2 * Copyright (c) 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
40 typedef struct krb5_scache
{
49 sqlite3_stmt
*iprincipal
;
52 sqlite3_stmt
*ucachen
;
53 sqlite3_stmt
*ucachep
;
56 sqlite3_stmt
*scache_name
;
57 sqlite3_stmt
*umaster
;
61 #define SCACHE(X) ((krb5_scache *)(X)->data.data)
63 #define SCACHE_DEF_NAME "Default-cache"
64 #ifdef KRB5_USE_PATH_TOKENS
65 #define KRB5_SCACHE_DB "%{TEMP}/krb5scc_%{uid}"
67 #define KRB5_SCACHE_DB "/tmp/krb5scc_%{uid}"
69 #define KRB5_SCACHE_NAME "SCC:" SCACHE_DEF_NAME ":" KRB5_SCACHE_DB
71 #define SCACHE_INVALID_CID ((sqlite_uint64)-1)
77 #define SQL_CMASTER "" \
78 "CREATE TABLE master (" \
79 "oid INTEGER PRIMARY KEY," \
80 "version INTEGER NOT NULL," \
81 "defaultcache TEXT NOT NULL" \
84 #define SQL_SETUP_MASTER \
85 "INSERT INTO master (version,defaultcache) VALUES(2, \"" SCACHE_DEF_NAME "\")"
86 #define SQL_UMASTER "UPDATE master SET defaultcache=? WHERE version=2"
88 #define SQL_CCACHE "" \
89 "CREATE TABLE caches (" \
90 "oid INTEGER PRIMARY KEY," \
92 "name TEXT NOT NULL" \
95 #define SQL_TCACHE "" \
96 "CREATE TRIGGER CacheDropCreds AFTER DELETE ON caches " \
97 "FOR EACH ROW BEGIN " \
98 "DELETE FROM credentials WHERE cid=old.oid;" \
101 #define SQL_ICACHE "INSERT INTO caches (name) VALUES(?)"
102 #define SQL_UCACHE_NAME "UPDATE caches SET name=? WHERE OID=?"
103 #define SQL_UCACHE_PRINCIPAL "UPDATE caches SET principal=? WHERE OID=?"
104 #define SQL_DCACHE "DELETE FROM caches WHERE OID=?"
105 #define SQL_SCACHE "SELECT principal,name FROM caches WHERE OID=?"
106 #define SQL_SCACHE_NAME "SELECT oid FROM caches WHERE NAME=?"
108 #define SQL_CCREDS "" \
109 "CREATE TABLE credentials (" \
110 "oid INTEGER PRIMARY KEY," \
111 "cid INTEGER NOT NULL," \
112 "kvno INTEGER NOT NULL," \
113 "etype INTEGER NOT NULL," \
114 "created_at INTEGER NOT NULL," \
115 "cred BLOB NOT NULL" \
118 #define SQL_TCRED "" \
119 "CREATE TRIGGER credDropPrincipal AFTER DELETE ON credentials " \
120 "FOR EACH ROW BEGIN " \
121 "DELETE FROM principals WHERE credential_id=old.oid;" \
124 #define SQL_ICRED "INSERT INTO credentials (cid, kvno, etype, cred, created_at) VALUES (?,?,?,?,?)"
125 #define SQL_DCRED "DELETE FROM credentials WHERE cid=?"
127 #define SQL_CPRINCIPALS "" \
128 "CREATE TABLE principals (" \
129 "oid INTEGER PRIMARY KEY," \
130 "principal TEXT NOT NULL," \
131 "type INTEGER NOT NULL," \
132 "credential_id INTEGER NOT NULL" \
135 #define SQL_IPRINCIPAL "INSERT INTO principals (principal, type, credential_id) VALUES (?,?,?)"
142 free_data(void *data
)
154 scc_free(krb5_scache
*s
)
162 sqlite3_finalize(s
->icred
);
164 sqlite3_finalize(s
->dcred
);
166 sqlite3_finalize(s
->iprincipal
);
168 sqlite3_finalize(s
->icache
);
170 sqlite3_finalize(s
->ucachen
);
172 sqlite3_finalize(s
->ucachep
);
174 sqlite3_finalize(s
->dcache
);
176 sqlite3_finalize(s
->scache
);
178 sqlite3_finalize(s
->scache_name
);
180 sqlite3_finalize(s
->umaster
);
183 sqlite3_close(s
->db
);
189 trace(void* ptr
, const char * str
)
191 printf("SQL: %s\n", str
);
195 static krb5_error_code
196 prepare_stmt(krb5_context context
, sqlite3
*db
,
197 sqlite3_stmt
**stmt
, const char *str
)
201 ret
= sqlite3_prepare_v2(db
, str
, -1, stmt
, NULL
);
202 if (ret
!= SQLITE_OK
) {
203 krb5_set_error_message(context
, ENOENT
,
204 N_("Failed to prepare stmt %s: %s", ""),
205 str
, sqlite3_errmsg(db
));
211 static krb5_error_code
212 exec_stmt(krb5_context context
, sqlite3
*db
, const char *str
,
213 krb5_error_code code
)
217 ret
= sqlite3_exec(db
, str
, NULL
, NULL
, NULL
);
218 if (ret
!= SQLITE_OK
&& code
) {
219 krb5_set_error_message(context
, code
,
220 N_("scache execute %s: %s", ""), str
,
227 static krb5_error_code
228 default_db(krb5_context context
, sqlite3
**db
)
233 ret
= _krb5_expand_default_cc_name(context
, KRB5_SCACHE_DB
, &name
);
237 ret
= sqlite3_open_v2(name
, db
, SQLITE_OPEN_READWRITE
, NULL
);
239 if (ret
!= SQLITE_OK
) {
240 krb5_clear_error_message(context
);
245 sqlite3_trace(*db
, trace
, NULL
);
251 static krb5_error_code
252 get_def_name(krb5_context context
, char **str
)
259 ret
= default_db(context
, &db
);
263 ret
= prepare_stmt(context
, db
, &stmt
, "SELECT defaultcache FROM master");
269 ret
= sqlite3_step(stmt
);
270 if (ret
!= SQLITE_ROW
)
273 if (sqlite3_column_type(stmt
, 0) != SQLITE_TEXT
)
276 name
= (const char *)sqlite3_column_text(stmt
, 0);
284 sqlite3_finalize(stmt
);
288 sqlite3_finalize(stmt
);
290 krb5_clear_error_message(context
);
296 static krb5_scache
* KRB5_CALLCONV
297 scc_alloc(krb5_context context
, const char *name
)
306 s
->cid
= SCACHE_INVALID_CID
;
313 ret
= get_def_name(context
, &s
->name
);
315 s
->name
= strdup(SCACHE_DEF_NAME
);
317 s
->name
= strdup(name
);
319 file
= strrchr(s
->name
, ':');
322 s
->file
= strdup(file
);
325 ret
= _krb5_expand_default_cc_name(context
, KRB5_SCACHE_DB
, &s
->file
);
328 _krb5_expand_default_cc_name(context
, KRB5_SCACHE_DB
, &s
->file
);
329 ret
= asprintf(&s
->name
, "unique-%p", s
);
331 if (ret
< 0 || s
->file
== NULL
|| s
->name
== NULL
) {
339 static krb5_error_code
340 open_database(krb5_context context
, krb5_scache
*s
, int flags
)
344 ret
= sqlite3_open_v2(s
->file
, &s
->db
, SQLITE_OPEN_READWRITE
|flags
, NULL
);
347 krb5_set_error_message(context
, ENOENT
,
348 N_("Error opening scache file %s: %s", ""),
349 s
->file
, sqlite3_errmsg(s
->db
));
350 sqlite3_close(s
->db
);
353 krb5_set_error_message(context
, ENOENT
,
354 N_("malloc: out of memory", ""));
360 static krb5_error_code
361 create_cache(krb5_context context
, krb5_scache
*s
)
365 sqlite3_bind_text(s
->icache
, 1, s
->name
, -1, NULL
);
367 ret
= sqlite3_step(s
->icache
);
368 } while (ret
== SQLITE_ROW
);
369 if (ret
!= SQLITE_DONE
) {
370 krb5_set_error_message(context
, KRB5_CC_IO
,
371 N_("Failed to add scache: %d", ""), ret
);
374 sqlite3_reset(s
->icache
);
376 s
->cid
= sqlite3_last_insert_rowid(s
->db
);
381 static krb5_error_code
382 make_database(krb5_context context
, krb5_scache
*s
)
384 int created_file
= 0;
390 ret
= open_database(context
, s
, 0);
392 mode_t oldumask
= umask(077);
393 ret
= open_database(context
, s
, SQLITE_OPEN_CREATE
);
399 ret
= exec_stmt(context
, s
->db
, SQL_CMASTER
, KRB5_CC_IO
);
401 ret
= exec_stmt(context
, s
->db
, SQL_CCACHE
, KRB5_CC_IO
);
403 ret
= exec_stmt(context
, s
->db
, SQL_CCREDS
, KRB5_CC_IO
);
405 ret
= exec_stmt(context
, s
->db
, SQL_CPRINCIPALS
, KRB5_CC_IO
);
407 ret
= exec_stmt(context
, s
->db
, SQL_SETUP_MASTER
, KRB5_CC_IO
);
410 ret
= exec_stmt(context
, s
->db
, SQL_TCACHE
, KRB5_CC_IO
);
412 ret
= exec_stmt(context
, s
->db
, SQL_TCRED
, KRB5_CC_IO
);
417 sqlite3_trace(s
->db
, trace
, NULL
);
420 ret
= prepare_stmt(context
, s
->db
, &s
->icred
, SQL_ICRED
);
422 ret
= prepare_stmt(context
, s
->db
, &s
->dcred
, SQL_DCRED
);
424 ret
= prepare_stmt(context
, s
->db
, &s
->iprincipal
, SQL_IPRINCIPAL
);
426 ret
= prepare_stmt(context
, s
->db
, &s
->icache
, SQL_ICACHE
);
428 ret
= prepare_stmt(context
, s
->db
, &s
->ucachen
, SQL_UCACHE_NAME
);
430 ret
= prepare_stmt(context
, s
->db
, &s
->ucachep
, SQL_UCACHE_PRINCIPAL
);
432 ret
= prepare_stmt(context
, s
->db
, &s
->dcache
, SQL_DCACHE
);
434 ret
= prepare_stmt(context
, s
->db
, &s
->scache
, SQL_SCACHE
);
436 ret
= prepare_stmt(context
, s
->db
, &s
->scache_name
, SQL_SCACHE_NAME
);
438 ret
= prepare_stmt(context
, s
->db
, &s
->umaster
, SQL_UMASTER
);
445 sqlite3_close(s
->db
);
452 static krb5_error_code
453 bind_principal(krb5_context context
,
457 krb5_const_principal principal
)
462 ret
= krb5_unparse_name(context
, principal
, &str
);
466 ret
= sqlite3_bind_text(stmt
, col
, str
, -1, free_krb5
);
467 if (ret
!= SQLITE_OK
) {
469 krb5_set_error_message(context
, ENOMEM
,
470 N_("scache bind principal: %s", ""),
481 static const char* KRB5_CALLCONV
482 scc_get_name(krb5_context context
,
485 return SCACHE(id
)->name
;
488 static krb5_error_code KRB5_CALLCONV
489 scc_resolve(krb5_context context
, krb5_ccache
*id
, const char *res
)
494 s
= scc_alloc(context
, res
);
496 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
497 N_("malloc: out of memory", ""));
498 return KRB5_CC_NOMEM
;
501 ret
= make_database(context
, s
);
507 ret
= sqlite3_bind_text(s
->scache_name
, 1, s
->name
, -1, NULL
);
508 if (ret
!= SQLITE_OK
) {
509 krb5_set_error_message(context
, ENOMEM
,
510 "bind name: %s", sqlite3_errmsg(s
->db
));
515 if (sqlite3_step(s
->scache_name
) == SQLITE_ROW
) {
517 if (sqlite3_column_type(s
->scache_name
, 0) != SQLITE_INTEGER
) {
518 sqlite3_reset(s
->scache_name
);
519 krb5_set_error_message(context
, KRB5_CC_END
,
520 N_("Cache name of wrong type "
521 "for scache %ld", ""),
522 (unsigned long)s
->name
);
527 s
->cid
= sqlite3_column_int(s
->scache_name
, 0);
529 s
->cid
= SCACHE_INVALID_CID
;
531 sqlite3_reset(s
->scache_name
);
533 (*id
)->data
.data
= s
;
534 (*id
)->data
.length
= sizeof(*s
);
539 static krb5_error_code KRB5_CALLCONV
540 scc_gen_new(krb5_context context
, krb5_ccache
*id
)
544 s
= scc_alloc(context
, NULL
);
547 krb5_set_error_message(context
, KRB5_CC_NOMEM
,
548 N_("malloc: out of memory", ""));
549 return KRB5_CC_NOMEM
;
552 (*id
)->data
.data
= s
;
553 (*id
)->data
.length
= sizeof(*s
);
558 static krb5_error_code KRB5_CALLCONV
559 scc_initialize(krb5_context context
,
561 krb5_principal primary_principal
)
563 krb5_scache
*s
= SCACHE(id
);
566 ret
= make_database(context
, s
);
570 ret
= exec_stmt(context
, s
->db
, "BEGIN IMMEDIATE TRANSACTION", KRB5_CC_IO
);
573 if (s
->cid
== SCACHE_INVALID_CID
) {
574 ret
= create_cache(context
, s
);
578 sqlite3_bind_int(s
->dcred
, 1, s
->cid
);
580 ret
= sqlite3_step(s
->dcred
);
581 } while (ret
== SQLITE_ROW
);
582 sqlite3_reset(s
->dcred
);
583 if (ret
!= SQLITE_DONE
) {
585 krb5_set_error_message(context
, ret
,
586 N_("Failed to delete old "
587 "credentials: %s", ""),
588 sqlite3_errmsg(s
->db
));
593 ret
= bind_principal(context
, s
->db
, s
->ucachep
, 1, primary_principal
);
596 sqlite3_bind_int(s
->ucachep
, 2, s
->cid
);
599 ret
= sqlite3_step(s
->ucachep
);
600 } while (ret
== SQLITE_ROW
);
601 sqlite3_reset(s
->ucachep
);
602 if (ret
!= SQLITE_DONE
) {
604 krb5_set_error_message(context
, ret
,
605 N_("Failed to bind principal to cache %s", ""),
606 sqlite3_errmsg(s
->db
));
610 ret
= exec_stmt(context
, s
->db
, "COMMIT", KRB5_CC_IO
);
616 exec_stmt(context
, s
->db
, "ROLLBACK", 0);
622 static krb5_error_code KRB5_CALLCONV
623 scc_close(krb5_context context
,
626 scc_free(SCACHE(id
));
630 static krb5_error_code KRB5_CALLCONV
631 scc_destroy(krb5_context context
,
634 krb5_scache
*s
= SCACHE(id
);
637 if (s
->cid
== SCACHE_INVALID_CID
)
640 sqlite3_bind_int(s
->dcache
, 1, s
->cid
);
642 ret
= sqlite3_step(s
->dcache
);
643 } while (ret
== SQLITE_ROW
);
644 sqlite3_reset(s
->dcache
);
645 if (ret
!= SQLITE_DONE
) {
646 krb5_set_error_message(context
, KRB5_CC_IO
,
647 N_("Failed to destroy cache %s: %s", ""),
648 s
->name
, sqlite3_errmsg(s
->db
));
654 static krb5_error_code
655 encode_creds(krb5_context context
, krb5_creds
*creds
, krb5_data
*data
)
660 sp
= krb5_storage_emem();
662 krb5_set_error_message(context
, ENOMEM
,
663 N_("malloc: out of memory", ""));
667 ret
= krb5_store_creds(sp
, creds
);
669 krb5_set_error_message(context
, ret
,
670 N_("Failed to store credential in scache", ""));
671 krb5_storage_free(sp
);
675 ret
= krb5_storage_to_data(sp
, data
);
676 krb5_storage_free(sp
);
678 krb5_set_error_message(context
, ret
,
679 N_("Failed to encode credential in scache", ""));
683 static krb5_error_code
684 decode_creds(krb5_context context
, const void *data
, size_t length
,
690 sp
= krb5_storage_from_readonly_mem(data
, length
);
692 krb5_set_error_message(context
, ENOMEM
,
693 N_("malloc: out of memory", ""));
697 ret
= krb5_ret_creds(sp
, creds
);
698 krb5_storage_free(sp
);
700 krb5_set_error_message(context
, ret
,
701 N_("Failed to read credential in scache", ""));
708 static krb5_error_code KRB5_CALLCONV
709 scc_store_cred(krb5_context context
,
713 sqlite_uint64 credid
;
714 krb5_scache
*s
= SCACHE(id
);
718 ret
= make_database(context
, s
);
722 ret
= encode_creds(context
, creds
, &data
);
726 sqlite3_bind_int(s
->icred
, 1, s
->cid
);
728 krb5_enctype etype
= 0;
733 ret
= decode_Ticket(creds
->ticket
.data
,
734 creds
->ticket
.length
, &t
, &len
);
737 kvno
= *t
.enc_part
.kvno
;
739 etype
= t
.enc_part
.etype
;
744 sqlite3_bind_int(s
->icred
, 2, kvno
);
745 sqlite3_bind_int(s
->icred
, 3, etype
);
749 sqlite3_bind_blob(s
->icred
, 4, data
.data
, data
.length
, free_data
);
750 sqlite3_bind_int(s
->icred
, 5, time(NULL
));
752 ret
= exec_stmt(context
, s
->db
, "BEGIN IMMEDIATE TRANSACTION", KRB5_CC_IO
);
756 ret
= sqlite3_step(s
->icred
);
757 } while (ret
== SQLITE_ROW
);
758 sqlite3_reset(s
->icred
);
759 if (ret
!= SQLITE_DONE
) {
761 krb5_set_error_message(context
, ret
,
762 N_("Failed to add credential: %s", ""),
763 sqlite3_errmsg(s
->db
));
767 credid
= sqlite3_last_insert_rowid(s
->db
);
770 bind_principal(context
, s
->db
, s
->iprincipal
, 1, creds
->server
);
771 sqlite3_bind_int(s
->iprincipal
, 2, 1);
772 sqlite3_bind_int(s
->iprincipal
, 3, credid
);
775 ret
= sqlite3_step(s
->iprincipal
);
776 } while (ret
== SQLITE_ROW
);
777 sqlite3_reset(s
->iprincipal
);
778 if (ret
!= SQLITE_DONE
) {
780 krb5_set_error_message(context
, ret
,
781 N_("Failed to add principal: %s", ""),
782 sqlite3_errmsg(s
->db
));
788 bind_principal(context
, s
->db
, s
->iprincipal
, 1, creds
->client
);
789 sqlite3_bind_int(s
->iprincipal
, 2, 0);
790 sqlite3_bind_int(s
->iprincipal
, 3, credid
);
793 ret
= sqlite3_step(s
->iprincipal
);
794 } while (ret
== SQLITE_ROW
);
795 sqlite3_reset(s
->iprincipal
);
796 if (ret
!= SQLITE_DONE
) {
798 krb5_set_error_message(context
, ret
,
799 N_("Failed to add principal: %s", ""),
800 sqlite3_errmsg(s
->db
));
805 ret
= exec_stmt(context
, s
->db
, "COMMIT", KRB5_CC_IO
);
811 exec_stmt(context
, s
->db
, "ROLLBACK", 0);
816 static krb5_error_code KRB5_CALLCONV
817 scc_get_principal(krb5_context context
,
819 krb5_principal
*principal
)
821 krb5_scache
*s
= SCACHE(id
);
827 ret
= make_database(context
, s
);
831 sqlite3_bind_int(s
->scache
, 1, s
->cid
);
833 if (sqlite3_step(s
->scache
) != SQLITE_ROW
) {
834 sqlite3_reset(s
->scache
);
835 krb5_set_error_message(context
, KRB5_CC_END
,
836 N_("No principal for cache SCC:%s:%s", ""),
841 if (sqlite3_column_type(s
->scache
, 0) != SQLITE_TEXT
) {
842 sqlite3_reset(s
->scache
);
843 krb5_set_error_message(context
, KRB5_CC_END
,
844 N_("Principal data of wrong type "
845 "for SCC:%s:%s", ""),
850 str
= (const char *)sqlite3_column_text(s
->scache
, 0);
852 sqlite3_reset(s
->scache
);
853 krb5_set_error_message(context
, KRB5_CC_END
,
854 N_("Principal not set for SCC:%s:%s", ""),
859 ret
= krb5_parse_name(context
, str
, principal
);
861 sqlite3_reset(s
->scache
);
869 sqlite3_stmt
*credstmt
;
872 static krb5_error_code KRB5_CALLCONV
873 scc_get_first (krb5_context context
,
875 krb5_cc_cursor
*cursor
)
877 krb5_scache
*s
= SCACHE(id
);
879 struct cred_ctx
*ctx
;
880 char *str
= NULL
, *name
= NULL
;
884 ctx
= calloc(1, sizeof(*ctx
));
886 krb5_set_error_message(context
, ENOMEM
,
887 N_("malloc: out of memory", ""));
891 ret
= make_database(context
, s
);
897 if (s
->cid
== SCACHE_INVALID_CID
) {
898 krb5_set_error_message(context
, KRB5_CC_END
,
899 N_("Iterating a invalid scache %s", ""),
905 ret
= asprintf(&name
, "credIteration%luPid%d",
906 (unsigned long)ctx
, (int)getpid());
907 if (ret
< 0 || name
== NULL
) {
908 krb5_set_error_message(context
, ENOMEM
,
909 N_("malloc: out of memory", ""));
914 ret
= asprintf(&ctx
->drop
, "DROP TABLE %s", name
);
915 if (ret
< 0 || ctx
->drop
== NULL
) {
916 krb5_set_error_message(context
, ENOMEM
,
917 N_("malloc: out of memory", ""));
923 ret
= asprintf(&str
, "CREATE TEMPORARY TABLE %s "
924 "AS SELECT oid,created_at FROM credentials WHERE cid = %lu",
925 name
, (unsigned long)s
->cid
);
926 if (ret
< 0 || str
== NULL
) {
933 ret
= exec_stmt(context
, s
->db
, str
, KRB5_CC_IO
);
943 ret
= asprintf(&str
, "SELECT oid FROM %s ORDER BY created_at", name
);
944 if (ret
< 0 || str
== NULL
) {
945 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
952 ret
= prepare_stmt(context
, s
->db
, &ctx
->stmt
, str
);
957 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
963 ret
= prepare_stmt(context
, s
->db
, &ctx
->credstmt
,
964 "SELECT cred FROM credentials WHERE oid = ?");
966 sqlite3_finalize(ctx
->stmt
);
967 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
978 static krb5_error_code KRB5_CALLCONV
979 scc_get_next (krb5_context context
,
981 krb5_cc_cursor
*cursor
,
984 struct cred_ctx
*ctx
= *cursor
;
985 krb5_scache
*s
= SCACHE(id
);
988 const void *data
= NULL
;
992 ret
= sqlite3_step(ctx
->stmt
);
993 if (ret
== SQLITE_DONE
) {
994 krb5_clear_error_message(context
);
996 } else if (ret
!= SQLITE_ROW
) {
997 krb5_set_error_message(context
, KRB5_CC_IO
,
998 N_("scache Database failed: %s", ""),
999 sqlite3_errmsg(s
->db
));
1003 oid
= sqlite3_column_int64(ctx
->stmt
, 0);
1005 /* read cred from credentials table */
1007 sqlite3_bind_int(ctx
->credstmt
, 1, oid
);
1009 ret
= sqlite3_step(ctx
->credstmt
);
1010 if (ret
!= SQLITE_ROW
) {
1011 sqlite3_reset(ctx
->credstmt
);
1015 if (sqlite3_column_type(ctx
->credstmt
, 0) != SQLITE_BLOB
) {
1016 krb5_set_error_message(context
, KRB5_CC_END
,
1017 N_("credential of wrong type for SCC:%s:%s", ""),
1019 sqlite3_reset(ctx
->credstmt
);
1023 data
= sqlite3_column_blob(ctx
->credstmt
, 0);
1024 len
= sqlite3_column_bytes(ctx
->credstmt
, 0);
1026 ret
= decode_creds(context
, data
, len
, creds
);
1027 sqlite3_reset(ctx
->credstmt
);
1031 static krb5_error_code KRB5_CALLCONV
1032 scc_end_get (krb5_context context
,
1034 krb5_cc_cursor
*cursor
)
1036 struct cred_ctx
*ctx
= *cursor
;
1037 krb5_scache
*s
= SCACHE(id
);
1039 sqlite3_finalize(ctx
->stmt
);
1040 sqlite3_finalize(ctx
->credstmt
);
1042 exec_stmt(context
, s
->db
, ctx
->drop
, 0);
1050 static krb5_error_code KRB5_CALLCONV
1051 scc_remove_cred(krb5_context context
,
1056 krb5_scache
*s
= SCACHE(id
);
1057 krb5_error_code ret
;
1059 sqlite_uint64 credid
= 0;
1060 const void *data
= NULL
;
1063 ret
= make_database(context
, s
);
1067 ret
= prepare_stmt(context
, s
->db
, &stmt
,
1068 "SELECT cred,oid FROM credentials "
1073 sqlite3_bind_int(stmt
, 1, s
->cid
);
1075 /* find credential... */
1079 ret
= sqlite3_step(stmt
);
1080 if (ret
== SQLITE_DONE
) {
1083 } else if (ret
!= SQLITE_ROW
) {
1085 krb5_set_error_message(context
, ret
,
1086 N_("scache Database failed: %s", ""),
1087 sqlite3_errmsg(s
->db
));
1091 if (sqlite3_column_type(stmt
, 0) != SQLITE_BLOB
) {
1093 krb5_set_error_message(context
, ret
,
1094 N_("Credential of wrong type "
1095 "for SCC:%s:%s", ""),
1100 data
= sqlite3_column_blob(stmt
, 0);
1101 len
= sqlite3_column_bytes(stmt
, 0);
1103 ret
= decode_creds(context
, data
, len
, &creds
);
1107 ret
= krb5_compare_creds(context
, which
, mcreds
, &creds
);
1108 krb5_free_cred_contents(context
, &creds
);
1110 credid
= sqlite3_column_int64(stmt
, 1);
1116 sqlite3_finalize(stmt
);
1119 ret
= prepare_stmt(context
, s
->db
, &stmt
,
1120 "DELETE FROM credentials WHERE oid=?");
1123 sqlite3_bind_int(stmt
, 1, credid
);
1126 ret
= sqlite3_step(stmt
);
1127 } while (ret
== SQLITE_ROW
);
1128 sqlite3_finalize(stmt
);
1129 if (ret
!= SQLITE_DONE
) {
1131 krb5_set_error_message(context
, ret
,
1132 N_("failed to delete scache credental", ""));
1140 static krb5_error_code KRB5_CALLCONV
1141 scc_set_flags(krb5_context context
,
1154 static krb5_error_code KRB5_CALLCONV
1155 scc_get_cache_first(krb5_context context
, krb5_cc_cursor
*cursor
)
1157 struct cache_iter
*ctx
;
1158 krb5_error_code ret
;
1159 char *name
= NULL
, *str
= NULL
;
1163 ctx
= calloc(1, sizeof(*ctx
));
1165 krb5_set_error_message(context
, ENOMEM
,
1166 N_("malloc: out of memory", ""));
1170 ret
= default_db(context
, &ctx
->db
);
1171 if (ctx
->db
== NULL
) {
1176 ret
= asprintf(&name
, "cacheIteration%luPid%d",
1177 (unsigned long)ctx
, (int)getpid());
1178 if (ret
< 0 || name
== NULL
) {
1179 krb5_set_error_message(context
, ENOMEM
,
1180 N_("malloc: out of memory", ""));
1181 sqlite3_close(ctx
->db
);
1186 ret
= asprintf(&ctx
->drop
, "DROP TABLE %s", name
);
1187 if (ret
< 0 || ctx
->drop
== NULL
) {
1188 krb5_set_error_message(context
, ENOMEM
,
1189 N_("malloc: out of memory", ""));
1190 sqlite3_close(ctx
->db
);
1196 ret
= asprintf(&str
, "CREATE TEMPORARY TABLE %s AS SELECT name FROM caches",
1198 if (ret
< 0 || str
== NULL
) {
1199 krb5_set_error_message(context
, ENOMEM
,
1200 N_("malloc: out of memory", ""));
1201 sqlite3_close(ctx
->db
);
1208 ret
= exec_stmt(context
, ctx
->db
, str
, KRB5_CC_IO
);
1212 sqlite3_close(ctx
->db
);
1219 ret
= asprintf(&str
, "SELECT name FROM %s", name
);
1221 if (ret
< 0 || str
== NULL
) {
1222 exec_stmt(context
, ctx
->db
, ctx
->drop
, 0);
1223 sqlite3_close(ctx
->db
);
1230 ret
= prepare_stmt(context
, ctx
->db
, &ctx
->stmt
, str
);
1233 exec_stmt(context
, ctx
->db
, ctx
->drop
, 0);
1234 sqlite3_close(ctx
->db
);
1245 static krb5_error_code KRB5_CALLCONV
1246 scc_get_cache_next(krb5_context context
,
1247 krb5_cc_cursor cursor
,
1250 struct cache_iter
*ctx
= cursor
;
1251 krb5_error_code ret
;
1255 ret
= sqlite3_step(ctx
->stmt
);
1256 if (ret
== SQLITE_DONE
) {
1257 krb5_clear_error_message(context
);
1259 } else if (ret
!= SQLITE_ROW
) {
1260 krb5_set_error_message(context
, KRB5_CC_IO
,
1261 N_("Database failed: %s", ""),
1262 sqlite3_errmsg(ctx
->db
));
1266 if (sqlite3_column_type(ctx
->stmt
, 0) != SQLITE_TEXT
)
1269 name
= (const char *)sqlite3_column_text(ctx
->stmt
, 0);
1273 ret
= _krb5_cc_allocate(context
, &krb5_scc_ops
, id
);
1277 return scc_resolve(context
, id
, name
);
1280 static krb5_error_code KRB5_CALLCONV
1281 scc_end_cache_get(krb5_context context
, krb5_cc_cursor cursor
)
1283 struct cache_iter
*ctx
= cursor
;
1285 exec_stmt(context
, ctx
->db
, ctx
->drop
, 0);
1286 sqlite3_finalize(ctx
->stmt
);
1287 sqlite3_close(ctx
->db
);
1293 static krb5_error_code KRB5_CALLCONV
1294 scc_move(krb5_context context
, krb5_ccache from
, krb5_ccache to
)
1296 krb5_scache
*sfrom
= SCACHE(from
);
1297 krb5_scache
*sto
= SCACHE(to
);
1298 krb5_error_code ret
;
1300 if (strcmp(sfrom
->file
, sto
->file
) != 0) {
1301 krb5_set_error_message(context
, KRB5_CC_BADNAME
,
1302 N_("Can't handle cross database "
1303 "credential move: %s -> %s", ""),
1304 sfrom
->file
, sto
->file
);
1305 return KRB5_CC_BADNAME
;
1308 ret
= make_database(context
, sfrom
);
1312 ret
= exec_stmt(context
, sfrom
->db
,
1313 "BEGIN IMMEDIATE TRANSACTION", KRB5_CC_IO
);
1314 if (ret
) return ret
;
1316 if (sto
->cid
!= SCACHE_INVALID_CID
) {
1317 /* drop old cache entry */
1319 sqlite3_bind_int(sfrom
->dcache
, 1, sto
->cid
);
1321 ret
= sqlite3_step(sfrom
->dcache
);
1322 } while (ret
== SQLITE_ROW
);
1323 sqlite3_reset(sfrom
->dcache
);
1324 if (ret
!= SQLITE_DONE
) {
1325 krb5_set_error_message(context
, KRB5_CC_IO
,
1326 N_("Failed to delete old cache: %d", ""),
1332 sqlite3_bind_text(sfrom
->ucachen
, 1, sto
->name
, -1, NULL
);
1333 sqlite3_bind_int(sfrom
->ucachen
, 2, sfrom
->cid
);
1336 ret
= sqlite3_step(sfrom
->ucachen
);
1337 } while (ret
== SQLITE_ROW
);
1338 sqlite3_reset(sfrom
->ucachen
);
1339 if (ret
!= SQLITE_DONE
) {
1340 krb5_set_error_message(context
, KRB5_CC_IO
,
1341 N_("Failed to update new cache: %d", ""),
1346 sto
->cid
= sfrom
->cid
;
1348 ret
= exec_stmt(context
, sfrom
->db
, "COMMIT", KRB5_CC_IO
);
1349 if (ret
) return ret
;
1356 exec_stmt(context
, sfrom
->db
, "ROLLBACK", 0);
1362 static krb5_error_code KRB5_CALLCONV
1363 scc_get_default_name(krb5_context context
, char **str
)
1365 krb5_error_code ret
;
1370 ret
= get_def_name(context
, &name
);
1372 return _krb5_expand_default_cc_name(context
, KRB5_SCACHE_NAME
, str
);
1374 ret
= asprintf(str
, "SCC:%s", name
);
1376 if (ret
< 0 || *str
== NULL
) {
1377 krb5_set_error_message(context
, ENOMEM
,
1378 N_("malloc: out of memory", ""));
1384 static krb5_error_code KRB5_CALLCONV
1385 scc_set_default(krb5_context context
, krb5_ccache id
)
1387 krb5_scache
*s
= SCACHE(id
);
1388 krb5_error_code ret
;
1390 if (s
->cid
== SCACHE_INVALID_CID
) {
1391 krb5_set_error_message(context
, KRB5_CC_IO
,
1392 N_("Trying to set a invalid cache "
1393 "as default %s", ""),
1398 ret
= sqlite3_bind_text(s
->umaster
, 1, s
->name
, -1, NULL
);
1400 sqlite3_reset(s
->umaster
);
1401 krb5_set_error_message(context
, KRB5_CC_IO
,
1402 N_("Failed to set name of default cache", ""));
1407 ret
= sqlite3_step(s
->umaster
);
1408 } while (ret
== SQLITE_ROW
);
1409 sqlite3_reset(s
->umaster
);
1410 if (ret
!= SQLITE_DONE
) {
1411 krb5_set_error_message(context
, KRB5_CC_IO
,
1412 N_("Failed to update default cache", ""));
1420 * Variable containing the SCC based credential cache implemention.
1422 * @ingroup krb5_ccache
1425 KRB5_LIB_VARIABLE
const krb5_cc_ops krb5_scc_ops
= {
1426 KRB5_CC_OPS_VERSION
,
1435 NULL
, /* scc_retrieve */
1443 scc_get_cache_first
,
1447 scc_get_default_name
,