Attachment 3373 Details for Bug 19199 – бэкпорт cifs.upcall

[patch] бэкпорт cifs.upcall

deb-cifs-upcall-backport-3.2.x.patch (text/plain), 21.85 KB, created by Andriy Stepanov (stanv) on 2009-03-16 16:53:34 MSK

(hide)

Description:

Filename:

MIME Type:

Creator: Andriy Stepanov (stanv)

Created: 2009-03-16 16:53:34 MSK

Size: 21.85 KB

patch

obsolete

>Index: samba-3.0.28a/source/Makefile.in
>===================================================================
>--- samba-3.0.28a.orig/source/Makefile.in
>+++ samba-3.0.28a/source/Makefile.in
>@@ -151,7 +151,7 @@
> 
> # Note that all executable programs now provide for an optional executable suffix.
> 
>-SBIN_PROGS = bin/smbd@EXEEXT@ bin/nmbd@EXEEXT@ bin/swat@EXEEXT@ @EXTRA_SBIN_PROGS@
>+SBIN_PROGS = bin/smbd@EXEEXT@ bin/nmbd@EXEEXT@ bin/swat@EXEEXT@ @EXTRA_SBIN_PROGS@ @CIFSUPCALL_PROGS@
> 
> ROOT_SBIN_PROGS = @CIFSMOUNT_PROGS@
> 
>@@ -653,6 +653,12 @@
> 
> CIFS_UMOUNT_OBJ = client/umount.cifs.o
> 
>+CIFS_UPCALL_OBJ = client/cifs.upcall.o libsmb/clikrb5.o libsmb/clispnego.o \
>+		libsmb/asn1.o libsmb/nterr.o libsmb/dcerpc_err.o \
>+		libsmb/smbdes.o libsmb/smbencrypt.o libsmb/ntlmssp_parse.o \
>+		$(PARAM_OBJ) $(LIBNMB_OBJ) $(KRBCLIENT_OBJ) $(SECRETS_OBJ) \
>+		$(ERRORMAP_OBJ) $(RPC_PARSE_OBJ1) $(DOSERR_OBJ) $(LIB_DUMMY_OBJ)
>+
> NMBLOOKUP_OBJ = utils/nmblookup.o $(PARAM_OBJ) $(LIBNMB_OBJ) $(RPC_PARSE_OBJ1) $(DOSERR_OBJ) \
>                $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(SECRETS_OBJ) $(LIBSAMBA_OBJ)
> 
>@@ -1029,6 +1035,12 @@
> 	@echo Linking $@
> 	@$(CC) $(FLAGS) -o $@ $(CIFS_UMOUNT_OBJ) $(DYNEXP) $(LDFLAGS)
> 
>+bin/cifs.upcall@EXEEXT@: $(BINARY_PREREQS) $(CIFS_UPCALL_OBJ) $(LIBSMBCLIENT_OBJ1) $(LIB_OBJ) @BUILD_POPT@
>+	@echo Linking $@
>+	@$(CC) $(FLAGS) -o $@ $(CIFS_UPCALL_OBJ) $(DYNEXP) $(LDFLAGS) \
>+		-lkeyutils $(LIBSMBCLIENT_OBJ1) $(LIB_OBJ) \
>+		$(KRB5LIBS) $(LDAP_LIBS) $(POPT_LIBS) $(LIBS) 
>+
> bin/testparm@EXEEXT@: proto_exists $(TESTPARM_OBJ) @BUILD_POPT@ bin/.dummy
> 	@echo Linking $@
> 	@$(CC) $(FLAGS) -o $@ $(TESTPARM_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) $(LDAP_LIBS) @POPTLIBS@
>@@ -1573,7 +1585,7 @@
> 	@echo Linking $@
> 	@$(CC) $(FLAGS) -o $@ $(DYNEXP) script/tests/timelimit.o
> 
>-install: installservers installbin @INSTALL_CIFSMOUNT@ installman installscripts installdat installswat installmodules @INSTALL_LIBSMBCLIENT@ @INSTALL_LIBMSRPC@ @INSTALL_PAM_MODULES@ @INSTALL_LIBSMBSHAREMODES@
>+install: installservers installbin @INSTALL_CIFSMOUNT@ @INSTALL_CIFSUPCALL@ installman installscripts installdat installswat installmodules @INSTALL_LIBSMBCLIENT@ @INSTALL_LIBMSRPC@ @INSTALL_PAM_MODULES@ @INSTALL_LIBSMBSHAREMODES@
> 
> 
> install-everything: install installmodules
>@@ -1599,6 +1611,10 @@
> 	@$(SHELL) $(srcdir)/script/installdirs.sh $(INSTALLPERMS) $(DESTDIR) $(ROOTSBINDIR)
> 	@$(SHELL) script/installbin.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(ROOTSBINDIR) @CIFSMOUNT_PROGS@
> 
>+installcifsupcall: @CIFSUPCALL_PROGS@
>+	@$(SHELL) $(srcdir)/script/installdirs.sh $(INSTALLPERMS) $(DESTDIR) $(SBINDIR)
>+	@$(SHELL) script/installbin.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(SBINDIR) @CIFSUPCALL_PROGS@
>+
> # Some symlinks are required for the 'probing' of modules.
> # This mechanism should go at some point..
> installmodules: modules installdirs
>@@ -1716,7 +1732,7 @@
> 	@echo "  swatdir:     $(SWATDIR)"
> 
> 
>-uninstall: uninstallman uninstallservers uninstallbin @UNINSTALL_CIFSMOUNT@ uninstallscripts uninstalldat uninstallswat uninstallmodules @UNINSTALL_LIBSMBCLIENT@ @UNINSTALL_LIBMSRPC@ @UNINSTALL_PAM_MODULES@ @UNINSTALL_LIBSMBSHAREMODES@
>+uninstall: uninstallman uninstallservers uninstallbin @UNINSTALL_CIFSMOUNT@ @UNINSTALL_CIFSUPCALL@ uninstallscripts uninstalldat uninstallswat uninstallmodules @UNINSTALL_LIBSMBCLIENT@ @UNINSTALL_LIBMSRPC@ @UNINSTALL_PAM_MODULES@ @UNINSTALL_LIBSMBSHAREMODES@
> 
> uninstallman:
> 	@$(SHELL) $(srcdir)/script/uninstallman.sh $(DESTDIR)$(MANDIR) $(srcdir) C
>@@ -1730,6 +1746,9 @@
> uninstallcifsmount:
> 	@$(SHELL) script/uninstallbin.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(ROOTSBINDIR) @CIFSMOUNT_PROGS@
> 
>+uninstallcifsupcall:
>+	@$(SHELL) script/uninstallbin.sh $(INSTALLPERMS_BIN) $(DESTDIR) $(prefix) $(SBINDIR) @CIFSUPCALL_PROGS@
>+
> uninstallmodules:
> 	@$(SHELL) $(srcdir)/script/uninstallmodules.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(VFSLIBDIR) $(VFS_MODULES)
> 	@$(SHELL) $(srcdir)/script/uninstallmodules.sh $(INSTALLPERMS) $(DESTDIR) $(prefix) $(PDBLIBDIR) $(PDB_MODULES)
>Index: samba-3.0.28a/source/client/cifs_spnego.h
>===================================================================
>--- /dev/null
>+++ samba-3.0.28a/source/client/cifs_spnego.h
>@@ -0,0 +1,46 @@
>+/*
>+ *   fs/cifs/cifs_spnego.h -- SPNEGO upcall management for CIFS
>+ *
>+ *   Copyright (c) 2007 Red Hat, Inc.
>+ *   Author(s): Jeff Layton (jlayton@redhat.com)
>+ *              Steve French (sfrench@us.ibm.com)
>+ *
>+ *   This library is free software; you can redistribute it and/or modify
>+ *   it under the terms of the GNU Lesser General Public License as published
>+ *   by the Free Software Foundation; either version 2.1 of the License, or
>+ *   (at your option) any later version.
>+ *
>+ *   This library is distributed in the hope that it will be useful,
>+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
>+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
>+ *   the GNU Lesser General Public License for more details.
>+ *
>+ *   You should have received a copy of the GNU Lesser General Public License
>+ *   along with this library; if not, write to the Free Software
>+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
>+ */
>+
>+#ifndef _CIFS_SPNEGO_H
>+#define _CIFS_SPNEGO_H
>+
>+#define CIFS_SPNEGO_UPCALL_VERSION 2
>+
>+/*
>+ * The version field should always be set to CIFS_SPNEGO_UPCALL_VERSION.
>+ * The flags field is for future use. The request-key callout should set
>+ * sesskey_len and secblob_len, and then concatenate the SessKey+SecBlob
>+ * and stuff it in the data field.
>+ */
>+struct cifs_spnego_msg {
>+	uint32_t version;
>+	uint32_t flags;
>+	uint32_t sesskey_len;
>+	uint32_t secblob_len;
>+	uint8_t data[1];
>+};
>+
>+#ifdef __KERNEL__
>+extern struct key_type cifs_spnego_key_type;
>+#endif				/* KERNEL */
>+
>+#endif				/* _CIFS_SPNEGO_H */
>Index: samba-3.0.28a/source/configure.in
>===================================================================
>--- samba-3.0.28a.orig/source/configure.in
>+++ samba-3.0.28a/source/configure.in
>@@ -321,6 +321,9 @@
> AC_SUBST(CIFSMOUNT_PROGS)
> AC_SUBST(INSTALL_CIFSMOUNT)
> AC_SUBST(UNINSTALL_CIFSMOUNT)
>+AC_SUBST(CIFSUPCALL_PROGS)
>+AC_SUBST(INSTALL_CIFSUPCALL)
>+AC_SUBST(UNINSTALL_CIFSUPCALL)
> AC_SUBST(EXTRA_SBIN_PROGS)
> AC_SUBST(EXTRA_ALL_TARGETS)
> AC_SUBST(CONFIG_LIBS)
>@@ -4242,6 +4245,60 @@
>   esac ]
> )
> 
>+#################################################
>+# check for cifs.upcall support
>+AC_CHECK_HEADERS([keyutils.h], [HAVE_KEYUTILS_H=1], [HAVE_KEYUTILS_H=0])
>+CIFSUPCALL_PROGS=""
>+INSTALL_CIFSUPCALL=""
>+UNINSTALL_CIFSUPCALL=""
>+AC_MSG_CHECKING(whether to build cifs.upcall)
>+AC_ARG_WITH(cifsupcall,
>+[AS_HELP_STRING([--with-cifsupcall], [Include cifs.upcall (Linux only) support (default=yes)])],
>+[ case "$withval" in
>+  no)
>+	AC_MSG_RESULT(no)
>+	;;
>+  *)
>+	case "$host_os" in
>+	*linux*)
>+		if test x"$use_ads" != x"yes"; then
>+			AC_MSG_ERROR(ADS support should be enabled for building cifs.upcall)
>+		elif test x"$HAVE_KEYUTILS_H" != "x1"; then
>+			AC_MSG_ERROR(keyutils package is required for cifs.upcall)
>+		else
>+			AC_MSG_RESULT(yes)
>+			AC_DEFINE(WITH_CIFSUPCALL,1,[whether to build cifs.upcall])
>+			CIFSUPCALL_PROGS="bin/cifs.upcall"
>+			INSTALL_CIFSUPCALL="installcifsupcall"
>+			UNINSTALL_CIFSUPCALL="uninstallcifsupcall"
>+		fi
>+		;;
>+	*)
>+		AC_MSG_ERROR(not on a linux system!)
>+		;;
>+	esac
>+    ;;
>+  esac ],
>+[ case "$host_os" in
>+  *linux*)
>+        if test x"$use_ads" != x"yes"; then
>+                AC_MSG_WARN(ADS support should be enabled for building cifs.upcall)
>+        elif test x"$HAVE_KEYUTILS_H" != "x1"; then
>+                AC_MSG_WARN(keyutils package is required for cifs.upcall)
>+        else
>+                AC_MSG_RESULT(yes)
>+                AC_DEFINE(WITH_CIFSUPCALL,1,[whether to build cifs.upcall])
>+                CIFSUPCALL_PROGS="bin/cifs.upcall"
>+                INSTALL_CIFSUPCALL="installcifsupcall"
>+                UNINSTALL_CIFSUPCALL="uninstallcifsupcall"
>+        fi
>+        ;;
>+  *)
>+        AC_MSG_RESULT(no)
>+        ;;
>+  esac ]
>+)
>+
> 
> #################################################
> # check for a PAM clear-text auth, accounts, password and session support
>Index: samba-3.0.28a/source/include/smb.h
>===================================================================
>--- samba-3.0.28a.orig/source/include/smb.h
>+++ samba-3.0.28a/source/include/smb.h
>@@ -558,6 +558,8 @@
> 	void (*free)(struct data_blob_ *data_blob);
> } DATA_BLOB;
> 
>+extern const DATA_BLOB data_blob_null;
>+
> /*
>  * Structure used to keep directory state information around.
>  * Used in NT change-notify code.
>Index: samba-3.0.28a/source/lib/data_blob.c
>===================================================================
>--- samba-3.0.28a.orig/source/lib/data_blob.c
>+++ samba-3.0.28a/source/lib/data_blob.c
>@@ -21,6 +21,8 @@
> 
> #include "includes.h"
> 
>+const DATA_BLOB data_blob_null = { NULL, 0, NULL };
>+
> /*******************************************************************
>  Free() a data blob.
> *******************************************************************/
>Index: samba-3.0.28a/source/client/cifs.upcall.c
>===================================================================
>--- /dev/null
>+++ samba-3.0.28a/source/client/cifs.upcall.c
>@@ -0,0 +1,391 @@
>+/*
>+* CIFS user-space helper.
>+* Copyright (C) Igor Mammedov (niallain@gmail.com) 2007
>+*
>+* Used by /sbin/request-key for handling
>+* cifs upcall for kerberos authorization of access to share and
>+* cifs upcall for DFS srver name resolving (IPv4/IPv6 aware).
>+* You should have keyutils installed and add something like the
>+* following lines to /etc/request-key.conf file:
>+
>+create cifs.spnego * * /usr/local/sbin/cifs.upcall %k
>+create dns_resolver * * /usr/local/sbin/cifs.upcall %k
>+
>+* This program is free software; you can redistribute it and/or modify
>+* it under the terms of the GNU General Public License as published by
>+* the Free Software Foundation; either version 2 of the License, or
>+* (at your option) any later version.
>+* This program is distributed in the hope that it will be useful,
>+* but WITHOUT ANY WARRANTY; without even the implied warranty of
>+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+* GNU General Public License for more details.
>+* You should have received a copy of the GNU General Public License
>+* along with this program; if not, write to the Free Software
>+* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
>+*/
>+
>+#include "includes.h"
>+#include <keyutils.h>
>+
>+#include "cifs_spnego.h"
>+
>+const char *CIFSSPNEGO_VERSION = "1.2";
>+static const char *prog = "cifs.upcall";
>+typedef enum _secType {
>+	NONE = 0,
>+	KRB5,
>+	MS_KRB5
>+} secType_t;
>+
>+/*
>+ * Prepares AP-REQ data for mechToken and gets session key
>+ * Uses credentials from cache. It will not ask for password
>+ * you should receive credentials for yuor name manually using
>+ * kinit or whatever you wish.
>+ *
>+ * in:
>+ * 	oid -		string with OID/ Could be OID_KERBEROS5
>+ * 			or OID_KERBEROS5_OLD
>+ * 	principal -	Service name.
>+ * 			Could be "cifs/FQDN" for KRB5 OID
>+ * 			or for MS_KRB5 OID style server principal
>+ * 			like "pdc$@YOUR.REALM.NAME"
>+ *
>+ * out:
>+ * 	secblob -	pointer for spnego wrapped AP-REQ data to be stored
>+ * 	sess_key-	pointer for SessionKey data to be stored
>+ *
>+ * ret: 0 - success, others - failure
>+*/
>+static int
>+handle_krb5_mech(const char *oid, const char *principal,
>+		     DATA_BLOB * secblob, DATA_BLOB * sess_key)
>+{
>+	int retval;
>+	DATA_BLOB tkt, tkt_wrapped;
>+
>+	/* get a kerberos ticket for the service and extract the session key */
>+	retval = cli_krb5_get_ticket(principal, 0,
>+				     &tkt, sess_key, 0, NULL, NULL);
>+
>+	if (retval)
>+		return retval;
>+
>+	/* wrap that up in a nice GSS-API wrapping */
>+	tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
>+
>+	/* and wrap that in a shiny SPNEGO wrapper */
>+	*secblob = gen_negTokenInit(oid, tkt_wrapped);
>+
>+	data_blob_free(&tkt_wrapped);
>+	data_blob_free(&tkt);
>+	return retval;
>+}
>+
>+#define DKD_HAVE_HOSTNAME	1
>+#define DKD_HAVE_VERSION	2
>+#define DKD_HAVE_SEC		4
>+#define DKD_HAVE_IPV4		8
>+#define DKD_HAVE_IPV6		16
>+#define DKD_HAVE_UID		32
>+#define DKD_MUSTHAVE_SET (DKD_HAVE_HOSTNAME|DKD_HAVE_VERSION|DKD_HAVE_SEC)
>+
>+static int
>+decode_key_description(const char *desc, int *ver, secType_t * sec,
>+			   char **hostname, uid_t * uid)
>+{
>+	int retval = 0;
>+	char *pos;
>+	const char *tkn = desc;
>+
>+	do {
>+		pos = index(tkn, ';');
>+		if (strncmp(tkn, "host=", 5) == 0) {
>+			int len;
>+
>+			if (pos == NULL) {
>+				len = strlen(tkn);
>+			} else {
>+				len = pos - tkn;
>+			}
>+			len -= 4;
>+			SAFE_FREE(*hostname);
>+			*hostname = SMB_XMALLOC_ARRAY(char, len);
>+			strlcpy(*hostname, tkn + 5, len);
>+			retval |= DKD_HAVE_HOSTNAME;
>+		} else if (strncmp(tkn, "ipv4=", 5) == 0) {
>+			/* BB: do we need it if we have hostname already? */
>+		} else if (strncmp(tkn, "ipv6=", 5) == 0) {
>+			/* BB: do we need it if we have hostname already? */
>+		} else if (strncmp(tkn, "sec=", 4) == 0) {
>+			if (strncmp(tkn + 4, "krb5", 4) == 0) {
>+				retval |= DKD_HAVE_SEC;
>+				*sec = KRB5;
>+			} else if (strncmp(tkn + 4, "mskrb5", 6) == 0) {
>+				retval |= DKD_HAVE_SEC;
>+				*sec = MS_KRB5;
>+			}
>+		} else if (strncmp(tkn, "uid=", 4) == 0) {
>+			errno = 0;
>+			*uid = strtol(tkn + 4, NULL, 16);
>+			if (errno != 0) {
>+				syslog(LOG_WARNING, "Invalid uid format: %s",
>+				       strerror(errno));
>+				return 1;
>+			} else {
>+				retval |= DKD_HAVE_UID;
>+			}
>+		} else if (strncmp(tkn, "ver=", 4) == 0) {	/* if version */
>+			errno = 0;
>+			*ver = strtol(tkn + 4, NULL, 16);
>+			if (errno != 0) {
>+				syslog(LOG_WARNING,
>+				       "Invalid version format: %s",
>+				       strerror(errno));
>+				return 1;
>+			} else {
>+				retval |= DKD_HAVE_VERSION;
>+			}
>+		}
>+		if (pos == NULL)
>+			break;
>+		tkn = pos + 1;
>+	} while (tkn);
>+	return retval;
>+}
>+
>+static int
>+cifs_resolver(const key_serial_t key, const char *key_descr)
>+{
>+	int c;
>+	struct addrinfo *addr;
>+	char ip[INET6_ADDRSTRLEN];
>+	void *p;
>+	const char *keyend = key_descr;
>+	/* skip next 4 ';' delimiters to get to description */
>+	for (c = 1; c <= 4; c++) {
>+		keyend = index(keyend+1, ';');
>+		if (!keyend) {
>+			syslog(LOG_WARNING, "invalid key description: %s",
>+					key_descr);
>+			return 1;
>+		}
>+	}
>+	keyend++;
>+
>+	/* resolve name to ip */
>+	c = getaddrinfo(keyend, NULL, NULL, &addr);
>+	if (c) {
>+		syslog(LOG_WARNING, "unable to resolve hostname: %s [%s]",
>+				keyend, gai_strerror(c));
>+		return 1;
>+	}
>+
>+	/* conver ip to string form */
>+	if (addr->ai_family == AF_INET) {
>+		p = &(((struct sockaddr_in *)addr->ai_addr)->sin_addr);
>+	} else {
>+		p = &(((struct sockaddr_in6 *)addr->ai_addr)->sin6_addr);
>+	}
>+	if (!inet_ntop(addr->ai_family, p, ip, sizeof(ip))) {
>+		syslog(LOG_WARNING, "%s: inet_ntop: %s",
>+				__FUNCTION__, strerror(errno));
>+		freeaddrinfo(addr);
>+		return 1;
>+	}
>+
>+	/* setup key */
>+	c = keyctl_instantiate(key, ip, strlen(ip)+1, 0);
>+	if (c == -1) {
>+		syslog(LOG_WARNING, "%s: keyctl_instantiate: %s",
>+				__FUNCTION__, strerror(errno));
>+		freeaddrinfo(addr);
>+		return 1;
>+	}
>+
>+	freeaddrinfo(addr);
>+	return 0;
>+}
>+
>+static void
>+usage(void)
>+{
>+	syslog(LOG_WARNING, "Usage: %s [-c] [-v] key_serial", prog);
>+	fprintf(stderr, "Usage: %s [-c] [-v] key_serial\n", prog);
>+}
>+
>+int main(const int argc, char *const argv[])
>+{
>+	struct cifs_spnego_msg *keydata = NULL;
>+	DATA_BLOB secblob = data_blob_null;
>+	DATA_BLOB sess_key = data_blob_null;
>+	secType_t sectype = NONE;
>+	key_serial_t key = 0;
>+	size_t datalen;
>+	long rc = 1;
>+	uid_t uid = 0;
>+	int kernel_upcall_version = 0;
>+	int c, use_cifs_service_prefix = 0;
>+	char *buf, *hostname = NULL;
>+	const char *oid;
>+
>+	openlog(prog, 0, LOG_DAEMON);
>+
>+	while ((c = getopt(argc, argv, "cv")) != -1) {
>+		switch (c) {
>+		case 'c':{
>+			use_cifs_service_prefix = 1;
>+			break;
>+			}
>+		case 'v':{
>+			printf("version: %s\n", CIFSSPNEGO_VERSION);
>+			goto out;
>+			}
>+		default:{
>+			syslog(LOG_WARNING, "unknown option: %c", c);
>+			goto out;
>+			}
>+		}
>+	}
>+
>+	/* is there a key? */
>+	if (argc <= optind) {
>+		usage();
>+		goto out;
>+	}
>+
>+	/* get key and keyring values */
>+	errno = 0;
>+	key = strtol(argv[optind], NULL, 10);
>+	if (errno != 0) {
>+		key = 0;
>+		syslog(LOG_WARNING, "Invalid key format: %s", strerror(errno));
>+		goto out;
>+	}
>+
>+	rc = keyctl_describe_alloc(key, &buf);
>+	if (rc == -1) {
>+		syslog(LOG_WARNING, "keyctl_describe_alloc failed: %s",
>+		       strerror(errno));
>+		rc = 1;
>+		goto out;
>+	}
>+
>+	if ((strncmp(buf, "cifs.resolver", sizeof("cifs.resolver")-1) == 0) ||
>+	    (strncmp(buf, "dns_resolver", sizeof("dns_resolver")-1) == 0)) {
>+		rc = cifs_resolver(key, buf);
>+		goto out;
>+	}
>+
>+	rc = decode_key_description(buf, &kernel_upcall_version, &sectype,
>+				    &hostname, &uid);
>+	if ((rc & DKD_MUSTHAVE_SET) != DKD_MUSTHAVE_SET) {
>+		syslog(LOG_WARNING,
>+		       "unable to get from description necessary params");
>+		rc = 1;
>+		SAFE_FREE(buf);
>+		goto out;
>+	}
>+	SAFE_FREE(buf);
>+
>+	if (kernel_upcall_version > CIFS_SPNEGO_UPCALL_VERSION) {
>+		syslog(LOG_WARNING,
>+		       "incompatible kernel upcall version: 0x%x",
>+		       kernel_upcall_version);
>+		rc = 1;
>+		goto out;
>+	}
>+
>+	if (rc & DKD_HAVE_UID) {
>+		rc = setuid(uid);
>+		if (rc == -1) {
>+			syslog(LOG_WARNING, "setuid: %s", strerror(errno));
>+			goto out;
>+		}
>+	}
>+
>+	/* BB: someday upcall SPNEGO blob could be checked here to decide
>+	 * what mech to use */
>+
>+	// do mech specific authorization
>+	switch (sectype) {
>+	case MS_KRB5:
>+	case KRB5:{
>+			char *princ;
>+			size_t len;
>+
>+			/* for "cifs/" service name + terminating 0 */
>+			len = strlen(hostname) + 5 + 1;
>+			princ = SMB_XMALLOC_ARRAY(char, len);
>+			if (!princ) {
>+				rc = 1;
>+				break;
>+			}
>+			if (use_cifs_service_prefix) {
>+				strlcpy(princ, "cifs/", len);
>+			} else {
>+				strlcpy(princ, "host/", len);
>+			}
>+			strlcpy(princ + 5, hostname, len - 5);
>+
>+			if (sectype == MS_KRB5)
>+				oid = OID_KERBEROS5_OLD;
>+			else
>+				oid = OID_KERBEROS5;
>+
>+			rc = handle_krb5_mech(oid, princ, &secblob, &sess_key);
>+			SAFE_FREE(princ);
>+			break;
>+		}
>+	default:{
>+			syslog(LOG_WARNING, "sectype: %d is not implemented",
>+			       sectype);
>+			rc = 1;
>+			break;
>+		}
>+	}
>+
>+	if (rc) {
>+		goto out;
>+	}
>+
>+	/* pack SecurityBLob and SessionKey into downcall packet */
>+	datalen =
>+	    sizeof(struct cifs_spnego_msg) + secblob.length + sess_key.length;
>+	keydata = (struct cifs_spnego_msg*)SMB_XMALLOC_ARRAY(char, datalen);
>+	if (!keydata) {
>+		rc = 1;
>+		goto out;
>+	}
>+	keydata->version = kernel_upcall_version;
>+	keydata->flags = 0;
>+	keydata->sesskey_len = sess_key.length;
>+	keydata->secblob_len = secblob.length;
>+	memcpy(&(keydata->data), sess_key.data, sess_key.length);
>+	memcpy(&(keydata->data) + keydata->sesskey_len,
>+	       secblob.data, secblob.length);
>+
>+	/* setup key */
>+	rc = keyctl_instantiate(key, keydata, datalen, 0);
>+	if (rc == -1) {
>+		syslog(LOG_WARNING, "keyctl_instantiate: %s", strerror(errno));
>+		goto out;
>+	}
>+
>+	/* BB: maybe we need use timeout for key: for example no more then
>+	 * ticket lifietime? */
>+	/* keyctl_set_timeout( key, 60); */
>+out:
>+	/*
>+	 * on error, negatively instantiate the key ourselves so that we can
>+	 * make sure the kernel doesn't hang it off of a searchable keyring
>+	 * and interfere with the next attempt to instantiate the key.
>+	 */
>+	if (rc != 0  && key == 0)
>+		keyctl_negate(key, 1, KEY_REQKEY_DEFL_DEFAULT);
>+	data_blob_free(&secblob);
>+	data_blob_free(&sess_key);
>+	SAFE_FREE(hostname);
>+	SAFE_FREE(keydata);
>+	return rc;
>+}
>Index: samba-3.0.28a/docs/manpages/cifs.upcall.8
>===================================================================
>--- /dev/null
>+++ samba-3.0.28a/docs/manpages/cifs.upcall.8
>@@ -0,0 +1,82 @@
>+.\"     Title: cifs.upcall
>+.\"    Author: 
>+.\" Generator: DocBook XSL Stylesheets v1.73.1 <http://docbook.sf.net/>
>+.\"      Date: 09/18/2008
>+.\"    Manual: System Administration tools
>+.\"    Source: Samba 3.2
>+.\"
>+.TH "CIFS\.UPCALL" "8" "09/18/2008" "Samba 3\.2" "System Administration tools"
>+.\" disable hyphenation
>+.nh
>+.\" disable justification (adjust text to left margin only)
>+.ad l
>+.SH "NAME"
>+cifs.upcall - Userspace upcall helper for Common Internet File System (CIFS)
>+.SH "SYNOPSIS"
>+.HP 1
>+cifs\.upcall [\-c] [\-v] {keyid}
>+.SH "DESCRIPTION"
>+.PP
>+This tool is part of the
>+\fBsamba\fR(7)
>+suite\.
>+.PP
>+cifs\.upcall is a userspace helper program for the linux CIFS client filesystem\. There are a number of activities that the kernel cannot easily do itself\. This program is a callout program that does these things for the kernel and then returns the result\.
>+.PP
>+cifs\.upcall is generally intended to be run when the kernel calls request\-key(8)
>+for a particular key type\. While it can be run directly from the command\-line, it\'s not generally intended to be run that way\.
>+.SH "OPTIONS"
>+.PP
>+\-c
>+.RS 4
>+When handling a kerberos upcall, use a service principal that starts with "cifs/"\. The default is to use the "host/" service principal\.
>+.RE
>+.PP
>+\-v
>+.RS 4
>+Print version number and exit\.
>+.RE
>+.SH "CONFIGURATION FOR KEYCTL"
>+.PP
>+cifs\.upcall is designed to be called from the kernel via the request\-key callout program\. This requires that request\-key be told where and how to call this program\. The current cifs\.upcall program handles two different key types:
>+.PP
>+cifs\.spnego
>+.RS 4
>+This keytype is for retrieving kerberos session keys
>+.RE
>+.PP
>+dns_resolver
>+.RS 4
>+This key type is for resolving hostnames into IP addresses
>+.RE
>+.PP
>+To make this program useful for CIFS, you\'ll need to set up entries for them in request\-key\.conf(5)\. Here\'s an example of an entry for each key type:
>+.sp
>+.RS 4
>+.nf
>+#OPERATION  TYPE           D C PROGRAM ARG1 ARG2\.\.\.
>+#=========  =============  = = ==========================================
>+create	    cifs\.spnego    * * /usr/local/sbin/cifs\.upcall \-c %k
>+create      dns_resolver   * * /usr/local/sbin/cifs\.upcall %k
>+.fi
>+.RE
>+.PP
>+See
>+\fBrequest-key.conf5\fR()
>+for more info on each field\.
>+.SH "SEE ALSO"
>+.PP
>+
>+\fBrequest-key.conf\fR(5),
>+\fBmount.cifs\fR(8)
>+.SH "AUTHOR"
>+.PP
>+Igor Mammedov wrote the cifs\.upcall program\.
>+.PP
>+Jeff Layton authored this manpage\.
>+.PP
>+The maintainer of the Linux CIFS VFS is Steve French\.
>+.PP
>+The
>+Linux CIFS Mailing list
>+is the preferred place to ask questions regarding these programs\.

Actions: View | Diff

Attachments on bug 19199: 3373 | 3374