Attachment #88650: nfs-utils-1.0.8-CITI_NFS4_ALL-2.patch for bug #136038

	int buf_used, buf_available;

	char *buf;

	/* Don't bother formatting a message we're never going to print! */

	if (priority > verbosity)

		return;

	buf_used = strlen(message_buf);

	/* subtract 4 to leave room for "...\n" if necessary */

	buf_available = sizeof(message_buf) - buf_used - 4;

	buf = message_buf + buf_used;

	if (gssd_check_mechs() != 0)

		errx(1, "Problem with gssapi library");

	/* Determine Kerberos information from the kernel */

	gssd_obtain_kernel_krb5_info();

int gssd_check_mechs(void)

{

	u_int32_t maj_stat, min_stat;

	gss_OID_set supported_mechs = GSS_C_NO_OID_SET;

	int retval = -1;

	maj_stat = gss_indicate_mechs(&min_stat, &supported_mechs);

	if (maj_stat != GSS_S_COMPLETE) {

		printerr(0, "Unable to obtain list of supported mechanisms. "

			 "Check that gss library is properly configured.\n");

		goto out;

	}

	if (supported_mechs == GSS_C_NO_OID_SET ||

	    supported_mechs->count == 0) {

		printerr(0, "Unable to obtain list of supported mechanisms. "

			 "Check that gss library is properly configured.\n");

		goto out;

	}

	maj_stat = gss_release_oid_set(&min_stat, &supported_mechs);

	retval = 0;

out:

	return retval;

}

int gssd_check_mechs(void);

	if (gssd_check_mechs() != 0) {

		printerr(0, "ERROR: Problem with gssapi library\n");

		exit(1);

	}

#include <sys/types.h>

#include <fcntl.h>

/* Encryption types supported by the kernel rpcsec_gss code */

int num_krb5_enctypes = 0;

krb5_enctype *krb5_enctypes = NULL;

/*

 * Parse the supported encryption type information

 */

static int

parse_enctypes(char *enctypes)

{

	int n = 0;

	char *curr, *comma;

	int i;

	/* Just in case this ever gets called more than once */

	if (krb5_enctypes != NULL) {

		free(krb5_enctypes);

		krb5_enctypes = NULL;

		num_krb5_enctypes = 0;

	}

	/* count the number of commas */

	for (curr = enctypes; curr && *curr != '\0'; curr = ++comma) {

		comma = strchr(curr, ',');

		if (comma != NULL)

			n++;

		else

			break;

	}

	/* If no more commas and we're not at the end, there's one more value */

	if (*curr != '\0')

		n++;

	/* Empty string, return an error */

	if (n == 0)

		return ENOENT;

	/* Allocate space for enctypes array */

	if ((krb5_enctypes = (int *) calloc(n, sizeof(int))) == NULL) {

		return ENOMEM;

	}

	/* Now parse each value into the array */

	for (curr = enctypes, i = 0; curr && *curr != '\0'; curr = ++comma) {

		krb5_enctypes[i++] = atoi(curr);

		comma = strchr(curr, ',');

		if (comma == NULL)

			break;

	}

	num_krb5_enctypes = n;

	return 0;

}

#ifdef HAVE_SET_ALLOWABLE_ENCTYPES

/*

 * this routine obtains a credentials handle via gss_acquire_cred()

 * then calls gss_krb5_set_allowable_enctypes() to limit the encryption

 * types negotiated.

 *

 * Returns:

 *	0 => all went well

 *     -1 => there was an error

 */

int

limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid)

{

	u_int maj_stat, min_stat;

	gss_cred_id_t credh;

	gss_OID_set_desc  desired_mechs;

	krb5_enctype enctypes[] = {ENCTYPE_DES_CBC_CRC};

	int num_enctypes = sizeof(enctypes) / sizeof(enctypes[0]);

	/* We only care about getting a krb5 cred */

	desired_mechs.count = 1;

	desired_mechs.elements = &krb5oid;

	maj_stat = gss_acquire_cred(&min_stat, NULL, 0,

				    &desired_mechs, GSS_C_INITIATE,

				    &credh, NULL, NULL);

	if (maj_stat != GSS_S_COMPLETE) {

		pgsserr("gss_acquire_cred",

			maj_stat, min_stat, &krb5oid);

		return -1;

	}

	/*

	 * If we failed for any reason to produce global

	 * list of supported enctypes, use local default here.

	 */

	if (krb5_enctypes == NULL)

		maj_stat = gss_set_allowable_enctypes(&min_stat, credh,

					&krb5oid, num_enctypes, &enctypes);

	else

		maj_stat = gss_set_allowable_enctypes(&min_stat, credh,

					&krb5oid, num_krb5_enctypes,

					krb5_enctypes);

	if (maj_stat != GSS_S_COMPLETE) {

		pgsserr("gss_set_allowable_enctypes",

			maj_stat, min_stat, &krb5oid);

		return -1;

	}

	sec->cred = credh;

	return 0;

}

#endif	/* HAVE_SET_ALLOWABLE_ENCTYPES */

/*

 * Obtain supported enctypes from kernel.

 * Set defaults if info is not available.

 */

void

gssd_obtain_kernel_krb5_info(void)

{

	char enctype_file_name[128];

	char buf[1024];

	char enctypes[128];

	char extrainfo[1024];

	int fd;

	int use_default_enctypes = 0;

	int nbytes, numfields;

	char default_enctypes[] = "1,3,2";

	int code;

	snprintf(enctype_file_name, sizeof(enctype_file_name),

		 "%s/%s", pipefsdir, "krb5_info");

	if ((fd = open(enctype_file_name, O_RDONLY)) == -1) {

		printerr(1, "WARNING: gssd_obtain_kernel_krb5_info: "

			 "Unable to open '%s'. Unable to determine "

			 "Kerberos encryption types supported by the "

			 "kernel; using defaults (%s).\n",

			 enctype_file_name, default_enctypes);

		use_default_enctypes = 1;

		goto do_the_parse;

	}

	if ((nbytes = read(fd, buf, sizeof(buf))) == -1) {

		printerr(0, "WARNING: gssd_obtain_kernel_krb5_info: "

			 "Error reading Kerberos encryption type "

			 "information file '%s'; using defaults (%s).\n",

			 enctype_file_name, default_enctypes);

		use_default_enctypes = 1;

		goto do_the_parse;

	}

	numfields = sscanf(buf, "enctypes: %s\n%s", enctypes, extrainfo);

	if (numfields < 1) {

		printerr(0, "WARNING: gssd_obtain_kernel_krb5_info: "

			 "error parsing Kerberos encryption type "

			 "information from file '%s'; using defaults (%s).\n",

			 enctype_file_name, default_enctypes);

		use_default_enctypes = 1;

		goto do_the_parse;

	}

	if (numfields > 1) {

		printerr(0, "WARNING: gssd_obtain_kernel_krb5_info: "

			 "Extra information, '%s', from '%s' is ignored\n",

			 enctype_file_name, extrainfo);

		use_default_enctypes = 1;

		goto do_the_parse;

	}

  do_the_parse:

  	if (use_default_enctypes)

		strcpy(enctypes, default_enctypes);

	if ((code = parse_enctypes(enctypes)) != 0) {

		printerr(0, "ERROR: gssd_obtain_kernel_krb5_info: "

			 "parse_enctypes%s failed with code %d\n",

			 use_default_enctypes ? " (with default enctypes)" : "",

			 code);

	}

}

void gssd_obtain_kernel_krb5_info(void);

#include <errno.h>

/* for 3DES */

#define KG_USAGE_SEAL 22

#define KG_USAGE_SIGN 23

#define KG_USAGE_SEQ  24

/* for rfc???? */

#define KG_USAGE_ACCEPTOR_SEAL  22

#define KG_USAGE_ACCEPTOR_SIGN  23

#define KG_USAGE_INITIATOR_SEAL 24

#define KG_USAGE_INITIATOR_SIGN 25

/* Lifted from mit src/lib/gssapi/krb5/gssapiP_krb5.h */

enum seal_alg {

  SEAL_ALG_NONE            = 0xffff,

  SEAL_ALG_DES             = 0x0000,

  SEAL_ALG_1               = 0x0001, /* not published */

  SEAL_ALG_MICROSOFT_RC4   = 0x0010, /* microsoft w2k;  */

  SEAL_ALG_DES3KD          = 0x0002

};

#define KEY_USAGE_SEED_ENCRYPTION	0xAA

#define KEY_USAGE_SEED_INTEGRITY	0x55

#define KEY_USAGE_SEED_CHECKSUM		0x99

#define K5CLENGTH 5

/* Flags for version 2 context flags */

#define KRB5_CTX_FLAG_INITIATOR		0x00000001

#define KRB5_CTX_FLAG_CFX		0x00000002

#define KRB5_CTX_FLAG_ACCEPTOR_SUBKEY	0x00000004

/*

 * XXX Hack alert.  We don't have "legal" access to these

 * structures located in libk5crypto

 */

extern void krb5int_enc_arcfour;

extern void krb5int_enc_des3;

extern void krb5int_enc_aes128;

extern void krb5int_enc_aes256;

extern int krb5_derive_key();

void *get_enc_provider();

static void

key_lucid_to_krb5(const gss_krb5_lucid_key_t *lin, krb5_keyblock *kout)

{

	memset(kout, '\0', sizeof(kout));

	kout->enctype = lin->type;

	kout->length = lin->length;

	kout->contents = lin->data;

}

static void

key_krb5_to_lucid(const krb5_keyblock *kin, gss_krb5_lucid_key_t *lout)

{

	memset(lout, '\0', sizeof(lout));

	lout->type = kin->enctype;

	lout->length = kin->length;

	lout->data = kin->contents;

}

/*

 * Function to derive a new key from a given key and given constant data.

 */

static krb5_error_code

derive_key_lucid(const gss_krb5_lucid_key_t *in, gss_krb5_lucid_key_t *out,

		 int usage, char extra)

{

	krb5_error_code code;

	unsigned char constant_data[K5CLENGTH];

	krb5_data datain;

	int keylength;

	void *enc;

	krb5_keyblock kin, kout;  /* must send krb5_keyblock, not lucid! */

	/*

	 * XXX Hack alert.  We don't have "legal" access to these

	 * values and structures located in libk5crypto

	 */

	switch (in->type) {

	case ENCTYPE_DES3_CBC_RAW:

		keylength = 24;

		enc = &krb5int_enc_des3;

		break;

	case ENCTYPE_AES128_CTS_HMAC_SHA1_96:

		keylength = 16;

		enc = &krb5int_enc_aes128;

		break;

	case ENCTYPE_AES256_CTS_HMAC_SHA1_96:

		keylength = 32;

		enc = &krb5int_enc_aes256;

		break;

	default:

		code = KRB5_BAD_ENCTYPE;

		goto out;

	}

	/* allocate memory for output key */

	if ((out->data = malloc(keylength)) == NULL) {

		code = ENOMEM;

		goto out;

	}

	out->length = keylength;

	out->type = in->type;

	/* Convert to correct format for call to krb5_derive_key */

	key_lucid_to_krb5(in, &kin);

	key_lucid_to_krb5(out, &kout);

	datain.data = (char *) constant_data;

	datain.length = K5CLENGTH;

	datain.data[0] = (usage>>24)&0xff;

	datain.data[1] = (usage>>16)&0xff;

	datain.data[2] = (usage>>8)&0xff;

	datain.data[3] = usage&0xff;

	datain.data[4] = (char) extra;

	if ((code = krb5_derive_key(enc, &kin, &kout, &datain))) {

		free(out->data);

		out->data = NULL;

		goto out;

	}

	key_krb5_to_lucid(&kout, out);

  out:

  	if (code)

		printerr(0, "ERROR: derive_key_lucid returning error %d (%s)\n",

			 code, error_message(code));

	return (code);

}

/*

 * Prepare a new-style buffer to send to the kernel for newer encryption

 * types -- or for DES3.

 *

 * The new format is:

 *

 *	u32 version;          This is two (2)

 *	s32 endtime;

 *	u32 flags;

 *	#define KRB5_CTX_FLAG_INITIATOR		0x00000001

 *	#define KRB5_CTX_FLAG_CFX		0x00000002

 *	#define KRB5_CTX_FLAG_ACCEPTOR_SUBKEY	0x00000004

 *	u64 seq_send;

 *	u32  enctype;			( encrption type of keys )

 *	u32  size_of_each_key;		( size of each key in bytes )

 *	u32  number_of_keys;		( N -- should always be 3 for now )

 *	keydata-1;                      ( Ke )

 *	keydata-2;                      ( Ki )

 *	keydata-3;                      ( Kc )

 *

 */

 * Function to derive a new key from a given key and given constant data.

 */

static krb5_error_code

derive_key(const krb5_keyblock *in, krb5_keyblock *out, int usage, char extra)

{

	krb5_error_code code;

	unsigned char constant_data[K5CLENGTH];

	krb5_data datain;

	int keylength;

	void *enc;

	/*

	 * XXX Hack alert.  We don't have "legal" access to these

	 * values and structures located in libk5crypto

	 */

	switch (in->enctype) {

	case ENCTYPE_DES3_CBC_RAW:

		keylength = 24;

		enc = &krb5int_enc_des3;

		break;

	case ENCTYPE_ARCFOUR_HMAC:

		keylength = 16;

		enc = &krb5int_enc_arcfour;

		break;

	default:

		code = KRB5_BAD_ENCTYPE;

		goto out;

	}

	/* allocate memory for output key */

	if ((out->contents = malloc(keylength)) == NULL) {

		code = ENOMEM;

		goto out;

	}

	out->length = keylength;

	out->enctype = in->enctype;

	datain.data = (char *) constant_data;

	datain.length = K5CLENGTH;

	datain.data[0] = (usage>>24)&0xff;

	datain.data[1] = (usage>>16)&0xff;

	datain.data[2] = (usage>>8)&0xff;

	datain.data[3] = usage&0xff;

	datain.data[4] = (char) extra;

	if ((code = krb5_derive_key(enc, in, out, &datain))) {

		free(out->contents);

		out->contents = NULL;

	}

  out:

  	if (code)

		printerr(0, "ERROR: derive_key returning error %d (%s)\n",

			 code, error_message(code));

	return (code);

}

/*

	static int constant_one = 1;

	static int constant_two = 2;

	u_int64_t seq_send_64bit;

	uint32_t v2_flags = 0;

	krb5_keyblock derived_key;

	uint32_t numkeys;

inline static int

write_oid(char **p, char *end, gss_OID_desc *arg)

{

	int len = (int)arg->length;		/* make an int out of size_t */

	if (WRITE_BYTES(p, end, len))

		return -1;

	if (*p + arg->length > end)

		return -1;

	memcpy(*p, arg->elements, len);

	*p += len;

	return 0;

}

#include <errno.h>

#define READLINE_BUFFER_INCREMENT 2048