2 Unix SMB/CIFS implementation.
4 Winbind daemon - krb5 credential cache functions
5 and in-memory cache functions.
7 Copyright (C) Guenther Deschner 2005-2006
8 Copyright (C) Jeremy Allison 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define DBGC_CLASS DBGC_WINBIND
30 /* uncomment this to to fast debugging on the krb5 ticket renewal event */
31 #ifdef DEBUG_KRB5_TKT_RENEWAL
32 #undef DEBUG_KRB5_TKT_RENEWAL
35 #define MAX_CCACHES 100
37 static struct WINBINDD_CCACHE_ENTRY
*ccache_list
;
39 /* The Krb5 ticket refresh handler should be scheduled
40 at one-half of the period from now till the tkt
42 #define KRB5_EVENT_REFRESH_TIME(x) ((x) - (((x) - time(NULL))/2))
44 /****************************************************************
45 Find an entry by name.
46 ****************************************************************/
48 static struct WINBINDD_CCACHE_ENTRY
*get_ccache_by_username(const char *username
)
50 struct WINBINDD_CCACHE_ENTRY
*entry
;
52 for (entry
= ccache_list
; entry
; entry
= entry
->next
) {
53 if (strequal(entry
->username
, username
)) {
60 /****************************************************************
62 ****************************************************************/
64 static int ccache_entry_count(void)
66 struct WINBINDD_CCACHE_ENTRY
*entry
;
69 for (entry
= ccache_list
; entry
; entry
= entry
->next
) {
75 /****************************************************************
76 Do the work of refreshing the ticket.
77 ****************************************************************/
79 static void krb5_ticket_refresh_handler(struct event_context
*event_ctx
,
80 struct timed_event
*te
,
81 const struct timeval
*now
,
84 struct WINBINDD_CCACHE_ENTRY
*entry
=
85 talloc_get_type_abort(private_data
, struct WINBINDD_CCACHE_ENTRY
);
89 struct WINBINDD_MEMORY_CREDS
*cred_ptr
= entry
->cred_ptr
;
92 DEBUG(10,("krb5_ticket_refresh_handler called\n"));
93 DEBUGADD(10,("event called for: %s, %s\n", entry
->ccname
, entry
->username
));
95 TALLOC_FREE(entry
->event
);
99 /* Kinit again if we have the user password and we can't renew the old
102 if ((entry
->renew_until
< time(NULL
)) && cred_ptr
&& cred_ptr
->pass
) {
104 set_effective_uid(entry
->uid
);
106 ret
= kerberos_kinit_password_ext(entry
->principal_name
,
108 0, /* hm, can we do time correction here ? */
109 &entry
->refresh_time
,
112 False
, /* no PAC required anymore */
114 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
116 gain_root_privilege();
119 DEBUG(3,("krb5_ticket_refresh_handler: could not re-kinit: %s\n",
120 error_message(ret
)));
121 TALLOC_FREE(entry
->event
);
125 DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
126 "for: %s in ccache: %s\n",
127 entry
->principal_name
, entry
->ccname
));
129 #if defined(DEBUG_KRB5_TKT_RENEWAL)
130 new_start
= time(NULL
) + 30;
132 /* The tkt should be refreshed at one-half the period
133 from now to the expiration time */
134 new_start
= KRB5_EVENT_REFRESH_TIME(entry
->refresh_time
);
140 set_effective_uid(entry
->uid
);
142 ret
= smb_krb5_renew_ticket(entry
->ccname
,
143 entry
->principal_name
,
146 #if defined(DEBUG_KRB5_TKT_RENEWAL)
147 new_start
= time(NULL
) + 30;
149 new_start
= KRB5_EVENT_REFRESH_TIME(new_start
);
152 gain_root_privilege();
155 DEBUG(3,("krb5_ticket_refresh_handler: could not renew tickets: %s\n",
156 error_message(ret
)));
157 /* maybe we are beyond the renewing window */
159 /* avoid breaking the renewal chain: retry in lp_winbind_cache_time()
160 * seconds when the KDC was not available right now. */
162 if (ret
== KRB5_KDC_UNREACH
) {
163 new_start
= time(NULL
) + MAX(30, lp_winbind_cache_time());
172 entry
->event
= event_add_timed(winbind_event_context(), entry
,
173 timeval_set(new_start
, 0),
174 "krb5_ticket_refresh_handler",
175 krb5_ticket_refresh_handler
,
181 /****************************************************************
182 Do the work of regaining a ticket when coming from offline auth.
183 ****************************************************************/
185 static void krb5_ticket_gain_handler(struct event_context
*event_ctx
,
186 struct timed_event
*te
,
187 const struct timeval
*now
,
190 struct WINBINDD_CCACHE_ENTRY
*entry
=
191 talloc_get_type_abort(private_data
, struct WINBINDD_CCACHE_ENTRY
);
195 struct WINBINDD_MEMORY_CREDS
*cred_ptr
= entry
->cred_ptr
;
196 struct winbindd_domain
*domain
= NULL
;
199 DEBUG(10,("krb5_ticket_gain_handler called\n"));
200 DEBUGADD(10,("event called for: %s, %s\n", entry
->ccname
, entry
->username
));
202 TALLOC_FREE(entry
->event
);
206 if (!cred_ptr
|| !cred_ptr
->pass
) {
207 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
211 if ((domain
= find_domain_from_name(entry
->realm
)) == NULL
) {
212 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
216 if (domain
->online
) {
218 set_effective_uid(entry
->uid
);
220 ret
= kerberos_kinit_password_ext(entry
->principal_name
,
222 0, /* hm, can we do time correction here ? */
223 &entry
->refresh_time
,
226 False
, /* no PAC required anymore */
228 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
230 gain_root_privilege();
233 DEBUG(3,("krb5_ticket_gain_handler: could not kinit: %s\n",
234 error_message(ret
)));
238 DEBUG(10,("krb5_ticket_gain_handler: successful kinit for: %s in ccache: %s\n",
239 entry
->principal_name
, entry
->ccname
));
246 entry
->event
= event_add_timed(winbind_event_context(), entry
,
247 timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0),
248 "krb5_ticket_gain_handler",
249 krb5_ticket_gain_handler
,
256 #if defined(DEBUG_KRB5_TKT_RENEWAL)
257 t
= timeval_set(time(NULL
) + 30, 0);
259 t
= timeval_set(KRB5_EVENT_REFRESH_TIME(entry
->refresh_time
), 0);
262 entry
->event
= event_add_timed(winbind_event_context(), entry
,
264 "krb5_ticket_refresh_handler",
265 krb5_ticket_refresh_handler
,
272 /****************************************************************
273 Check if an ccache entry exists.
274 ****************************************************************/
276 BOOL
ccache_entry_exists(const char *username
)
278 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
279 return (entry
!= NULL
);
282 /****************************************************************
283 Ensure we're changing the correct entry.
284 ****************************************************************/
286 BOOL
ccache_entry_identical(const char *username
, uid_t uid
, const char *ccname
)
288 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
294 if (entry
->uid
!= uid
) {
295 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
296 (unsigned int)entry
->uid
, (unsigned int)uid
));
299 if (!strcsequal(entry
->ccname
, ccname
)) {
300 DEBUG(0,("cache_entry_identical: ccnames differ: (cache) %s != (client) %s\n",
301 entry
->ccname
, ccname
));
307 NTSTATUS
add_ccache_to_list(const char *princ_name
,
310 const char *username
,
316 BOOL postponed_request
)
318 struct WINBINDD_CCACHE_ENTRY
*entry
= NULL
;
320 if ((username
== NULL
&& princ_name
== NULL
) || ccname
== NULL
|| uid
< 0) {
321 return NT_STATUS_INVALID_PARAMETER
;
324 if (ccache_entry_count() + 1 > MAX_CCACHES
) {
325 DEBUG(10,("add_ccache_to_list: max number of ccaches reached\n"));
326 return NT_STATUS_NO_MORE_ENTRIES
;
329 /* Reference count old entries */
330 entry
= get_ccache_by_username(username
);
332 /* Check cached entries are identical. */
333 if (!ccache_entry_identical(username
, uid
, ccname
)) {
334 return NT_STATUS_INVALID_PARAMETER
;
337 DEBUG(10,("add_ccache_to_list: ref count on entry %s is now %d\n",
338 username
, entry
->ref_count
));
339 /* FIXME: in this case we still might want to have a krb5 cred
340 * event handler created - gd*/
344 entry
= TALLOC_P(NULL
, struct WINBINDD_CCACHE_ENTRY
);
346 return NT_STATUS_NO_MEMORY
;
352 entry
->username
= talloc_strdup(entry
, username
);
353 if (!entry
->username
) {
358 entry
->principal_name
= talloc_strdup(entry
, princ_name
);
359 if (!entry
->principal_name
) {
364 entry
->service
= talloc_strdup(entry
, service
);
365 if (!entry
->service
) {
370 entry
->ccname
= talloc_strdup(entry
, ccname
);
371 if (!entry
->ccname
) {
375 entry
->realm
= talloc_strdup(entry
, realm
);
380 entry
->create_time
= create_time
;
381 entry
->renew_until
= renew_until
;
383 entry
->ref_count
= 1;
385 if (lp_winbind_refresh_tickets() && renew_until
> 0) {
386 if (postponed_request
) {
387 entry
->event
= event_add_timed(winbind_event_context(), entry
,
388 timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0),
389 "krb5_ticket_gain_handler",
390 krb5_ticket_gain_handler
,
393 /* Renew at 1/2 the ticket expiration time */
394 entry
->event
= event_add_timed(winbind_event_context(), entry
,
395 #if defined(DEBUG_KRB5_TKT_RENEWAL)
396 timeval_set(time(NULL
)+30, 0),
398 timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end
), 0),
400 "krb5_ticket_refresh_handler",
401 krb5_ticket_refresh_handler
,
409 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
412 DLIST_ADD(ccache_list
, entry
);
414 DEBUG(10,("add_ccache_to_list: added ccache [%s] for user [%s] to the list\n", ccname
, username
));
421 return NT_STATUS_NO_MEMORY
;
424 /*******************************************************************
425 Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer referenced.
426 *******************************************************************/
428 NTSTATUS
remove_ccache(const char *username
)
430 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
437 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
440 if (entry
->ref_count
<= 0) {
441 DEBUG(0,("remove_ccache: logic error. ref count for user %s = %d\n",
442 username
, entry
->ref_count
));
443 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
448 if (entry
->ref_count
> 0) {
449 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
450 username
, entry
->ref_count
));
454 /* no references any more */
456 DLIST_REMOVE(ccache_list
, entry
);
457 TALLOC_FREE(entry
->event
); /* unregisters events */
460 ret
= ads_kdestroy(entry
->ccname
);
462 /* we ignore the error when there has been no credential cache */
463 if (ret
== KRB5_FCC_NOFILE
) {
466 DEBUG(0,("remove_ccache: failed to destroy user krb5 ccache %s with: %s\n",
467 entry
->ccname
, error_message(ret
)));
469 DEBUG(10,("remove_ccache: successfully destroyed krb5 ccache %s for user %s\n",
470 entry
->ccname
, username
));
472 status
= krb5_to_nt_status(ret
);
476 DEBUG(10,("remove_ccache: removed ccache for user %s\n", username
));
481 /*******************************************************************
482 In memory credentials cache code.
483 *******************************************************************/
485 static struct WINBINDD_MEMORY_CREDS
*memory_creds_list
;
487 /***********************************************************
488 Find an entry on the list by name.
489 ***********************************************************/
491 struct WINBINDD_MEMORY_CREDS
*find_memory_creds_by_name(const char *username
)
493 struct WINBINDD_MEMORY_CREDS
*p
;
495 for (p
= memory_creds_list
; p
; p
= p
->next
) {
496 if (strequal(p
->username
, username
)) {
503 /***********************************************************
504 Store the required creds and mlock them.
505 ***********************************************************/
507 static NTSTATUS
store_memory_creds(struct WINBINDD_MEMORY_CREDS
*memcredp
, const char *pass
)
509 #if !defined(HAVE_MLOCK)
512 /* new_entry->nt_hash is the base pointer for the block
513 of memory pointed into by new_entry->lm_hash and
514 new_entry->pass (if we're storing plaintext). */
516 memcredp
->len
= NT_HASH_LEN
+ LM_HASH_LEN
;
518 memcredp
->len
+= strlen(pass
)+1;
523 /* aligning the memory on on x86_64 and compiling
524 with gcc 4.1 using -O2 causes a segv in the
525 next memset() --jerry */
526 memcredp
->nt_hash
= SMB_MALLOC_ARRAY(unsigned char, memcredp
->len
);
528 /* On non-linux platforms, mlock()'d memory must be aligned */
529 memcredp
->nt_hash
= SMB_MEMALIGN_ARRAY(unsigned char,
530 getpagesize(), memcredp
->len
);
532 if (!memcredp
->nt_hash
) {
533 return NT_STATUS_NO_MEMORY
;
535 memset( memcredp
->nt_hash
, 0x0, memcredp
->len
);
537 memcredp
->lm_hash
= memcredp
->nt_hash
+ NT_HASH_LEN
;
539 #ifdef DEBUG_PASSWORD
540 DEBUG(10,("mlocking memory: %p\n", memcredp
->nt_hash
));
542 if ((mlock(memcredp
->nt_hash
, memcredp
->len
)) == -1) {
543 DEBUG(0,("failed to mlock memory: %s (%d)\n",
544 strerror(errno
), errno
));
545 SAFE_FREE(memcredp
->nt_hash
);
546 return map_nt_error_from_unix(errno
);
549 #ifdef DEBUG_PASSWORD
550 DEBUG(10,("mlocked memory: %p\n", memcredp
->nt_hash
));
553 /* Create and store the password hashes. */
554 E_md4hash(pass
, memcredp
->nt_hash
);
555 E_deshash(pass
, memcredp
->lm_hash
);
558 memcredp
->pass
= (char *)memcredp
->lm_hash
+ LM_HASH_LEN
;
559 memcpy(memcredp
->pass
, pass
, memcredp
->len
- NT_HASH_LEN
- LM_HASH_LEN
);
566 /***********************************************************
567 Destroy existing creds.
568 ***********************************************************/
570 static NTSTATUS
delete_memory_creds(struct WINBINDD_MEMORY_CREDS
*memcredp
)
572 #if !defined(HAVE_MUNLOCK)
575 if (munlock(memcredp
->nt_hash
, memcredp
->len
) == -1) {
576 DEBUG(0,("failed to munlock memory: %s (%d)\n",
577 strerror(errno
), errno
));
578 return map_nt_error_from_unix(errno
);
580 memset(memcredp
->nt_hash
, '\0', memcredp
->len
);
581 SAFE_FREE(memcredp
->nt_hash
);
582 memcredp
->nt_hash
= NULL
;
583 memcredp
->lm_hash
= NULL
;
584 memcredp
->pass
= NULL
;
590 /***********************************************************
591 Replace the required creds with new ones (password change).
592 ***********************************************************/
594 static NTSTATUS
winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS
*memcredp
,
597 NTSTATUS status
= delete_memory_creds(memcredp
);
598 if (!NT_STATUS_IS_OK(status
)) {
601 return store_memory_creds(memcredp
, pass
);
604 /*************************************************************
605 Store credentials in memory in a list.
606 *************************************************************/
608 static NTSTATUS
winbindd_add_memory_creds_internal(const char *username
, uid_t uid
, const char *pass
)
610 /* Shortcut to ensure we don't store if no mlock. */
611 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
615 struct WINBINDD_MEMORY_CREDS
*memcredp
= find_memory_creds_by_name(username
);
617 if (uid
== (uid_t
)-1) {
618 DEBUG(0,("winbindd_add_memory_creds_internal: invalid uid for user %s.\n",
620 return NT_STATUS_INVALID_PARAMETER
;
624 /* Already exists. Increment the reference count and replace stored creds. */
625 if (uid
!= memcredp
->uid
) {
626 DEBUG(0,("winbindd_add_memory_creds_internal: uid %u for user %s doesn't "
627 "match stored uid %u. Replacing.\n",
628 (unsigned int)uid
, username
, (unsigned int)memcredp
->uid
));
631 memcredp
->ref_count
++;
632 DEBUG(10,("winbindd_add_memory_creds_internal: ref count for user %s is now %d\n",
633 username
, memcredp
->ref_count
));
634 return winbindd_replace_memory_creds_internal(memcredp
, pass
);
637 memcredp
= TALLOC_ZERO_P(NULL
, struct WINBINDD_MEMORY_CREDS
);
639 return NT_STATUS_NO_MEMORY
;
641 memcredp
->username
= talloc_strdup(memcredp
, username
);
642 if (!memcredp
->username
) {
643 talloc_destroy(memcredp
);
644 return NT_STATUS_NO_MEMORY
;
647 status
= store_memory_creds(memcredp
, pass
);
648 if (!NT_STATUS_IS_OK(status
)) {
649 talloc_destroy(memcredp
);
654 memcredp
->ref_count
= 1;
655 DLIST_ADD(memory_creds_list
, memcredp
);
657 DEBUG(10,("winbindd_add_memory_creds_internal: added entry for user %s\n",
664 /*************************************************************
665 Store users credentials in memory. If we also have a
666 struct WINBINDD_CCACHE_ENTRY for this username with a
667 refresh timer, then store the plaintext of the password
668 and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
669 *************************************************************/
671 NTSTATUS
winbindd_add_memory_creds(const char *username
, uid_t uid
, const char *pass
)
673 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
676 status
= winbindd_add_memory_creds_internal(username
, uid
, pass
);
677 if (!NT_STATUS_IS_OK(status
)) {
682 struct WINBINDD_MEMORY_CREDS
*memcredp
= find_memory_creds_by_name(username
);
684 entry
->cred_ptr
= memcredp
;
691 /*************************************************************
692 Decrement the in-memory ref count - delete if zero.
693 *************************************************************/
695 NTSTATUS
winbindd_delete_memory_creds(const char *username
)
697 struct WINBINDD_MEMORY_CREDS
*memcredp
= find_memory_creds_by_name(username
);
698 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
699 NTSTATUS status
= NT_STATUS_OK
;
702 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
704 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
707 if (memcredp
->ref_count
<= 0) {
708 DEBUG(0,("winbindd_delete_memory_creds: logic error. ref count for user %s = %d\n",
709 username
, memcredp
->ref_count
));
710 status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
713 memcredp
->ref_count
--;
714 if (memcredp
->ref_count
<= 0) {
715 delete_memory_creds(memcredp
);
716 DLIST_REMOVE(memory_creds_list
, memcredp
);
717 talloc_destroy(memcredp
);
718 DEBUG(10,("winbindd_delete_memory_creds: deleted entry for user %s\n",
721 DEBUG(10,("winbindd_delete_memory_creds: entry for user %s ref_count now %d\n",
722 username
, memcredp
->ref_count
));
726 entry
->cred_ptr
= NULL
; /* Ensure we have no dangling references to this. */
731 /***********************************************************
732 Replace the required creds with new ones (password change).
733 ***********************************************************/
735 NTSTATUS
winbindd_replace_memory_creds(const char *username
, const char *pass
)
737 struct WINBINDD_MEMORY_CREDS
*memcredp
= find_memory_creds_by_name(username
);
740 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
742 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
745 DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
748 return winbindd_replace_memory_creds_internal(memcredp
, pass
);