1da6c28aaSamw /*
2da6c28aaSamw * CDDL HEADER START
3da6c28aaSamw *
4da6c28aaSamw * The contents of this file are subject to the terms of the
5da6c28aaSamw * Common Development and Distribution License (the "License").
6da6c28aaSamw * You may not use this file except in compliance with the License.
7da6c28aaSamw *
8da6c28aaSamw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9da6c28aaSamw * or http://www.opensolaris.org/os/licensing.
10da6c28aaSamw * See the License for the specific language governing permissions
11da6c28aaSamw * and limitations under the License.
12da6c28aaSamw *
13da6c28aaSamw * When distributing Covered Code, include this CDDL HEADER in each
14da6c28aaSamw * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15da6c28aaSamw * If applicable, add the following below this CDDL HEADER, with the
16da6c28aaSamw * fields enclosed by brackets "[]" replaced with your own identifying
17da6c28aaSamw * information: Portions Copyright [yyyy] [name of copyright owner]
18da6c28aaSamw *
19da6c28aaSamw * CDDL HEADER END
20da6c28aaSamw */
215ad42b1bSSurya Prakki
22da6c28aaSamw /*
23148c5f43SAlan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24b3700b07SGordon Ross * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
25da6c28aaSamw */
26da6c28aaSamw /*
27da6c28aaSamw * Copyright 1990 by the Massachusetts Institute of Technology.
28da6c28aaSamw * All Rights Reserved.
29da6c28aaSamw *
30da6c28aaSamw * Export of this software from the United States of America may
31da6c28aaSamw * require a specific license from the United States Government.
32da6c28aaSamw * It is the responsibility of any person or organization contemplating
33da6c28aaSamw * export to obtain such a license before exporting.
34da6c28aaSamw *
35da6c28aaSamw * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
36da6c28aaSamw * distribute this software and its documentation for any purpose and
37da6c28aaSamw * without fee is hereby granted, provided that the above copyright
38da6c28aaSamw * notice appear in all copies and that both that copyright notice and
39da6c28aaSamw * this permission notice appear in supporting documentation, and that
40da6c28aaSamw * the name of M.I.T. not be used in advertising or publicity pertaining
41da6c28aaSamw * to distribution of the software without specific, written prior
42da6c28aaSamw * permission. Furthermore if you modify this software you must label
43da6c28aaSamw * your software as modified software and not distribute it in such a
44da6c28aaSamw * fashion that it might be confused with the original M.I.T. software.
45da6c28aaSamw * M.I.T. makes no representations about the suitability of
46da6c28aaSamw * this software for any purpose. It is provided "as is" without express
47da6c28aaSamw * or implied warranty.
48da6c28aaSamw *
49da6c28aaSamw *
50da6c28aaSamw * Initialize a credentials cache.
51da6c28aaSamw */
52da6c28aaSamw #include <kerberosv5/krb5.h>
53da6c28aaSamw #include <kerberosv5/com_err.h>
5455bf511dSas #include <assert.h>
55da6c28aaSamw #include <stdio.h>
56da6c28aaSamw #include <syslog.h>
57faa1795aSjb #include <errno.h>
58da6c28aaSamw
59da6c28aaSamw #include <smbsrv/libsmbns.h>
60da6c28aaSamw #include <smbns_krb.h>
61da6c28aaSamw
62a0aa776eSAlan Wright int
smb_kinit(char * domain_name,char * principal_name,char * principal_passwd)63b3700b07SGordon Ross smb_kinit(char *domain_name, char *principal_name, char *principal_passwd)
64da6c28aaSamw {
65b3700b07SGordon Ross char default_realm[MAXHOSTNAMELEN];
66a0aa776eSAlan Wright krb5_context ctx = NULL;
67a0aa776eSAlan Wright krb5_ccache cc = NULL;
68a0aa776eSAlan Wright krb5_principal me = NULL;
69da6c28aaSamw krb5_creds my_creds;
70a0aa776eSAlan Wright krb5_error_code code;
71a0aa776eSAlan Wright const char *doing = NULL;
72b3700b07SGordon Ross smb_ads_status_t err;
73a0aa776eSAlan Wright
74a0aa776eSAlan Wright assert(principal_name != NULL);
75a0aa776eSAlan Wright assert(principal_passwd != NULL);
76da6c28aaSamw
77da6c28aaSamw (void) memset(&my_creds, 0, sizeof (my_creds));
78da6c28aaSamw
79da6c28aaSamw /*
80a0aa776eSAlan Wright * From this point on, we can goto cleanup because the key variables
81a0aa776eSAlan Wright * are initialized.
82da6c28aaSamw */
83da6c28aaSamw
84a0aa776eSAlan Wright code = krb5_init_context(&ctx);
85da6c28aaSamw if (code) {
86b3700b07SGordon Ross err = SMB_ADS_KRB5_INIT_CTX;
87148c5f43SAlan Wright doing = "smbns_krb: initializing context";
88da6c28aaSamw goto cleanup;
89da6c28aaSamw }
90da6c28aaSamw
91b3700b07SGordon Ross /*
92b3700b07SGordon Ross * In case krb5.conf is not configured, set the default realm.
93b3700b07SGordon Ross */
94b3700b07SGordon Ross (void) strlcpy(default_realm, domain_name, sizeof (default_realm));
95b3700b07SGordon Ross (void) smb_strupr(default_realm);
96b3700b07SGordon Ross (void) krb5_set_default_realm(ctx, default_realm);
97b3700b07SGordon Ross
98a0aa776eSAlan Wright code = krb5_cc_default(ctx, &cc);
99a0aa776eSAlan Wright if (code != 0) {
100b3700b07SGordon Ross err = SMB_ADS_KRB5_CC_DEFAULT;
101148c5f43SAlan Wright doing = "smbns_krb: resolve default credentials cache";
102da6c28aaSamw goto cleanup;
103da6c28aaSamw }
104da6c28aaSamw
105a0aa776eSAlan Wright /* Use specified name */
106a0aa776eSAlan Wright code = krb5_parse_name(ctx, principal_name, &me);
107a0aa776eSAlan Wright if (code != 0) {
108b3700b07SGordon Ross err = SMB_ADS_KRB5_PARSE_PRINCIPAL;
109148c5f43SAlan Wright doing = "smbns_krb: parsing principal name";
110da6c28aaSamw goto cleanup;
111da6c28aaSamw }
112da6c28aaSamw
113a0aa776eSAlan Wright code = krb5_get_init_creds_password(ctx, &my_creds, me,
114a0aa776eSAlan Wright principal_passwd, NULL, 0, (krb5_deltat)0,
115a0aa776eSAlan Wright NULL, NULL);
116a0aa776eSAlan Wright if (code != 0) {
117148c5f43SAlan Wright doing = "smbns_krb: getting initial credentials";
118*7b0b8123SGordon Ross switch (code) {
119da6c28aaSamw
120*7b0b8123SGordon Ross case KRB5KRB_AP_ERR_BAD_INTEGRITY:
121*7b0b8123SGordon Ross err = SMB_ADS_KRB5_GET_INIT_CREDS_PW;
122*7b0b8123SGordon Ross break;
123*7b0b8123SGordon Ross
124*7b0b8123SGordon Ross case KRB5KRB_AP_ERR_SKEW:
125*7b0b8123SGordon Ross err = SMB_ADS_KRB5_GET_INIT_CREDS_SKEW;
126*7b0b8123SGordon Ross break;
127*7b0b8123SGordon Ross
128*7b0b8123SGordon Ross default:
129*7b0b8123SGordon Ross err = SMB_ADS_KRB5_GET_INIT_CREDS_OTHER;
130*7b0b8123SGordon Ross break;
131da6c28aaSamw }
132da6c28aaSamw
133a0aa776eSAlan Wright goto cleanup;
134da6c28aaSamw }
135da6c28aaSamw
136a0aa776eSAlan Wright code = krb5_cc_initialize(ctx, cc, me);
137a0aa776eSAlan Wright if (code != 0) {
138b3700b07SGordon Ross err = SMB_ADS_KRB5_CC_INITIALIZE;
139148c5f43SAlan Wright doing = "smbns_krb: initializing cache";
140a0aa776eSAlan Wright goto cleanup;
141da6c28aaSamw }
142da6c28aaSamw
143a0aa776eSAlan Wright code = krb5_cc_store_cred(ctx, cc, &my_creds);
144a0aa776eSAlan Wright if (code != 0) {
145b3700b07SGordon Ross err = SMB_ADS_KRB5_CC_STORE_CRED;
146148c5f43SAlan Wright doing = "smbns_krb: storing credentials";
147a0aa776eSAlan Wright goto cleanup;
148da6c28aaSamw }
14955bf511dSas
150a0aa776eSAlan Wright /* SUCCESS! */
151b3700b07SGordon Ross err = SMB_ADS_SUCCESS;
152da6c28aaSamw
153a0aa776eSAlan Wright cleanup:
154a0aa776eSAlan Wright if (code != 0) {
155*7b0b8123SGordon Ross smb_krb5_log_errmsg(ctx, doing, code);
156a0aa776eSAlan Wright }
157da6c28aaSamw
158a0aa776eSAlan Wright if (my_creds.client == me) {
159a0aa776eSAlan Wright my_creds.client = NULL;
160a0aa776eSAlan Wright }
161a0aa776eSAlan Wright krb5_free_cred_contents(ctx, &my_creds);
162da6c28aaSamw
163a0aa776eSAlan Wright if (me)
164a0aa776eSAlan Wright krb5_free_principal(ctx, me);
165a0aa776eSAlan Wright if (cc)
1665ad42b1bSSurya Prakki (void) krb5_cc_close(ctx, cc);
167a0aa776eSAlan Wright if (ctx)
168a0aa776eSAlan Wright krb5_free_context(ctx);
169da6c28aaSamw
170b3700b07SGordon Ross return (err);
171da6c28aaSamw }
172faa1795aSjb
173148c5f43SAlan Wright /*
174148c5f43SAlan Wright * Invoke krb5_get_error_message() to generate a richer error message.
175148c5f43SAlan Wright */
176148c5f43SAlan Wright void
smb_krb5_log_errmsg(krb5_context ctx,const char * prefix,krb5_error_code code)177148c5f43SAlan Wright smb_krb5_log_errmsg(krb5_context ctx, const char *prefix, krb5_error_code code)
178148c5f43SAlan Wright {
179148c5f43SAlan Wright const char *msg;
180148c5f43SAlan Wright
181148c5f43SAlan Wright msg = krb5_get_error_message(ctx, code);
182148c5f43SAlan Wright syslog(LOG_ERR, "%s (%s)", prefix, msg);
183148c5f43SAlan Wright krb5_free_error_message(ctx, msg);
184148c5f43SAlan Wright }
185148c5f43SAlan Wright
186faa1795aSjb /*
187faa1795aSjb * smb_ccache_init
188faa1795aSjb *
189faa1795aSjb * Creates the directory where the Kerberos ccache file is located
190faa1795aSjb * and set KRB5CCNAME in the environment.
191faa1795aSjb *
192faa1795aSjb * Returns 0 upon succcess. Otherwise, returns
193faa1795aSjb * -1 if it fails to create the specified directory fails.
194faa1795aSjb * -2 if it fails to set the KRB5CCNAME environment variable.
195faa1795aSjb */
196faa1795aSjb int
smb_ccache_init(char * dir,char * filename)197faa1795aSjb smb_ccache_init(char *dir, char *filename)
198faa1795aSjb {
199faa1795aSjb static char buf[MAXPATHLEN];
200faa1795aSjb
201faa1795aSjb if ((mkdir(dir, 0700) < 0) && (errno != EEXIST))
202faa1795aSjb return (-1);
203faa1795aSjb
204faa1795aSjb (void) snprintf(buf, MAXPATHLEN, "KRB5CCNAME=%s/%s", dir, filename);
205faa1795aSjb if (putenv(buf) != 0)
206faa1795aSjb return (-2);
207faa1795aSjb return (0);
208faa1795aSjb }
209faa1795aSjb
210faa1795aSjb void
smb_ccache_remove(char * path)211faa1795aSjb smb_ccache_remove(char *path)
212faa1795aSjb {
213faa1795aSjb if ((remove(path) < 0) && (errno != ENOENT))
214148c5f43SAlan Wright syslog(LOG_ERR, "smbns_krb: failed to remove ccache (%s)",
215148c5f43SAlan Wright path);
216faa1795aSjb }
217