1/* 2 * Copyright (c) 2004 - 2007 Kungliga Tekniska H��gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "krb5_locl.h" 35#include <krb5_ccapi.h> 36#ifdef HAVE_DLFCN_H 37#include <dlfcn.h> 38#endif 39 40static HEIMDAL_MUTEX acc_mutex = HEIMDAL_MUTEX_INITIALIZER; 41static cc_initialize_func init_func; 42#ifdef HAVE_DLOPEN 43static void *cc_handle; 44#endif 45 46typedef struct krb5_acc { 47 char *cache_name; 48 cc_context_t context; 49 cc_ccache_t ccache; 50} krb5_acc; 51 52static krb5_error_code acc_close(krb5_context, krb5_ccache); 53 54#define ACACHE(X) ((krb5_acc *)(X)->data.data) 55 56static const struct { 57 cc_int32 error; 58 krb5_error_code ret; 59} cc_errors[] = { 60 { ccErrBadName, KRB5_CC_BADNAME }, 61 { ccErrCredentialsNotFound, KRB5_CC_NOTFOUND }, 62 { ccErrCCacheNotFound, KRB5_FCC_NOFILE }, 63 { ccErrContextNotFound, KRB5_CC_NOTFOUND }, 64 { ccIteratorEnd, KRB5_CC_END }, 65 { ccErrNoMem, KRB5_CC_NOMEM }, 66 { ccErrServerUnavailable, KRB5_CC_NOSUPP }, 67 { ccErrInvalidCCache, KRB5_CC_BADNAME }, 68 { ccNoError, 0 } 69}; 70 71static krb5_error_code 72translate_cc_error(krb5_context context, cc_int32 error) 73{ 74 int i; 75 krb5_clear_error_message(context); 76 for(i = 0; i < sizeof(cc_errors)/sizeof(cc_errors[0]); i++) 77 if (cc_errors[i].error == error) 78 return cc_errors[i].ret; 79 return KRB5_FCC_INTERNAL; 80} 81 82static krb5_error_code 83init_ccapi(krb5_context context) 84{ 85 const char *lib; 86 87 HEIMDAL_MUTEX_lock(&acc_mutex); 88 if (init_func) { 89 HEIMDAL_MUTEX_unlock(&acc_mutex); 90 krb5_clear_error_message(context); 91 return 0; 92 } 93 94 lib = krb5_config_get_string(context, NULL, 95 "libdefaults", "ccapi_library", 96 NULL); 97 if (lib == NULL) { 98#ifdef __APPLE__ 99 lib = "/System/Library/Frameworks/Kerberos.framework/Kerberos"; 100#else 101 lib = "/usr/lib/libkrb5_cc.so"; 102#endif 103 } 104 105#ifdef HAVE_DLOPEN 106 107#ifndef RTLD_LAZY 108#define RTLD_LAZY 0 109#endif 110 111 cc_handle = dlopen(lib, RTLD_LAZY); 112 if (cc_handle == NULL) { 113 HEIMDAL_MUTEX_unlock(&acc_mutex); 114 krb5_set_error_message(context, KRB5_CC_NOSUPP, 115 N_("Failed to load API cache module %s", "file"), 116 lib); 117 return KRB5_CC_NOSUPP; 118 } 119 120 init_func = (cc_initialize_func)dlsym(cc_handle, "cc_initialize"); 121 HEIMDAL_MUTEX_unlock(&acc_mutex); 122 if (init_func == NULL) { 123 krb5_set_error_message(context, KRB5_CC_NOSUPP, 124 N_("Failed to find cc_initialize" 125 "in %s: %s", "file, error"), lib, dlerror()); 126 dlclose(cc_handle); 127 return KRB5_CC_NOSUPP; 128 } 129 130 return 0; 131#else 132 HEIMDAL_MUTEX_unlock(&acc_mutex); 133 krb5_set_error_message(context, KRB5_CC_NOSUPP, 134 N_("no support for shared object", "")); 135 return KRB5_CC_NOSUPP; 136#endif 137} 138 139static krb5_error_code 140make_cred_from_ccred(krb5_context context, 141 const cc_credentials_v5_t *incred, 142 krb5_creds *cred) 143{ 144 krb5_error_code ret; 145 unsigned int i; 146 147 memset(cred, 0, sizeof(*cred)); 148 149 ret = krb5_parse_name(context, incred->client, &cred->client); 150 if (ret) 151 goto fail; 152 153 ret = krb5_parse_name(context, incred->server, &cred->server); 154 if (ret) 155 goto fail; 156 157 cred->session.keytype = incred->keyblock.type; 158 cred->session.keyvalue.length = incred->keyblock.length; 159 cred->session.keyvalue.data = malloc(incred->keyblock.length); 160 if (cred->session.keyvalue.data == NULL) 161 goto nomem; 162 memcpy(cred->session.keyvalue.data, incred->keyblock.data, 163 incred->keyblock.length); 164 165 cred->times.authtime = incred->authtime; 166 cred->times.starttime = incred->starttime; 167 cred->times.endtime = incred->endtime; 168 cred->times.renew_till = incred->renew_till; 169 170 ret = krb5_data_copy(&cred->ticket, 171 incred->ticket.data, 172 incred->ticket.length); 173 if (ret) 174 goto nomem; 175 176 ret = krb5_data_copy(&cred->second_ticket, 177 incred->second_ticket.data, 178 incred->second_ticket.length); 179 if (ret) 180 goto nomem; 181 182 cred->authdata.val = NULL; 183 cred->authdata.len = 0; 184 185 cred->addresses.val = NULL; 186 cred->addresses.len = 0; 187 188 for (i = 0; incred->authdata && incred->authdata[i]; i++) 189 ; 190 191 if (i) { 192 cred->authdata.val = calloc(i, sizeof(cred->authdata.val[0])); 193 if (cred->authdata.val == NULL) 194 goto nomem; 195 cred->authdata.len = i; 196 for (i = 0; i < cred->authdata.len; i++) { 197 cred->authdata.val[i].ad_type = incred->authdata[i]->type; 198 ret = krb5_data_copy(&cred->authdata.val[i].ad_data, 199 incred->authdata[i]->data, 200 incred->authdata[i]->length); 201 if (ret) 202 goto nomem; 203 } 204 } 205 206 for (i = 0; incred->addresses && incred->addresses[i]; i++) 207 ; 208 209 if (i) { 210 cred->addresses.val = calloc(i, sizeof(cred->addresses.val[0])); 211 if (cred->addresses.val == NULL) 212 goto nomem; 213 cred->addresses.len = i; 214 215 for (i = 0; i < cred->addresses.len; i++) { 216 cred->addresses.val[i].addr_type = incred->addresses[i]->type; 217 ret = krb5_data_copy(&cred->addresses.val[i].address, 218 incred->addresses[i]->data, 219 incred->addresses[i]->length); 220 if (ret) 221 goto nomem; 222 } 223 } 224 225 cred->flags.i = 0; 226 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_FORWARDABLE) 227 cred->flags.b.forwardable = 1; 228 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_FORWARDED) 229 cred->flags.b.forwarded = 1; 230 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PROXIABLE) 231 cred->flags.b.proxiable = 1; 232 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PROXY) 233 cred->flags.b.proxy = 1; 234 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_MAY_POSTDATE) 235 cred->flags.b.may_postdate = 1; 236 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_POSTDATED) 237 cred->flags.b.postdated = 1; 238 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_INVALID) 239 cred->flags.b.invalid = 1; 240 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_RENEWABLE) 241 cred->flags.b.renewable = 1; 242 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_INITIAL) 243 cred->flags.b.initial = 1; 244 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PRE_AUTH) 245 cred->flags.b.pre_authent = 1; 246 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_HW_AUTH) 247 cred->flags.b.hw_authent = 1; 248 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_TRANSIT_POLICY_CHECKED) 249 cred->flags.b.transited_policy_checked = 1; 250 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_OK_AS_DELEGATE) 251 cred->flags.b.ok_as_delegate = 1; 252 if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_ANONYMOUS) 253 cred->flags.b.anonymous = 1; 254 255 return 0; 256 257nomem: 258 ret = ENOMEM; 259 krb5_set_error_message(context, ret, N_("malloc: out of memory", "malloc")); 260 261fail: 262 krb5_free_cred_contents(context, cred); 263 return ret; 264} 265 266static void 267free_ccred(cc_credentials_v5_t *cred) 268{ 269 int i; 270 271 if (cred->addresses) { 272 for (i = 0; cred->addresses[i] != 0; i++) { 273 if (cred->addresses[i]->data) 274 free(cred->addresses[i]->data); 275 free(cred->addresses[i]); 276 } 277 free(cred->addresses); 278 } 279 if (cred->server) 280 free(cred->server); 281 if (cred->client) 282 free(cred->client); 283 memset(cred, 0, sizeof(*cred)); 284} 285 286static krb5_error_code 287make_ccred_from_cred(krb5_context context, 288 const krb5_creds *incred, 289 cc_credentials_v5_t *cred) 290{ 291 krb5_error_code ret; 292 int i; 293 294 memset(cred, 0, sizeof(*cred)); 295 296 ret = krb5_unparse_name(context, incred->client, &cred->client); 297 if (ret) 298 goto fail; 299 300 ret = krb5_unparse_name(context, incred->server, &cred->server); 301 if (ret) 302 goto fail; 303 304 cred->keyblock.type = incred->session.keytype; 305 cred->keyblock.length = incred->session.keyvalue.length; 306 cred->keyblock.data = incred->session.keyvalue.data; 307 308 cred->authtime = incred->times.authtime; 309 cred->starttime = incred->times.starttime; 310 cred->endtime = incred->times.endtime; 311 cred->renew_till = incred->times.renew_till; 312 313 cred->ticket.length = incred->ticket.length; 314 cred->ticket.data = incred->ticket.data; 315 316 cred->second_ticket.length = incred->second_ticket.length; 317 cred->second_ticket.data = incred->second_ticket.data; 318 319 /* XXX this one should also be filled in */ 320 cred->authdata = NULL; 321 322 cred->addresses = calloc(incred->addresses.len + 1, 323 sizeof(cred->addresses[0])); 324 if (cred->addresses == NULL) { 325 326 ret = ENOMEM; 327 goto fail; 328 } 329 330 for (i = 0; i < incred->addresses.len; i++) { 331 cc_data *addr; 332 addr = malloc(sizeof(*addr)); 333 if (addr == NULL) { 334 ret = ENOMEM; 335 goto fail; 336 } 337 addr->type = incred->addresses.val[i].addr_type; 338 addr->length = incred->addresses.val[i].address.length; 339 addr->data = malloc(addr->length); 340 if (addr->data == NULL) { 341 free(addr); 342 ret = ENOMEM; 343 goto fail; 344 } 345 memcpy(addr->data, incred->addresses.val[i].address.data, 346 addr->length); 347 cred->addresses[i] = addr; 348 } 349 cred->addresses[i] = NULL; 350 351 cred->ticket_flags = 0; 352 if (incred->flags.b.forwardable) 353 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_FORWARDABLE; 354 if (incred->flags.b.forwarded) 355 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_FORWARDED; 356 if (incred->flags.b.proxiable) 357 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PROXIABLE; 358 if (incred->flags.b.proxy) 359 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PROXY; 360 if (incred->flags.b.may_postdate) 361 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_MAY_POSTDATE; 362 if (incred->flags.b.postdated) 363 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_POSTDATED; 364 if (incred->flags.b.invalid) 365 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_INVALID; 366 if (incred->flags.b.renewable) 367 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_RENEWABLE; 368 if (incred->flags.b.initial) 369 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_INITIAL; 370 if (incred->flags.b.pre_authent) 371 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PRE_AUTH; 372 if (incred->flags.b.hw_authent) 373 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_HW_AUTH; 374 if (incred->flags.b.transited_policy_checked) 375 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_TRANSIT_POLICY_CHECKED; 376 if (incred->flags.b.ok_as_delegate) 377 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_OK_AS_DELEGATE; 378 if (incred->flags.b.anonymous) 379 cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_ANONYMOUS; 380 381 return 0; 382 383fail: 384 free_ccred(cred); 385 386 krb5_clear_error_message(context); 387 return ret; 388} 389 390static cc_int32 391get_cc_name(krb5_acc *a) 392{ 393 cc_string_t name; 394 cc_int32 error; 395 396 error = (*a->ccache->func->get_name)(a->ccache, &name); 397 if (error) 398 return error; 399 400 a->cache_name = strdup(name->data); 401 (*name->func->release)(name); 402 if (a->cache_name == NULL) 403 return ccErrNoMem; 404 return ccNoError; 405} 406 407 408static const char* 409acc_get_name(krb5_context context, 410 krb5_ccache id) 411{ 412 krb5_acc *a = ACACHE(id); 413 int32_t error; 414 415 if (a->cache_name == NULL) { 416 krb5_error_code ret; 417 krb5_principal principal; 418 char *name; 419 420 ret = _krb5_get_default_principal_local(context, &principal); 421 if (ret) 422 return NULL; 423 424 ret = krb5_unparse_name(context, principal, &name); 425 krb5_free_principal(context, principal); 426 if (ret) 427 return NULL; 428 429 error = (*a->context->func->create_new_ccache)(a->context, 430 cc_credentials_v5, 431 name, 432 &a->ccache); 433 krb5_xfree(name); 434 if (error) 435 return NULL; 436 437 error = get_cc_name(a); 438 if (error) 439 return NULL; 440 } 441 442 return a->cache_name; 443} 444 445static krb5_error_code 446acc_alloc(krb5_context context, krb5_ccache *id) 447{ 448 krb5_error_code ret; 449 cc_int32 error; 450 krb5_acc *a; 451 452 ret = init_ccapi(context); 453 if (ret) 454 return ret; 455 456 ret = krb5_data_alloc(&(*id)->data, sizeof(*a)); 457 if (ret) { 458 krb5_clear_error_message(context); 459 return ret; 460 } 461 462 a = ACACHE(*id); 463 464 error = (*init_func)(&a->context, ccapi_version_3, NULL, NULL); 465 if (error) { 466 krb5_data_free(&(*id)->data); 467 return translate_cc_error(context, error); 468 } 469 470 a->cache_name = NULL; 471 472 return 0; 473} 474 475static krb5_error_code 476acc_resolve(krb5_context context, krb5_ccache *id, const char *res) 477{ 478 krb5_error_code ret; 479 cc_int32 error; 480 krb5_acc *a; 481 482 ret = acc_alloc(context, id); 483 if (ret) 484 return ret; 485 486 a = ACACHE(*id); 487 488 error = (*a->context->func->open_ccache)(a->context, res, &a->ccache); 489 if (error == ccNoError) { 490 cc_time_t offset; 491 error = get_cc_name(a); 492 if (error != ccNoError) { 493 acc_close(context, *id); 494 *id = NULL; 495 return translate_cc_error(context, error); 496 } 497 498 error = (*a->ccache->func->get_kdc_time_offset)(a->ccache, 499 cc_credentials_v5, 500 &offset); 501 if (error == 0) 502 context->kdc_sec_offset = offset; 503 504 } else if (error == ccErrCCacheNotFound) { 505 a->ccache = NULL; 506 a->cache_name = NULL; 507 } else { 508 *id = NULL; 509 return translate_cc_error(context, error); 510 } 511 512 return 0; 513} 514 515static krb5_error_code 516acc_gen_new(krb5_context context, krb5_ccache *id) 517{ 518 krb5_error_code ret; 519 krb5_acc *a; 520 521 ret = acc_alloc(context, id); 522 if (ret) 523 return ret; 524 525 a = ACACHE(*id); 526 527 a->ccache = NULL; 528 a->cache_name = NULL; 529 530 return 0; 531} 532 533static krb5_error_code 534acc_initialize(krb5_context context, 535 krb5_ccache id, 536 krb5_principal primary_principal) 537{ 538 krb5_acc *a = ACACHE(id); 539 krb5_error_code ret; 540 int32_t error; 541 char *name; 542 543 ret = krb5_unparse_name(context, primary_principal, &name); 544 if (ret) 545 return ret; 546 547 if (a->cache_name == NULL) { 548 error = (*a->context->func->create_new_ccache)(a->context, 549 cc_credentials_v5, 550 name, 551 &a->ccache); 552 free(name); 553 if (error == ccNoError) 554 error = get_cc_name(a); 555 } else { 556 cc_credentials_iterator_t iter; 557 cc_credentials_t ccred; 558 559 error = (*a->ccache->func->new_credentials_iterator)(a->ccache, &iter); 560 if (error) { 561 free(name); 562 return translate_cc_error(context, error); 563 } 564 565 while (1) { 566 error = (*iter->func->next)(iter, &ccred); 567 if (error) 568 break; 569 (*a->ccache->func->remove_credentials)(a->ccache, ccred); 570 (*ccred->func->release)(ccred); 571 } 572 (*iter->func->release)(iter); 573 574 error = (*a->ccache->func->set_principal)(a->ccache, 575 cc_credentials_v5, 576 name); 577 } 578 579 if (error == 0 && context->kdc_sec_offset) 580 error = (*a->ccache->func->set_kdc_time_offset)(a->ccache, 581 cc_credentials_v5, 582 context->kdc_sec_offset); 583 584 return translate_cc_error(context, error); 585} 586 587static krb5_error_code 588acc_close(krb5_context context, 589 krb5_ccache id) 590{ 591 krb5_acc *a = ACACHE(id); 592 593 if (a->ccache) { 594 (*a->ccache->func->release)(a->ccache); 595 a->ccache = NULL; 596 } 597 if (a->cache_name) { 598 free(a->cache_name); 599 a->cache_name = NULL; 600 } 601 if (a->context) { 602 (*a->context->func->release)(a->context); 603 a->context = NULL; 604 } 605 krb5_data_free(&id->data); 606 return 0; 607} 608 609static krb5_error_code 610acc_destroy(krb5_context context, 611 krb5_ccache id) 612{ 613 krb5_acc *a = ACACHE(id); 614 cc_int32 error = 0; 615 616 if (a->ccache) { 617 error = (*a->ccache->func->destroy)(a->ccache); 618 a->ccache = NULL; 619 } 620 if (a->context) { 621 error = (a->context->func->release)(a->context); 622 a->context = NULL; 623 } 624 return translate_cc_error(context, error); 625} 626 627static krb5_error_code 628acc_store_cred(krb5_context context, 629 krb5_ccache id, 630 krb5_creds *creds) 631{ 632 krb5_acc *a = ACACHE(id); 633 cc_credentials_union cred; 634 cc_credentials_v5_t v5cred; 635 krb5_error_code ret; 636 cc_int32 error; 637 638 if (a->ccache == NULL) { 639 krb5_set_error_message(context, KRB5_CC_NOTFOUND, 640 N_("No API credential found", "")); 641 return KRB5_CC_NOTFOUND; 642 } 643 644 cred.version = cc_credentials_v5; 645 cred.credentials.credentials_v5 = &v5cred; 646 647 ret = make_ccred_from_cred(context, 648 creds, 649 &v5cred); 650 if (ret) 651 return ret; 652 653 error = (*a->ccache->func->store_credentials)(a->ccache, &cred); 654 if (error) 655 ret = translate_cc_error(context, error); 656 657 free_ccred(&v5cred); 658 659 return ret; 660} 661 662static krb5_error_code 663acc_get_principal(krb5_context context, 664 krb5_ccache id, 665 krb5_principal *principal) 666{ 667 krb5_acc *a = ACACHE(id); 668 krb5_error_code ret; 669 int32_t error; 670 cc_string_t name; 671 672 if (a->ccache == NULL) { 673 krb5_set_error_message(context, KRB5_CC_NOTFOUND, 674 N_("No API credential found", "")); 675 return KRB5_CC_NOTFOUND; 676 } 677 678 error = (*a->ccache->func->get_principal)(a->ccache, 679 cc_credentials_v5, 680 &name); 681 if (error) 682 return translate_cc_error(context, error); 683 684 ret = krb5_parse_name(context, name->data, principal); 685 686 (*name->func->release)(name); 687 return ret; 688} 689 690static krb5_error_code 691acc_get_first (krb5_context context, 692 krb5_ccache id, 693 krb5_cc_cursor *cursor) 694{ 695 cc_credentials_iterator_t iter; 696 krb5_acc *a = ACACHE(id); 697 int32_t error; 698 699 if (a->ccache == NULL) { 700 krb5_set_error_message(context, KRB5_CC_NOTFOUND, 701 N_("No API credential found", "")); 702 return KRB5_CC_NOTFOUND; 703 } 704 705 error = (*a->ccache->func->new_credentials_iterator)(a->ccache, &iter); 706 if (error) { 707 krb5_clear_error_message(context); 708 return ENOENT; 709 } 710 *cursor = iter; 711 return 0; 712} 713 714 715static krb5_error_code 716acc_get_next (krb5_context context, 717 krb5_ccache id, 718 krb5_cc_cursor *cursor, 719 krb5_creds *creds) 720{ 721 cc_credentials_iterator_t iter = *cursor; 722 cc_credentials_t cred; 723 krb5_error_code ret; 724 int32_t error; 725 726 while (1) { 727 error = (*iter->func->next)(iter, &cred); 728 if (error) 729 return translate_cc_error(context, error); 730 if (cred->data->version == cc_credentials_v5) 731 break; 732 (*cred->func->release)(cred); 733 } 734 735 ret = make_cred_from_ccred(context, 736 cred->data->credentials.credentials_v5, 737 creds); 738 (*cred->func->release)(cred); 739 return ret; 740} 741 742static krb5_error_code 743acc_end_get (krb5_context context, 744 krb5_ccache id, 745 krb5_cc_cursor *cursor) 746{ 747 cc_credentials_iterator_t iter = *cursor; 748 (*iter->func->release)(iter); 749 return 0; 750} 751 752static krb5_error_code 753acc_remove_cred(krb5_context context, 754 krb5_ccache id, 755 krb5_flags which, 756 krb5_creds *cred) 757{ 758 cc_credentials_iterator_t iter; 759 krb5_acc *a = ACACHE(id); 760 cc_credentials_t ccred; 761 krb5_error_code ret; 762 cc_int32 error; 763 char *client, *server; 764 765 if (a->ccache == NULL) { 766 krb5_set_error_message(context, KRB5_CC_NOTFOUND, 767 N_("No API credential found", "")); 768 return KRB5_CC_NOTFOUND; 769 } 770 771 if (cred->client) { 772 ret = krb5_unparse_name(context, cred->client, &client); 773 if (ret) 774 return ret; 775 } else 776 client = NULL; 777 778 ret = krb5_unparse_name(context, cred->server, &server); 779 if (ret) { 780 free(client); 781 return ret; 782 } 783 784 error = (*a->ccache->func->new_credentials_iterator)(a->ccache, &iter); 785 if (error) { 786 free(server); 787 free(client); 788 return translate_cc_error(context, error); 789 } 790 791 ret = KRB5_CC_NOTFOUND; 792 while (1) { 793 cc_credentials_v5_t *v5cred; 794 795 error = (*iter->func->next)(iter, &ccred); 796 if (error) 797 break; 798 799 if (ccred->data->version != cc_credentials_v5) 800 goto next; 801 802 v5cred = ccred->data->credentials.credentials_v5; 803 804 if (client && strcmp(v5cred->client, client) != 0) 805 goto next; 806 807 if (strcmp(v5cred->server, server) != 0) 808 goto next; 809 810 (*a->ccache->func->remove_credentials)(a->ccache, ccred); 811 ret = 0; 812 next: 813 (*ccred->func->release)(ccred); 814 } 815 816 (*iter->func->release)(iter); 817 818 if (ret) 819 krb5_set_error_message(context, ret, 820 N_("Can't find credential %s in cache", 821 "principal"), server); 822 free(server); 823 free(client); 824 825 return ret; 826} 827 828static krb5_error_code 829acc_set_flags(krb5_context context, 830 krb5_ccache id, 831 krb5_flags flags) 832{ 833 return 0; 834} 835 836static int 837acc_get_version(krb5_context context, 838 krb5_ccache id) 839{ 840 return 0; 841} 842 843struct cache_iter { 844 cc_context_t context; 845 cc_ccache_iterator_t iter; 846}; 847 848static krb5_error_code 849acc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor) 850{ 851 struct cache_iter *iter; 852 krb5_error_code ret; 853 cc_int32 error; 854 855 ret = init_ccapi(context); 856 if (ret) 857 return ret; 858 859 iter = calloc(1, sizeof(*iter)); 860 if (iter == NULL) { 861 krb5_set_error_message(context, ENOMEM, "malloc: out of memory"); 862 return ENOMEM; 863 } 864 865 error = (*init_func)(&iter->context, ccapi_version_3, NULL, NULL); 866 if (error) { 867 free(iter); 868 return translate_cc_error(context, error); 869 } 870 871 error = (*iter->context->func->new_ccache_iterator)(iter->context, 872 &iter->iter); 873 if (error) { 874 free(iter); 875 krb5_clear_error_message(context); 876 return ENOENT; 877 } 878 *cursor = iter; 879 return 0; 880} 881 882static krb5_error_code 883acc_get_cache_next(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id) 884{ 885 struct cache_iter *iter = cursor; 886 cc_ccache_t cache; 887 krb5_acc *a; 888 krb5_error_code ret; 889 int32_t error; 890 891 error = (*iter->iter->func->next)(iter->iter, &cache); 892 if (error) 893 return translate_cc_error(context, error); 894 895 ret = _krb5_cc_allocate(context, &krb5_acc_ops, id); 896 if (ret) { 897 (*cache->func->release)(cache); 898 return ret; 899 } 900 901 ret = acc_alloc(context, id); 902 if (ret) { 903 (*cache->func->release)(cache); 904 free(*id); 905 return ret; 906 } 907 908 a = ACACHE(*id); 909 a->ccache = cache; 910 911 error = get_cc_name(a); 912 if (error) { 913 acc_close(context, *id); 914 *id = NULL; 915 return translate_cc_error(context, error); 916 } 917 return 0; 918} 919 920static krb5_error_code 921acc_end_cache_get(krb5_context context, krb5_cc_cursor cursor) 922{ 923 struct cache_iter *iter = cursor; 924 925 (*iter->iter->func->release)(iter->iter); 926 iter->iter = NULL; 927 (*iter->context->func->release)(iter->context); 928 iter->context = NULL; 929 free(iter); 930 return 0; 931} 932 933static krb5_error_code 934acc_move(krb5_context context, krb5_ccache from, krb5_ccache to) 935{ 936 krb5_acc *afrom = ACACHE(from); 937 krb5_acc *ato = ACACHE(to); 938 int32_t error; 939 940 if (ato->ccache == NULL) { 941 cc_string_t name; 942 943 error = (*afrom->ccache->func->get_principal)(afrom->ccache, 944 cc_credentials_v5, 945 &name); 946 if (error) 947 return translate_cc_error(context, error); 948 949 error = (*ato->context->func->create_new_ccache)(ato->context, 950 cc_credentials_v5, 951 name->data, 952 &ato->ccache); 953 (*name->func->release)(name); 954 if (error) 955 return translate_cc_error(context, error); 956 } 957 958 error = (*ato->ccache->func->move)(afrom->ccache, ato->ccache); 959 960 acc_destroy(context, from); 961 962 return translate_cc_error(context, error); 963} 964 965static krb5_error_code 966acc_get_default_name(krb5_context context, char **str) 967{ 968 krb5_error_code ret; 969 cc_context_t cc; 970 cc_string_t name; 971 int32_t error; 972 973 ret = init_ccapi(context); 974 if (ret) 975 return ret; 976 977 error = (*init_func)(&cc, ccapi_version_3, NULL, NULL); 978 if (error) 979 return translate_cc_error(context, error); 980 981 error = (*cc->func->get_default_ccache_name)(cc, &name); 982 if (error) { 983 (*cc->func->release)(cc); 984 return translate_cc_error(context, error); 985 } 986 987 asprintf(str, "API:%s", name->data); 988 (*name->func->release)(name); 989 (*cc->func->release)(cc); 990 991 if (*str == NULL) { 992 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", "")); 993 return ENOMEM; 994 } 995 return 0; 996} 997 998static krb5_error_code 999acc_set_default(krb5_context context, krb5_ccache id) 1000{ 1001 krb5_acc *a = ACACHE(id); 1002 cc_int32 error; 1003 1004 if (a->ccache == NULL) { 1005 krb5_set_error_message(context, KRB5_CC_NOTFOUND, 1006 N_("No API credential found", "")); 1007 return KRB5_CC_NOTFOUND; 1008 } 1009 1010 error = (*a->ccache->func->set_default)(a->ccache); 1011 if (error) 1012 return translate_cc_error(context, error); 1013 1014 return 0; 1015} 1016 1017static krb5_error_code 1018acc_lastchange(krb5_context context, krb5_ccache id, krb5_timestamp *mtime) 1019{ 1020 krb5_acc *a = ACACHE(id); 1021 cc_int32 error; 1022 cc_time_t t; 1023 1024 if (a->ccache == NULL) { 1025 krb5_set_error_message(context, KRB5_CC_NOTFOUND, 1026 N_("No API credential found", "")); 1027 return KRB5_CC_NOTFOUND; 1028 } 1029 1030 error = (*a->ccache->func->get_change_time)(a->ccache, &t); 1031 if (error) 1032 return translate_cc_error(context, error); 1033 1034 *mtime = t; 1035 1036 return 0; 1037} 1038 1039/** 1040 * Variable containing the API based credential cache implemention. 1041 * 1042 * @ingroup krb5_ccache 1043 */ 1044 1045KRB5_LIB_VARIABLE const krb5_cc_ops krb5_acc_ops = { 1046 KRB5_CC_OPS_VERSION, 1047 "API", 1048 acc_get_name, 1049 acc_resolve, 1050 acc_gen_new, 1051 acc_initialize, 1052 acc_destroy, 1053 acc_close, 1054 acc_store_cred, 1055 NULL, /* acc_retrieve */ 1056 acc_get_principal, 1057 acc_get_first, 1058 acc_get_next, 1059 acc_end_get, 1060 acc_remove_cred, 1061 acc_set_flags, 1062 acc_get_version, 1063 acc_get_cache_first, 1064 acc_get_cache_next, 1065 acc_end_cache_get, 1066 acc_move, 1067 acc_get_default_name, 1068 acc_set_default, 1069 acc_lastchange 1070}; 1071