lib/hdb/hdb-sqlite.c

   1 /*
   2  * Copyright (c) 2009 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "hdb_locl.h"
  35 #include "sqlite3.h"
  36
  37 #define MAX_RETRIES 10
  38
  39 typedef struct hdb_sqlite_db {
  40     double version;
  41     sqlite3 *db;
  42     char *db_file;
  43
  44     sqlite3_stmt *get_version;
  45     sqlite3_stmt *fetch;
  46     sqlite3_stmt *get_ids;
  47     sqlite3_stmt *add_entry;
  48     sqlite3_stmt *add_principal;
  49     sqlite3_stmt *add_alias;
  50     sqlite3_stmt *delete_aliases;
  51     sqlite3_stmt *update_entry;
  52     sqlite3_stmt *remove;
  53     sqlite3_stmt *get_all_entries;
  54
  55 } hdb_sqlite_db;
  56
  57 /* This should be used to mark updates which make the code incompatible
  58  * with databases created with previous versions. Don't update it if
  59  * compatibility is not broken. */
  60 #define HDBSQLITE_VERSION 0.1
  61
  62 #define _HDBSQLITE_STRINGIFY(x) #x
  63 #define HDBSQLITE_STRINGIFY(x) _HDBSQLITE_STRINGIFY(x)
  64
  65 #define HDBSQLITE_CREATE_TABLES \
  66                  " BEGIN TRANSACTION;" \
  67                  " CREATE TABLE Version (number REAL);" \
  68                  " INSERT INTO Version (number)" \
  69                  " VALUES (" HDBSQLITE_STRINGIFY(HDBSQLITE_VERSION) ");" \
  70                  " CREATE TABLE Principal" \
  71                  "  (id INTEGER PRIMARY KEY," \
  72                  "   principal TEXT UNIQUE NOT NULL," \
  73                  "   canonical INTEGER," \
  74                  "   entry INTEGER);" \
  75                  " CREATE TABLE Entry" \
  76                  "  (id INTEGER PRIMARY KEY," \
  77                  "   data BLOB);" \
  78                  " COMMIT"
  79 #define HDBSQLITE_CREATE_TRIGGERS \
  80                  " CREATE TRIGGER remove_principals AFTER DELETE ON Entry" \
  81                  " BEGIN" \
  82                  "  DELETE FROM Principal" \
  83                  "  WHERE entry = OLD.id;" \
  84                  " END"
  85 #define HDBSQLITE_GET_VERSION \
  86                  " SELECT number FROM Version"
  87 #define HDBSQLITE_FETCH \
  88                  " SELECT Entry.data FROM Principal, Entry" \
  89                  " WHERE Principal.principal = ? AND" \
  90                  "       Entry.id = Principal.entry"
  91 #define HDBSQLITE_GET_IDS \
  92                  " SELECT id, entry FROM Principal" \
  93                  " WHERE principal = ?"
  94 #define HDBSQLITE_ADD_ENTRY \
  95                  " INSERT INTO Entry (data) VALUES (?)"
  96 #define HDBSQLITE_ADD_PRINCIPAL \
  97                  " INSERT INTO Principal (principal, entry, canonical)" \
  98                  " VALUES (?, last_insert_rowid(), 1)"
  99 #define HDBSQLITE_ADD_ALIAS \
 100                  " INSERT INTO Principal (principal, entry, canonical)" \
 101                  " VALUES(?, ?, 0)"
 102 #define HDBSQLITE_DELETE_ALIASES \
 103                  " DELETE FROM Principal" \
 104                  " WHERE entry = ? AND canonical = 0"
 105 #define HDBSQLITE_UPDATE_ENTRY \
 106                  " UPDATE Entry SET data = ?" \
 107                  " WHERE id = ?"
 108 #define HDBSQLITE_REMOVE \
 109                  " DELETE FROM ENTRY WHERE id = " \
 110                  "  (SELECT entry FROM Principal" \
 111                  "   WHERE principal = ?)"
 112 #define HDBSQLITE_GET_ALL_ENTRIES \
 113                  " SELECT data FROM Entry"
 114
 115 /**
 116  * Wrapper around sqlite3_prepare_v2.
 117  *
 118  * @param context   The current krb5 context
 119  * @param statement Where to store the pointer to the statement
 120  *                  after preparing it
 121  * @param str       SQL code for the statement
 122  *
 123  * @return          0 if OK, an error code if not
 124  */
 125 static krb5_error_code
 126 hdb_sqlite_prepare_stmt(krb5_context context,
 127                         sqlite3 *db,
 128                         sqlite3_stmt **statement,
 129                         const char *str)
 130 {
 131     int ret, tries = 0;
 132
 133     ret = sqlite3_prepare_v2(db, str, -1, statement, NULL);
 134     while((tries++ < MAX_RETRIES) &&
 135           ((ret == SQLITE_BUSY) ||
 136            (ret == SQLITE_IOERR_BLOCKED) ||
 137            (ret == SQLITE_LOCKED))) {
 138         krb5_warnx(context, "hdb-sqlite: prepare busy");
 139         sleep(1);
 140         ret = sqlite3_prepare_v2(db, str, -1, statement, NULL);
 141     }
 142
 143     if (ret != SQLITE_OK) {
 144         krb5_set_error_message(context, EINVAL,
 145                                "Failed to prepare stmt %s: %s",
 146                                str, sqlite3_errmsg(db));
 147         return EINVAL;
 148     }
 149
 150     return 0;
 151 }
 152
 153 /**
 154  * A wrapper around sqlite3_exec.
 155  *
 156  * @param context    The current krb5 context
 157  * @param database   An open sqlite3 database handle
 158  * @param statement  SQL code to execute
 159  * @param error_code What to return if the statement fails
 160  *
 161  * @return           0 if OK, else error_code
 162  */
 163 static krb5_error_code
 164 hdb_sqlite_exec_stmt(krb5_context context,
 165                      sqlite3 *database,
 166                      const char *statement,
 167                      krb5_error_code error_code)
 168 {
 169     int ret;
 170
 171     ret = sqlite3_exec(database, statement, NULL, NULL, NULL);
 172
 173     while(((ret == SQLITE_BUSY) ||
 174            (ret == SQLITE_IOERR_BLOCKED) ||
 175            (ret == SQLITE_LOCKED))) {
 176         krb5_warnx(context, "hdb-sqlite: exec busy: %d", (int)getpid());
 177         sleep(1);
 178         ret = sqlite3_exec(database, statement, NULL, NULL, NULL);
 179     }
 180
 181     if (ret != SQLITE_OK && error_code) {
 182         krb5_set_error_message(context, error_code,
 183                                "Execute %s: %s", statement,
 184                               sqlite3_errmsg(database));
 185         return error_code;
 186     }
 187
 188     return 0;
 189 }
 190
 191 /**
 192  *
 193  */
 194
 195 static krb5_error_code
 196 bind_principal(krb5_context context, krb5_const_principal principal, sqlite3_stmt *stmt, int key)
 197 {
 198     krb5_error_code ret;
 199     char *str = NULL;
 200
 201     ret = krb5_unparse_name(context, principal, &str);
 202     if (ret)
 203         return ret;
 204
 205     sqlite3_bind_text(stmt, key, str, -1, SQLITE_TRANSIENT);
 206     free(str);
 207     return 0;
 208 }
 209
 210 /**
 211  * Opens an sqlite3 database handle to a file, may create the
 212  * database file depending on flags.
 213  *
 214  * @param context The current krb5 context
 215  * @param db      Heimdal database handle
 216  * @param flags   Controls whether or not the file may be created,
 217  *                may be 0 or SQLITE_OPEN_CREATE
 218  */
 219 static krb5_error_code
 220 hdb_sqlite_open_database(krb5_context context, HDB *db, int flags)
 221 {
 222     int ret;
 223     hdb_sqlite_db *hsdb = (hdb_sqlite_db*) db->hdb_db;
 224
 225     ret = sqlite3_open_v2(hsdb->db_file, &hsdb->db,
 226                           SQLITE_OPEN_READWRITE | flags, NULL);
 227
 228     if (ret) {
 229         if (hsdb->db) {
 230             ret = ENOENT;
 231             krb5_set_error_message(context, ret,
 232                                   "Error opening sqlite database %s: %s",
 233                                   hsdb->db_file, sqlite3_errmsg(hsdb->db));
 234             sqlite3_close(hsdb->db);
 235             hsdb->db = NULL;
 236         } else
 237             ret = krb5_enomem(context);
 238         return ret;
 239     }
 240
 241     return 0;
 242 }
 243
 244 static int
 245 hdb_sqlite_step(krb5_context context, sqlite3 *db, sqlite3_stmt *stmt)
 246 {
 247     int ret;
 248
 249     ret = sqlite3_step(stmt);
 250     while(((ret == SQLITE_BUSY) ||
 251            (ret == SQLITE_IOERR_BLOCKED) ||
 252            (ret == SQLITE_LOCKED))) {
 253         krb5_warnx(context, "hdb-sqlite: step busy: %d", (int)getpid());
 254         sleep(1);
 255         ret = sqlite3_step(stmt);
 256     }
 257     return ret;
 258 }
 259
 260 /**
 261  * Closes the database and frees memory allocated for statements.
 262  *
 263  * @param context The current krb5 context
 264  * @param db      Heimdal database handle
 265  */
 266 static krb5_error_code
 267 hdb_sqlite_close_database(krb5_context context, HDB *db)
 268 {
 269     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
 270
 271     sqlite3_finalize(hsdb->get_version);
 272     sqlite3_finalize(hsdb->fetch);
 273     sqlite3_finalize(hsdb->get_ids);
 274     sqlite3_finalize(hsdb->add_entry);
 275     sqlite3_finalize(hsdb->add_principal);
 276     sqlite3_finalize(hsdb->add_alias);
 277     sqlite3_finalize(hsdb->delete_aliases);
 278     sqlite3_finalize(hsdb->update_entry);
 279     sqlite3_finalize(hsdb->remove);
 280     sqlite3_finalize(hsdb->get_all_entries);
 281
 282     sqlite3_close(hsdb->db);
 283
 284     return 0;
 285 }
 286
 287 /**
 288  * Opens an sqlite database file and prepares it for use.
 289  * If the file does not exist it will be created.
 290  *
 291  * @param context  The current krb5_context
 292  * @param db       The heimdal database handle
 293  * @param filename Where to store the database file
 294  *
 295  * @return         0 if everything worked, an error code if not
 296  */
 297 static krb5_error_code
 298 hdb_sqlite_make_database(krb5_context context, HDB *db, const char *filename)
 299 {
 300     int ret;
 301     int created_file = 0;
 302     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
 303
 304     hsdb->db_file = strdup(filename);
 305     if(hsdb->db_file == NULL)
 306         return ENOMEM;
 307
 308     ret = hdb_sqlite_open_database(context, db, 0);
 309     if (ret) {
 310         ret = hdb_sqlite_open_database(context, db, SQLITE_OPEN_CREATE);
 311         if (ret) goto out;
 312
 313         created_file = 1;
 314
 315         ret = hdb_sqlite_exec_stmt(context, hsdb->db,
 316                                    HDBSQLITE_CREATE_TABLES,
 317                                    EINVAL);
 318         if (ret) goto out;
 319
 320         ret = hdb_sqlite_exec_stmt(context, hsdb->db,
 321                                    HDBSQLITE_CREATE_TRIGGERS,
 322                                    EINVAL);
 323         if (ret) goto out;
 324     }
 325
 326     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 327                                   &hsdb->get_version,
 328                                   HDBSQLITE_GET_VERSION);
 329     if (ret) goto out;
 330     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 331                                   &hsdb->fetch,
 332                                   HDBSQLITE_FETCH);
 333     if (ret) goto out;
 334     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 335                                   &hsdb->get_ids,
 336                                   HDBSQLITE_GET_IDS);
 337     if (ret) goto out;
 338     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 339                                   &hsdb->add_entry,
 340                                   HDBSQLITE_ADD_ENTRY);
 341     if (ret) goto out;
 342     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 343                                   &hsdb->add_principal,
 344                                   HDBSQLITE_ADD_PRINCIPAL);
 345     if (ret) goto out;
 346     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 347                                   &hsdb->add_alias,
 348                                   HDBSQLITE_ADD_ALIAS);
 349     if (ret) goto out;
 350     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 351                                   &hsdb->delete_aliases,
 352                                   HDBSQLITE_DELETE_ALIASES);
 353     if (ret) goto out;
 354     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 355                                   &hsdb->update_entry,
 356                                   HDBSQLITE_UPDATE_ENTRY);
 357     if (ret) goto out;
 358     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 359                                   &hsdb->remove,
 360                                   HDBSQLITE_REMOVE);
 361     if (ret) goto out;
 362     ret = hdb_sqlite_prepare_stmt(context, hsdb->db,
 363                                   &hsdb->get_all_entries,
 364                                   HDBSQLITE_GET_ALL_ENTRIES);
 365     if (ret) goto out;
 366
 367     ret = hdb_sqlite_step(context, hsdb->db, hsdb->get_version);
 368     if(ret == SQLITE_ROW) {
 369         hsdb->version = sqlite3_column_double(hsdb->get_version, 0);
 370     }
 371     sqlite3_reset(hsdb->get_version);
 372     ret = 0;
 373
 374     if(hsdb->version != HDBSQLITE_VERSION) {
 375         ret = EINVAL;
 376         krb5_set_error_message(context, ret, "HDBSQLITE_VERSION mismatch");
 377     }
 378
 379     if(ret) goto out;
 380
 381     return 0;
 382
 383  out:
 384     if (hsdb->db)
 385         sqlite3_close(hsdb->db);
 386     if (created_file)
 387         unlink(hsdb->db_file);
 388
 389     return ret;
 390 }
 391
 392 /**
 393  * Retrieves an entry by searching for the given
 394  * principal in the Principal database table, both
 395  * for canonical principals and aliases.
 396  *
 397  * @param context   The current krb5_context
 398  * @param db        Heimdal database handle
 399  * @param principal The principal whose entry to search for
 400  * @param flags     Currently only for HDB_F_DECRYPT
 401  * @param kvno      kvno to fetch is HDB_F_KVNO_SPECIFIED use used
 402  *
 403  * @return          0 if everything worked, an error code if not
 404  */
 405 static krb5_error_code
 406 hdb_sqlite_fetch_kvno(krb5_context context, HDB *db, krb5_const_principal principal,
 407                       unsigned flags, krb5_kvno kvno, hdb_entry_ex *entry)
 408 {
 409     int sqlite_error;
 410     krb5_error_code ret;
 411     hdb_sqlite_db *hsdb = (hdb_sqlite_db*)(db->hdb_db);
 412     sqlite3_stmt *fetch = hsdb->fetch;
 413     krb5_data value;
 414     krb5_principal enterprise_principal = NULL;
 415
 416     if (principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
 417         if (principal->name.name_string.len != 1) {
 418             ret = KRB5_PARSE_MALFORMED;
 419             krb5_set_error_message(context, ret, "malformed principal: "
 420                                    "enterprise name with %d name components",
 421                                    principal->name.name_string.len);
 422             return ret;
 423         }
 424         ret = krb5_parse_name(context, principal->name.name_string.val[0],
 425                               &enterprise_principal);
 426         if (ret)
 427             return ret;
 428         principal = enterprise_principal;
 429     }
 430
 431     ret = bind_principal(context, principal, fetch, 1);
 432     if (ret)
 433         return ret;
 434
 435     krb5_free_principal(context, enterprise_principal);
 436
 437     sqlite_error = hdb_sqlite_step(context, hsdb->db, fetch);
 438     if (sqlite_error != SQLITE_ROW) {
 439         if(sqlite_error == SQLITE_DONE) {
 440             ret = HDB_ERR_NOENTRY;
 441             goto out;
 442         } else {
 443             ret = EINVAL;
 444             krb5_set_error_message(context, ret,
 445                                   "sqlite fetch failed: %d",
 446                                   sqlite_error);
 447             goto out;
 448         }
 449     }
 450
 451     value.length = sqlite3_column_bytes(fetch, 0);
 452     value.data = (void *) sqlite3_column_blob(fetch, 0);
 453
 454     ret = hdb_value2entry(context, &value, &entry->entry);
 455     if(ret)
 456         goto out;
 457
 458     if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
 459         ret = hdb_unseal_keys(context, db, &entry->entry);
 460         if(ret) {
 461            hdb_free_entry(context, entry);
 462            goto out;
 463         }
 464     }
 465
 466     ret = 0;
 467
 468 out:
 469
 470     sqlite3_clear_bindings(fetch);
 471     sqlite3_reset(fetch);
 472
 473
 474     return ret;
 475 }
 476
 477 /**
 478  * Convenience function to step a prepared statement with no
 479  * value once.
 480  *
 481  * @param context   The current krb5_context
 482  * @param statement A prepared sqlite3 statement
 483  *
 484  * @return        0 if everything worked, an error code if not
 485  */
 486 static krb5_error_code
 487 hdb_sqlite_step_once(krb5_context context, HDB *db, sqlite3_stmt *statement)
 488 {
 489     int ret;
 490     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
 491
 492     ret = hdb_sqlite_step(context, hsdb->db, statement);
 493     sqlite3_clear_bindings(statement);
 494     sqlite3_reset(statement);
 495
 496     return ret;
 497 }
 498
 499
 500 /**
 501  * Stores an hdb_entry in the database. If flags contains HDB_F_REPLACE
 502  * a previous entry may be replaced.
 503  *
 504  * @param context The current krb5_context
 505  * @param db      Heimdal database handle
 506  * @param flags   May currently only contain HDB_F_REPLACE
 507  * @param entry   The data to store
 508  *
 509  * @return        0 if everything worked, an error code if not
 510  */
 511 static krb5_error_code
 512 hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
 513                  hdb_entry_ex *entry)
 514 {
 515     int ret;
 516     int i;
 517     sqlite_int64 entry_id;
 518     const HDB_Ext_Aliases *aliases;
 519
 520     hdb_sqlite_db *hsdb = (hdb_sqlite_db *)(db->hdb_db);
 521     krb5_data value;
 522     sqlite3_stmt *get_ids = hsdb->get_ids;
 523
 524     ret = hdb_sqlite_exec_stmt(context, hsdb->db,
 525                                "BEGIN IMMEDIATE TRANSACTION", EINVAL);
 526     if(ret != SQLITE_OK) {
 527         ret = EINVAL;
 528         krb5_set_error_message(context, ret,
 529                                "SQLite BEGIN TRANSACTION failed: %s",
 530                                sqlite3_errmsg(hsdb->db));
 531         goto rollback;
 532     }
 533
 534     ret = hdb_seal_keys(context, db, &entry->entry);
 535     if(ret) {
 536         goto rollback;
 537     }
 538
 539     ret = hdb_entry2value(context, &entry->entry, &value);
 540     if(ret) {
 541         goto rollback;
 542     }
 543
 544     ret = bind_principal(context, entry->entry.principal, get_ids, 1);
 545     if (ret)
 546         return ret;
 547
 548     ret = hdb_sqlite_step(context, hsdb->db, get_ids);
 549
 550     if(ret == SQLITE_DONE) { /* No such principal */
 551
 552         sqlite3_bind_blob(hsdb->add_entry, 1,
 553                           value.data, value.length, SQLITE_STATIC);
 554         ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_entry);
 555         sqlite3_clear_bindings(hsdb->add_entry);
 556         sqlite3_reset(hsdb->add_entry);
 557         if(ret != SQLITE_DONE)
 558             goto rollback;
 559
 560         ret = bind_principal(context, entry->entry.principal, hsdb->add_principal, 1);
 561         if (ret)
 562             goto rollback;
 563
 564         ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_principal);
 565         sqlite3_clear_bindings(hsdb->add_principal);
 566         sqlite3_reset(hsdb->add_principal);
 567         if(ret != SQLITE_DONE)
 568             goto rollback;
 569
 570         entry_id = sqlite3_column_int64(get_ids, 1);
 571
 572     } else if(ret == SQLITE_ROW) { /* Found a principal */
 573
 574         if(! (flags & HDB_F_REPLACE)) /* Not allowed to replace it */
 575             goto rollback;
 576
 577         entry_id = sqlite3_column_int64(get_ids, 1);
 578
 579         sqlite3_bind_int64(hsdb->delete_aliases, 1, entry_id);
 580         ret = hdb_sqlite_step_once(context, db, hsdb->delete_aliases);
 581         if(ret != SQLITE_DONE)
 582             goto rollback;
 583
 584         sqlite3_bind_blob(hsdb->update_entry, 1,
 585                           value.data, value.length, SQLITE_STATIC);
 586         sqlite3_bind_int64(hsdb->update_entry, 2, entry_id);
 587         ret = hdb_sqlite_step_once(context, db, hsdb->update_entry);
 588         if(ret != SQLITE_DONE)
 589             goto rollback;
 590
 591     } else {
 592         /* Error! */
 593         goto rollback;
 594     }
 595
 596     ret = hdb_entry_get_aliases(&entry->entry, &aliases);
 597     if(ret || aliases == NULL)
 598         goto commit;
 599
 600     for(i = 0; i < aliases->aliases.len; i++) {
 601
 602         ret = bind_principal(context, &aliases->aliases.val[i], hsdb->add_alias, 1);
 603         if (ret)
 604             goto rollback;
 605
 606         sqlite3_bind_int64(hsdb->add_alias, 2, entry_id);
 607         ret = hdb_sqlite_step_once(context, db, hsdb->add_alias);
 608
 609         if(ret != SQLITE_DONE)
 610             goto rollback;
 611     }
 612
 613     ret = 0;
 614
 615 commit:
 616
 617     krb5_data_free(&value);
 618
 619     sqlite3_clear_bindings(get_ids);
 620     sqlite3_reset(get_ids);
 621
 622     ret = hdb_sqlite_exec_stmt(context, hsdb->db, "COMMIT", EINVAL);
 623     if(ret != SQLITE_OK)
 624         krb5_warnx(context, "hdb-sqlite: COMMIT problem: %d: %s",
 625                    ret, sqlite3_errmsg(hsdb->db));
 626
 627     return ret;
 628
 629 rollback:
 630
 631     krb5_warnx(context, "hdb-sqlite: store rollback problem: %d: %s",
 632                ret, sqlite3_errmsg(hsdb->db));
 633
 634     ret = hdb_sqlite_exec_stmt(context, hsdb->db,
 635                                "ROLLBACK", EINVAL);
 636     return ret;
 637 }
 638
 639 /**
 640  * This may be called often by other code, since the BDB backends
 641  * can not have several open connections. SQLite can handle
 642  * many processes with open handles to the database file
 643  * and closing/opening the handle is an expensive operation.
 644  * Hence, this function does nothing.
 645  *
 646  * @param context The current krb5 context
 647  * @param db      Heimdal database handle
 648  *
 649  * @return        Always returns 0
 650  */
 651 static krb5_error_code
 652 hdb_sqlite_close(krb5_context context, HDB *db)
 653 {
 654     return 0;
 655 }
 656
 657 /**
 658  * The opposite of hdb_sqlite_close. Since SQLite accepts
 659  * many open handles to the database file the handle does not
 660  * need to be closed, or reopened.
 661  *
 662  * @param context The current krb5 context
 663  * @param db      Heimdal database handle
 664  * @param flags
 665  * @param mode_t
 666  *
 667  * @return        Always returns 0
 668  */
 669 static krb5_error_code
 670 hdb_sqlite_open(krb5_context context, HDB *db, int flags, mode_t mode)
 671 {
 672     return 0;
 673 }
 674
 675 /**
 676  * Closes the databse and frees all resources.
 677  *
 678  * @param context The current krb5 context
 679  * @param db      Heimdal database handle
 680  *
 681  * @return        0 on success, an error code if not
 682  */
 683 static krb5_error_code
 684 hdb_sqlite_destroy(krb5_context context, HDB *db)
 685 {
 686     int ret;
 687     hdb_sqlite_db *hsdb;
 688
 689     ret = hdb_clear_master_key(context, db);
 690
 691     hdb_sqlite_close_database(context, db);
 692
 693     hsdb = (hdb_sqlite_db*)(db->hdb_db);
 694
 695     free(hsdb->db_file);
 696     free(db->hdb_db);
 697     free(db);
 698
 699     return ret;
 700 }
 701
 702 /*
 703  * Not sure if this is needed.
 704  */
 705 static krb5_error_code
 706 hdb_sqlite_lock(krb5_context context, HDB *db, int operation)
 707 {
 708     krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
 709                            "lock not implemented");
 710     return HDB_ERR_CANT_LOCK_DB;
 711 }
 712
 713 /*
 714  * Not sure if this is needed.
 715  */
 716 static krb5_error_code
 717 hdb_sqlite_unlock(krb5_context context, HDB *db)
 718 {
 719     krb5_set_error_message(context, HDB_ERR_CANT_LOCK_DB,
 720                           "unlock not implemented");
 721     return HDB_ERR_CANT_LOCK_DB;
 722 }
 723
 724 /*
 725  * Should get the next entry, to allow iteration over all entries.
 726  */
 727 static krb5_error_code
 728 hdb_sqlite_nextkey(krb5_context context, HDB *db, unsigned flags,
 729                    hdb_entry_ex *entry)
 730 {
 731     krb5_error_code ret = 0;
 732     int sqlite_error;
 733     krb5_data value;
 734
 735     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
 736
 737     sqlite_error = hdb_sqlite_step(context, hsdb->db, hsdb->get_all_entries);
 738     if(sqlite_error == SQLITE_ROW) {
 739         /* Found an entry */
 740         value.length = sqlite3_column_bytes(hsdb->get_all_entries, 0);
 741         value.data = (void *) sqlite3_column_blob(hsdb->get_all_entries, 0);
 742         memset(entry, 0, sizeof(*entry));
 743         ret = hdb_value2entry(context, &value, &entry->entry);
 744     }
 745     else if(sqlite_error == SQLITE_DONE) {
 746         /* No more entries */
 747         ret = HDB_ERR_NOENTRY;
 748         sqlite3_reset(hsdb->get_all_entries);
 749     }
 750     else {
 751         /* XXX SQLite error. Should be handled in some way. */
 752         ret = EINVAL;
 753     }
 754
 755     return ret;
 756 }
 757
 758 /*
 759  * Should get the first entry in the database.
 760  * What is flags used for?
 761  */
 762 static krb5_error_code
 763 hdb_sqlite_firstkey(krb5_context context, HDB *db, unsigned flags,
 764                     hdb_entry_ex *entry)
 765 {
 766     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
 767     krb5_error_code ret;
 768
 769     sqlite3_reset(hsdb->get_all_entries);
 770
 771     ret = hdb_sqlite_nextkey(context, db, flags, entry);
 772     if(ret)
 773         return ret;
 774
 775     return 0;
 776 }
 777
 778 /*
 779  * Renames the database file.
 780  */
 781 static krb5_error_code
 782 hdb_sqlite_rename(krb5_context context, HDB *db, const char *new_name)
 783 {
 784     hdb_sqlite_db *hsdb = (hdb_sqlite_db *) db->hdb_db;
 785     int ret;
 786
 787     krb5_warnx(context, "hdb_sqlite_rename");
 788
 789     if (strncasecmp(new_name, "sqlite:", 7) == 0)
 790         new_name += 7;
 791
 792     hdb_sqlite_close_database(context, db);
 793
 794     ret = rename(hsdb->db_file, new_name);
 795     free(hsdb->db_file);
 796
 797     hdb_sqlite_make_database(context, db, new_name);
 798
 799     return ret;
 800 }
 801
 802 /*
 803  * Removes a principal, including aliases and associated entry.
 804  */
 805 static krb5_error_code
 806 hdb_sqlite_remove(krb5_context context, HDB *db,
 807                   krb5_const_principal principal)
 808 {
 809     krb5_error_code ret;
 810     hdb_sqlite_db *hsdb = (hdb_sqlite_db*)(db->hdb_db);
 811     sqlite3_stmt *rm = hsdb->remove;
 812
 813     bind_principal(context, principal, rm, 1);
 814
 815     ret = hdb_sqlite_step(context, hsdb->db, rm);
 816     if (ret != SQLITE_DONE) {
 817         ret = EINVAL;
 818         krb5_set_error_message(context, ret,
 819                               "sqlite remove failed: %d",
 820                               ret);
 821     } else
 822         ret = 0;
 823
 824     sqlite3_clear_bindings(rm);
 825     sqlite3_reset(rm);
 826
 827     return ret;
 828 }
 829
 830 /**
 831  * Create SQLITE object, and creates the on disk database if its doesn't exists.
 832  *
 833  * @param context A Kerberos 5 context.
 834  * @param db a returned database handle.
 835  * @param argument filename
 836  *
 837  * @return        0 on success, an error code if not
 838  */
 839
 840 krb5_error_code
 841 hdb_sqlite_create(krb5_context context, HDB **db, const char *argument)
 842 {
 843     krb5_error_code ret;
 844     hdb_sqlite_db *hsdb;
 845
 846     *db = calloc(1, sizeof (**db));
 847     if (*db == NULL)
 848         return krb5_enomem(context);
 849
 850     hsdb = (hdb_sqlite_db*) calloc(1, sizeof (*hsdb));
 851     if (hsdb == NULL) {
 852         free(*db);
 853         *db = NULL;
 854         return krb5_enomem(context);
 855     }
 856
 857     (*db)->hdb_db = hsdb;
 858
 859     /* XXX make_database should make sure everything else is freed on error */
 860     ret = hdb_sqlite_make_database(context, *db, argument);
 861     if (ret) {
 862         free((*db)->hdb_db);
 863         free(*db);
 864
 865         return ret;
 866     }
 867
 868     (*db)->hdb_master_key_set = 0;
 869     (*db)->hdb_openp = 0;
 870     (*db)->hdb_capability_flags = 0;
 871
 872     (*db)->hdb_open = hdb_sqlite_open;
 873     (*db)->hdb_close = hdb_sqlite_close;
 874
 875     (*db)->hdb_lock = hdb_sqlite_lock;
 876     (*db)->hdb_unlock = hdb_sqlite_unlock;
 877     (*db)->hdb_firstkey = hdb_sqlite_firstkey;
 878     (*db)->hdb_nextkey = hdb_sqlite_nextkey;
 879     (*db)->hdb_fetch_kvno = hdb_sqlite_fetch_kvno;
 880     (*db)->hdb_store = hdb_sqlite_store;
 881     (*db)->hdb_remove = hdb_sqlite_remove;
 882     (*db)->hdb_destroy = hdb_sqlite_destroy;
 883     (*db)->hdb_rename = hdb_sqlite_rename;
 884     (*db)->hdb__get = NULL;
 885     (*db)->hdb__put = NULL;
 886     (*db)->hdb__del = NULL;
 887
 888     return 0;
 889 }