client/cifs.upcall.c

ソースコードを見る。

型定義
typedef enum _secType	secType_t
列挙型
enum	_secType { KRB5, MS_KRB5 }
関数
int	handle_krb5_mech (const char *oid, const char *principal, DATA_BLOB *secblob, DATA_BLOB *sess_key)
int	decode_key_description (const char *desc, int *ver, secType_t *sec, char **hostname, uid_t *uid)
int	cifs_resolver (const key_serial_t key, const char *key_descr)
void	usage (void)
int	main (const int argc, char *const argv[])
変数
const char *	CIFSSPNEGO_VERSION = "1.2"
static const char *	prog = "cifs.upcall"
const DATA_BLOB	data_blob_null = { NULL, 0, NULL }

---

型定義

typedef enum _secType secType_t

---

列挙型

enum _secType

列挙型の値:

KRB5
MS_KRB5

cifs.upcall.c の 34 行で定義されています。

                      {
        KRB5,
        MS_KRB5
} secType_t;

---

関数

int handle_krb5_mech	(	const char *	oid,
		const char *	principal,
		DATA_BLOB *	secblob,
		DATA_BLOB *	sess_key
	)

cifs.upcall.c の 60 行で定義されています。

参照先 cli_krb5_get_ticket()・data_blob_free()・gen_negTokenInit()・spnego_gen_krb5_wrap().

{
        int retval;
        DATA_BLOB tkt, tkt_wrapped;

        /* get a kerberos ticket for the service and extract the session key */
        retval = cli_krb5_get_ticket(principal, 0,
                                     &tkt, sess_key, 0, NULL, NULL);

        if (retval)
                return retval;

        /* wrap that up in a nice GSS-API wrapping */
        tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);

        /* and wrap that in a shiny SPNEGO wrapper */
        *secblob = gen_negTokenInit(oid, tkt_wrapped);

        data_blob_free(&tkt_wrapped);
        data_blob_free(&tkt);
        return retval;
}

int decode_key_description	(	const char *	desc,
		int *	ver,
		secType_t *	sec,
		char **	hostname,
		uid_t *	uid
	)

cifs.upcall.c の 92 行で定義されています。

参照先 errno・index・KRB5・len・MS_KRB5・strerror()・strlcpy().

{
        int retval = 0;
        char *pos;
        const char *tkn = desc;

        do {
                pos = index(tkn, ';');
                if (strncmp(tkn, "host=", 5) == 0) {
                        int len;

                        if (pos == NULL) {
                                len = strlen(tkn);
                        } else {
                                len = pos - tkn;
                        }
                        len -= 4;
                        SAFE_FREE(*hostname);
                        *hostname = SMB_XMALLOC_ARRAY(char, len);
                        strlcpy(*hostname, tkn + 5, len);
                        retval |= DKD_HAVE_HOSTNAME;
                } else if (strncmp(tkn, "ipv4=", 5) == 0) {
                        /* BB: do we need it if we have hostname already? */
                } else if (strncmp(tkn, "ipv6=", 5) == 0) {
                        /* BB: do we need it if we have hostname already? */
                } else if (strncmp(tkn, "sec=", 4) == 0) {
                        if (strncmp(tkn + 4, "krb5", 4) == 0) {
                                retval |= DKD_HAVE_SEC;
                                *sec = KRB5;
                        } else if (strncmp(tkn + 4, "mskrb5", 6) == 0) {
                                retval |= DKD_HAVE_SEC;
                                *sec = MS_KRB5;
                        }
                } else if (strncmp(tkn, "uid=", 4) == 0) {
                        errno = 0;
                        *uid = strtol(tkn + 4, NULL, 16);
                        if (errno != 0) {
                                syslog(LOG_WARNING, "Invalid uid format: %s",
                                       strerror(errno));
                                return 1;
                        } else {
                                retval |= DKD_HAVE_UID;
                        }
                } else if (strncmp(tkn, "ver=", 4) == 0) {      /* if version */
                        errno = 0;
                        *ver = strtol(tkn + 4, NULL, 16);
                        if (errno != 0) {
                                syslog(LOG_WARNING,
                                       "Invalid version format: %s",
                                       strerror(errno));
                                return 1;
                        } else {
                                retval |= DKD_HAVE_VERSION;
                        }
                }
                if (pos == NULL)
                        break;
                tkn = pos + 1;
        } while (tkn);
        return retval;
}

int cifs_resolver	(	const key_serial_t	key,
		const char *	key_descr
	)

cifs.upcall.c の 155 行で定義されています。

参照先 c・errno・index・strerror().

{
        int c;
        struct addrinfo *addr;
        char ip[INET6_ADDRSTRLEN];
        void *p;
        const char *keyend = key_descr;
        /* skip next 4 ';' delimiters to get to description */
        for (c = 1; c <= 4; c++) {
                keyend = index(keyend+1, ';');
                if (!keyend) {
                        syslog(LOG_WARNING, "invalid key description: %s",
                                        key_descr);
                        return 1;
                }
        }
        keyend++;

        /* resolve name to ip */
        c = getaddrinfo(keyend, NULL, NULL, &addr);
        if (c) {
                syslog(LOG_WARNING, "unable to resolve hostname: %s [%s]",
                                keyend, gai_strerror(c));
                return 1;
        }

        /* conver ip to string form */
        if (addr->ai_family == AF_INET) {
                p = &(((struct sockaddr_in *)addr->ai_addr)->sin_addr);
        } else {
                p = &(((struct sockaddr_in6 *)addr->ai_addr)->sin6_addr);
        }
        if (!inet_ntop(addr->ai_family, p, ip, sizeof(ip))) {
                syslog(LOG_WARNING, "%s: inet_ntop: %s",
                                __FUNCTION__, strerror(errno));
                freeaddrinfo(addr);
                return 1;
        }

        /* setup key */
        c = keyctl_instantiate(key, ip, strlen(ip)+1, 0);
        if (c == -1) {
                syslog(LOG_WARNING, "%s: keyctl_instantiate: %s",
                                __FUNCTION__, strerror(errno));
                freeaddrinfo(addr);
                return 1;
        }

        freeaddrinfo(addr);
        return 0;
}

static void usage

(

void

)

cifs.upcall.c の 208 行で定義されています。

参照先 fprintf()・prog.

参照元 check_pac_checksum()・do_connection()・main()・parse_mount_smb()・process_nonroot()・process_options()・process_root().

{
        syslog(LOG_WARNING, "Usage: %s [-c] [-v] key_serial", prog);
        fprintf(stderr, "Usage: %s [-c] [-v] key_serial\n", prog);
}

int main	(	const int	argc,
		char *const	argv[]
	)

cifs.upcall.c の 214 行で定義されています。

参照先 buf・c・cifs_resolver()・CIFSSPNEGO_VERSION・cifs_spnego_msg::data・data_blob_free()・data_blob_null・decode_key_description()・errno・handle_krb5_mech()・KRB5・len・MS_KRB5・optind・printf()・prog・cifs_spnego_msg::secblob_len・strerror()・strlcpy()・usage()・cifs_spnego_msg::version.

{
        struct cifs_spnego_msg *keydata = NULL;
        DATA_BLOB secblob = data_blob_null;
        DATA_BLOB sess_key = data_blob_null;
        secType_t sectype;
        key_serial_t key = 0;
        size_t datalen;
        long rc = 1;
        uid_t uid;
        int kernel_upcall_version;
        int c, use_cifs_service_prefix = 0;
        char *buf, *hostname = NULL;
        const char *oid;

        openlog(prog, 0, LOG_DAEMON);

        while ((c = getopt(argc, argv, "cv")) != -1) {
                switch (c) {
                case 'c':{
                        use_cifs_service_prefix = 1;
                        break;
                        }
                case 'v':{
                        printf("version: %s\n", CIFSSPNEGO_VERSION);
                        goto out;
                        }
                default:{
                        syslog(LOG_WARNING, "unknown option: %c", c);
                        goto out;
                        }
                }
        }

        /* is there a key? */
        if (argc <= optind) {
                usage();
                goto out;
        }

        /* get key and keyring values */
        errno = 0;
        key = strtol(argv[optind], NULL, 10);
        if (errno != 0) {
                key = 0;
                syslog(LOG_WARNING, "Invalid key format: %s", strerror(errno));
                goto out;
        }

        rc = keyctl_describe_alloc(key, &buf);
        if (rc == -1) {
                syslog(LOG_WARNING, "keyctl_describe_alloc failed: %s",
                       strerror(errno));
                rc = 1;
                goto out;
        }

        if ((strncmp(buf, "cifs.resolver", sizeof("cifs.resolver")-1) == 0) ||
            (strncmp(buf, "dns_resolver", sizeof("dns_resolver")-1) == 0)) {
                rc = cifs_resolver(key, buf);
                goto out;
        }

        rc = decode_key_description(buf, &kernel_upcall_version, &sectype,
                                    &hostname, &uid);
        if ((rc & DKD_MUSTHAVE_SET) != DKD_MUSTHAVE_SET) {
                syslog(LOG_WARNING,
                       "unable to get from description necessary params");
                rc = 1;
                SAFE_FREE(buf);
                goto out;
        }
        SAFE_FREE(buf);

        if (kernel_upcall_version > CIFS_SPNEGO_UPCALL_VERSION) {
                syslog(LOG_WARNING,
                       "incompatible kernel upcall version: 0x%x",
                       kernel_upcall_version);
                rc = 1;
                goto out;
        }

        if (rc & DKD_HAVE_UID) {
                rc = setuid(uid);
                if (rc == -1) {
                        syslog(LOG_WARNING, "setuid: %s", strerror(errno));
                        goto out;
                }
        }

        /* BB: someday upcall SPNEGO blob could be checked here to decide
         * what mech to use */

        // do mech specific authorization
        switch (sectype) {
        case MS_KRB5:
        case KRB5:{
                        char *princ;
                        size_t len;

                        /* for "cifs/" service name + terminating 0 */
                        len = strlen(hostname) + 5 + 1;
                        princ = SMB_XMALLOC_ARRAY(char, len);
                        if (!princ) {
                                rc = 1;
                                break;
                        }
                        if (use_cifs_service_prefix) {
                                strlcpy(princ, "cifs/", len);
                        } else {
                                strlcpy(princ, "host/", len);
                        }
                        strlcpy(princ + 5, hostname, len - 5);

                        if (sectype == MS_KRB5)
                                oid = OID_KERBEROS5_OLD;
                        else
                                oid = OID_KERBEROS5;

                        rc = handle_krb5_mech(oid, princ, &secblob, &sess_key);
                        SAFE_FREE(princ);
                        break;
                }
        default:{
                        syslog(LOG_WARNING, "sectype: %d is not implemented",
                               sectype);
                        rc = 1;
                        break;
                }
        }

        if (rc) {
                goto out;
        }

        /* pack SecurityBLob and SessionKey into downcall packet */
        datalen =
            sizeof(struct cifs_spnego_msg) + secblob.length + sess_key.length;
        keydata = (struct cifs_spnego_msg*)SMB_XMALLOC_ARRAY(char, datalen);
        if (!keydata) {
                rc = 1;
                goto out;
        }
        keydata->version = kernel_upcall_version;
        keydata->flags = 0;
        keydata->sesskey_len = sess_key.length;
        keydata->secblob_len = secblob.length;
        memcpy(&(keydata->data), sess_key.data, sess_key.length);
        memcpy(&(keydata->data) + keydata->sesskey_len,
               secblob.data, secblob.length);

        /* setup key */
        rc = keyctl_instantiate(key, keydata, datalen, 0);
        if (rc == -1) {
                syslog(LOG_WARNING, "keyctl_instantiate: %s", strerror(errno));
                goto out;
        }

        /* BB: maybe we need use timeout for key: for example no more then
         * ticket lifietime? */
        /* keyctl_set_timeout( key, 60); */
out:
        /*
         * on error, negatively instantiate the key ourselves so that we can
         * make sure the kernel doesn't hang it off of a searchable keyring
         * and interfere with the next attempt to instantiate the key.
         */
        if (rc != 0  && key == 0)
                keyctl_negate(key, 1, KEY_REQKEY_DEFL_DEFAULT);
        data_blob_free(&secblob);
        data_blob_free(&sess_key);
        SAFE_FREE(hostname);
        SAFE_FREE(keydata);
        return rc;
}

---

変数

const char* CIFSSPNEGO_VERSION = "1.2"

cifs.upcall.c の 32 行で定義されています。

const char* prog = "cifs.upcall" [static]

cifs.upcall.c の 33 行で定義されています。

const DATA_BLOB data_blob_null = { NULL, 0, NULL }

cifs.upcall.c の 38 行で定義されています。

参照元 main().

---