/*
* Copyright 2000, International Business Machines Corporation and others.
* All Rights Reserved.
- *
+ *
* This software has been released under the terms of the IBM Public
* License. For details, see the LICENSE file in the top-level source
* directory or online at http://www.openafs.org/dl/license10.html
/* ticket caching code */
#include <afsconfig.h>
-#if defined(UKERNEL)
-#include "afs/param.h"
-#else
#include <afs/param.h>
-#endif
-
#if defined(UKERNEL)
-#include "afs/sysincludes.h"
#include "afsincludes.h"
-#include "afs/stds.h"
-#include "afs/pthread_glock.h"
-#include "afs/vice.h"
-#include "afs/auth.h"
-#include "afs/venus.h"
-#include "afs/pthread_glock.h"
-#include "afs/dirpath.h"
-#include <ctype.h>
-
-#if !defined(min)
-#define min(a,b) ((a)<(b)?(a):(b))
-#endif /* !defined(min) */
-
-#else /* defined(UKERNEL) */
+#endif
#ifdef AFS_SUN5_ENV
#include <unistd.h>
#endif
#endif
#endif
-#ifdef AFS_DARWIN100_ENV
+#ifdef HAVE_CRT_EXTERNS_H
#include <crt_externs.h>
#endif
#ifdef HAVE_UNISTD_H
#include <afs/auth.h>
#include <afs/venus.h>
#include <afs/afsutil.h>
+
+#if !defined(UKERNEL)
#include <afs/sys_prototypes.h>
+#endif
+
+#include "token.h"
-#endif /* defined(UKERNEL) */
+#if defined(LINUX_KEYRING_SUPPORT) && defined(HAVE_SESSION_TO_PARENT)
+#include <sys/syscall.h>
+#define KEYCTL_SESSION_TO_PARENT 18
+#endif
/* For malloc() */
#include <stdlib.h>
int afs_tf_get_pname(char *);
int afs_tf_get_pinst(char *);
int afs_tf_get_cred(struct ktc_principal *, struct ktc_token *);
-int afs_tf_save_cred(struct ktc_principal *, struct ktc_token *,
+int afs_tf_save_cred(struct ktc_principal *, struct ktc_token *,
struct ktc_principal *);
int afs_tf_close(void);
int afs_tf_create(char *, char *);
#define PIOCTL pioctl
#endif
-
-#ifdef KERNEL_KTC_COMPAT
-
-#ifndef KTC_SYSCALL
-#define KTC_SYSCALL 32
-#endif
-
-/* Kernel call opcode definitions */
-#define KTC_OPCODE_BASE 4300
-#define KTC_NO_OP (0+KTC_OPCODE_BASE)
-#define KTC_SETTOKEN_OP (1+KTC_OPCODE_BASE)
-#define KTC_GETTOKEN_OP (2+KTC_OPCODE_BASE)
-#define KTC_LISTTOKENS_OP (3+KTC_OPCODE_BASE)
-#define KTC_FORGETTOKEN_OP (4+KTC_OPCODE_BASE)
-#define KTC_FORGETALLTOKENS_OP (5+KTC_OPCODE_BASE)
-#define KTC_STATUS_OP (6+KTC_OPCODE_BASE)
-#define KTC_GC_OP (7+KTC_OPCODE_BASE)
-
-#define KTC_INTERFACE_VERSION 3
-
-/* We have to determine if the kernel supports the ktc system call. To do so
- * we attempt to execute its noop function. If this is successful we use the
- * kernel calls in the future otherwise we let the old code run. */
-
-/* To safely check to see whether a system call exists we have to intercept the
- * SIGSYS signal which is caused by executing a non-existant system call. If
- * it is ignored the syscall routine returns EINVAL. The SIGSYS is reset to
- * its old value after the return from syscall. */
-
-static int kernelKTC = 0;
-
-#ifdef AFS_DECOSF_ENV
-/*
- * SIGSYS semantics are broken on Dec AXP OSF/1 v1.2 systems. You need
- * to ignore SIGTRAP too. It is claimed to be fixed under v1.3, but...
- */
-
-#define CHECK_KERNEL \
- if (kernelKTC == 0) { \
- int code, ecode; \
- int (*old)(); \
- int (*old_t)(); \
- old = (int (*)())signal(SIGSYS, SIG_IGN); \
- old_t = (int (*)())signal(SIGTRAP, SIG_IGN); \
- code = syscall (KTC_SYSCALL, KTC_NO_OP, 0,0,0,0,0); \
- ecode = errno; \
- signal(SIGSYS, old); \
- signal(SIGTRAP, old_t); \
- if (code == 0) kernelKTC = 1; \
- else kernelKTC = 2; \
-/* printf ("returned from KTC_NO_OP kernelKTC <= %d; code=%d, errno=%d\n", kernelKTC, code, errno); */\
- }
-
-#else /* AFS_DECOSF_ENV */
-
-#define CHECK_KERNEL \
- if (kernelKTC == 0) { \
- int code, ecode; \
- int (*old)(); \
- old = (int (*)())signal(SIGSYS, SIG_IGN); \
- code = syscall (KTC_SYSCALL, KTC_NO_OP, 0,0,0,0,0); \
- ecode = errno; \
- signal(SIGSYS, old); \
- if (code == 0) kernelKTC = 1; \
- else kernelKTC = 2; \
-/* printf ("returned from KTC_NO_OP kernelKTC <= %d; code=%d, errno=%d\n", kernelKTC, code, errno); */\
- }
-#endif /* AFS_DECOSF_ENV */
-
-#define TRY_KERNEL(cmd,a1,a2,a3,a4) \
-{ CHECK_KERNEL; \
- if (kernelKTC == 1) \
- return syscall (KTC_SYSCALL, cmd, \
- KTC_INTERFACE_VERSION, a1,a2,a3,a4); \
-}
-
-#else
-#define TRY_KERNEL(cmd,a1,a2,a3,a4)
-#endif /* KERNEL_KTC_COMPAT */
-
#if !defined(UKERNEL)
/* this is a structure used to communicate with the afs cache mgr, but is
* otherwise irrelevant */
0}, {
0}};
-/* new interface routines to the ticket cache. Only handle afs service right
- * now. */
-
-static int
-NewSetToken(struct ktc_principal *aserver,
- struct ktc_token *atoken,
- struct ktc_principal *aclient,
- afs_int32 flags)
-{
- TRY_KERNEL(KTC_SETTOKEN_OP, aserver, aclient, atoken,
- sizeof(struct ktc_token));
- /* no kernel ticket cache */
- return EINVAL;
-}
#define MAXPIOCTLTOKENLEN \
(3*sizeof(afs_int32)+MAXKTCTICKETLEN+sizeof(struct ClearToken)+MAXKTCREALMLEN)
static int
-OldSetToken(struct ktc_principal *aserver, struct ktc_token *atoken,
+SetToken(struct ktc_principal *aserver, struct ktc_token *atoken,
struct ktc_principal *aclient, afs_int32 flags)
{
struct ViceIoctl iob;
char tbuffer[MAXPIOCTLTOKENLEN];
- register char *tp;
+ char *tp;
struct ClearToken ct;
- register afs_int32 code;
+ afs_int32 code;
afs_int32 temp;
if (strcmp(aserver->name, "afs") != 0) {
/*
* Information needed by the user space cache manager
*/
- u.u_expiration = ct.EndTimestamp;
- u.u_viceid = ct.ViceId;
+ get_user_struct()->u_expiration = ct.EndTimestamp;
+ get_user_struct()->u_viceid = ct.ViceId;
#endif
temp = sizeof(struct ClearToken);
}
#else /* NO_AFS_CLIENT */
code = PIOCTL(0, VIOCSETTOK, &iob, 0);
+#if defined(LINUX_KEYRING_SUPPORT) && defined(HAVE_SESSION_TO_PARENT)
+ /*
+ * If we're using keyring based PAGs and the SESSION_TO_PARENT keyctl
+ * is available, use it to copy the session keyring to the parent process
+ */
+ if (flags & AFS_SETTOK_SETPAG)
+ syscall(SYS_keyctl, KEYCTL_SESSION_TO_PARENT);
+#endif
#endif /* NO_AFS_CLIENT */
if (code)
return KTC_PIOCTLFAIL;
}
int
+ktc_SetTokenEx(struct ktc_setTokenData *token) {
+ struct ViceIoctl iob;
+ afs_int32 code;
+ XDR xdrs;
+
+ xdrlen_create(&xdrs);
+ if (!xdr_ktc_setTokenData(&xdrs, token))
+ return EINVAL;
+ iob.in_size = xdr_getpos(&xdrs);
+ xdr_destroy(&xdrs);
+
+ iob.in = malloc(iob.in_size);
+ if (iob.in == NULL)
+ return ENOMEM;
+
+ xdrmem_create(&xdrs, iob.in, iob.in_size, XDR_ENCODE);
+ if (!xdr_ktc_setTokenData(&xdrs, token))
+ return KTC_INVAL;
+ xdr_destroy(&xdrs);
+
+ iob.out = NULL;
+ iob.out_size = 0;
+
+ code = PIOCTL(0, VIOC_SETTOK2, &iob, 0);
+
+ free(iob.in);
+
+ /* If we can't use the new pioctl, then fallback to using the old
+ * one, with just the rxkad portion of the token we're being asked to
+ * set
+ */
+ if (code == -1 && errno == EINVAL) {
+ struct ktc_principal server, client;
+ struct ktc_token *rxkadToken;
+ afs_int32 flags;
+
+ /* With the growth of ticket sizes, a ktc_token is now 12k. Don't
+ * allocate it on the stack! */
+ rxkadToken = malloc(sizeof(*rxkadToken));
+ if (rxkadToken == NULL)
+ return ENOMEM;
+
+ code = token_extractRxkad(token, rxkadToken, &flags, &client);
+ if (code) {
+ free(rxkadToken);
+ return KTC_INVAL;
+ }
+
+ memset(&server, 0, sizeof(server));
+ strcpy(server.name, "afs");
+ strcpy(server.cell, token->cell);
+ code = ktc_SetToken(&server, rxkadToken, &client, flags);
+ free(rxkadToken);
+ return code;
+ }
+
+ if (code)
+ return KTC_PIOCTLFAIL;
+
+ return 0;
+}
+
+int
ktc_SetToken(struct ktc_principal *aserver,
struct ktc_token *atoken,
struct ktc_principal *aclient,
afs_int32 flags)
{
- int ncode, ocode;
+ int code;
LOCK_GLOBAL_MUTEX;
#ifdef AFS_KERBEROS_ENV
}
}
- ncode = afs_tf_init(ktc_tkt_string(), W_TKT_FIL);
- if (ncode == NO_TKT_FIL) {
+ code = afs_tf_init(ktc_tkt_string(), W_TKT_FIL);
+ if (code == NO_TKT_FIL) {
(void)afs_tf_create(aclient->name, aclient->instance);
- ncode = afs_tf_init(ktc_tkt_string(), W_TKT_FIL);
+ code = afs_tf_init(ktc_tkt_string(), W_TKT_FIL);
}
- if (!ncode) {
+ if (!code) {
afs_tf_save_cred(aserver, atoken, aclient);
}
afs_tf_close();
#ifdef NO_AFS_CLIENT
UNLOCK_GLOBAL_MUTEX;
- return ncode;
+ return code;
#endif /* NO_AFS_CLIENT */
}
#endif
#ifndef NO_AFS_CLIENT
- ncode = NewSetToken(aserver, atoken, aclient, flags);
- if (ncode || /* new style failed */
- (strcmp(aserver->name, "afs") == 0)) { /* for afs tokens do both */
- ocode = OldSetToken(aserver, atoken, aclient, flags);
- } else
- ocode = 0;
- if (ncode && ocode) {
+ code = SetToken(aserver, atoken, aclient, flags);
+ if (code) {
UNLOCK_GLOBAL_MUTEX;
- if (ocode == -1)
- ocode = errno;
- else if (ocode == KTC_PIOCTLFAIL)
- ocode = errno;
- if (ocode == ESRCH)
+ if (code == -1)
+ code = errno;
+ else if (code == KTC_PIOCTLFAIL)
+ code = errno;
+ if (code == ESRCH)
return KTC_NOCELL;
- if (ocode == EINVAL)
+ if (code == EINVAL)
return KTC_NOPIOCTL;
- if (ocode == EIO)
+ if (code == EIO)
return KTC_NOCM;
return KTC_PIOCTLFAIL;
}
* be set to our identity to the server.
*/
int
-ktc_GetToken(struct ktc_principal *aserver, struct ktc_token *atoken,
+ktc_GetToken(struct ktc_principal *aserver, struct ktc_token *atoken,
int atokenLen, struct ktc_principal *aclient)
{
struct ViceIoctl iob;
char tbuffer[MAXPIOCTLTOKENLEN];
- register afs_int32 code = 0;
+ afs_int32 code = 0;
int index;
char *stp, *cellp; /* secret token ptr */
struct ClearToken ct;
- register char *tp;
+ char *tp;
afs_int32 temp;
int maxLen; /* biggest ticket we can copy */
int tktLen; /* server ticket length */
#endif
LOCK_GLOBAL_MUTEX;
-#ifndef NO_AFS_CLIENT
- TRY_KERNEL(KTC_GETTOKEN_OP, aserver, aclient, atoken, atokenLen);
-#endif /* NO_AFS_CLIENT */
#ifdef AFS_KERBEROS_ENV
if (!lcell[0])
int rc;
LOCK_GLOBAL_MUTEX;
- TRY_KERNEL(KTC_FORGETTOKEN_OP, aserver, 0, 0, 0);
-
rc = ktc_ForgetAllTokens(); /* bogus, but better */
UNLOCK_GLOBAL_MUTEX;
return rc;
{
struct ViceIoctl iob;
char tbuffer[MAXPIOCTLTOKENLEN];
- register afs_int32 code = 0 ;
- register char *tp;
+ afs_int32 code = 0 ;
+ char *tp;
afs_int32 temp, index;
memset(tbuffer, 0, sizeof(tbuffer));
LOCK_GLOBAL_MUTEX;
-#ifndef NO_AFS_CLIENT
- TRY_KERNEL(KTC_LISTTOKENS_OP, aserver, aprevIndex, aindex, 0);
-#endif /* NO_AFS_CLIENT */
index = aprevIndex;
#ifdef NO_AFS_CLIENT
return 0;
}
-/* discard all tokens from this user's cache */
-
-static int
-NewForgetAll(void)
-{
-#ifndef NO_AFS_CLIENT
- TRY_KERNEL(KTC_FORGETALLTOKENS_OP, 0, 0, 0, 0);
-#endif /* NO_AFS_CLIENT */
- return EINVAL;
-}
-
static int
-OldForgetAll(void)
+ForgetAll(void)
{
struct ViceIoctl iob;
- register afs_int32 code;
+ afs_int32 code;
int i;
for (i = 0; i < MAXLOCALTOKENS; i++)
int
ktc_ForgetAllTokens(void)
{
- int ncode, ocode;
+ int ocode;
LOCK_GLOBAL_MUTEX;
#ifdef AFS_KERBEROS_ENV
(void)afs_tf_dest_tkt();
#endif
- ncode = NewForgetAll();
- ocode = OldForgetAll();
- if (ncode && ocode) {
+ ocode = ForgetAll();
+ if (ocode) {
if (ocode == -1)
ocode = errno;
else if (ocode == KTC_PIOCTLFAIL)
int
ktc_OldPioctl(void)
{
- int rc;
- LOCK_GLOBAL_MUTEX;
-#ifdef KERNEL_KTC_COMPAT
- CHECK_KERNEL;
- rc = (kernelKTC != 1); /* old style interface */
-#else
- rc = 1;
-#endif
- UNLOCK_GLOBAL_MUTEX;
- return rc;
+ return 1;
}
afs_uint32
{
int code;
struct ViceIoctl iob;
- afs_int32 pag;
+ afs_uint32 pag;
/* now setup for the pioctl */
iob.in = NULL;
iob.in_size = 0;
- iob.out = &pag;
- iob.out_size = sizeof(afs_int32);
+ iob.out = (caddr_t) &pag;
+ iob.out_size = sizeof(afs_uint32);
code = PIOCTL(0, VIOC_GETPAG, &iob, 0);
if (code < 0) {
gid_t groups[NGROUPS_MAX];
afs_uint32 g0, g1;
afs_uint32 h, l, ret;
+ int ngroups;
+#ifdef AFS_LINUX26_ENV
+ int i;
+#endif
+
+ ngroups = getgroups(sizeof groups / sizeof groups[0], groups);
- if (getgroups(sizeof groups / sizeof groups[0], groups) < 2)
+#ifdef AFS_LINUX26_ENV
+ /* check for AFS_LINUX26_ONEGROUP_ENV PAGs */
+ for (i = 0; i < ngroups; i++) {
+ if (((groups[i] >> 24) & 0xff) == 'A') {
+ return groups[i];
+ }
+ }
+#endif
+
+ if (ngroups < 2)
return 0;
g0 = groups[0] & 0xffff;
* are invalid (ie. when deciding whether afs_tf_init has been
* called.)
* c. In tf_close, be sure it gets reinitialized to a negative
- * number.
+ * number.
*/
static int fd = -1;
static int curpos; /* Position in tfbfr */
* afs_tf_close() closes the ticket file and releases the lock.
*
* tf_gets() returns the next null-terminated string. It's an internal
- * routine used by afs_tf_get_pname(), afs_tf_get_pinst(), and
+ * routine used by afs_tf_get_pname(), afs_tf_get_pinst(), and
* afs_tf_get_cred().
*
* tf_read() reads a given number of bytes. It's an internal routine
/*
* afs_tf_init() should be called before the other ticket file routines.
* It takes the name of the ticket file to use, "tf_name", and a
- * read/write flag "rw" as arguments.
+ * read/write flag "rw" as arguments.
*
* It tries to open the ticket file, checks the mode, and if everything
* is okay, locks the file. If it's opened for reading, the lock is
- * shared. If it's opened for writing, the lock is exclusive.
+ * shared. If it's opened for writing, the lock is exclusive.
*
- * Returns 0 if all went well, otherwise one of the following:
+ * Returns 0 if all went well, otherwise one of the following:
*
* NO_TKT_FIL - file wasn't there
* TKT_FIL_ACC - file was in wrong mode, etc.
* If "wflag" is set, open the ticket file in append-writeonly mode
* and lock the ticket file in exclusive mode. If unable to lock
* the file, sleep and try again. If we fail again, return with the
- * proper error message.
+ * proper error message.
*/
curpos = sizeof(tfbfr);
}
/*
* Otherwise "wflag" is not set and the ticket file should be opened
- * for read-only operations and locked for shared access.
+ * for read-only operations and locked for shared access.
*/
fd = open(tf_name, O_RDONLY, 0600);
* principal's name is filled into the "p" parameter. If all goes well,
* 0 is returned. If afs_tf_init() wasn't called, TKT_FIL_INI is
* returned. If the name was null, or EOF was encountered, or the name
- * was longer than MAXKTCNAMELEN, TKT_FIL_FMT is returned.
+ * was longer than MAXKTCNAMELEN, TKT_FIL_FMT is returned.
*/
int
* goes well, 0 is returned. If afs_tf_init() wasn't called,
* TKT_FIL_INI is returned. If EOF was encountered, or the instance
* was longer than MAXKTCNAMELEN, TKT_FIL_FMT is returned. Note that the
- * instance may be null.
+ * instance may be null.
*/
int
/*
* afs_tf_get_cred() reads a CREDENTIALS record from a ticket file and fills
* in the given structure "c". It should only be called after afs_tf_init(),
- * afs_tf_get_pname(), and afs_tf_get_pinst() have been called. If all goes
- * well, 0 is returned. Possible error codes are:
+ * afs_tf_get_pname(), and afs_tf_get_pinst() have been called. If all goes
+ * well, 0 is returned. Possible error codes are:
*
* TKT_FIL_INI - afs_tf_init wasn't called first
* TKT_FIL_FMT - bad format
*/
static int
-tf_gets(register char *s, int n)
+tf_gets(char *s, int n)
{
- register int count;
+ int count;
if (fd < 0) {
return TKT_FIL_INI;
*/
static int
-tf_read(register char *s, register int n)
+tf_read(char *s, int n)
{
- register int count;
+ int count;
for (count = n; count > 0; --count) {
if (curpos >= sizeof(tfbfr)) {
*/
int
-afs_tf_save_cred(struct ktc_principal *aserver,
- struct ktc_token *atoken,
+afs_tf_save_cred(struct ktc_principal *aserver,
+ struct ktc_token *atoken,
struct ktc_principal *aclient)
{
char realm[MAXKTCREALMLEN + 1];
int count;
char *file = ktc_tkt_string();
int fd;
- register int i;
+ int i;
char zerobuf[1024];
struct stat sbuf;
int
ktc_newpag(void)
{
-#ifdef AFS_DARWIN100_ENV
-#define environ (*_NSGetEnviron())
-#else
+#if !defined(AFS_DARWIN100_ENV) || defined(HAVE_CRT_EXTERNS_H)
+# if defined(AFS_DARWIN100_ENV)
+# define environ (*_NSGetEnviron())
+# else
extern char **environ;
-#endif
+# endif
afs_uint32 pag;
struct stat sbuf;
*++denv = 0;
environ = newenv;
UNLOCK_GLOBAL_MUTEX;
+#endif
return 0;
}
static void
ktc_LocalCell(void)
{
- int code;
+ int code = 0;
struct afsconf_dir *conf;
if ((conf = afsconf_Open(AFSDIR_CLIENT_ETC_DIRPATH))
git://git.openafs.org / openafs.git / blobdiff