crypto/external/bsd/heimdal/dist/lib/hdb/hdb.c

   1 /*      $NetBSD: hdb.c,v 1.3 2014/04/24 13:45:34 pettai Exp $   */
   2
   3 /*
   4  * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
   5  * (Royal Institute of Technology, Stockholm, Sweden).
   6  * All rights reserved.
   7  *
   8  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  *
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  *
  21  * 3. Neither the name of the Institute nor the names of its contributors
  22  *    may be used to endorse or promote products derived from this software
  23  *    without specific prior written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  35  * SUCH DAMAGE.
  36  */
  37
  38 #include "krb5_locl.h"
  39 #include "hdb_locl.h"
  40
  41 #ifdef HAVE_DLFCN_H
  42 #include <dlfcn.h>
  43 #endif
  44
  45 /*! @mainpage Heimdal database backend library
  46  *
  47  * @section intro Introduction
  48  *
  49  * Heimdal libhdb library provides the backend support for Heimdal kdc
  50  * and kadmind. Its here where plugins for diffrent database engines
  51  * can be pluged in and extend support for here Heimdal get the
  52  * principal and policy data from.
  53  *
  54  * Example of Heimdal backend are:
  55  * - Berkeley DB 1.85
  56  * - Berkeley DB 3.0
  57  * - Berkeley DB 4.0
  58  * - New Berkeley DB
  59  * - LDAP
  60  *
  61  *
  62  * The project web page: http://www.h5l.org/
  63  *
  64  */
  65
  66 const int hdb_interface_version = HDB_INTERFACE_VERSION;
  67
  68 static struct hdb_method methods[] = {
  69 #if HAVE_DB1 || HAVE_DB3
  70     { HDB_INTERFACE_VERSION, "db:",     hdb_db_create},
  71 #endif
  72 #if HAVE_DB1
  73     { HDB_INTERFACE_VERSION, "mit-db:", hdb_mdb_create},
  74 #endif
  75 #if HAVE_NDBM
  76     { HDB_INTERFACE_VERSION, "ndbm:",   hdb_ndbm_create},
  77 #endif
  78     { HDB_INTERFACE_VERSION, "keytab:", hdb_keytab_create},
  79 #if defined(OPENLDAP) && !defined(OPENLDAP_MODULE)
  80     { HDB_INTERFACE_VERSION, "ldap:",   hdb_ldap_create},
  81     { HDB_INTERFACE_VERSION, "ldapi:",  hdb_ldapi_create},
  82 #endif
  83 #ifdef HAVE_SQLITE3
  84     { HDB_INTERFACE_VERSION, "sqlite:", hdb_sqlite_create},
  85 #endif
  86     {0, NULL,   NULL}
  87 };
  88
  89 #if HAVE_DB1 || HAVE_DB3
  90 static struct hdb_method dbmetod =
  91     { HDB_INTERFACE_VERSION, "", hdb_db_create };
  92 #elif defined(HAVE_NDBM)
  93 static struct hdb_method dbmetod =
  94     { HDB_INTERFACE_VERSION, "", hdb_ndbm_create };
  95 #endif
  96
  97
  98 krb5_error_code
  99 hdb_next_enctype2key(krb5_context context,
 100                      const hdb_entry *e,
 101                      krb5_enctype enctype,
 102                      Key **key)
 103 {
 104     Key *k;
 105
 106     for (k = *key ? (*key) + 1 : e->keys.val;
 107          k < e->keys.val + e->keys.len;
 108          k++)
 109     {
 110         if(k->key.keytype == enctype){
 111             *key = k;
 112             return 0;
 113         }
 114     }
 115     krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
 116                            "No next enctype %d for hdb-entry",
 117                           (int)enctype);
 118     return KRB5_PROG_ETYPE_NOSUPP; /* XXX */
 119 }
 120
 121 krb5_error_code
 122 hdb_enctype2key(krb5_context context,
 123                 hdb_entry *e,
 124                 krb5_enctype enctype,
 125                 Key **key)
 126 {
 127     *key = NULL;
 128     return hdb_next_enctype2key(context, e, enctype, key);
 129 }
 130
 131 void
 132 hdb_free_key(Key *key)
 133 {
 134     memset(key->key.keyvalue.data,
 135            0,
 136            key->key.keyvalue.length);
 137     free_Key(key);
 138     free(key);
 139 }
 140
 141
 142 krb5_error_code
 143 hdb_lock(int fd, int operation)
 144 {
 145     int i, code = 0;
 146
 147     for(i = 0; i < 3; i++){
 148         code = flock(fd, (operation == HDB_RLOCK ? LOCK_SH : LOCK_EX) | LOCK_NB);
 149         if(code == 0 || errno != EWOULDBLOCK)
 150             break;
 151         sleep(1);
 152     }
 153     if(code == 0)
 154         return 0;
 155     if(errno == EWOULDBLOCK)
 156         return HDB_ERR_DB_INUSE;
 157     return HDB_ERR_CANT_LOCK_DB;
 158 }
 159
 160 krb5_error_code
 161 hdb_unlock(int fd)
 162 {
 163     int code;
 164     code = flock(fd, LOCK_UN);
 165     if(code)
 166         return 4711 /* XXX */;
 167     return 0;
 168 }
 169
 170 void
 171 hdb_free_entry(krb5_context context, hdb_entry_ex *ent)
 172 {
 173     size_t i;
 174
 175     if (ent->free_entry)
 176         (*ent->free_entry)(context, ent);
 177
 178     for(i = 0; i < ent->entry.keys.len; ++i) {
 179         Key *k = &ent->entry.keys.val[i];
 180
 181         memset (k->key.keyvalue.data, 0, k->key.keyvalue.length);
 182     }
 183     free_hdb_entry(&ent->entry);
 184 }
 185
 186 krb5_error_code
 187 hdb_foreach(krb5_context context,
 188             HDB *db,
 189             unsigned flags,
 190             hdb_foreach_func_t func,
 191             void *data)
 192 {
 193     krb5_error_code ret;
 194     hdb_entry_ex entry;
 195     ret = db->hdb_firstkey(context, db, flags, &entry);
 196     if (ret == 0)
 197         krb5_clear_error_message(context);
 198     while(ret == 0){
 199         ret = (*func)(context, db, &entry, data);
 200         hdb_free_entry(context, &entry);
 201         if(ret == 0)
 202             ret = db->hdb_nextkey(context, db, flags, &entry);
 203     }
 204     if(ret == HDB_ERR_NOENTRY)
 205         ret = 0;
 206     return ret;
 207 }
 208
 209 krb5_error_code
 210 hdb_check_db_format(krb5_context context, HDB *db)
 211 {
 212     krb5_data tag;
 213     krb5_data version;
 214     krb5_error_code ret, ret2;
 215     unsigned ver;
 216     int foo;
 217
 218     ret = db->hdb_lock(context, db, HDB_RLOCK);
 219     if (ret)
 220         return ret;
 221
 222     tag.data = (void *)(intptr_t)HDB_DB_FORMAT_ENTRY;
 223     tag.length = strlen(tag.data);
 224     ret = (*db->hdb__get)(context, db, tag, &version);
 225     ret2 = db->hdb_unlock(context, db);
 226     if(ret)
 227         return ret;
 228     if (ret2)
 229         return ret2;
 230     foo = sscanf(version.data, "%u", &ver);
 231     krb5_data_free (&version);
 232     if (foo != 1)
 233         return HDB_ERR_BADVERSION;
 234     if(ver != HDB_DB_FORMAT)
 235         return HDB_ERR_BADVERSION;
 236     return 0;
 237 }
 238
 239 krb5_error_code
 240 hdb_init_db(krb5_context context, HDB *db)
 241 {
 242     krb5_error_code ret, ret2;
 243     krb5_data tag;
 244     krb5_data version;
 245     char ver[32];
 246
 247     ret = hdb_check_db_format(context, db);
 248     if(ret != HDB_ERR_NOENTRY)
 249         return ret;
 250
 251     ret = db->hdb_lock(context, db, HDB_WLOCK);
 252     if (ret)
 253         return ret;
 254
 255     tag.data = (void *)(intptr_t)HDB_DB_FORMAT_ENTRY;
 256     tag.length = strlen(tag.data);
 257     snprintf(ver, sizeof(ver), "%u", HDB_DB_FORMAT);
 258     version.data = ver;
 259     version.length = strlen(version.data) + 1; /* zero terminated */
 260     ret = (*db->hdb__put)(context, db, 0, tag, version);
 261     ret2 = db->hdb_unlock(context, db);
 262     if (ret) {
 263         if (ret2)
 264             krb5_clear_error_message(context);
 265         return ret;
 266     }
 267     return ret2;
 268 }
 269
 270 #ifdef HAVE_DLOPEN
 271
 272  /*
 273  * Load a dynamic backend from /usr/heimdal/lib/hdb_NAME.so,
 274  * looking for the hdb_NAME_create symbol.
 275  */
 276
 277 static const struct hdb_method *
 278 find_dynamic_method (krb5_context context,
 279                      const char *filename,
 280                      const char **rest)
 281 {
 282     static struct hdb_method method;
 283     struct hdb_so_method *mso;
 284     char *prefix, *path, *symbol;
 285     const char *p;
 286     void *dl;
 287     size_t len;
 288
 289     p = strchr(filename, ':');
 290
 291     /* if no prefix, don't know what module to load, just ignore it */
 292     if (p == NULL)
 293         return NULL;
 294
 295     len = p - filename;
 296     *rest = filename + len + 1;
 297
 298     prefix = malloc(len + 1);
 299     if (prefix == NULL)
 300         krb5_errx(context, 1, "out of memory");
 301     strlcpy(prefix, filename, len + 1);
 302
 303     if (asprintf(&path, LIBDIR "/hdb_%s.so", prefix) == -1)
 304         krb5_errx(context, 1, "out of memory");
 305
 306 #ifndef RTLD_NOW
 307 #define RTLD_NOW 0
 308 #endif
 309 #ifndef RTLD_GLOBAL
 310 #define RTLD_GLOBAL 0
 311 #endif
 312
 313     dl = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
 314     if (dl == NULL) {
 315         krb5_warnx(context, "error trying to load dynamic module %s: %s\n",
 316                    path, dlerror());
 317         free(prefix);
 318         free(path);
 319         return NULL;
 320     }
 321
 322     if (asprintf(&symbol, "hdb_%s_interface", prefix) == -1)
 323         krb5_errx(context, 1, "out of memory");
 324
 325     mso = (struct hdb_so_method *) dlsym(dl, symbol);
 326     if (mso == NULL) {
 327         krb5_warnx(context, "error finding symbol %s in %s: %s\n",
 328                    symbol, path, dlerror());
 329         dlclose(dl);
 330         free(symbol);
 331         free(prefix);
 332         free(path);
 333         return NULL;
 334     }
 335     free(path);
 336     free(symbol);
 337
 338     if (mso->version != HDB_INTERFACE_VERSION) {
 339         krb5_warnx(context,
 340                    "error wrong version in shared module %s "
 341                    "version: %d should have been %d\n",
 342                    prefix, mso->version, HDB_INTERFACE_VERSION);
 343         dlclose(dl);
 344         free(prefix);
 345         return NULL;
 346     }
 347
 348     if (mso->create == NULL) {
 349         krb5_errx(context, 1,
 350                   "no entry point function in shared mod %s ",
 351                    prefix);
 352         dlclose(dl);
 353         free(prefix);
 354         return NULL;
 355     }
 356
 357     method.create = mso->create;
 358     method.prefix = prefix;
 359
 360     return &method;
 361 }
 362 #endif /* HAVE_DLOPEN */
 363
 364 /*
 365  * find the relevant method for `filename', returning a pointer to the
 366  * rest in `rest'.
 367  * return NULL if there's no such method.
 368  */
 369
 370 static const struct hdb_method *
 371 find_method (const char *filename, const char **rest)
 372 {
 373     const struct hdb_method *h;
 374
 375     for (h = methods; h->prefix != NULL; ++h) {
 376         if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0) {
 377             *rest = filename + strlen(h->prefix);
 378             return h;
 379         }
 380     }
 381 #if defined(HAVE_DB1) || defined(HAVE_DB3) || defined(HAVE_NDBM)
 382     if (strncmp(filename, "/", 1) == 0
 383         || strncmp(filename, "./", 2) == 0
 384         || strncmp(filename, "../", 3) == 0)
 385     {
 386         *rest = filename;
 387         return &dbmetod;
 388     }
 389 #endif
 390
 391     return NULL;
 392 }
 393
 394 krb5_error_code
 395 hdb_list_builtin(krb5_context context, char **list)
 396 {
 397     const struct hdb_method *h;
 398     size_t len = 0;
 399     char *buf = NULL;
 400
 401     for (h = methods; h->prefix != NULL; ++h) {
 402         if (h->prefix[0] == '\0')
 403             continue;
 404         len += strlen(h->prefix) + 2;
 405     }
 406
 407     len += 1;
 408     buf = malloc(len);
 409     if (buf == NULL) {
 410         krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
 411         return ENOMEM;
 412     }
 413     buf[0] = '\0';
 414
 415     for (h = methods; h->prefix != NULL; ++h) {
 416         if (h != methods)
 417             strlcat(buf, ", ", len);
 418         strlcat(buf, h->prefix, len);
 419     }
 420     *list = buf;
 421     return 0;
 422 }
 423
 424 krb5_error_code
 425 _hdb_keytab2hdb_entry(krb5_context context,
 426                       const krb5_keytab_entry *ktentry,
 427                       hdb_entry_ex *entry)
 428 {
 429     entry->entry.kvno = ktentry->vno;
 430     entry->entry.created_by.time = ktentry->timestamp;
 431
 432     entry->entry.keys.val = calloc(1, sizeof(entry->entry.keys.val[0]));
 433     if (entry->entry.keys.val == NULL)
 434         return ENOMEM;
 435     entry->entry.keys.len = 1;
 436
 437     entry->entry.keys.val[0].mkvno = NULL;
 438     entry->entry.keys.val[0].salt = NULL;
 439
 440     return krb5_copy_keyblock_contents(context,
 441                                        &ktentry->keyblock,
 442                                        &entry->entry.keys.val[0].key);
 443 }
 444
 445 /**
 446  * Create a handle for a Kerberos database
 447  *
 448  * Create a handle for a Kerberos database backend specified by a
 449  * filename.  Doesn't create a file if its doesn't exists, you have to
 450  * use O_CREAT to tell the backend to create the file.
 451  */
 452
 453 krb5_error_code
 454 hdb_create(krb5_context context, HDB **db, const char *filename)
 455 {
 456     const struct hdb_method *h;
 457     const char *residual;
 458     krb5_error_code ret;
 459     struct krb5_plugin *list = NULL, *e;
 460
 461     if(filename == NULL)
 462         filename = HDB_DEFAULT_DB;
 463     krb5_add_et_list(context, initialize_hdb_error_table_r);
 464     h = find_method (filename, &residual);
 465
 466     if (h == NULL) {
 467             ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, "hdb", &list);
 468             if(ret == 0 && list != NULL) {
 469                     for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
 470                             h = _krb5_plugin_get_symbol(e);
 471                             if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0
 472                                 && h->interface_version == HDB_INTERFACE_VERSION) {
 473                                     residual = filename + strlen(h->prefix);
 474                                     break;
 475                             }
 476                     }
 477                     if (e == NULL) {
 478                             h = NULL;
 479                             _krb5_plugin_free(list);
 480                     }
 481             }
 482     }
 483
 484 #ifdef HAVE_DLOPEN
 485     if (h == NULL)
 486         h = find_dynamic_method (context, filename, &residual);
 487 #endif
 488     if (h == NULL)
 489         krb5_errx(context, 1, "No database support for %s", filename);
 490     return (*h->create)(context, db, residual);
 491 }