lib/kadm5/prune_s.c

   1 /*
   2  * Copyright (c) 2018 Cesnet z.s.p.o.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of the Institute nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #include "kadm5_locl.h"
  34
  35 RCSID("$Id$");
  36
  37 struct prune_principal_hook_ctx {
  38     kadm5_server_context *context;
  39     enum kadm5_hook_stage stage;
  40     krb5_error_code code;
  41     krb5_const_principal princ;
  42     int kvno;
  43 };
  44
  45 static krb5_error_code KRB5_LIB_CALL
  46 prune_principal_hook_cb(krb5_context context,
  47                         const void *hook,
  48                         void *hookctx,
  49                         void *userctx)
  50 {
  51     krb5_error_code ret;
  52     const struct kadm5_hook_ftable *ftable = hook;
  53     struct prune_principal_hook_ctx *ctx = userctx;
  54
  55     ret = ftable->prune(context, hookctx,
  56                         ctx->stage, ctx->code, ctx->princ, ctx->kvno);
  57     if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE)
  58         _kadm5_s_set_hook_error_message(ctx->context, ret, "prune",
  59                                         hook, ctx->stage);
  60
  61     /* only pre-commit plugins can abort */
  62     if (ret == 0 || ctx->stage == KADM5_HOOK_STAGE_POSTCOMMIT)
  63         ret = KRB5_PLUGIN_NO_HANDLE;
  64
  65     return ret;
  66 }
  67
  68 static kadm5_ret_t
  69 prune_principal_hook(kadm5_server_context *context,
  70                       enum kadm5_hook_stage stage,
  71                       krb5_error_code code,
  72                       krb5_const_principal princ,
  73                       int kvno)
  74 {
  75     krb5_error_code ret;
  76     struct prune_principal_hook_ctx ctx;
  77
  78     ctx.context = context;
  79     ctx.stage = stage;
  80     ctx.code = code;
  81     ctx.princ = princ;
  82     ctx.kvno = kvno;
  83
  84     ret = _krb5_plugin_run_f(context->context, &kadm5_hook_plugin_data,
  85                              0, &ctx, prune_principal_hook_cb);
  86     if (ret == KRB5_PLUGIN_NO_HANDLE)
  87         ret = 0;
  88
  89     return ret;
  90 }
  91
  92 kadm5_ret_t
  93 kadm5_s_prune_principal(void *server_handle,
  94                         krb5_principal princ,
  95                         int kvno)
  96 {
  97     kadm5_server_context *context = server_handle;
  98     hdb_entry ent;
  99     kadm5_ret_t ret;
 100
 101     memset(&ent, 0, sizeof(ent));
 102     if (!context->keep_open) {
 103         ret = context->db->hdb_open(context->context, context->db, O_RDWR, 0);
 104         if(ret)
 105             return ret;
 106     }
 107
 108     ret = kadm5_log_init(context);
 109     if (ret)
 110         goto out;
 111
 112     /* NOTE: We do not use hdb_fetch_kvno() here */
 113     ret = context->db->hdb_fetch_kvno(context->context, context->db, princ,
 114                                       HDB_F_DECRYPT|HDB_F_GET_ANY|HDB_F_ADMIN_DATA,
 115                                       0, &ent);
 116     if (ret)
 117         goto out2;
 118
 119     ret = prune_principal_hook(context, KADM5_HOOK_STAGE_PRECOMMIT,
 120                                0, princ, kvno);
 121     if (ret)
 122         goto out3;
 123
 124     ret = hdb_prune_keys_kvno(context->context, &ent, kvno);
 125     if (ret)
 126         goto out3;
 127
 128     ret = hdb_seal_keys(context->context, context->db, &ent);
 129     if (ret)
 130         goto out3;
 131
 132     ret = kadm5_log_modify(context, &ent, KADM5_KEY_DATA);
 133
 134     (void) prune_principal_hook(context, KADM5_HOOK_STAGE_POSTCOMMIT,
 135                                 ret, princ, kvno);
 136
 137 out3:
 138     hdb_free_entry(context->context, context->db, &ent);
 139 out2:
 140     (void) kadm5_log_end(context);
 141 out:
 142     if (!context->keep_open) {
 143         kadm5_ret_t ret2;
 144         ret2 = context->db->hdb_close(context->context, context->db);
 145         if (ret == 0 && ret2 != 0)
 146             ret = ret2;
 147     }
 148     return _kadm5_error_code(ret);
 149 }