2 * Copyright (c) 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
40 typedef struct krb5_scache
{
49 sqlite3_stmt
*iprincipal
;
52 sqlite3_stmt
*ucachen
;
53 sqlite3_stmt
*ucachep
;
56 sqlite3_stmt
*scache_name
;
57 sqlite3_stmt
*umaster
;
61 #define SCACHE(X) ((krb5_scache *)(X)->data.data)
63 #define SCACHE_DEF_NAME "Default-cache"
64 #ifdef KRB5_USE_PATH_TOKENS
65 #define KRB5_SCACHE_DB "%{TEMP}/krb5scc_%{uid}"
67 #define KRB5_SCACHE_DB "/tmp/krb5scc_%{uid}"
69 #define KRB5_SCACHE_NAME "SCC:" SCACHE_DEF_NAME ":" KRB5_SCACHE_DB
71 #define SCACHE_INVALID_CID ((sqlite_uint64)-1)
77 #define SQL_CMASTER "" \
78 "CREATE TABLE master (" \
79 "oid INTEGER PRIMARY KEY," \
80 "version INTEGER NOT NULL," \
81 "defaultcache TEXT NOT NULL" \
84 #define SQL_SETUP_MASTER \
85 "INSERT INTO master (version,defaultcache) VALUES(2, \"" SCACHE_DEF_NAME "\")"
86 #define SQL_UMASTER "UPDATE master SET defaultcache=? WHERE version=2"
88 #define SQL_CCACHE "" \
89 "CREATE TABLE caches (" \
90 "oid INTEGER PRIMARY KEY," \
92 "name TEXT NOT NULL" \
95 #define SQL_TCACHE "" \
96 "CREATE TRIGGER CacheDropCreds AFTER DELETE ON caches " \
97 "FOR EACH ROW BEGIN " \
98 "DELETE FROM credentials WHERE cid=old.oid;" \
101 #define SQL_ICACHE "INSERT INTO caches (name) VALUES(?)"
102 #define SQL_UCACHE_NAME "UPDATE caches SET name=? WHERE OID=?"
103 #define SQL_UCACHE_PRINCIPAL "UPDATE caches SET principal=? WHERE OID=?"
104 #define SQL_DCACHE "DELETE FROM caches WHERE OID=?"
105 #define SQL_SCACHE "SELECT principal,name FROM caches WHERE OID=?"
106 #define SQL_SCACHE_NAME "SELECT oid FROM caches WHERE NAME=?"
108 #define SQL_CCREDS "" \
109 "CREATE TABLE credentials (" \
110 "oid INTEGER PRIMARY KEY," \
111 "cid INTEGER NOT NULL," \
112 "kvno INTEGER NOT NULL," \
113 "etype INTEGER NOT NULL," \
114 "created_at INTEGER NOT NULL," \
115 "cred BLOB NOT NULL" \
118 #define SQL_TCRED "" \
119 "CREATE TRIGGER credDropPrincipal AFTER DELETE ON credentials " \
120 "FOR EACH ROW BEGIN " \
121 "DELETE FROM principals WHERE credential_id=old.oid;" \
124 #define SQL_ICRED "INSERT INTO credentials (cid, kvno, etype, cred, created_at) VALUES (?,?,?,?,?)"
125 #define SQL_DCRED "DELETE FROM credentials WHERE cid=?"
127 #define SQL_CPRINCIPALS "" \
128 "CREATE TABLE principals (" \
129 "oid INTEGER PRIMARY KEY," \
130 "principal TEXT NOT NULL," \
131 "type INTEGER NOT NULL," \
132 "credential_id INTEGER NOT NULL" \
135 #define SQL_IPRINCIPAL "INSERT INTO principals (principal, type, credential_id) VALUES (?,?,?)"
142 free_data(void *data
)
154 scc_free(krb5_scache
*s
)
162 sqlite3_finalize(s
->icred
);
164 sqlite3_finalize(s
->dcred
);
166 sqlite3_finalize(s
->iprincipal
);
168 sqlite3_finalize(s
->icache
);
170 sqlite3_finalize(s
->ucachen
);
172 sqlite3_finalize(s
->ucachep
);
174 sqlite3_finalize(s
->dcache
);
176 sqlite3_finalize(s
->scache
);
178 sqlite3_finalize(s
->scache_name
);
180 sqlite3_finalize(s
->umaster
);
183 sqlite3_close(s
->db
);
189 trace(void* ptr
, const char * str
)
191 printf("SQL: %s\n", str
);
195 static krb5_error_code
196 prepare_stmt(krb5_context context
, sqlite3
*db
,
197 sqlite3_stmt
**stmt
, const char *str
)
201 ret
= sqlite3_prepare_v2(db
, str
, -1, stmt
, NULL
);
202 if (ret
!= SQLITE_OK
) {
203 krb5_set_error_message(context
, ENOENT
,
204 N_("Failed to prepare stmt %s: %s", ""),
205 str
, sqlite3_errmsg(db
));
211 static krb5_error_code
212 exec_stmt(krb5_context context
, sqlite3
*db
, const char *str
,
213 krb5_error_code code
)
217 ret
= sqlite3_exec(db
, str
, NULL
, NULL
, NULL
);
218 if (ret
!= SQLITE_OK
&& code
) {
219 krb5_set_error_message(context
, code
,
220 N_("scache execute %s: %s", ""), str
,
227 static krb5_error_code
228 default_db(krb5_context context
, sqlite3
**db
)
233 ret
= _krb5_expand_default_cc_name(context
, KRB5_SCACHE_DB
, &name
);
237 ret
= sqlite3_open_v2(name
, db
, SQLITE_OPEN_READWRITE
, NULL
);
239 if (ret
!= SQLITE_OK
) {
240 krb5_clear_error_message(context
);
245 sqlite3_trace(*db
, trace
, NULL
);
251 static krb5_error_code
252 get_def_name(krb5_context context
, char **str
)
259 ret
= default_db(context
, &db
);
263 ret
= prepare_stmt(context
, db
, &stmt
, "SELECT defaultcache FROM master");
269 ret
= sqlite3_step(stmt
);
270 if (ret
!= SQLITE_ROW
)
273 if (sqlite3_column_type(stmt
, 0) != SQLITE_TEXT
)
276 name
= (const char *)sqlite3_column_text(stmt
, 0);
284 sqlite3_finalize(stmt
);
288 sqlite3_finalize(stmt
);
290 krb5_clear_error_message(context
);
296 static krb5_scache
* KRB5_CALLCONV
297 scc_alloc(krb5_context context
, const char *name
)
306 s
->cid
= SCACHE_INVALID_CID
;
312 ret
= get_def_name(context
, &s
->name
);
314 s
->name
= strdup(SCACHE_DEF_NAME
);
316 s
->name
= strdup(name
);
318 file
= strrchr(s
->name
, ':');
321 s
->file
= strdup(file
);
324 ret
= _krb5_expand_default_cc_name(context
, KRB5_SCACHE_DB
, &s
->file
);
327 _krb5_expand_default_cc_name(context
, KRB5_SCACHE_DB
, &s
->file
);
328 ret
= asprintf(&s
->name
, "unique-%p", s
);
330 if (ret
< 0 || s
->file
== NULL
|| s
->name
== NULL
) {
338 static krb5_error_code
339 open_database(krb5_context context
, krb5_scache
*s
, int flags
)
343 ret
= sqlite3_open_v2(s
->file
, &s
->db
, SQLITE_OPEN_READWRITE
|flags
, NULL
);
346 krb5_set_error_message(context
, ENOENT
,
347 N_("Error opening scache file %s: %s", ""),
348 s
->file
, sqlite3_errmsg(s
->db
));
349 sqlite3_close(s
->db
);
352 krb5_set_error_message(context
, ENOENT
,
353 N_("malloc: out of memory", ""));
359 static krb5_error_code
360 create_cache(krb5_context context
, krb5_scache
*s
)
364 sqlite3_bind_text(s
->icache
, 1, s
->name
, -1, NULL
);
366 ret
= sqlite3_step(s
->icache
);
367 } while (ret
== SQLITE_ROW
);
368 if (ret
!= SQLITE_DONE
) {
369 krb5_set_error_message(context
, KRB5_CC_IO
,
370 N_("Failed to add scache: %d", ""), ret
);
373 sqlite3_reset(s
->icache
);
375 s
->cid
= sqlite3_last_insert_rowid(s
->db
);
380 static krb5_error_code
381 make_database(krb5_context context
, krb5_scache
*s
)
383 int created_file
= 0;
389 ret
= open_database(context
, s
, 0);
391 mode_t oldumask
= umask(077);
392 ret
= open_database(context
, s
, SQLITE_OPEN_CREATE
);
398 ret
= exec_stmt(context
, s
->db
, SQL_CMASTER
, KRB5_CC_IO
);
400 ret
= exec_stmt(context
, s
->db
, SQL_CCACHE
, KRB5_CC_IO
);
402 ret
= exec_stmt(context
, s
->db
, SQL_CCREDS
, KRB5_CC_IO
);
404 ret
= exec_stmt(context
, s
->db
, SQL_CPRINCIPALS
, KRB5_CC_IO
);
406 ret
= exec_stmt(context
, s
->db
, SQL_SETUP_MASTER
, KRB5_CC_IO
);
409 ret
= exec_stmt(context
, s
->db
, SQL_TCACHE
, KRB5_CC_IO
);
411 ret
= exec_stmt(context
, s
->db
, SQL_TCRED
, KRB5_CC_IO
);
416 sqlite3_trace(s
->db
, trace
, NULL
);
419 ret
= prepare_stmt(context
, s
->db
, &s
->icred
, SQL_ICRED
);
421 ret
= prepare_stmt(context
, s
->db
, &s
->dcred
, SQL_DCRED
);
423 ret
= prepare_stmt(context
, s
->db
, &s
->iprincipal
, SQL_IPRINCIPAL
);
425 ret
= prepare_stmt(context
, s
->db
, &s
->icache
, SQL_ICACHE
);
427 ret
= prepare_stmt(context
, s
->db
, &s
->ucachen
, SQL_UCACHE_NAME
);
429 ret
= prepare_stmt(context
, s
->db
, &s
->ucachep
, SQL_UCACHE_PRINCIPAL
);
431 ret
= prepare_stmt(context
, s
->db
, &s
->dcache
, SQL_DCACHE
);
433 ret
= prepare_stmt(context
, s
->db
, &s
->scache
, SQL_SCACHE
);
435 ret
= prepare_stmt(context
, s
->db
, &s
->scache_name
, SQL_SCACHE_NAME
);
437 ret
= prepare_stmt(context
, s
->db
, &s
->umaster
, SQL_UMASTER
);
444 sqlite3_close(s
->db
);
451 static krb5_error_code
452 bind_principal(krb5_context context
,
456 krb5_const_principal principal
)
461 ret
= krb5_unparse_name(context
, principal
, &str
);
465 ret
= sqlite3_bind_text(stmt
, col
, str
, -1, free_krb5
);
466 if (ret
!= SQLITE_OK
) {
468 krb5_set_error_message(context
, ENOMEM
,
469 N_("scache bind principal: %s", ""),
480 static const char* KRB5_CALLCONV
481 scc_get_name(krb5_context context
,
484 return SCACHE(id
)->name
;
487 static krb5_error_code KRB5_CALLCONV
488 scc_resolve(krb5_context context
, krb5_ccache
*id
, const char *res
)
493 s
= scc_alloc(context
, res
);
495 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
496 N_("malloc: out of memory", ""));
497 return KRB5_CC_NOMEM
;
500 ret
= make_database(context
, s
);
506 ret
= sqlite3_bind_text(s
->scache_name
, 1, s
->name
, -1, NULL
);
507 if (ret
!= SQLITE_OK
) {
508 krb5_set_error_message(context
, ENOMEM
,
509 "bind name: %s", sqlite3_errmsg(s
->db
));
514 if (sqlite3_step(s
->scache_name
) == SQLITE_ROW
) {
516 if (sqlite3_column_type(s
->scache_name
, 0) != SQLITE_INTEGER
) {
517 sqlite3_reset(s
->scache_name
);
518 krb5_set_error_message(context
, KRB5_CC_END
,
519 N_("Cache name of wrong type "
520 "for scache %s", ""),
526 s
->cid
= sqlite3_column_int(s
->scache_name
, 0);
528 s
->cid
= SCACHE_INVALID_CID
;
530 sqlite3_reset(s
->scache_name
);
532 (*id
)->data
.data
= s
;
533 (*id
)->data
.length
= sizeof(*s
);
538 static krb5_error_code KRB5_CALLCONV
539 scc_gen_new(krb5_context context
, krb5_ccache
*id
)
543 s
= scc_alloc(context
, NULL
);
546 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
547 N_("malloc: out of memory", ""));
548 return KRB5_CC_NOMEM
;
551 (*id
)->data
.data
= s
;
552 (*id
)->data
.length
= sizeof(*s
);
557 static krb5_error_code KRB5_CALLCONV
558 scc_initialize(krb5_context context
,
560 krb5_principal primary_principal
)
562 krb5_scache
*s
= SCACHE(id
);
565 ret
= make_database(context
, s
);
569 ret
= exec_stmt(context
, s
->db
, "BEGIN IMMEDIATE TRANSACTION", KRB5_CC_IO
);
572 if (s
->cid
== SCACHE_INVALID_CID
) {
573 ret
= create_cache(context
, s
);
577 sqlite3_bind_int(s
->dcred
, 1, s
->cid
);
579 ret
= sqlite3_step(s
->dcred
);
580 } while (ret
== SQLITE_ROW
);
581 sqlite3_reset(s
->dcred
);
582 if (ret
!= SQLITE_DONE
) {
584 krb5_set_error_message(context
, ret
,
585 N_("Failed to delete old "
586 "credentials: %s", ""),
587 sqlite3_errmsg(s
->db
));
592 ret
= bind_principal(context
, s
->db
, s
->ucachep
, 1, primary_principal
);
595 sqlite3_bind_int(s
->ucachep
, 2, s
->cid
);
598 ret
= sqlite3_step(s
->ucachep
);
599 } while (ret
== SQLITE_ROW
);
600 sqlite3_reset(s
->ucachep
);
601 if (ret
!= SQLITE_DONE
) {
603 krb5_set_error_message(context
, ret
,
604 N_("Failed to bind principal to cache %s", ""),
605 sqlite3_errmsg(s
->db
));
609 ret
= exec_stmt(context
, s
->db
, "COMMIT", KRB5_CC_IO
);
615 exec_stmt(context
, s
->db
, "ROLLBACK", 0);
621 static krb5_error_code KRB5_CALLCONV
622 scc_close(krb5_context context
,
625 scc_free(SCACHE(id
));
629 static krb5_error_code KRB5_CALLCONV
630 scc_destroy(krb5_context context
,
633 krb5_scache
*s
= SCACHE(id
);
636 if (s
->cid
== SCACHE_INVALID_CID
)
639 sqlite3_bind_int(s
->dcache
, 1, s
->cid
);
641 ret
= sqlite3_step(s
->dcache
);
642 } while (ret
== SQLITE_ROW
);
643 sqlite3_reset(s
->dcache
);
644 if (ret
!= SQLITE_DONE
) {
645 krb5_set_error_message(context
, KRB5_CC_IO
,
646 N_("Failed to destroy cache %s: %s", ""),
647 s
->name
, sqlite3_errmsg(s
->db
));
653 static krb5_error_code
654 encode_creds(krb5_context context
, krb5_creds
*creds
, krb5_data
*data
)
659 sp
= krb5_storage_emem();
661 return krb5_enomem(context
);
663 ret
= krb5_store_creds(sp
, creds
);
665 krb5_set_error_message(context
, ret
,
666 N_("Failed to store credential in scache", ""));
667 krb5_storage_free(sp
);
671 ret
= krb5_storage_to_data(sp
, data
);
672 krb5_storage_free(sp
);
674 krb5_set_error_message(context
, ret
,
675 N_("Failed to encode credential in scache", ""));
679 static krb5_error_code
680 decode_creds(krb5_context context
, const void *data
, size_t length
,
686 sp
= krb5_storage_from_readonly_mem(data
, length
);
688 return krb5_enomem(context
);
690 ret
= krb5_ret_creds(sp
, creds
);
691 krb5_storage_free(sp
);
693 krb5_set_error_message(context
, ret
,
694 N_("Failed to read credential in scache", ""));
701 static krb5_error_code KRB5_CALLCONV
702 scc_store_cred(krb5_context context
,
706 sqlite_uint64 credid
;
707 krb5_scache
*s
= SCACHE(id
);
711 ret
= make_database(context
, s
);
715 ret
= encode_creds(context
, creds
, &data
);
719 sqlite3_bind_int(s
->icred
, 1, s
->cid
);
721 krb5_enctype etype
= 0;
726 ret
= decode_Ticket(creds
->ticket
.data
,
727 creds
->ticket
.length
, &t
, &len
);
730 kvno
= *t
.enc_part
.kvno
;
732 etype
= t
.enc_part
.etype
;
737 sqlite3_bind_int(s
->icred
, 2, kvno
);
738 sqlite3_bind_int(s
->icred
, 3, etype
);
742 sqlite3_bind_blob(s
->icred
, 4, data
.data
, data
.length
, free_data
);
743 sqlite3_bind_int(s
->icred
, 5, time(NULL
));
745 ret
= exec_stmt(context
, s
->db
, "BEGIN IMMEDIATE TRANSACTION", KRB5_CC_IO
);
749 ret
= sqlite3_step(s
->icred
);
750 } while (ret
== SQLITE_ROW
);
751 sqlite3_reset(s
->icred
);
752 if (ret
!= SQLITE_DONE
) {
754 krb5_set_error_message(context
, ret
,
755 N_("Failed to add credential: %s", ""),
756 sqlite3_errmsg(s
->db
));
760 credid
= sqlite3_last_insert_rowid(s
->db
);
763 bind_principal(context
, s
->db
, s
->iprincipal
, 1, creds
->server
);
764 sqlite3_bind_int(s
->iprincipal
, 2, 1);
765 sqlite3_bind_int(s
->iprincipal
, 3, credid
);
768 ret
= sqlite3_step(s
->iprincipal
);
769 } while (ret
== SQLITE_ROW
);
770 sqlite3_reset(s
->iprincipal
);
771 if (ret
!= SQLITE_DONE
) {
773 krb5_set_error_message(context
, ret
,
774 N_("Failed to add principal: %s", ""),
775 sqlite3_errmsg(s
->db
));
781 bind_principal(context
, s
->db
, s
->iprincipal
, 1, creds
->client
);
782 sqlite3_bind_int(s
->iprincipal
, 2, 0);
783 sqlite3_bind_int(s
->iprincipal
, 3, credid
);
786 ret
= sqlite3_step(s
->iprincipal
);
787 } while (ret
== SQLITE_ROW
);
788 sqlite3_reset(s
->iprincipal
);
789 if (ret
!= SQLITE_DONE
) {
791 krb5_set_error_message(context
, ret
,
792 N_("Failed to add principal: %s", ""),
793 sqlite3_errmsg(s
->db
));
798 ret
= exec_stmt(context
, s
->db
, "COMMIT", KRB5_CC_IO
);
804 exec_stmt(context
, s
->db
, "ROLLBACK", 0);
809 static krb5_error_code KRB5_CALLCONV
810 scc_get_principal(krb5_context context
,
812 krb5_principal
*principal
)
814 krb5_scache
*s
= SCACHE(id
);
820 ret
= make_database(context
, s
);
824 sqlite3_bind_int(s
->scache
, 1, s
->cid
);
826 if (sqlite3_step(s
->scache
) != SQLITE_ROW
) {
827 sqlite3_reset(s
->scache
);
828 krb5_set_error_message(context
, KRB5_CC_END
,
829 N_("No principal for cache SCC:%s:%s", ""),
834 if (sqlite3_column_type(s
->scache
, 0) != SQLITE_TEXT
) {
835 sqlite3_reset(s
->scache
);
836 krb5_set_error_message(context
, KRB5_CC_END
,
837 N_("Principal data of wrong type "
838 "for SCC:%s:%s", ""),
843 str
= (const char *)sqlite3_column_text(s
->scache
, 0);
845 sqlite3_reset(s
->scache
);
846 krb5_set_error_message(context
, KRB5_CC_END
,
847 N_("Principal not set for SCC:%s:%s", ""),
852 ret
= krb5_parse_name(context
, str
, principal
);
854 sqlite3_reset(s
->scache
);
862 sqlite3_stmt
*credstmt
;
865 static krb5_error_code KRB5_CALLCONV
866 scc_get_first (krb5_context context
,
868 krb5_cc_cursor
*cursor
)
870 krb5_scache
*s
= SCACHE(id
);
872 struct cred_ctx
*ctx
;
873 char *str
= NULL
, *name
= NULL
;
877 ctx
= calloc(1, sizeof(*ctx
));
879 return krb5_enomem(context
);
881 ret
= make_database(context
, s
);
887 if (s
->cid
== SCACHE_INVALID_CID
) {
888 krb5_set_error_message(context
, KRB5_CC_END
,
889 N_("Iterating a invalid scache %s", ""),
895 ret
= asprintf(&name
, "credIteration%pPid%d",
897 if (ret
< 0 || name
== NULL
) {
899 return krb5_enomem(context
);
902 ret
= asprintf(&ctx
->drop
, "DROP TABLE %s", name
);
903 if (ret
< 0 || ctx
->drop
== NULL
) {
906 return krb5_enomem(context
);
909 ret
= asprintf(&str
, "CREATE TEMPORARY TABLE %s "
910 "AS SELECT oid,created_at FROM credentials WHERE cid = %lu",
911 name
, (unsigned long)s
->cid
);
912 if (ret
< 0 || str
== NULL
) {
916 return krb5_enomem(context
);
919 ret
= exec_stmt(context
, s
->db
, str
, KRB5_CC_IO
);
929 ret
= asprintf(&str
, "SELECT oid FROM %s ORDER BY created_at", name
);
930 if (ret
< 0 || str
== NULL
) {
931 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
938 ret
= prepare_stmt(context
, s
->db
, &ctx
->stmt
, str
);
943 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
949 ret
= prepare_stmt(context
, s
->db
, &ctx
->credstmt
,
950 "SELECT cred FROM credentials WHERE oid = ?");
952 sqlite3_finalize(ctx
->stmt
);
953 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
964 static krb5_error_code KRB5_CALLCONV
965 scc_get_next (krb5_context context
,
967 krb5_cc_cursor
*cursor
,
970 struct cred_ctx
*ctx
= *cursor
;
971 krb5_scache
*s
= SCACHE(id
);
974 const void *data
= NULL
;
978 ret
= sqlite3_step(ctx
->stmt
);
979 if (ret
== SQLITE_DONE
) {
980 krb5_clear_error_message(context
);
982 } else if (ret
!= SQLITE_ROW
) {
983 krb5_set_error_message(context
, KRB5_CC_IO
,
984 N_("scache Database failed: %s", ""),
985 sqlite3_errmsg(s
->db
));
989 oid
= sqlite3_column_int64(ctx
->stmt
, 0);
991 /* read cred from credentials table */
993 sqlite3_bind_int(ctx
->credstmt
, 1, oid
);
995 ret
= sqlite3_step(ctx
->credstmt
);
996 if (ret
!= SQLITE_ROW
) {
997 sqlite3_reset(ctx
->credstmt
);
1001 if (sqlite3_column_type(ctx
->credstmt
, 0) != SQLITE_BLOB
) {
1002 krb5_set_error_message(context
, KRB5_CC_END
,
1003 N_("credential of wrong type for SCC:%s:%s", ""),
1005 sqlite3_reset(ctx
->credstmt
);
1009 data
= sqlite3_column_blob(ctx
->credstmt
, 0);
1010 len
= sqlite3_column_bytes(ctx
->credstmt
, 0);
1012 ret
= decode_creds(context
, data
, len
, creds
);
1013 sqlite3_reset(ctx
->credstmt
);
1017 static krb5_error_code KRB5_CALLCONV
1018 scc_end_get (krb5_context context
,
1020 krb5_cc_cursor
*cursor
)
1022 struct cred_ctx
*ctx
= *cursor
;
1023 krb5_scache
*s
= SCACHE(id
);
1025 sqlite3_finalize(ctx
->stmt
);
1026 sqlite3_finalize(ctx
->credstmt
);
1028 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
1036 static krb5_error_code KRB5_CALLCONV
1037 scc_remove_cred(krb5_context context
,
1042 krb5_scache
*s
= SCACHE(id
);
1043 krb5_error_code ret
;
1045 sqlite_uint64 credid
= 0;
1046 const void *data
= NULL
;
1049 ret
= make_database(context
, s
);
1053 ret
= prepare_stmt(context
, s
->db
, &stmt
,
1054 "SELECT cred,oid FROM credentials "
1059 sqlite3_bind_int(stmt
, 1, s
->cid
);
1061 /* find credential... */
1065 ret
= sqlite3_step(stmt
);
1066 if (ret
== SQLITE_DONE
) {
1069 } else if (ret
!= SQLITE_ROW
) {
1071 krb5_set_error_message(context
, ret
,
1072 N_("scache Database failed: %s", ""),
1073 sqlite3_errmsg(s
->db
));
1077 if (sqlite3_column_type(stmt
, 0) != SQLITE_BLOB
) {
1079 krb5_set_error_message(context
, ret
,
1080 N_("Credential of wrong type "
1081 "for SCC:%s:%s", ""),
1086 data
= sqlite3_column_blob(stmt
, 0);
1087 len
= sqlite3_column_bytes(stmt
, 0);
1089 ret
= decode_creds(context
, data
, len
, &creds
);
1093 ret
= krb5_compare_creds(context
, which
, mcreds
, &creds
);
1094 krb5_free_cred_contents(context
, &creds
);
1096 credid
= sqlite3_column_int64(stmt
, 1);
1102 sqlite3_finalize(stmt
);
1105 ret
= prepare_stmt(context
, s
->db
, &stmt
,
1106 "DELETE FROM credentials WHERE oid=?");
1109 sqlite3_bind_int(stmt
, 1, credid
);
1112 ret
= sqlite3_step(stmt
);
1113 } while (ret
== SQLITE_ROW
);
1114 sqlite3_finalize(stmt
);
1115 if (ret
!= SQLITE_DONE
) {
1117 krb5_set_error_message(context
, ret
,
1118 N_("failed to delete scache credental", ""));
1126 static krb5_error_code KRB5_CALLCONV
1127 scc_set_flags(krb5_context context
,
1140 static krb5_error_code KRB5_CALLCONV
1141 scc_get_cache_first(krb5_context context
, krb5_cc_cursor
*cursor
)
1143 struct cache_iter
*ctx
;
1144 krb5_error_code ret
;
1145 char *name
= NULL
, *str
= NULL
;
1149 ctx
= calloc(1, sizeof(*ctx
));
1151 return krb5_enomem(context
);
1153 ret
= default_db(context
, &ctx
->db
);
1154 if (ctx
->db
== NULL
) {
1159 ret
= asprintf(&name
, "cacheIteration%pPid%d",
1160 ctx
, (int)getpid());
1161 if (ret
< 0 || name
== NULL
) {
1162 sqlite3_close(ctx
->db
);
1164 return krb5_enomem(context
);
1167 ret
= asprintf(&ctx
->drop
, "DROP TABLE %s", name
);
1168 if (ret
< 0 || ctx
->drop
== NULL
) {
1169 sqlite3_close(ctx
->db
);
1172 return krb5_enomem(context
);
1175 ret
= asprintf(&str
, "CREATE TEMPORARY TABLE %s AS SELECT name FROM caches",
1177 if (ret
< 0 || str
== NULL
) {
1178 sqlite3_close(ctx
->db
);
1182 return krb5_enomem(context
);
1185 ret
= exec_stmt(context
, ctx
->db
, str
, KRB5_CC_IO
);
1189 sqlite3_close(ctx
->db
);
1196 ret
= asprintf(&str
, "SELECT name FROM %s", name
);
1198 if (ret
< 0 || str
== NULL
) {
1199 exec_stmt(context
, ctx
->db
, ctx
->drop
, 0);
1200 sqlite3_close(ctx
->db
);
1204 return krb5_enomem(context
);
1207 ret
= prepare_stmt(context
, ctx
->db
, &ctx
->stmt
, str
);
1210 exec_stmt(context
, ctx
->db
, ctx
->drop
, 0);
1211 sqlite3_close(ctx
->db
);
1222 static krb5_error_code KRB5_CALLCONV
1223 scc_get_cache_next(krb5_context context
,
1224 krb5_cc_cursor cursor
,
1227 struct cache_iter
*ctx
= cursor
;
1228 krb5_error_code ret
;
1232 ret
= sqlite3_step(ctx
->stmt
);
1233 if (ret
== SQLITE_DONE
) {
1234 krb5_clear_error_message(context
);
1236 } else if (ret
!= SQLITE_ROW
) {
1237 krb5_set_error_message(context
, KRB5_CC_IO
,
1238 N_("Database failed: %s", ""),
1239 sqlite3_errmsg(ctx
->db
));
1243 if (sqlite3_column_type(ctx
->stmt
, 0) != SQLITE_TEXT
)
1246 name
= (const char *)sqlite3_column_text(ctx
->stmt
, 0);
1250 ret
= _krb5_cc_allocate(context
, &krb5_scc_ops
, id
);
1254 return scc_resolve(context
, id
, name
);
1257 static krb5_error_code KRB5_CALLCONV
1258 scc_end_cache_get(krb5_context context
, krb5_cc_cursor cursor
)
1260 struct cache_iter
*ctx
= cursor
;
1262 exec_stmt(context
, ctx
->db
, ctx
->drop
, 0);
1263 sqlite3_finalize(ctx
->stmt
);
1264 sqlite3_close(ctx
->db
);
1270 static krb5_error_code KRB5_CALLCONV
1271 scc_move(krb5_context context
, krb5_ccache from
, krb5_ccache to
)
1273 krb5_scache
*sfrom
= SCACHE(from
);
1274 krb5_scache
*sto
= SCACHE(to
);
1275 krb5_error_code ret
;
1277 if (strcmp(sfrom
->file
, sto
->file
) != 0) {
1278 krb5_set_error_message(context
, KRB5_CC_BADNAME
,
1279 N_("Can't handle cross database "
1280 "credential move: %s -> %s", ""),
1281 sfrom
->file
, sto
->file
);
1282 return KRB5_CC_BADNAME
;
1285 ret
= make_database(context
, sfrom
);
1289 ret
= exec_stmt(context
, sfrom
->db
,
1290 "BEGIN IMMEDIATE TRANSACTION", KRB5_CC_IO
);
1291 if (ret
) return ret
;
1293 if (sto
->cid
!= SCACHE_INVALID_CID
) {
1294 /* drop old cache entry */
1296 sqlite3_bind_int(sfrom
->dcache
, 1, sto
->cid
);
1298 ret
= sqlite3_step(sfrom
->dcache
);
1299 } while (ret
== SQLITE_ROW
);
1300 sqlite3_reset(sfrom
->dcache
);
1301 if (ret
!= SQLITE_DONE
) {
1302 krb5_set_error_message(context
, KRB5_CC_IO
,
1303 N_("Failed to delete old cache: %d", ""),
1309 sqlite3_bind_text(sfrom
->ucachen
, 1, sto
->name
, -1, NULL
);
1310 sqlite3_bind_int(sfrom
->ucachen
, 2, sfrom
->cid
);
1313 ret
= sqlite3_step(sfrom
->ucachen
);
1314 } while (ret
== SQLITE_ROW
);
1315 sqlite3_reset(sfrom
->ucachen
);
1316 if (ret
!= SQLITE_DONE
) {
1317 krb5_set_error_message(context
, KRB5_CC_IO
,
1318 N_("Failed to update new cache: %d", ""),
1323 sto
->cid
= sfrom
->cid
;
1325 ret
= exec_stmt(context
, sfrom
->db
, "COMMIT", KRB5_CC_IO
);
1326 if (ret
) return ret
;
1333 exec_stmt(context
, sfrom
->db
, "ROLLBACK", 0);
1339 static krb5_error_code KRB5_CALLCONV
1340 scc_get_default_name(krb5_context context
, char **str
)
1342 krb5_error_code ret
;
1347 ret
= get_def_name(context
, &name
);
1349 return _krb5_expand_default_cc_name(context
, KRB5_SCACHE_NAME
, str
);
1351 ret
= asprintf(str
, "SCC:%s", name
);
1353 if (ret
< 0 || *str
== NULL
)
1354 return krb5_enomem(context
);
1358 static krb5_error_code KRB5_CALLCONV
1359 scc_set_default(krb5_context context
, krb5_ccache id
)
1361 krb5_scache
*s
= SCACHE(id
);
1362 krb5_error_code ret
;
1364 if (s
->cid
== SCACHE_INVALID_CID
) {
1365 krb5_set_error_message(context
, KRB5_CC_IO
,
1366 N_("Trying to set a invalid cache "
1367 "as default %s", ""),
1372 ret
= sqlite3_bind_text(s
->umaster
, 1, s
->name
, -1, NULL
);
1374 sqlite3_reset(s
->umaster
);
1375 krb5_set_error_message(context
, KRB5_CC_IO
,
1376 N_("Failed to set name of default cache", ""));
1381 ret
= sqlite3_step(s
->umaster
);
1382 } while (ret
== SQLITE_ROW
);
1383 sqlite3_reset(s
->umaster
);
1384 if (ret
!= SQLITE_DONE
) {
1385 krb5_set_error_message(context
, KRB5_CC_IO
,
1386 N_("Failed to update default cache", ""));
1394 * Variable containing the SCC based credential cache implemention.
1396 * @ingroup krb5_ccache
1399 KRB5_LIB_VARIABLE
const krb5_cc_ops krb5_scc_ops
= {
1400 KRB5_CC_OPS_VERSION
,
1409 NULL
, /* scc_retrieve */
1417 scc_get_cache_first
,
1421 scc_get_default_name
,