lib/hdb/hdb-mitdb.c

   1 /*
   2  * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #define KRB5_KDB_DISALLOW_POSTDATED     0x00000001
  37 #define KRB5_KDB_DISALLOW_FORWARDABLE   0x00000002
  38 #define KRB5_KDB_DISALLOW_TGT_BASED     0x00000004
  39 #define KRB5_KDB_DISALLOW_RENEWABLE     0x00000008
  40 #define KRB5_KDB_DISALLOW_PROXIABLE     0x00000010
  41 #define KRB5_KDB_DISALLOW_DUP_SKEY      0x00000020
  42 #define KRB5_KDB_DISALLOW_ALL_TIX       0x00000040
  43 #define KRB5_KDB_REQUIRES_PRE_AUTH      0x00000080
  44 #define KRB5_KDB_REQUIRES_HW_AUTH       0x00000100
  45 #define KRB5_KDB_REQUIRES_PWCHANGE      0x00000200
  46 #define KRB5_KDB_DISALLOW_SVR           0x00001000
  47 #define KRB5_KDB_PWCHANGE_SERVICE       0x00002000
  48 #define KRB5_KDB_SUPPORT_DESMD5         0x00004000
  49 #define KRB5_KDB_NEW_PRINC              0x00008000
  50
  51 /*
  52
  53 key: krb5_unparse_name  + NUL
  54
  55  16: baselength
  56  32: attributes
  57  32: max time
  58  32: max renewable time
  59  32: client expire
  60  32: passwd expire
  61  32: last successful passwd
  62  32: last failed attempt
  63  32: num of failed attempts
  64  16: num tl data
  65  16: num data data
  66  16: principal length
  67  length: principal
  68  for num tl data times
  69     16: tl data type
  70     16: tl data length
  71     length: length
  72  for num key data times
  73     16: version (num keyblocks)
  74     16: kvno
  75     for version times:
  76         16: type
  77         16: length
  78         length: keydata
  79
  80
  81 key_data_contents[0]
  82
  83         int16: length
  84         read-of-data: key-encrypted, key-usage 0, master-key
  85
  86 salt:
  87     version2 = salt in key_data->key_data_contents[1]
  88     else default salt.
  89
  90 */
  91
  92 #include "hdb_locl.h"
  93
  94 #define KDB_V1_BASE_LENGTH 38
  95
  96 #if HAVE_DB1
  97
  98 #if defined(HAVE_DB_185_H)
  99 #include <db_185.h>
 100 #elif defined(HAVE_DB_H)
 101 #include <db.h>
 102 #endif
 103
 104 #define CHECK(x) do { if ((x)) goto out; } while(0)
 105
 106 static krb5_error_code
 107 mdb_principal2key(krb5_context context,
 108                   krb5_const_principal principal,
 109                   krb5_data *key)
 110 {
 111     krb5_error_code ret;
 112     char *str;
 113
 114     ret = krb5_unparse_name(context, principal, &str);
 115     if (ret)
 116         return ret;
 117     key->data = str;
 118     key->length = strlen(str) + 1;
 119     return 0;
 120 }
 121
 122 #define KRB5_KDB_SALTTYPE_NORMAL        0
 123 #define KRB5_KDB_SALTTYPE_V4            1
 124 #define KRB5_KDB_SALTTYPE_NOREALM       2
 125 #define KRB5_KDB_SALTTYPE_ONLYREALM     3
 126 #define KRB5_KDB_SALTTYPE_SPECIAL       4
 127 #define KRB5_KDB_SALTTYPE_AFS3          5
 128
 129 static krb5_error_code
 130 fix_salt(krb5_context context, hdb_entry *ent, int key_num)
 131 {
 132     krb5_error_code ret;
 133     Salt *salt = ent->keys.val[key_num].salt;
 134     /* fix salt type */
 135     switch((int)salt->type) {
 136     case KRB5_KDB_SALTTYPE_NORMAL:
 137         salt->type = KRB5_PADATA_PW_SALT;
 138         break;
 139     case KRB5_KDB_SALTTYPE_V4:
 140         krb5_data_free(&salt->salt);
 141         salt->type = KRB5_PADATA_PW_SALT;
 142         break;
 143     case KRB5_KDB_SALTTYPE_NOREALM:
 144     {
 145         size_t len;
 146         int i;
 147         char *p;
 148
 149         len = 0;
 150         for (i = 0; i < ent->principal->name.name_string.len; ++i)
 151             len += strlen(ent->principal->name.name_string.val[i]);
 152         ret = krb5_data_alloc (&salt->salt, len);
 153         if (ret)
 154             return ret;
 155         p = salt->salt.data;
 156         for (i = 0; i < ent->principal->name.name_string.len; ++i) {
 157             memcpy (p,
 158                     ent->principal->name.name_string.val[i],
 159                     strlen(ent->principal->name.name_string.val[i]));
 160             p += strlen(ent->principal->name.name_string.val[i]);
 161         }
 162
 163         salt->type = KRB5_PADATA_PW_SALT;
 164         break;
 165     }
 166     case KRB5_KDB_SALTTYPE_ONLYREALM:
 167         krb5_data_free(&salt->salt);
 168         ret = krb5_data_copy(&salt->salt,
 169                              ent->principal->realm,
 170                              strlen(ent->principal->realm));
 171         if(ret)
 172             return ret;
 173         salt->type = KRB5_PADATA_PW_SALT;
 174         break;
 175     case KRB5_KDB_SALTTYPE_SPECIAL:
 176         salt->type = KRB5_PADATA_PW_SALT;
 177         break;
 178     case KRB5_KDB_SALTTYPE_AFS3:
 179         krb5_data_free(&salt->salt);
 180         ret = krb5_data_copy(&salt->salt,
 181                        ent->principal->realm,
 182                        strlen(ent->principal->realm));
 183         if(ret)
 184             return ret;
 185         salt->type = KRB5_PADATA_AFS3_SALT;
 186         break;
 187     default:
 188         abort();
 189     }
 190     return 0;
 191 }
 192
 193
 194 static krb5_error_code
 195 mdb_value2entry(krb5_context context, krb5_data *data, hdb_entry *entry)
 196 {
 197     krb5_error_code ret;
 198     krb5_storage *sp;
 199     uint32_t u32;
 200     uint16_t u16, num_keys, num_tl;
 201     size_t i, j;
 202     char *p = NULL;
 203
 204     sp = krb5_storage_from_data(data);
 205     if (sp == NULL) {
 206         krb5_set_error_message(context, ENOMEM, "out of memory");
 207         return ENOMEM;
 208     }
 209
 210     krb5_storage_set_byteorder(sp, KRB5_STORAGE_BYTEORDER_LE);
 211
 212     /* 16: baselength */
 213     CHECK(ret = krb5_ret_uint16(sp, &u16));
 214     if (u16 != KDB_V1_BASE_LENGTH) { ret = EINVAL; goto out; }
 215     /* 32: attributes */
 216     CHECK(ret = krb5_ret_uint32(sp, &u32));
 217     entry->flags.postdate =      !(u16 & KRB5_KDB_DISALLOW_POSTDATED);
 218     entry->flags.forwardable =   !(u16 & KRB5_KDB_DISALLOW_FORWARDABLE);
 219     entry->flags.initial =      !!(u16 & KRB5_KDB_DISALLOW_TGT_BASED);
 220     entry->flags.renewable =     !(u16 & KRB5_KDB_DISALLOW_RENEWABLE);
 221     entry->flags.proxiable =     !(u16 & KRB5_KDB_DISALLOW_PROXIABLE);
 222     /* DUP_SKEY */
 223     entry->flags.invalid =      !!(u16 & KRB5_KDB_DISALLOW_ALL_TIX);
 224     entry->flags.require_preauth =!!(u16 & KRB5_KDB_REQUIRES_PRE_AUTH);
 225     entry->flags.require_hwauth =!!(u16 & KRB5_KDB_REQUIRES_HW_AUTH);
 226     entry->flags.server =        !(u16 & KRB5_KDB_DISALLOW_SVR);
 227     entry->flags.change_pw =    !!(u16 & KRB5_KDB_PWCHANGE_SERVICE);
 228     entry->flags.client =          1; /* XXX */
 229
 230     /* 32: max time */
 231     CHECK(ret = krb5_ret_uint32(sp, &u32));
 232     if (u32) {
 233         entry->max_life = malloc(sizeof(*entry->max_life));
 234         *entry->max_life = u32;
 235     }
 236     /* 32: max renewable time */
 237     CHECK(ret = krb5_ret_uint32(sp, &u32));
 238     if (u32) {
 239         entry->max_renew = malloc(sizeof(*entry->max_renew));
 240         *entry->max_renew = u32;
 241     }
 242     /* 32: client expire */
 243     CHECK(ret = krb5_ret_uint32(sp, &u32));
 244     if (u32) {
 245         entry->valid_end = malloc(sizeof(*entry->valid_end));
 246         *entry->valid_end = u32;
 247     }
 248     /* 32: passwd expire */
 249     CHECK(ret = krb5_ret_uint32(sp, &u32));
 250     if (u32) {
 251         entry->pw_end = malloc(sizeof(*entry->pw_end));
 252         *entry->pw_end = u32;
 253     }
 254     /* 32: last successful passwd */
 255     CHECK(ret = krb5_ret_uint32(sp, &u32));
 256     /* 32: last failed attempt */
 257     CHECK(ret = krb5_ret_uint32(sp, &u32));
 258     /* 32: num of failed attempts */
 259     CHECK(ret = krb5_ret_uint32(sp, &u32));
 260     /* 16: num tl data */
 261     CHECK(ret = krb5_ret_uint16(sp, &u16));
 262     num_tl = u16;
 263     /* 16: num key data */
 264     CHECK(ret = krb5_ret_uint16(sp, &u16));
 265     num_keys = u16;
 266     /* 16: principal length */
 267     CHECK(ret = krb5_ret_uint16(sp, &u16));
 268     /* length: principal */
 269     {
 270         p = malloc(u16 + 1);
 271         krb5_storage_read(sp, p, u16);
 272         p[u16] = '\0';
 273         CHECK(ret = krb5_parse_name(context, p, &entry->principal));
 274         free(p); p = NULL;
 275     }
 276     /* for num tl data times
 277            16: tl data type
 278            16: tl data length
 279            length: length */
 280     for (i = 0; i < num_tl; i++) {
 281         CHECK(ret = krb5_ret_uint16(sp, &u16));
 282         CHECK(ret = krb5_ret_uint16(sp, &u16));
 283         krb5_storage_seek(sp, u16, SEEK_CUR);
 284     }
 285     /* for num key data times
 286        16: version (num keyblocks)
 287        16: kvno
 288        for version times:
 289            16: type
 290            16: length
 291            length: keydata */
 292     for (i = 0; i < num_keys; i++) {
 293         int keep = 0;
 294         uint16_t version;
 295         void *ptr;
 296
 297         CHECK(ret = krb5_ret_uint16(sp, &u16));
 298         version = u16;
 299         CHECK(ret = krb5_ret_uint16(sp, &u16));
 300
 301         if (entry->kvno < u16) {
 302             keep = 1;
 303             entry->kvno = u16;
 304             for (j = 0; j < entry->keys.len; j++) {
 305                 free_Key(&entry->keys.val[j]);
 306                 free(entry->keys.val);
 307                 entry->keys.len = 0;
 308                 entry->keys.val = NULL;
 309             }
 310         } else if (entry->kvno == u16)
 311             keep = 1;
 312
 313         if (keep) {
 314             Key *k;
 315
 316             ptr = realloc(entry->keys.val, sizeof(entry->keys.val[0]) * (entry->keys.len + 1));
 317             if (ptr == NULL) {
 318                 ret = ENOMEM;
 319                 goto out;
 320             }
 321             entry->keys.val = ptr;
 322
 323             /* k points to current Key */
 324             k = &entry->keys.val[entry->keys.len];
 325
 326             memset(k, 0, sizeof(*k));
 327             entry->keys.len += 1;
 328
 329             entry->keys.val[i].mkvno = malloc(sizeof(*entry->keys.val[i].mkvno));
 330             if (entry->keys.val[i].mkvno == NULL) {
 331                 ret = ENOMEM;
 332                 goto out;
 333             }
 334             *entry->keys.val[i].mkvno = 1;
 335
 336             for (j = 0; j < version; j++) {
 337                 uint16_t type;
 338                 CHECK(ret = krb5_ret_uint16(sp, &type));
 339                 CHECK(ret = krb5_ret_uint16(sp, &u16));
 340                 if (j == 0) { /* key */
 341                     k->key.keytype = type;
 342                     if (u16 < 2) {
 343                         ret = EINVAL;
 344                         goto out;
 345                     }
 346                     krb5_storage_seek(sp, 2, SEEK_CUR); /* skip real length */
 347                     k->key.keyvalue.length = u16 - 2;
 348                     k->key.keyvalue.data = malloc(k->key.keyvalue.length);
 349                     krb5_storage_read(sp, k->key.keyvalue.data, k->key.keyvalue.length);
 350                 } else if (j == 1) { /* salt */
 351                     k->salt = calloc(1, sizeof(*k->salt));
 352                     if (k->salt == NULL) {
 353                         ret = ENOMEM;
 354                         goto out;
 355                     }
 356                     k->salt->type = type;
 357                     if (u16 != 0) {
 358                         k->salt->salt.data = malloc(u16);
 359                         if (k->salt->salt.data == NULL) {
 360                             ret = ENOMEM;
 361                             goto out;
 362                         }
 363                         k->salt->salt.length = u16;
 364                         krb5_storage_read(sp, k->salt->salt.data, k->salt->salt.length);
 365                     }
 366                     fix_salt(context, entry, entry->keys.len - 1);
 367                 } else {
 368                     krb5_storage_seek(sp, u16, SEEK_CUR);
 369                 }
 370             }
 371         } else {
 372             /* skip */
 373             for (j = 0; j < version; j++) {
 374                 CHECK(ret = krb5_ret_uint16(sp, &u16));
 375                 CHECK(ret = krb5_ret_uint16(sp, &u16));
 376                 krb5_storage_seek(sp, u16, u16);
 377             }
 378         }
 379     }
 380
 381     return 0;
 382  out:
 383     if (p)
 384         free(p);
 385     free_hdb_entry(entry);
 386     return ret;
 387 }
 388
 389 #if 0
 390 static krb5_error_code
 391 mdb_entry2value(krb5_context context, hdb_entry *entry, krb5_data *data)
 392 {
 393     return EINVAL;
 394 }
 395 #endif
 396
 397
 398 static krb5_error_code
 399 mdb_close(krb5_context context, HDB *db)
 400 {
 401     DB *d = (DB*)db->hdb_db;
 402     (*d->close)(d);
 403     return 0;
 404 }
 405
 406 static krb5_error_code
 407 mdb_destroy(krb5_context context, HDB *db)
 408 {
 409     krb5_error_code ret;
 410
 411     ret = hdb_clear_master_key (context, db);
 412     free(db->hdb_name);
 413     free(db);
 414     return ret;
 415 }
 416
 417 static krb5_error_code
 418 mdb_lock(krb5_context context, HDB *db, int operation)
 419 {
 420     DB *d = (DB*)db->hdb_db;
 421     int fd = (*d->fd)(d);
 422     if(fd < 0) {
 423         krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
 424                                "Can't lock database: %s", db->hdb_name);
 425         return HDB_ERR_CANT_LOCK_DB;
 426     }
 427     return hdb_lock(fd, operation);
 428 }
 429
 430 static krb5_error_code
 431 mdb_unlock(krb5_context context, HDB *db)
 432 {
 433     DB *d = (DB*)db->hdb_db;
 434     int fd = (*d->fd)(d);
 435     if(fd < 0) {
 436         krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
 437                                "Can't unlock database: %s", db->hdb_name);
 438         return HDB_ERR_CANT_LOCK_DB;
 439     }
 440     return hdb_unlock(fd);
 441 }
 442
 443
 444 static krb5_error_code
 445 mdb_seq(krb5_context context, HDB *db,
 446        unsigned flags, hdb_entry_ex *entry, int flag)
 447 {
 448     DB *d = (DB*)db->hdb_db;
 449     DBT key, value;
 450     krb5_data key_data, data;
 451     int code;
 452
 453     code = db->hdb_lock(context, db, HDB_RLOCK);
 454     if(code == -1) {
 455         krb5_set_error_message(context, HDB_ERR_DB_INUSE, "Database %s in use", db->hdb_name);
 456         return HDB_ERR_DB_INUSE;
 457     }
 458     code = (*d->seq)(d, &key, &value, flag);
 459     db->hdb_unlock(context, db); /* XXX check value */
 460     if(code == -1) {
 461         code = errno;
 462         krb5_set_error_message(context, code, "Database %s seq error: %s",
 463                                db->hdb_name, strerror(code));
 464         return code;
 465     }
 466     if(code == 1) {
 467         krb5_clear_error_message(context);
 468         return HDB_ERR_NOENTRY;
 469     }
 470
 471     key_data.data = key.data;
 472     key_data.length = key.size;
 473     data.data = value.data;
 474     data.length = value.size;
 475     memset(entry, 0, sizeof(*entry));
 476
 477     if (mdb_value2entry(context, &data, &entry->entry))
 478         return mdb_seq(context, db, flags, entry, R_NEXT);
 479
 480     if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
 481         code = hdb_unseal_keys (context, db, &entry->entry);
 482         if (code)
 483             hdb_free_entry (context, entry);
 484     }
 485
 486     return code;
 487 }
 488
 489
 490 static krb5_error_code
 491 mdb_firstkey(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
 492 {
 493     return mdb_seq(context, db, flags, entry, R_FIRST);
 494 }
 495
 496
 497 static krb5_error_code
 498 mdb_nextkey(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
 499 {
 500     return mdb_seq(context, db, flags, entry, R_NEXT);
 501 }
 502
 503 static krb5_error_code
 504 mdb_rename(krb5_context context, HDB *db, const char *new_name)
 505 {
 506     int ret;
 507     char *old, *new;
 508
 509     asprintf(&old, "%s.db", db->hdb_name);
 510     asprintf(&new, "%s.db", new_name);
 511     ret = rename(old, new);
 512     free(old);
 513     free(new);
 514     if(ret)
 515         return errno;
 516
 517     free(db->hdb_name);
 518     db->hdb_name = strdup(new_name);
 519     return 0;
 520 }
 521
 522 static krb5_error_code
 523 mdb__get(krb5_context context, HDB *db, krb5_data key, krb5_data *reply)
 524 {
 525     DB *d = (DB*)db->hdb_db;
 526     DBT k, v;
 527     int code;
 528
 529     k.data = key.data;
 530     k.size = key.length;
 531     code = db->hdb_lock(context, db, HDB_RLOCK);
 532     if(code)
 533         return code;
 534     code = (*d->get)(d, &k, &v, 0);
 535     db->hdb_unlock(context, db);
 536     if(code < 0) {
 537         code = errno;
 538         krb5_set_error_message(context, code, "Database %s get error: %s",
 539                                db->hdb_name, strerror(code));
 540         return code;
 541     }
 542     if(code == 1) {
 543         krb5_clear_error_message(context);
 544         return HDB_ERR_NOENTRY;
 545     }
 546
 547     krb5_data_copy(reply, v.data, v.size);
 548     return 0;
 549 }
 550
 551 static krb5_error_code
 552 mdb__put(krb5_context context, HDB *db, int replace,
 553         krb5_data key, krb5_data value)
 554 {
 555     DB *d = (DB*)db->hdb_db;
 556     DBT k, v;
 557     int code;
 558
 559     k.data = key.data;
 560     k.size = key.length;
 561     v.data = value.data;
 562     v.size = value.length;
 563     code = db->hdb_lock(context, db, HDB_WLOCK);
 564     if(code)
 565         return code;
 566     code = (*d->put)(d, &k, &v, replace ? 0 : R_NOOVERWRITE);
 567     db->hdb_unlock(context, db);
 568     if(code < 0) {
 569         code = errno;
 570         krb5_set_error_message(context, code, "Database %s put error: %s",
 571                                db->hdb_name, strerror(code));
 572         return code;
 573     }
 574     if(code == 1) {
 575         krb5_clear_error_message(context);
 576         return HDB_ERR_EXISTS;
 577     }
 578     return 0;
 579 }
 580
 581 static krb5_error_code
 582 mdb__del(krb5_context context, HDB *db, krb5_data key)
 583 {
 584     DB *d = (DB*)db->hdb_db;
 585     DBT k;
 586     krb5_error_code code;
 587     k.data = key.data;
 588     k.size = key.length;
 589     code = db->hdb_lock(context, db, HDB_WLOCK);
 590     if(code)
 591         return code;
 592     code = (*d->del)(d, &k, 0);
 593     db->hdb_unlock(context, db);
 594     if(code == 1) {
 595         code = errno;
 596         krb5_set_error_message(context, code, "Database %s put error: %s",
 597                                db->hdb_name, strerror(code));
 598         return code;
 599     }
 600     if(code < 0)
 601         return errno;
 602     return 0;
 603 }
 604
 605 static krb5_error_code
 606 mdb_fetch(krb5_context context, HDB *db, krb5_const_principal principal,
 607           unsigned flags, hdb_entry_ex *entry)
 608 {
 609     krb5_data key, value;
 610     krb5_error_code code;
 611
 612     code = mdb_principal2key(context, principal, &key);
 613     if (code)
 614         return code;
 615     code = db->hdb__get(context, db, key, &value);
 616     krb5_data_free(&key);
 617     if(code)
 618         return code;
 619     code = mdb_value2entry(context, &value, &entry->entry);
 620     krb5_data_free(&value);
 621     if (code)
 622         return code;
 623
 624     if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
 625         code = hdb_unseal_keys (context, db, &entry->entry);
 626         if (code)
 627             hdb_free_entry(context, entry);
 628     }
 629
 630     return 0;
 631 }
 632
 633 static krb5_error_code
 634 mdb_store(krb5_context context, HDB *db, unsigned flags, hdb_entry_ex *entry)
 635 {
 636     krb5_set_error_message(context, EINVAL, "can't set principal in mdb");
 637     return EINVAL;
 638 }
 639
 640 static krb5_error_code
 641 mdb_remove(krb5_context context, HDB *db, krb5_const_principal principal)
 642 {
 643     krb5_error_code code;
 644     krb5_data key;
 645
 646     mdb_principal2key(context, principal, &key);
 647     code = db->hdb__del(context, db, key);
 648     krb5_data_free(&key);
 649     return code;
 650 }
 651
 652 static krb5_error_code
 653 mdb_open(krb5_context context, HDB *db, int flags, mode_t mode)
 654 {
 655     char *fn;
 656     krb5_error_code ret;
 657
 658     asprintf(&fn, "%s.db", db->hdb_name);
 659     if (fn == NULL) {
 660         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 661         return ENOMEM;
 662     }
 663     db->hdb_db = dbopen(fn, flags, mode, DB_BTREE, NULL);
 664     free(fn);
 665
 666     if (db->hdb_db == NULL) {
 667         switch (errno) {
 668 #ifdef EFTYPE
 669         case EFTYPE:
 670 #endif
 671         case EINVAL:
 672             db->hdb_db = dbopen(fn, flags, mode, DB_BTREE, NULL);
 673         }
 674     }
 675
 676     /* try to open without .db extension */
 677     if(db->hdb_db == NULL && errno == ENOENT)
 678         db->hdb_db = dbopen(db->hdb_name, flags, mode, DB_BTREE, NULL);
 679     if(db->hdb_db == NULL) {
 680         ret = errno;
 681         krb5_set_error_message(context, ret, "dbopen (%s): %s",
 682                               db->hdb_name, strerror(ret));
 683         return ret;
 684     }
 685     if((flags & O_ACCMODE) == O_RDONLY)
 686         ret = hdb_check_db_format(context, db);
 687     else
 688         ret = hdb_init_db(context, db);
 689     if(ret == HDB_ERR_NOENTRY) {
 690         krb5_clear_error_message(context);
 691         return 0;
 692     }
 693     if (ret) {
 694         mdb_close(context, db);
 695         krb5_set_error_message(context, ret, "hdb_open: failed %s database %s",
 696                               (flags & O_ACCMODE) == O_RDONLY ?
 697                               "checking format of" : "initialize",
 698                               db->hdb_name);
 699     }
 700     return ret;
 701 }
 702
 703 krb5_error_code
 704 hdb_mdb_create(krb5_context context, HDB **db,
 705                const char *filename)
 706 {
 707     *db = calloc(1, sizeof(**db));
 708     if (*db == NULL) {
 709         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 710         return ENOMEM;
 711     }
 712
 713     (*db)->hdb_db = NULL;
 714     (*db)->hdb_name = strdup(filename);
 715     if ((*db)->hdb_name == NULL) {
 716         free(*db);
 717         *db = NULL;
 718         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 719         return ENOMEM;
 720     }
 721     (*db)->hdb_master_key_set = 0;
 722     (*db)->hdb_openp = 0;
 723     (*db)->hdb_capability_flags = 0;
 724     (*db)->hdb_open = mdb_open;
 725     (*db)->hdb_close = mdb_close;
 726     (*db)->hdb_fetch = mdb_fetch;
 727     (*db)->hdb_store = mdb_store;
 728     (*db)->hdb_remove = mdb_remove;
 729     (*db)->hdb_firstkey = mdb_firstkey;
 730     (*db)->hdb_nextkey= mdb_nextkey;
 731     (*db)->hdb_lock = mdb_lock;
 732     (*db)->hdb_unlock = mdb_unlock;
 733     (*db)->hdb_rename = mdb_rename;
 734     (*db)->hdb__get = mdb__get;
 735     (*db)->hdb__put = mdb__put;
 736     (*db)->hdb__del = mdb__del;
 737     (*db)->hdb_destroy = mdb_destroy;
 738     return 0;
 739 }
 740
 741 #endif /* HAVE_DB1 */