lib/hdb/hdb.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35 #include "hdb_locl.h"
  36
  37 #ifdef HAVE_DLFCN_H
  38 #include <dlfcn.h>
  39 #endif
  40
  41 /*! @mainpage Heimdal database backend library
  42  *
  43  * @section intro Introduction
  44  *
  45  * Heimdal libhdb library provides the backend support for Heimdal kdc
  46  * and kadmind. Its here where plugins for diffrent database engines
  47  * can be pluged in and extend support for here Heimdal get the
  48  * principal and policy data from.
  49  *
  50  * Example of Heimdal backend are:
  51  * - Berkeley DB 1.85
  52  * - Berkeley DB 3.0
  53  * - Berkeley DB 4.0
  54  * - New Berkeley DB
  55  * - LDAP
  56  *
  57  *
  58  * The project web page: http://www.h5l.org/
  59  *
  60  */
  61
  62
  63
  64 static struct hdb_method methods[] = {
  65 #if HAVE_DB1 || HAVE_DB3
  66     { HDB_INTERFACE_VERSION, "db:",     hdb_db_create},
  67 #endif
  68 #if HAVE_NDBM
  69     { HDB_INTERFACE_VERSION, "ndbm:",   hdb_ndbm_create},
  70 #endif
  71 #if defined(OPENLDAP) && !defined(OPENLDAP_MODULE)
  72     { HDB_INTERFACE_VERSION, "ldap:",   hdb_ldap_create},
  73     { HDB_INTERFACE_VERSION, "ldapi:",  hdb_ldapi_create},
  74 #endif
  75     {0, NULL,   NULL}
  76 };
  77
  78 #if HAVE_DB1 || HAVE_DB3
  79 static struct hdb_method dbmetod =
  80     { HDB_INTERFACE_VERSION, "", hdb_db_create };
  81 #elif defined(HAVE_NDBM)
  82 static struct hdb_method dbmetod =
  83     { HDB_INTERFACE_VERSION, "", hdb_ndbm_create };
  84 #endif
  85
  86
  87 krb5_error_code
  88 hdb_next_enctype2key(krb5_context context,
  89                      const hdb_entry *e,
  90                      krb5_enctype enctype,
  91                      Key **key)
  92 {
  93     Key *k;
  94
  95     for (k = *key ? (*key) + 1 : e->keys.val;
  96          k < e->keys.val + e->keys.len;
  97          k++)
  98     {
  99         if(k->key.keytype == enctype){
 100             *key = k;
 101             return 0;
 102         }
 103     }
 104     krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
 105                            "No next enctype %d for hdb-entry",
 106                           (int)enctype);
 107     return KRB5_PROG_ETYPE_NOSUPP; /* XXX */
 108 }
 109
 110 krb5_error_code
 111 hdb_enctype2key(krb5_context context,
 112                 hdb_entry *e,
 113                 krb5_enctype enctype,
 114                 Key **key)
 115 {
 116     *key = NULL;
 117     return hdb_next_enctype2key(context, e, enctype, key);
 118 }
 119
 120 void
 121 hdb_free_key(Key *key)
 122 {
 123     memset(key->key.keyvalue.data,
 124            0,
 125            key->key.keyvalue.length);
 126     free_Key(key);
 127     free(key);
 128 }
 129
 130
 131 krb5_error_code
 132 hdb_lock(int fd, int operation)
 133 {
 134     int i, code = 0;
 135
 136     for(i = 0; i < 3; i++){
 137         code = flock(fd, (operation == HDB_RLOCK ? LOCK_SH : LOCK_EX) | LOCK_NB);
 138         if(code == 0 || errno != EWOULDBLOCK)
 139             break;
 140         sleep(1);
 141     }
 142     if(code == 0)
 143         return 0;
 144     if(errno == EWOULDBLOCK)
 145         return HDB_ERR_DB_INUSE;
 146     return HDB_ERR_CANT_LOCK_DB;
 147 }
 148
 149 krb5_error_code
 150 hdb_unlock(int fd)
 151 {
 152     int code;
 153     code = flock(fd, LOCK_UN);
 154     if(code)
 155         return 4711 /* XXX */;
 156     return 0;
 157 }
 158
 159 void
 160 hdb_free_entry(krb5_context context, hdb_entry_ex *ent)
 161 {
 162     int i;
 163
 164     if (ent->free_entry)
 165         (*ent->free_entry)(context, ent);
 166
 167     for(i = 0; i < ent->entry.keys.len; ++i) {
 168         Key *k = &ent->entry.keys.val[i];
 169
 170         memset (k->key.keyvalue.data, 0, k->key.keyvalue.length);
 171     }
 172     free_hdb_entry(&ent->entry);
 173 }
 174
 175 krb5_error_code
 176 hdb_foreach(krb5_context context,
 177             HDB *db,
 178             unsigned flags,
 179             hdb_foreach_func_t func,
 180             void *data)
 181 {
 182     krb5_error_code ret;
 183     hdb_entry_ex entry;
 184     ret = db->hdb_firstkey(context, db, flags, &entry);
 185     if (ret == 0)
 186         krb5_clear_error_message(context);
 187     while(ret == 0){
 188         ret = (*func)(context, db, &entry, data);
 189         hdb_free_entry(context, &entry);
 190         if(ret == 0)
 191             ret = db->hdb_nextkey(context, db, flags, &entry);
 192     }
 193     if(ret == HDB_ERR_NOENTRY)
 194         ret = 0;
 195     return ret;
 196 }
 197
 198 krb5_error_code
 199 hdb_check_db_format(krb5_context context, HDB *db)
 200 {
 201     krb5_data tag;
 202     krb5_data version;
 203     krb5_error_code ret, ret2;
 204     unsigned ver;
 205     int foo;
 206
 207     ret = db->hdb_lock(context, db, HDB_RLOCK);
 208     if (ret)
 209         return ret;
 210
 211     tag.data = HDB_DB_FORMAT_ENTRY;
 212     tag.length = strlen(tag.data);
 213     ret = (*db->hdb__get)(context, db, tag, &version);
 214     ret2 = db->hdb_unlock(context, db);
 215     if(ret)
 216         return ret;
 217     if (ret2)
 218         return ret2;
 219     foo = sscanf(version.data, "%u", &ver);
 220     krb5_data_free (&version);
 221     if (foo != 1)
 222         return HDB_ERR_BADVERSION;
 223     if(ver != HDB_DB_FORMAT)
 224         return HDB_ERR_BADVERSION;
 225     return 0;
 226 }
 227
 228 krb5_error_code
 229 hdb_init_db(krb5_context context, HDB *db)
 230 {
 231     krb5_error_code ret, ret2;
 232     krb5_data tag;
 233     krb5_data version;
 234     char ver[32];
 235
 236     ret = hdb_check_db_format(context, db);
 237     if(ret != HDB_ERR_NOENTRY)
 238         return ret;
 239
 240     ret = db->hdb_lock(context, db, HDB_WLOCK);
 241     if (ret)
 242         return ret;
 243
 244     tag.data = HDB_DB_FORMAT_ENTRY;
 245     tag.length = strlen(tag.data);
 246     snprintf(ver, sizeof(ver), "%u", HDB_DB_FORMAT);
 247     version.data = ver;
 248     version.length = strlen(version.data) + 1; /* zero terminated */
 249     ret = (*db->hdb__put)(context, db, 0, tag, version);
 250     ret2 = db->hdb_unlock(context, db);
 251     if (ret) {
 252         if (ret2)
 253             krb5_clear_error_message(context);
 254         return ret;
 255     }
 256     return ret2;
 257 }
 258
 259 #ifdef HAVE_DLOPEN
 260
 261  /*
 262  * Load a dynamic backend from /usr/heimdal/lib/hdb_NAME.so,
 263  * looking for the hdb_NAME_create symbol.
 264  */
 265
 266 static const struct hdb_method *
 267 find_dynamic_method (krb5_context context,
 268                      const char *filename,
 269                      const char **rest)
 270 {
 271     static struct hdb_method method;
 272     struct hdb_so_method *mso;
 273     char *prefix, *path, *symbol;
 274     const char *p;
 275     void *dl;
 276     size_t len;
 277
 278     p = strchr(filename, ':');
 279
 280     /* if no prefix, don't know what module to load, just ignore it */
 281     if (p == NULL)
 282         return NULL;
 283
 284     len = p - filename;
 285     *rest = filename + len + 1;
 286
 287     prefix = malloc(len + 1);
 288     if (prefix == NULL)
 289         krb5_errx(context, 1, "out of memory");
 290     strlcpy(prefix, filename, len + 1);
 291
 292     if (asprintf(&path, LIBDIR "/hdb_%s.so", prefix) == -1)
 293         krb5_errx(context, 1, "out of memory");
 294
 295 #ifndef RTLD_NOW
 296 #define RTLD_NOW 0
 297 #endif
 298 #ifndef RTLD_GLOBAL
 299 #define RTLD_GLOBAL 0
 300 #endif
 301
 302     dl = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
 303     if (dl == NULL) {
 304         krb5_warnx(context, "error trying to load dynamic module %s: %s\n",
 305                    path, dlerror());
 306         free(prefix);
 307         free(path);
 308         return NULL;
 309     }
 310
 311     if (asprintf(&symbol, "hdb_%s_interface", prefix) == -1)
 312         krb5_errx(context, 1, "out of memory");
 313
 314     mso = dlsym(dl, symbol);
 315     if (mso == NULL) {
 316         krb5_warnx(context, "error finding symbol %s in %s: %s\n",
 317                    symbol, path, dlerror());
 318         dlclose(dl);
 319         free(symbol);
 320         free(prefix);
 321         free(path);
 322         return NULL;
 323     }
 324     free(path);
 325     free(symbol);
 326
 327     if (mso->version != HDB_INTERFACE_VERSION) {
 328         krb5_warnx(context,
 329                    "error wrong version in shared module %s "
 330                    "version: %d should have been %d\n",
 331                    prefix, mso->version, HDB_INTERFACE_VERSION);
 332         dlclose(dl);
 333         free(prefix);
 334         return NULL;
 335     }
 336
 337     if (mso->create == NULL) {
 338         krb5_errx(context, 1,
 339                   "no entry point function in shared mod %s ",
 340                    prefix);
 341         dlclose(dl);
 342         free(prefix);
 343         return NULL;
 344     }
 345
 346     method.create = mso->create;
 347     method.prefix = prefix;
 348
 349     return &method;
 350 }
 351 #endif /* HAVE_DLOPEN */
 352
 353 /*
 354  * find the relevant method for `filename', returning a pointer to the
 355  * rest in `rest'.
 356  * return NULL if there's no such method.
 357  */
 358
 359 static const struct hdb_method *
 360 find_method (const char *filename, const char **rest)
 361 {
 362     const struct hdb_method *h;
 363
 364     for (h = methods; h->prefix != NULL; ++h) {
 365         if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0) {
 366             *rest = filename + strlen(h->prefix);
 367             return h;
 368         }
 369     }
 370 #if defined(HAVE_DB1) || defined(HAVE_DB3) || defined(HAVE_NDBM)
 371     if (strncmp(filename, "/", 1) == 0
 372         || strncmp(filename, "./", 2) == 0
 373         || strncmp(filename, "../", 3) == 0)
 374     {
 375         *rest = filename;
 376         return &dbmetod;
 377     }
 378 #endif
 379
 380     return NULL;
 381 }
 382
 383 krb5_error_code
 384 hdb_list_builtin(krb5_context context, char **list)
 385 {
 386     const struct hdb_method *h;
 387     size_t len = 0;
 388     char *buf = NULL;
 389
 390     for (h = methods; h->prefix != NULL; ++h) {
 391         if (h->prefix[0] == '\0')
 392             continue;
 393         len += strlen(h->prefix) + 2;
 394     }
 395
 396     len += 1;
 397     buf = malloc(len);
 398     if (buf == NULL) {
 399         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 400         return ENOMEM;
 401     }
 402     buf[0] = '\0';
 403
 404     for (h = methods; h->prefix != NULL; ++h) {
 405         if (h != methods)
 406             strlcat(buf, ", ", len);
 407         strlcat(buf, h->prefix, len);
 408     }
 409     *list = buf;
 410     return 0;
 411 }
 412
 413 /**
 414  * Create a handle for a Kerberos database
 415  *
 416  * Create a handle for a Kerberos database backend specified by a
 417  * filename.  Doesn't create a file if its doesn't exists, you have to
 418  * use O_CREAT to tell the backend to create the file.
 419  */
 420
 421 krb5_error_code
 422 hdb_create(krb5_context context, HDB **db, const char *filename)
 423 {
 424     const struct hdb_method *h;
 425     const char *residual;
 426     krb5_error_code ret;
 427     struct krb5_plugin *list = NULL, *e;
 428
 429     if(filename == NULL)
 430         filename = HDB_DEFAULT_DB;
 431     krb5_add_et_list(context, initialize_hdb_error_table_r);
 432     h = find_method (filename, &residual);
 433
 434     if (h == NULL) {
 435             ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, "hdb", &list);
 436             if(ret == 0 && list != NULL) {
 437                     for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
 438                             h = _krb5_plugin_get_symbol(e);
 439                             if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0
 440                                 && h->interface_version == HDB_INTERFACE_VERSION) {
 441                                     residual = filename + strlen(h->prefix);
 442                                     break;
 443                             }
 444                     }
 445                     if (e == NULL) {
 446                             h = NULL;
 447                             _krb5_plugin_free(list);
 448                     }
 449             }
 450     }
 451
 452 #ifdef HAVE_DLOPEN
 453     if (h == NULL)
 454         h = find_dynamic_method (context, filename, &residual);
 455 #endif
 456     if (h == NULL)
 457         krb5_errx(context, 1, "No database support for %s", filename);
 458     return (*h->create)(context, db, residual);
 459 }