lib/libgss/gssd_pname_to_uid.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <pwd.h>
#include <grp.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <thread.h>
#include <synch.h>
#include <syslog.h>
#include <deflt.h>
#include <mechglueP.h>
#include "../../cmd/gss/gsscred/gsscred.h"

static mutex_t uid_map_lock = DEFAULTMUTEX;
static int uid_map_opt = 0;

extern int _getgroupsbymember(const char *, gid_t[], int, int);

/* local function used to call a mechanisms pname_to_uid */
static OM_uint32 gss_pname_to_uid(OM_uint32*, const gss_name_t,
            const gss_OID, uid_t *);

static OM_uint32 private_gsscred_expname_to_unix_cred(const gss_buffer_t,
            uid_t *, gid_t *, gid_t **, int *);

/*
 * The gsscred functions will first attempt to call the
 * mechanism'm pname_to_uid function.  In case this function
 * returns an error or if it is not provided by a mechanism
 * then the functions will attempt to look up the principal
 * in the gsscred table.
 * It is envisioned that the pname_to_uid function will be
 * provided by only a few mechanism, which may have the principal
 * name to unix credential mapping inherently present.
 */

/*
 * Fetch gsscred options from conf file.
 */
static void
get_conf_options(int *uid_map)
{
    int  flags;
    char *ptr;
    void    *defp;
    static char *conffile = "/etc/gss/gsscred.conf";

    *uid_map = 0;
    if ((defp = defopen_r(conffile)) != NULL) {
        flags = defcntl_r(DC_GETFLAGS, 0, defp);
        /* ignore case */
        TURNOFF(flags, DC_CASE);
        (void) defcntl_r(DC_SETFLAGS, flags, defp);

        if ((ptr = defread_r("SYSLOG_UID_MAPPING=", defp)) != NULL &&
            strcasecmp("yes", ptr) == 0) {
            *uid_map = 1;
        }
        defclose_r(defp);
    }
}

void
gsscred_set_options()
{
    int u;

    get_conf_options(&u);
    (void) mutex_lock(&uid_map_lock);
    uid_map_opt = u;
    (void) mutex_unlock(&uid_map_lock);
}

static int
get_uid_map_opt()
{
    int u;

    (void) mutex_lock(&uid_map_lock);
    u = uid_map_opt;
    (void) mutex_unlock(&uid_map_lock);
    return (u);
}

/*
 * This routine accepts a name in export name format and retrieves
 * unix credentials associated with it.
 */

OM_uint32
gsscred_expname_to_unix_cred_ext(
    const gss_buffer_t expName,
    uid_t *uidOut,
    gid_t *gidOut,
    gid_t *gids[],
    int *gidsLen,
    int try_mech)
{
    gss_name_t intName;
    OM_uint32 minor, major;
    const char *mechStr = NULL;
    char *nameStr = NULL;
    char *whoami = "gsscred_expname_to_unix_cred";
    gss_buffer_desc namebuf;
    int debug = get_uid_map_opt();

    if (uidOut == NULL)
        return (GSS_S_CALL_INACCESSIBLE_WRITE);

    if (expName == NULL)
        return (GSS_S_CALL_INACCESSIBLE_READ);

    /* first check the mechanism for the mapping */
    if (gss_import_name(&minor, expName, (gss_OID)GSS_C_NT_EXPORT_NAME,
        &intName) == GSS_S_COMPLETE) {

        if (debug) {
            gss_union_name_t uintName = (gss_union_name_t)intName;

            if (uintName->mech_type)
                mechStr = __gss_oid_to_mech(
                    uintName->mech_type);

            major = gss_display_name(&minor, intName,
                &namebuf, NULL);
            if (major == GSS_S_COMPLETE) {
                nameStr = strdup(namebuf.value);
                (void) gss_release_buffer(&minor, &namebuf);
            }
        }

        if (try_mech) {
            major = gss_pname_to_uid(&minor, intName,
                NULL, uidOut);
            if (major == GSS_S_COMPLETE) {

                if (debug) {
                    syslog(LOG_AUTH|LOG_DEBUG,
                        "%s: mech provided local name"
                        " mapping (%s, %s, %d)", whoami,
                        mechStr ? mechStr : "<null>",
                        nameStr ? nameStr : "<null>",
                        *uidOut);
                    free(nameStr);
                }

                (void) gss_release_name(&minor, &intName);
                if (gids && gidsLen && gidOut)
                    return (gss_get_group_info(*uidOut,
                        gidOut, gids, gidsLen));
                return (GSS_S_COMPLETE);
            }
        }

        (void) gss_release_name(&minor, &intName);
    }

    /*
     * we fall back onto the gsscred table to provide the mapping
     * start by making sure that the expName is an export name buffer
     */
    major = private_gsscred_expname_to_unix_cred(expName, uidOut, gidOut,
        gids, gidsLen);

    if (debug && major == GSS_S_COMPLETE) {
        syslog(LOG_AUTH|LOG_DEBUG,
            "%s: gsscred tbl provided"
            " local name mapping (%s, %s, %d)",
            whoami,
            mechStr ? mechStr : "<unknown>",
            nameStr ? nameStr : "<unknown>",
            *uidOut);
        free(nameStr);
    } else if (debug) {
        syslog(LOG_AUTH|LOG_DEBUG,
            "%s: gsscred tbl could NOT"
            " provide local name mapping (%s, %s)",
            whoami,
            mechStr ? mechStr : "<unknown>",
            nameStr ? nameStr : "<unknown>");
        free(nameStr);
    }

    return (major);

} /* gsscred_expname_to_unix_cred */

OM_uint32
gsscred_expname_to_unix_cred(
    const gss_buffer_t expName,
    uid_t *uidOut,
    gid_t *gidOut,
    gid_t *gids[],
    int *gidsLen)
{
    return (gsscred_expname_to_unix_cred_ext(expName, uidOut, gidOut, gids,
        gidsLen, 1));
}


static const char *expNameTokId = "\x04\x01";
static const int expNameTokIdLen = 2;
/*
 * private routine added to be called from gsscred_name_to_unix_cred
 * and gsscred_expName_to_unix_cred.
 */
static OM_uint32
private_gsscred_expname_to_unix_cred(expName, uidOut, gidOut, gids, gidsLen)
const gss_buffer_t expName;
uid_t *uidOut;
gid_t *gidOut;
gid_t *gids[];
int *gidsLen;
{

    if (expName->length < expNameTokIdLen ||
        (memcmp(expName->value, expNameTokId, expNameTokIdLen) != 0))
        return (GSS_S_DEFECTIVE_TOKEN);

    if (!gss_getGssCredEntry(expName, uidOut))
        return (GSS_S_FAILURE);

    /* did caller request group info also ? */
    if (gids && gidsLen && gidOut)
        return (gss_get_group_info(*uidOut, gidOut, gids, gidsLen));

    return (GSS_S_COMPLETE);
}

/*
 * Return a string of the authenticated name.
 * It's a bit of hack/workaround/longroad but the current intName
 * passed to gss_display_name insists on returning an empty string.
 *
 * Caller must free string memory.
 */
static
char *make_name_str(
    const gss_name_t intName,
    const gss_OID mechType)

{
    gss_buffer_desc expName = GSS_C_EMPTY_BUFFER;
    OM_uint32 major, minor;
    gss_name_t canonName;
    gss_name_t iName;
    gss_buffer_desc namebuf;

    if (major = gss_canonicalize_name(&minor, intName,
                mechType, &canonName))
        return (NULL);

    major = gss_export_name(&minor, canonName, &expName);
    (void) gss_release_name(&minor, &canonName);
    if (major)
        return (NULL);

    if (gss_import_name(&minor, &expName,
                (gss_OID)GSS_C_NT_EXPORT_NAME,
                &iName) == GSS_S_COMPLETE) {

        major = gss_display_name(&minor, iName, &namebuf, NULL);
        if (major == GSS_S_COMPLETE) {
            char *s;

            if (namebuf.value)
                s = strdup(namebuf.value);

            (void) gss_release_buffer(&minor, &namebuf);
            (void) gss_release_buffer(&minor, &expName);
            (void) gss_release_buffer(&minor, (gss_buffer_t)iName);
            return (s);
        }
        (void) gss_release_buffer(&minor, (gss_buffer_t)iName);
    }

    (void) gss_release_buffer(&minor, &expName);
    return (NULL);
}

/*
 * This routine accepts a name in gss internal name format together with
 * a mechanim OID and retrieves a unix credentials for that entity.
 */
OM_uint32
gsscred_name_to_unix_cred_ext(
    const gss_name_t intName,
    const gss_OID mechType,
    uid_t *uidOut,
    gid_t *gidOut,
    gid_t *gids[],
    int *gidsLen,
    int try_mech)
{
    gss_name_t canonName;
    gss_buffer_desc expName = GSS_C_EMPTY_BUFFER;
    OM_uint32 major, minor;
    int debug = get_uid_map_opt();

    const char *mechStr;
    char *whoami = "gsscred_name_to_unix_cred";
    gss_buffer_desc namebuf;

    if (intName == NULL || mechType == NULL)
        return (GSS_S_CALL_INACCESSIBLE_READ);

    if (uidOut == NULL)
        return (GSS_S_CALL_INACCESSIBLE_WRITE);

    mechStr = __gss_oid_to_mech(mechType);

    /* first try the mechanism provided mapping */
    if (try_mech && gss_pname_to_uid(&minor, intName, mechType, uidOut)
        == GSS_S_COMPLETE) {

        if (debug) {
            char *s = make_name_str(intName, mechType);
            syslog(LOG_AUTH|LOG_DEBUG,
                "%s: mech provided local name"
                " mapping (%s, %s, %d)", whoami,
                mechStr ? mechStr : "<null>",
                s ? s : "<null>",
                *uidOut);
            free(s);
        }

        if (gids && gidsLen && gidOut)
            return (gss_get_group_info(*uidOut, gidOut, gids,
                gidsLen));
        return (GSS_S_COMPLETE);
    }
    /*
     * falling back onto the gsscred table to provide the mapping
     * start by canonicalizing the passed in name and then export it
     */
    if (major = gss_canonicalize_name(&minor, intName,
        mechType, &canonName))
        return (major);

    major = gss_export_name(&minor, canonName, &expName);
    (void) gss_release_name(&minor, &canonName);
    if (major)
        return (major);

    major = private_gsscred_expname_to_unix_cred(&expName, uidOut, gidOut,
        gids, gidsLen);


    if (debug) {
        gss_name_t iName;
        OM_uint32 maj;
        char *nameStr = NULL;

        if (gss_import_name(&minor, &expName,
            (gss_OID)GSS_C_NT_EXPORT_NAME, &iName) == GSS_S_COMPLETE) {

            maj = gss_display_name(&minor, iName, &namebuf,
                NULL);
            (void) gss_release_buffer(&minor, (gss_buffer_t)iName);
            if (maj == GSS_S_COMPLETE) {
                nameStr = strdup(namebuf.value);
                (void) gss_release_buffer(&minor, &namebuf);
            }
        }

        if (major == GSS_S_COMPLETE)
            syslog(LOG_AUTH|LOG_DEBUG,
                "%s: gsscred tbl provided"
                " local name mapping (%s, %s, %d)",
                whoami,
                mechStr ? mechStr : "<unknown>",
                nameStr ? nameStr : "<unknown>",
                *uidOut);
        else
            syslog(LOG_AUTH|LOG_DEBUG,
                "%s: gsscred tbl could NOT"
                " provide local name mapping (%s, %s)",
                whoami,
                mechStr ? mechStr : "<unknown>",
                nameStr ? nameStr : "<unknown>");

        free(nameStr);
    }

    (void) gss_release_buffer(&minor, &expName);
    return (major);
} /* gsscred_name_to_unix_cred */


OM_uint32
gsscred_name_to_unix_cred(
    const gss_name_t intName,
    const gss_OID mechType,
    uid_t *uidOut,
    gid_t *gidOut,
    gid_t *gids[],
    int *gidsLen)
{
    return (gsscred_name_to_unix_cred_ext(intName, mechType,
        uidOut, gidOut, gids, gidsLen, 1));
}


/*
 * This routine accepts a unix uid, and retrieves the group id
 * and supplamentery group ids for that uid.
 * Callers should be aware that the supplamentary group ids
 * array may be empty even when this function returns success.
 */
OM_uint32
gss_get_group_info(uid, gidOut, gids, gidsLen)
const uid_t uid;
gid_t *gidOut;
gid_t *gids[];
int *gidsLen;
{
    struct passwd *pw;
    int maxgroups;

    /* check for output parameters */
    if (gidOut == NULL || gids == NULL || gidsLen == NULL)
        return (GSS_S_CALL_INACCESSIBLE_WRITE);

    *gids = NULL;
    *gidsLen = 0;

    /* determine maximum number of groups possible */
    maxgroups = sysconf(_SC_NGROUPS_MAX);
    if (maxgroups < 1)
        maxgroups = 16;

    if ((pw = getpwuid(uid)) == NULL)
        return (GSS_S_FAILURE);

    /*
     * we allocate for the maximum number of groups
     * we do not reclaim the space when the actual number
     * is lower, just set the size approprately.
     */
    *gids = (gid_t *)calloc(maxgroups, sizeof (gid_t));
    if (*gids == NULL)
        return (GSS_S_FAILURE);

    *gidOut = pw->pw_gid;
    (*gids)[0] = pw->pw_gid;
    *gidsLen = _getgroupsbymember(pw->pw_name, *gids, maxgroups, 1);
    /*
     * we will try to remove the duplicate entry from the groups
     * array.  This can cause the group array to be empty.
     */
    if (*gidsLen < 1)
    {
        free(*gids);
        *gids = NULL;
        return (GSS_S_FAILURE);
    } else if (*gidsLen == 1) {
        free(*gids);
        *gids = NULL;
        *gidsLen = 0;
    } else {
        /* length is atleast 2 */
        *gidsLen = *gidsLen -1;
        (*gids)[0] = (*gids)[*gidsLen];
    }

    return (GSS_S_COMPLETE);
} /* gss_get_group_info */


static OM_uint32
gss_pname_to_uid(minor, name, mech_type, uidOut)
OM_uint32 *minor;
const gss_name_t name;
const gss_OID mech_type;
uid_t *uidOut;
{
    gss_mechanism mech;
    gss_union_name_t intName;
    gss_name_t mechName = NULL;
    OM_uint32 major, tmpMinor;

    if (!minor)
        return (GSS_S_CALL_INACCESSIBLE_WRITE);

    *minor = 0;

    if (uidOut == NULL)
        return (GSS_S_CALL_INACCESSIBLE_WRITE);

    if (name == NULL)
        return (GSS_S_CALL_INACCESSIBLE_READ);

    intName = (gss_union_name_t)name;

    if (mech_type != NULL)
        mech = __gss_get_mechanism(mech_type);
    else {
        /*
         * if this is a MN, then try using the mech
         * from the name; otherwise ask for default
         */
        mech = __gss_get_mechanism(intName->mech_type);
    }

    if (mech == NULL || mech->pname_to_uid == NULL)
        return (GSS_S_UNAVAILABLE);

    /* may need to import the name if this is not MN */
    if (intName->mech_type == NULL) {
        major = __gss_import_internal_name(minor,
                mech_type, intName,
                &mechName);
        if (major != GSS_S_COMPLETE)
            return (major);
    } else
        mechName = intName->mech_name;


    /* now call the mechanism's pname function to do the work */
    major = mech->pname_to_uid(mech->context, minor, mechName, uidOut);

    if (intName->mech_name != mechName)
        (void) __gss_release_internal_name(&tmpMinor, &mech->mech_type,
                &mechName);

    return (major);
} /* gss_pname_to_uid */