cifscreds.c

/*
 * Credentials stashing utility for Linux CIFS VFS (virtual filesystem) client
 * Copyright (C) 2010 Jeff Layton (jlayton@samba.org)
 * Copyright (C) 2010 Igor Druzhinin (jaxbrigs@gmail.com)
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif /* HAVE_CONFIG_H */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <ctype.h>
#include <keyutils.h>
#include <getopt.h>
#include <errno.h>
#include "cifskey.h"
#include "mount.h"
#include "resolve_host.h"
#include "util.h"

#define THIS_PROGRAM_NAME "cifscreds"

/* max length of appropriate command */
#define MAX_COMMAND_SIZE 32

struct cmdarg {
	char		*host;
	char		*user;
	char		keytype;
};

struct command {
	int (*action)(struct cmdarg *arg);
	const char	name[MAX_COMMAND_SIZE];
	const char	*format;
};

static int cifscreds_add(struct cmdarg *arg);
static int cifscreds_clear(struct cmdarg *arg);
static int cifscreds_clearall(struct cmdarg *arg);
static int cifscreds_update(struct cmdarg *arg);

static const char *thisprogram;

static struct command commands[] = {
	{ cifscreds_add,	"add",		"[-u username] [-d] <host|domain>" },
	{ cifscreds_clear,	"clear",	"[-u username] [-d] <host|domain>" },
	{ cifscreds_clearall,	"clearall",	"" },
	{ cifscreds_update,	"update",	"[-u username] [-d] <host|domain>" },
	{ NULL, "", NULL }
};

static struct option longopts[] = {
	{"username", 1, NULL, 'u'},
	{"domain", 0, NULL, 'd' },
	{NULL, 0, NULL, 0}
};

/* display usage information */
static int
usage(void)
{
	struct command *cmd;

	fprintf(stderr, "Usage:\n");
	for (cmd = commands; cmd->action; cmd++)
		fprintf(stderr, "\t%s %s %s\n", thisprogram,
			cmd->name, cmd->format);
	fprintf(stderr, "\n");

	return EXIT_FAILURE;
}

/* search all program's keys in keyring */
static key_serial_t key_search_all(void)
{
	key_serial_t key, *pk;
	void *keylist;
	char *buffer;
	int count, dpos, n, ret;

	/* read the key payload data */
	count = keyctl_read_alloc(DEST_KEYRING, &keylist);
	if (count < 0)
		return 0;

	count /= sizeof(key_serial_t);

	if (count == 0) {
		ret = 0;
		goto key_search_all_out;
	}

	/* list the keys in the keyring */
	pk = keylist;
	do {
		key = *pk++;

		ret = keyctl_describe_alloc(key, &buffer);
		if (ret < 0)
			continue;

		n = sscanf(buffer, "%*[^;];%*d;%*d;%*x;%n", &dpos);
		if (n) {
			free(buffer);
			continue;
		}

		if (strstr(buffer + dpos, KEY_PREFIX ":") ==
			buffer + dpos
		) {
			ret = key;
			free(buffer);
			goto key_search_all_out;
		}
		free(buffer);

	} while (--count);

	ret = 0;

key_search_all_out:
	free(keylist);
	return ret;
}

/* add command handler */
static int cifscreds_add(struct cmdarg *arg)
{
	char addrstr[MAX_ADDR_LIST_LEN];
	char *currentaddress, *nextaddress;
	char *pass;
	int ret = 0;

	if (arg->host == NULL || arg->user == NULL)
		return usage();

	if (arg->keytype == 'd')
		strlcpy(addrstr, arg->host, MAX_ADDR_LIST_LEN);
	else
		ret = resolve_host(arg->host, addrstr);

	switch (ret) {
	case EX_USAGE:
		fprintf(stderr, "error: Could not resolve address "
			"for %s\n", arg->host);
		return EXIT_FAILURE;

	case EX_SYSERR:
		fprintf(stderr, "error: Problem parsing address list\n");
		return EXIT_FAILURE;
	}

	if (strpbrk(arg->user, USER_DISALLOWED_CHARS)) {
		fprintf(stderr, "error: Incorrect username\n");
		return EXIT_FAILURE;
	}

	/* search for same credentials stashed for current host */
	currentaddress = addrstr;
	nextaddress = strchr(currentaddress, ',');
	if (nextaddress)
		*nextaddress++ = '\0';

	while (currentaddress) {
		if (key_search(currentaddress, arg->keytype) > 0) {
			printf("You already have stashed credentials "
				"for %s (%s)\n", currentaddress, arg->host);
			printf("If you want to update them use:\n");
			printf("\t%s update\n", thisprogram);

			return EXIT_FAILURE;
		}

		switch(errno) {
		case ENOKEY:
			/* success */
			break;
		default:
			printf("Key search failed: %s\n", strerror(errno));
			return EXIT_FAILURE;
		}

		currentaddress = nextaddress;
		if (currentaddress) {
			*(currentaddress - 1) = ',';
			nextaddress = strchr(currentaddress, ',');
			if (nextaddress)
				*nextaddress++ = '\0';
		}
	}

	/*
	 * if there isn't same credentials stashed add them to keyring
	 * and set permisson mask
	 */
	pass = getpass("Password: ");

	currentaddress = addrstr;
	nextaddress = strchr(currentaddress, ',');
	if (nextaddress)
		*nextaddress++ = '\0';

	while (currentaddress) {
		key_serial_t key = key_add(currentaddress, arg->user, pass, arg->keytype);
		if (key <= 0) {
			fprintf(stderr, "error: Add credential key for %s: %s\n",
				currentaddress, strerror(errno));
		} else {
			if (keyctl(KEYCTL_SETPERM, key, CIFS_KEY_PERMS) < 0) {
				fprintf(stderr, "error: Setting permissons "
					"on key, attempt to delete...\n");

				if (keyctl(KEYCTL_UNLINK, key, DEST_KEYRING) < 0) {
					fprintf(stderr, "error: Deleting key from "
						"keyring for %s (%s)\n",
						currentaddress, arg->host);
				}
			}
		}

		currentaddress = nextaddress;
		if (currentaddress) {
			nextaddress = strchr(currentaddress, ',');
			if (nextaddress)
				*nextaddress++ = '\0';
		}
	}

	return EXIT_SUCCESS;
}

/* clear command handler */
static int cifscreds_clear(struct cmdarg *arg)
{
	char addrstr[MAX_ADDR_LIST_LEN];
	char *currentaddress, *nextaddress;
	int ret = 0, count = 0, errors = 0;

	if (arg->host == NULL || arg->user == NULL)
		return usage();

	if (arg->keytype == 'd')
		strlcpy(addrstr, arg->host, MAX_ADDR_LIST_LEN);
	else
		ret = resolve_host(arg->host, addrstr);

	switch (ret) {
	case EX_USAGE:
		fprintf(stderr, "error: Could not resolve address "
			"for %s\n", arg->host);
		return EXIT_FAILURE;

	case EX_SYSERR:
		fprintf(stderr, "error: Problem parsing address list\n");
		return EXIT_FAILURE;
	}

	if (strpbrk(arg->user, USER_DISALLOWED_CHARS)) {
		fprintf(stderr, "error: Incorrect username\n");
		return EXIT_FAILURE;
	}

	/*
	 * search for same credentials stashed for current host
	 * and unlink them from session keyring
	 */
	currentaddress = addrstr;
	nextaddress = strchr(currentaddress, ',');
	if (nextaddress)
		*nextaddress++ = '\0';

	while (currentaddress) {
		key_serial_t key = key_search(currentaddress, arg->keytype);
		if (key > 0) {
			if (keyctl(KEYCTL_UNLINK, key, DEST_KEYRING) < 0) {
				fprintf(stderr, "error: Removing key from "
					"keyring for %s (%s)\n",
					currentaddress, arg->host);
				errors++;
			} else {
				count++;
			}
		}

		currentaddress = nextaddress;
		if (currentaddress) {
			nextaddress = strchr(currentaddress, ',');
			if (nextaddress)
				*nextaddress++ = '\0';
		}
	}

	if (!count && !errors) {
		printf("You have no same stashed credentials "
			" for %s\n", arg->host);
		printf("If you want to add them use:\n");
		printf("\t%s add\n", thisprogram);

		return EXIT_FAILURE;
	}

	return EXIT_SUCCESS;
}

/* clearall command handler */
static int cifscreds_clearall(struct cmdarg *arg __attribute__ ((unused)))
{
	key_serial_t key;
	int count = 0, errors = 0;

	/*
	 * search for all program's credentials stashed in session keyring
	 * and then unlink them
	 */
	do {
		key = key_search_all();
		if (key > 0) {
			if (keyctl(KEYCTL_UNLINK, key, DEST_KEYRING) < 0) {
				fprintf(stderr, "error: Deleting key "
					"from keyring");
				errors++;
			} else {
				count++;
			}
		}
	} while (key > 0);

	if (!count && !errors) {
		printf("You have no stashed " KEY_PREFIX
			" credentials\n");
		printf("If you want to add them use:\n");
		printf("\t%s add\n", thisprogram);

		return EXIT_FAILURE;
	}

	return EXIT_SUCCESS;
}

/* update command handler */
static int cifscreds_update(struct cmdarg *arg)
{
	char addrstr[MAX_ADDR_LIST_LEN];
	char *currentaddress, *nextaddress, *pass;
	char *addrs[16];
	int ret = 0, id, count = 0;

	if (arg->host == NULL || arg->user == NULL)
		return usage();

	if (arg->keytype == 'd')
		strlcpy(addrstr, arg->host, MAX_ADDR_LIST_LEN);
	else
		ret = resolve_host(arg->host, addrstr);

	switch (ret) {
	case EX_USAGE:
		fprintf(stderr, "error: Could not resolve address "
			"for %s\n", arg->host);
		return EXIT_FAILURE;

	case EX_SYSERR:
		fprintf(stderr, "error: Problem parsing address list\n");
		return EXIT_FAILURE;
	}

	if (strpbrk(arg->user, USER_DISALLOWED_CHARS)) {
		fprintf(stderr, "error: Incorrect username\n");
		return EXIT_FAILURE;
	}

	/* search for necessary credentials stashed in session keyring */
	currentaddress = addrstr;
	nextaddress = strchr(currentaddress, ',');
	if (nextaddress)
		*nextaddress++ = '\0';

	while (currentaddress) {
		if (key_search(currentaddress, arg->keytype) > 0) {
			addrs[count] = currentaddress;
			count++;
		}

		currentaddress = nextaddress;
		if (currentaddress) {
			nextaddress = strchr(currentaddress, ',');
			if (nextaddress)
				*nextaddress++ = '\0';
		}
	}

	if (!count) {
		printf("You have no same stashed credentials "
			"for %s\n", arg->host);
		printf("If you want to add them use:\n");
		printf("\t%s add\n", thisprogram);

		return EXIT_FAILURE;
	}

	/* update payload of found keys */
	pass = getpass("Password: ");

	for (id = 0; id < count; id++) {
		key_serial_t key = key_add(addrs[id], arg->user, pass, arg->keytype);
		if (key <= 0)
			fprintf(stderr, "error: Update credential key "
				"for %s: %s\n", addrs[id], strerror(errno));
	}

	return EXIT_SUCCESS;
}

static int
check_session_keyring(void)
{
	key_serial_t	ses_key, uses_key;

	ses_key = keyctl_get_keyring_ID(KEY_SPEC_SESSION_KEYRING, 0);
	if (ses_key == -1) {
		if (errno == ENOKEY)
			fprintf(stderr, "Error: you have no session keyring. "
					"Consider using pam_keyinit to "
					"install one.\n");
		else
			fprintf(stderr, "Error: unable to query session "
					"keyring: %s\n", strerror(errno));
		return (int)ses_key;
	}

	/* A problem querying the user-session keyring isn't fatal. */
	uses_key = keyctl_get_keyring_ID(KEY_SPEC_USER_SESSION_KEYRING, 0);
	if (uses_key == -1)
		return 0;

	if (ses_key == uses_key)
		fprintf(stderr, "Warning: you have no persistent session "
				"keyring. cifscreds keys will not persist "
				"after this process exits. See "
				"pam_keyinit(8).\n");
	return 0;
}

int main(int argc, char **argv)
{
	struct command *cmd, *best;
	struct cmdarg arg;
	int n;

	memset(&arg, 0, sizeof(arg));
	arg.keytype = 'a';

	thisprogram = (char *)basename(argv[0]);
	if (thisprogram == NULL)
		thisprogram = THIS_PROGRAM_NAME;

	if (argc == 1)
		return usage();

	while((n = getopt_long(argc, argv, "du:", longopts, NULL)) != -1) {
		switch (n) {
		case 'd':
			arg.keytype = (char) n;
			break;
		case 'u':
			arg.user = optarg;
			break;
		default:
			return usage();
		}
	}

	if (optind >= argc)
		return usage();

	/* find the best fit command */
	best = NULL;
	n = strnlen(argv[optind], MAX_COMMAND_SIZE);

	for (cmd = commands; cmd->action; cmd++) {
		if (memcmp(cmd->name, argv[optind], n) != 0)
			continue;

		if (cmd->name[n] == 0) {
			/* exact match */
			best = cmd;
			break;
		}

		/* partial match */
		if (best) {
			fprintf(stderr, "Ambiguous command\n");
			return EXIT_FAILURE;
		}

		best = cmd;
	}

	if (!best) {
		fprintf(stderr, "Unknown command\n");
		return EXIT_FAILURE;
	}

	/* second argument should be host or domain */
	if (argc >= 3)
		arg.host = argv[optind + 1];

	if (arg.host && arg.keytype == 'd' &&
	    strpbrk(arg.host, DOMAIN_DISALLOWED_CHARS)) {
		fprintf(stderr, "error: Domain name contains invalid characters\n");
		return EXIT_FAILURE;
	}

	if (arg.user == NULL)
		arg.user = getusername(getuid());

	if (check_session_keyring())
		return EXIT_FAILURE;

	return best->action(&arg);
}