/*-
* Copyright (c) 2008 Isilon Inc http://www.isilon.com/
* Authors: Doug Rabson <dfr@rabson.org>
* Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#ifdef __FreeBSD__
#include <sys/cdefs.h>
#else
#define __unused
#endif
#include <ctype.h>
#include <err.h>
#include <netdb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <rpc/rpc.h>
#include <rpc/rpcsec_gss.h>
static rpc_gss_principal_t server_acl = NULL;
static void
usage(void)
{
printf("rpctest client | server\n");
exit(1);
}
static void
print_principal(rpc_gss_principal_t principal)
{
int i, len, n;
uint8_t *p;
len = principal->len;
p = (uint8_t *) principal->name;
while (len > 0) {
n = len;
if (n > 16)
n = 16;
for (i = 0; i < n; i++)
printf("%02x ", p[i]);
for (; i < 16; i++)
printf(" ");
printf("|");
for (i = 0; i < n; i++)
printf("%c", isprint(p[i]) ? p[i] : '.');
printf("|\n");
len -= n;
p += n;
}
}
static void
test_client(int argc, const char **argv)
{
rpcproc_t prog = 123456;
rpcvers_t vers = 1;
const char *netid = "tcp";
char hostname[128], service[128+5];
CLIENT *client;
AUTH *auth;
const char **mechs;
rpc_gss_options_req_t options_req;
rpc_gss_options_ret_t options_ret;
rpc_gss_service_t svc;
struct timeval tv;
enum clnt_stat stat;
if (argc == 2)
strlcpy(hostname, argv[1], sizeof(hostname));
else
gethostname(hostname, sizeof(hostname));
client = clnt_create(hostname, prog, vers, netid);
if (!client) {
printf("rpc_createerr.cf_stat = %d\n",
rpc_createerr.cf_stat);
printf("rpc_createerr.cf_error.re_errno = %d\n",
rpc_createerr.cf_error.re_errno);
return;
}
strcpy(service, "host");
strcat(service, "@");
strcat(service, hostname);
mechs = rpc_gss_get_mechanisms();
auth = NULL;
while (*mechs) {
options_req.req_flags = GSS_C_MUTUAL_FLAG;
options_req.time_req = 600;
options_req.my_cred = GSS_C_NO_CREDENTIAL;
options_req.input_channel_bindings = NULL;
auth = rpc_gss_seccreate(client, service,
*mechs,
rpc_gss_svc_none,
NULL,
&options_req,
&options_ret);
if (auth)
break;
mechs++;
}
if (!auth) {
clnt_pcreateerror("rpc_gss_seccreate");
printf("Can't authenticate with server %s.\n",
hostname);
exit(1);
}
client->cl_auth = auth;
for (svc = rpc_gss_svc_none; svc <= rpc_gss_svc_privacy; svc++) {
const char *svc_names[] = {
"rpc_gss_svc_default",
"rpc_gss_svc_none",
"rpc_gss_svc_integrity",
"rpc_gss_svc_privacy"
};
int num;
rpc_gss_set_defaults(auth, svc, NULL);
tv.tv_sec = 5;
tv.tv_usec = 0;
num = 42;
stat = CLNT_CALL(client, 1,
(xdrproc_t) xdr_int, (char *) &num,
(xdrproc_t) xdr_int, (char *) &num, tv);
if (stat == RPC_SUCCESS) {
printf("succeeded with %s\n", svc_names[svc]);
if (num != 142)
printf("unexpected reply %d\n", num);
} else {
clnt_perror(client, "call failed");
}
}
AUTH_DESTROY(auth);
CLNT_DESTROY(client);
}
static void
server_program_1(struct svc_req *rqstp, register SVCXPRT *transp)
{
rpc_gss_rawcred_t *rcred;
rpc_gss_ucred_t *ucred;
int i, num;
if (rqstp->rq_cred.oa_flavor != RPCSEC_GSS) {
svcerr_weakauth(transp);
return;
}
if (!rpc_gss_getcred(rqstp, &rcred, &ucred, NULL)) {
svcerr_systemerr(transp);
return;
}
printf("svc=%d, mech=%s, uid=%d, gid=%d, gids={",
rcred->service, rcred->mechanism, ucred->uid, ucred->gid);
for (i = 0; i < ucred->gidlen; i++) {
if (i > 0) printf(",");
printf("%d", ucred->gidlist[i]);
}
printf("}\n");
switch (rqstp->rq_proc) {
case 0:
if (!svc_getargs(transp, (xdrproc_t) xdr_void, 0)) {
svcerr_decode(transp);
goto out;
}
if (!svc_sendreply(transp, (xdrproc_t) xdr_void, 0)) {
svcerr_systemerr(transp);
}
goto out;
case 1:
if (!svc_getargs(transp, (xdrproc_t) xdr_int,
(char *) &num)) {
svcerr_decode(transp);
goto out;
}
num += 100;
if (!svc_sendreply(transp, (xdrproc_t) xdr_int,
(char *) &num)) {
svcerr_systemerr(transp);
}
goto out;
default:
svcerr_noproc(transp);
goto out;
}
out:
return;
}
#if 0
static void
report_error(gss_OID mech, OM_uint32 maj, OM_uint32 min)
{
OM_uint32 maj_stat, min_stat;
OM_uint32 message_context;
gss_buffer_desc buf;
printf("major_stat=%d, minor_stat=%d\n", maj, min);
message_context = 0;
do {
maj_stat = gss_display_status(&min_stat, maj,
GSS_C_GSS_CODE, GSS_C_NO_OID, &message_context, &buf);
printf("%.*s\n", (int)buf.length, (char *) buf.value);
gss_release_buffer(&min_stat, &buf);
} while (message_context);
if (mech) {
message_context = 0;
do {
maj_stat = gss_display_status(&min_stat, min,
GSS_C_MECH_CODE, mech, &message_context, &buf);
printf("%.*s\n", (int)buf.length, (char *) buf.value);
gss_release_buffer(&min_stat, &buf);
} while (message_context);
}
exit(1);
}
#endif
static bool_t
server_new_context(__unused struct svc_req *req,
__unused gss_cred_id_t deleg,
__unused gss_ctx_id_t gss_context,
rpc_gss_lock_t *lock,
__unused void **cookie)
{
rpc_gss_rawcred_t *rcred = lock->raw_cred;
printf("new security context version=%d, mech=%s, qop=%s:\n",
rcred->version, rcred->mechanism, rcred->qop);
print_principal(rcred->client_principal);
if (!server_acl)
return (TRUE);
if (rcred->client_principal->len != server_acl->len
|| memcmp(rcred->client_principal->name, server_acl->name,
server_acl->len)) {
return (FALSE);
}
return (TRUE);
}
static void
test_server(__unused int argc, __unused const char **argv)
{
char hostname[128];
char principal[128 + 5];
const char **mechs;
static rpc_gss_callback_t cb;
if (argc == 3) {
if (!rpc_gss_get_principal_name(&server_acl, argv[1],
argv[2], NULL, NULL)) {
printf("Can't create %s ACL entry for %s\n",
argv[1], argv[2]);
return;
}
}
gethostname(hostname, sizeof(hostname));;
snprintf(principal, sizeof(principal), "host@%s", hostname);
mechs = rpc_gss_get_mechanisms();
while (*mechs) {
if (!rpc_gss_set_svc_name(principal, *mechs, GSS_C_INDEFINITE,
123456, 1)) {
rpc_gss_error_t e;
rpc_gss_get_error(&e);
printf("setting name for %s for %s failed: %d, %d\n",
principal, *mechs,
e.rpc_gss_error, e.system_error);
#if 0
gss_OID mech_oid;
gss_OID_set_desc oid_set;
gss_name_t name;
OM_uint32 maj_stat, min_stat;
gss_buffer_desc namebuf;
gss_cred_id_t cred;
rpc_gss_mech_to_oid(*mechs, &mech_oid);
oid_set.count = 1;
oid_set.elements = mech_oid;
namebuf.value = principal;
namebuf.length = strlen(principal);
maj_stat = gss_import_name(&min_stat, &namebuf,
GSS_C_NT_HOSTBASED_SERVICE, &name);
if (maj_stat) {
printf("gss_import_name failed\n");
report_error(mech_oid, maj_stat, min_stat);
}
maj_stat = gss_acquire_cred(&min_stat, name,
0, &oid_set, GSS_C_ACCEPT, &cred, NULL, NULL);
if (maj_stat) {
printf("gss_acquire_cred failed\n");
report_error(mech_oid, maj_stat, min_stat);
}
#endif
}
mechs++;
}
cb.program = 123456;
cb.version = 1;
cb.callback = server_new_context;
rpc_gss_set_callback(&cb);
svc_create(server_program_1, 123456, 1, 0);
svc_run();
}
static void
test_get_principal_name(int argc, const char **argv)
{
const char *mechname, *name, *node, *domain;
rpc_gss_principal_t principal;
if (argc < 3 || argc > 5) {
printf("usage: rpctest principal <mechname> <name> "
"[<node> [<domain>] ]\n");
exit(1);
}
mechname = argv[1];
name = argv[2];
node = NULL;
domain = NULL;
if (argc > 3) {
node = argv[3];
if (argc > 4)
domain = argv[4];
}
if (rpc_gss_get_principal_name(&principal, mechname, name,
node, domain)) {
printf("succeeded:\n");
print_principal(principal);
free(principal);
} else {
printf("failed\n");
}
}
int
main(int argc, const char **argv)
{
if (argc < 2)
usage();
if (!strcmp(argv[1], "client"))
test_client(argc - 1, argv + 1);
else if (!strcmp(argv[1], "server"))
test_server(argc - 1, argv + 1);
else if (!strcmp(argv[1], "principal"))
test_get_principal_name(argc - 1, argv + 1);
else
usage();
return (0);
}
plain