From 45b99383649047c24c0c8e789b1e450aadb55d47 Mon Sep 17 00:00:00 2001 From: Simon Wilkinson Date: Sat, 11 Sep 2010 16:39:23 +0100 Subject: [PATCH] auth: Restructure userok Restructure the userok logic in auth to split it into smaller functions, and abstract out common code. This will make it easier to add support for other security layers in future commits. Change-Id: I64f6e053ad1a6a2054630a400f7499d805bb9838 Reviewed-on: http://gerrit.openafs.org/2752 Reviewed-by: Derrick Brashear Tested-by: Derrick Brashear --- src/auth/userok.c | 271 ++++++++++++++++++++++++---------------------- 1 file changed, 142 insertions(+), 129 deletions(-) diff --git a/src/auth/userok.c b/src/auth/userok.c index e35da8185..54d1f0c29 100644 --- a/src/auth/userok.c +++ b/src/auth/userok.c @@ -335,6 +335,147 @@ CompFindUser(struct afsconf_dir *adir, char *name, char *sep, char *inst, } } +static int +kerberosSuperUser(struct afsconf_dir *adir, char *tname, char *tinst, + char *tcell, char *namep) +{ + char tcell_l[MAXKTCREALMLEN]; + char *tmp; + + /* keep track of which one actually authorized request */ + char uname[MAXKTCNAMELEN + MAXKTCNAMELEN + MAXKTCREALMLEN + 3]; + + static char lcell[MAXCELLCHARS] = ""; + static char lrealms[AFS_NUM_LREALMS][AFS_REALM_SZ]; + static int num_lrealms = -1; + int lrealm_match = 0, i; + int flag; + + /* generate lowercased version of cell name */ + strcpy(tcell_l, tcell); + tmp = tcell_l; + while (*tmp) { + *tmp = tolower(*tmp); + tmp++; + } + + /* determine local cell name. It's static, so will only get + * calculated the first time through */ + if (!lcell[0]) + afsconf_GetLocalCell(adir, lcell, sizeof(lcell)); + + /* if running a krb environment, also get the local realm */ + /* note - this assumes AFS_REALM_SZ <= MAXCELLCHARS */ + /* just set it to lcell if it fails */ + if (num_lrealms == -1) { + for (i=0; i"); + flag = 1; + + /* cell of connection matches local cell or one of the realms */ + } else if (!strcasecmp(tcell, lcell) || lrealm_match) { + if ((tmp = CompFindUser(adir, tname, ".", tinst, NULL))) { + strcpy(uname, tmp); + flag = 1; +#ifdef notyet + } else if ((tmp = CompFindUser(adir, tname, "/", tinst, NULL))) { + strcpy(uname, tmp); + flag = 1; +#endif + } + /* cell of conn doesn't match local cell or realm */ + } else { + if ((tmp = CompFindUser(adir, tname, ".", tinst, tcell))) { + strcpy(uname, tmp); + flag = 1; +#ifdef notyet + } else if ((tmp = CompFindUser(adir, tname, "/", tinst, tcell))) { + strcpy(uname, tmp); + flag = 1; +#endif + } else if ((tmp = CompFindUser(adir, tname, ".", tinst, tcell_l))) { + strcpy(uname, tmp); + flag = 1; +#ifdef notyet + } else if ((tmp = CompFindUser(adir, tname, "/", tinst, tcell_l))) { + strcpy(uname, tmp); + flag = 1; +#endif + } + } + + if (namep) + strcpy(namep, uname); + + return flag; +} + +static int +rxkadSuperUser(struct afsconf_dir *adir, struct rx_call *acall, char *namep) +{ + char tname[MAXKTCNAMELEN]; /* authentication from ticket */ + char tinst[MAXKTCNAMELEN]; + char tcell[MAXKTCREALMLEN]; + + afs_uint32 exp; + int code; + + /* get auth details from server connection */ + code = rxkad_GetServerInfo(acall->conn, NULL, &exp, tname, tinst, tcell, + NULL); + if (code) + return 0; /* bogus connection/other error */ + + /* don't bother checking anything else if tix have expired */ +#ifdef AFS_PTHREAD_ENV + if (exp < clock_Sec()) +#else + if (exp < FT_ApproxTime()) +#endif + return 0; /* expired tix */ + + return kerberosSuperUser(adir, tname, tinst, tcell, namep); +} /* make sure user authenticated on rx call acall is in list of valid users. Copy the "real name" of the authenticated user into namep @@ -370,135 +511,7 @@ afsconf_SuperUser(struct afsconf_dir *adir, struct rx_call *acall, char *namep) UNLOCK_GLOBAL_MUTEX; return 0; /* not supported any longer */ } else if (code == 2) { - char tname[MAXKTCNAMELEN]; /* authentication from ticket */ - char tinst[MAXKTCNAMELEN]; - char tcell[MAXKTCREALMLEN]; - char tcell_l[MAXKTCREALMLEN]; - char *tmp; - - /* keep track of which one actually authorized request */ - char uname[MAXKTCNAMELEN + MAXKTCNAMELEN + MAXKTCREALMLEN + 3]; - - afs_uint32 exp; - static char lcell[MAXCELLCHARS] = ""; - static char lrealms[AFS_NUM_LREALMS][AFS_REALM_SZ]; - static int num_lrealms = -1; - int lrealm_match = 0, i; - - /* get auth details from server connection */ - code = - rxkad_GetServerInfo(acall->conn, NULL, &exp, tname, tinst, tcell, - NULL); - if (code) { - UNLOCK_GLOBAL_MUTEX; - return 0; /* bogus connection/other error */ - } - - /* don't bother checking anything else if tix have expired */ -#ifdef AFS_PTHREAD_ENV - if (exp < clock_Sec()) { -#else - if (exp < FT_ApproxTime()) { -#endif - UNLOCK_GLOBAL_MUTEX; - return 0; /* expired tix */ - } - - /* generate lowercased version of cell name */ - strcpy(tcell_l, tcell); - tmp = tcell_l; - while (*tmp) { - *tmp = tolower(*tmp); - tmp++; - } - - /* determine local cell name. It's static, so will only get - * calculated the first time through */ - if (!lcell[0]) - afsconf_GetLocalCell(adir, lcell, sizeof(lcell)); - - /* if running a krb environment, also get the local realm */ - /* note - this assumes AFS_REALM_SZ <= MAXCELLCHARS */ - /* just set it to lcell if it fails */ - if (num_lrealms == -1) { - for (i=0; i"); - flag = 1; - - /* cell of connection matches local cell or one of the realms */ - } else if (!strcasecmp(tcell, lcell) || lrealm_match) { - if ((tmp = CompFindUser(adir, tname, ".", tinst, NULL))) { - strcpy(uname, tmp); - flag = 1; -#ifdef notyet - } else if ((tmp = CompFindUser(adir, tname, "/", tinst, NULL))) { - strcpy(uname, tmp); - flag = 1; -#endif - } - /* cell of conn doesn't match local cell or realm */ - } else { - if ((tmp = CompFindUser(adir, tname, ".", tinst, tcell))) { - strcpy(uname, tmp); - flag = 1; -#ifdef notyet - } else if ((tmp = CompFindUser(adir, tname, "/", tinst, tcell))) { - strcpy(uname, tmp); - flag = 1; -#endif - } else if ((tmp = CompFindUser(adir, tname, ".", tinst, tcell_l))) { - strcpy(uname, tmp); - flag = 1; -#ifdef notyet - } else if ((tmp = CompFindUser(adir, tname, "/", tinst, tcell_l))) { - strcpy(uname, tmp); - flag = 1; -#endif - } - } - - if (namep) - strcpy(namep, uname); + flag = rxkadSuperUser(adir, acall, namep); UNLOCK_GLOBAL_MUTEX; return flag; } else { /* some other auth type */ -- 2.39.5