This used to be commit 36741d3cf53a7bd17d361251f2bb50851cdb035f) --- source3/lib/afs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 0830a3a0e7..8688fde6b1 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -116,7 +116,7 @@ static BOOL afs_createtoken(const char *username, const char *cell, p += 4; /* We need to create a session key */ - generate_random_buffer(p, 8, False); + generate_random_buffer(p, 8); /* Our client code needs the the key in the clear, it does not know the server-key ... */ -- cgit From efe5a8eb0bb8805d1630663ad827ef3a68565f37 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Fri, 17 Dec 2004 09:35:54 +0000 Subject: r4252: Comment clarification from Love Hörnquist Åstrand . MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thanks, Volker (This used to be commit 207625c7ab8ce41d7b59981e6a767dc299178335) --- source3/lib/afs.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 8688fde6b1..d3921ab9be 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -124,9 +124,13 @@ static BOOL afs_createtoken(const char *username, const char *cell, p += 8; - /* Ticket lifetime. We fake everything here, so go as long as - possible. This is in 5-minute intervals, so 255 is 21 hours - and 15 minutes.*/ + /* This is a kerberos 4 life time. The life time is expressed + * in units of 5 minute intervals up to 38400 seconds, after + * that a table is used up to lifetime 0xBF. Values between + * 0xC0 and 0xFF is undefined. 0xFF is defined to be the + * infinite time that never expire. + * + * So here we cheat and use the infinite time */ *p = 255; p += 1; -- cgit From c96872d3ab895ccf122f077a54104542cb3f772b Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Fri, 17 Dec 2004 11:42:10 +0000 Subject: r4256: Add a patch from kllin@it.su.se: New Parameter 'afs token lifetime' tells the AFS client when to throw away a token. Thanks, Volker (This used to be commit 836a8277b2281bcdb6eab8339b05bec61b49eb74) --- source3/lib/afs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index d3921ab9be..5ff027ee01 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -139,7 +139,11 @@ static BOOL afs_createtoken(const char *username, const char *cell, SIVAL(p, 0, now); ct->BeginTimestamp = now; - ct->EndTimestamp = now + (255*60*5); + if(lp_afs_token_lifetime() == 0) + ct->EndTimestamp = NEVERDATE; + else + ct->EndTimestamp = now + lp_afs_token_lifetime(); + if (((ct->EndTimestamp - ct->BeginTimestamp) & 1) == 1) { ct->BeginTimestamp += 1; /* Lifetime must be even */ } -- cgit From aa9132cc55d43d9d197e3196fc7098eec6e8615a Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Fri, 11 Feb 2005 10:32:46 +0000 Subject: r5331: Support SIDs as %s replacements in the afs username map parameter. Add 'log nt token command' parameter. If set, %s is replaced with the user sid, and %t takes all the group sids. Volker (This used to be commit e7dc9fde45c750013ad07f584599dd51f8eb8a54) --- source3/lib/afs.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 5ff027ee01..7f79429b9e 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -214,12 +214,16 @@ BOOL afs_login(connection_struct *conn) char *cell; BOOL result; char *ticket_str; + DOM_SID user_sid; struct ClearToken ct; pstrcpy(afs_username, lp_afs_username_map()); standard_sub_conn(conn, afs_username, sizeof(afs_username)); + if (NT_STATUS_IS_OK(uid_to_sid(&user_sid, conn->uid))) + pstring_sub(afs_username, "%s", sid_string_static(&user_sid)); + /* The pts command always generates completely lower-case user * names. */ strlower_m(afs_username); -- cgit From a69fee3ca6383df87f6e5d669d532d07767bc112 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Fri, 13 May 2005 12:21:35 +0000 Subject: r6779: Use the SID in the user token for the %s expansion in 'afs username map'. This fixes a rather weird problem where an algorithmic SID ended up as the replacement for %s. Volker (This used to be commit 67dbc91b27aeeeab3cc1360137db1dd955728061) --- source3/lib/afs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 7f79429b9e..b8173f7cc1 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -209,20 +209,21 @@ char *afs_createtoken_str(const char *username, const char *cell) BOOL afs_login(connection_struct *conn) { + extern struct current_user current_user; DATA_BLOB ticket; pstring afs_username; char *cell; BOOL result; char *ticket_str; - DOM_SID user_sid; + const DOM_SID *user_sid; struct ClearToken ct; pstrcpy(afs_username, lp_afs_username_map()); standard_sub_conn(conn, afs_username, sizeof(afs_username)); - if (NT_STATUS_IS_OK(uid_to_sid(&user_sid, conn->uid))) - pstring_sub(afs_username, "%s", sid_string_static(&user_sid)); + user_sid = ¤t_user.nt_user_token->user_sids[0]; + pstring_sub(afs_username, "%s", sid_string_static(user_sid)); /* The pts command always generates completely lower-case user * names. */ -- cgit From e2b4d0ad75001131f26e7f847b7e0d9959de2e98 Mon Sep 17 00:00:00 2001 From: Günther Deschner Date: Thu, 13 Oct 2005 22:11:18 +0000 Subject: r10976: Fix the build with openssl-0.9.8a. Guenther (This used to be commit 081409a724fce1f6e6f29bfcc824fd3f5ec6d9ff) --- source3/lib/afs.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index b8173f7cc1..8a304adcf0 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -22,6 +22,8 @@ #ifdef WITH_FAKE_KASERVER +#define NO_ASN1_TYPEDEFS 1 + #include #include #include -- cgit From fbdcf2663b56007a438ac4f0d8d82436b1bfe688 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Tue, 11 Jul 2006 18:01:26 +0000 Subject: r16945: Sync trunk -> 3.0 for 3.0.24 code. Still need to do the upper layer directories but this is what everyone is waiting for.... Jeremy. (This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8) --- source3/lib/afs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 8a304adcf0..ea83fdebc2 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -211,6 +211,7 @@ char *afs_createtoken_str(const char *username, const char *cell) BOOL afs_login(connection_struct *conn) { + extern userdom_struct current_user_info; extern struct current_user current_user; DATA_BLOB ticket; pstring afs_username; @@ -222,7 +223,11 @@ BOOL afs_login(connection_struct *conn) struct ClearToken ct; pstrcpy(afs_username, lp_afs_username_map()); - standard_sub_conn(conn, afs_username, sizeof(afs_username)); + standard_sub_advanced(SNUM(conn), conn->user, + conn->connectpath, conn->gid, + get_current_username(), + current_user_info.domain, + afs_username, sizeof(afs_username)); user_sid = ¤t_user.nt_user_token->user_sids[0]; pstring_sub(afs_username, "%s", sid_string_static(user_sid)); -- cgit From d824b98f80ba186030cbb70b3a1e5daf80469ecd Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 9 Jul 2007 19:25:36 +0000 Subject: r23779: Change from v2 or later to v3 or later. Jeremy. (This used to be commit 407e6e695b8366369b7c76af1ff76869b45347b3) --- source3/lib/afs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index ea83fdebc2..7311ed1bd6 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -5,7 +5,7 @@ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or + * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, -- cgit From 153cfb9c83534b09f15cc16205d7adb19b394928 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 10 Jul 2007 05:23:25 +0000 Subject: r23801: The FSF has moved around a lot. This fixes their Mass Ave address. (This used to be commit 87c91e4362c51819032bfbebbb273c52e203b227) --- source3/lib/afs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 7311ed1bd6..3adab490e9 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -14,8 +14,7 @@ * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + * along with this program; if not, see . */ #include "includes.h" -- cgit From 30191d1a5704ad2b158386b511558972d539ce47 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 18 Oct 2007 17:40:25 -0700 Subject: RIP BOOL. Convert BOOL -> bool. I found a few interesting bugs in various places whilst doing this (places that assumed BOOL == int). I also need to fix the Samba4 pidl generation (next checkin). Jeremy. (This used to be commit f35a266b3cbb3e5fa6a86be60f34fe340a3ca71f) --- source3/lib/afs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 3adab490e9..e9a7059028 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -72,7 +72,7 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, /* Create a ClearToken and an encrypted ticket. ClearToken has not yet the * ViceId set, this should be set by the caller. */ -static BOOL afs_createtoken(const char *username, const char *cell, +static bool afs_createtoken(const char *username, const char *cell, DATA_BLOB *ticket, struct ClearToken *ct) { fstring clear_ticket; @@ -208,14 +208,14 @@ char *afs_createtoken_str(const char *username, const char *cell) For the comments "Alice" is the User to be auth'ed, and "Bob" is the AFS server. */ -BOOL afs_login(connection_struct *conn) +bool afs_login(connection_struct *conn) { extern userdom_struct current_user_info; extern struct current_user current_user; DATA_BLOB ticket; pstring afs_username; char *cell; - BOOL result; + bool result; char *ticket_str; const DOM_SID *user_sid; @@ -268,7 +268,7 @@ BOOL afs_login(connection_struct *conn) #else -BOOL afs_login(connection_struct *conn) +bool afs_login(connection_struct *conn) { return True; } -- cgit From 62b97b01561e332d3b566c4f70cc2601e2d7fcac Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sun, 28 Oct 2007 19:15:08 +0100 Subject: Make base64_encode_data_blob return a talloced string (This used to be commit 5f205ab48d8ac3b7af573ea0be1ce095ab835448) --- source3/lib/afs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index e9a7059028..35f213fd08 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -53,7 +53,7 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, base64_key = base64_encode_data_blob(key); if (base64_key == NULL) { - free(base64_ticket); + TALLOC_FREE(base64_ticket); return NULL; } @@ -63,8 +63,8 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, DEBUG(10, ("Got ticket string:\n%s\n", result)); - free(base64_ticket); - free(base64_key); + TALLOC_FREE(base64_ticket); + TALLOC_FREE(base64_key); return result; } -- cgit From 68be9a820059ee96dd26c527efd7c14e679d3f2c Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 15 Nov 2007 14:19:52 -0800 Subject: More pstring removal. This one was tricky. I had to add one horror (pstring_clean_name()) which will have to remain until I've removed all pstrings from the client code. Jeremy. (This used to be commit 1ea3ac80146b83c2522b69e7747c823366a2b47d) --- source3/lib/afs.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 35f213fd08..dadd83d513 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -213,10 +213,10 @@ bool afs_login(connection_struct *conn) extern userdom_struct current_user_info; extern struct current_user current_user; DATA_BLOB ticket; - pstring afs_username; - char *cell; + char *afs_username = NULL; + char *cell = NULL; bool result; - char *ticket_str; + char *ticket_str = NULL; const DOM_SID *user_sid; struct ClearToken ct; @@ -229,7 +229,13 @@ bool afs_login(connection_struct *conn) afs_username, sizeof(afs_username)); user_sid = ¤t_user.nt_user_token->user_sids[0]; - pstring_sub(afs_username, "%s", sid_string_static(user_sid)); + afs_username = talloc_string_sub(talloc_tos(), + lp_afs_username_map(), + "%s", + sid_string_static(user_sid)); + if (!afs_username) { + return false; + } /* The pts command always generates completely lower-case user * names. */ @@ -240,13 +246,13 @@ bool afs_login(connection_struct *conn) if (cell == NULL) { DEBUG(1, ("AFS username doesn't contain a @, " "could not find cell\n")); - return False; + return false; } *cell = '\0'; cell += 1; - DEBUG(10, ("Trying to log into AFS for user %s@%s\n", + DEBUG(10, ("Trying to log into AFS for user %s@%s\n", afs_username, cell)); if (!afs_createtoken(afs_username, cell, &ticket, &ct)) -- cgit From acf15ae730c95443681404c76b67ccfca0253d8b Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Fri, 7 Dec 2007 12:26:32 -0800 Subject: Don't build rpctorture anymore - not maintained. Just remove. Remove all vestiges of pstring (except for smbctool as noted in previous commit). Jeremy (This used to be commit 4c32a22ac50ada3275d2ffba3c1aa08bee7d1549) --- source3/lib/afs.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index dadd83d513..a815c21907 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -218,19 +218,29 @@ bool afs_login(connection_struct *conn) bool result; char *ticket_str = NULL; const DOM_SID *user_sid; + TALLOC_CTX *ctx = talloc_tos(); struct ClearToken ct; - pstrcpy(afs_username, lp_afs_username_map()); - standard_sub_advanced(SNUM(conn), conn->user, - conn->connectpath, conn->gid, - get_current_username(), - current_user_info.domain, - afs_username, sizeof(afs_username)); + afs_username = talloc_strdup(ctx, + lp_afs_username_map()); + if (!afs_username) { + return false; + } + + afs_username = talloc_sub_advanced(ctx, + SNUM(conn), conn->user, + conn->connectpath, conn->gid, + get_current_username(), + current_user_info.domain, + afs_username); + if (!afs_username) { + return false; + } user_sid = ¤t_user.nt_user_token->user_sids[0]; afs_username = talloc_string_sub(talloc_tos(), - lp_afs_username_map(), + afs_username, "%s", sid_string_static(user_sid)); if (!afs_username) { -- cgit From 900288a2b86abd247f9eb4cd15dc5617a17cfef1 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sat, 15 Dec 2007 21:11:36 +0100 Subject: Replace sid_string_static by sid_string_dbg in DEBUGs (This used to be commit bb35e794ec129805e874ceba882bcc1e84791a09) --- source3/lib/afs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index a815c21907..a7d6f6c9f7 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -242,7 +242,7 @@ bool afs_login(connection_struct *conn) afs_username = talloc_string_sub(talloc_tos(), afs_username, "%s", - sid_string_static(user_sid)); + sid_string_tos(user_sid)); if (!afs_username) { return false; } -- cgit From 805caafd44cbc5fff49711b1a15fb64cc99f3ad3 Mon Sep 17 00:00:00 2001 From: Kai Blin Date: Sat, 19 Jan 2008 02:12:35 +0100 Subject: util_str: Don't return memory from talloc_tos(), use mem_ctx instead. (This used to be commit ab0ee6e9a6a9eee317228f0c2bde254ad9a59b85) --- source3/lib/afs.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index a7d6f6c9f7..b3d590bf24 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -42,20 +42,23 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, const struct ClearToken *ct) { char *base64_ticket; - char *result; + char *result = NULL; DATA_BLOB key = data_blob(ct->HandShakeKey, 8); char *base64_key; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_init("afs_encode_token"); + if (mem_ctx == NULL) + goto done; - base64_ticket = base64_encode_data_blob(ticket); + base64_ticket = base64_encode_data_blob(mem_ctx, ticket); if (base64_ticket == NULL) - return NULL; + goto done; - base64_key = base64_encode_data_blob(key); - if (base64_key == NULL) { - TALLOC_FREE(base64_ticket); - return NULL; - } + base64_key = base64_encode_data_blob(mem_ctx, key); + if (base64_key == NULL) + goto done; asprintf(&result, "%s\n%u\n%s\n%u\n%u\n%u\n%s\n", cell, ct->AuthHandle, base64_key, ct->ViceId, ct->BeginTimestamp, @@ -63,8 +66,8 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, DEBUG(10, ("Got ticket string:\n%s\n", result)); - TALLOC_FREE(base64_ticket); - TALLOC_FREE(base64_key); +done: + TALLOC_FREE(mem_ctx); return result; } -- cgit From 398c323f7544e815cfeb2b750f9ff28061c294f3 Mon Sep 17 00:00:00 2001 From: Kai Blin Date: Sat, 19 Jan 2008 12:27:31 +0100 Subject: afs: Use talloc_stackframe() instead of talloc_init() Thanks to vl for pointing this out. (This used to be commit 76cf5a979bf3014b1de660520e538546b3676b23) --- source3/lib/afs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index b3d590bf24..9f5d81f442 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -48,7 +48,7 @@ static char *afs_encode_token(const char *cell, const DATA_BLOB ticket, char *base64_key; TALLOC_CTX *mem_ctx; - mem_ctx = talloc_init("afs_encode_token"); + mem_ctx = talloc_stackframe(); if (mem_ctx == NULL) goto done; -- cgit From 84ad491173a130552b19b23af293e239bbd7290b Mon Sep 17 00:00:00 2001 From: Kai Blin Date: Wed, 14 May 2008 09:02:22 +0200 Subject: AFS: The dummy afs_createtoken_str should return NULL, not False. (This used to be commit c84d49429191423a81d558042fe949c26f5de5fe) --- source3/lib/afs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index 9f5d81f442..c4569d97bb 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -294,7 +294,7 @@ bool afs_login(connection_struct *conn) char *afs_createtoken_str(const char *username, const char *cell) { - return False; + return NULL; } #endif /* WITH_FAKE_KASERVER */ -- cgit From 50ab871813d8281760e0c70d454cba996e0b67d8 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Sun, 11 May 2008 11:26:33 +0200 Subject: Remove some references to get_current_username() and current_user_info (This used to be commit 344d69f95e217d16213eaa6b53141af6ab459708) --- source3/lib/afs.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'source3/lib/afs.c') diff --git a/source3/lib/afs.c b/source3/lib/afs.c index c4569d97bb..7193f0e46d 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -213,8 +213,6 @@ char *afs_createtoken_str(const char *username, const char *cell) bool afs_login(connection_struct *conn) { - extern userdom_struct current_user_info; - extern struct current_user current_user; DATA_BLOB ticket; char *afs_username = NULL; char *cell = NULL; @@ -234,14 +232,14 @@ bool afs_login(connection_struct *conn) afs_username = talloc_sub_advanced(ctx, SNUM(conn), conn->user, conn->connectpath, conn->gid, - get_current_username(), - current_user_info.domain, + conn->server_info->sanitized_username, + pdb_get_domain(conn->server_info->sam_account), afs_username); if (!afs_username) { return false; } - user_sid = ¤t_user.nt_user_token->user_sids[0]; + user_sid = &conn->server_info->ptok->user_sids[0]; afs_username = talloc_string_sub(talloc_tos(), afs_username, "%s", -- cgit