Context Navigation

source: branches/samba-3.0/source/nsswitch/winbindd_cred_cache.c

Visit:

Last change on this file was 165, checked in by Paul Smedley, 17 years ago
Add 'missing' 3.0.34 diffs
File size: 27.0 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3
4	Winbind daemon - krb5 credential cache functions
5	and in-memory cache functions.
6
7	Copyright (C) Guenther Deschner 2005-2006
8	Copyright (C) Jeremy Allison 2006
9
10	This program is free software; you can redistribute it and/or modify
11	it under the terms of the GNU General Public License as published by
12	the Free Software Foundation; either version 2 of the License, or
13	(at your option) any later version.
14
15	This program is distributed in the hope that it will be useful,
16	but WITHOUT ANY WARRANTY; without even the implied warranty of
17	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18	GNU General Public License for more details.
19
20	You should have received a copy of the GNU General Public License
21	along with this program; if not, write to the Free Software
22	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23	*/
24
25	#include "includes.h"
26	#include "winbindd.h"
27	#undef DBGC_CLASS
28	#define DBGC_CLASS DBGC_WINBIND
29
30	/* uncomment this to to fast debugging on the krb5 ticket renewal event */
31	#ifdef DEBUG_KRB5_TKT_RENEWAL
32	#undef DEBUG_KRB5_TKT_RENEWAL
33	#endif
34
35	#define MAX_CCACHES 100
36
37	static struct WINBINDD_CCACHE_ENTRY *ccache_list;
38	static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
39	struct timeval t);
40
41	/* The Krb5 ticket refresh handler should be scheduled
42	at one-half of the period from now till the tkt
43	expiration */
44	#define KRB5_EVENT_REFRESH_TIME(x) ((x) - (((x) - time(NULL))/2))
45
46	/****************************************************************
47	Find an entry by name.
48	****************************************************************/
49
50	static struct WINBINDD_CCACHE_ENTRY get_ccache_by_username(const char username)
51	{
52	struct WINBINDD_CCACHE_ENTRY *entry;
53
54	for (entry = ccache_list; entry; entry = entry->next) {
55	if (strequal(entry->username, username)) {
56	return entry;
57	}
58	}
59	return NULL;
60	}
61
62	/****************************************************************
63	How many do we have ?
64	****************************************************************/
65
66	static int ccache_entry_count(void)
67	{
68	struct WINBINDD_CCACHE_ENTRY *entry;
69	int i = 0;
70
71	for (entry = ccache_list; entry; entry = entry->next) {
72	i++;
73	}
74	return i;
75	}
76
77	void ccache_remove_all_after_fork(void)
78	{
79	struct WINBINDD_CCACHE_ENTRY *cur;
80	cur = ccache_list;
81	while (cur) {
82	DLIST_REMOVE(ccache_list, cur);
83	TALLOC_FREE(cur->event);
84	TALLOC_FREE(cur);
85	cur = ccache_list;
86	}
87	}
88
89	static void krb5_ticket_gain_handler(struct event_context *event_ctx,
90	struct timed_event *te,
91	const struct timeval *now,
92	void *private_data);
93	static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
94	struct timed_event *te,
95	const struct timeval *now,
96	void *private_data);
97
98	void ccache_regain_all_now(void)
99	{
100	struct WINBINDD_CCACHE_ENTRY *cur;
101	struct timeval t = timeval_current();
102
103	for (cur = ccache_list; cur; cur = cur->next) {
104	struct timed_event *new_event;
105
106	/*
107	* if refresh_time is 0, we know that the
108	* the event has the krb5_ticket_gain_handler
109	*/
110	if (cur->refresh_time == 0) {
111	new_event = event_add_timed(winbind_event_context(),
112	cur, t,
113	"krb5_ticket_gain_handler",
114	krb5_ticket_gain_handler,
115	cur);
116	} else {
117	new_event = event_add_timed(winbind_event_context(),
118	cur, t,
119	"krb5_ticket_refresh_handler",
120	krb5_ticket_refresh_handler,
121	cur);
122	}
123	if (!new_event) {
124	continue;
125	}
126
127	TALLOC_FREE(cur->event);
128	cur->event = new_event;
129	}
130	return;
131	}
132
133	/****************************************************************
134	The gain initial ticket is recognized as entry->refresh_time is
135	always zero.
136	****************************************************************/
137
138	static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
139	struct timeval t)
140	{
141	entry->refresh_time = 0;
142	entry->event = event_add_timed(winbind_event_context(), entry,
143	t,
144	"krb5_ticket_gain_handler",
145	krb5_ticket_gain_handler,
146	entry);
147	}
148
149	/****************************************************************
150	Do the work of refreshing the ticket.
151	****************************************************************/
152
153	static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
154	struct timed_event *te,
155	const struct timeval *now,
156	void *private_data)
157	{
158	struct WINBINDD_CCACHE_ENTRY *entry =
159	talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
160	#ifdef HAVE_KRB5
161	int ret;
162	time_t new_start;
163	time_t expire_time = 0;
164	struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
165	#endif
166
167	DEBUG(10,("krb5_ticket_refresh_handler called\n"));
168	DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
169
170	TALLOC_FREE(entry->event);
171
172	#ifdef HAVE_KRB5
173
174	/* Kinit again if we have the user password and we can't renew the old
175	* tgt anymore
176	* NB
177	* This happens when machine are put to sleep for a very long time. */
178
179	if (entry->renew_until < time(NULL)) {
180	rekinit:
181	if (cred_ptr && cred_ptr->pass) {
182
183	set_effective_uid(entry->uid);
184
185	ret = kerberos_kinit_password_ext(entry->principal_name,
186	cred_ptr->pass,
187	0, /* hm, can we do time correction here ? */
188	&entry->refresh_time,
189	&entry->renew_until,
190	entry->ccname,
191	False, /* no PAC required anymore */
192	True,
193	WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
194	gain_root_privilege();
195
196	if (ret) {
197	DEBUG(3,("krb5_ticket_refresh_handler: "
198	"could not re-kinit: %s\n",
199	error_message(ret)));
200	/* destroy the ticket because we cannot rekinit
201	* it, ignore error here */
202	ads_kdestroy(entry->ccname);
203
204	/* Don't break the ticket refresh chain: retry
205	* refreshing ticket sometime later when KDC is
206	* unreachable -- BoYang.
207	* More error handling here? KRB5_CC_IO,
208	* KRB5KRB_AP_ERR_SKEW.
209	* */
210
211	if ((ret == KRB5_KDC_UNREACH)
212	\|\| (ret == KRB5_REALM_CANT_RESOLVE)) {
213	#if defined(DEBUG_KRB5_TKT_RENEWAL)
214	new_start = time(NULL) + 30;
215	#else
216	new_start = time(NULL) +
217	MAX(30, lp_winbind_cache_time());
218	#endif
219	/* try to regain ticket here */
220	add_krb5_ticket_gain_handler_event(entry,
221	timeval_set(new_start, 0));
222	return;
223	}
224	TALLOC_FREE(entry->event);
225	return;
226	}
227
228	DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
229	"for: %s in ccache: %s\n",
230	entry->principal_name, entry->ccname));
231
232	#if defined(DEBUG_KRB5_TKT_RENEWAL)
233	new_start = time(NULL) + 30;
234	#else
235	/* The tkt should be refreshed at one-half the period
236	from now to the expiration time */
237	expire_time = entry->refresh_time;
238	new_start = KRB5_EVENT_REFRESH_TIME(entry->refresh_time);
239	#endif
240	goto done;
241	} else {
242	/* can this happen?
243	* No cached credentials
244	* destroy ticket and refresh chain
245	* */
246	ads_kdestroy(entry->ccname);
247	TALLOC_FREE(entry->event);
248	return;
249	}
250	}
251
252	set_effective_uid(entry->uid);
253
254	ret = smb_krb5_renew_ticket(entry->ccname,
255	entry->principal_name,
256	entry->service,
257	&new_start);
258	#if defined(DEBUG_KRB5_TKT_RENEWAL)
259	new_start = time(NULL) + 30;
260	#else
261	expire_time = new_start;
262	new_start = KRB5_EVENT_REFRESH_TIME(new_start);
263	#endif
264
265	gain_root_privilege();
266
267	if (ret) {
268	DEBUG(3,("krb5_ticket_refresh_handler: could not renew tickets: %s\n",
269	error_message(ret)));
270	/* maybe we are beyond the renewing window */
271
272	/* evil rises here, we refresh ticket failed,
273	* but the ticket might be expired. Therefore,
274	* When we refresh ticket failed, destory the
275	* ticket */
276
277	ads_kdestroy(entry->ccname);
278
279	/* avoid breaking the renewal chain: retry in lp_winbind_cache_time()
280	* seconds when the KDC was not available right now.
281	* the return code can be KRB5_REALM_CANT_RESOLVE
282	* More error handling here? KRB5_CC_IO, KRB5KRB_AP_ERR_SKEW. */
283
284	if ((ret == KRB5_KDC_UNREACH)
285	\|\| (ret == KRB5_REALM_CANT_RESOLVE)) {
286	#if defined(DEBUG_KRB5_TKT_RENEWAL)
287	new_start = time(NULL) + 30;
288	#else
289	new_start = time(NULL) +
290	MAX(30, lp_winbind_cache_time());
291	#endif
292	/* ticket is destroyed here, we have to regain it
293	* if it is possible */
294	add_krb5_ticket_gain_handler_event(entry, timeval_set(new_start, 0));
295	return;
296	}
297	/* This is evil, if the ticket was already expired.
298	* renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
299	* But there is still a chance that we can rekinit it.
300	*
301	* This happens when user login in online mode, and then network
302	* down or something cause winbind goes offline for a very long time,
303	* and then goes online again. ticket expired, renew failed.
304	* This happens when machine are put to sleep for a long time,
305	* but shorter than entry->renew_util.
306	* NB
307	* Looks like the KDC is reachable, we want to rekinit as soon as
308	* possible instead of waiting some time later. */
309	if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
310	\|\| (ret == KRB5_FCC_NOFILE)) goto rekinit;
311
312
313	return;
314	}
315
316	done:
317	/* in cases that ticket will be unrenewable soon, we don't try to renew ticket
318	* but try to regain ticket if it is possible */
319	if (entry->renew_until && expire_time
320	&& (entry->renew_until <= expire_time)) {
321	/* try to regain ticket 10 seconds beforre expiration */
322	expire_time -= 10;
323	add_krb5_ticket_gain_handler_event(entry, timeval_set(expire_time, 0));
324	return;
325	}
326
327	if (!entry->refresh_time) {
328	entry->refresh_time = new_start;
329	}
330	entry->event = event_add_timed(winbind_event_context(), entry,
331	timeval_set(new_start, 0),
332	"krb5_ticket_refresh_handler",
333	krb5_ticket_refresh_handler,
334	entry);
335
336	#endif
337	}
338
339	/****************************************************************
340	Do the work of regaining a ticket when coming from offline auth.
341	****************************************************************/
342
343	static void krb5_ticket_gain_handler(struct event_context *event_ctx,
344	struct timed_event *te,
345	const struct timeval *now,
346	void *private_data)
347	{
348	struct WINBINDD_CCACHE_ENTRY *entry =
349	talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
350	#ifdef HAVE_KRB5
351	int ret;
352	struct timeval t;
353	struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
354	struct winbindd_domain *domain = NULL;
355	#endif
356
357	DEBUG(10,("krb5_ticket_gain_handler called\n"));
358	DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
359
360	TALLOC_FREE(entry->event);
361
362	#ifdef HAVE_KRB5
363
364	if (!cred_ptr \|\| !cred_ptr->pass) {
365	DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
366	return;
367	}
368
369	if ((domain = find_domain_from_name(entry->realm)) == NULL) {
370	DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
371	return;
372	}
373
374	if (domain->online) {
375
376	set_effective_uid(entry->uid);
377
378	ret = kerberos_kinit_password_ext(entry->principal_name,
379	cred_ptr->pass,
380	0, /* hm, can we do time correction here ? */
381	&entry->refresh_time,
382	&entry->renew_until,
383	entry->ccname,
384	False, /* no PAC required anymore */
385	True,
386	WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
387	gain_root_privilege();
388
389	if (ret) {
390	DEBUG(3,("krb5_ticket_gain_handler: could not kinit: %s\n",
391	error_message(ret)));
392	/* evil. If we cannot do it, destroy any the __maybe__
393	* __existing__ ticket */
394	ads_kdestroy(entry->ccname);
395	goto retry_later;
396	}
397
398	DEBUG(10,("krb5_ticket_gain_handler: successful kinit for: %s in ccache: %s\n",
399	entry->principal_name, entry->ccname));
400
401	goto got_ticket;
402	}
403
404	retry_later:
405	#if defined(DEBUG_KRB5_TKT_REGAIN)
406	t = timeval_set(time(NULL) + 30, 0);
407	#else
408	t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
409	#endif
410	add_krb5_ticket_gain_handler_event(entry, t);
411
412	return;
413
414	got_ticket:
415
416	#if defined(DEBUG_KRB5_TKT_RENEWAL)
417	t = timeval_set(time(NULL) + 30, 0);
418	#else
419	t = timeval_set(KRB5_EVENT_REFRESH_TIME(entry->refresh_time), 0);
420	#endif
421
422	if (!entry->refresh_time) {
423	entry->refresh_time = t.tv_sec;
424	}
425	entry->event = event_add_timed(winbind_event_context(), entry,
426	t,
427	"krb5_ticket_refresh_handler",
428	krb5_ticket_refresh_handler,
429	entry);
430
431	return;
432	#endif
433	}
434
435	/****************************************************************
436	Check if an ccache entry exists.
437	****************************************************************/
438
439	BOOL ccache_entry_exists(const char *username)
440	{
441	struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
442	return (entry != NULL);
443	}
444
445	/****************************************************************
446	Ensure we're changing the correct entry.
447	****************************************************************/
448
449	BOOL ccache_entry_identical(const char username, uid_t uid, const char ccname)
450	{
451	struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
452
453	if (!entry) {
454	return False;
455	}
456
457	if (entry->uid != uid) {
458	DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
459	(unsigned int)entry->uid, (unsigned int)uid ));
460	return False;
461	}
462	if (!strcsequal(entry->ccname, ccname)) {
463	DEBUG(0,("cache_entry_identical: ccnames differ: (cache) %s != (client) %s\n",
464	entry->ccname, ccname));
465	return False;
466	}
467	return True;
468	}
469
470	NTSTATUS add_ccache_to_list(const char *princ_name,
471	const char *ccname,
472	const char *service,
473	const char *username,
474	const char *realm,
475	uid_t uid,
476	time_t create_time,
477	time_t ticket_end,
478	time_t renew_until,
479	BOOL postponed_request)
480	{
481	struct WINBINDD_CCACHE_ENTRY *entry = NULL;
482	NTSTATUS ntret;
483	#ifdef HAVE_KRB5
484	int ret;
485	#endif
486
487	if ((username == NULL && princ_name == NULL) \|\| ccname == NULL \|\| uid < 0) {
488	return NT_STATUS_INVALID_PARAMETER;
489	}
490
491	if (ccache_entry_count() + 1 > MAX_CCACHES) {
492	DEBUG(10,("add_ccache_to_list: max number of ccaches reached\n"));
493	return NT_STATUS_NO_MORE_ENTRIES;
494	}
495
496	/* If it is cached login, destroy krb5 ticket
497	* to avoid surprise. */
498	#ifdef HAVE_KRB5
499	if (postponed_request) {
500	/* ignore KRB5_FCC_NOFILE error here */
501	ret = ads_kdestroy(ccname);
502	if (ret == KRB5_FCC_NOFILE) {
503	ret = 0;
504	}
505	if (ret) {
506	DEBUG(0, ("add_ccache_to_list: failed to destroy "
507	"user krb5 ccache %s with %s\n", ccname,
508	error_message(ret)));
509	return krb5_to_nt_status(ret);
510	} else {
511	DEBUG(10, ("add_ccache_to_list: successfully destroyed "
512	"krb5 ccache %s for user %s\n", ccname,
513	username));
514	}
515	}
516	#endif
517
518	/* Reference count old entries */
519	entry = get_ccache_by_username(username);
520	if (entry) {
521	/* Check cached entries are identical. */
522	if (!ccache_entry_identical(username, uid, ccname)) {
523	return NT_STATUS_INVALID_PARAMETER;
524	}
525	entry->ref_count++;
526	DEBUG(10,("add_ccache_to_list: ref count on entry %s is now %d\n",
527	username, entry->ref_count));
528	/* FIXME: in this case we still might want to have a krb5 cred
529	* event handler created - gd
530	* Add ticket refresh handler here */
531
532	if (!lp_winbind_refresh_tickets() \|\| renew_until <= 0) {
533	return NT_STATUS_OK;
534	}
535
536	if (!entry->event) {
537	struct timeval t;
538	if (postponed_request) {
539	t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
540	add_krb5_ticket_gain_handler_event(entry, t);
541	} else {
542	/* Renew at 1/2 the ticket expiration time */
543	#if defined(DEBUG_KRB5_TKT_RENEWAL)
544	t = timeval_set(time(NULL)+30, 0);
545	#else
546	t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
547	#endif
548	if (!entry->refresh_time) {
549	entry->refresh_time = t.tv_sec;
550	}
551	entry->event = event_add_timed(winbind_event_context(),
552	entry,
553	t,
554	"krb5_ticket_refresh_handler",
555	krb5_ticket_refresh_handler,
556	entry);
557	}
558
559	if (!entry->event) {
560	ntret = remove_ccache(username);
561	if (!NT_STATUS_IS_OK(ntret)) {
562	DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
563	"ccache %s for user %s\n", entry->ccname,
564	entry->username));
565	DEBUG(0, ("add_ccache_to_list: error is %s\n",
566	nt_errstr(ntret)));
567	return ntret;
568	}
569	return NT_STATUS_NO_MEMORY;
570	}
571
572	DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
573	}
574
575	return NT_STATUS_OK;
576	}
577
578	entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
579	if (!entry) {
580	return NT_STATUS_NO_MEMORY;
581	}
582
583	ZERO_STRUCTP(entry);
584
585	if (username) {
586	entry->username = talloc_strdup(entry, username);
587	if (!entry->username) {
588	goto no_mem;
589	}
590	}
591	if (princ_name) {
592	entry->principal_name = talloc_strdup(entry, princ_name);
593	if (!entry->principal_name) {
594	goto no_mem;
595	}
596	}
597	if (service) {
598	entry->service = talloc_strdup(entry, service);
599	if (!entry->service) {
600	goto no_mem;
601	}
602	}
603
604	entry->ccname = talloc_strdup(entry, ccname);
605	if (!entry->ccname) {
606	goto no_mem;
607	}
608
609	entry->realm = talloc_strdup(entry, realm);
610	if (!entry->realm) {
611	goto no_mem;
612	}
613
614	entry->create_time = create_time;
615	entry->renew_until = renew_until;
616	entry->uid = uid;
617	entry->ref_count = 1;
618
619	if (lp_winbind_refresh_tickets() && renew_until > 0) {
620	struct timeval t;
621	if (postponed_request) {
622	add_krb5_ticket_gain_handler_event(entry, t);
623	} else {
624	/* Renew at 1/2 the ticket expiration time */
625	#if defined(DEBUG_KRB5_TKT_RENEWAL)
626	t = timeval_set(time(NULL)+30, 0);
627	#else
628	t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
629	#endif
630	if (!entry->refresh_time) {
631	entry->refresh_time = t.tv_sec;
632	}
633	entry->event = event_add_timed(winbind_event_context(), entry,
634	t,
635	"krb5_ticket_refresh_handler",
636	krb5_ticket_refresh_handler,
637	entry);
638	}
639
640	if (!entry->event) {
641	goto no_mem;
642	}
643
644	DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
645	}
646
647	DLIST_ADD(ccache_list, entry);
648
649	DEBUG(10,("add_ccache_to_list: added ccache [%s] for user [%s] to the list\n", ccname, username));
650
651	return NT_STATUS_OK;
652
653	no_mem:
654
655	TALLOC_FREE(entry);
656	return NT_STATUS_NO_MEMORY;
657	}
658
659	/*******************************************************************
660	Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer referenced.
661	*******************************************************************/
662
663	NTSTATUS remove_ccache(const char *username)
664	{
665	struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
666	NTSTATUS status = NT_STATUS_OK;
667	#ifdef HAVE_KRB5
668	krb5_error_code ret;
669	#endif
670
671	if (!entry) {
672	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
673	}
674
675	if (entry->ref_count <= 0) {
676	DEBUG(0,("remove_ccache: logic error. ref count for user %s = %d\n",
677	username, entry->ref_count));
678	return NT_STATUS_INTERNAL_DB_CORRUPTION;
679	}
680
681	entry->ref_count--;
682
683	if (entry->ref_count > 0) {
684	DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
685	username, entry->ref_count ));
686	return NT_STATUS_OK;
687	}
688
689	/* no references any more */
690
691	DLIST_REMOVE(ccache_list, entry);
692	TALLOC_FREE(entry->event); /* unregisters events */
693
694	#ifdef HAVE_KRB5
695	ret = ads_kdestroy(entry->ccname);
696
697	/* we ignore the error when there has been no credential cache */
698	if (ret == KRB5_FCC_NOFILE) {
699	ret = 0;
700	} else if (ret) {
701	DEBUG(0,("remove_ccache: failed to destroy user krb5 ccache %s with: %s\n",
702	entry->ccname, error_message(ret)));
703	} else {
704	DEBUG(10,("remove_ccache: successfully destroyed krb5 ccache %s for user %s\n",
705	entry->ccname, username));
706	}
707	status = krb5_to_nt_status(ret);
708	#endif
709
710	TALLOC_FREE(entry);
711	DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
712
713	return status;
714	}
715
716	/*******************************************************************
717	In memory credentials cache code.
718	*******************************************************************/
719
720	static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
721
722	/***********************************************************
723	Find an entry on the list by name.
724	***********************************************************/
725
726	struct WINBINDD_MEMORY_CREDS find_memory_creds_by_name(const char username)
727	{
728	struct WINBINDD_MEMORY_CREDS *p;
729
730	for (p = memory_creds_list; p; p = p->next) {
731	if (strequal(p->username, username)) {
732	return p;
733	}
734	}
735	return NULL;
736	}
737
738	/***********************************************************
739	Store the required creds and mlock them.
740	***********************************************************/
741
742	static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS memcredp, const char pass)
743	{
744	#if !defined(HAVE_MLOCK)
745	return NT_STATUS_OK;
746	#else
747	/* new_entry->nt_hash is the base pointer for the block
748	of memory pointed into by new_entry->lm_hash and
749	new_entry->pass (if we're storing plaintext). */
750
751	memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
752	if (pass) {
753	memcredp->len += strlen(pass)+1;
754	}
755
756
757	#if defined(LINUX)
758	/* aligning the memory on on x86_64 and compiling
759	with gcc 4.1 using -O2 causes a segv in the
760	next memset() --jerry */
761	memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
762	#else
763	/* On non-linux platforms, mlock()'d memory must be aligned */
764	memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
765	getpagesize(), memcredp->len);
766	#endif
767	if (!memcredp->nt_hash) {
768	return NT_STATUS_NO_MEMORY;
769	}
770	memset( memcredp->nt_hash, 0x0, memcredp->len );
771
772	memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
773
774	#ifdef DEBUG_PASSWORD
775	DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
776	#endif
777	if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
778	DEBUG(0,("failed to mlock memory: %s (%d)\n",
779	strerror(errno), errno));
780	SAFE_FREE(memcredp->nt_hash);
781	return map_nt_error_from_unix(errno);
782	}
783
784	#ifdef DEBUG_PASSWORD
785	DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
786	#endif
787
788	/* Create and store the password hashes. */
789	E_md4hash(pass, memcredp->nt_hash);
790	E_deshash(pass, memcredp->lm_hash);
791
792	if (pass) {
793	memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
794	memcpy(memcredp->pass, pass, memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
795	}
796
797	return NT_STATUS_OK;
798	#endif
799	}
800
801	/***********************************************************
802	Destroy existing creds.
803	***********************************************************/
804
805	static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
806	{
807	#if !defined(HAVE_MUNLOCK)
808	return NT_STATUS_OK;
809	#else
810	if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
811	DEBUG(0,("failed to munlock memory: %s (%d)\n",
812	strerror(errno), errno));
813	return map_nt_error_from_unix(errno);
814	}
815	memset(memcredp->nt_hash, '\0', memcredp->len);
816	SAFE_FREE(memcredp->nt_hash);
817	memcredp->nt_hash = NULL;
818	memcredp->lm_hash = NULL;
819	memcredp->pass = NULL;
820	memcredp->len = 0;
821	return NT_STATUS_OK;
822	#endif
823	}
824
825	/***********************************************************
826	Replace the required creds with new ones (password change).
827	***********************************************************/
828
829	static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
830	const char *pass)
831	{
832	NTSTATUS status = delete_memory_creds(memcredp);
833	if (!NT_STATUS_IS_OK(status)) {
834	return status;
835	}
836	return store_memory_creds(memcredp, pass);
837	}
838
839	/*************************************************************
840	Store credentials in memory in a list.
841	*************************************************************/
842
843	static NTSTATUS winbindd_add_memory_creds_internal(const char username, uid_t uid, const char pass)
844	{
845	/* Shortcut to ensure we don't store if no mlock. */
846	#if !defined(HAVE_MLOCK) \|\| !defined(HAVE_MUNLOCK)
847	return NT_STATUS_OK;
848	#else
849	NTSTATUS status;
850	struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
851
852	if (uid == (uid_t)-1) {
853	DEBUG(0,("winbindd_add_memory_creds_internal: invalid uid for user %s.\n",
854	username ));
855	return NT_STATUS_INVALID_PARAMETER;
856	}
857
858	if (memcredp) {
859	/* Already exists. Increment the reference count and replace stored creds. */
860	if (uid != memcredp->uid) {
861	DEBUG(0,("winbindd_add_memory_creds_internal: uid %u for user %s doesn't "
862	"match stored uid %u. Replacing.\n",
863	(unsigned int)uid, username, (unsigned int)memcredp->uid ));
864	memcredp->uid = uid;
865	}
866	memcredp->ref_count++;
867	DEBUG(10,("winbindd_add_memory_creds_internal: ref count for user %s is now %d\n",
868	username, memcredp->ref_count ));
869	return winbindd_replace_memory_creds_internal(memcredp, pass);
870	}
871
872	memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
873	if (!memcredp) {
874	return NT_STATUS_NO_MEMORY;
875	}
876	memcredp->username = talloc_strdup(memcredp, username);
877	if (!memcredp->username) {
878	talloc_destroy(memcredp);
879	return NT_STATUS_NO_MEMORY;
880	}
881
882	status = store_memory_creds(memcredp, pass);
883	if (!NT_STATUS_IS_OK(status)) {
884	talloc_destroy(memcredp);
885	return status;
886	}
887
888	memcredp->uid = uid;
889	memcredp->ref_count = 1;
890	DLIST_ADD(memory_creds_list, memcredp);
891
892	DEBUG(10,("winbindd_add_memory_creds_internal: added entry for user %s\n",
893	username ));
894
895	return NT_STATUS_OK;
896	#endif
897	}
898
899	/*************************************************************
900	Store users credentials in memory. If we also have a
901	struct WINBINDD_CCACHE_ENTRY for this username with a
902	refresh timer, then store the plaintext of the password
903	and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
904	*************************************************************/
905
906	NTSTATUS winbindd_add_memory_creds(const char username, uid_t uid, const char pass)
907	{
908	struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
909	NTSTATUS status;
910
911	status = winbindd_add_memory_creds_internal(username, uid, pass);
912	if (!NT_STATUS_IS_OK(status)) {
913	return status;
914	}
915
916	if (entry) {
917	struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
918	if (memcredp) {
919	entry->cred_ptr = memcredp;
920	}
921	}
922
923	return status;
924	}
925
926	/*************************************************************
927	Decrement the in-memory ref count - delete if zero.
928	*************************************************************/
929
930	NTSTATUS winbindd_delete_memory_creds(const char *username)
931	{
932	struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
933	struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
934	NTSTATUS status = NT_STATUS_OK;
935
936	if (!memcredp) {
937	DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
938	username ));
939	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
940	}
941
942	if (memcredp->ref_count <= 0) {
943	DEBUG(0,("winbindd_delete_memory_creds: logic error. ref count for user %s = %d\n",
944	username, memcredp->ref_count));
945	status = NT_STATUS_INTERNAL_DB_CORRUPTION;
946	}
947
948	memcredp->ref_count--;
949	if (memcredp->ref_count <= 0) {
950	delete_memory_creds(memcredp);
951	DLIST_REMOVE(memory_creds_list, memcredp);
952	talloc_destroy(memcredp);
953	DEBUG(10,("winbindd_delete_memory_creds: deleted entry for user %s\n",
954	username));
955	} else {
956	DEBUG(10,("winbindd_delete_memory_creds: entry for user %s ref_count now %d\n",
957	username, memcredp->ref_count));
958	}
959
960	if (entry) {
961	entry->cred_ptr = NULL; /* Ensure we have no dangling references to this. */
962	}
963	return status;
964	}
965
966	/***********************************************************
967	Replace the required creds with new ones (password change).
968	***********************************************************/
969
970	NTSTATUS winbindd_replace_memory_creds(const char username, const char pass)
971	{
972	struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
973
974	if (!memcredp) {
975	DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
976	username ));
977	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
978	}
979
980	DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
981	username ));
982
983	return winbindd_replace_memory_creds_internal(memcredp, pass);
984	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: