source3/winbindd/winbindd_cred_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - krb5 credential cache functions
   5    and in-memory cache functions.
   6
   7    Copyright (C) Guenther Deschner 2005-2006
   8    Copyright (C) Jeremy Allison 2006
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26 #include "../libcli/auth/libcli_auth.h"
  27 #include "smb_krb5.h"
  28 #include "libads/kerberos_proto.h"
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_WINBIND
  32
  33 /* uncomment this to do fast debugging on the krb5 ticket renewal event */
  34 #ifdef DEBUG_KRB5_TKT_RENEWAL
  35 #undef DEBUG_KRB5_TKT_RENEWAL
  36 #endif
  37
  38 #define MAX_CCACHES 100
  39
  40 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
  41 static void krb5_ticket_gain_handler(struct event_context *,
  42                                      struct timed_event *,
  43                                      struct timeval,
  44                                      void *);
  45 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *,
  46                                      struct timeval);
  47
  48 /* The Krb5 ticket refresh handler should be scheduled
  49    at one-half of the period from now till the tkt
  50    expiration */
  51
  52 static time_t krb5_event_refresh_time(time_t end_time)
  53 {
  54         time_t rest = end_time - time(NULL);
  55         return end_time - rest/2;
  56 }
  57
  58 /****************************************************************
  59  Find an entry by name.
  60 ****************************************************************/
  61
  62 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
  63 {
  64         struct WINBINDD_CCACHE_ENTRY *entry;
  65
  66         for (entry = ccache_list; entry; entry = entry->next) {
  67                 if (strequal(entry->username, username)) {
  68                         return entry;
  69                 }
  70         }
  71         return NULL;
  72 }
  73
  74 /****************************************************************
  75  How many do we have ?
  76 ****************************************************************/
  77
  78 static int ccache_entry_count(void)
  79 {
  80         struct WINBINDD_CCACHE_ENTRY *entry;
  81         int i = 0;
  82
  83         for (entry = ccache_list; entry; entry = entry->next) {
  84                 i++;
  85         }
  86         return i;
  87 }
  88
  89 void ccache_remove_all_after_fork(void)
  90 {
  91         struct WINBINDD_CCACHE_ENTRY *cur, *next;
  92
  93         for (cur = ccache_list; cur; cur = next) {
  94                 next = cur->next;
  95                 DLIST_REMOVE(ccache_list, cur);
  96                 TALLOC_FREE(cur->event);
  97                 TALLOC_FREE(cur);
  98         }
  99
 100         return;
 101 }
 102
 103 /****************************************************************
 104  Do the work of refreshing the ticket.
 105 ****************************************************************/
 106
 107 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
 108                                         struct timed_event *te,
 109                                         struct timeval now,
 110                                         void *private_data)
 111 {
 112         struct WINBINDD_CCACHE_ENTRY *entry =
 113                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 114 #ifdef HAVE_KRB5
 115         int ret;
 116         time_t new_start;
 117         time_t expire_time = 0;
 118         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 119 #endif
 120
 121         DEBUG(10,("krb5_ticket_refresh_handler called\n"));
 122         DEBUGADD(10,("event called for: %s, %s\n",
 123                 entry->ccname, entry->username));
 124
 125         TALLOC_FREE(entry->event);
 126
 127 #ifdef HAVE_KRB5
 128
 129         /* Kinit again if we have the user password and we can't renew the old
 130          * tgt anymore
 131          * NB
 132          * This happens when machine are put to sleep for a very long time. */
 133
 134         if (entry->renew_until < time(NULL)) {
 135 rekinit:
 136                 if (cred_ptr && cred_ptr->pass) {
 137
 138                         set_effective_uid(entry->uid);
 139
 140                         ret = kerberos_kinit_password_ext(entry->principal_name,
 141                                                           cred_ptr->pass,
 142                                                           0, /* hm, can we do time correction here ? */
 143                                                           &entry->refresh_time,
 144                                                           &entry->renew_until,
 145                                                           entry->ccname,
 146                                                           False, /* no PAC required anymore */
 147                                                           True,
 148                                                           WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 149                                                           NULL);
 150                         gain_root_privilege();
 151
 152                         if (ret) {
 153                                 DEBUG(3,("krb5_ticket_refresh_handler: "
 154                                         "could not re-kinit: %s\n",
 155                                         error_message(ret)));
 156                                 /* destroy the ticket because we cannot rekinit
 157                                  * it, ignore error here */
 158                                 ads_kdestroy(entry->ccname);
 159
 160                                 /* Don't break the ticket refresh chain: retry
 161                                  * refreshing ticket sometime later when KDC is
 162                                  * unreachable -- BoYang. More error code handling
 163                                  * here?
 164                                  * */
 165
 166                                 if ((ret == KRB5_KDC_UNREACH)
 167                                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
 168 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 169                                         new_start = time(NULL) + 30;
 170 #else
 171                                         new_start = time(NULL) +
 172                                                     MAX(30, lp_winbind_cache_time());
 173 #endif
 174                                         add_krb5_ticket_gain_handler_event(entry,
 175                                                         timeval_set(new_start, 0));
 176                                         return;
 177                                 }
 178                                 TALLOC_FREE(entry->event);
 179                                 return;
 180                         }
 181
 182                         DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
 183                                 "for: %s in ccache: %s\n",
 184                                 entry->principal_name, entry->ccname));
 185
 186 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 187                         new_start = time(NULL) + 30;
 188 #else
 189                         /* The tkt should be refreshed at one-half the period
 190                            from now to the expiration time */
 191                         expire_time = entry->refresh_time;
 192                         new_start = krb5_event_refresh_time(entry->refresh_time);
 193 #endif
 194                         goto done;
 195                 } else {
 196                                 /* can this happen?
 197                                  * No cached credentials
 198                                  * destroy ticket and refresh chain
 199                                  * */
 200                                 ads_kdestroy(entry->ccname);
 201                                 TALLOC_FREE(entry->event);
 202                                 return;
 203                 }
 204         }
 205
 206         set_effective_uid(entry->uid);
 207
 208         ret = smb_krb5_renew_ticket(entry->ccname,
 209                                     entry->principal_name,
 210                                     entry->service,
 211                                     &new_start);
 212 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 213         new_start = time(NULL) + 30;
 214 #else
 215         expire_time = new_start;
 216         new_start = krb5_event_refresh_time(new_start);
 217 #endif
 218
 219         gain_root_privilege();
 220
 221         if (ret) {
 222                 DEBUG(3,("krb5_ticket_refresh_handler: "
 223                         "could not renew tickets: %s\n",
 224                         error_message(ret)));
 225                 /* maybe we are beyond the renewing window */
 226
 227                 /* evil rises here, we refresh ticket failed,
 228                  * but the ticket might be expired. Therefore,
 229                  * When we refresh ticket failed, destory the
 230                  * ticket */
 231
 232                 ads_kdestroy(entry->ccname);
 233
 234                 /* avoid breaking the renewal chain: retry in
 235                  * lp_winbind_cache_time() seconds when the KDC was not
 236                  * available right now.
 237                  * the return code can be KRB5_REALM_CANT_RESOLVE.
 238                  * More error code handling here? */
 239
 240                 if ((ret == KRB5_KDC_UNREACH)
 241                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
 242 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 243                         new_start = time(NULL) + 30;
 244 #else
 245                         new_start = time(NULL) +
 246                                     MAX(30, lp_winbind_cache_time());
 247 #endif
 248                         /* ticket is destroyed here, we have to regain it
 249                          * if it is possible */
 250                         add_krb5_ticket_gain_handler_event(entry,
 251                                                 timeval_set(new_start, 0));
 252                         return;
 253                 }
 254
 255                 /* This is evil, if the ticket was already expired.
 256                  * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
 257                  * But there is still a chance that we can rekinit it.
 258                  *
 259                  * This happens when user login in online mode, and then network
 260                  * down or something cause winbind goes offline for a very long time,
 261                  * and then goes online again. ticket expired, renew failed.
 262                  * This happens when machine are put to sleep for a long time,
 263                  * but shorter than entry->renew_util.
 264                  * NB
 265                  * Looks like the KDC is reachable, we want to rekinit as soon as
 266                  * possible instead of waiting some time later. */
 267                 if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
 268                     || (ret == KRB5_FCC_NOFILE)) goto rekinit;
 269
 270                 return;
 271         }
 272
 273 done:
 274         /* in cases that ticket will be unrenewable soon, we don't try to renew ticket
 275          * but try to regain ticket if it is possible */
 276         if (entry->renew_until && expire_time
 277              && (entry->renew_until <= expire_time)) {
 278                 /* try to regain ticket 10 seconds before expiration */
 279                 expire_time -= 10;
 280                 add_krb5_ticket_gain_handler_event(entry,
 281                                         timeval_set(expire_time, 0));
 282                 return;
 283         }
 284
 285         if (entry->refresh_time == 0) {
 286                 entry->refresh_time = new_start;
 287         }
 288         entry->event = event_add_timed(winbind_event_context(), entry,
 289                                        timeval_set(new_start, 0),
 290                                        krb5_ticket_refresh_handler,
 291                                        entry);
 292
 293 #endif
 294 }
 295
 296 /****************************************************************
 297  Do the work of regaining a ticket when coming from offline auth.
 298 ****************************************************************/
 299
 300 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
 301                                      struct timed_event *te,
 302                                      struct timeval now,
 303                                      void *private_data)
 304 {
 305         struct WINBINDD_CCACHE_ENTRY *entry =
 306                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 307 #ifdef HAVE_KRB5
 308         int ret;
 309         struct timeval t;
 310         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 311         struct winbindd_domain *domain = NULL;
 312 #endif
 313
 314         DEBUG(10,("krb5_ticket_gain_handler called\n"));
 315         DEBUGADD(10,("event called for: %s, %s\n",
 316                 entry->ccname, entry->username));
 317
 318         TALLOC_FREE(entry->event);
 319
 320 #ifdef HAVE_KRB5
 321
 322         if (!cred_ptr || !cred_ptr->pass) {
 323                 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
 324                 return;
 325         }
 326
 327         if ((domain = find_domain_from_name(entry->realm)) == NULL) {
 328                 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
 329                 return;
 330         }
 331
 332         if (!domain->online) {
 333                 goto retry_later;
 334         }
 335
 336         set_effective_uid(entry->uid);
 337
 338         ret = kerberos_kinit_password_ext(entry->principal_name,
 339                                           cred_ptr->pass,
 340                                           0, /* hm, can we do time correction here ? */
 341                                           &entry->refresh_time,
 342                                           &entry->renew_until,
 343                                           entry->ccname,
 344                                           False, /* no PAC required anymore */
 345                                           True,
 346                                           WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 347                                           NULL);
 348         gain_root_privilege();
 349
 350         if (ret) {
 351                 DEBUG(3,("krb5_ticket_gain_handler: "
 352                         "could not kinit: %s\n",
 353                         error_message(ret)));
 354                 /* evil. If we cannot do it, destroy any the __maybe__
 355                  * __existing__ ticket */
 356                 ads_kdestroy(entry->ccname);
 357                 goto retry_later;
 358         }
 359
 360         DEBUG(10,("krb5_ticket_gain_handler: "
 361                 "successful kinit for: %s in ccache: %s\n",
 362                 entry->principal_name, entry->ccname));
 363
 364         goto got_ticket;
 365
 366   retry_later:
 367
 368 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 369         t = timeval_set(time(NULL) + 30, 0);
 370 #else
 371         t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 372 #endif
 373
 374         add_krb5_ticket_gain_handler_event(entry, t);
 375         return;
 376
 377   got_ticket:
 378
 379 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 380         t = timeval_set(time(NULL) + 30, 0);
 381 #else
 382         t = timeval_set(krb5_event_refresh_time(entry->refresh_time), 0);
 383 #endif
 384
 385         if (entry->refresh_time == 0) {
 386                 entry->refresh_time = t.tv_sec;
 387         }
 388         entry->event = event_add_timed(winbind_event_context(),
 389                                        entry,
 390                                        t,
 391                                        krb5_ticket_refresh_handler,
 392                                        entry);
 393
 394         return;
 395 #endif
 396 }
 397
 398 /**************************************************************
 399  The gain initial ticket case is recognised as entry->refresh_time
 400  is always zero.
 401 **************************************************************/
 402
 403 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
 404                                      struct timeval t)
 405 {
 406         entry->refresh_time = 0;
 407         entry->event = event_add_timed(winbind_event_context(),
 408                                        entry,
 409                                        t,
 410                                        krb5_ticket_gain_handler,
 411                                        entry);
 412 }
 413
 414 void ccache_regain_all_now(void)
 415 {
 416         struct WINBINDD_CCACHE_ENTRY *cur;
 417         struct timeval t = timeval_current();
 418
 419         for (cur = ccache_list; cur; cur = cur->next) {
 420                 struct timed_event *new_event;
 421
 422                 /*
 423                  * if refresh_time is 0, we know that the
 424                  * the event has the krb5_ticket_gain_handler
 425                  */
 426                 if (cur->refresh_time == 0) {
 427                         new_event = event_add_timed(winbind_event_context(),
 428                                                     cur,
 429                                                     t,
 430                                                     krb5_ticket_gain_handler,
 431                                                     cur);
 432                 } else {
 433                         new_event = event_add_timed(winbind_event_context(),
 434                                                     cur,
 435                                                     t,
 436                                                     krb5_ticket_refresh_handler,
 437                                                     cur);
 438                 }
 439
 440                 if (!new_event) {
 441                         continue;
 442                 }
 443
 444                 TALLOC_FREE(cur->event);
 445                 cur->event = new_event;
 446         }
 447
 448         return;
 449 }
 450
 451 /****************************************************************
 452  Check if an ccache entry exists.
 453 ****************************************************************/
 454
 455 bool ccache_entry_exists(const char *username)
 456 {
 457         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 458         return (entry != NULL);
 459 }
 460
 461 /****************************************************************
 462  Ensure we're changing the correct entry.
 463 ****************************************************************/
 464
 465 bool ccache_entry_identical(const char *username,
 466                             uid_t uid,
 467                             const char *ccname)
 468 {
 469         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 470
 471         if (!entry) {
 472                 return False;
 473         }
 474
 475         if (entry->uid != uid) {
 476                 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
 477                         (unsigned int)entry->uid, (unsigned int)uid));
 478                 return False;
 479         }
 480         if (!strcsequal(entry->ccname, ccname)) {
 481                 DEBUG(0,("cache_entry_identical: "
 482                         "ccnames differ: (cache) %s != (client) %s\n",
 483                         entry->ccname, ccname));
 484                 return False;
 485         }
 486         return True;
 487 }
 488
 489 NTSTATUS add_ccache_to_list(const char *princ_name,
 490                             const char *ccname,
 491                             const char *service,
 492                             const char *username,
 493                             const char *realm,
 494                             uid_t uid,
 495                             time_t create_time,
 496                             time_t ticket_end,
 497                             time_t renew_until,
 498                             bool postponed_request)
 499 {
 500         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
 501         struct timeval t;
 502         NTSTATUS ntret;
 503 #ifdef HAVE_KRB5
 504         int ret;
 505 #endif
 506
 507         if ((username == NULL && princ_name == NULL) ||
 508             ccname == NULL || uid < 0) {
 509                 return NT_STATUS_INVALID_PARAMETER;
 510         }
 511
 512         if (ccache_entry_count() + 1 > MAX_CCACHES) {
 513                 DEBUG(10,("add_ccache_to_list: "
 514                         "max number of ccaches reached\n"));
 515                 return NT_STATUS_NO_MORE_ENTRIES;
 516         }
 517
 518         /* If it is cached login, destroy krb5 ticket
 519          * to avoid surprise. */
 520 #ifdef HAVE_KRB5
 521         if (postponed_request) {
 522                 /* ignore KRB5_FCC_NOFILE error here */
 523                 ret = ads_kdestroy(ccname);
 524                 if (ret == KRB5_FCC_NOFILE) {
 525                         ret = 0;
 526                 }
 527                 if (ret) {
 528                         DEBUG(0, ("add_ccache_to_list: failed to destroy "
 529                                    "user krb5 ccache %s with %s\n", ccname,
 530                                    error_message(ret)));
 531                         return krb5_to_nt_status(ret);
 532                 }
 533                 DEBUG(10, ("add_ccache_to_list: successfully destroyed "
 534                            "krb5 ccache %s for user %s\n", ccname,
 535                            username));
 536         }
 537 #endif
 538
 539         /* Reference count old entries */
 540         entry = get_ccache_by_username(username);
 541         if (entry) {
 542                 /* Check cached entries are identical. */
 543                 if (!ccache_entry_identical(username, uid, ccname)) {
 544                         return NT_STATUS_INVALID_PARAMETER;
 545                 }
 546                 entry->ref_count++;
 547                 DEBUG(10,("add_ccache_to_list: "
 548                         "ref count on entry %s is now %d\n",
 549                         username, entry->ref_count));
 550                 /* FIXME: in this case we still might want to have a krb5 cred
 551                  * event handler created - gd
 552                  * Add ticket refresh handler here */
 553
 554                 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
 555                         return NT_STATUS_OK;
 556                 }
 557
 558                 if (!entry->event) {
 559                         if (postponed_request) {
 560                                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 561                                 add_krb5_ticket_gain_handler_event(entry, t);
 562                         } else {
 563                                 /* Renew at 1/2 the ticket expiration time */
 564 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 565                                 t = timeval_set(time(NULL)+30, 0);
 566 #else
 567                                 t = timeval_set(krb5_event_refresh_time(ticket_end),
 568                                                 0);
 569 #endif
 570                                 if (!entry->refresh_time) {
 571                                         entry->refresh_time = t.tv_sec;
 572                                 }
 573                                 entry->event = event_add_timed(winbind_event_context(),
 574                                                                entry,
 575                                                                t,
 576                                                                krb5_ticket_refresh_handler,
 577                                                                entry);
 578                         }
 579
 580                         if (!entry->event) {
 581                                 ntret = remove_ccache(username);
 582                                 if (!NT_STATUS_IS_OK(ntret)) {
 583                                         DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
 584                                                   "ccache %s for user %s\n", entry->ccname,
 585                                                   entry->username));
 586                                         DEBUG(0, ("add_ccache_to_list: error is %s\n",
 587                                                   nt_errstr(ntret)));
 588                                         return ntret;
 589                                 }
 590                                 return NT_STATUS_NO_MEMORY;
 591                         }
 592
 593                         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 594                 }
 595
 596                 return NT_STATUS_OK;
 597         }
 598
 599         entry = talloc(NULL, struct WINBINDD_CCACHE_ENTRY);
 600         if (!entry) {
 601                 return NT_STATUS_NO_MEMORY;
 602         }
 603
 604         ZERO_STRUCTP(entry);
 605
 606         if (username) {
 607                 entry->username = talloc_strdup(entry, username);
 608                 if (!entry->username) {
 609                         goto no_mem;
 610                 }
 611         }
 612         if (princ_name) {
 613                 entry->principal_name = talloc_strdup(entry, princ_name);
 614                 if (!entry->principal_name) {
 615                         goto no_mem;
 616                 }
 617         }
 618         if (service) {
 619                 entry->service = talloc_strdup(entry, service);
 620                 if (!entry->service) {
 621                         goto no_mem;
 622                 }
 623         }
 624
 625         entry->ccname = talloc_strdup(entry, ccname);
 626         if (!entry->ccname) {
 627                 goto no_mem;
 628         }
 629
 630         entry->realm = talloc_strdup(entry, realm);
 631         if (!entry->realm) {
 632                 goto no_mem;
 633         }
 634
 635         entry->create_time = create_time;
 636         entry->renew_until = renew_until;
 637         entry->uid = uid;
 638         entry->ref_count = 1;
 639
 640         if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
 641                 goto add_entry;
 642         }
 643
 644         if (postponed_request) {
 645                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
 646                 add_krb5_ticket_gain_handler_event(entry, t);
 647         } else {
 648                 /* Renew at 1/2 the ticket expiration time */
 649 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 650                 t = timeval_set(time(NULL)+30, 0);
 651 #else
 652                 t = timeval_set(krb5_event_refresh_time(ticket_end), 0);
 653 #endif
 654                 if (entry->refresh_time == 0) {
 655                         entry->refresh_time = t.tv_sec;
 656                 }
 657                 entry->event = event_add_timed(winbind_event_context(),
 658                                                entry,
 659                                                t,
 660                                                krb5_ticket_refresh_handler,
 661                                                entry);
 662         }
 663
 664         if (!entry->event) {
 665                 goto no_mem;
 666         }
 667
 668         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 669
 670  add_entry:
 671
 672         DLIST_ADD(ccache_list, entry);
 673
 674         DEBUG(10,("add_ccache_to_list: "
 675                 "added ccache [%s] for user [%s] to the list\n",
 676                 ccname, username));
 677
 678         return NT_STATUS_OK;
 679
 680  no_mem:
 681
 682         TALLOC_FREE(entry);
 683         return NT_STATUS_NO_MEMORY;
 684 }
 685
 686 /*******************************************************************
 687  Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer
 688  referenced.
 689  *******************************************************************/
 690
 691 NTSTATUS remove_ccache(const char *username)
 692 {
 693         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 694         NTSTATUS status = NT_STATUS_OK;
 695 #ifdef HAVE_KRB5
 696         krb5_error_code ret;
 697 #endif
 698
 699         if (!entry) {
 700                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 701         }
 702
 703         if (entry->ref_count <= 0) {
 704                 DEBUG(0,("remove_ccache: logic error. "
 705                         "ref count for user %s = %d\n",
 706                         username, entry->ref_count));
 707                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 708         }
 709
 710         entry->ref_count--;
 711
 712         if (entry->ref_count > 0) {
 713                 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
 714                         username, entry->ref_count));
 715                 return NT_STATUS_OK;
 716         }
 717
 718         /* no references any more */
 719
 720         DLIST_REMOVE(ccache_list, entry);
 721         TALLOC_FREE(entry->event); /* unregisters events */
 722
 723 #ifdef HAVE_KRB5
 724         ret = ads_kdestroy(entry->ccname);
 725
 726         /* we ignore the error when there has been no credential cache */
 727         if (ret == KRB5_FCC_NOFILE) {
 728                 ret = 0;
 729         } else if (ret) {
 730                 DEBUG(0,("remove_ccache: "
 731                         "failed to destroy user krb5 ccache %s with: %s\n",
 732                         entry->ccname, error_message(ret)));
 733         } else {
 734                 DEBUG(10,("remove_ccache: "
 735                         "successfully destroyed krb5 ccache %s for user %s\n",
 736                         entry->ccname, username));
 737         }
 738         status = krb5_to_nt_status(ret);
 739 #endif
 740
 741         TALLOC_FREE(entry);
 742         DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
 743
 744         return status;
 745 }
 746
 747 /*******************************************************************
 748  In memory credentials cache code.
 749 *******************************************************************/
 750
 751 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
 752
 753 /***********************************************************
 754  Find an entry on the list by name.
 755 ***********************************************************/
 756
 757 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
 758 {
 759         struct WINBINDD_MEMORY_CREDS *p;
 760
 761         for (p = memory_creds_list; p; p = p->next) {
 762                 if (strequal(p->username, username)) {
 763                         return p;
 764                 }
 765         }
 766         return NULL;
 767 }
 768
 769 /***********************************************************
 770  Store the required creds and mlock them.
 771 ***********************************************************/
 772
 773 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp,
 774                                    const char *pass)
 775 {
 776 #if !defined(HAVE_MLOCK)
 777         return NT_STATUS_OK;
 778 #else
 779         /* new_entry->nt_hash is the base pointer for the block
 780            of memory pointed into by new_entry->lm_hash and
 781            new_entry->pass (if we're storing plaintext). */
 782
 783         memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
 784         if (pass) {
 785                 memcredp->len += strlen(pass)+1;
 786         }
 787
 788
 789 #if defined(LINUX)
 790         /* aligning the memory on on x86_64 and compiling
 791            with gcc 4.1 using -O2 causes a segv in the
 792            next memset()  --jerry */
 793         memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
 794 #else
 795         /* On non-linux platforms, mlock()'d memory must be aligned */
 796         memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
 797                                                getpagesize(), memcredp->len);
 798 #endif
 799         if (!memcredp->nt_hash) {
 800                 return NT_STATUS_NO_MEMORY;
 801         }
 802         memset(memcredp->nt_hash, 0x0, memcredp->len);
 803
 804         memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
 805
 806 #ifdef DEBUG_PASSWORD
 807         DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
 808 #endif
 809         if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
 810                 DEBUG(0,("failed to mlock memory: %s (%d)\n",
 811                         strerror(errno), errno));
 812                 SAFE_FREE(memcredp->nt_hash);
 813                 return map_nt_error_from_unix(errno);
 814         }
 815
 816 #ifdef DEBUG_PASSWORD
 817         DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
 818 #endif
 819
 820         /* Create and store the password hashes. */
 821         E_md4hash(pass, memcredp->nt_hash);
 822         E_deshash(pass, memcredp->lm_hash);
 823
 824         if (pass) {
 825                 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
 826                 memcpy(memcredp->pass, pass,
 827                        memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
 828         }
 829
 830         return NT_STATUS_OK;
 831 #endif
 832 }
 833
 834 /***********************************************************
 835  Destroy existing creds.
 836 ***********************************************************/
 837
 838 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
 839 {
 840 #if !defined(HAVE_MUNLOCK)
 841         return NT_STATUS_OK;
 842 #else
 843         if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
 844                 DEBUG(0,("failed to munlock memory: %s (%d)\n",
 845                         strerror(errno), errno));
 846                 return map_nt_error_from_unix(errno);
 847         }
 848         memset(memcredp->nt_hash, '\0', memcredp->len);
 849         SAFE_FREE(memcredp->nt_hash);
 850         memcredp->nt_hash = NULL;
 851         memcredp->lm_hash = NULL;
 852         memcredp->pass = NULL;
 853         memcredp->len = 0;
 854         return NT_STATUS_OK;
 855 #endif
 856 }
 857
 858 /***********************************************************
 859  Replace the required creds with new ones (password change).
 860 ***********************************************************/
 861
 862 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
 863                                                        const char *pass)
 864 {
 865         NTSTATUS status = delete_memory_creds(memcredp);
 866         if (!NT_STATUS_IS_OK(status)) {
 867                 return status;
 868         }
 869         return store_memory_creds(memcredp, pass);
 870 }
 871
 872 /*************************************************************
 873  Store credentials in memory in a list.
 874 *************************************************************/
 875
 876 static NTSTATUS winbindd_add_memory_creds_internal(const char *username,
 877                                                    uid_t uid,
 878                                                    const char *pass)
 879 {
 880         /* Shortcut to ensure we don't store if no mlock. */
 881 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
 882         return NT_STATUS_OK;
 883 #else
 884         NTSTATUS status;
 885         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
 886
 887         memcredp = find_memory_creds_by_name(username);
 888         if (uid == (uid_t)-1) {
 889                 DEBUG(0,("winbindd_add_memory_creds_internal: "
 890                         "invalid uid for user %s.\n", username));
 891                 return NT_STATUS_INVALID_PARAMETER;
 892         }
 893
 894         if (memcredp) {
 895                 /* Already exists. Increment the reference count and replace stored creds. */
 896                 if (uid != memcredp->uid) {
 897                         DEBUG(0,("winbindd_add_memory_creds_internal: "
 898                                 "uid %u for user %s doesn't "
 899                                 "match stored uid %u. Replacing.\n",
 900                                 (unsigned int)uid, username,
 901                                 (unsigned int)memcredp->uid));
 902                         memcredp->uid = uid;
 903                 }
 904                 memcredp->ref_count++;
 905                 DEBUG(10,("winbindd_add_memory_creds_internal: "
 906                         "ref count for user %s is now %d\n",
 907                         username, memcredp->ref_count));
 908                 return winbindd_replace_memory_creds_internal(memcredp, pass);
 909         }
 910
 911         memcredp = talloc_zero(NULL, struct WINBINDD_MEMORY_CREDS);
 912         if (!memcredp) {
 913                 return NT_STATUS_NO_MEMORY;
 914         }
 915         memcredp->username = talloc_strdup(memcredp, username);
 916         if (!memcredp->username) {
 917                 talloc_destroy(memcredp);
 918                 return NT_STATUS_NO_MEMORY;
 919         }
 920
 921         status = store_memory_creds(memcredp, pass);
 922         if (!NT_STATUS_IS_OK(status)) {
 923                 talloc_destroy(memcredp);
 924                 return status;
 925         }
 926
 927         memcredp->uid = uid;
 928         memcredp->ref_count = 1;
 929         DLIST_ADD(memory_creds_list, memcredp);
 930
 931         DEBUG(10,("winbindd_add_memory_creds_internal: "
 932                 "added entry for user %s\n", username));
 933
 934         return NT_STATUS_OK;
 935 #endif
 936 }
 937
 938 /*************************************************************
 939  Store users credentials in memory. If we also have a
 940  struct WINBINDD_CCACHE_ENTRY for this username with a
 941  refresh timer, then store the plaintext of the password
 942  and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
 943 *************************************************************/
 944
 945 NTSTATUS winbindd_add_memory_creds(const char *username,
 946                                    uid_t uid,
 947                                    const char *pass)
 948 {
 949         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 950         NTSTATUS status;
 951
 952         status = winbindd_add_memory_creds_internal(username, uid, pass);
 953         if (!NT_STATUS_IS_OK(status)) {
 954                 return status;
 955         }
 956
 957         if (entry) {
 958                 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
 959                 memcredp = find_memory_creds_by_name(username);
 960                 if (memcredp) {
 961                         entry->cred_ptr = memcredp;
 962                 }
 963         }
 964
 965         return status;
 966 }
 967
 968 /*************************************************************
 969  Decrement the in-memory ref count - delete if zero.
 970 *************************************************************/
 971
 972 NTSTATUS winbindd_delete_memory_creds(const char *username)
 973 {
 974         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
 975         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
 976         NTSTATUS status = NT_STATUS_OK;
 977
 978         memcredp = find_memory_creds_by_name(username);
 979         entry = get_ccache_by_username(username);
 980
 981         if (!memcredp) {
 982                 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
 983                         username));
 984                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 985         }
 986
 987         if (memcredp->ref_count <= 0) {
 988                 DEBUG(0,("winbindd_delete_memory_creds: logic error. "
 989                         "ref count for user %s = %d\n",
 990                         username, memcredp->ref_count));
 991                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 992         }
 993
 994         memcredp->ref_count--;
 995         if (memcredp->ref_count <= 0) {
 996                 delete_memory_creds(memcredp);
 997                 DLIST_REMOVE(memory_creds_list, memcredp);
 998                 talloc_destroy(memcredp);
 999                 DEBUG(10,("winbindd_delete_memory_creds: "
1000                         "deleted entry for user %s\n",
1001                         username));
1002         } else {
1003                 DEBUG(10,("winbindd_delete_memory_creds: "
1004                         "entry for user %s ref_count now %d\n",
1005                         username, memcredp->ref_count));
1006         }
1007
1008         if (entry) {
1009                 /* Ensure we have no dangling references to this. */
1010                 entry->cred_ptr = NULL;
1011         }
1012
1013         return status;
1014 }
1015
1016 /***********************************************************
1017  Replace the required creds with new ones (password change).
1018 ***********************************************************/
1019
1020 NTSTATUS winbindd_replace_memory_creds(const char *username,
1021                                        const char *pass)
1022 {
1023         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
1024
1025         memcredp = find_memory_creds_by_name(username);
1026         if (!memcredp) {
1027                 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
1028                         username));
1029                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1030         }
1031
1032         DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
1033                 username));
1034
1035         return winbindd_replace_memory_creds_internal(memcredp, pass);
1036 }