source3/winbindd/winbindd_cred_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - krb5 credential cache functions
   5    and in-memory cache functions.
   6
   7    Copyright (C) Guenther Deschner 2005-2006
   8    Copyright (C) Jeremy Allison 2006
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_WINBIND
  28
  29 /* uncomment this to do fast debugging on the krb5 ticket renewal event */
  30 #ifdef DEBUG_KRB5_TKT_RENEWAL
  31 #undef DEBUG_KRB5_TKT_RENEWAL
  32 #endif
  33
  34 #define MAX_CCACHES 100
  35
  36 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
  37 static void krb5_ticket_gain_handler(struct event_context *,
  38                                      struct timed_event *,
  39                                      const struct timeval *,
  40                                      void *);
  41
  42 /* The Krb5 ticket refresh handler should be scheduled
  43    at one-half of the period from now till the tkt
  44    expiration */
  45 #define KRB5_EVENT_REFRESH_TIME(x) ((x) - (((x) - time(NULL))/2))
  46
  47 /****************************************************************
  48  Find an entry by name.
  49 ****************************************************************/
  50
  51 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
  52 {
  53         struct WINBINDD_CCACHE_ENTRY *entry;
  54
  55         for (entry = ccache_list; entry; entry = entry->next) {
  56                 if (strequal(entry->username, username)) {
  57                         return entry;
  58                 }
  59         }
  60         return NULL;
  61 }
  62
  63 /****************************************************************
  64  How many do we have ?
  65 ****************************************************************/
  66
  67 static int ccache_entry_count(void)
  68 {
  69         struct WINBINDD_CCACHE_ENTRY *entry;
  70         int i = 0;
  71
  72         for (entry = ccache_list; entry; entry = entry->next) {
  73                 i++;
  74         }
  75         return i;
  76 }
  77
  78 void ccache_remove_all_after_fork(void)
  79 {
  80         struct WINBINDD_CCACHE_ENTRY *cur, *next;
  81
  82         for (cur = ccache_list; cur; cur = next) {
  83                 next = cur->next;
  84                 DLIST_REMOVE(ccache_list, cur);
  85                 TALLOC_FREE(cur->event);
  86                 TALLOC_FREE(cur);
  87         }
  88
  89         return;
  90 }
  91
  92 /****************************************************************
  93  Do the work of refreshing the ticket.
  94 ****************************************************************/
  95
  96 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
  97                                         struct timed_event *te,
  98                                         const struct timeval *now,
  99                                         void *private_data)
 100 {
 101         struct WINBINDD_CCACHE_ENTRY *entry =
 102                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 103 #ifdef HAVE_KRB5
 104         int ret;
 105         time_t new_start;
 106         time_t expire_time = 0;
 107         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 108 #endif
 109
 110         DEBUG(10,("krb5_ticket_refresh_handler called\n"));
 111         DEBUGADD(10,("event called for: %s, %s\n",
 112                 entry->ccname, entry->username));
 113
 114         TALLOC_FREE(entry->event);
 115
 116 #ifdef HAVE_KRB5
 117
 118         /* Kinit again if we have the user password and we can't renew the old
 119          * tgt anymore
 120          * NB
 121          * This happens when machine are put to sleep for a very long time. */
 122
 123         if (entry->renew_until < time(NULL)) {
 124 rekinit:
 125                 if (cred_ptr && cred_ptr->pass) {
 126
 127                         set_effective_uid(entry->uid);
 128
 129                         ret = kerberos_kinit_password_ext(entry->principal_name,
 130                                                           cred_ptr->pass,
 131                                                           0, /* hm, can we do time correction here ? */
 132                                                           &entry->refresh_time,
 133                                                           &entry->renew_until,
 134                                                           entry->ccname,
 135                                                           False, /* no PAC required anymore */
 136                                                           True,
 137                                                           WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 138                                                           NULL);
 139                         gain_root_privilege();
 140
 141                         if (ret) {
 142                                 DEBUG(3,("krb5_ticket_refresh_handler: "
 143                                         "could not re-kinit: %s\n",
 144                                         error_message(ret)));
 145                                 /* destroy the ticket because we cannot rekinit
 146                                  * it, ignore error here */
 147                                 ads_kdestroy(entry->ccname);
 148
 149                                 /* Don't break the ticket refresh chain: retry
 150                                  * refreshing ticket sometime later when KDC is
 151                                  * unreachable -- BoYang
 152                                  * */
 153
 154                                 if ((ret == KRB5_KDC_UNREACH)
 155                                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
 156 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 157                                         new_start = time(NULL) + 30;
 158 #else
 159                                         new_start = time(NULL) +
 160                                                     MAX(30, lp_winbind_cache_time());
 161 #endif
 162                                         /* try to regain ticket here */
 163                                         entry->event = event_add_timed(winbind_event_context(),
 164                                                                        entry,
 165                                                                        timeval_set(new_start, 0),
 166                                                                        "krb5_ticket_gain_handler",
 167                                                                        krb5_ticket_gain_handler,
 168                                                                        entry);
 169                                         return;
 170                                 }
 171                                 TALLOC_FREE(entry->event);
 172                                 return;
 173                         }
 174
 175                         DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
 176                                 "for: %s in ccache: %s\n",
 177                                 entry->principal_name, entry->ccname));
 178
 179 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 180                         new_start = time(NULL) + 30;
 181 #else
 182                         /* The tkt should be refreshed at one-half the period
 183                            from now to the expiration time */
 184                         expire_time = entry->refresh_time;
 185                         new_start = KRB5_EVENT_REFRESH_TIME(entry->refresh_time);
 186 #endif
 187                         goto done;
 188                 } else {
 189                                 /* can this happen?
 190                                  * No cached credentials
 191                                  * destroy ticket and refresh chain
 192                                  * */
 193                                 ads_kdestroy(entry->ccname);
 194                                 TALLOC_FREE(entry->event);
 195                                 return;
 196                 }
 197         }
 198
 199         set_effective_uid(entry->uid);
 200
 201         ret = smb_krb5_renew_ticket(entry->ccname,
 202                                     entry->principal_name,
 203                                     entry->service,
 204                                     &new_start);
 205 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 206         new_start = time(NULL) + 30;
 207 #else
 208         expire_time = new_start;
 209         new_start = KRB5_EVENT_REFRESH_TIME(new_start);
 210 #endif
 211
 212         gain_root_privilege();
 213
 214         if (ret) {
 215                 DEBUG(3,("krb5_ticket_refresh_handler: "
 216                         "could not renew tickets: %s\n",
 217                         error_message(ret)));
 218                 /* maybe we are beyond the renewing window */
 219
 220                 /* evil rises here, we refresh ticket failed,
 221                  * but the ticket might be expired. Therefore,
 222                  * When we refresh ticket failed, destory the
 223                  * ticket */
 224
 225                 ads_kdestroy(entry->ccname);
 226
 227                 /* avoid breaking the renewal chain: retry in
 228                  * lp_winbind_cache_time() seconds when the KDC was not
 229                  * available right now.
 230                  * the return code can be KRB5_REALM_CANT_RESOLVE*/
 231
 232                 if ((ret == KRB5_KDC_UNREACH)
 233                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
 234 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 235                         new_start = time(NULL) + 30;
 236 #else
 237                         new_start = time(NULL) +
 238                                     MAX(30, lp_winbind_cache_time());
 239 #endif
 240                         /* ticket is destroyed here, we have to regain it
 241                          * if it is possible */
 242                         entry->event = event_add_timed(winbind_event_context(),
 243                                                         entry,
 244                                                         timeval_set(new_start, 0),
 245                                                         "krb5_ticket_gain_handler",
 246                                                         krb5_ticket_gain_handler,
 247                                                         entry);
 248                         return;
 249                 }
 250
 251                 /* This is evil, if the ticket was already expired.
 252                  * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
 253                  * But there is still a chance that we can rekinit it.
 254                  *
 255                  * This happens when user login in online mode, and then network
 256                  * down or something cause winbind goes offline for a very long time,
 257                  * and then goes online again. ticket expired, renew failed.
 258                  * This happens when machine are put to sleep for a long time,
 259                  * but shorter than entry->renew_util.
 260                  * NB
 261                  * Looks like the KDC is reachable, we want to rekinit as soon as
 262                  * possible instead of waiting some time later. */
 263                 if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
 264                     || (ret == KRB5_FCC_NOFILE)) goto rekinit;
 265
 266                 return;
 267         }
 268
 269 done:
 270         /* in cases that ticket will be unrenewable soon, we don't try to renew ticket
 271          * but try to regain ticket if it is possible */
 272         if (entry->renew_until && expire_time
 273              && (entry->renew_until <= expire_time)) {
 274                 /* try to regain ticket 10 seconds beforre expiration */
 275                 expire_time -= 10;
 276                 entry->event = event_add_timed(winbind_event_context(), entry,
 277                                                 timeval_set(expire_time, 0),
 278                                                 "krb5_ticket_gain_handler",
 279                                                 krb5_ticket_gain_handler,
 280                                                 entry);
 281                 return;
 282         }
 283
 284         if (entry->refresh_time == 0) {
 285                 entry->refresh_time = new_start;
 286         }
 287         entry->event = event_add_timed(winbind_event_context(), entry,
 288                                        timeval_set(new_start, 0),
 289                                        "krb5_ticket_refresh_handler",
 290                                        krb5_ticket_refresh_handler,
 291                                        entry);
 292
 293 #endif
 294 }
 295
 296 /****************************************************************
 297  Do the work of regaining a ticket when coming from offline auth.
 298 ****************************************************************/
 299
 300 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
 301                                      struct timed_event *te,
 302                                      const struct timeval *now,
 303                                      void *private_data)
 304 {
 305         struct WINBINDD_CCACHE_ENTRY *entry =
 306                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 307 #ifdef HAVE_KRB5
 308         int ret;
 309         struct timeval t;
 310         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 311         struct winbindd_domain *domain = NULL;
 312 #endif
 313
 314         DEBUG(10,("krb5_ticket_gain_handler called\n"));
 315         DEBUGADD(10,("event called for: %s, %s\n",
 316                 entry->ccname, entry->username));
 317
 318         TALLOC_FREE(entry->event);
 319
 320 #ifdef HAVE_KRB5
 321
 322         if (!cred_ptr || !cred_ptr->pass) {
 323                 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
 324                 return;
 325         }
 326
 327         if ((domain = find_domain_from_name(entry->realm)) == NULL) {
 328                 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
 329                 return;
 330         }
 331
 332         if (!domain->online) {
 333                 goto retry_later;
 334         }
 335
 336         set_effective_uid(entry->uid);
 337
 338         ret = kerberos_kinit_password_ext(entry->principal_name,
 339                                           cred_ptr->pass,
 340                                           0, /* hm, can we do time correction here ? */
 341                                           &entry->refresh_time,
 342                                           &entry->renew_until,
 343                                           entry->ccname,
 344                                           False, /* no PAC required anymore */
 345                                           True,
 346                                           WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 347                                           NULL);
 348         gain_root_privilege();
 349
 350         if (ret) {
 351                 DEBUG(3,("krb5_ticket_gain_handler: "
 352                         "could not kinit: %s\n",
 353                         error_message(ret)));
 354                 /* evil. If we cannot do it, destroy any the __maybe__
 355                  * __existing__ ticket */
 356                 ads_kdestroy(entry->ccname);
 357                 goto retry_later;
 358         }
 359
 360         DEBUG(10,("krb5_ticket_gain_handler: "
 361                 "successful kinit for: %s in ccache: %s\n",
 362                 entry->principal_name, entry->ccname));
 363
 364         goto got_ticket;
 365
 366   retry_later:
 367
 368 #if defined(DEBUG_KRB5_TKT_REGAIN)
 369         t = timeval_set(time(NULL) + 30, 0);
 370 #else
 371         t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 372 #endif
 373
 374         entry->refresh_time = 0;
 375         entry->event = event_add_timed(winbind_event_context(),
 376                                        entry,
 377                                        t,
 378                                        "krb5_ticket_gain_handler",
 379                                        krb5_ticket_gain_handler,
 380                                        entry);
 381
 382         return;
 383
 384   got_ticket:
 385
 386 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 387         t = timeval_set(time(NULL) + 30, 0);
 388 #else
 389         t = timeval_set(KRB5_EVENT_REFRESH_TIME(entry->refresh_time), 0);
 390 #endif
 391
 392         if (entry->refresh_time == 0) {
 393                 entry->refresh_time = t.tv_sec;
 394         }
 395         entry->event = event_add_timed(winbind_event_context(),
 396                                        entry,
 397                                        t,
 398                                        "krb5_ticket_refresh_handler",
 399                                        krb5_ticket_refresh_handler,
 400                                        entry);
 401
 402         return;
 403 #endif
 404 }
 405
 406 void ccache_regain_all_now(void)
 407 {
 408         struct WINBINDD_CCACHE_ENTRY *cur;
 409         struct timeval t = timeval_current();
 410
 411         for (cur = ccache_list; cur; cur = cur->next) {
 412                 struct timed_event *new_event;
 413
 414                 /*
 415                  * if refresh_time is 0, we know that the
 416                  * the event has the krb5_ticket_gain_handler
 417                  */
 418                 if (cur->refresh_time == 0) {
 419                         new_event = event_add_timed(winbind_event_context(),
 420                                                     cur,
 421                                                     t,
 422                                                     "krb5_ticket_gain_handler",
 423                                                     krb5_ticket_gain_handler,
 424                                                     cur);
 425                 } else {
 426                         new_event = event_add_timed(winbind_event_context(),
 427                                                     cur,
 428                                                     t,
 429                                                     "krb5_ticket_refresh_handler",
 430                                                     krb5_ticket_refresh_handler,
 431                                                     cur);
 432                 }
 433
 434                 if (!new_event) {
 435                         continue;
 436                 }
 437
 438                 TALLOC_FREE(cur->event);
 439                 cur->event = new_event;
 440         }
 441
 442         return;
 443 }
 444
 445 /****************************************************************
 446  Check if an ccache entry exists.
 447 ****************************************************************/
 448
 449 bool ccache_entry_exists(const char *username)
 450 {
 451         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 452         return (entry != NULL);
 453 }
 454
 455 /****************************************************************
 456  Ensure we're changing the correct entry.
 457 ****************************************************************/
 458
 459 bool ccache_entry_identical(const char *username,
 460                             uid_t uid,
 461                             const char *ccname)
 462 {
 463         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 464
 465         if (!entry) {
 466                 return False;
 467         }
 468
 469         if (entry->uid != uid) {
 470                 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
 471                         (unsigned int)entry->uid, (unsigned int)uid));
 472                 return False;
 473         }
 474         if (!strcsequal(entry->ccname, ccname)) {
 475                 DEBUG(0,("cache_entry_identical: "
 476                         "ccnames differ: (cache) %s != (client) %s\n",
 477                         entry->ccname, ccname));
 478                 return False;
 479         }
 480         return True;
 481 }
 482
 483 NTSTATUS add_ccache_to_list(const char *princ_name,
 484                             const char *ccname,
 485                             const char *service,
 486                             const char *username,
 487                             const char *realm,
 488                             uid_t uid,
 489                             time_t create_time,
 490                             time_t ticket_end,
 491                             time_t renew_until,
 492                             bool postponed_request)
 493 {
 494         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
 495         struct timeval t;
 496         NTSTATUS ntret;
 497 #ifdef HAVE_KRB5
 498         int ret;
 499 #endif
 500
 501         if ((username == NULL && princ_name == NULL) ||
 502             ccname == NULL || uid < 0) {
 503                 return NT_STATUS_INVALID_PARAMETER;
 504         }
 505
 506         if (ccache_entry_count() + 1 > MAX_CCACHES) {
 507                 DEBUG(10,("add_ccache_to_list: "
 508                         "max number of ccaches reached\n"));
 509                 return NT_STATUS_NO_MORE_ENTRIES;
 510         }
 511
 512         /* If it is cached login, destroy krb5 ticket
 513          * to avoid surprise. */
 514 #ifdef HAVE_KRB5
 515         if (postponed_request) {
 516                 /* ignore KRB5_FCC_NOFILE error here */
 517                 ret = ads_kdestroy(ccname);
 518                 if (ret == KRB5_FCC_NOFILE) {
 519                         ret = 0;
 520                 }
 521                 if (ret) {
 522                         DEBUG(0, ("add_ccache_to_list: failed to destroy "
 523                                    "user krb5 ccache %s with %s\n", ccname,
 524                                    error_message(ret)));
 525                         return krb5_to_nt_status(ret);
 526                 } else {
 527                         DEBUG(10, ("add_ccache_to_list: successfully destroyed "
 528                                    "krb5 ccache %s for user %s\n", ccname,
 529                                    username));
 530                 }
 531         }
 532 #endif
 533
 534         /* Reference count old entries */
 535         entry = get_ccache_by_username(username);
 536         if (entry) {
 537                 /* Check cached entries are identical. */
 538                 if (!ccache_entry_identical(username, uid, ccname)) {
 539                         return NT_STATUS_INVALID_PARAMETER;
 540                 }
 541                 entry->ref_count++;
 542                 DEBUG(10,("add_ccache_to_list: "
 543                         "ref count on entry %s is now %d\n",
 544                         username, entry->ref_count));
 545                 /* FIXME: in this case we still might want to have a krb5 cred
 546                  * event handler created - gd
 547                  * Add ticket refresh handler here */
 548
 549                 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
 550                         return NT_STATUS_OK;
 551                 }
 552
 553                 if (!entry->event) {
 554                         if (postponed_request) {
 555                                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 556                                 entry->event = event_add_timed(winbind_event_context(),
 557                                                                entry,
 558                                                                t,
 559                                                                "krb5_ticket_gain_handler",
 560                                                                krb5_ticket_gain_handler,
 561                                                                entry);
 562                         } else {
 563                                 /* Renew at 1/2 the ticket expiration time */
 564 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 565                                 t = timeval_set(time(NULL)+30, 0);
 566 #else
 567                                 t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
 568 #endif
 569                                 entry->event = event_add_timed(winbind_event_context(),
 570                                                                entry,
 571                                                                t,
 572                                                                "krb5_ticket_refresh_handler",
 573                                                                krb5_ticket_refresh_handler,
 574                                                                entry);
 575                         }
 576
 577                         if (!entry->event) {
 578                                 ntret = remove_ccache(username);
 579                                 if (!NT_STATUS_IS_OK(ntret)) {
 580                                         DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
 581                                                   "ccache %s for user %s\n", entry->ccname,
 582                                                   entry->username));
 583                                         DEBUG(0, ("add_ccache_to_list: error is %s\n",
 584                                                   nt_errstr(ntret)));
 585                                         return ntret;
 586                                 }
 587                                 return NT_STATUS_NO_MEMORY;
 588                         }
 589
 590                         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 591                 }
 592
 593                 return NT_STATUS_OK;
 594         }
 595
 596         entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
 597         if (!entry) {
 598                 return NT_STATUS_NO_MEMORY;
 599         }
 600
 601         ZERO_STRUCTP(entry);
 602
 603         if (username) {
 604                 entry->username = talloc_strdup(entry, username);
 605                 if (!entry->username) {
 606                         goto no_mem;
 607                 }
 608         }
 609         if (princ_name) {
 610                 entry->principal_name = talloc_strdup(entry, princ_name);
 611                 if (!entry->principal_name) {
 612                         goto no_mem;
 613                 }
 614         }
 615         if (service) {
 616                 entry->service = talloc_strdup(entry, service);
 617                 if (!entry->service) {
 618                         goto no_mem;
 619                 }
 620         }
 621
 622         entry->ccname = talloc_strdup(entry, ccname);
 623         if (!entry->ccname) {
 624                 goto no_mem;
 625         }
 626
 627         entry->realm = talloc_strdup(entry, realm);
 628         if (!entry->realm) {
 629                 goto no_mem;
 630         }
 631
 632         entry->create_time = create_time;
 633         entry->renew_until = renew_until;
 634         entry->uid = uid;
 635         entry->ref_count = 1;
 636
 637         if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
 638                 goto add_entry;
 639         }
 640
 641         if (postponed_request) {
 642                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 643                 entry->refresh_time = 0;
 644                 entry->event = event_add_timed(winbind_event_context(),
 645                                                entry,
 646                                                t,
 647                                                "krb5_ticket_gain_handler",
 648                                                krb5_ticket_gain_handler,
 649                                                entry);
 650         } else {
 651                 /* Renew at 1/2 the ticket expiration time */
 652 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 653                 t = timeval_set(time(NULL)+30, 0);
 654 #else
 655                 t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
 656 #endif
 657                 if (entry->refresh_time == 0) {
 658                         entry->refresh_time = t.tv_sec;
 659                 }
 660                 entry->event = event_add_timed(winbind_event_context(),
 661                                                entry,
 662                                                t,
 663                                                "krb5_ticket_refresh_handler",
 664                                                krb5_ticket_refresh_handler,
 665                                                entry);
 666         }
 667
 668         if (!entry->event) {
 669                 goto no_mem;
 670         }
 671
 672         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 673
 674  add_entry:
 675
 676         DLIST_ADD(ccache_list, entry);
 677
 678         DEBUG(10,("add_ccache_to_list: "
 679                 "added ccache [%s] for user [%s] to the list\n",
 680                 ccname, username));
 681
 682         return NT_STATUS_OK;
 683
 684  no_mem:
 685
 686         TALLOC_FREE(entry);
 687         return NT_STATUS_NO_MEMORY;
 688 }
 689
 690 /*******************************************************************
 691  Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer
 692  referenced.
 693  *******************************************************************/
 694
 695 NTSTATUS remove_ccache(const char *username)
 696 {
 697         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 698         NTSTATUS status = NT_STATUS_OK;
 699         #ifdef HAVE_KRB5
 700         krb5_error_code ret;
 701 #endif
 702
 703         if (!entry) {
 704                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 705         }
 706
 707         if (entry->ref_count <= 0) {
 708                 DEBUG(0,("remove_ccache: logic error. "
 709                         "ref count for user %s = %d\n",
 710                         username, entry->ref_count));
 711                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 712         }
 713
 714         entry->ref_count--;
 715
 716         if (entry->ref_count > 0) {
 717                 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
 718                         username, entry->ref_count));
 719                 return NT_STATUS_OK;
 720         }
 721
 722         /* no references any more */
 723
 724         DLIST_REMOVE(ccache_list, entry);
 725         TALLOC_FREE(entry->event); /* unregisters events */
 726
 727 #ifdef HAVE_KRB5
 728         ret = ads_kdestroy(entry->ccname);
 729
 730         /* we ignore the error when there has been no credential cache */
 731         if (ret == KRB5_FCC_NOFILE) {
 732                 ret = 0;
 733         } else if (ret) {
 734                 DEBUG(0,("remove_ccache: "
 735                         "failed to destroy user krb5 ccache %s with: %s\n",
 736                         entry->ccname, error_message(ret)));
 737         } else {
 738                 DEBUG(10,("remove_ccache: "
 739                         "successfully destroyed krb5 ccache %s for user %s\n",
 740                         entry->ccname, username));
 741         }
 742         status = krb5_to_nt_status(ret);
 743 #endif
 744
 745         TALLOC_FREE(entry);
 746         DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
 747
 748         return status;
 749 }
 750
 751 /*******************************************************************
 752  In memory credentials cache code.
 753 *******************************************************************/
 754
 755 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
 756
 757 /***********************************************************
 758  Find an entry on the list by name.
 759 ***********************************************************/
 760
 761 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
 762 {
 763         struct WINBINDD_MEMORY_CREDS *p;
 764
 765         for (p = memory_creds_list; p; p = p->next) {
 766                 if (strequal(p->username, username)) {
 767                         return p;
 768                 }
 769         }
 770         return NULL;
 771 }
 772
 773 /***********************************************************
 774  Store the required creds and mlock them.
 775 ***********************************************************/
 776
 777 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp,
 778                                    const char *pass)
 779 {
 780 #if !defined(HAVE_MLOCK)
 781         return NT_STATUS_OK;
 782 #else
 783         /* new_entry->nt_hash is the base pointer for the block
 784            of memory pointed into by new_entry->lm_hash and
 785            new_entry->pass (if we're storing plaintext). */
 786
 787         memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
 788         if (pass) {
 789                 memcredp->len += strlen(pass)+1;
 790         }
 791
 792
 793 #if defined(LINUX)
 794         /* aligning the memory on on x86_64 and compiling
 795            with gcc 4.1 using -O2 causes a segv in the
 796            next memset()  --jerry */
 797         memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
 798 #else
 799         /* On non-linux platforms, mlock()'d memory must be aligned */
 800         memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
 801                                                getpagesize(), memcredp->len);
 802 #endif
 803         if (!memcredp->nt_hash) {
 804                 return NT_STATUS_NO_MEMORY;
 805         }
 806         memset(memcredp->nt_hash, 0x0, memcredp->len);
 807
 808         memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
 809
 810 #ifdef DEBUG_PASSWORD
 811         DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
 812 #endif
 813         if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
 814                 DEBUG(0,("failed to mlock memory: %s (%d)\n",
 815                         strerror(errno), errno));
 816                 SAFE_FREE(memcredp->nt_hash);
 817                 return map_nt_error_from_unix(errno);
 818         }
 819
 820 #ifdef DEBUG_PASSWORD
 821         DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
 822 #endif
 823
 824         /* Create and store the password hashes. */
 825         E_md4hash(pass, memcredp->nt_hash);
 826         E_deshash(pass, memcredp->lm_hash);
 827
 828         if (pass) {
 829                 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
 830                 memcpy(memcredp->pass, pass,
 831                        memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
 832         }
 833
 834         return NT_STATUS_OK;
 835 #endif
 836 }
 837
 838 /***********************************************************
 839  Destroy existing creds.
 840 ***********************************************************/
 841
 842 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
 843 {
 844 #if !defined(HAVE_MUNLOCK)
 845         return NT_STATUS_OK;
 846 #else
 847         if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
 848                 DEBUG(0,("failed to munlock memory: %s (%d)\n",
 849                         strerror(errno), errno));
 850                 return map_nt_error_from_unix(errno);
 851         }
 852         memset(memcredp->nt_hash, '\0', memcredp->len);
 853         SAFE_FREE(memcredp->nt_hash);
 854         memcredp->nt_hash = NULL;
 855         memcredp->lm_hash = NULL;
 856         memcredp->pass = NULL;
 857         memcredp->len = 0;
 858         return NT_STATUS_OK;
 859 #endif
 860 }
 861
 862 /***********************************************************
 863  Replace the required creds with new ones (password change).
 864 ***********************************************************/
 865
 866 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
 867                                                        const char *pass)
 868 {
 869         NTSTATUS status = delete_memory_creds(memcredp);
 870         if (!NT_STATUS_IS_OK(status)) {
 871                 return status;
 872         }
 873         return store_memory_creds(memcredp, pass);
 874 }
 875
 876 /*************************************************************
 877  Store credentials in memory in a list.
 878 *************************************************************/
 879
 880 static NTSTATUS winbindd_add_memory_creds_internal(const char *username,
 881                                                    uid_t uid,
 882                                                    const char *pass)
 883 {
 884         /* Shortcut to ensure we don't store if no mlock. */
 885 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
 886         return NT_STATUS_OK;
 887 #else
 888         NTSTATUS status;
 889         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
 890
 891         memcredp = find_memory_creds_by_name(username);
 892         if (uid == (uid_t)-1) {
 893                 DEBUG(0,("winbindd_add_memory_creds_internal: "
 894                         "invalid uid for user %s.\n", username));
 895                 return NT_STATUS_INVALID_PARAMETER;
 896         }
 897
 898         if (memcredp) {
 899                 /* Already exists. Increment the reference count and replace stored creds. */
 900                 if (uid != memcredp->uid) {
 901                         DEBUG(0,("winbindd_add_memory_creds_internal: "
 902                                 "uid %u for user %s doesn't "
 903                                 "match stored uid %u. Replacing.\n",
 904                                 (unsigned int)uid, username,
 905                                 (unsigned int)memcredp->uid));
 906                         memcredp->uid = uid;
 907                 }
 908                 memcredp->ref_count++;
 909                 DEBUG(10,("winbindd_add_memory_creds_internal: "
 910                         "ref count for user %s is now %d\n",
 911                         username, memcredp->ref_count));
 912                 return winbindd_replace_memory_creds_internal(memcredp, pass);
 913         }
 914
 915         memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
 916         if (!memcredp) {
 917                 return NT_STATUS_NO_MEMORY;
 918         }
 919         memcredp->username = talloc_strdup(memcredp, username);
 920         if (!memcredp->username) {
 921                 talloc_destroy(memcredp);
 922                 return NT_STATUS_NO_MEMORY;
 923         }
 924
 925         status = store_memory_creds(memcredp, pass);
 926         if (!NT_STATUS_IS_OK(status)) {
 927                 talloc_destroy(memcredp);
 928                 return status;
 929         }
 930
 931         memcredp->uid = uid;
 932         memcredp->ref_count = 1;
 933         DLIST_ADD(memory_creds_list, memcredp);
 934
 935         DEBUG(10,("winbindd_add_memory_creds_internal: "
 936                 "added entry for user %s\n", username));
 937
 938         return NT_STATUS_OK;
 939 #endif
 940 }
 941
 942 /*************************************************************
 943  Store users credentials in memory. If we also have a
 944  struct WINBINDD_CCACHE_ENTRY for this username with a
 945  refresh timer, then store the plaintext of the password
 946  and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
 947 *************************************************************/
 948
 949 NTSTATUS winbindd_add_memory_creds(const char *username,
 950                                    uid_t uid,
 951                                    const char *pass)
 952 {
 953         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 954         NTSTATUS status;
 955
 956         status = winbindd_add_memory_creds_internal(username, uid, pass);
 957         if (!NT_STATUS_IS_OK(status)) {
 958                 return status;
 959         }
 960
 961         if (entry) {
 962                 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
 963                 memcredp = find_memory_creds_by_name(username);
 964                 if (memcredp) {
 965                         entry->cred_ptr = memcredp;
 966                 }
 967         }
 968
 969         return status;
 970 }
 971
 972 /*************************************************************
 973  Decrement the in-memory ref count - delete if zero.
 974 *************************************************************/
 975
 976 NTSTATUS winbindd_delete_memory_creds(const char *username)
 977 {
 978         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
 979         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
 980         NTSTATUS status = NT_STATUS_OK;
 981
 982         memcredp = find_memory_creds_by_name(username);
 983         entry = get_ccache_by_username(username);
 984
 985         if (!memcredp) {
 986                 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
 987                         username));
 988                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 989         }
 990
 991         if (memcredp->ref_count <= 0) {
 992                 DEBUG(0,("winbindd_delete_memory_creds: logic error. "
 993                         "ref count for user %s = %d\n",
 994                         username, memcredp->ref_count));
 995                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 996         }
 997
 998         memcredp->ref_count--;
 999         if (memcredp->ref_count <= 0) {
1000                 delete_memory_creds(memcredp);
1001                 DLIST_REMOVE(memory_creds_list, memcredp);
1002                 talloc_destroy(memcredp);
1003                 DEBUG(10,("winbindd_delete_memory_creds: "
1004                         "deleted entry for user %s\n",
1005                         username));
1006         } else {
1007                 DEBUG(10,("winbindd_delete_memory_creds: "
1008                         "entry for user %s ref_count now %d\n",
1009                         username, memcredp->ref_count));
1010         }
1011
1012         if (entry) {
1013                 /* Ensure we have no dangling references to this. */
1014                 entry->cred_ptr = NULL;
1015         }
1016
1017         return status;
1018 }
1019
1020 /***********************************************************
1021  Replace the required creds with new ones (password change).
1022 ***********************************************************/
1023
1024 NTSTATUS winbindd_replace_memory_creds(const char *username,
1025                                        const char *pass)
1026 {
1027         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
1028
1029         memcredp = find_memory_creds_by_name(username);
1030         if (!memcredp) {
1031                 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
1032                         username));
1033                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1034         }
1035
1036         DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
1037                 username));
1038
1039         return winbindd_replace_memory_creds_internal(memcredp, pass);
1040 }