src/cache.c

   1 /*
   2     Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013
   3     Ben Kibbey <bjk@luxsci.net>
   4
   5     This file is part of pwmd.
   6
   7     Pwmd is free software: you can redistribute it and/or modify
   8     it under the terms of the GNU General Public License as published by
   9     the Free Software Foundation, either version 2 of the License, or
  10     (at your option) any later version.
  11
  12     Pwmd is distributed in the hope that it will be useful,
  13     but WITHOUT ANY WARRANTY; without even the implied warranty of
  14     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15     GNU General Public License for more details.
  16
  17     You should have received a copy of the GNU General Public License
  18     along with Pwmd.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20 #ifdef HAVE_CONFIG_H
  21 #include <config.h>
  22 #endif
  23
  24 #include <stdio.h>
  25 #include <unistd.h>
  26 #include <pthread.h>
  27 #include <ctype.h>
  28 #include <errno.h>
  29
  30 #include "pwmd-error.h"
  31 #include <gcrypt.h>
  32 #include "mutex.h"
  33 #include "cache.h"
  34 #include "status.h"
  35 #include "mem.h"
  36 #include "util-misc.h"
  37 #include "util-string.h"
  38 #include "crypto.h"
  39
  40 #ifdef HAVE_TIME_H
  41 #include <time.h>
  42 #endif
  43
  44 static pthread_mutex_t cache_mutex;
  45 static struct slist_s *key_cache;
  46 #ifdef WITH_AGENT
  47 static struct agent_s *cache_agent;
  48 #endif
  49
  50 extern void log_write (const char *fmt, ...);
  51
  52 typedef gpg_error_t (*free_data_fn_t) (file_cache_t *);
  53 static free_data_fn_t free_data_fn;
  54 static gpg_error_t clear_once (file_cache_t * p);
  55 static int remove_entry (const unsigned char *md5file);
  56 static void free_entry (file_cache_t * p);
  57
  58 static file_cache_t *
  59 get_entry (const unsigned char *md5file)
  60 {
  61   int t = slist_length (key_cache);
  62   int i;
  63
  64   if (!md5file)
  65     return NULL;
  66
  67   for (i = 0; i < t; i++)
  68     {
  69       file_cache_t *p = slist_nth_data (key_cache, i);
  70
  71       if (!memcmp (p->filename, md5file, sizeof (p->filename)))
  72         return p;
  73     }
  74
  75   return NULL;
  76 }
  77
  78 gpg_error_t
  79 cache_lock_mutex (void *ctx, const unsigned char *md5file,
  80                   long lock_timeout, int add, int timeout)
  81 {
  82   MUTEX_LOCK (&cache_mutex);
  83   gpg_error_t rc = 0;
  84   file_cache_t *p = get_entry (md5file);
  85
  86   if (p)
  87     {
  88       MUTEX_UNLOCK (&cache_mutex);
  89       MUTEX_TRYLOCK (ctx, p->mutex, rc, lock_timeout);
  90     }
  91   else if (add)
  92     {
  93       if (cache_add_file (md5file, NULL, NULL, timeout))
  94         {
  95           p = get_entry (md5file);
  96           MUTEX_UNLOCK (&cache_mutex);
  97           MUTEX_TRYLOCK (ctx, p->mutex, rc, lock_timeout);
  98         }
  99       else
 100         {
 101           MUTEX_UNLOCK (&cache_mutex);
 102           rc = GPG_ERR_ENOMEM;
 103         }
 104     }
 105   else
 106     {
 107       MUTEX_UNLOCK (&cache_mutex);
 108     }
 109
 110   return !p && !rc ? GPG_ERR_NO_DATA : rc;
 111 }
 112
 113 static int
 114 remove_entry (const unsigned char *md5file)
 115 {
 116   MUTEX_LOCK (&cache_mutex);
 117   file_cache_t *p = get_entry (md5file);
 118
 119   pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 120   if (p)
 121     {
 122       /* Keep a refcount because another client maybe editing this same new
 123        * file. The entry needs to be kept in case the other client SAVE's.
 124        */
 125       p->refcount--;
 126       if (!p->refcount)
 127         free_entry (p);
 128     }
 129
 130   pthread_cleanup_pop (1);
 131   return p ? 1 : 0;
 132 }
 133
 134 gpg_error_t
 135 cache_unlock_mutex (const unsigned char *md5file, int remove)
 136 {
 137   MUTEX_LOCK (&cache_mutex);
 138   file_cache_t *p = get_entry (md5file);
 139
 140   if (p)
 141     {
 142       MUTEX_UNLOCK (p->mutex);
 143       if (remove)
 144         remove_entry (md5file);
 145     }
 146
 147   MUTEX_UNLOCK (&cache_mutex);
 148   return p ? 0 : GPG_ERR_NO_DATA;
 149 }
 150
 151 #ifdef WITH_AGENT
 152 static int valid_agent_grip (file_cache_t *e)
 153 {
 154   size_t c;
 155
 156   for (c = 0; c < sizeof (e->grip); c++)
 157     {
 158       if (e->grip[c] && e->grip[c] != '0')
 159         return 1;
 160     }
 161
 162   return 0;
 163 }
 164 #endif
 165
 166 static int
 167 valid_grip (file_cache_t * e)
 168 {
 169   if (e->data && e->data->key)
 170     return 1;
 171
 172 #ifdef WITH_AGENT
 173   return valid_agent_grip (e);
 174 #else
 175   return 0;
 176 #endif
 177 }
 178
 179 static gpg_error_t
 180 iscached (const unsigned char *md5file, int *defer)
 181 {
 182   gpg_error_t rc = 0;
 183   file_cache_t *p = get_entry (md5file);
 184
 185   if (!p || !p->data || !valid_grip (p))
 186     return GPG_ERR_NO_DATA;
 187
 188   if (defer)
 189     *defer = p->defer_clear;
 190
 191   if (p->data && p->data->key)
 192     return 0;
 193
 194 #ifdef WITH_AGENT
 195   char *line;
 196
 197   rc = send_to_agent (cache_agent, &line, NULL, "KEYINFO --data %s", p->grip);
 198   if (!rc)
 199     {
 200       char **fields = str_split (line, " ", 0);
 201
 202       /* Smartcard with a cached document. */
 203       if (*fields[1] == 'T' && p->data->doc)
 204         rc = 0;
 205       else
 206         rc = isdigit (*fields[4]) || *fields[5] == 'C' ? 0 : GPG_ERR_NO_DATA;
 207
 208       strv_free (fields);
 209       xfree (line);
 210     }
 211 #endif
 212
 213   return rc;
 214 }
 215
 216 unsigned
 217 cache_file_count ()
 218 {
 219   MUTEX_LOCK (&cache_mutex);
 220   unsigned total = 0, i, n;
 221
 222   pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 223   n = slist_length (key_cache);
 224   for (i = 0; i < n; i++)
 225     {
 226       file_cache_t *p = slist_nth_data (key_cache, i);
 227
 228       if (!iscached (p->filename, NULL))
 229         total++;
 230     }
 231
 232   pthread_cleanup_pop (1);
 233   return total;
 234 }
 235
 236 void
 237 cache_adjust_timeout ()
 238 {
 239   MUTEX_LOCK (&cache_mutex);
 240   int t = slist_length (key_cache);
 241   int i;
 242
 243   pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 244
 245   for (i = 0; i < t; i++)
 246     {
 247       file_cache_t *p = slist_nth_data (key_cache, i);
 248
 249       if (p->timeout > 0)
 250         p->timeout--;
 251
 252       if (!p->timeout)
 253         {
 254           /* The file associated with this cache entry may be locked by a
 255            * client. Defer freeing this cache entry until the next timeout
 256            * check. */
 257           if (!clear_once (p))
 258             send_status_all (STATUS_CACHE, NULL);
 259         }
 260     }
 261
 262   pthread_cleanup_pop (1);
 263 }
 264
 265 static void
 266 setgrip (file_cache_t * p, const unsigned char *grip)
 267 {
 268   if (grip)
 269     {
 270       char *tmp = bin2hex (grip, 20);
 271
 272       memcpy (p->grip, tmp, sizeof (p->grip));
 273       xfree (tmp);
 274     }
 275   else
 276     memset (p->grip, 0, sizeof(p->grip));
 277 }
 278
 279 static gpg_error_t
 280 set_timeout (const unsigned char *md5file, int timeout, int defer)
 281 {
 282   MUTEX_LOCK (&cache_mutex);
 283   file_cache_t *p = get_entry (md5file);
 284   gpg_error_t rc = 0;
 285
 286   if (!p)
 287     {
 288       MUTEX_UNLOCK (&cache_mutex);
 289       return GPG_ERR_NOT_FOUND;
 290     }
 291
 292   p->reset = timeout;
 293   if (p->timeout == -1 || timeout == -1)
 294     p->timeout = timeout;
 295
 296   if (!timeout || defer)
 297     {
 298       rc = clear_once (p);
 299       if (!rc)
 300         send_status_all (STATUS_CACHE, NULL);
 301     }
 302
 303   MUTEX_UNLOCK (&cache_mutex);
 304   return rc;
 305 }
 306
 307 gpg_error_t
 308 cache_set_data (const unsigned char *md5file, struct cache_data_s * data,
 309                 const unsigned char *grip)
 310 {
 311   MUTEX_LOCK (&cache_mutex);
 312   file_cache_t *p = get_entry (md5file);
 313
 314   if (p)
 315     {
 316       setgrip (p, grip);
 317       p->data = data;
 318       set_timeout (md5file, p->reset, p->defer_clear);
 319       if (!p->reset)
 320         {
 321           clear_once (p);
 322           send_status_all (STATUS_CACHE, NULL);
 323         }
 324     }
 325
 326   MUTEX_UNLOCK (&cache_mutex);
 327   return p ? 0 : GPG_ERR_NO_DATA;
 328 }
 329
 330 struct cache_data_s *
 331 cache_get_data (const unsigned char *md5file)
 332 {
 333   MUTEX_LOCK (&cache_mutex);
 334   file_cache_t *p = get_entry (md5file);
 335
 336   MUTEX_UNLOCK (&cache_mutex);
 337   return p ? p->data : NULL;
 338 }
 339
 340
 341 struct cache_data_s *
 342 cache_get_data_filename (const char *filename)
 343 {
 344   unsigned char md5file[16];
 345
 346   gcry_md_hash_buffer (GCRY_MD_MD5, md5file, filename, strlen (filename));
 347   return cache_get_data (md5file);
 348 }
 349
 350 int
 351 cache_add_file (const unsigned char *md5file, const unsigned char *grip,
 352                 struct cache_data_s *data, int timeout)
 353 {
 354   MUTEX_LOCK (&cache_mutex);
 355   file_cache_t *p = get_entry (md5file);
 356   struct slist_s *new;
 357   int b;
 358
 359   if (p)
 360     {
 361       setgrip (p, grip);
 362       p->data = data;
 363       p->refcount++;
 364       b = set_timeout (md5file, timeout, p->defer_clear) == 0 ? 1 : 0;
 365       MUTEX_UNLOCK (&cache_mutex);
 366       send_status_all (STATUS_CACHE, NULL);
 367       return b;
 368     }
 369
 370   p = xcalloc (1, sizeof (file_cache_t));
 371   if (!p)
 372     {
 373       MUTEX_UNLOCK (&cache_mutex);
 374       return 0;
 375     }
 376
 377   p->mutex = (pthread_mutex_t *) xmalloc (sizeof (pthread_mutex_t));
 378   if (!p->mutex)
 379     {
 380       xfree (p);
 381       MUTEX_UNLOCK (&cache_mutex);
 382       return 0;
 383     }
 384
 385   pthread_mutexattr_t attr;
 386   pthread_mutexattr_init (&attr);
 387   pthread_mutexattr_settype (&attr, PTHREAD_MUTEX_RECURSIVE);
 388   pthread_mutex_init (p->mutex, &attr);
 389   pthread_mutexattr_destroy (&attr);
 390   memcpy (p->filename, md5file, sizeof (p->filename));
 391   setgrip (p, grip);
 392   p->reset = p->timeout = timeout;
 393   p->data = data;
 394   p->refcount++;
 395   new = slist_append (key_cache, p);
 396   if (!new)
 397     {
 398       pthread_mutex_destroy (p->mutex);
 399       xfree (p->mutex);
 400       xfree (p);
 401       MUTEX_UNLOCK (&cache_mutex);
 402       return 0;
 403     }
 404
 405   key_cache = new;
 406   MUTEX_UNLOCK (&cache_mutex);
 407   send_status_all (STATUS_CACHE, NULL);
 408   return 1;
 409 }
 410
 411 static gpg_error_t
 412 clear_once (file_cache_t * p)
 413 {
 414   gpg_error_t rc = free_data_fn (p);
 415
 416   if (!rc && valid_grip (p))
 417     {
 418 #ifdef WITH_AGENT
 419       if (use_agent && valid_agent_grip (p))
 420         {
 421           rc = send_to_agent (cache_agent, NULL, NULL,
 422                               "CLEAR_PASSPHRASE --mode=normal %s", p->grip);
 423           if (rc)
 424             log_write ("%s(): %s", __FUNCTION__, pwmd_strerror (rc));
 425         }
 426 #endif
 427       memset (p->grip, 0, sizeof (p->grip));
 428     }
 429
 430   return rc;
 431 }
 432
 433 static void
 434 free_entry (file_cache_t * p)
 435 {
 436   gpg_error_t rc;
 437
 438   if (!p)
 439     return;
 440
 441   rc = clear_once (p);
 442   if (rc)
 443     log_write ("%s(): %s", __FUNCTION__, pwmd_strerror (rc));
 444
 445   if (p->mutex)
 446     {
 447       pthread_mutex_destroy (p->mutex);
 448       xfree (p->mutex);
 449     }
 450
 451   key_cache = slist_remove (key_cache, p);
 452   xfree (p);
 453 }
 454
 455 gpg_error_t
 456 cache_clear (const unsigned char *md5file)
 457 {
 458   file_cache_t *p;
 459   gpg_error_t rc = 0;
 460   int i, t;
 461
 462   MUTEX_LOCK (&cache_mutex);
 463
 464   if (md5file)
 465     {
 466       p = get_entry (md5file);
 467       if (!p)
 468         {
 469           MUTEX_UNLOCK (&cache_mutex);
 470           return 0;
 471         }
 472
 473       pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 474       rc = clear_once (p);
 475       pthread_cleanup_pop (1);
 476       if (rc)
 477         log_write ("%s(): %s", __FUNCTION__, pwmd_strerror (rc));
 478
 479       return rc;
 480     }
 481
 482   pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 483   t = slist_length (key_cache);
 484   for (i = 0; i < t; i++)
 485     {
 486       p = slist_nth_data (key_cache, i);
 487       clear_once (p);
 488     }
 489
 490   pthread_cleanup_pop (1);
 491   return 0;
 492 }
 493
 494 gpg_error_t
 495 cache_iscached (const char *filename, int *defer)
 496 {
 497   gpg_error_t rc;
 498   unsigned char md5file[16];
 499
 500   MUTEX_LOCK (&cache_mutex);
 501   pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 502   gcry_md_hash_buffer (GCRY_MD_MD5, md5file, filename, strlen (filename));
 503   rc = iscached (md5file, defer);
 504   pthread_cleanup_pop (1);
 505
 506   /* Test if the data file disappeared from the filesystem. */
 507   if ((!rc || rc == GPG_ERR_NO_DATA) && access (filename, R_OK) == -1)
 508     {
 509       rc = gpg_error_from_errno (errno);
 510       if (gpg_err_code (rc) == GPG_ERR_ENOENT)
 511         {
 512           rc = cache_defer_clear (md5file);
 513           if (!rc && defer)
 514             *defer = 1;
 515
 516           rc = GPG_ERR_ENOENT;
 517         }
 518     }
 519
 520   return rc;
 521 }
 522
 523 gpg_error_t
 524 cache_defer_clear (const unsigned char *md5file)
 525 {
 526   MUTEX_LOCK (&cache_mutex);
 527   file_cache_t *p = get_entry (md5file);
 528   gpg_error_t rc = 0;
 529
 530   if (!p)
 531     rc = GPG_ERR_NOT_FOUND;
 532   else
 533     p->defer_clear = 1;
 534
 535   MUTEX_UNLOCK (&cache_mutex);
 536   return rc;
 537 }
 538
 539 gpg_error_t
 540 cache_set_timeout (const unsigned char *md5file, int timeout)
 541 {
 542   return set_timeout (md5file, timeout, 0);
 543 }
 544
 545 int
 546 cache_get_grip (const unsigned char *md5file, unsigned char *grip)
 547 {
 548   MUTEX_LOCK (&cache_mutex);
 549   file_cache_t *p = get_entry (md5file);
 550
 551   if (!p || !valid_grip (p))
 552     {
 553       MUTEX_UNLOCK (&cache_mutex);
 554       return 0;
 555     }
 556
 557   memcpy (grip, p->grip, sizeof (p->grip));
 558   MUTEX_UNLOCK (&cache_mutex);
 559   return 1;
 560 }
 561
 562 /* The with_pkcs parameter is needed to prevent clearing gpg-agent
 563    cached keys during an atfork callback since the agent is still
 564    shared between the two processes. */
 565 void
 566 cache_deinit (int atfork)
 567 {
 568   MUTEX_LOCK (&cache_mutex);
 569   int i, t = slist_length (key_cache);
 570
 571   pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 572   for (i = 0; i < t; i++)
 573     {
 574       file_cache_t *p = slist_nth_data (key_cache, i);
 575
 576 #ifdef WITH_AGENT
 577       if (atfork && valid_agent_grip (p))
 578           continue;
 579 #endif
 580
 581       free_entry (p);
 582       t = slist_length (key_cache);
 583       i = -1;
 584     }
 585
 586 #ifdef WITH_AGENT
 587   if (use_agent && cache_agent)
 588     cleanup_agent (cache_agent);
 589
 590   cache_agent = NULL;
 591 #endif
 592   gcry_free (cache_key);
 593   xfree (cache_iv);
 594   cache_key = NULL;
 595   cache_iv = NULL;
 596   pthread_cleanup_pop (1);
 597   pthread_mutex_destroy (&cache_mutex);
 598 }
 599
 600 void
 601 cache_mutex_init ()
 602 {
 603   pthread_mutexattr_t attr;
 604
 605   pthread_mutexattr_init (&attr);
 606   pthread_mutexattr_settype (&attr, PTHREAD_MUTEX_RECURSIVE);
 607   pthread_mutex_init (&cache_mutex, &attr);
 608   pthread_mutexattr_destroy (&attr);
 609 }
 610
 611 gpg_error_t
 612 cache_init (free_data_fn_t fn)
 613 {
 614   gpg_error_t rc = 0;
 615
 616   if (!cache_key)
 617     {
 618       rc = gcry_cipher_algo_info (GCRY_CIPHER_AES, GCRYCTL_GET_BLKLEN, NULL,
 619                                   &cache_blocksize);
 620       if (rc)
 621         return rc;
 622
 623       rc = gcry_cipher_algo_info (GCRY_CIPHER_AES, GCRYCTL_GET_KEYLEN, NULL,
 624                                   &cache_keysize);
 625       if (rc)
 626         return rc;
 627
 628       cache_key = gcry_malloc (cache_keysize);
 629       if (!cache_key)
 630         return GPG_ERR_ENOMEM;
 631
 632       cache_iv = xmalloc (cache_blocksize);
 633       if (!cache_iv)
 634         {
 635           gcry_free (cache_key);
 636           cache_key = NULL;
 637           return GPG_ERR_ENOMEM;
 638         }
 639
 640       gcry_create_nonce (cache_key, cache_keysize);
 641       gcry_create_nonce (cache_iv, cache_blocksize);
 642     }
 643
 644 #ifdef WITH_AGENT
 645   if (use_agent && !cache_agent)
 646     {
 647       rc = agent_init (&cache_agent);
 648       if (!rc)
 649         {
 650           char *line;
 651
 652           rc = send_to_agent (cache_agent, &line, NULL, "GETINFO version");
 653           if (!rc)
 654             {
 655               char **fields = str_split (line, ".", 0);
 656               int major, minor;
 657
 658               major = atoi (fields[0]);
 659               minor = atoi (fields[1]);
 660               if (major < 2 || minor < 1)
 661                 rc = GPG_ERR_UNKNOWN_VERSION;
 662
 663               strv_free (fields);
 664               xfree (line);
 665             }
 666         }
 667     }
 668 #endif
 669
 670   cache_mutex_init ();
 671   free_data_fn = fn;
 672   return rc;
 673 }
 674
 675 #ifdef WITH_AGENT
 676 gpg_error_t
 677 cache_is_shadowed (const char *grip)
 678 {
 679   MUTEX_LOCK (&cache_mutex);
 680   char *line;
 681   size_t len;
 682   gpg_error_t rc;
 683
 684   pthread_cleanup_push (cleanup_mutex_cb, &cache_mutex);
 685   rc = send_to_agent (cache_agent, &line, &len, "KEYINFO --data %s", grip);
 686   pthread_cleanup_pop (1);
 687
 688   if (!rc)
 689     {
 690       char **fields = str_split (line, " ", 0);
 691
 692       rc = (*fields[1] == 'T') ? 0 : GPG_ERR_NO_DATA;
 693       xfree (line);
 694       strv_free (fields);
 695     }
 696
 697   return rc;
 698 }
 699 #endif
 700
 701 void
 702 cache_lock ()
 703 {
 704   MUTEX_LOCK (&cache_mutex);
 705 }
 706
 707 void
 708 cache_unlock ()
 709 {
 710   MUTEX_UNLOCK (&cache_mutex);
 711 }
 712
 713 void
 714 free_cache_data_once (struct cache_data_s *data)
 715 {
 716   if (!data)
 717     return;
 718
 719 #ifdef WITH_AGENT
 720   if (data->pubkey)
 721     gcry_sexp_release (data->pubkey);
 722
 723   if (data->sigkey)
 724     gcry_sexp_release (data->sigkey);
 725 #endif
 726
 727   gcry_free (data->doc);
 728   gcry_free (data->key);
 729   xfree (data->crc);
 730   xfree (data);
 731 }