1/*
2 * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35#include <vis.h>
36
37struct krb5_rcache_data {
38    char *name;
39};
40
41KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
42krb5_rc_resolve(krb5_context context,
43		krb5_rcache id,
44		const char *name)
45{
46    id->name = strdup(name);
47    if(id->name == NULL) {
48	krb5_set_error_message(context, KRB5_RC_MALLOC,
49			       N_("malloc: out of memory", ""));
50	return KRB5_RC_MALLOC;
51    }
52    return 0;
53}
54
55KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
56krb5_rc_resolve_type(krb5_context context,
57		     krb5_rcache *id,
58		     const char *type)
59{
60    *id = NULL;
61    if(strcmp(type, "FILE")) {
62	krb5_set_error_message (context, KRB5_RC_TYPE_NOTFOUND,
63				N_("replay cache type %s not supported", ""),
64				type);
65	return KRB5_RC_TYPE_NOTFOUND;
66    }
67    *id = calloc(1, sizeof(**id));
68    if(*id == NULL) {
69	krb5_set_error_message(context, KRB5_RC_MALLOC,
70			       N_("malloc: out of memory", ""));
71	return KRB5_RC_MALLOC;
72    }
73    return 0;
74}
75
76KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
77krb5_rc_resolve_full(krb5_context context,
78		     krb5_rcache *id,
79		     const char *string_name)
80{
81    krb5_error_code ret;
82
83    *id = NULL;
84
85    if(strncmp(string_name, "FILE:", 5)) {
86	krb5_set_error_message(context, KRB5_RC_TYPE_NOTFOUND,
87			       N_("replay cache type %s not supported", ""),
88			       string_name);
89	return KRB5_RC_TYPE_NOTFOUND;
90    }
91    ret = krb5_rc_resolve_type(context, id, "FILE");
92    if(ret)
93	return ret;
94    ret = krb5_rc_resolve(context, *id, string_name + 5);
95    if (ret) {
96	krb5_rc_close(context, *id);
97	*id = NULL;
98    }
99    return ret;
100}
101
102KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
103krb5_rc_default_name(krb5_context context)
104{
105    return "FILE:/var/run/default_rcache";
106}
107
108KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
109krb5_rc_default_type(krb5_context context)
110{
111    return "FILE";
112}
113
114KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
115krb5_rc_default(krb5_context context,
116		krb5_rcache *id)
117{
118    return krb5_rc_resolve_full(context, id, krb5_rc_default_name(context));
119}
120
121struct rc_entry{
122    time_t stamp;
123    unsigned char data[16];
124};
125
126KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
127krb5_rc_initialize(krb5_context context,
128		   krb5_rcache id,
129		   krb5_deltat auth_lifespan)
130{
131    FILE *f = fopen(id->name, "w");
132    struct rc_entry tmp;
133    int ret;
134
135    if(f == NULL) {
136	char buf[128];
137	ret = errno;
138	rk_strerror_r(ret, buf, sizeof(buf));
139	krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf);
140	return ret;
141    }
142    tmp.stamp = auth_lifespan;
143    fwrite(&tmp, 1, sizeof(tmp), f);
144    fclose(f);
145    return 0;
146}
147
148KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
149krb5_rc_recover(krb5_context context,
150		krb5_rcache id)
151{
152    return 0;
153}
154
155KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
156krb5_rc_destroy(krb5_context context,
157		krb5_rcache id)
158{
159    int ret;
160
161    if(remove(id->name) < 0) {
162	char buf[128];
163	ret = errno;
164	rk_strerror_r(ret, buf, sizeof(buf));
165	krb5_set_error_message(context, ret, "remove(%s): %s", id->name, buf);
166	return ret;
167    }
168    return krb5_rc_close(context, id);
169}
170
171KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
172krb5_rc_close(krb5_context context,
173	      krb5_rcache id)
174{
175    free(id->name);
176    free(id);
177    return 0;
178}
179
180static void
181checksum_authenticator(Authenticator *auth, void *data)
182{
183    CCDigestRef m = CCDigestCreate(kCCDigestMD5);
184    unsigned i;
185
186    CCDigestUpdate(m, auth->crealm, strlen(auth->crealm));
187    for(i = 0; i < auth->cname.name_string.len; i++)
188	CCDigestUpdate(m, auth->cname.name_string.val[i],
189		       strlen(auth->cname.name_string.val[i]));
190    CCDigestUpdate(m, &auth->ctime, sizeof(auth->ctime));
191    CCDigestUpdate(m, &auth->cusec, sizeof(auth->cusec));
192
193    CCDigestFinal(m, data);
194    CCDigestDestroy(m);
195}
196
197KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
198krb5_rc_store(krb5_context context,
199	      krb5_rcache id,
200	      krb5_donot_replay *rep)
201{
202    struct rc_entry ent, tmp;
203    time_t t;
204    FILE *f;
205    int ret;
206
207    ent.stamp = time(NULL);
208    checksum_authenticator(rep, ent.data);
209    f = fopen(id->name, "r");
210    if(f == NULL) {
211	char buf[128];
212	ret = errno;
213	rk_strerror_r(ret, buf, sizeof(buf));
214	krb5_set_error_message(context, ret, "open(%s): %s", id->name, buf);
215	return ret;
216    }
217    rk_cloexec_file(f);
218    fread(&tmp, sizeof(ent), 1, f);
219    t = ent.stamp - tmp.stamp;
220    while(fread(&tmp, sizeof(ent), 1, f)){
221	if(tmp.stamp < t)
222	    continue;
223	if(memcmp(tmp.data, ent.data, sizeof(ent.data)) == 0){
224	    fclose(f);
225	    krb5_clear_error_message (context);
226	    return KRB5_RC_REPLAY;
227	}
228    }
229    if(ferror(f)){
230	char buf[128];
231	ret = errno;
232	fclose(f);
233	rk_strerror_r(ret, buf, sizeof(buf));
234	krb5_set_error_message(context, ret, "%s: %s",
235			       id->name, buf);
236	return ret;
237    }
238    fclose(f);
239    f = fopen(id->name, "a");
240    if(f == NULL) {
241	char buf[128];
242	rk_strerror_r(errno, buf, sizeof(buf));
243	krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN,
244			       "open(%s): %s", id->name, buf);
245	return KRB5_RC_IO_UNKNOWN;
246    }
247    fwrite(&ent, 1, sizeof(ent), f);
248    fclose(f);
249    return 0;
250}
251
252KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
253krb5_rc_expunge(krb5_context context,
254		krb5_rcache id)
255{
256    return 0;
257}
258
259KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
260krb5_rc_get_lifespan(krb5_context context,
261		     krb5_rcache id,
262		     krb5_deltat *auth_lifespan)
263{
264    FILE *f = fopen(id->name, "r");
265    size_t r;
266    struct rc_entry ent;
267    r = fread(&ent, sizeof(ent), 1, f);
268    fclose(f);
269    if(r){
270	*auth_lifespan = ent.stamp;
271	return 0;
272    }
273    krb5_clear_error_message (context);
274    return KRB5_RC_IO_UNKNOWN;
275}
276
277KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
278krb5_rc_get_name(krb5_context context,
279		 krb5_rcache id)
280{
281    return id->name;
282}
283
284KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
285krb5_rc_get_type(krb5_context context,
286		 krb5_rcache id)
287{
288    return "FILE";
289}
290
291KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
292krb5_get_server_rcache(krb5_context context,
293		       const krb5_data *piece,
294		       krb5_rcache *id)
295{
296    krb5_rcache rcache;
297    krb5_error_code ret;
298
299    char *tmp = malloc(4 * piece->length + 1);
300    char *name;
301
302    if(tmp == NULL) {
303	krb5_set_error_message(context, ENOMEM,
304			       N_("malloc: out of memory", ""));
305	return ENOMEM;
306    }
307    strvisx(tmp, piece->data, piece->length, VIS_WHITE | VIS_OCTAL);
308#ifdef HAVE_GETEUID
309    ret = asprintf(&name, "FILE:rc_%s_%u", tmp, (unsigned)geteuid());
310#else
311    ret = asprintf(&name, "FILE:rc_%s", tmp);
312#endif
313    free(tmp);
314    if(ret < 0 || name == NULL) {
315	krb5_set_error_message(context, ENOMEM,
316			       N_("malloc: out of memory", ""));
317	return ENOMEM;
318    }
319
320    ret = krb5_rc_resolve_full(context, &rcache, name);
321    free(name);
322    if(ret)
323	return ret;
324    *id = rcache;
325    return ret;
326}
327