lib/krb5/kcm.c

   1 /*
   2  * Copyright (c) 2005, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. Neither the name of PADL Software nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include "krb5_locl.h"
  36
  37 #ifdef HAVE_KCM
  38 /*
  39  * Client library for Kerberos Credentials Manager (KCM) daemon
  40  */
  41
  42 #include "kcm.h"
  43 #include <heim-ipc.h>
  44
  45 static krb5_error_code
  46 kcm_set_kdc_offset(krb5_context, krb5_ccache, krb5_deltat);
  47
  48 static const char *kcm_ipc_name = "ANY:org.h5l.kcm";
  49
  50 typedef struct krb5_kcmcache {
  51     char *name;
  52 } krb5_kcmcache;
  53
  54 typedef struct krb5_kcm_cursor {
  55     unsigned long offset;
  56     unsigned long length;
  57     kcmuuid_t *uuids;
  58 } *krb5_kcm_cursor;
  59
  60
  61 #define KCMCACHE(X)     ((krb5_kcmcache *)(X)->data.data)
  62 #define CACHENAME(X)    (KCMCACHE(X)->name)
  63 #define KCMCURSOR(C)    ((krb5_kcm_cursor)(C))
  64
  65 static HEIMDAL_MUTEX kcm_mutex = HEIMDAL_MUTEX_INITIALIZER;
  66 static heim_ipc kcm_ipc = NULL;
  67
  68 static krb5_error_code
  69 kcm_send_request(krb5_context context,
  70                  krb5_storage *request,
  71                  krb5_data *response_data)
  72 {
  73     krb5_error_code ret = 0;
  74     krb5_data request_data;
  75
  76     HEIMDAL_MUTEX_lock(&kcm_mutex);
  77     if (kcm_ipc == NULL)
  78         ret = heim_ipc_init_context(kcm_ipc_name, &kcm_ipc);
  79     HEIMDAL_MUTEX_unlock(&kcm_mutex);
  80     if (ret)
  81         return KRB5_CC_NOSUPP;
  82
  83     ret = krb5_storage_to_data(request, &request_data);
  84     if (ret) {
  85         krb5_clear_error_message(context);
  86         return KRB5_CC_NOMEM;
  87     }
  88
  89     ret = heim_ipc_call(kcm_ipc, &request_data, response_data, NULL);
  90     krb5_data_free(&request_data);
  91
  92     if (ret) {
  93         krb5_clear_error_message(context);
  94         ret = KRB5_CC_NOSUPP;
  95     }
  96
  97     return ret;
  98 }
  99
 100 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 101 krb5_kcm_storage_request(krb5_context context,
 102                          uint16_t opcode,
 103                          krb5_storage **storage_p)
 104 {
 105     krb5_storage *sp;
 106     krb5_error_code ret;
 107
 108     *storage_p = NULL;
 109
 110     sp = krb5_storage_emem();
 111     if (sp == NULL) {
 112         krb5_set_error_message(context, KRB5_CC_NOMEM, N_("malloc: out of memory", ""));
 113         return KRB5_CC_NOMEM;
 114     }
 115
 116     /* Send MAJOR | VERSION | OPCODE */
 117     ret  = krb5_store_int8(sp, KCM_PROTOCOL_VERSION_MAJOR);
 118     if (ret)
 119         goto fail;
 120     ret = krb5_store_int8(sp, KCM_PROTOCOL_VERSION_MINOR);
 121     if (ret)
 122         goto fail;
 123     ret = krb5_store_int16(sp, opcode);
 124     if (ret)
 125         goto fail;
 126
 127     *storage_p = sp;
 128  fail:
 129     if (ret) {
 130         krb5_set_error_message(context, ret,
 131                                N_("Failed to encode KCM request", ""));
 132         krb5_storage_free(sp);
 133     }
 134
 135     return ret;
 136 }
 137
 138 static krb5_error_code
 139 kcm_alloc(krb5_context context, const char *name, krb5_ccache *id)
 140 {
 141     krb5_kcmcache *k;
 142
 143     k = malloc(sizeof(*k));
 144     if (k == NULL) {
 145         krb5_set_error_message(context, KRB5_CC_NOMEM,
 146                                N_("malloc: out of memory", ""));
 147         return KRB5_CC_NOMEM;
 148     }
 149
 150     if (name != NULL) {
 151         k->name = strdup(name);
 152         if (k->name == NULL) {
 153             free(k);
 154             krb5_set_error_message(context, KRB5_CC_NOMEM,
 155                                    N_("malloc: out of memory", ""));
 156             return KRB5_CC_NOMEM;
 157         }
 158     } else
 159         k->name = NULL;
 160
 161     (*id)->data.data = k;
 162     (*id)->data.length = sizeof(*k);
 163
 164     return 0;
 165 }
 166
 167 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 168 krb5_kcm_call(krb5_context context,
 169               krb5_storage *request,
 170               krb5_storage **response_p,
 171               krb5_data *response_data_p)
 172 {
 173     krb5_data response_data;
 174     krb5_error_code ret;
 175     int32_t status;
 176     krb5_storage *response;
 177
 178     if (response_p != NULL)
 179         *response_p = NULL;
 180
 181     krb5_data_zero(&response_data);
 182
 183     ret = kcm_send_request(context, request, &response_data);
 184     if (ret)
 185         return ret;
 186
 187     response = krb5_storage_from_data(&response_data);
 188     if (response == NULL) {
 189         krb5_data_free(&response_data);
 190         return KRB5_CC_IO;
 191     }
 192
 193     ret = krb5_ret_int32(response, &status);
 194     if (ret) {
 195         krb5_storage_free(response);
 196         krb5_data_free(&response_data);
 197         return KRB5_CC_FORMAT;
 198     }
 199
 200     if (status) {
 201         krb5_storage_free(response);
 202         krb5_data_free(&response_data);
 203         return status;
 204     }
 205
 206     if (response_p != NULL) {
 207         *response_data_p = response_data;
 208         *response_p = response;
 209
 210         return 0;
 211     }
 212
 213     krb5_storage_free(response);
 214     krb5_data_free(&response_data);
 215
 216     return 0;
 217 }
 218
 219 static void
 220 kcm_free(krb5_context context, krb5_ccache *id)
 221 {
 222     krb5_kcmcache *k = KCMCACHE(*id);
 223
 224     if (k != NULL) {
 225         if (k->name != NULL)
 226             free(k->name);
 227         memset(k, 0, sizeof(*k));
 228         krb5_data_free(&(*id)->data);
 229     }
 230 }
 231
 232 static const char *
 233 kcm_get_name(krb5_context context,
 234              krb5_ccache id)
 235 {
 236     return CACHENAME(id);
 237 }
 238
 239 static krb5_error_code
 240 kcm_resolve(krb5_context context, krb5_ccache *id, const char *res)
 241 {
 242     return kcm_alloc(context, res, id);
 243 }
 244
 245 /*
 246  * Request:
 247  *
 248  * Response:
 249  *      NameZ
 250  */
 251 static krb5_error_code
 252 kcm_gen_new(krb5_context context, krb5_ccache *id)
 253 {
 254     krb5_kcmcache *k;
 255     krb5_error_code ret;
 256     krb5_storage *request, *response;
 257     krb5_data response_data;
 258
 259     ret = kcm_alloc(context, NULL, id);
 260     if (ret)
 261         return ret;
 262
 263     k = KCMCACHE(*id);
 264
 265     ret = krb5_kcm_storage_request(context, KCM_OP_GEN_NEW, &request);
 266     if (ret) {
 267         kcm_free(context, id);
 268         return ret;
 269     }
 270
 271     ret = krb5_kcm_call(context, request, &response, &response_data);
 272     if (ret) {
 273         krb5_storage_free(request);
 274         kcm_free(context, id);
 275         return ret;
 276     }
 277
 278     ret = krb5_ret_stringz(response, &k->name);
 279     if (ret)
 280         ret = KRB5_CC_IO;
 281
 282     krb5_storage_free(request);
 283     krb5_storage_free(response);
 284     krb5_data_free(&response_data);
 285
 286     if (ret)
 287         kcm_free(context, id);
 288
 289     return ret;
 290 }
 291
 292 /*
 293  * Request:
 294  *      NameZ
 295  *      Principal
 296  *
 297  * Response:
 298  *
 299  */
 300 static krb5_error_code
 301 kcm_initialize(krb5_context context,
 302                krb5_ccache id,
 303                krb5_principal primary_principal)
 304 {
 305     krb5_error_code ret;
 306     krb5_kcmcache *k = KCMCACHE(id);
 307     krb5_storage *request;
 308
 309     ret = krb5_kcm_storage_request(context, KCM_OP_INITIALIZE, &request);
 310     if (ret)
 311         return ret;
 312
 313     ret = krb5_store_stringz(request, k->name);
 314     if (ret) {
 315         krb5_storage_free(request);
 316         return ret;
 317     }
 318
 319     ret = krb5_store_principal(request, primary_principal);
 320     if (ret) {
 321         krb5_storage_free(request);
 322         return ret;
 323     }
 324
 325     ret = krb5_kcm_call(context, request, NULL, NULL);
 326
 327     krb5_storage_free(request);
 328
 329     if (context->kdc_sec_offset)
 330         kcm_set_kdc_offset(context, id, context->kdc_sec_offset);
 331
 332     return ret;
 333 }
 334
 335 static krb5_error_code
 336 kcm_close(krb5_context context,
 337           krb5_ccache id)
 338 {
 339     kcm_free(context, &id);
 340     return 0;
 341 }
 342
 343 /*
 344  * Request:
 345  *      NameZ
 346  *
 347  * Response:
 348  *
 349  */
 350 static krb5_error_code
 351 kcm_destroy(krb5_context context,
 352             krb5_ccache id)
 353 {
 354     krb5_error_code ret;
 355     krb5_kcmcache *k = KCMCACHE(id);
 356     krb5_storage *request;
 357
 358     ret = krb5_kcm_storage_request(context, KCM_OP_DESTROY, &request);
 359     if (ret)
 360         return ret;
 361
 362     ret = krb5_store_stringz(request, k->name);
 363     if (ret) {
 364         krb5_storage_free(request);
 365         return ret;
 366     }
 367
 368     ret = krb5_kcm_call(context, request, NULL, NULL);
 369
 370     krb5_storage_free(request);
 371     return ret;
 372 }
 373
 374 /*
 375  * Request:
 376  *      NameZ
 377  *      Creds
 378  *
 379  * Response:
 380  *
 381  */
 382 static krb5_error_code
 383 kcm_store_cred(krb5_context context,
 384                krb5_ccache id,
 385                krb5_creds *creds)
 386 {
 387     krb5_error_code ret;
 388     krb5_kcmcache *k = KCMCACHE(id);
 389     krb5_storage *request;
 390
 391     ret = krb5_kcm_storage_request(context, KCM_OP_STORE, &request);
 392     if (ret)
 393         return ret;
 394
 395     ret = krb5_store_stringz(request, k->name);
 396     if (ret) {
 397         krb5_storage_free(request);
 398         return ret;
 399     }
 400
 401     ret = krb5_store_creds(request, creds);
 402     if (ret) {
 403         krb5_storage_free(request);
 404         return ret;
 405     }
 406
 407     ret = krb5_kcm_call(context, request, NULL, NULL);
 408
 409     krb5_storage_free(request);
 410     return ret;
 411 }
 412
 413 #if 0
 414 /*
 415  * Request:
 416  *      NameZ
 417  *      WhichFields
 418  *      MatchCreds
 419  *
 420  * Response:
 421  *      Creds
 422  *
 423  */
 424 static krb5_error_code
 425 kcm_retrieve(krb5_context context,
 426              krb5_ccache id,
 427              krb5_flags which,
 428              const krb5_creds *mcred,
 429              krb5_creds *creds)
 430 {
 431     krb5_error_code ret;
 432     krb5_kcmcache *k = KCMCACHE(id);
 433     krb5_storage *request, *response;
 434     krb5_data response_data;
 435
 436     ret = krb5_kcm_storage_request(context, KCM_OP_RETRIEVE, &request);
 437     if (ret)
 438         return ret;
 439
 440     ret = krb5_store_stringz(request, k->name);
 441     if (ret) {
 442         krb5_storage_free(request);
 443         return ret;
 444     }
 445
 446     ret = krb5_store_int32(request, which);
 447     if (ret) {
 448         krb5_storage_free(request);
 449         return ret;
 450     }
 451
 452     ret = krb5_store_creds_tag(request, rk_UNCONST(mcred));
 453     if (ret) {
 454         krb5_storage_free(request);
 455         return ret;
 456     }
 457
 458     ret = krb5_kcm_call(context, request, &response, &response_data);
 459     if (ret) {
 460         krb5_storage_free(request);
 461         return ret;
 462     }
 463
 464     ret = krb5_ret_creds(response, creds);
 465     if (ret)
 466         ret = KRB5_CC_IO;
 467
 468     krb5_storage_free(request);
 469     krb5_storage_free(response);
 470     krb5_data_free(&response_data);
 471
 472     return ret;
 473 }
 474 #endif
 475
 476 /*
 477  * Request:
 478  *      NameZ
 479  *
 480  * Response:
 481  *      Principal
 482  */
 483 static krb5_error_code
 484 kcm_get_principal(krb5_context context,
 485                   krb5_ccache id,
 486                   krb5_principal *principal)
 487 {
 488     krb5_error_code ret;
 489     krb5_kcmcache *k = KCMCACHE(id);
 490     krb5_storage *request, *response;
 491     krb5_data response_data;
 492
 493     ret = krb5_kcm_storage_request(context, KCM_OP_GET_PRINCIPAL, &request);
 494     if (ret)
 495         return ret;
 496
 497     ret = krb5_store_stringz(request, k->name);
 498     if (ret) {
 499         krb5_storage_free(request);
 500         return ret;
 501     }
 502
 503     ret = krb5_kcm_call(context, request, &response, &response_data);
 504     if (ret) {
 505         krb5_storage_free(request);
 506         return ret;
 507     }
 508
 509     ret = krb5_ret_principal(response, principal);
 510     if (ret)
 511         ret = KRB5_CC_IO;
 512
 513     krb5_storage_free(request);
 514     krb5_storage_free(response);
 515     krb5_data_free(&response_data);
 516
 517     return ret;
 518 }
 519
 520 /*
 521  * Request:
 522  *      NameZ
 523  *
 524  * Response:
 525  *      Cursor
 526  *
 527  */
 528 static krb5_error_code
 529 kcm_get_first (krb5_context context,
 530                krb5_ccache id,
 531                krb5_cc_cursor *cursor)
 532 {
 533     krb5_error_code ret;
 534     krb5_kcm_cursor c;
 535     krb5_kcmcache *k = KCMCACHE(id);
 536     krb5_storage *request, *response;
 537     krb5_data response_data;
 538
 539     ret = krb5_kcm_storage_request(context, KCM_OP_GET_CRED_UUID_LIST, &request);
 540     if (ret)
 541         return ret;
 542
 543     ret = krb5_store_stringz(request, k->name);
 544     if (ret) {
 545         krb5_storage_free(request);
 546         return ret;
 547     }
 548
 549     ret = krb5_kcm_call(context, request, &response, &response_data);
 550     krb5_storage_free(request);
 551     if (ret)
 552         return ret;
 553
 554     c = calloc(1, sizeof(*c));
 555     if (c == NULL) {
 556         ret = krb5_enomem(context);
 557         return ret;
 558     }
 559
 560     while (1) {
 561         ssize_t sret;
 562         kcmuuid_t uuid;
 563         void *ptr;
 564
 565         sret = krb5_storage_read(response, &uuid, sizeof(uuid));
 566         if (sret == 0) {
 567             ret = 0;
 568             break;
 569         } else if (sret != sizeof(uuid)) {
 570             ret = EINVAL;
 571             break;
 572         }
 573
 574         ptr = realloc(c->uuids, sizeof(c->uuids[0]) * (c->length + 1));
 575         if (ptr == NULL) {
 576             free(c->uuids);
 577             free(c);
 578             return krb5_enomem(context);
 579         }
 580         c->uuids = ptr;
 581
 582         memcpy(&c->uuids[c->length], &uuid, sizeof(uuid));
 583         c->length += 1;
 584     }
 585
 586     krb5_storage_free(response);
 587     krb5_data_free(&response_data);
 588
 589     if (ret) {
 590         free(c->uuids);
 591         free(c);
 592         return ret;
 593     }
 594
 595     *cursor = c;
 596
 597     return 0;
 598 }
 599
 600 /*
 601  * Request:
 602  *      NameZ
 603  *      Cursor
 604  *
 605  * Response:
 606  *      Creds
 607  */
 608 static krb5_error_code
 609 kcm_get_next (krb5_context context,
 610                 krb5_ccache id,
 611                 krb5_cc_cursor *cursor,
 612                 krb5_creds *creds)
 613 {
 614     krb5_error_code ret;
 615     krb5_kcmcache *k = KCMCACHE(id);
 616     krb5_kcm_cursor c = KCMCURSOR(*cursor);
 617     krb5_storage *request, *response;
 618     krb5_data response_data;
 619     ssize_t sret;
 620
 621  again:
 622
 623     if (c->offset >= c->length)
 624         return KRB5_CC_END;
 625
 626     ret = krb5_kcm_storage_request(context, KCM_OP_GET_CRED_BY_UUID, &request);
 627     if (ret)
 628         return ret;
 629
 630     ret = krb5_store_stringz(request, k->name);
 631     if (ret) {
 632         krb5_storage_free(request);
 633         return ret;
 634     }
 635
 636     sret = krb5_storage_write(request,
 637                               &c->uuids[c->offset],
 638                               sizeof(c->uuids[c->offset]));
 639     c->offset++;
 640     if (sret != sizeof(c->uuids[c->offset])) {
 641         krb5_storage_free(request);
 642         krb5_clear_error_message(context);
 643         return ENOMEM;
 644     }
 645
 646     ret = krb5_kcm_call(context, request, &response, &response_data);
 647     krb5_storage_free(request);
 648     if (ret == KRB5_CC_END) {
 649         goto again;
 650     }
 651
 652     ret = krb5_ret_creds(response, creds);
 653     if (ret)
 654         ret = KRB5_CC_IO;
 655
 656     krb5_storage_free(response);
 657     krb5_data_free(&response_data);
 658
 659     return ret;
 660 }
 661
 662 /*
 663  * Request:
 664  *      NameZ
 665  *      Cursor
 666  *
 667  * Response:
 668  *
 669  */
 670 static krb5_error_code
 671 kcm_end_get (krb5_context context,
 672              krb5_ccache id,
 673              krb5_cc_cursor *cursor)
 674 {
 675     krb5_kcm_cursor c = KCMCURSOR(*cursor);
 676
 677     free(c->uuids);
 678     free(c);
 679
 680     *cursor = NULL;
 681
 682     return 0;
 683 }
 684
 685 /*
 686  * Request:
 687  *      NameZ
 688  *      WhichFields
 689  *      MatchCreds
 690  *
 691  * Response:
 692  *
 693  */
 694 static krb5_error_code
 695 kcm_remove_cred(krb5_context context,
 696                 krb5_ccache id,
 697                 krb5_flags which,
 698                 krb5_creds *cred)
 699 {
 700     krb5_error_code ret;
 701     krb5_kcmcache *k = KCMCACHE(id);
 702     krb5_storage *request;
 703
 704     ret = krb5_kcm_storage_request(context, KCM_OP_REMOVE_CRED, &request);
 705     if (ret)
 706         return ret;
 707
 708     ret = krb5_store_stringz(request, k->name);
 709     if (ret) {
 710         krb5_storage_free(request);
 711         return ret;
 712     }
 713
 714     ret = krb5_store_int32(request, which);
 715     if (ret) {
 716         krb5_storage_free(request);
 717         return ret;
 718     }
 719
 720     ret = krb5_store_creds_tag(request, cred);
 721     if (ret) {
 722         krb5_storage_free(request);
 723         return ret;
 724     }
 725
 726     ret = krb5_kcm_call(context, request, NULL, NULL);
 727
 728     krb5_storage_free(request);
 729     return ret;
 730 }
 731
 732 static krb5_error_code
 733 kcm_set_flags(krb5_context context,
 734               krb5_ccache id,
 735               krb5_flags flags)
 736 {
 737     krb5_error_code ret;
 738     krb5_kcmcache *k = KCMCACHE(id);
 739     krb5_storage *request;
 740
 741     ret = krb5_kcm_storage_request(context, KCM_OP_SET_FLAGS, &request);
 742     if (ret)
 743         return ret;
 744
 745     ret = krb5_store_stringz(request, k->name);
 746     if (ret) {
 747         krb5_storage_free(request);
 748         return ret;
 749     }
 750
 751     ret = krb5_store_int32(request, flags);
 752     if (ret) {
 753         krb5_storage_free(request);
 754         return ret;
 755     }
 756
 757     ret = krb5_kcm_call(context, request, NULL, NULL);
 758
 759     krb5_storage_free(request);
 760     return ret;
 761 }
 762
 763 static int
 764 kcm_get_version(krb5_context context,
 765                 krb5_ccache id)
 766 {
 767     return 0;
 768 }
 769
 770 /*
 771  * Send nothing
 772  * get back list of uuids
 773  */
 774
 775 static krb5_error_code
 776 kcm_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
 777 {
 778     krb5_error_code ret;
 779     krb5_kcm_cursor c;
 780     krb5_storage *request, *response;
 781     krb5_data response_data;
 782
 783     *cursor = NULL;
 784
 785     c = calloc(1, sizeof(*c));
 786     if (c == NULL) {
 787         ret = krb5_enomem(context);
 788         goto out;
 789     }
 790
 791     ret = krb5_kcm_storage_request(context, KCM_OP_GET_CACHE_UUID_LIST, &request);
 792     if (ret)
 793         goto out;
 794
 795     ret = krb5_kcm_call(context, request, &response, &response_data);
 796     krb5_storage_free(request);
 797     if (ret)
 798         goto out;
 799
 800     while (1) {
 801         ssize_t sret;
 802         kcmuuid_t uuid;
 803         void *ptr;
 804
 805         sret = krb5_storage_read(response, &uuid, sizeof(uuid));
 806         if (sret == 0) {
 807             ret = 0;
 808             break;
 809         } else if (sret != sizeof(uuid)) {
 810             ret = EINVAL;
 811             goto out;
 812         }
 813
 814         ptr = realloc(c->uuids, sizeof(c->uuids[0]) * (c->length + 1));
 815         if (ptr == NULL) {
 816             ret = krb5_enomem(context);
 817             goto out;
 818         }
 819         c->uuids = ptr;
 820
 821         memcpy(&c->uuids[c->length], &uuid, sizeof(uuid));
 822         c->length += 1;
 823     }
 824
 825     krb5_storage_free(response);
 826     krb5_data_free(&response_data);
 827
 828  out:
 829     if (ret && c) {
 830         free(c->uuids);
 831         free(c);
 832     } else
 833         *cursor = c;
 834
 835     return ret;
 836 }
 837
 838 /*
 839  * Send uuid
 840  * Recv cache name
 841  */
 842
 843 static krb5_error_code
 844 kcm_get_cache_next(krb5_context context, krb5_cc_cursor cursor, const krb5_cc_ops *ops, krb5_ccache *id)
 845 {
 846     krb5_error_code ret;
 847     krb5_kcm_cursor c = KCMCURSOR(cursor);
 848     krb5_storage *request, *response;
 849     krb5_data response_data;
 850     ssize_t sret;
 851     char *name;
 852
 853     *id = NULL;
 854
 855  again:
 856
 857     if (c->offset >= c->length)
 858         return KRB5_CC_END;
 859
 860     ret = krb5_kcm_storage_request(context, KCM_OP_GET_CACHE_BY_UUID, &request);
 861     if (ret)
 862         return ret;
 863
 864     sret = krb5_storage_write(request,
 865                               &c->uuids[c->offset],
 866                               sizeof(c->uuids[c->offset]));
 867     c->offset++;
 868     if (sret != sizeof(c->uuids[c->offset])) {
 869         krb5_storage_free(request);
 870         krb5_clear_error_message(context);
 871         return ENOMEM;
 872     }
 873
 874     ret = krb5_kcm_call(context, request, &response, &response_data);
 875     krb5_storage_free(request);
 876     if (ret == KRB5_CC_END)
 877         goto again;
 878
 879     ret = krb5_ret_stringz(response, &name);
 880     krb5_storage_free(response);
 881     krb5_data_free(&response_data);
 882
 883     if (ret == 0) {
 884         ret = _krb5_cc_allocate(context, ops, id);
 885         if (ret == 0)
 886             ret = kcm_alloc(context, name, id);
 887         krb5_xfree(name);
 888     }
 889
 890     return ret;
 891 }
 892
 893 static krb5_error_code
 894 kcm_get_cache_next_kcm(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
 895 {
 896 #ifndef KCM_IS_API_CACHE
 897     return kcm_get_cache_next(context, cursor, &krb5_kcm_ops, id);
 898 #else
 899     return KRB5_CC_END;
 900 #endif
 901 }
 902
 903 static krb5_error_code
 904 kcm_get_cache_next_api(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
 905 {
 906     return kcm_get_cache_next(context, cursor, &krb5_akcm_ops, id);
 907 }
 908
 909
 910 static krb5_error_code
 911 kcm_end_cache_get(krb5_context context, krb5_cc_cursor cursor)
 912 {
 913     krb5_kcm_cursor c = KCMCURSOR(cursor);
 914
 915     free(c->uuids);
 916     free(c);
 917     return 0;
 918 }
 919
 920
 921 static krb5_error_code
 922 kcm_move(krb5_context context, krb5_ccache from, krb5_ccache to)
 923 {
 924     krb5_error_code ret;
 925     krb5_kcmcache *oldk = KCMCACHE(from);
 926     krb5_kcmcache *newk = KCMCACHE(to);
 927     krb5_storage *request;
 928
 929     ret = krb5_kcm_storage_request(context, KCM_OP_MOVE_CACHE, &request);
 930     if (ret)
 931         return ret;
 932
 933     ret = krb5_store_stringz(request, oldk->name);
 934     if (ret) {
 935         krb5_storage_free(request);
 936         return ret;
 937     }
 938
 939     ret = krb5_store_stringz(request, newk->name);
 940     if (ret) {
 941         krb5_storage_free(request);
 942         return ret;
 943     }
 944     ret = krb5_kcm_call(context, request, NULL, NULL);
 945
 946     krb5_storage_free(request);
 947     return ret;
 948 }
 949
 950 static krb5_error_code
 951 kcm_get_default_name(krb5_context context, const krb5_cc_ops *ops,
 952                      const char *defstr, char **str)
 953 {
 954     krb5_error_code ret;
 955     krb5_storage *request, *response;
 956     krb5_data response_data;
 957     char *name;
 958     int aret;
 959
 960     *str = NULL;
 961
 962     ret = krb5_kcm_storage_request(context, KCM_OP_GET_DEFAULT_CACHE, &request);
 963     if (ret)
 964         return ret;
 965
 966     ret = krb5_kcm_call(context, request, &response, &response_data);
 967     krb5_storage_free(request);
 968     if (ret)
 969         return _krb5_expand_default_cc_name(context, defstr, str);
 970
 971     ret = krb5_ret_stringz(response, &name);
 972     krb5_storage_free(response);
 973     krb5_data_free(&response_data);
 974     if (ret)
 975         return ret;
 976
 977     aret = asprintf(str, "%s:%s", ops->prefix, name);
 978     free(name);
 979     if (aret == -1 || str == NULL)
 980         return ENOMEM;
 981
 982     return 0;
 983 }
 984
 985 static krb5_error_code
 986 kcm_get_default_name_api(krb5_context context, char **str)
 987 {
 988     return kcm_get_default_name(context, &krb5_akcm_ops,
 989                                 KRB5_DEFAULT_CCNAME_KCM_API, str);
 990 }
 991
 992 static krb5_error_code
 993 kcm_get_default_name_kcm(krb5_context context, char **str)
 994 {
 995     return kcm_get_default_name(context, &krb5_kcm_ops,
 996                                 KRB5_DEFAULT_CCNAME_KCM_KCM, str);
 997 }
 998
 999 static krb5_error_code
1000 kcm_set_default(krb5_context context, krb5_ccache id)
1001 {
1002     krb5_error_code ret;
1003     krb5_storage *request;
1004     krb5_kcmcache *k = KCMCACHE(id);
1005
1006     ret = krb5_kcm_storage_request(context, KCM_OP_SET_DEFAULT_CACHE, &request);
1007     if (ret)
1008         return ret;
1009
1010     ret = krb5_store_stringz(request, k->name);
1011     if (ret) {
1012         krb5_storage_free(request);
1013         return ret;
1014     }
1015
1016     ret = krb5_kcm_call(context, request, NULL, NULL);
1017     krb5_storage_free(request);
1018
1019     return ret;
1020 }
1021
1022 static krb5_error_code
1023 kcm_lastchange(krb5_context context, krb5_ccache id, krb5_timestamp *mtime)
1024 {
1025     *mtime = time(NULL);
1026     return 0;
1027 }
1028
1029 static krb5_error_code
1030 kcm_set_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat kdc_offset)
1031 {
1032     krb5_kcmcache *k = KCMCACHE(id);
1033     krb5_error_code ret;
1034     krb5_storage *request;
1035
1036     ret = krb5_kcm_storage_request(context, KCM_OP_SET_KDC_OFFSET, &request);
1037     if (ret)
1038         return ret;
1039
1040     ret = krb5_store_stringz(request, k->name);
1041     if (ret) {
1042         krb5_storage_free(request);
1043         return ret;
1044     }
1045     ret = krb5_store_int32(request, kdc_offset);
1046     if (ret) {
1047         krb5_storage_free(request);
1048         return ret;
1049     }
1050
1051     ret = krb5_kcm_call(context, request, NULL, NULL);
1052     krb5_storage_free(request);
1053
1054     return ret;
1055 }
1056
1057 static krb5_error_code
1058 kcm_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *kdc_offset)
1059 {
1060     krb5_kcmcache *k = KCMCACHE(id);
1061     krb5_error_code ret;
1062     krb5_storage *request, *response;
1063     krb5_data response_data;
1064     int32_t offset;
1065
1066     ret = krb5_kcm_storage_request(context, KCM_OP_GET_KDC_OFFSET, &request);
1067     if (ret)
1068         return ret;
1069
1070     ret = krb5_store_stringz(request, k->name);
1071     if (ret) {
1072         krb5_storage_free(request);
1073         return ret;
1074     }
1075
1076     ret = krb5_kcm_call(context, request, &response, &response_data);
1077     krb5_storage_free(request);
1078     if (ret)
1079         return ret;
1080
1081     ret = krb5_ret_int32(response, &offset);
1082     krb5_storage_free(response);
1083     krb5_data_free(&response_data);
1084     if (ret)
1085         return ret;
1086
1087     *kdc_offset = offset;
1088
1089     return 0;
1090 }
1091
1092 /**
1093  * Variable containing the KCM based credential cache implemention.
1094  *
1095  * @ingroup krb5_ccache
1096  */
1097
1098 KRB5_LIB_VARIABLE const krb5_cc_ops krb5_kcm_ops = {
1099     KRB5_CC_OPS_VERSION,
1100     "KCM",
1101     kcm_get_name,
1102     kcm_resolve,
1103     kcm_gen_new,
1104     kcm_initialize,
1105     kcm_destroy,
1106     kcm_close,
1107     kcm_store_cred,
1108     NULL /* kcm_retrieve */,
1109     kcm_get_principal,
1110     kcm_get_first,
1111     kcm_get_next,
1112     kcm_end_get,
1113     kcm_remove_cred,
1114     kcm_set_flags,
1115     kcm_get_version,
1116     kcm_get_cache_first,
1117     kcm_get_cache_next_kcm,
1118     kcm_end_cache_get,
1119     kcm_move,
1120     kcm_get_default_name_kcm,
1121     kcm_set_default,
1122     kcm_lastchange,
1123     kcm_set_kdc_offset,
1124     kcm_get_kdc_offset
1125 };
1126
1127 KRB5_LIB_VARIABLE const krb5_cc_ops krb5_akcm_ops = {
1128     KRB5_CC_OPS_VERSION,
1129     "API",
1130     kcm_get_name,
1131     kcm_resolve,
1132     kcm_gen_new,
1133     kcm_initialize,
1134     kcm_destroy,
1135     kcm_close,
1136     kcm_store_cred,
1137     NULL /* kcm_retrieve */,
1138     kcm_get_principal,
1139     kcm_get_first,
1140     kcm_get_next,
1141     kcm_end_get,
1142     kcm_remove_cred,
1143     kcm_set_flags,
1144     kcm_get_version,
1145     kcm_get_cache_first,
1146     kcm_get_cache_next_api,
1147     kcm_end_cache_get,
1148     kcm_move,
1149     kcm_get_default_name_api,
1150     kcm_set_default,
1151     kcm_lastchange,
1152     NULL,
1153     NULL
1154 };
1155
1156
1157 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
1158 _krb5_kcm_is_running(krb5_context context)
1159 {
1160     krb5_error_code ret;
1161     krb5_ccache_data ccdata;
1162     krb5_ccache id = &ccdata;
1163     krb5_boolean running;
1164
1165     ret = kcm_alloc(context, NULL, &id);
1166     if (ret)
1167         return 0;
1168
1169     running = (_krb5_kcm_noop(context, id) == 0);
1170
1171     kcm_free(context, &id);
1172
1173     return running;
1174 }
1175
1176 /*
1177  * Request:
1178  *
1179  * Response:
1180  *
1181  */
1182 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1183 _krb5_kcm_noop(krb5_context context,
1184                krb5_ccache id)
1185 {
1186     krb5_error_code ret;
1187     krb5_storage *request;
1188
1189     ret = krb5_kcm_storage_request(context, KCM_OP_NOOP, &request);
1190     if (ret)
1191         return ret;
1192
1193     ret = krb5_kcm_call(context, request, NULL, NULL);
1194
1195     krb5_storage_free(request);
1196     return ret;
1197 }
1198
1199
1200 /*
1201  * Request:
1202  *      NameZ
1203  *      ServerPrincipalPresent
1204  *      ServerPrincipal OPTIONAL
1205  *      Key
1206  *
1207  * Repsonse:
1208  *
1209  */
1210 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1211 _krb5_kcm_get_initial_ticket(krb5_context context,
1212                              krb5_ccache id,
1213                              krb5_principal server,
1214                              krb5_keyblock *key)
1215 {
1216     krb5_kcmcache *k = KCMCACHE(id);
1217     krb5_error_code ret;
1218     krb5_storage *request;
1219
1220     ret = krb5_kcm_storage_request(context, KCM_OP_GET_INITIAL_TICKET, &request);
1221     if (ret)
1222         return ret;
1223
1224     ret = krb5_store_stringz(request, k->name);
1225     if (ret) {
1226         krb5_storage_free(request);
1227         return ret;
1228     }
1229
1230     ret = krb5_store_int8(request, (server == NULL) ? 0 : 1);
1231     if (ret) {
1232         krb5_storage_free(request);
1233         return ret;
1234     }
1235
1236     if (server != NULL) {
1237         ret = krb5_store_principal(request, server);
1238         if (ret) {
1239             krb5_storage_free(request);
1240             return ret;
1241         }
1242     }
1243
1244     ret = krb5_store_keyblock(request, *key);
1245     if (ret) {
1246         krb5_storage_free(request);
1247         return ret;
1248     }
1249
1250     ret = krb5_kcm_call(context, request, NULL, NULL);
1251
1252     krb5_storage_free(request);
1253     return ret;
1254 }
1255
1256
1257 /*
1258  * Request:
1259  *      NameZ
1260  *      KDCFlags
1261  *      EncryptionType
1262  *      ServerPrincipal
1263  *
1264  * Repsonse:
1265  *
1266  */
1267 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1268 _krb5_kcm_get_ticket(krb5_context context,
1269                      krb5_ccache id,
1270                      krb5_kdc_flags flags,
1271                      krb5_enctype enctype,
1272                      krb5_principal server)
1273 {
1274     krb5_error_code ret;
1275     krb5_kcmcache *k = KCMCACHE(id);
1276     krb5_storage *request;
1277
1278     ret = krb5_kcm_storage_request(context, KCM_OP_GET_TICKET, &request);
1279     if (ret)
1280         return ret;
1281
1282     ret = krb5_store_stringz(request, k->name);
1283     if (ret) {
1284         krb5_storage_free(request);
1285         return ret;
1286     }
1287
1288     ret = krb5_store_int32(request, flags.i);
1289     if (ret) {
1290         krb5_storage_free(request);
1291         return ret;
1292     }
1293
1294     ret = krb5_store_int32(request, enctype);
1295     if (ret) {
1296         krb5_storage_free(request);
1297         return ret;
1298     }
1299
1300     ret = krb5_store_principal(request, server);
1301     if (ret) {
1302         krb5_storage_free(request);
1303         return ret;
1304     }
1305
1306     ret = krb5_kcm_call(context, request, NULL, NULL);
1307
1308     krb5_storage_free(request);
1309     return ret;
1310 }
1311
1312 #endif /* HAVE_KCM */