lib/hdb/hdb.c

   1 /*
   2  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "krb5_locl.h"
  37 #include "hdb_locl.h"
  38
  39 #ifdef HAVE_DLFCN_H
  40 #include <dlfcn.h>
  41 #endif
  42
  43 /*! @mainpage Heimdal database backend library
  44  *
  45  * @section intro Introduction
  46  *
  47  * Heimdal libhdb library provides the backend support for Heimdal kdc
  48  * and kadmind. Its here where plugins for diffrent database engines
  49  * can be pluged in and extend support for here Heimdal get the
  50  * principal and policy data from.
  51  *
  52  * Example of Heimdal backend are:
  53  * - Berkeley DB 1.85
  54  * - Berkeley DB 3.0
  55  * - Berkeley DB 4.0
  56  * - New Berkeley DB
  57  * - LDAP
  58  *
  59  *
  60  * The project web page: http://www.h5l.org/
  61  *
  62  */
  63
  64 const int hdb_interface_version = HDB_INTERFACE_VERSION;
  65
  66 static struct hdb_method methods[] = {
  67 #if HAVE_DB1 || HAVE_DB3
  68     { HDB_INTERFACE_VERSION, "db:",     hdb_db_create},
  69 #endif
  70 #if HAVE_DB1
  71     { HDB_INTERFACE_VERSION, "mit-db:", hdb_mdb_create},
  72 #endif
  73 #if HAVE_NDBM
  74     { HDB_INTERFACE_VERSION, "ndbm:",   hdb_ndbm_create},
  75 #endif
  76     { HDB_INTERFACE_VERSION, "keytab:", hdb_keytab_create},
  77 #if defined(OPENLDAP) && !defined(OPENLDAP_MODULE)
  78     { HDB_INTERFACE_VERSION, "ldap:",   hdb_ldap_create},
  79     { HDB_INTERFACE_VERSION, "ldapi:",  hdb_ldapi_create},
  80 #endif
  81     { HDB_INTERFACE_VERSION, "sqlite:", hdb_sqlite_create},
  82     {0, NULL,   NULL}
  83 };
  84
  85 #if HAVE_DB1 || HAVE_DB3
  86 static struct hdb_method dbmetod =
  87     { HDB_INTERFACE_VERSION, "", hdb_db_create };
  88 #elif defined(HAVE_NDBM)
  89 static struct hdb_method dbmetod =
  90     { HDB_INTERFACE_VERSION, "", hdb_ndbm_create };
  91 #endif
  92
  93
  94 krb5_error_code
  95 hdb_next_enctype2key(krb5_context context,
  96                      const hdb_entry *e,
  97                      krb5_enctype enctype,
  98                      Key **key)
  99 {
 100     Key *k;
 101
 102     for (k = *key ? (*key) + 1 : e->keys.val;
 103          k < e->keys.val + e->keys.len;
 104          k++)
 105     {
 106         if(k->key.keytype == enctype){
 107             *key = k;
 108             return 0;
 109         }
 110     }
 111     krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
 112                            "No next enctype %d for hdb-entry",
 113                           (int)enctype);
 114     return KRB5_PROG_ETYPE_NOSUPP; /* XXX */
 115 }
 116
 117 krb5_error_code
 118 hdb_enctype2key(krb5_context context,
 119                 hdb_entry *e,
 120                 krb5_enctype enctype,
 121                 Key **key)
 122 {
 123     *key = NULL;
 124     return hdb_next_enctype2key(context, e, enctype, key);
 125 }
 126
 127 void
 128 hdb_free_key(Key *key)
 129 {
 130     memset(key->key.keyvalue.data,
 131            0,
 132            key->key.keyvalue.length);
 133     free_Key(key);
 134     free(key);
 135 }
 136
 137
 138 krb5_error_code
 139 hdb_lock(int fd, int operation)
 140 {
 141     int i, code = 0;
 142
 143     for(i = 0; i < 3; i++){
 144         code = flock(fd, (operation == HDB_RLOCK ? LOCK_SH : LOCK_EX) | LOCK_NB);
 145         if(code == 0 || errno != EWOULDBLOCK)
 146             break;
 147         sleep(1);
 148     }
 149     if(code == 0)
 150         return 0;
 151     if(errno == EWOULDBLOCK)
 152         return HDB_ERR_DB_INUSE;
 153     return HDB_ERR_CANT_LOCK_DB;
 154 }
 155
 156 krb5_error_code
 157 hdb_unlock(int fd)
 158 {
 159     int code;
 160     code = flock(fd, LOCK_UN);
 161     if(code)
 162         return 4711 /* XXX */;
 163     return 0;
 164 }
 165
 166 void
 167 hdb_free_entry(krb5_context context, hdb_entry_ex *ent)
 168 {
 169     int i;
 170
 171     if (ent->free_entry)
 172         (*ent->free_entry)(context, ent);
 173
 174     for(i = 0; i < ent->entry.keys.len; ++i) {
 175         Key *k = &ent->entry.keys.val[i];
 176
 177         memset (k->key.keyvalue.data, 0, k->key.keyvalue.length);
 178     }
 179     free_hdb_entry(&ent->entry);
 180 }
 181
 182 krb5_error_code
 183 hdb_foreach(krb5_context context,
 184             HDB *db,
 185             unsigned flags,
 186             hdb_foreach_func_t func,
 187             void *data)
 188 {
 189     krb5_error_code ret;
 190     hdb_entry_ex entry;
 191     ret = db->hdb_firstkey(context, db, flags, &entry);
 192     if (ret == 0)
 193         krb5_clear_error_message(context);
 194     while(ret == 0){
 195         ret = (*func)(context, db, &entry, data);
 196         hdb_free_entry(context, &entry);
 197         if(ret == 0)
 198             ret = db->hdb_nextkey(context, db, flags, &entry);
 199     }
 200     if(ret == HDB_ERR_NOENTRY)
 201         ret = 0;
 202     return ret;
 203 }
 204
 205 krb5_error_code
 206 hdb_check_db_format(krb5_context context, HDB *db)
 207 {
 208     krb5_data tag;
 209     krb5_data version;
 210     krb5_error_code ret, ret2;
 211     unsigned ver;
 212     int foo;
 213
 214     ret = db->hdb_lock(context, db, HDB_RLOCK);
 215     if (ret)
 216         return ret;
 217
 218     tag.data = HDB_DB_FORMAT_ENTRY;
 219     tag.length = strlen(tag.data);
 220     ret = (*db->hdb__get)(context, db, tag, &version);
 221     ret2 = db->hdb_unlock(context, db);
 222     if(ret)
 223         return ret;
 224     if (ret2)
 225         return ret2;
 226     foo = sscanf(version.data, "%u", &ver);
 227     krb5_data_free (&version);
 228     if (foo != 1)
 229         return HDB_ERR_BADVERSION;
 230     if(ver != HDB_DB_FORMAT)
 231         return HDB_ERR_BADVERSION;
 232     return 0;
 233 }
 234
 235 krb5_error_code
 236 hdb_init_db(krb5_context context, HDB *db)
 237 {
 238     krb5_error_code ret, ret2;
 239     krb5_data tag;
 240     krb5_data version;
 241     char ver[32];
 242
 243     ret = hdb_check_db_format(context, db);
 244     if(ret != HDB_ERR_NOENTRY)
 245         return ret;
 246
 247     ret = db->hdb_lock(context, db, HDB_WLOCK);
 248     if (ret)
 249         return ret;
 250
 251     tag.data = HDB_DB_FORMAT_ENTRY;
 252     tag.length = strlen(tag.data);
 253     snprintf(ver, sizeof(ver), "%u", HDB_DB_FORMAT);
 254     version.data = ver;
 255     version.length = strlen(version.data) + 1; /* zero terminated */
 256     ret = (*db->hdb__put)(context, db, 0, tag, version);
 257     ret2 = db->hdb_unlock(context, db);
 258     if (ret) {
 259         if (ret2)
 260             krb5_clear_error_message(context);
 261         return ret;
 262     }
 263     return ret2;
 264 }
 265
 266 #ifdef HAVE_DLOPEN
 267
 268  /*
 269  * Load a dynamic backend from /usr/heimdal/lib/hdb_NAME.so,
 270  * looking for the hdb_NAME_create symbol.
 271  */
 272
 273 static const struct hdb_method *
 274 find_dynamic_method (krb5_context context,
 275                      const char *filename,
 276                      const char **rest)
 277 {
 278     static struct hdb_method method;
 279     struct hdb_so_method *mso;
 280     char *prefix, *path, *symbol;
 281     const char *p;
 282     void *dl;
 283     size_t len;
 284
 285     p = strchr(filename, ':');
 286
 287     /* if no prefix, don't know what module to load, just ignore it */
 288     if (p == NULL)
 289         return NULL;
 290
 291     len = p - filename;
 292     *rest = filename + len + 1;
 293
 294     prefix = malloc(len + 1);
 295     if (prefix == NULL)
 296         krb5_errx(context, 1, "out of memory");
 297     strlcpy(prefix, filename, len + 1);
 298
 299     if (asprintf(&path, LIBDIR "/hdb_%s.so", prefix) == -1)
 300         krb5_errx(context, 1, "out of memory");
 301
 302 #ifndef RTLD_NOW
 303 #define RTLD_NOW 0
 304 #endif
 305 #ifndef RTLD_GLOBAL
 306 #define RTLD_GLOBAL 0
 307 #endif
 308
 309     dl = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
 310     if (dl == NULL) {
 311         krb5_warnx(context, "error trying to load dynamic module %s: %s\n",
 312                    path, dlerror());
 313         free(prefix);
 314         free(path);
 315         return NULL;
 316     }
 317
 318     if (asprintf(&symbol, "hdb_%s_interface", prefix) == -1)
 319         krb5_errx(context, 1, "out of memory");
 320
 321     mso = dlsym(dl, symbol);
 322     if (mso == NULL) {
 323         krb5_warnx(context, "error finding symbol %s in %s: %s\n",
 324                    symbol, path, dlerror());
 325         dlclose(dl);
 326         free(symbol);
 327         free(prefix);
 328         free(path);
 329         return NULL;
 330     }
 331     free(path);
 332     free(symbol);
 333
 334     if (mso->version != HDB_INTERFACE_VERSION) {
 335         krb5_warnx(context,
 336                    "error wrong version in shared module %s "
 337                    "version: %d should have been %d\n",
 338                    prefix, mso->version, HDB_INTERFACE_VERSION);
 339         dlclose(dl);
 340         free(prefix);
 341         return NULL;
 342     }
 343
 344     if (mso->create == NULL) {
 345         krb5_errx(context, 1,
 346                   "no entry point function in shared mod %s ",
 347                    prefix);
 348         dlclose(dl);
 349         free(prefix);
 350         return NULL;
 351     }
 352
 353     method.create = mso->create;
 354     method.prefix = prefix;
 355
 356     return &method;
 357 }
 358 #endif /* HAVE_DLOPEN */
 359
 360 /*
 361  * find the relevant method for `filename', returning a pointer to the
 362  * rest in `rest'.
 363  * return NULL if there's no such method.
 364  */
 365
 366 static const struct hdb_method *
 367 find_method (const char *filename, const char **rest)
 368 {
 369     const struct hdb_method *h;
 370
 371     for (h = methods; h->prefix != NULL; ++h) {
 372         if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0) {
 373             *rest = filename + strlen(h->prefix);
 374             return h;
 375         }
 376     }
 377 #if defined(HAVE_DB1) || defined(HAVE_DB3) || defined(HAVE_NDBM)
 378     if (strncmp(filename, "/", 1) == 0
 379         || strncmp(filename, "./", 2) == 0
 380         || strncmp(filename, "../", 3) == 0)
 381     {
 382         *rest = filename;
 383         return &dbmetod;
 384     }
 385 #endif
 386
 387     return NULL;
 388 }
 389
 390 krb5_error_code
 391 hdb_list_builtin(krb5_context context, char **list)
 392 {
 393     const struct hdb_method *h;
 394     size_t len = 0;
 395     char *buf = NULL;
 396
 397     for (h = methods; h->prefix != NULL; ++h) {
 398         if (h->prefix[0] == '\0')
 399             continue;
 400         len += strlen(h->prefix) + 2;
 401     }
 402
 403     len += 1;
 404     buf = malloc(len);
 405     if (buf == NULL) {
 406         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 407         return ENOMEM;
 408     }
 409     buf[0] = '\0';
 410
 411     for (h = methods; h->prefix != NULL; ++h) {
 412         if (h != methods)
 413             strlcat(buf, ", ", len);
 414         strlcat(buf, h->prefix, len);
 415     }
 416     *list = buf;
 417     return 0;
 418 }
 419
 420 krb5_error_code
 421 _hdb_keytab2hdb_entry(krb5_context context,
 422                       const krb5_keytab_entry *ktentry,
 423                       hdb_entry_ex *entry)
 424 {
 425     entry->entry.kvno = ktentry->vno;
 426     entry->entry.created_by.time = ktentry->timestamp;
 427
 428     entry->entry.keys.val = calloc(1, sizeof(entry->entry.keys.val[0]));
 429     if (entry->entry.keys.val == NULL)
 430         return ENOMEM;
 431     entry->entry.keys.len = 1;
 432
 433     entry->entry.keys.val[0].mkvno = NULL;
 434     entry->entry.keys.val[0].salt = NULL;
 435
 436     return krb5_copy_keyblock_contents(context,
 437                                        &ktentry->keyblock,
 438                                        &entry->entry.keys.val[0].key);
 439 }
 440
 441 /**
 442  * Create a handle for a Kerberos database
 443  *
 444  * Create a handle for a Kerberos database backend specified by a
 445  * filename.  Doesn't create a file if its doesn't exists, you have to
 446  * use O_CREAT to tell the backend to create the file.
 447  */
 448
 449 krb5_error_code
 450 hdb_create(krb5_context context, HDB **db, const char *filename)
 451 {
 452     const struct hdb_method *h;
 453     const char *residual;
 454     krb5_error_code ret;
 455     struct krb5_plugin *list = NULL, *e;
 456
 457     if(filename == NULL)
 458         filename = HDB_DEFAULT_DB;
 459     krb5_add_et_list(context, initialize_hdb_error_table_r);
 460     h = find_method (filename, &residual);
 461
 462     if (h == NULL) {
 463             ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, "hdb", &list);
 464             if(ret == 0 && list != NULL) {
 465                     for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
 466                             h = _krb5_plugin_get_symbol(e);
 467                             if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0
 468                                 && h->interface_version == HDB_INTERFACE_VERSION) {
 469                                     residual = filename + strlen(h->prefix);
 470                                     break;
 471                             }
 472                     }
 473                     if (e == NULL) {
 474                             h = NULL;
 475                             _krb5_plugin_free(list);
 476                     }
 477             }
 478     }
 479
 480 #ifdef HAVE_DLOPEN
 481     if (h == NULL)
 482         h = find_dynamic_method (context, filename, &residual);
 483 #endif
 484     if (h == NULL)
 485         krb5_errx(context, 1, "No database support for %s", filename);
 486     return (*h->create)(context, db, residual);
 487 }