source/nsswitch/winbindd_cred_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - krb5 credential cache functions
   5    and in-memory cache functions.
   6
   7    Copyright (C) Guenther Deschner 2005-2006
   8    Copyright (C) Jeremy Allison 2006
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_WINBIND
  29
  30 /* uncomment this to to fast debugging on the krb5 ticket renewal event */
  31 #ifdef DEBUG_KRB5_TKT_RENEWAL
  32 #undef DEBUG_KRB5_TKT_RENEWAL
  33 #endif
  34
  35 #define MAX_CCACHES 100
  36
  37 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
  38 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
  39                                                 struct timeval t);
  40
  41 /* The Krb5 ticket refresh handler should be scheduled
  42    at one-half of the period from now till the tkt
  43    expiration */
  44 #define KRB5_EVENT_REFRESH_TIME(x) ((x) - (((x) - time(NULL))/2))
  45
  46 /****************************************************************
  47  Find an entry by name.
  48 ****************************************************************/
  49
  50 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
  51 {
  52         struct WINBINDD_CCACHE_ENTRY *entry;
  53
  54         for (entry = ccache_list; entry; entry = entry->next) {
  55                 if (strequal(entry->username, username)) {
  56                         return entry;
  57                 }
  58         }
  59         return NULL;
  60 }
  61
  62 /****************************************************************
  63  How many do we have ?
  64 ****************************************************************/
  65
  66 static int ccache_entry_count(void)
  67 {
  68         struct WINBINDD_CCACHE_ENTRY *entry;
  69         int i = 0;
  70
  71         for (entry = ccache_list; entry; entry = entry->next) {
  72                 i++;
  73         }
  74         return i;
  75 }
  76
  77 void ccache_remove_all_after_fork(void)
  78 {
  79         struct WINBINDD_CCACHE_ENTRY *cur;
  80         cur = ccache_list;
  81         while (cur) {
  82                 DLIST_REMOVE(ccache_list, cur);
  83                 TALLOC_FREE(cur->event);
  84                 TALLOC_FREE(cur);
  85                 cur = ccache_list;
  86         }
  87 }
  88
  89 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
  90                                      struct timed_event *te,
  91                                      const struct timeval *now,
  92                                      void *private_data);
  93 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
  94                                         struct timed_event *te,
  95                                         const struct timeval *now,
  96                                         void *private_data);
  97
  98 void ccache_regain_all_now(void)
  99 {
 100         struct WINBINDD_CCACHE_ENTRY *cur;
 101         struct timeval t = timeval_current();
 102
 103         for (cur = ccache_list; cur; cur = cur->next) {
 104                 struct timed_event *new_event;
 105
 106                 /*
 107                  * if refresh_time is 0, we know that the
 108                  * the event has the krb5_ticket_gain_handler
 109                  */
 110                 if (cur->refresh_time == 0) {
 111                         new_event = event_add_timed(winbind_event_context(),
 112                                                 cur, t,
 113                                                 "krb5_ticket_gain_handler",
 114                                                 krb5_ticket_gain_handler,
 115                                                 cur);
 116                 } else {
 117                         new_event = event_add_timed(winbind_event_context(),
 118                                                 cur, t,
 119                                                 "krb5_ticket_refresh_handler",
 120                                                 krb5_ticket_refresh_handler,
 121                                                 cur);
 122                 }
 123                 if (!new_event) {
 124                         continue;
 125                 }
 126
 127                 TALLOC_FREE(cur->event);
 128                 cur->event = new_event;
 129         }
 130         return;
 131 }
 132
 133 /****************************************************************
 134  The gain initial ticket is recognized as entry->refresh_time is
 135  always zero.
 136 ****************************************************************/
 137
 138 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
 139                                                 struct timeval t)
 140 {
 141         entry->refresh_time = 0;
 142         entry->event = event_add_timed(winbind_event_context(), entry,
 143                                         t,
 144                                         "krb5_ticket_gain_handler",
 145                                         krb5_ticket_gain_handler,
 146                                         entry);
 147 }
 148
 149 /****************************************************************
 150  Do the work of refreshing the ticket.
 151 ****************************************************************/
 152
 153 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
 154                                         struct timed_event *te,
 155                                         const struct timeval *now,
 156                                         void *private_data)
 157 {
 158         struct WINBINDD_CCACHE_ENTRY *entry =
 159                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 160 #ifdef HAVE_KRB5
 161         int ret;
 162         time_t new_start;
 163         time_t expire_time = 0;
 164         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 165 #endif
 166
 167         DEBUG(10,("krb5_ticket_refresh_handler called\n"));
 168         DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
 169
 170         TALLOC_FREE(entry->event);
 171
 172 #ifdef HAVE_KRB5
 173
 174         /* Kinit again if we have the user password and we can't renew the old
 175          * tgt anymore
 176          * NB
 177          * This happens when machine are put to sleep for a very long time. */
 178
 179         if (entry->renew_until < time(NULL)) {
 180 rekinit:
 181                 if (cred_ptr && cred_ptr->pass) {
 182
 183                         set_effective_uid(entry->uid);
 184
 185                         ret = kerberos_kinit_password_ext(entry->principal_name,
 186                                                           cred_ptr->pass,
 187                                                           0, /* hm, can we do time correction here ? */
 188                                                           &entry->refresh_time,
 189                                                           &entry->renew_until,
 190                                                           entry->ccname,
 191                                                           False, /* no PAC required anymore */
 192                                                           True,
 193                                                           WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
 194                         gain_root_privilege();
 195
 196                         if (ret) {
 197                                 DEBUG(3,("krb5_ticket_refresh_handler: "
 198                                         "could not re-kinit: %s\n",
 199                                         error_message(ret)));
 200                                 /* destroy the ticket because we cannot rekinit
 201                                  * it, ignore error here */
 202                                 ads_kdestroy(entry->ccname);
 203
 204                                 /* Don't break the ticket refresh chain: retry
 205                                  * refreshing ticket sometime later when KDC is
 206                                  * unreachable -- BoYang.
 207                                  * More error handling here? KRB5_CC_IO,
 208                                  * KRB5KRB_AP_ERR_SKEW.
 209                                  * */
 210
 211                                 if ((ret == KRB5_KDC_UNREACH)
 212                                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
 213 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 214                                         new_start = time(NULL) + 30;
 215 #else
 216                                         new_start = time(NULL) +
 217                                                     MAX(30, lp_winbind_cache_time());
 218 #endif
 219                                         /* try to regain ticket here */
 220                                         add_krb5_ticket_gain_handler_event(entry,
 221                                                                         timeval_set(new_start, 0));
 222                                         return;
 223                                 }
 224                                 TALLOC_FREE(entry->event);
 225                                 return;
 226                         }
 227
 228                         DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
 229                                 "for: %s in ccache: %s\n",
 230                                 entry->principal_name, entry->ccname));
 231
 232 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 233                         new_start = time(NULL) + 30;
 234 #else
 235                         /* The tkt should be refreshed at one-half the period
 236                            from now to the expiration time */
 237                         expire_time = entry->refresh_time;
 238                         new_start = KRB5_EVENT_REFRESH_TIME(entry->refresh_time);
 239 #endif
 240                         goto done;
 241                 } else {
 242                                 /* can this happen?
 243                                  * No cached credentials
 244                                  * destroy ticket and refresh chain
 245                                  * */
 246                                 ads_kdestroy(entry->ccname);
 247                                 TALLOC_FREE(entry->event);
 248                                 return;
 249                 }
 250         }
 251
 252         set_effective_uid(entry->uid);
 253
 254         ret = smb_krb5_renew_ticket(entry->ccname,
 255                                     entry->principal_name,
 256                                     entry->service,
 257                                     &new_start);
 258 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 259         new_start = time(NULL) + 30;
 260 #else
 261         expire_time = new_start;
 262         new_start = KRB5_EVENT_REFRESH_TIME(new_start);
 263 #endif
 264
 265         gain_root_privilege();
 266
 267         if (ret) {
 268                 DEBUG(3,("krb5_ticket_refresh_handler: could not renew tickets: %s\n",
 269                         error_message(ret)));
 270                 /* maybe we are beyond the renewing window */
 271
 272                 /* evil rises here, we refresh ticket failed,
 273                  * but the ticket might be expired. Therefore,
 274                  * When we refresh ticket failed, destory the
 275                  * ticket */
 276
 277                 ads_kdestroy(entry->ccname);
 278
 279                 /* avoid breaking the renewal chain: retry in lp_winbind_cache_time()
 280                  * seconds when the KDC was not available right now.
 281                  * the return code can be KRB5_REALM_CANT_RESOLVE
 282                  * More error handling here? KRB5_CC_IO, KRB5KRB_AP_ERR_SKEW. */
 283
 284                 if ((ret == KRB5_KDC_UNREACH)
 285                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
 286 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 287                         new_start = time(NULL) + 30;
 288 #else
 289                         new_start = time(NULL) +
 290                                     MAX(30, lp_winbind_cache_time());
 291 #endif
 292                         /* ticket is destroyed here, we have to regain it
 293                          * if it is possible */
 294                         add_krb5_ticket_gain_handler_event(entry, timeval_set(new_start, 0));
 295                         return;
 296                 }
 297                 /* This is evil, if the ticket was already expired.
 298                  * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
 299                  * But there is still a chance that we can rekinit it.
 300                  *
 301                  * This happens when user login in online mode, and then network
 302                  * down or something cause winbind goes offline for a very long time,
 303                  * and then goes online again. ticket expired, renew failed.
 304                  * This happens when machine are put to sleep for a long time,
 305                  * but shorter than entry->renew_util.
 306                  * NB
 307                  * Looks like the KDC is reachable, we want to rekinit as soon as
 308                  * possible instead of waiting some time later. */
 309                 if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
 310                     || (ret == KRB5_FCC_NOFILE)) goto rekinit;
 311
 312
 313                 return;
 314         }
 315
 316 done:
 317         /* in cases that ticket will be unrenewable soon, we don't try to renew ticket
 318          * but try to regain ticket if it is possible */
 319         if (entry->renew_until && expire_time
 320              && (entry->renew_until <= expire_time)) {
 321                 /* try to regain ticket 10 seconds beforre expiration */
 322                 expire_time -= 10;
 323                 add_krb5_ticket_gain_handler_event(entry, timeval_set(expire_time, 0));
 324                 return;
 325         }
 326
 327         if (!entry->refresh_time) {
 328                 entry->refresh_time = new_start;
 329         }
 330         entry->event = event_add_timed(winbind_event_context(), entry,
 331                                        timeval_set(new_start, 0),
 332                                        "krb5_ticket_refresh_handler",
 333                                        krb5_ticket_refresh_handler,
 334                                        entry);
 335
 336 #endif
 337 }
 338
 339 /****************************************************************
 340  Do the work of regaining a ticket when coming from offline auth.
 341 ****************************************************************/
 342
 343 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
 344                                      struct timed_event *te,
 345                                         const struct timeval *now,
 346                                         void *private_data)
 347 {
 348         struct WINBINDD_CCACHE_ENTRY *entry =
 349                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 350 #ifdef HAVE_KRB5
 351         int ret;
 352         struct timeval t;
 353         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 354         struct winbindd_domain *domain = NULL;
 355 #endif
 356
 357         DEBUG(10,("krb5_ticket_gain_handler called\n"));
 358         DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
 359
 360         TALLOC_FREE(entry->event);
 361
 362 #ifdef HAVE_KRB5
 363
 364         if (!cred_ptr || !cred_ptr->pass) {
 365                 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
 366                 return;
 367         }
 368
 369         if ((domain = find_domain_from_name(entry->realm)) == NULL) {
 370                 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
 371                 return;
 372         }
 373
 374         if (domain->online) {
 375
 376                 set_effective_uid(entry->uid);
 377
 378                 ret = kerberos_kinit_password_ext(entry->principal_name,
 379                                                 cred_ptr->pass,
 380                                                 0, /* hm, can we do time correction here ? */
 381                                                 &entry->refresh_time,
 382                                                 &entry->renew_until,
 383                                                 entry->ccname,
 384                                                 False, /* no PAC required anymore */
 385                                                 True,
 386                                                 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
 387                 gain_root_privilege();
 388
 389                 if (ret) {
 390                         DEBUG(3,("krb5_ticket_gain_handler: could not kinit: %s\n",
 391                                 error_message(ret)));
 392                         /* evil. If we cannot do it, destroy any the __maybe__
 393                          * __existing__ ticket */
 394                         ads_kdestroy(entry->ccname);
 395                         goto retry_later;
 396                 }
 397
 398                 DEBUG(10,("krb5_ticket_gain_handler: successful kinit for: %s in ccache: %s\n",
 399                         entry->principal_name, entry->ccname));
 400
 401                 goto got_ticket;
 402         }
 403
 404   retry_later:
 405 #if defined(DEBUG_KRB5_TKT_REGAIN)
 406         t = timeval_set(time(NULL) + 30, 0);
 407 #else
 408         t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 409 #endif
 410         add_krb5_ticket_gain_handler_event(entry, t);
 411
 412         return;
 413
 414   got_ticket:
 415
 416 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 417         t = timeval_set(time(NULL) + 30, 0);
 418 #else
 419         t = timeval_set(KRB5_EVENT_REFRESH_TIME(entry->refresh_time), 0);
 420 #endif
 421
 422         if (!entry->refresh_time) {
 423                 entry->refresh_time = t.tv_sec;
 424         }
 425         entry->event = event_add_timed(winbind_event_context(), entry,
 426                                         t,
 427                                         "krb5_ticket_refresh_handler",
 428                                         krb5_ticket_refresh_handler,
 429                                         entry);
 430
 431         return;
 432 #endif
 433 }
 434
 435 /****************************************************************
 436  Check if an ccache entry exists.
 437 ****************************************************************/
 438
 439 BOOL ccache_entry_exists(const char *username)
 440 {
 441         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 442         return (entry != NULL);
 443 }
 444
 445 /****************************************************************
 446  Ensure we're changing the correct entry.
 447 ****************************************************************/
 448
 449 BOOL ccache_entry_identical(const char *username, uid_t uid, const char *ccname)
 450 {
 451         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 452
 453         if (!entry) {
 454                 return False;
 455         }
 456
 457         if (entry->uid != uid) {
 458                 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
 459                         (unsigned int)entry->uid, (unsigned int)uid ));
 460                 return False;
 461         }
 462         if (!strcsequal(entry->ccname, ccname)) {
 463                 DEBUG(0,("cache_entry_identical: ccnames differ: (cache) %s != (client) %s\n",
 464                         entry->ccname, ccname));
 465                 return False;
 466         }
 467         return True;
 468 }
 469
 470 NTSTATUS add_ccache_to_list(const char *princ_name,
 471                             const char *ccname,
 472                             const char *service,
 473                             const char *username,
 474                             const char *realm,
 475                             uid_t uid,
 476                             time_t create_time,
 477                             time_t ticket_end,
 478                             time_t renew_until,
 479                             BOOL postponed_request)
 480 {
 481         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
 482         NTSTATUS ntret;
 483 #ifdef HAVE_KRB5
 484         int ret;
 485 #endif
 486
 487         if ((username == NULL && princ_name == NULL) || ccname == NULL || uid < 0) {
 488                 return NT_STATUS_INVALID_PARAMETER;
 489         }
 490
 491         if (ccache_entry_count() + 1 > MAX_CCACHES) {
 492                 DEBUG(10,("add_ccache_to_list: max number of ccaches reached\n"));
 493                 return NT_STATUS_NO_MORE_ENTRIES;
 494         }
 495
 496         /* If it is cached login, destroy krb5 ticket
 497          * to avoid surprise. */
 498 #ifdef HAVE_KRB5
 499         if (postponed_request) {
 500                 /* ignore KRB5_FCC_NOFILE error here */
 501                 ret = ads_kdestroy(ccname);
 502                 if (ret == KRB5_FCC_NOFILE) {
 503                         ret = 0;
 504                 }
 505                 if (ret) {
 506                         DEBUG(0, ("add_ccache_to_list: failed to destroy "
 507                                    "user krb5 ccache %s with %s\n", ccname,
 508                                    error_message(ret)));
 509                         return krb5_to_nt_status(ret);
 510                 } else {
 511                         DEBUG(10, ("add_ccache_to_list: successfully destroyed "
 512                                    "krb5 ccache %s for user %s\n", ccname,
 513                                    username));
 514                 }
 515         }
 516 #endif
 517
 518         /* Reference count old entries */
 519         entry = get_ccache_by_username(username);
 520         if (entry) {
 521                 /* Check cached entries are identical. */
 522                 if (!ccache_entry_identical(username, uid, ccname)) {
 523                         return NT_STATUS_INVALID_PARAMETER;
 524                 }
 525                 entry->ref_count++;
 526                 DEBUG(10,("add_ccache_to_list: ref count on entry %s is now %d\n",
 527                         username, entry->ref_count));
 528                 /* FIXME: in this case we still might want to have a krb5 cred
 529                  * event handler created - gd
 530                  * Add ticket refresh handler here */
 531
 532                 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
 533                         return NT_STATUS_OK;
 534                 }
 535
 536                 if (!entry->event) {
 537                         struct timeval t;
 538                         if (postponed_request) {
 539                                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 540                                 add_krb5_ticket_gain_handler_event(entry, t);
 541                         } else {
 542                                 /* Renew at 1/2 the ticket expiration time */
 543 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 544                                 t = timeval_set(time(NULL)+30, 0);
 545 #else
 546                                 t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
 547 #endif
 548                                 if (!entry->refresh_time) {
 549                                         entry->refresh_time = t.tv_sec;
 550                                 }
 551                                 entry->event = event_add_timed(winbind_event_context(),
 552                                                                entry,
 553                                                                t,
 554                                                                "krb5_ticket_refresh_handler",
 555                                                                krb5_ticket_refresh_handler,
 556                                                                entry);
 557                         }
 558
 559                         if (!entry->event) {
 560                                 ntret = remove_ccache(username);
 561                                 if (!NT_STATUS_IS_OK(ntret)) {
 562                                         DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
 563                                                   "ccache %s for user %s\n", entry->ccname,
 564                                                   entry->username));
 565                                         DEBUG(0, ("add_ccache_to_list: error is %s\n",
 566                                                   nt_errstr(ntret)));
 567                                         return ntret;
 568                                 }
 569                                 return NT_STATUS_NO_MEMORY;
 570                         }
 571
 572                         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 573                 }
 574
 575                 return NT_STATUS_OK;
 576         }
 577
 578         entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
 579         if (!entry) {
 580                 return NT_STATUS_NO_MEMORY;
 581         }
 582
 583         ZERO_STRUCTP(entry);
 584
 585         if (username) {
 586                 entry->username = talloc_strdup(entry, username);
 587                 if (!entry->username) {
 588                         goto no_mem;
 589                 }
 590         }
 591         if (princ_name) {
 592                 entry->principal_name = talloc_strdup(entry, princ_name);
 593                 if (!entry->principal_name) {
 594                         goto no_mem;
 595                 }
 596         }
 597         if (service) {
 598                 entry->service = talloc_strdup(entry, service);
 599                 if (!entry->service) {
 600                         goto no_mem;
 601                 }
 602         }
 603
 604         entry->ccname = talloc_strdup(entry, ccname);
 605         if (!entry->ccname) {
 606                 goto no_mem;
 607         }
 608
 609         entry->realm = talloc_strdup(entry, realm);
 610         if (!entry->realm) {
 611                 goto no_mem;
 612         }
 613
 614         entry->create_time = create_time;
 615         entry->renew_until = renew_until;
 616         entry->uid = uid;
 617         entry->ref_count = 1;
 618
 619         if (lp_winbind_refresh_tickets() && renew_until > 0) {
 620                 struct timeval t;
 621                 if (postponed_request) {
 622                         add_krb5_ticket_gain_handler_event(entry, t);
 623                 } else {
 624                         /* Renew at 1/2 the ticket expiration time */
 625 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 626                         t = timeval_set(time(NULL)+30, 0);
 627 #else
 628                         t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
 629 #endif
 630                         if (!entry->refresh_time) {
 631                                 entry->refresh_time = t.tv_sec;
 632                         }
 633                         entry->event = event_add_timed(winbind_event_context(), entry,
 634                                                 t,
 635                                                 "krb5_ticket_refresh_handler",
 636                                                 krb5_ticket_refresh_handler,
 637                                                 entry);
 638                 }
 639
 640                 if (!entry->event) {
 641                         goto no_mem;
 642                 }
 643
 644                 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 645         }
 646
 647         DLIST_ADD(ccache_list, entry);
 648
 649         DEBUG(10,("add_ccache_to_list: added ccache [%s] for user [%s] to the list\n", ccname, username));
 650
 651         return NT_STATUS_OK;
 652
 653  no_mem:
 654
 655         TALLOC_FREE(entry);
 656         return NT_STATUS_NO_MEMORY;
 657 }
 658
 659 /*******************************************************************
 660  Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer referenced.
 661 *******************************************************************/
 662
 663 NTSTATUS remove_ccache(const char *username)
 664 {
 665         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 666         NTSTATUS status = NT_STATUS_OK;
 667 #ifdef HAVE_KRB5
 668         krb5_error_code ret;
 669 #endif
 670
 671         if (!entry) {
 672                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 673         }
 674
 675         if (entry->ref_count <= 0) {
 676                 DEBUG(0,("remove_ccache: logic error. ref count for user %s = %d\n",
 677                         username, entry->ref_count));
 678                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 679         }
 680
 681         entry->ref_count--;
 682
 683         if (entry->ref_count > 0) {
 684                 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
 685                         username, entry->ref_count ));
 686                 return NT_STATUS_OK;
 687         }
 688
 689         /* no references any more */
 690
 691         DLIST_REMOVE(ccache_list, entry);
 692         TALLOC_FREE(entry->event); /* unregisters events */
 693
 694 #ifdef HAVE_KRB5
 695         ret = ads_kdestroy(entry->ccname);
 696
 697         /* we ignore the error when there has been no credential cache */
 698         if (ret == KRB5_FCC_NOFILE) {
 699                 ret = 0;
 700         } else if (ret) {
 701                 DEBUG(0,("remove_ccache: failed to destroy user krb5 ccache %s with: %s\n",
 702                         entry->ccname, error_message(ret)));
 703         } else {
 704                 DEBUG(10,("remove_ccache: successfully destroyed krb5 ccache %s for user %s\n",
 705                         entry->ccname, username));
 706         }
 707         status = krb5_to_nt_status(ret);
 708 #endif
 709
 710         TALLOC_FREE(entry);
 711         DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
 712
 713         return status;
 714 }
 715
 716 /*******************************************************************
 717  In memory credentials cache code.
 718 *******************************************************************/
 719
 720 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
 721
 722 /***********************************************************
 723  Find an entry on the list by name.
 724 ***********************************************************/
 725
 726 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
 727 {
 728         struct WINBINDD_MEMORY_CREDS *p;
 729
 730         for (p = memory_creds_list; p; p = p->next) {
 731                 if (strequal(p->username, username)) {
 732                         return p;
 733                 }
 734         }
 735         return NULL;
 736 }
 737
 738 /***********************************************************
 739  Store the required creds and mlock them.
 740 ***********************************************************/
 741
 742 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp, const char *pass)
 743 {
 744 #if !defined(HAVE_MLOCK)
 745         return NT_STATUS_OK;
 746 #else
 747         /* new_entry->nt_hash is the base pointer for the block
 748            of memory pointed into by new_entry->lm_hash and
 749            new_entry->pass (if we're storing plaintext). */
 750
 751         memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
 752         if (pass) {
 753                 memcredp->len += strlen(pass)+1;
 754         }
 755
 756
 757 #if defined(LINUX)
 758         /* aligning the memory on on x86_64 and compiling
 759            with gcc 4.1 using -O2 causes a segv in the
 760            next memset()  --jerry */
 761         memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
 762 #else
 763         /* On non-linux platforms, mlock()'d memory must be aligned */
 764         memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
 765                                                getpagesize(), memcredp->len);
 766 #endif
 767         if (!memcredp->nt_hash) {
 768                 return NT_STATUS_NO_MEMORY;
 769         }
 770         memset( memcredp->nt_hash, 0x0, memcredp->len );
 771
 772         memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
 773
 774 #ifdef DEBUG_PASSWORD
 775         DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
 776 #endif
 777         if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
 778                 DEBUG(0,("failed to mlock memory: %s (%d)\n",
 779                         strerror(errno), errno));
 780                 SAFE_FREE(memcredp->nt_hash);
 781                 return map_nt_error_from_unix(errno);
 782         }
 783
 784 #ifdef DEBUG_PASSWORD
 785         DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
 786 #endif
 787
 788         /* Create and store the password hashes. */
 789         E_md4hash(pass, memcredp->nt_hash);
 790         E_deshash(pass, memcredp->lm_hash);
 791
 792         if (pass) {
 793                 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
 794                 memcpy(memcredp->pass, pass, memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
 795         }
 796
 797         return NT_STATUS_OK;
 798 #endif
 799 }
 800
 801 /***********************************************************
 802  Destroy existing creds.
 803 ***********************************************************/
 804
 805 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
 806 {
 807 #if !defined(HAVE_MUNLOCK)
 808         return NT_STATUS_OK;
 809 #else
 810         if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
 811                 DEBUG(0,("failed to munlock memory: %s (%d)\n",
 812                         strerror(errno), errno));
 813                 return map_nt_error_from_unix(errno);
 814         }
 815         memset(memcredp->nt_hash, '\0', memcredp->len);
 816         SAFE_FREE(memcredp->nt_hash);
 817         memcredp->nt_hash = NULL;
 818         memcredp->lm_hash = NULL;
 819         memcredp->pass = NULL;
 820         memcredp->len = 0;
 821         return NT_STATUS_OK;
 822 #endif
 823 }
 824
 825 /***********************************************************
 826  Replace the required creds with new ones (password change).
 827 ***********************************************************/
 828
 829 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
 830                                                 const char *pass)
 831 {
 832         NTSTATUS status = delete_memory_creds(memcredp);
 833         if (!NT_STATUS_IS_OK(status)) {
 834                 return status;
 835         }
 836         return store_memory_creds(memcredp, pass);
 837 }
 838
 839 /*************************************************************
 840  Store credentials in memory in a list.
 841 *************************************************************/
 842
 843 static NTSTATUS winbindd_add_memory_creds_internal(const char *username, uid_t uid, const char *pass)
 844 {
 845         /* Shortcut to ensure we don't store if no mlock. */
 846 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
 847         return NT_STATUS_OK;
 848 #else
 849         NTSTATUS status;
 850         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 851
 852         if (uid == (uid_t)-1) {
 853                 DEBUG(0,("winbindd_add_memory_creds_internal: invalid uid for user %s.\n",
 854                         username ));
 855                 return NT_STATUS_INVALID_PARAMETER;
 856         }
 857
 858         if (memcredp) {
 859                 /* Already exists. Increment the reference count and replace stored creds. */
 860                 if (uid != memcredp->uid) {
 861                         DEBUG(0,("winbindd_add_memory_creds_internal: uid %u for user %s doesn't "
 862                                 "match stored uid %u. Replacing.\n",
 863                                 (unsigned int)uid, username, (unsigned int)memcredp->uid ));
 864                         memcredp->uid = uid;
 865                 }
 866                 memcredp->ref_count++;
 867                 DEBUG(10,("winbindd_add_memory_creds_internal: ref count for user %s is now %d\n",
 868                         username, memcredp->ref_count ));
 869                 return winbindd_replace_memory_creds_internal(memcredp, pass);
 870         }
 871
 872         memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
 873         if (!memcredp) {
 874                 return NT_STATUS_NO_MEMORY;
 875         }
 876         memcredp->username = talloc_strdup(memcredp, username);
 877         if (!memcredp->username) {
 878                 talloc_destroy(memcredp);
 879                 return NT_STATUS_NO_MEMORY;
 880         }
 881
 882         status = store_memory_creds(memcredp, pass);
 883         if (!NT_STATUS_IS_OK(status)) {
 884                 talloc_destroy(memcredp);
 885                 return status;
 886         }
 887
 888         memcredp->uid = uid;
 889         memcredp->ref_count = 1;
 890         DLIST_ADD(memory_creds_list, memcredp);
 891
 892         DEBUG(10,("winbindd_add_memory_creds_internal: added entry for user %s\n",
 893                 username ));
 894
 895         return NT_STATUS_OK;
 896 #endif
 897 }
 898
 899 /*************************************************************
 900  Store users credentials in memory. If we also have a
 901  struct WINBINDD_CCACHE_ENTRY for this username with a
 902  refresh timer, then store the plaintext of the password
 903  and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
 904 *************************************************************/
 905
 906 NTSTATUS winbindd_add_memory_creds(const char *username, uid_t uid, const char *pass)
 907 {
 908         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 909         NTSTATUS status;
 910
 911         status = winbindd_add_memory_creds_internal(username, uid, pass);
 912         if (!NT_STATUS_IS_OK(status)) {
 913                 return status;
 914         }
 915
 916         if (entry) {
 917                 struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 918                 if (memcredp) {
 919                         entry->cred_ptr = memcredp;
 920                 }
 921         }
 922
 923         return status;
 924 }
 925
 926 /*************************************************************
 927  Decrement the in-memory ref count - delete if zero.
 928 *************************************************************/
 929
 930 NTSTATUS winbindd_delete_memory_creds(const char *username)
 931 {
 932         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 933         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 934         NTSTATUS status = NT_STATUS_OK;
 935
 936         if (!memcredp) {
 937                 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
 938                         username ));
 939                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 940         }
 941
 942         if (memcredp->ref_count <= 0) {
 943                 DEBUG(0,("winbindd_delete_memory_creds: logic error. ref count for user %s = %d\n",
 944                         username, memcredp->ref_count));
 945                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 946         }
 947
 948         memcredp->ref_count--;
 949         if (memcredp->ref_count <= 0) {
 950                 delete_memory_creds(memcredp);
 951                 DLIST_REMOVE(memory_creds_list, memcredp);
 952                 talloc_destroy(memcredp);
 953                 DEBUG(10,("winbindd_delete_memory_creds: deleted entry for user %s\n",
 954                         username));
 955         } else {
 956                 DEBUG(10,("winbindd_delete_memory_creds: entry for user %s ref_count now %d\n",
 957                         username, memcredp->ref_count));
 958         }
 959
 960         if (entry) {
 961                 entry->cred_ptr = NULL; /* Ensure we have no dangling references to this. */
 962         }
 963         return status;
 964 }
 965
 966 /***********************************************************
 967  Replace the required creds with new ones (password change).
 968 ***********************************************************/
 969
 970 NTSTATUS winbindd_replace_memory_creds(const char *username, const char *pass)
 971 {
 972         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 973
 974         if (!memcredp) {
 975                 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
 976                         username ));
 977                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 978         }
 979
 980         DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
 981                 username ));
 982
 983         return winbindd_replace_memory_creds_internal(memcredp, pass);
 984 }