cifs_spnego.c 6.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248
  1. /*
  2. * fs/cifs/cifs_spnego.c -- SPNEGO upcall management for CIFS
  3. *
  4. * Copyright (c) 2007 Red Hat, Inc.
  5. * Author(s): Jeff Layton (jlayton@redhat.com)
  6. *
  7. * This library is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU Lesser General Public License as published
  9. * by the Free Software Foundation; either version 2.1 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This library is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
  15. * the GNU Lesser General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU Lesser General Public License
  18. * along with this library; if not, write to the Free Software
  19. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  20. */
  21. #include <linux/list.h>
  22. #include <linux/slab.h>
  23. #include <linux/string.h>
  24. #include <keys/user-type.h>
  25. #include <linux/key-type.h>
  26. #include <linux/keyctl.h>
  27. #include <linux/inet.h>
  28. #include "cifsglob.h"
  29. #include "cifs_spnego.h"
  30. #include "cifs_debug.h"
  31. #include "cifsproto.h"
  32. static const struct cred *spnego_cred;
  33. /* create a new cifs key */
  34. static int
  35. cifs_spnego_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
  36. {
  37. char *payload;
  38. int ret;
  39. ret = -ENOMEM;
  40. payload = kmemdup(prep->data, prep->datalen, GFP_KERNEL);
  41. if (!payload)
  42. goto error;
  43. /* attach the data */
  44. key->payload.data[0] = payload;
  45. ret = 0;
  46. error:
  47. return ret;
  48. }
  49. static void
  50. cifs_spnego_key_destroy(struct key *key)
  51. {
  52. kfree(key->payload.data[0]);
  53. }
  54. /*
  55. * keytype for CIFS spnego keys
  56. */
  57. struct key_type cifs_spnego_key_type = {
  58. .name = "cifs.spnego",
  59. .instantiate = cifs_spnego_key_instantiate,
  60. .destroy = cifs_spnego_key_destroy,
  61. .describe = user_describe,
  62. };
  63. /* length of longest version string e.g. strlen("ver=0xFF") */
  64. #define MAX_VER_STR_LEN 8
  65. /* length of longest security mechanism name, eg in future could have
  66. * strlen(";sec=ntlmsspi") */
  67. #define MAX_MECH_STR_LEN 13
  68. /* strlen of "host=" */
  69. #define HOST_KEY_LEN 5
  70. /* strlen of ";ip4=" or ";ip6=" */
  71. #define IP_KEY_LEN 5
  72. /* strlen of ";uid=0x" */
  73. #define UID_KEY_LEN 7
  74. /* strlen of ";creduid=0x" */
  75. #define CREDUID_KEY_LEN 11
  76. /* strlen of ";user=" */
  77. #define USER_KEY_LEN 6
  78. /* strlen of ";pid=0x" */
  79. #define PID_KEY_LEN 7
  80. /* get a key struct with a SPNEGO security blob, suitable for session setup */
  81. struct key *
  82. cifs_get_spnego_key(struct cifs_ses *sesInfo)
  83. {
  84. struct TCP_Server_Info *server = cifs_ses_server(sesInfo);
  85. struct sockaddr_in *sa = (struct sockaddr_in *) &server->dstaddr;
  86. struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *) &server->dstaddr;
  87. char *description, *dp;
  88. size_t desc_len;
  89. struct key *spnego_key;
  90. const char *hostname = server->hostname;
  91. const struct cred *saved_cred;
  92. /* length of fields (with semicolons): ver=0xyz ip4=ipaddress
  93. host=hostname sec=mechanism uid=0xFF user=username */
  94. desc_len = MAX_VER_STR_LEN +
  95. HOST_KEY_LEN + strlen(hostname) +
  96. IP_KEY_LEN + INET6_ADDRSTRLEN +
  97. MAX_MECH_STR_LEN +
  98. UID_KEY_LEN + (sizeof(uid_t) * 2) +
  99. CREDUID_KEY_LEN + (sizeof(uid_t) * 2) +
  100. PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
  101. if (sesInfo->user_name)
  102. desc_len += USER_KEY_LEN + strlen(sesInfo->user_name);
  103. spnego_key = ERR_PTR(-ENOMEM);
  104. description = kzalloc(desc_len, GFP_KERNEL);
  105. if (description == NULL)
  106. goto out;
  107. dp = description;
  108. /* start with version and hostname portion of UNC string */
  109. spnego_key = ERR_PTR(-EINVAL);
  110. sprintf(dp, "ver=0x%x;host=%s;", CIFS_SPNEGO_UPCALL_VERSION,
  111. hostname);
  112. dp = description + strlen(description);
  113. /* add the server address */
  114. if (server->dstaddr.ss_family == AF_INET)
  115. sprintf(dp, "ip4=%pI4", &sa->sin_addr);
  116. else if (server->dstaddr.ss_family == AF_INET6)
  117. sprintf(dp, "ip6=%pI6", &sa6->sin6_addr);
  118. else
  119. goto out;
  120. dp = description + strlen(description);
  121. /* for now, only sec=krb5 and sec=mskrb5 are valid */
  122. if (server->sec_kerberos)
  123. sprintf(dp, ";sec=krb5");
  124. else if (server->sec_mskerberos)
  125. sprintf(dp, ";sec=mskrb5");
  126. else {
  127. cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n");
  128. sprintf(dp, ";sec=krb5");
  129. }
  130. dp = description + strlen(description);
  131. sprintf(dp, ";uid=0x%x",
  132. from_kuid_munged(&init_user_ns, sesInfo->linux_uid));
  133. dp = description + strlen(description);
  134. sprintf(dp, ";creduid=0x%x",
  135. from_kuid_munged(&init_user_ns, sesInfo->cred_uid));
  136. if (sesInfo->user_name) {
  137. dp = description + strlen(description);
  138. sprintf(dp, ";user=%s", sesInfo->user_name);
  139. }
  140. dp = description + strlen(description);
  141. sprintf(dp, ";pid=0x%x", current->pid);
  142. cifs_dbg(FYI, "key description = %s\n", description);
  143. saved_cred = override_creds(spnego_cred);
  144. spnego_key = request_key(&cifs_spnego_key_type, description, "");
  145. revert_creds(saved_cred);
  146. #ifdef CONFIG_CIFS_DEBUG2
  147. if (cifsFYI && !IS_ERR(spnego_key)) {
  148. struct cifs_spnego_msg *msg = spnego_key->payload.data[0];
  149. cifs_dump_mem("SPNEGO reply blob:", msg->data, min(1024U,
  150. msg->secblob_len + msg->sesskey_len));
  151. }
  152. #endif /* CONFIG_CIFS_DEBUG2 */
  153. out:
  154. kfree(description);
  155. return spnego_key;
  156. }
  157. int
  158. init_cifs_spnego(void)
  159. {
  160. struct cred *cred;
  161. struct key *keyring;
  162. int ret;
  163. cifs_dbg(FYI, "Registering the %s key type\n",
  164. cifs_spnego_key_type.name);
  165. /*
  166. * Create an override credential set with special thread keyring for
  167. * spnego upcalls.
  168. */
  169. cred = prepare_kernel_cred(NULL);
  170. if (!cred)
  171. return -ENOMEM;
  172. keyring = keyring_alloc(".cifs_spnego",
  173. GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
  174. (KEY_POS_ALL & ~KEY_POS_SETATTR) |
  175. KEY_USR_VIEW | KEY_USR_READ,
  176. KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
  177. if (IS_ERR(keyring)) {
  178. ret = PTR_ERR(keyring);
  179. goto failed_put_cred;
  180. }
  181. ret = register_key_type(&cifs_spnego_key_type);
  182. if (ret < 0)
  183. goto failed_put_key;
  184. /*
  185. * instruct request_key() to use this special keyring as a cache for
  186. * the results it looks up
  187. */
  188. set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
  189. cred->thread_keyring = keyring;
  190. cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
  191. spnego_cred = cred;
  192. cifs_dbg(FYI, "cifs spnego keyring: %d\n", key_serial(keyring));
  193. return 0;
  194. failed_put_key:
  195. key_put(keyring);
  196. failed_put_cred:
  197. put_cred(cred);
  198. return ret;
  199. }
  200. void
  201. exit_cifs_spnego(void)
  202. {
  203. key_revoke(spnego_cred->thread_keyring);
  204. unregister_key_type(&cifs_spnego_key_type);
  205. put_cred(spnego_cred);
  206. cifs_dbg(FYI, "Unregistered %s key type\n", cifs_spnego_key_type.name);
  207. }