kcm/cache.c

   1 /*
   2  * Copyright (c) 2005, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. Neither the name of PADL Software nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include "kcm_locl.h"
  36
  37 HEIMDAL_MUTEX ccache_mutex = HEIMDAL_MUTEX_INITIALIZER;
  38 kcm_ccache_data *ccache_head = NULL;
  39 static unsigned int ccache_nextid = 0;
  40
  41 char *kcm_ccache_nextid(pid_t pid, uid_t uid, gid_t gid)
  42 {
  43     unsigned n;
  44     char *name;
  45
  46     HEIMDAL_MUTEX_lock(&ccache_mutex);
  47     n = ++ccache_nextid;
  48     HEIMDAL_MUTEX_unlock(&ccache_mutex);
  49
  50     asprintf(&name, "%ld:%u", (long)uid, n);
  51
  52     return name;
  53 }
  54
  55 krb5_error_code
  56 kcm_ccache_resolve(krb5_context context,
  57                    const char *name,
  58                    kcm_ccache *ccache)
  59 {
  60     kcm_ccache p;
  61     krb5_error_code ret;
  62
  63     *ccache = NULL;
  64
  65     ret = KRB5_FCC_NOFILE;
  66
  67     HEIMDAL_MUTEX_lock(&ccache_mutex);
  68
  69     for (p = ccache_head; p != NULL; p = p->next) {
  70         if ((p->flags & KCM_FLAGS_VALID) == 0)
  71             continue;
  72         if (strcmp(p->name, name) == 0) {
  73             ret = 0;
  74             break;
  75         }
  76     }
  77
  78     if (ret == 0) {
  79         kcm_retain_ccache(context, p);
  80         *ccache = p;
  81     }
  82
  83     HEIMDAL_MUTEX_unlock(&ccache_mutex);
  84
  85     return ret;
  86 }
  87
  88 krb5_error_code
  89 kcm_ccache_resolve_by_uuid(krb5_context context,
  90                            kcmuuid_t uuid,
  91                            kcm_ccache *ccache)
  92 {
  93     kcm_ccache p;
  94     krb5_error_code ret;
  95
  96     *ccache = NULL;
  97
  98     ret = KRB5_FCC_NOFILE;
  99
 100     HEIMDAL_MUTEX_lock(&ccache_mutex);
 101
 102     for (p = ccache_head; p != NULL; p = p->next) {
 103         if ((p->flags & KCM_FLAGS_VALID) == 0)
 104             continue;
 105         if (memcmp(p->uuid, uuid, sizeof(uuid)) == 0) {
 106             ret = 0;
 107             break;
 108         }
 109     }
 110
 111     if (ret == 0) {
 112         kcm_retain_ccache(context, p);
 113         *ccache = p;
 114     }
 115
 116     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 117
 118     return ret;
 119 }
 120
 121 krb5_error_code
 122 kcm_ccache_get_uuids(krb5_context context, kcm_client *client, kcm_operation opcode, krb5_storage *sp)
 123 {
 124     krb5_error_code ret;
 125     kcm_ccache p;
 126
 127     ret = KRB5_FCC_NOFILE;
 128
 129     HEIMDAL_MUTEX_lock(&ccache_mutex);
 130
 131     for (p = ccache_head; p != NULL; p = p->next) {
 132         if ((p->flags & KCM_FLAGS_VALID) == 0)
 133             continue;
 134         ret = kcm_access(context, client, opcode, p);
 135         if (ret) {
 136             ret = 0;
 137             continue;
 138         }
 139         krb5_storage_write(sp, p->uuid, sizeof(p->uuid));
 140     }
 141
 142     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 143
 144     return ret;
 145 }
 146
 147
 148 krb5_error_code kcm_debug_ccache(krb5_context context)
 149 {
 150     kcm_ccache p;
 151
 152     for (p = ccache_head; p != NULL; p = p->next) {
 153         char *cpn = NULL, *spn = NULL;
 154         int ncreds = 0;
 155         struct kcm_creds *k;
 156
 157         if ((p->flags & KCM_FLAGS_VALID) == 0) {
 158             kcm_log(7, "cache %08x: empty slot");
 159             continue;
 160         }
 161
 162         KCM_ASSERT_VALID(p);
 163
 164         for (k = p->creds; k != NULL; k = k->next)
 165             ncreds++;
 166
 167         if (p->client != NULL)
 168             krb5_unparse_name(context, p->client, &cpn);
 169         if (p->server != NULL)
 170             krb5_unparse_name(context, p->server, &spn);
 171
 172         kcm_log(7, "cache %08x: name %s refcnt %d flags %04x mode %04o "
 173                 "uid %d gid %d client %s server %s ncreds %d",
 174                 p, p->name, p->refcnt, p->flags, p->mode, p->uid, p->gid,
 175                 (cpn == NULL) ? "<none>" : cpn,
 176                 (spn == NULL) ? "<none>" : spn,
 177                 ncreds);
 178
 179         if (cpn != NULL)
 180             free(cpn);
 181         if (spn != NULL)
 182             free(spn);
 183     }
 184
 185     return 0;
 186 }
 187
 188 static void
 189 kcm_free_ccache_data_internal(krb5_context context,
 190                               kcm_ccache_data *cache)
 191 {
 192     KCM_ASSERT_VALID(cache);
 193
 194     if (cache->name != NULL) {
 195         free(cache->name);
 196         cache->name = NULL;
 197     }
 198
 199     if (cache->flags & KCM_FLAGS_USE_KEYTAB) {
 200         krb5_kt_close(context, cache->key.keytab);
 201         cache->key.keytab = NULL;
 202     } else if (cache->flags & KCM_FLAGS_USE_CACHED_KEY) {
 203         krb5_free_keyblock_contents(context, &cache->key.keyblock);
 204         krb5_keyblock_zero(&cache->key.keyblock);
 205     }
 206
 207     cache->flags = 0;
 208     cache->mode = 0;
 209     cache->uid = -1;
 210     cache->gid = -1;
 211     cache->session = -1;
 212
 213     kcm_zero_ccache_data_internal(context, cache);
 214
 215     cache->tkt_life = 0;
 216     cache->renew_life = 0;
 217
 218     cache->next = NULL;
 219     cache->refcnt = 0;
 220
 221     HEIMDAL_MUTEX_unlock(&cache->mutex);
 222     HEIMDAL_MUTEX_destroy(&cache->mutex);
 223 }
 224
 225
 226 krb5_error_code
 227 kcm_ccache_destroy(krb5_context context, const char *name)
 228 {
 229     kcm_ccache *p, ccache;
 230     krb5_error_code ret;
 231
 232     ret = KRB5_FCC_NOFILE;
 233
 234     HEIMDAL_MUTEX_lock(&ccache_mutex);
 235     for (p = &ccache_head; *p != NULL; p = &(*p)->next) {
 236         if (((*p)->flags & KCM_FLAGS_VALID) == 0)
 237             continue;
 238         if (strcmp((*p)->name, name) == 0) {
 239             ret = 0;
 240             break;
 241         }
 242     }
 243     if (ret)
 244         goto out;
 245
 246     if ((*p)->refcnt != 1) {
 247         ret = EAGAIN;
 248         goto out;
 249     }
 250
 251     ccache = *p;
 252     *p = (*p)->next;
 253     kcm_free_ccache_data_internal(context, ccache);
 254     free(ccache);
 255
 256 out:
 257     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 258
 259     return ret;
 260 }
 261
 262 static krb5_error_code
 263 kcm_ccache_alloc(krb5_context context,
 264                  const char *name,
 265                  kcm_ccache *ccache)
 266 {
 267     kcm_ccache slot = NULL, p;
 268     krb5_error_code ret;
 269     int new_slot = 0;
 270
 271     *ccache = NULL;
 272
 273     /* First, check for duplicates */
 274     HEIMDAL_MUTEX_lock(&ccache_mutex);
 275     ret = 0;
 276     for (p = ccache_head; p != NULL; p = p->next) {
 277         if (p->flags & KCM_FLAGS_VALID) {
 278             if (strcmp(p->name, name) == 0) {
 279                 ret = KRB5_CC_WRITE;
 280                 break;
 281             }
 282         } else if (slot == NULL)
 283             slot = p;
 284     }
 285
 286     if (ret)
 287         goto out;
 288
 289     /*
 290      * Create an enpty slot for us.
 291      */
 292     if (slot == NULL) {
 293         slot = (kcm_ccache_data *)malloc(sizeof(*slot));
 294         if (slot == NULL) {
 295             ret = KRB5_CC_NOMEM;
 296             goto out;
 297         }
 298         slot->next = ccache_head;
 299         HEIMDAL_MUTEX_init(&slot->mutex);
 300         new_slot = 1;
 301     }
 302
 303     RAND_bytes(slot->uuid, sizeof(slot->uuid));
 304
 305     slot->name = strdup(name);
 306     if (slot->name == NULL) {
 307         ret = KRB5_CC_NOMEM;
 308         goto out;
 309     }
 310
 311     slot->refcnt = 1;
 312     slot->flags = KCM_FLAGS_VALID;
 313     slot->mode = S_IRUSR | S_IWUSR;
 314     slot->uid = -1;
 315     slot->gid = -1;
 316     slot->client = NULL;
 317     slot->server = NULL;
 318     slot->creds = NULL;
 319     slot->key.keytab = NULL;
 320     slot->tkt_life = 0;
 321     slot->renew_life = 0;
 322
 323     if (new_slot)
 324         ccache_head = slot;
 325
 326     *ccache = slot;
 327
 328     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 329     return 0;
 330
 331 out:
 332     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 333     if (new_slot && slot != NULL) {
 334         HEIMDAL_MUTEX_destroy(&slot->mutex);
 335         free(slot);
 336     }
 337     return ret;
 338 }
 339
 340 krb5_error_code
 341 kcm_ccache_remove_creds_internal(krb5_context context,
 342                                  kcm_ccache ccache)
 343 {
 344     struct kcm_creds *k;
 345
 346     k = ccache->creds;
 347     while (k != NULL) {
 348         struct kcm_creds *old;
 349
 350         krb5_free_cred_contents(context, &k->cred);
 351         old = k;
 352         k = k->next;
 353         free(old);
 354     }
 355     ccache->creds = NULL;
 356
 357     return 0;
 358 }
 359
 360 krb5_error_code
 361 kcm_ccache_remove_creds(krb5_context context,
 362                         kcm_ccache ccache)
 363 {
 364     krb5_error_code ret;
 365
 366     KCM_ASSERT_VALID(ccache);
 367
 368     HEIMDAL_MUTEX_lock(&ccache->mutex);
 369     ret = kcm_ccache_remove_creds_internal(context, ccache);
 370     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 371
 372     return ret;
 373 }
 374
 375 krb5_error_code
 376 kcm_zero_ccache_data_internal(krb5_context context,
 377                               kcm_ccache_data *cache)
 378 {
 379     if (cache->client != NULL) {
 380         krb5_free_principal(context, cache->client);
 381         cache->client = NULL;
 382     }
 383
 384     if (cache->server != NULL) {
 385         krb5_free_principal(context, cache->server);
 386         cache->server = NULL;
 387     }
 388
 389     kcm_ccache_remove_creds_internal(context, cache);
 390
 391     return 0;
 392 }
 393
 394 krb5_error_code
 395 kcm_zero_ccache_data(krb5_context context,
 396                      kcm_ccache cache)
 397 {
 398     krb5_error_code ret;
 399
 400     KCM_ASSERT_VALID(cache);
 401
 402     HEIMDAL_MUTEX_lock(&cache->mutex);
 403     ret = kcm_zero_ccache_data_internal(context, cache);
 404     HEIMDAL_MUTEX_unlock(&cache->mutex);
 405
 406     return ret;
 407 }
 408
 409 krb5_error_code
 410 kcm_retain_ccache(krb5_context context,
 411                   kcm_ccache ccache)
 412 {
 413     KCM_ASSERT_VALID(ccache);
 414
 415     HEIMDAL_MUTEX_lock(&ccache->mutex);
 416     ccache->refcnt++;
 417     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 418
 419     return 0;
 420 }
 421
 422 krb5_error_code
 423 kcm_release_ccache(krb5_context context, kcm_ccache c)
 424 {
 425     krb5_error_code ret = 0;
 426
 427     KCM_ASSERT_VALID(c);
 428
 429     HEIMDAL_MUTEX_lock(&c->mutex);
 430     if (c->refcnt == 1) {
 431     } else {
 432         c->refcnt--;
 433         HEIMDAL_MUTEX_unlock(&c->mutex);
 434     }
 435
 436     return ret;
 437 }
 438
 439 krb5_error_code
 440 kcm_ccache_gen_new(krb5_context context,
 441                    pid_t pid,
 442                    uid_t uid,
 443                    gid_t gid,
 444                    kcm_ccache *ccache)
 445 {
 446     krb5_error_code ret;
 447     char *name;
 448
 449     name = kcm_ccache_nextid(pid, uid, gid);
 450     if (name == NULL) {
 451         return KRB5_CC_NOMEM;
 452     }
 453
 454     ret = kcm_ccache_new(context, name, ccache);
 455
 456     free(name);
 457     return ret;
 458 }
 459
 460 krb5_error_code
 461 kcm_ccache_new(krb5_context context,
 462                const char *name,
 463                kcm_ccache *ccache)
 464 {
 465     krb5_error_code ret;
 466
 467     ret = kcm_ccache_alloc(context, name, ccache);
 468     if (ret == 0) {
 469         /*
 470          * one reference is held by the linked list,
 471          * one by the caller
 472          */
 473         kcm_retain_ccache(context, *ccache);
 474     }
 475
 476     return ret;
 477 }
 478
 479 krb5_error_code
 480 kcm_ccache_destroy_if_empty(krb5_context context,
 481                             kcm_ccache ccache)
 482 {
 483     krb5_error_code ret;
 484
 485     KCM_ASSERT_VALID(ccache);
 486
 487     if (ccache->creds == NULL) {
 488         ret = kcm_ccache_destroy(context, ccache->name);
 489     } else
 490         ret = 0;
 491
 492     return ret;
 493 }
 494
 495 krb5_error_code
 496 kcm_ccache_store_cred(krb5_context context,
 497                       kcm_ccache ccache,
 498                       krb5_creds *creds,
 499                       int copy)
 500 {
 501     krb5_error_code ret;
 502     krb5_creds *tmp;
 503
 504     KCM_ASSERT_VALID(ccache);
 505
 506     HEIMDAL_MUTEX_lock(&ccache->mutex);
 507     ret = kcm_ccache_store_cred_internal(context, ccache, creds, copy, &tmp);
 508     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 509
 510     return ret;
 511 }
 512
 513 struct kcm_creds *
 514 kcm_ccache_find_cred_uuid(krb5_context context,
 515                           kcm_ccache ccache,
 516                           kcmuuid_t uuid)
 517 {
 518     struct kcm_creds *c;
 519
 520     for (c = ccache->creds; c != NULL; c = c->next)
 521         if (memcmp(c->uuid, uuid, sizeof(c->uuid)) == 0)
 522             return c;
 523
 524     return NULL;
 525 }
 526
 527
 528
 529 krb5_error_code
 530 kcm_ccache_store_cred_internal(krb5_context context,
 531                                kcm_ccache ccache,
 532                                krb5_creds *creds,
 533                                int copy,
 534                                krb5_creds **credp)
 535 {
 536     struct kcm_creds **c;
 537     krb5_error_code ret;
 538
 539     for (c = &ccache->creds; *c != NULL; c = &(*c)->next)
 540         ;
 541
 542     *c = (struct kcm_creds *)calloc(1, sizeof(**c));
 543     if (*c == NULL)
 544         return KRB5_CC_NOMEM;
 545
 546     RAND_bytes((*c)->uuid, sizeof((*c)->uuid));
 547
 548     *credp = &(*c)->cred;
 549
 550     if (copy) {
 551         ret = krb5_copy_creds_contents(context, creds, *credp);
 552         if (ret) {
 553             free(*c);
 554             *c = NULL;
 555         }
 556     } else {
 557         **credp = *creds;
 558         ret = 0;
 559     }
 560
 561     return ret;
 562 }
 563
 564 krb5_error_code
 565 kcm_ccache_remove_cred_internal(krb5_context context,
 566                                 kcm_ccache ccache,
 567                                 krb5_flags whichfields,
 568                                 const krb5_creds *mcreds)
 569 {
 570     krb5_error_code ret;
 571     struct kcm_creds **c;
 572
 573     ret = KRB5_CC_NOTFOUND;
 574
 575     for (c = &ccache->creds; *c != NULL; c = &(*c)->next) {
 576         if (krb5_compare_creds(context, whichfields, mcreds, &(*c)->cred)) {
 577             struct kcm_creds *cred = *c;
 578
 579             *c = cred->next;
 580             krb5_free_cred_contents(context, &cred->cred);
 581             free(cred);
 582             ret = 0;
 583             if (*c == NULL)
 584                 break;
 585         }
 586     }
 587
 588     return ret;
 589 }
 590
 591 krb5_error_code
 592 kcm_ccache_remove_cred(krb5_context context,
 593                        kcm_ccache ccache,
 594                        krb5_flags whichfields,
 595                        const krb5_creds *mcreds)
 596 {
 597     krb5_error_code ret;
 598
 599     KCM_ASSERT_VALID(ccache);
 600
 601     HEIMDAL_MUTEX_lock(&ccache->mutex);
 602     ret = kcm_ccache_remove_cred_internal(context, ccache, whichfields, mcreds);
 603     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 604
 605     return ret;
 606 }
 607
 608 krb5_error_code
 609 kcm_ccache_retrieve_cred_internal(krb5_context context,
 610                                   kcm_ccache ccache,
 611                                   krb5_flags whichfields,
 612                                   const krb5_creds *mcreds,
 613                                   krb5_creds **creds)
 614 {
 615     krb5_boolean match;
 616     struct kcm_creds *c;
 617     krb5_error_code ret;
 618
 619     memset(creds, 0, sizeof(*creds));
 620
 621     ret = KRB5_CC_END;
 622
 623     match = FALSE;
 624     for (c = ccache->creds; c != NULL; c = c->next) {
 625         match = krb5_compare_creds(context, whichfields, mcreds, &c->cred);
 626         if (match)
 627             break;
 628     }
 629
 630     if (match) {
 631         ret = 0;
 632         *creds = &c->cred;
 633     }
 634
 635     return ret;
 636 }
 637
 638 krb5_error_code
 639 kcm_ccache_retrieve_cred(krb5_context context,
 640                          kcm_ccache ccache,
 641                          krb5_flags whichfields,
 642                          const krb5_creds *mcreds,
 643                          krb5_creds **credp)
 644 {
 645     krb5_error_code ret;
 646
 647     KCM_ASSERT_VALID(ccache);
 648
 649     HEIMDAL_MUTEX_lock(&ccache->mutex);
 650     ret = kcm_ccache_retrieve_cred_internal(context, ccache,
 651                                             whichfields, mcreds, credp);
 652     HEIMDAL_MUTEX_unlock(&ccache->mutex);
 653
 654     return ret;
 655 }
 656
 657 char *
 658 kcm_ccache_first_name(kcm_client *client)
 659 {
 660     kcm_ccache p;
 661     char *name = NULL;
 662
 663     HEIMDAL_MUTEX_lock(&ccache_mutex);
 664
 665     for (p = ccache_head; p != NULL; p = p->next) {
 666         if (kcm_is_same_session(client, p->uid, p->session))
 667             break;
 668     }
 669     if (p)
 670         name = strdup(p->name);
 671     HEIMDAL_MUTEX_unlock(&ccache_mutex);
 672     return name;
 673 }