kcm/cache.c

   1 /*
   2  * Copyright (c) 2005, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. Neither the name of PADL Software nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include "kcm_locl.h"
  36
  37 HEIMDAL_MUTEX ccache_mutex = HEIMDAL_MUTEX_INITIALIZER;
  38 kcm_ccache_data *ccache_head = NULL;
  39 static unsigned int ccache_nextid = 0;
  40
  41 char *kcm_ccache_nextid(pid_t pid, uid_t uid, gid_t gid)
  42 {
  43     unsigned n;
  44     char *name;
  45     int ret;
  46
  47     HEIMDAL_MUTEX_lock(&ccache_mutex);
  48     n = ++ccache_nextid;
  49     HEIMDAL_MUTEX_unlock(&ccache_mutex);
  50
  51     ret = asprintf(&name, "%ld:%u", (long)uid, n);
  52     if (ret == -1)
  53         return NULL;
  54
  55     return name;
  56 }
  57
  58 krb5_error_code
  59 kcm_ccache_resolve(krb5_context context,
  60                    const char *name,
  61                    kcm_ccache *ccache)
  62 {
  63     kcm_ccache p;
  64     krb5_error_code ret;
  65
  66     *ccache = NULL;
  67
  68     ret = KRB5_FCC_NOFILE;
  69
  70     HEIMDAL_MUTEX_lock(&ccache_mutex);
  71
  72     for (p = ccache_head; p != NULL; p = p->next) {
  73         if ((p->flags & KCM_FLAGS_VALID) == 0)
  74             continue;
  75         if (strcmp(p->name, name) == 0) {
  76             ret = 0;
  77             break;
  78         }
  79     }
  80
  81     if (ret == 0) {
  82         kcm_retain_ccache(context, p);
  83         *ccache = p;
  84     }
  85
  86     HEIMDAL_MUTEX_unlock(&ccache_mutex);
  87
  88     return ret;
  89 }
  90
  91 krb5_error_code
  92 kcm_ccache_resolve_by_uuid(krb5_context context,
  93                            kcmuuid_t uuid,
  94                            kcm_ccache *ccache)
  95 {
  96     kcm_ccache p;
  97     krb5_error_code ret;
  98
  99     *ccache = NULL;
 100
 101     ret = KRB5_FCC_NOFILE;
 102
 103     HEIMDAL_MUTEX_lock(&ccache_mutex);
 104
 105     for (p = ccache_head; p != NULL; p = p->next) {
 106         if ((p->flags & KCM_FLAGS_VALID) == 0)
 107             continue;
 108         if (memcmp(p->uuid, uuid, sizeof(kcmuuid_t)) == 0) {
 109             ret = 0;
 110             break;
 111         }
 112     }
 113
 114     if (ret == 0) {
 115         kcm_retain_ccache(context, p);
 116         *ccache = p;
 117     }
 118
 119     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 120
 121     return ret;
 122 }
 123
 124 krb5_error_code
 125 kcm_ccache_get_uuids(krb5_context context, kcm_client *client, kcm_operation opcode, krb5_storage *sp)
 126 {
 127     krb5_error_code ret;
 128     kcm_ccache p;
 129
 130     ret = KRB5_FCC_NOFILE;
 131
 132     HEIMDAL_MUTEX_lock(&ccache_mutex);
 133
 134     for (p = ccache_head; p != NULL; p = p->next) {
 135         if ((p->flags & KCM_FLAGS_VALID) == 0)
 136             continue;
 137         ret = kcm_access(context, client, opcode, p);
 138         if (ret) {
 139             ret = 0;
 140             continue;
 141         }
 142         krb5_storage_write(sp, p->uuid, sizeof(p->uuid));
 143     }
 144
 145     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 146
 147     return ret;
 148 }
 149
 150
 151 krb5_error_code kcm_debug_ccache(krb5_context context)
 152 {
 153     kcm_ccache p;
 154
 155     for (p = ccache_head; p != NULL; p = p->next) {
 156         char *cpn = NULL, *spn = NULL;
 157         int ncreds = 0;
 158         struct kcm_creds *k;
 159
 160         if ((p->flags & KCM_FLAGS_VALID) == 0) {
 161             kcm_log(7, "cache %08x: empty slot");
 162             continue;
 163         }
 164
 165         KCM_ASSERT_VALID(p);
 166
 167         for (k = p->creds; k != NULL; k = k->next)
 168             ncreds++;
 169
 170         if (p->client != NULL)
 171             krb5_unparse_name(context, p->client, &cpn);
 172         if (p->server != NULL)
 173             krb5_unparse_name(context, p->server, &spn);
 174
 175         kcm_log(7, "cache %08x: name %s refcnt %d flags %04x mode %04o "
 176                 "uid %d gid %d client %s server %s ncreds %d",
 177                 p, p->name, p->refcnt, p->flags, p->mode, p->uid, p->gid,
 178                 (cpn == NULL) ? "<none>" : cpn,
 179                 (spn == NULL) ? "<none>" : spn,
 180                 ncreds);
 181
 182         if (cpn != NULL)
 183             free(cpn);
 184         if (spn != NULL)
 185             free(spn);
 186     }
 187
 188     return 0;
 189 }
 190
 191 static void
 192 kcm_free_ccache_data_internal(krb5_context context,
 193                               kcm_ccache_data *cache)
 194 {
 195     KCM_ASSERT_VALID(cache);
 196
 197     if (cache->name != NULL) {
 198         free(cache->name);
 199         cache->name = NULL;
 200     }
 201
 202     if (cache->flags & KCM_FLAGS_USE_KEYTAB) {
 203         krb5_kt_close(context, cache->key.keytab);
 204         cache->key.keytab = NULL;
 205     } else if (cache->flags & KCM_FLAGS_USE_CACHED_KEY) {
 206         krb5_free_keyblock_contents(context, &cache->key.keyblock);
 207         krb5_keyblock_zero(&cache->key.keyblock);
 208     }
 209
 210     cache->flags = 0;
 211     cache->mode = 0;
 212     cache->uid = -1;
 213     cache->gid = -1;
 214     cache->session = -1;
 215
 216     kcm_zero_ccache_data_internal(context, cache);
 217
 218     cache->tkt_life = 0;
 219     cache->renew_life = 0;
 220
 221     cache->next = NULL;
 222     cache->refcnt = 0;
 223
 224     HEIMDAL_MUTEX_unlock(&cache->mutex);
 225     HEIMDAL_MUTEX_destroy(&cache->mutex);
 226 }
 227
 228
 229 krb5_error_code
 230 kcm_ccache_destroy(krb5_context context, const char *name)
 231 {
 232     kcm_ccache *p, ccache;
 233     krb5_error_code ret;
 234
 235     ret = KRB5_FCC_NOFILE;
 236
 237     HEIMDAL_MUTEX_lock(&ccache_mutex);
 238     for (p = &ccache_head; *p != NULL; p = &(*p)->next) {
 239         if (((*p)->flags & KCM_FLAGS_VALID) == 0)
 240             continue;
 241         if (strcmp((*p)->name, name) == 0) {
 242             ret = 0;
 243             break;
 244         }
 245     }
 246     if (ret)
 247         goto out;
 248
 249     if ((*p)->refcnt != 1) {
 250         ret = EAGAIN;
 251         goto out;
 252     }
 253
 254     ccache = *p;
 255     *p = (*p)->next;
 256     kcm_free_ccache_data_internal(context, ccache);
 257     free(ccache);
 258
 259 out:
 260     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 261
 262     return ret;
 263 }
 264
 265 static krb5_error_code
 266 kcm_ccache_alloc(krb5_context context,
 267                  const char *name,
 268                  kcm_ccache *ccache)
 269 {
 270     kcm_ccache slot = NULL, p;
 271     krb5_error_code ret;
 272     int new_slot = 0;
 273
 274     *ccache = NULL;
 275
 276     /* First, check for duplicates */
 277     HEIMDAL_MUTEX_lock(&ccache_mutex);
 278     ret = 0;
 279     for (p = ccache_head; p != NULL; p = p->next) {
 280         if (p->flags & KCM_FLAGS_VALID) {
 281             if (strcmp(p->name, name) == 0) {
 282                 ret = KRB5_CC_WRITE;
 283                 break;
 284             }
 285         } else if (slot == NULL)
 286             slot = p;
 287     }
 288
 289     if (ret)
 290         goto out;
 291
 292     /*
 293      * Create an enpty slot for us.
 294      */
 295     if (slot == NULL) {
 296         slot = (kcm_ccache_data *)malloc(sizeof(*slot));
 297         if (slot == NULL) {
 298             ret = KRB5_CC_NOMEM;
 299             goto out;
 300         }
 301         slot->next = ccache_head;
 302         HEIMDAL_MUTEX_init(&slot->mutex);
 303         new_slot = 1;
 304     }
 305
 306     RAND_bytes(slot->uuid, sizeof(slot->uuid));
 307
 308     slot->name = strdup(name);
 309     if (slot->name == NULL) {
 310         ret = KRB5_CC_NOMEM;
 311         goto out;
 312     }
 313
 314     slot->refcnt = 1;
 315     slot->flags = KCM_FLAGS_VALID;
 316     slot->mode = S_IRUSR | S_IWUSR;
 317     slot->uid = -1;
 318     slot->gid = -1;
 319     slot->client = NULL;
 320     slot->server = NULL;
 321     slot->creds = NULL;
 322     slot->key.keytab = NULL;
 323     slot->tkt_life = 0;
 324     slot->renew_life = 0;
 325
 326     if (new_slot)
 327         ccache_head = slot;
 328
 329     *ccache = slot;
 330
 331     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 332     return 0;
 333
 334 out:
 335     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 336     if (new_slot && slot != NULL) {
 337         HEIMDAL_MUTEX_destroy(&slot->mutex);
 338         free(slot);
 339     }
 340     return ret;
 341 }
 342
 343 krb5_error_code
 344 kcm_ccache_remove_creds_internal(krb5_context context,
 345                                  kcm_ccache ccache)
 346 {
 347     struct kcm_creds *k;
 348
 349     k = ccache->creds;
 350     while (k != NULL) {
 351         struct kcm_creds *old;
 352
 353         krb5_free_cred_contents(context, &k->cred);
 354         old = k;
 355         k = k->next;
 356         free(old);
 357     }
 358     ccache->creds = NULL;
 359
 360     return 0;
 361 }
 362
 363 krb5_error_code
 364 kcm_ccache_remove_creds(krb5_context context,
 365                         kcm_ccache ccache)
 366 {
 367     krb5_error_code ret;
 368
 369     KCM_ASSERT_VALID(ccache);
 370
 371     HEIMDAL_MUTEX_lock(&ccache->mutex);
 372     ret = kcm_ccache_remove_creds_internal(context, ccache);
 373     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 374
 375     return ret;
 376 }
 377
 378 krb5_error_code
 379 kcm_zero_ccache_data_internal(krb5_context context,
 380                               kcm_ccache_data *cache)
 381 {
 382     if (cache->client != NULL) {
 383         krb5_free_principal(context, cache->client);
 384         cache->client = NULL;
 385     }
 386
 387     if (cache->server != NULL) {
 388         krb5_free_principal(context, cache->server);
 389         cache->server = NULL;
 390     }
 391
 392     kcm_ccache_remove_creds_internal(context, cache);
 393
 394     return 0;
 395 }
 396
 397 krb5_error_code
 398 kcm_zero_ccache_data(krb5_context context,
 399                      kcm_ccache cache)
 400 {
 401     krb5_error_code ret;
 402
 403     KCM_ASSERT_VALID(cache);
 404
 405     HEIMDAL_MUTEX_lock(&cache->mutex);
 406     ret = kcm_zero_ccache_data_internal(context, cache);
 407     HEIMDAL_MUTEX_unlock(&cache->mutex);
 408
 409     return ret;
 410 }
 411
 412 krb5_error_code
 413 kcm_retain_ccache(krb5_context context,
 414                   kcm_ccache ccache)
 415 {
 416     KCM_ASSERT_VALID(ccache);
 417
 418     HEIMDAL_MUTEX_lock(&ccache->mutex);
 419     ccache->refcnt++;
 420     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 421
 422     return 0;
 423 }
 424
 425 krb5_error_code
 426 kcm_release_ccache(krb5_context context, kcm_ccache c)
 427 {
 428     krb5_error_code ret = 0;
 429
 430     KCM_ASSERT_VALID(c);
 431
 432     HEIMDAL_MUTEX_lock(&c->mutex);
 433     if (c->refcnt == 1) {
 434         kcm_free_ccache_data_internal(context, c);
 435         free(c);
 436     } else {
 437         c->refcnt--;
 438         HEIMDAL_MUTEX_unlock(&c->mutex);
 439     }
 440
 441     return ret;
 442 }
 443
 444 krb5_error_code
 445 kcm_ccache_gen_new(krb5_context context,
 446                    pid_t pid,
 447                    uid_t uid,
 448                    gid_t gid,
 449                    kcm_ccache *ccache)
 450 {
 451     krb5_error_code ret;
 452     char *name;
 453
 454     name = kcm_ccache_nextid(pid, uid, gid);
 455     if (name == NULL) {
 456         return KRB5_CC_NOMEM;
 457     }
 458
 459     ret = kcm_ccache_new(context, name, ccache);
 460
 461     free(name);
 462     return ret;
 463 }
 464
 465 krb5_error_code
 466 kcm_ccache_new(krb5_context context,
 467                const char *name,
 468                kcm_ccache *ccache)
 469 {
 470     krb5_error_code ret;
 471
 472     ret = kcm_ccache_alloc(context, name, ccache);
 473     if (ret == 0) {
 474         /*
 475          * one reference is held by the linked list,
 476          * one by the caller
 477          */
 478         kcm_retain_ccache(context, *ccache);
 479     }
 480
 481     return ret;
 482 }
 483
 484 krb5_error_code
 485 kcm_ccache_destroy_if_empty(krb5_context context,
 486                             kcm_ccache ccache)
 487 {
 488     krb5_error_code ret;
 489
 490     KCM_ASSERT_VALID(ccache);
 491
 492     if (ccache->creds == NULL) {
 493         ret = kcm_ccache_destroy(context, ccache->name);
 494     } else
 495         ret = 0;
 496
 497     return ret;
 498 }
 499
 500 krb5_error_code
 501 kcm_ccache_store_cred(krb5_context context,
 502                       kcm_ccache ccache,
 503                       krb5_creds *creds,
 504                       int copy)
 505 {
 506     krb5_error_code ret;
 507     krb5_creds *tmp;
 508
 509     KCM_ASSERT_VALID(ccache);
 510
 511     HEIMDAL_MUTEX_lock(&ccache->mutex);
 512     ret = kcm_ccache_store_cred_internal(context, ccache, creds, copy, &tmp);
 513     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 514
 515     return ret;
 516 }
 517
 518 struct kcm_creds *
 519 kcm_ccache_find_cred_uuid(krb5_context context,
 520                           kcm_ccache ccache,
 521                           kcmuuid_t uuid)
 522 {
 523     struct kcm_creds *c;
 524
 525     for (c = ccache->creds; c != NULL; c = c->next)
 526         if (memcmp(c->uuid, uuid, sizeof(c->uuid)) == 0)
 527             return c;
 528
 529     return NULL;
 530 }
 531
 532
 533
 534 krb5_error_code
 535 kcm_ccache_store_cred_internal(krb5_context context,
 536                                kcm_ccache ccache,
 537                                krb5_creds *creds,
 538                                int copy,
 539                                krb5_creds **credp)
 540 {
 541     struct kcm_creds **c;
 542     krb5_error_code ret;
 543
 544     for (c = &ccache->creds; *c != NULL; c = &(*c)->next)
 545         ;
 546
 547     *c = (struct kcm_creds *)calloc(1, sizeof(**c));
 548     if (*c == NULL)
 549         return KRB5_CC_NOMEM;
 550
 551     RAND_bytes((*c)->uuid, sizeof((*c)->uuid));
 552
 553     *credp = &(*c)->cred;
 554
 555     if (copy) {
 556         ret = krb5_copy_creds_contents(context, creds, *credp);
 557         if (ret) {
 558             free(*c);
 559             *c = NULL;
 560         }
 561     } else {
 562         **credp = *creds;
 563         ret = 0;
 564     }
 565
 566     return ret;
 567 }
 568
 569 krb5_error_code
 570 kcm_ccache_remove_cred_internal(krb5_context context,
 571                                 kcm_ccache ccache,
 572                                 krb5_flags whichfields,
 573                                 const krb5_creds *mcreds)
 574 {
 575     krb5_error_code ret;
 576     struct kcm_creds **c;
 577
 578     ret = KRB5_CC_NOTFOUND;
 579
 580     for (c = &ccache->creds; *c != NULL; c = &(*c)->next) {
 581         if (krb5_compare_creds(context, whichfields, mcreds, &(*c)->cred)) {
 582             struct kcm_creds *cred = *c;
 583
 584             *c = cred->next;
 585             krb5_free_cred_contents(context, &cred->cred);
 586             free(cred);
 587             ret = 0;
 588             if (*c == NULL)
 589                 break;
 590         }
 591     }
 592
 593     return ret;
 594 }
 595
 596 krb5_error_code
 597 kcm_ccache_remove_cred(krb5_context context,
 598                        kcm_ccache ccache,
 599                        krb5_flags whichfields,
 600                        const krb5_creds *mcreds)
 601 {
 602     krb5_error_code ret;
 603
 604     KCM_ASSERT_VALID(ccache);
 605
 606     HEIMDAL_MUTEX_lock(&ccache->mutex);
 607     ret = kcm_ccache_remove_cred_internal(context, ccache, whichfields, mcreds);
 608     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 609
 610     return ret;
 611 }
 612
 613 krb5_error_code
 614 kcm_ccache_retrieve_cred_internal(krb5_context context,
 615                                   kcm_ccache ccache,
 616                                   krb5_flags whichfields,
 617                                   const krb5_creds *mcreds,
 618                                   krb5_creds **creds)
 619 {
 620     krb5_boolean match;
 621     struct kcm_creds *c;
 622     krb5_error_code ret;
 623
 624     memset(creds, 0, sizeof(*creds));
 625
 626     ret = KRB5_CC_END;
 627
 628     match = FALSE;
 629     for (c = ccache->creds; c != NULL; c = c->next) {
 630         match = krb5_compare_creds(context, whichfields, mcreds, &c->cred);
 631         if (match)
 632             break;
 633     }
 634
 635     if (match) {
 636         ret = 0;
 637         *creds = &c->cred;
 638     }
 639
 640     return ret;
 641 }
 642
 643 krb5_error_code
 644 kcm_ccache_retrieve_cred(krb5_context context,
 645                          kcm_ccache ccache,
 646                          krb5_flags whichfields,
 647                          const krb5_creds *mcreds,
 648                          krb5_creds **credp)
 649 {
 650     krb5_error_code ret;
 651
 652     KCM_ASSERT_VALID(ccache);
 653
 654     HEIMDAL_MUTEX_lock(&ccache->mutex);
 655     ret = kcm_ccache_retrieve_cred_internal(context, ccache,
 656                                             whichfields, mcreds, credp);
 657     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 658
 659     return ret;
 660 }
 661
 662 char *
 663 kcm_ccache_first_name(kcm_client *client)
 664 {
 665     kcm_ccache p;
 666     char *name = NULL;
 667
 668     HEIMDAL_MUTEX_lock(&ccache_mutex);
 669
 670     for (p = ccache_head; p != NULL; p = p->next) {
 671         if (kcm_is_same_session(client, p->uid, p->session))
 672             break;
 673     }
 674     if (p)
 675         name = strdup(p->name);
 676     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 677     return name;
 678 }