2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #include "krb5_locl.h"
43 /*! @mainpage Heimdal database backend library
45 * @section intro Introduction
47 * Heimdal libhdb library provides the backend support for Heimdal kdc
48 * and kadmind. Its here where plugins for diffrent database engines
49 * can be pluged in and extend support for here Heimdal get the
50 * principal and policy data from.
52 * Example of Heimdal backend are:
60 * The project web page: http://www.h5l.org/
64 const int hdb_interface_version
= HDB_INTERFACE_VERSION
;
66 static struct hdb_method methods
[] = {
67 #if HAVE_DB1 || HAVE_DB3
68 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "db:", hdb_db_create
},
71 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "mit-db:", hdb_mitdb_create
},
74 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "mdb:", hdb_mdb_create
},
77 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "ndbm:", hdb_ndbm_create
},
79 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "keytab:", hdb_keytab_create
},
80 #if defined(OPENLDAP) && !defined(OPENLDAP_MODULE)
81 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "ldap:", hdb_ldap_create
},
82 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "ldapi:", hdb_ldapi_create
},
85 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "sqlite:", hdb_sqlite_create
},
87 { 0, NULL
, NULL
, NULL
, NULL
}
90 #if HAVE_DB1 || HAVE_DB3
91 static struct hdb_method dbmetod
=
92 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "", hdb_db_create
};
93 #elif defined(HAVE_NDBM)
94 static struct hdb_method dbmetod
=
95 { HDB_INTERFACE_VERSION
, NULL
, NULL
, "", hdb_ndbm_create
};
99 hdb_kvno2keys(krb5_context context
,
103 HDB_Ext_KeySet
*hist_keys
;
110 extp
= hdb_find_extension(e
, choice_HDB_extension_data_hist_keys
);
114 hist_keys
= &extp
->data
.u
.hist_keys
;
115 for (i
= 0; i
< hist_keys
->len
; i
++) {
116 if (hist_keys
->val
[i
].kvno
== kvno
)
117 return &hist_keys
->val
[i
].keys
;
124 hdb_next_enctype2key(krb5_context context
,
127 krb5_enctype enctype
,
130 const Keys
*keys
= keyset
? keyset
: &e
->keys
;
133 for (k
= *key
? (*key
) + 1 : keys
->val
; k
< keys
->val
+ keys
->len
; k
++) {
134 if(k
->key
.keytype
== enctype
){
139 krb5_set_error_message(context
, KRB5_PROG_ETYPE_NOSUPP
,
140 "No next enctype %d for hdb-entry",
142 return KRB5_PROG_ETYPE_NOSUPP
; /* XXX */
146 hdb_enctype2key(krb5_context context
,
149 krb5_enctype enctype
,
153 return hdb_next_enctype2key(context
, e
, keyset
, enctype
, key
);
157 hdb_free_key(Key
*key
)
159 memset(key
->key
.keyvalue
.data
,
161 key
->key
.keyvalue
.length
);
168 hdb_lock(int fd
, int operation
)
172 for(i
= 0; i
< 3; i
++){
173 code
= flock(fd
, (operation
== HDB_RLOCK
? LOCK_SH
: LOCK_EX
) | LOCK_NB
);
174 if(code
== 0 || errno
!= EWOULDBLOCK
)
180 if(errno
== EWOULDBLOCK
)
181 return HDB_ERR_DB_INUSE
;
182 return HDB_ERR_CANT_LOCK_DB
;
189 code
= flock(fd
, LOCK_UN
);
191 return 4711 /* XXX */;
196 hdb_free_entry(krb5_context context
, hdb_entry_ex
*ent
)
202 (*ent
->free_entry
)(context
, ent
);
204 for(i
= 0; i
< ent
->entry
.keys
.len
; i
++) {
205 k
= &ent
->entry
.keys
.val
[i
];
207 memset (k
->key
.keyvalue
.data
, 0, k
->key
.keyvalue
.length
);
209 free_hdb_entry(&ent
->entry
);
213 hdb_foreach(krb5_context context
,
216 hdb_foreach_func_t func
,
221 ret
= db
->hdb_firstkey(context
, db
, flags
, &entry
);
223 krb5_clear_error_message(context
);
225 ret
= (*func
)(context
, db
, &entry
, data
);
226 hdb_free_entry(context
, &entry
);
228 ret
= db
->hdb_nextkey(context
, db
, flags
, &entry
);
230 if(ret
== HDB_ERR_NOENTRY
)
236 hdb_check_db_format(krb5_context context
, HDB
*db
)
240 krb5_error_code ret
, ret2
;
244 ret
= db
->hdb_lock(context
, db
, HDB_RLOCK
);
248 tag
.data
= (void *)(intptr_t)HDB_DB_FORMAT_ENTRY
;
249 tag
.length
= strlen(tag
.data
);
250 ret
= (*db
->hdb__get
)(context
, db
, tag
, &version
);
251 ret2
= db
->hdb_unlock(context
, db
);
256 foo
= sscanf(version
.data
, "%u", &ver
);
257 krb5_data_free (&version
);
259 return HDB_ERR_BADVERSION
;
260 if(ver
!= HDB_DB_FORMAT
)
261 return HDB_ERR_BADVERSION
;
266 hdb_init_db(krb5_context context
, HDB
*db
)
268 krb5_error_code ret
, ret2
;
273 ret
= hdb_check_db_format(context
, db
);
274 if(ret
!= HDB_ERR_NOENTRY
)
277 ret
= db
->hdb_lock(context
, db
, HDB_WLOCK
);
281 tag
.data
= (void *)(intptr_t)HDB_DB_FORMAT_ENTRY
;
282 tag
.length
= strlen(tag
.data
);
283 snprintf(ver
, sizeof(ver
), "%u", HDB_DB_FORMAT
);
285 version
.length
= strlen(version
.data
) + 1; /* zero terminated */
286 ret
= (*db
->hdb__put
)(context
, db
, 0, tag
, version
);
287 ret2
= db
->hdb_unlock(context
, db
);
290 krb5_clear_error_message(context
);
297 * find the relevant method for `filename', returning a pointer to the
299 * return NULL if there's no such method.
302 static const struct hdb_method
*
303 find_method (const char *filename
, const char **rest
)
305 const struct hdb_method
*h
;
307 for (h
= methods
; h
->prefix
!= NULL
; ++h
) {
308 if (strncmp (filename
, h
->prefix
, strlen(h
->prefix
)) == 0) {
309 *rest
= filename
+ strlen(h
->prefix
);
313 #if defined(HAVE_DB1) || defined(HAVE_DB3) || defined(HAVE_NDBM)
314 if (strncmp(filename
, "/", 1) == 0
315 || strncmp(filename
, "./", 2) == 0
316 || strncmp(filename
, "../", 3) == 0)
327 hdb_list_builtin(krb5_context context
, char **list
)
329 const struct hdb_method
*h
;
333 for (h
= methods
; h
->prefix
!= NULL
; ++h
) {
334 if (h
->prefix
[0] == '\0')
336 len
+= strlen(h
->prefix
) + 2;
342 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
347 for (h
= methods
; h
->prefix
!= NULL
; ++h
) {
349 strlcat(buf
, ", ", len
);
350 strlcat(buf
, h
->prefix
, len
);
357 _hdb_keytab2hdb_entry(krb5_context context
,
358 const krb5_keytab_entry
*ktentry
,
361 entry
->entry
.kvno
= ktentry
->vno
;
362 entry
->entry
.created_by
.time
= ktentry
->timestamp
;
364 entry
->entry
.keys
.val
= calloc(1, sizeof(entry
->entry
.keys
.val
[0]));
365 if (entry
->entry
.keys
.val
== NULL
)
367 entry
->entry
.keys
.len
= 1;
369 entry
->entry
.keys
.val
[0].mkvno
= NULL
;
370 entry
->entry
.keys
.val
[0].salt
= NULL
;
372 return krb5_copy_keyblock_contents(context
,
374 &entry
->entry
.keys
.val
[0].key
);
378 * Create a handle for a Kerberos database
380 * Create a handle for a Kerberos database backend specified by a
381 * filename. Doesn't create a file if its doesn't exists, you have to
382 * use O_CREAT to tell the backend to create the file.
386 const char *residual
;
387 const char *filename
;
388 const struct hdb_method
*h
;
391 static krb5_error_code KRB5_LIB_CALL
392 callback(krb5_context context
, const void *plug
, void *plugctx
, void *userctx
)
394 struct cb_s
*cb_ctx
= (struct cb_s
*)userctx
;
396 if (strncmp (cb_ctx
->filename
, cb_ctx
->h
->prefix
, strlen(cb_ctx
->h
->prefix
)) == 0) {
397 cb_ctx
->residual
= cb_ctx
->filename
+ strlen(cb_ctx
->h
->prefix
);
400 return KRB5_PLUGIN_NO_HANDLE
;
404 hdb_create(krb5_context context
, HDB
**db
, const char *filename
)
408 if (filename
== NULL
)
409 filename
= HDB_DEFAULT_DB
;
410 cb_ctx
.h
= find_method (filename
, &cb_ctx
.residual
);
411 cb_ctx
.filename
= filename
;
413 if (cb_ctx
.h
== NULL
) {
414 (void)_krb5_plugin_run_f(context
, "krb5", "hdb",
415 HDB_INTERFACE_VERSION
, 0, &cb_ctx
, callback
);
418 if (cb_ctx
.h
== NULL
)
419 cb_ctx
.h
= find_dynamic_method (context
, cb_ctx
.filename
, &cb_ctx
.residual
);
421 if (cb_ctx
.h
== NULL
)
422 krb5_errx(context
, 1, "No database support for %s", cb_ctx
.filename
);
423 return (*cb_ctx
.h
->create
)(context
, db
, cb_ctx
.residual
);