X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=netatalk.git;a=blobdiff_plain;f=etc%2Fafpd%2Fstatus.c;h=eb5b99b30b970a95f96547e6e87260be38282c9a;hp=1bc08862ce6e358708c5dc5ad74b63a4059b9244;hb=4d70a1cdf1cab29dde087f4224759a1a910524b4;hpb=657208a49d0c16ed49ceca8e553f00e2fddddeb8 diff --git a/etc/afpd/status.c b/etc/afpd/status.c index 1bc08862..eb5b99b3 100644 --- a/etc/afpd/status.c +++ b/etc/afpd/status.c @@ -7,6 +7,7 @@ #include "config.h" #endif /* HAVE_CONFIG_H */ +#include #include #include #include @@ -30,6 +31,14 @@ #include +#ifdef HAVE_KERBEROS +#ifdef HAVE_KRB5_KRB5_H +#include +#else +#include +#endif /* HAVE_KRB5_KRB5_H */ +#endif /* HAVE_KERBEROS */ + #include #include #include @@ -38,11 +47,24 @@ #include "status.h" #include "afp_config.h" #include "icon.h" +#include "uam_auth.h" static size_t maxstatuslen = 0; -static void status_flags(char *data, const int notif, const int ipok, - const unsigned char passwdbits, const int dirsrvcs _U_, int flags) +static int uam_gss_enabled() +{ + /* XXX: must be a better way to find out if uam_gss is active */ + return auth_uamfind(UAM_SERVER_LOGIN_EXT, + "Client Krb v2", + sizeof("Client Krb v2")) != NULL; +} + +static void status_flags(char *data, + const int notif, + const int ipok, + const unsigned char passwdbits, + const int dirsrvcs, + int flags) { uint16_t status; @@ -50,7 +72,6 @@ static void status_flags(char *data, const int notif, const int ipok, | AFPSRVRINFO_SRVSIGNATURE | AFPSRVRINFO_SRVMSGS | AFPSRVRINFO_FASTBOZO - | AFPSRVRINFO_SRVRDIR | AFPSRVRINFO_SRVUTF8 | AFPSRVRINFO_EXTSLEEP; @@ -58,10 +79,12 @@ static void status_flags(char *data, const int notif, const int ipok, status |= AFPSRVRINFO_PASSWD; if (passwdbits & PASSWD_NOSAVE) status |= AFPSRVRINFO_NOSAVEPASSWD; - if (ipok) /* only advertise tcp/ip if we have a valid address */ + if (ipok) /* only advertise tcp/ip if we have a valid address */ status |= AFPSRVRINFO_TCPIP; - if (notif) /* Default is yes */ + if (notif) /* Default is yes */ status |= AFPSRVRINFO_SRVNOTIFY; + if (dirsrvcs) + status |= AFPSRVRINFO_SRVRDIR; if (flags & OPTION_UUID) status |= AFPSRVRINFO_UUID; @@ -288,50 +311,180 @@ static size_t status_netaddress(char *data, int *servoffset, return (data - begin); } -static size_t status_directorynames(char *data, int *diroffset, - const DSI *dsi _U_, - const struct afp_options *options) +static bool append_directoryname(char **pdata, + size_t offset, + size_t *size, + char* DirectoryNamesCount, + size_t len, + char *principal) +{ + if (sizeof(uint8_t) + len > maxstatuslen - offset - *size) { + LOG(log_error, logtype_afpd, + "status:DirectoryNames: out of space for principal '%s' (len=%d)", + principal, len); + return false; + } else if (len > 255) { + LOG(log_error, logtype_afpd, + "status:DirectoryNames: principal '%s' (len=%d) too long (max=255)", + principal, len); + return false; + } + + LOG(log_info, logtype_afpd, + "DirectoryNames[%d]=%s", + *DirectoryNamesCount, principal); + + *DirectoryNamesCount += 1; + char *data = *pdata; + *data++ = len; + strncpy(data, principal, len); + + *pdata += len + 1; + *size += sizeof(uint8_t) + len; + + return true; +} + +/** + * DirectoryNamesCount offset: uint16_t + * ... + * DirectoryNamesCount: uint8_t + * DirectoryNames: list of UTF-8 Pascal strings (uint8_t + char[1,255]) + */ +static size_t status_directorynames(char *data, + int *diroffset, + const DSI *dsi _U_, + const struct afp_options *options _U_) { char *begin = data; uint16_t offset; - memcpy(&offset, data + *diroffset, sizeof(offset)); + + memcpy(&offset, begin + *diroffset, sizeof(offset)); offset = ntohs(offset); data += offset; - /* I can not find documentation of any other purpose for the - * DirectoryNames field. - */ - /* - * Try to synthesize a principal: - * service '/' fqdn '@' realm - */ - if (options->k5service && options->k5realm && options->fqdn) { - /* should k5princ be utf8 encoded? */ - size_t len; - char *p = strchr( options->fqdn, ':' ); - if (p) - *p = '\0'; - len = strlen( options->k5service ) - + strlen( options->fqdn ) - + strlen( options->k5realm ); - len+=2; /* '/' and '@' */ - if ( len > 255 || len+2 > maxstatuslen - offset) { - *data++ = 0; - LOG ( log_error, logtype_afpd, "status: could not set directory service list, no more room"); - } - else { - *data++ = 1; /* DirectoryNamesCount */ - *data++ = len; - snprintf( data, len + 1, "%s/%s@%s", options->k5service, - options->fqdn, options->k5realm ); - data += len; - if (p) - *p = ':'; - } + char *DirectoryNamesCount = data++; + char *DirectoryNames = data; + size_t size = sizeof(uint8_t); + *DirectoryNamesCount = 0; + + if (!uam_gss_enabled()) + goto offset_calc; + +#ifdef HAVE_KERBEROS + krb5_context context; + krb5_error_code ret; + const char *error_msg; + + if (krb5_init_context(&context)) { + LOG(log_error, logtype_afpd, + "status:DirectoryNames failed to intialize a krb5_context"); + goto offset_calc; + } + + krb5_keytab keytab; + if ((ret = krb5_kt_default(context, &keytab))) + goto krb5_error; + + // figure out which service principal to use + krb5_keytab_entry entry; + char *principal; + if (options->k5service && options->fqdn && options->k5realm) { + LOG(log_debug, logtype_afpd, + "status:DirectoryNames: using service principal specified in options"); + + krb5_principal service_principal; + if ((ret = krb5_build_principal(context, + &service_principal, + strlen(options->k5realm), + options->k5realm, + options->k5service, + options->fqdn, + NULL))) + goto krb5_error; + + // try to get the given service principal from keytab + ret = krb5_kt_get_entry(context, + keytab, + service_principal, + 0, // kvno - wildcard + 0, // enctype - wildcard + &entry); + if (ret == KRB5_KT_NOTFOUND) { + krb5_unparse_name(context, service_principal, &principal); + LOG(log_error, logtype_afpd, + "status:DirectoryNames: specified service principal '%s' not found in keytab", + principal); + // XXX: should this be krb5_xfree? +#ifdef HAVE_KRB5_FREE_UNPARSED_NAME + krb5_free_unparsed_name(context, principal); +#else + krb5_xfree(principal); +#endif + goto krb5_cleanup; + } + krb5_free_principal(context, service_principal); + if (ret) + goto krb5_error; } else { - *data++ = 0; + LOG(log_debug, logtype_afpd, + "status:DirectoryNames: using first entry from keytab as service principal"); + + krb5_kt_cursor cursor; + if ((ret = krb5_kt_start_seq_get(context, keytab, &cursor))) + goto krb5_error; + + ret = krb5_kt_next_entry(context, keytab, &entry, &cursor); + krb5_kt_end_seq_get(context, keytab, &cursor); + if (ret) + goto krb5_error; } + krb5_unparse_name(context, entry.principal, &principal); + krb5_kt_free_entry(context, &entry); + + append_directoryname(&data, + offset, + &size, + DirectoryNamesCount, + strlen(principal), + principal); + + free(principal); + goto krb5_cleanup; + +krb5_error: + if (ret) { + error_msg = krb5_get_error_message(context, ret); + LOG(log_note, logtype_afpd, "Can't get principal from default keytab: %s", + (char *)error_msg); +#ifdef HAVE_KRB5_FREE_ERROR_MESSAGE + krb5_free_error_message(context, error_msg); +#else + krb5_xfree(error_msg); +#endif + } + +krb5_cleanup: + krb5_kt_close(context, keytab); + krb5_free_context(context); +#else + if (!options->k5service || !options->fqdn || !options->k5realm) + goto offset_calc; + + char principal[255]; + size_t len = snprintf(principal, sizeof(principal), "%s/%s@%s", + options->k5service, options->fqdn, options->k5realm); + + append_directoryname(&data, + offset, + &size, + DirectoryNamesCount, + strlen(principal), + principal); +#endif // HAVE_KERBEROS + +offset_calc: /* Calculate and store offset for UTF8ServerName */ *diroffset += sizeof(uint16_t); offset = htons(data - begin); @@ -345,7 +498,6 @@ static size_t status_utf8servername(char *data, int *nameoffset, const DSI *dsi _U_, const struct afp_options *options) { - char *Obj, *Type, *Zone; uint16_t namelen; size_t len; char *begin = data; @@ -355,20 +507,15 @@ static size_t status_utf8servername(char *data, int *nameoffset, offset = ntohs(offset); data += offset; - /* FIXME: - * What is the valid character range for an nbpname? - * - * Apple's server likes to use the non-qualified hostname - * This obviously won't work very well if multiple servers are running - * on the box. - */ + LOG(log_info, logtype_afpd, "servername: %s", options->hostname); - /* extract the obj part of the server */ - Obj = options->hostname; - if ((size_t) -1 == (len = convert_string ( - options->unixcharset, CH_UTF8_MAC, - Obj, -1, data+sizeof(namelen), maxstatuslen-offset )) ) { - LOG ( log_error, logtype_afpd, "Could not set utf8 servername"); + if ((len = convert_string(options->unixcharset, + CH_UTF8_MAC, + options->hostname, + -1, + data + sizeof(namelen), + maxstatuslen-offset)) == (size_t)-1) { + LOG(log_error, logtype_afpd, "Could not set utf8 servername"); /* set offset to 0 */ memset(begin + *nameoffset, 0, sizeof(offset)); @@ -459,17 +606,14 @@ void status_init(AFPObj *obj, DSI *dsi) options->flags & OPTION_SERVERNOTIF, (options->fqdn || ipok), options->passwdbits, - (options->k5service && options->k5realm && options->fqdn), + 1, options->flags); /* returns offset to signature offset */ c = status_server(status, options->hostname, options); status_machine(status); status_versions(status, dsi); status_uams(status, options->uamlist); - if (options->flags & OPTION_CUSTOMICON) - status_icon(status, icon, sizeof(icon), c); - else - status_icon(status, apple_atalk_icon, sizeof(apple_atalk_icon), c); + status_icon(status, icon, sizeof(icon), c); sigoff = status_signature(status, &c, options); /* c now contains the offset where the netaddress offset lives */ @@ -483,10 +627,6 @@ void status_init(AFPObj *obj, DSI *dsi) if ( statuslen < maxstatuslen) statuslen = status_utf8servername(status, &c, dsi, options); - if ((options->flags & OPTION_CUSTOMICON) == 0) { - status_icon(status, apple_tcp_icon, sizeof(apple_tcp_icon), 0); - } - dsi->signature = status + sigoff; dsi->statuslen = statuslen; } @@ -497,10 +637,9 @@ void status_init(AFPObj *obj, DSI *dsi) /* If not found in conf file, genarate and append in conf file. */ /* If conf file don't exist, create and genarate. */ /* If cannot open conf file, use one-time signature. */ -/* If signature = user:xxxxx, use it. */ +/* If signature = xxxxx, use it. */ void set_signature(struct afp_options *options) { - char *usersign; int fd, i; struct stat tmpstat; char *servername_conf; @@ -511,38 +650,26 @@ void set_signature(struct afp_options *options) { char *server_tmp; server_tmp = options->hostname; - if (strcmp(options->signatureopt, "auto") == 0) { + len = strlen(options->signatureopt); + if (len == 0) { goto server_signature_auto; /* default */ - } else if (strcmp(options->signatureopt, "host") == 0) { - LOG(log_warning, logtype_afpd, "WARNING: option \"-signature host\" is obsoleted. Switching back to auto.", options->signatureopt); - goto server_signature_auto; /* same as auto */ - } else if (strncmp(options->signatureopt, "user", 4) == 0) { - goto server_signature_user; /* user string */ + } else if (len < 3) { + LOG(log_warning, logtype_afpd, "WARNING: signature string %s is very short!", options->signatureopt); + goto server_signature_user; + } else if (len > 16) { + LOG(log_warning, logtype_afpd, "WARNING: signature string %s is very long!", options->signatureopt); + len = 16; + goto server_signature_user; } else { - LOG(log_error, logtype_afpd, "ERROR: option \"-signature %s\" is not valid. Switching back to auto.", options->signatureopt); - goto server_signature_auto; /* switch back to auto*/ + LOG(log_info, logtype_afpd, "signature string is %s.", options->signatureopt); + goto server_signature_user; } server_signature_user: - /* Signature type is user string */ - len = strlen(options->signatureopt); - if (len <= 5) { - LOG(log_warning, logtype_afpd, "WARNING: option \"-signature %s\" is not valid. Switching back to auto.", options->signatureopt); - goto server_signature_auto; - } - usersign = options->signatureopt + 5; - len = len - 5; - if (len > 16) { - LOG(log_warning, logtype_afpd, "WARNING: signature user string %s is very long !", usersign); - len = 16; - } else if (len >= 3) { - LOG(log_info, logtype_afpd, "signature user string is %s.", usersign); - } else { - LOG(log_warning, logtype_afpd, "WARNING: signature user string %s is very short !", usersign); - } + /* Signature is defined in afp.conf */ memset(options->signature, 0, 16); - memcpy(options->signature, usersign, len); + memcpy(options->signature, options->signatureopt, len); goto server_signature_done; server_signature_auto: @@ -637,7 +764,7 @@ server_signature_random: fprintf(fp, "# ServerSignature is unique identifier used to prevent logging on to\n"); fprintf(fp, "# the same server twice.\n"); fprintf(fp, "# \n"); - fprintf(fp, "# If setting \"signature = user:xxxxx\" in afp.conf, this file is not used.\n\n"); + fprintf(fp, "# If setting \"signature = xxxxx\" in afp.conf, this file is not used.\n\n"); } if (fp) { @@ -653,8 +780,7 @@ server_signature_done: /* retrun */ LOG(log_info, logtype_afpd, - " \"%s\"'s signature is %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", - server_tmp, + "signature is %02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X", (options->signature)[ 0], (options->signature)[ 1], (options->signature)[ 2], (options->signature)[ 3], (options->signature)[ 4], (options->signature)[ 5],