2 * Adapted in part from MIT Kerberos 5-1.2.1 slave/kprop.c and from
3 * http://docs.sun.com/?p=/doc/816-1331/6m7oo9sms&a=view
5 * Copyright (c) 2002 The Regents of the University of Michigan.
8 * Andy Adamson <andros@umich.edu>
9 * J. Bruce Fields <bfields@umich.edu>
10 * Marius Aamodt Eriksen <marius@umich.edu>
16 * Copyright 1990,1991 by the Massachusetts Institute of Technology.
17 * All Rights Reserved.
19 * Export of this software from the United States of America may
20 * require a specific license from the United States Government.
21 * It is the responsibility of any person or organization contemplating
22 * export to obtain such a license before exporting.
24 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
25 * distribute this software and its documentation for any purpose and
26 * without fee is hereby granted, provided that the above copyright
27 * notice appear in all copies and that both that copyright notice and
28 * this permission notice appear in supporting documentation, and that
29 * the name of M.I.T. not be used in advertising or publicity pertaining
30 * to distribution of the software without specific, written prior
31 * permission. Furthermore if you modify this software you must label
32 * your software as modified software and not distribute it in such a
33 * fashion that it might be confused with the original M.I.T. software.
34 * M.I.T. makes no representations about the suitability of
35 * this software for any purpose. It is provided "as is" without express
36 * or implied warranty.
40 * Copyright 1994 by OpenVision Technologies, Inc.
42 * Permission to use, copy, modify, distribute, and sell this software
43 * and its documentation for any purpose is hereby granted without fee,
44 * provided that the above copyright notice appears in all copies and
45 * that both that copyright notice and this permission notice appear in
46 * supporting documentation, and that the name of OpenVision not be used
47 * in advertising or publicity pertaining to distribution of the software
48 * without specific, written prior permission. OpenVision makes no
49 * representations about the suitability of this software for any
50 * purpose. It is provided "as is" without express or implied warranty.
52 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
53 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
54 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
55 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
56 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
57 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
58 * PERFORMANCE OF THIS SOFTWARE.
66 #include <sys/param.h>
67 #include <sys/types.h>
68 #include <gssapi/gssapi.h>
69 #if defined(HAVE_KRB5) && !defined(GSS_C_NT_HOSTBASED_SERVICE)
70 #include <gssapi/gssapi_generic.h>
71 #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
84 #define GSSD_SERVICE_MGS "lustre_mgs"
85 #define GSSD_SERVICE_MDS "lustre_mds"
86 #define GSSD_SERVICE_OSS "lustre_oss"
88 /* Global gssd_credentials handle */
89 gss_cred_id_t gssd_cred_mgs;
90 gss_cred_id_t gssd_cred_mds;
91 gss_cred_id_t gssd_cred_oss;
92 int gssd_cred_mgs_valid = 0;
93 int gssd_cred_mds_valid = 0;
94 int gssd_cred_oss_valid = 0;
96 char *mgs_local_realm = NULL;
97 char *mds_local_realm = NULL;
98 char *oss_local_realm = NULL;
100 gss_OID g_mechOid = GSS_C_NULL_OID;;
104 display_status_1(char *m, u_int32_t code, int type, const gss_OID mech)
106 u_int32_t maj_stat, min_stat;
107 gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
108 u_int32_t msg_ctx = 0;
115 case GSS_C_MECH_CODE:
116 typestr = "mechanism";
124 maj_stat = gss_display_status(&min_stat, code,
125 type, mech, &msg_ctx, &msg);
126 if (maj_stat != GSS_S_COMPLETE) {
127 printerr(0, "ERROR: in call to "
128 "gss_display_status called from %s\n", m);
131 printerr(0, "ERROR: GSS-API: (%s) error in %s(): %s\n",
132 typestr, m, (char *)msg.value);
136 (void) gss_release_buffer(&min_stat, &msg);
145 display_status_2(char *m, u_int32_t major, u_int32_t minor, const gss_OID mech)
147 u_int32_t maj_stat1, min_stat1;
148 u_int32_t maj_stat2, min_stat2;
149 gss_buffer_desc maj_gss_buf = GSS_C_EMPTY_BUFFER;
150 gss_buffer_desc min_gss_buf = GSS_C_EMPTY_BUFFER;
151 char maj_buf[30], min_buf[30];
153 u_int32_t msg_ctx = 0;
155 /* Get major status message */
156 maj_stat1 = gss_display_status(&min_stat1, major,
157 GSS_C_GSS_CODE, mech, &msg_ctx, &maj_gss_buf);
159 if (maj_stat1 != GSS_S_COMPLETE) {
160 snprintf(maj_buf, sizeof(maj_buf), "(0x%08x)", major);
163 maj = maj_gss_buf.value;
166 /* Get minor status message */
167 maj_stat2 = gss_display_status(&min_stat2, minor,
168 GSS_C_MECH_CODE, mech, &msg_ctx, &min_gss_buf);
170 if (maj_stat2 != GSS_S_COMPLETE) {
171 snprintf(min_buf, sizeof(min_buf), "(0x%08x)", minor);
174 min = min_gss_buf.value;
177 printerr(0, "ERROR: GSS-API: error in %s(): %s - %s\n",
180 if (maj_gss_buf.length != 0)
181 (void) gss_release_buffer(&min_stat1, &maj_gss_buf);
182 if (min_gss_buf.length != 0)
183 (void) gss_release_buffer(&min_stat2, &min_gss_buf);
187 pgsserr(char *msg, u_int32_t maj_stat, u_int32_t min_stat, const gss_OID mech)
189 display_status_2(msg, maj_stat, min_stat, mech);
193 int extract_realm_name(gss_buffer_desc *name, char **realm)
198 sname = malloc(name->length + 1);
200 printerr(0, "out of memory\n");
204 memcpy(sname, name->value, name->length);
205 sname[name->length] = '\0';
206 printerr(1, "service principal: %s\n", sname);
208 c = strchr(sname, '@');
210 printerr(2, "no realm in principal, using '%s' instead\n",
212 *realm = strdup(krb5_this_realm);
214 printerr(0, "failed to duplicate default realm\n");
221 printerr(0, "failed to duplicated realm\n");
231 int gssd_acquire_cred(char *server_name, gss_cred_id_t *cred,
232 char **local_realm, int *valid)
234 gss_buffer_desc name;
235 gss_name_t target_name;
236 u_int32_t maj_stat, min_stat;
237 u_int32_t ignore_maj_stat, ignore_min_stat;
239 gss_buffer_desc pbuf;
243 name.value = (void *)server_name;
244 name.length = strlen(server_name);
246 maj_stat = gss_import_name(&min_stat, &name,
247 (const gss_OID) GSS_C_NT_HOSTBASED_SERVICE,
250 if (maj_stat != GSS_S_COMPLETE) {
251 pgsserr("gss_import_name", maj_stat, min_stat, g_mechOid);
255 maj_stat = gss_display_name(&min_stat, target_name, &name, &name_type);
256 if (maj_stat != GSS_S_COMPLETE) {
257 pgsserr(0, maj_stat, min_stat, g_mechOid);
260 if (extract_realm_name(&name, local_realm))
263 maj_stat = gss_acquire_cred(&min_stat, target_name, 0,
264 GSS_C_NULL_OID_SET, GSS_C_ACCEPT,
267 if (maj_stat != GSS_S_COMPLETE) {
268 pgsserr("gss_acquire_cred", maj_stat, min_stat, g_mechOid);
269 ignore_maj_stat = gss_display_name(&ignore_min_stat,
270 target_name, &pbuf, NULL);
271 if (ignore_maj_stat == GSS_S_COMPLETE) {
272 printerr(0, "Unable to obtain credentials for '%.*s'\n",
273 (int) pbuf.length, (char *) pbuf.value);
274 ignore_maj_stat = gss_release_buffer(&ignore_min_stat,
280 ignore_maj_stat = gss_release_name(&ignore_min_stat, &target_name);
282 if (maj_stat != GSS_S_COMPLETE)
287 int gssd_prepare_creds(int must_srv_mgs, int must_srv_mds, int must_srv_oss)
289 if (gssd_acquire_cred(GSSD_SERVICE_MGS, &gssd_cred_mgs,
290 &mgs_local_realm, &gssd_cred_mgs_valid)) {
295 if (gssd_acquire_cred(GSSD_SERVICE_MDS, &gssd_cred_mds,
296 &mds_local_realm, &gssd_cred_mds_valid)) {
301 if (gssd_acquire_cred(GSSD_SERVICE_OSS, &gssd_cred_oss,
302 &oss_local_realm, &gssd_cred_oss_valid)) {
307 if (!gssd_cred_mgs_valid &&
308 !gssd_cred_mds_valid &&
309 !gssd_cred_oss_valid) {
310 printerr(0, "can't obtain any service creds, exit\n");
314 if (gssd_cred_mgs_valid)
315 printerr(0, "Ready to serve Lustre MGS in realm %s\n",
316 mgs_local_realm ? mgs_local_realm : "N/A");
317 if (gssd_cred_mds_valid)
318 printerr(0, "Ready to serve Lustre MDS in realm %s\n",
319 mds_local_realm ? mds_local_realm : "N/A");
320 if (gssd_cred_oss_valid)
321 printerr(0, "Ready to serve Lustre OSS in realm %s\n",
322 oss_local_realm ? oss_local_realm : "N/A");
327 gss_cred_id_t gssd_select_svc_cred(int lustre_svc)
329 switch (lustre_svc) {
330 case LUSTRE_GSS_SVC_MGS:
331 if (!gssd_cred_mgs_valid) {
332 printerr(0, "ERROR: service cred for mgs not ready\n");
335 return gssd_cred_mgs;
336 case LUSTRE_GSS_SVC_MDS:
337 if (!gssd_cred_mds_valid) {
338 printerr(0, "ERROR: service cred for mds not ready\n");
341 printerr(2, "select mds service cred\n");
342 return gssd_cred_mds;
343 case LUSTRE_GSS_SVC_OSS:
344 if (!gssd_cred_oss_valid) {
345 printerr(0, "ERROR: service cred for oss not ready\n");
348 printerr(2, "select oss service cred\n");
349 return gssd_cred_oss;
351 printerr(0, "ERROR: invalid lustre svc id %d\n", lustre_svc);
357 int gssd_check_mechs(void)
359 u_int32_t maj_stat, min_stat;
360 gss_OID_set supported_mechs = GSS_C_NO_OID_SET;
363 maj_stat = gss_indicate_mechs(&min_stat, &supported_mechs);
364 if (maj_stat != GSS_S_COMPLETE) {
365 printerr(0, "Unable to obtain list of supported mechanisms. "
366 "Check that gss library is properly configured.\n");
369 if (supported_mechs == GSS_C_NO_OID_SET ||
370 supported_mechs->count == 0) {
371 printerr(0, "Unable to obtain list of supported mechanisms. "
372 "Check that gss library is properly configured.\n");
375 maj_stat = gss_release_oid_set(&min_stat, &supported_mechs);
381 /*********************************
382 * FIXME should be in krb5_util.c
383 *********************************/
385 void gssd_cleanup_realms(void)
387 krb5_context context = NULL;
388 krb5_error_code code;
390 if (krb5_this_realm) {
391 code = krb5_init_context(&context);
393 printerr(0, "ERROR: cleanup realms: init ctx: %s\n",
394 error_message(code));
396 krb5_free_string(context, krb5_this_realm);
397 krb5_this_realm = NULL;
398 krb5_free_context(context);
402 free(mgs_local_realm);
404 free(mds_local_realm);
406 free(oss_local_realm);