util:datablob: data_blob_pad checks its alignment assumption
[samba.git] / source3 / winbindd / winbindd_cred_cache.c
bloba73afe483fb30624b3d53eb448e0c30c1544e3b5
1 /*
2 Unix SMB/CIFS implementation.
4 Winbind daemon - krb5 credential cache functions
5 and in-memory cache functions.
7 Copyright (C) Guenther Deschner 2005-2006
8 Copyright (C) Jeremy Allison 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "includes.h"
25 #include "winbindd.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "smb_krb5.h"
28 #include "libads/kerberos_proto.h"
29 #include "lib/global_contexts.h"
31 #undef DBGC_CLASS
32 #define DBGC_CLASS DBGC_WINBIND
34 /* uncomment this to do fast debugging on the krb5 ticket renewal event */
35 #ifdef DEBUG_KRB5_TKT_RENEWAL
36 #undef DEBUG_KRB5_TKT_RENEWAL
37 #endif
39 #define MAX_CCACHES 100
41 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
42 static void krb5_ticket_gain_handler(struct tevent_context *,
43 struct tevent_timer *,
44 struct timeval,
45 void *);
46 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *,
47 struct timeval);
49 /* The Krb5 ticket refresh handler should be scheduled
50 at one-half of the period from now till the tkt
51 expiration */
53 static time_t krb5_event_refresh_time(time_t end_time)
55 time_t rest = end_time - time(NULL);
56 return end_time - rest/2;
59 /****************************************************************
60 Find an entry by name.
61 ****************************************************************/
63 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
65 struct WINBINDD_CCACHE_ENTRY *entry;
67 for (entry = ccache_list; entry; entry = entry->next) {
68 if (strequal(entry->username, username)) {
69 return entry;
72 return NULL;
75 /****************************************************************
76 How many do we have ?
77 ****************************************************************/
79 static int ccache_entry_count(void)
81 struct WINBINDD_CCACHE_ENTRY *entry;
82 int i = 0;
84 for (entry = ccache_list; entry; entry = entry->next) {
85 i++;
87 return i;
90 void ccache_remove_all_after_fork(void)
92 struct WINBINDD_CCACHE_ENTRY *cur, *next;
94 for (cur = ccache_list; cur; cur = next) {
95 next = cur->next;
96 DLIST_REMOVE(ccache_list, cur);
97 TALLOC_FREE(cur->event);
98 TALLOC_FREE(cur);
101 return;
104 /****************************************************************
105 Do the work of refreshing the ticket.
106 ****************************************************************/
108 static void krb5_ticket_refresh_handler(struct tevent_context *event_ctx,
109 struct tevent_timer *te,
110 struct timeval now,
111 void *private_data)
113 struct WINBINDD_CCACHE_ENTRY *entry =
114 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
115 #ifdef HAVE_KRB5
116 int ret;
117 time_t new_start;
118 time_t expire_time = 0;
119 struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
120 #endif
122 DBG_DEBUG("event called for: %s, %s\n",
123 entry->ccname, entry->username);
125 TALLOC_FREE(entry->event);
127 #ifdef HAVE_KRB5
129 /* Kinit again if we have the user password and we can't renew the old
130 * tgt anymore
131 * NB
132 * This happens when machine are put to sleep for a very long time. */
134 if (entry->renew_until < time(NULL)) {
135 rekinit:
136 if (cred_ptr && cred_ptr->pass) {
138 set_effective_uid(entry->uid);
140 ret = kerberos_kinit_password_ext(entry->principal_name,
141 cred_ptr->pass,
142 0, /* hm, can we do time correction here ? */
143 &entry->refresh_time,
144 &entry->renew_until,
145 entry->ccname,
146 False, /* no PAC required anymore */
147 True,
148 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
149 NULL,
150 NULL,
151 NULL,
152 NULL);
153 gain_root_privilege();
155 if (ret) {
156 DEBUG(3,("krb5_ticket_refresh_handler: "
157 "could not re-kinit: %s\n",
158 error_message(ret)));
159 /* destroy the ticket because we cannot rekinit
160 * it, ignore error here */
161 ads_kdestroy(entry->ccname);
163 /* Don't break the ticket refresh chain: retry
164 * refreshing ticket sometime later when KDC is
165 * unreachable -- BoYang. More error code handling
166 * here?
167 * */
169 if ((ret == KRB5_KDC_UNREACH)
170 || (ret == KRB5_REALM_CANT_RESOLVE)) {
171 #if defined(DEBUG_KRB5_TKT_RENEWAL)
172 new_start = time(NULL) + 30;
173 #else
174 new_start = time(NULL) +
175 MAX(30, lp_winbind_cache_time());
176 #endif
177 add_krb5_ticket_gain_handler_event(
178 entry,
179 tevent_timeval_set(new_start,
180 0));
181 return;
183 TALLOC_FREE(entry->event);
184 return;
187 DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
188 "for: %s in ccache: %s\n",
189 entry->principal_name, entry->ccname));
191 #if defined(DEBUG_KRB5_TKT_RENEWAL)
192 new_start = time(NULL) + 30;
193 #else
194 /* The tkt should be refreshed at one-half the period
195 from now to the expiration time */
196 expire_time = entry->refresh_time;
197 new_start = krb5_event_refresh_time(entry->refresh_time);
198 #endif
199 goto done;
200 } else {
201 /* can this happen?
202 * No cached credentials
203 * destroy ticket and refresh chain
204 * */
205 ads_kdestroy(entry->ccname);
206 TALLOC_FREE(entry->event);
207 return;
211 set_effective_uid(entry->uid);
213 ret = smb_krb5_renew_ticket(entry->ccname,
214 entry->canon_principal,
215 entry->service,
216 &new_start);
217 #if defined(DEBUG_KRB5_TKT_RENEWAL)
218 new_start = time(NULL) + 30;
219 #else
220 expire_time = new_start;
221 new_start = krb5_event_refresh_time(new_start);
222 #endif
224 gain_root_privilege();
226 if (ret) {
227 DEBUG(3,("krb5_ticket_refresh_handler: "
228 "could not renew tickets: %s\n",
229 error_message(ret)));
230 /* maybe we are beyond the renewing window */
232 /* evil rises here, we refresh ticket failed,
233 * but the ticket might be expired. Therefore,
234 * When we refresh ticket failed, destroy the
235 * ticket */
237 ads_kdestroy(entry->ccname);
239 /* avoid breaking the renewal chain: retry in
240 * lp_winbind_cache_time() seconds when the KDC was not
241 * available right now.
242 * the return code can be KRB5_REALM_CANT_RESOLVE.
243 * More error code handling here? */
245 if ((ret == KRB5_KDC_UNREACH)
246 || (ret == KRB5_REALM_CANT_RESOLVE)) {
247 #if defined(DEBUG_KRB5_TKT_RENEWAL)
248 new_start = time(NULL) + 30;
249 #else
250 new_start = time(NULL) +
251 MAX(30, lp_winbind_cache_time());
252 #endif
253 /* ticket is destroyed here, we have to regain it
254 * if it is possible */
255 add_krb5_ticket_gain_handler_event(
256 entry, tevent_timeval_set(new_start, 0));
257 return;
260 /* This is evil, if the ticket was already expired.
261 * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
262 * But there is still a chance that we can rekinit it.
264 * This happens when user login in online mode, and then network
265 * down or something cause winbind goes offline for a very long time,
266 * and then goes online again. ticket expired, renew failed.
267 * This happens when machine are put to sleep for a long time,
268 * but shorter than entry->renew_util.
269 * NB
270 * Looks like the KDC is reachable, we want to rekinit as soon as
271 * possible instead of waiting some time later. */
272 if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
273 || (ret == KRB5_FCC_NOFILE)) goto rekinit;
275 return;
278 done:
279 /* in cases that ticket will be unrenewable soon, we don't try to renew ticket
280 * but try to regain ticket if it is possible */
281 if (entry->renew_until && expire_time
282 && (entry->renew_until <= expire_time)) {
283 /* try to regain ticket 10 seconds before expiration */
284 expire_time -= 10;
285 add_krb5_ticket_gain_handler_event(
286 entry, tevent_timeval_set(expire_time, 0));
287 return;
290 if (entry->refresh_time == 0) {
291 entry->refresh_time = new_start;
293 entry->event = tevent_add_timer(global_event_context(),
294 entry,
295 tevent_timeval_set(new_start, 0),
296 krb5_ticket_refresh_handler,
297 entry);
299 #endif
302 /****************************************************************
303 Do the work of regaining a ticket when coming from offline auth.
304 ****************************************************************/
306 static void krb5_ticket_gain_handler(struct tevent_context *event_ctx,
307 struct tevent_timer *te,
308 struct timeval now,
309 void *private_data)
311 struct WINBINDD_CCACHE_ENTRY *entry =
312 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
313 #ifdef HAVE_KRB5
314 int ret;
315 struct timeval t;
316 struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
317 struct winbindd_domain *domain = NULL;
318 #endif
320 DBG_DEBUG("event called for: %s, %s\n",
321 entry->ccname, entry->username);
323 TALLOC_FREE(entry->event);
325 #ifdef HAVE_KRB5
327 if (!cred_ptr || !cred_ptr->pass) {
328 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
329 return;
332 if ((domain = find_domain_from_name(entry->realm)) == NULL) {
333 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
334 return;
337 if (!domain->online) {
338 goto retry_later;
341 set_effective_uid(entry->uid);
343 ret = kerberos_kinit_password_ext(entry->principal_name,
344 cred_ptr->pass,
345 0, /* hm, can we do time correction here ? */
346 &entry->refresh_time,
347 &entry->renew_until,
348 entry->ccname,
349 False, /* no PAC required anymore */
350 True,
351 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
352 NULL,
353 NULL,
354 NULL,
355 NULL);
356 gain_root_privilege();
358 if (ret) {
359 DEBUG(3,("krb5_ticket_gain_handler: "
360 "could not kinit: %s\n",
361 error_message(ret)));
362 /* evil. If we cannot do it, destroy any the __maybe__
363 * __existing__ ticket */
364 ads_kdestroy(entry->ccname);
365 goto retry_later;
368 DEBUG(10,("krb5_ticket_gain_handler: "
369 "successful kinit for: %s in ccache: %s\n",
370 entry->principal_name, entry->ccname));
372 goto got_ticket;
374 retry_later:
376 #if defined(DEBUG_KRB5_TKT_RENEWAL)
377 t = tevent_timeval_set(time(NULL) + 30, 0);
378 #else
379 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
380 #endif
382 add_krb5_ticket_gain_handler_event(entry, t);
383 return;
385 got_ticket:
387 #if defined(DEBUG_KRB5_TKT_RENEWAL)
388 t = tevent_timeval_set(time(NULL) + 30, 0);
389 #else
390 t = tevent_timeval_set(krb5_event_refresh_time(entry->refresh_time), 0);
391 #endif
393 if (entry->refresh_time == 0) {
394 entry->refresh_time = t.tv_sec;
396 entry->event = tevent_add_timer(global_event_context(),
397 entry,
399 krb5_ticket_refresh_handler,
400 entry);
402 return;
403 #endif
406 /**************************************************************
407 The gain initial ticket case is recognised as entry->refresh_time
408 is always zero.
409 **************************************************************/
411 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
412 struct timeval t)
414 entry->refresh_time = 0;
415 entry->event = tevent_add_timer(global_event_context(),
416 entry,
418 krb5_ticket_gain_handler,
419 entry);
422 void ccache_regain_all_now(void)
424 struct WINBINDD_CCACHE_ENTRY *cur;
425 struct timeval t = timeval_current();
427 for (cur = ccache_list; cur; cur = cur->next) {
428 struct tevent_timer *new_event;
431 * if refresh_time is 0, we know that the
432 * the event has the krb5_ticket_gain_handler
434 if (cur->refresh_time == 0) {
435 new_event = tevent_add_timer(global_event_context(),
436 cur,
438 krb5_ticket_gain_handler,
439 cur);
440 } else {
441 new_event = tevent_add_timer(global_event_context(),
442 cur,
444 krb5_ticket_refresh_handler,
445 cur);
448 if (!new_event) {
449 continue;
452 TALLOC_FREE(cur->event);
453 cur->event = new_event;
456 return;
459 /****************************************************************
460 Check if an ccache entry exists.
461 ****************************************************************/
463 bool ccache_entry_exists(const char *username)
465 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
466 return (entry != NULL);
469 /****************************************************************
470 Ensure we're changing the correct entry.
471 ****************************************************************/
473 bool ccache_entry_identical(const char *username,
474 uid_t uid,
475 const char *ccname)
477 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
479 if (!entry) {
480 return False;
483 if (entry->uid != uid) {
484 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
485 (unsigned int)entry->uid, (unsigned int)uid));
486 return False;
488 if (!strcsequal(entry->ccname, ccname)) {
489 DEBUG(0,("cache_entry_identical: "
490 "ccnames differ: (cache) %s != (client) %s\n",
491 entry->ccname, ccname));
492 return False;
494 return True;
497 NTSTATUS add_ccache_to_list(const char *princ_name,
498 const char *ccname,
499 const char *username,
500 const char *pass,
501 const char *realm,
502 uid_t uid,
503 time_t create_time,
504 time_t ticket_end,
505 time_t renew_until,
506 bool postponed_request,
507 const char *canon_principal,
508 const char *canon_realm)
510 struct WINBINDD_CCACHE_ENTRY *entry = NULL;
511 struct timeval t;
512 NTSTATUS ntret;
514 if ((username == NULL && princ_name == NULL) ||
515 ccname == NULL || uid == (uid_t)-1) {
516 return NT_STATUS_INVALID_PARAMETER;
519 if (ccache_entry_count() + 1 > MAX_CCACHES) {
520 DEBUG(10,("add_ccache_to_list: "
521 "max number of ccaches reached\n"));
522 return NT_STATUS_NO_MORE_ENTRIES;
525 /* Reference count old entries */
526 entry = get_ccache_by_username(username);
527 if (entry) {
528 /* Check cached entries are identical. */
529 if (!ccache_entry_identical(username, uid, ccname)) {
530 return NT_STATUS_INVALID_PARAMETER;
532 entry->ref_count++;
533 DEBUG(10,("add_ccache_to_list: "
534 "ref count on entry %s is now %d\n",
535 username, entry->ref_count));
536 /* FIXME: in this case we still might want to have a krb5 cred
537 * event handler created - gd
538 * Add ticket refresh handler here */
540 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
541 return NT_STATUS_OK;
544 if (!entry->event) {
545 if (postponed_request) {
546 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
547 add_krb5_ticket_gain_handler_event(entry, t);
548 } else {
549 /* Renew at 1/2 the ticket expiration time */
550 #if defined(DEBUG_KRB5_TKT_RENEWAL)
551 t = tevent_timeval_set(time(NULL) + 30, 0);
552 #else
553 t = tevent_timeval_set(krb5_event_refresh_time(
554 ticket_end),
556 #endif
557 if (!entry->refresh_time) {
558 entry->refresh_time = t.tv_sec;
560 entry->event = tevent_add_timer(global_event_context(),
561 entry,
563 krb5_ticket_refresh_handler,
564 entry);
567 if (!entry->event) {
568 ntret = remove_ccache(username);
569 if (!NT_STATUS_IS_OK(ntret)) {
570 DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
571 "ccache %s for user %s\n", entry->ccname,
572 entry->username));
573 DEBUG(0, ("add_ccache_to_list: error is %s\n",
574 nt_errstr(ntret)));
575 return ntret;
577 return NT_STATUS_NO_MEMORY;
580 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
585 * If we're set up to renew our krb5 tickets, we must
586 * cache the credentials in memory for the ticket
587 * renew function (or increase the reference count
588 * if we're logging in more than once). Fix inspired
589 * by patch from Ian Gordon <ian.gordon@strath.ac.uk>
590 * for bugid #9098.
593 ntret = winbindd_add_memory_creds(username, uid, pass);
594 DEBUG(10, ("winbindd_add_memory_creds returned: %s\n",
595 nt_errstr(ntret)));
597 return NT_STATUS_OK;
600 entry = talloc(NULL, struct WINBINDD_CCACHE_ENTRY);
601 if (!entry) {
602 return NT_STATUS_NO_MEMORY;
605 ZERO_STRUCTP(entry);
607 if (username) {
608 entry->username = talloc_strdup(entry, username);
609 if (!entry->username) {
610 goto no_mem;
613 if (princ_name) {
614 entry->principal_name = talloc_strdup(entry, princ_name);
615 if (!entry->principal_name) {
616 goto no_mem;
619 if (canon_principal != NULL) {
620 entry->canon_principal = talloc_strdup(entry, canon_principal);
621 if (entry->canon_principal == NULL) {
622 goto no_mem;
625 if (canon_realm != NULL) {
626 entry->canon_realm = talloc_strdup(entry, canon_realm);
627 if (entry->canon_realm == NULL) {
628 goto no_mem;
632 entry->ccname = talloc_strdup(entry, ccname);
633 if (!entry->ccname) {
634 goto no_mem;
637 entry->realm = talloc_strdup(entry, realm);
638 if (!entry->realm) {
639 goto no_mem;
642 entry->service = talloc_asprintf(entry,
643 "%s/%s@%s",
644 KRB5_TGS_NAME,
645 canon_realm,
646 canon_realm);
647 if (entry->service == NULL) {
648 goto no_mem;
651 entry->create_time = create_time;
652 entry->renew_until = renew_until;
653 entry->uid = uid;
654 entry->ref_count = 1;
656 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
657 goto add_entry;
660 if (postponed_request) {
661 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
662 add_krb5_ticket_gain_handler_event(entry, t);
663 } else {
664 /* Renew at 1/2 the ticket expiration time */
665 #if defined(DEBUG_KRB5_TKT_RENEWAL)
666 t = tevent_timeval_set(time(NULL) + 30, 0);
667 #else
668 t = tevent_timeval_set(krb5_event_refresh_time(ticket_end), 0);
669 #endif
670 if (entry->refresh_time == 0) {
671 entry->refresh_time = t.tv_sec;
673 entry->event = tevent_add_timer(global_event_context(),
674 entry,
676 krb5_ticket_refresh_handler,
677 entry);
680 if (!entry->event) {
681 goto no_mem;
684 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
686 add_entry:
688 DLIST_ADD(ccache_list, entry);
690 DBG_DEBUG("Added ccache [%s] for user [%s] and service [%s]\n",
691 entry->ccname, entry->username, entry->service);
693 if (entry->event) {
695 * If we're set up to renew our krb5 tickets, we must
696 * cache the credentials in memory for the ticket
697 * renew function. Fix inspired by patch from
698 * Ian Gordon <ian.gordon@strath.ac.uk> for
699 * bugid #9098.
702 ntret = winbindd_add_memory_creds(username, uid, pass);
703 DEBUG(10, ("winbindd_add_memory_creds returned: %s\n",
704 nt_errstr(ntret)));
707 return NT_STATUS_OK;
709 no_mem:
711 TALLOC_FREE(entry);
712 return NT_STATUS_NO_MEMORY;
715 /*******************************************************************
716 Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer
717 referenced.
718 *******************************************************************/
720 NTSTATUS remove_ccache(const char *username)
722 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
723 NTSTATUS status = NT_STATUS_OK;
724 #ifdef HAVE_KRB5
725 krb5_error_code ret;
726 #endif
728 if (!entry) {
729 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
732 if (entry->ref_count <= 0) {
733 DEBUG(0,("remove_ccache: logic error. "
734 "ref count for user %s = %d\n",
735 username, entry->ref_count));
736 return NT_STATUS_INTERNAL_DB_CORRUPTION;
739 entry->ref_count--;
741 if (entry->ref_count > 0) {
742 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
743 username, entry->ref_count));
744 return NT_STATUS_OK;
747 /* no references any more */
749 DLIST_REMOVE(ccache_list, entry);
750 TALLOC_FREE(entry->event); /* unregisters events */
752 #ifdef HAVE_KRB5
753 ret = ads_kdestroy(entry->ccname);
755 /* we ignore the error when there has been no credential cache */
756 if (ret == KRB5_FCC_NOFILE) {
757 ret = 0;
758 } else if (ret) {
759 DEBUG(0,("remove_ccache: "
760 "failed to destroy user krb5 ccache %s with: %s\n",
761 entry->ccname, error_message(ret)));
762 } else {
763 DEBUG(10,("remove_ccache: "
764 "successfully destroyed krb5 ccache %s for user %s\n",
765 entry->ccname, username));
767 status = krb5_to_nt_status(ret);
768 #endif
770 TALLOC_FREE(entry);
771 DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
773 return status;
776 /*******************************************************************
777 In memory credentials cache code.
778 *******************************************************************/
780 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
782 /***********************************************************
783 Find an entry on the list by name.
784 ***********************************************************/
786 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
788 struct WINBINDD_MEMORY_CREDS *p;
790 for (p = memory_creds_list; p; p = p->next) {
791 if (strequal(p->username, username)) {
792 return p;
795 return NULL;
798 /***********************************************************
799 Store the required creds and mlock them.
800 ***********************************************************/
802 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp,
803 const char *pass)
805 #if !defined(HAVE_MLOCK)
806 return NT_STATUS_OK;
807 #else
808 /* new_entry->nt_hash is the base pointer for the block
809 of memory pointed into by new_entry->lm_hash and
810 new_entry->pass (if we're storing plaintext). */
812 memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
813 if (pass) {
814 memcredp->len += strlen(pass)+1;
818 #if defined(LINUX)
819 /* aligning the memory on on x86_64 and compiling
820 with gcc 4.1 using -O2 causes a segv in the
821 next memset() --jerry */
822 memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
823 #else
824 /* On non-linux platforms, mlock()'d memory must be aligned */
825 memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
826 getpagesize(), memcredp->len);
827 #endif
828 if (!memcredp->nt_hash) {
829 return NT_STATUS_NO_MEMORY;
831 memset(memcredp->nt_hash, 0x0, memcredp->len);
833 memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
835 #ifdef DEBUG_PASSWORD
836 DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
837 #endif
838 if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
839 DEBUG(0,("failed to mlock memory: %s (%d)\n",
840 strerror(errno), errno));
841 SAFE_FREE(memcredp->nt_hash);
842 return map_nt_error_from_unix(errno);
845 #ifdef DEBUG_PASSWORD
846 DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
847 #endif
849 if (pass) {
850 /* Create and store the password hashes. */
851 E_md4hash(pass, memcredp->nt_hash);
852 E_deshash(pass, memcredp->lm_hash);
854 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
855 memcpy(memcredp->pass, pass,
856 memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
859 return NT_STATUS_OK;
860 #endif
863 /***********************************************************
864 Destroy existing creds.
865 ***********************************************************/
867 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
869 #if !defined(HAVE_MUNLOCK)
870 return NT_STATUS_OK;
871 #else
872 if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
873 DEBUG(0,("failed to munlock memory: %s (%d)\n",
874 strerror(errno), errno));
875 return map_nt_error_from_unix(errno);
877 memset(memcredp->nt_hash, '\0', memcredp->len);
878 SAFE_FREE(memcredp->nt_hash);
879 memcredp->nt_hash = NULL;
880 memcredp->lm_hash = NULL;
881 memcredp->pass = NULL;
882 memcredp->len = 0;
883 return NT_STATUS_OK;
884 #endif
887 /***********************************************************
888 Replace the required creds with new ones (password change).
889 ***********************************************************/
891 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
892 const char *pass)
894 NTSTATUS status = delete_memory_creds(memcredp);
895 if (!NT_STATUS_IS_OK(status)) {
896 return status;
898 return store_memory_creds(memcredp, pass);
901 /*************************************************************
902 Store credentials in memory in a list.
903 *************************************************************/
905 static NTSTATUS winbindd_add_memory_creds_internal(const char *username,
906 uid_t uid,
907 const char *pass)
909 /* Shortcut to ensure we don't store if no mlock. */
910 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
911 return NT_STATUS_OK;
912 #else
913 NTSTATUS status;
914 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
916 memcredp = find_memory_creds_by_name(username);
917 if (uid == (uid_t)-1) {
918 DEBUG(0,("winbindd_add_memory_creds_internal: "
919 "invalid uid for user %s.\n", username));
920 return NT_STATUS_INVALID_PARAMETER;
923 if (memcredp) {
924 /* Already exists. Increment the reference count and replace stored creds. */
925 if (uid != memcredp->uid) {
926 DEBUG(0,("winbindd_add_memory_creds_internal: "
927 "uid %u for user %s doesn't "
928 "match stored uid %u. Replacing.\n",
929 (unsigned int)uid, username,
930 (unsigned int)memcredp->uid));
931 memcredp->uid = uid;
933 memcredp->ref_count++;
934 DEBUG(10,("winbindd_add_memory_creds_internal: "
935 "ref count for user %s is now %d\n",
936 username, memcredp->ref_count));
937 return winbindd_replace_memory_creds_internal(memcredp, pass);
940 memcredp = talloc_zero(NULL, struct WINBINDD_MEMORY_CREDS);
941 if (!memcredp) {
942 return NT_STATUS_NO_MEMORY;
944 memcredp->username = talloc_strdup(memcredp, username);
945 if (!memcredp->username) {
946 talloc_destroy(memcredp);
947 return NT_STATUS_NO_MEMORY;
950 status = store_memory_creds(memcredp, pass);
951 if (!NT_STATUS_IS_OK(status)) {
952 talloc_destroy(memcredp);
953 return status;
956 memcredp->uid = uid;
957 memcredp->ref_count = 1;
958 DLIST_ADD(memory_creds_list, memcredp);
960 DEBUG(10,("winbindd_add_memory_creds_internal: "
961 "added entry for user %s\n", username));
963 return NT_STATUS_OK;
964 #endif
967 /*************************************************************
968 Store users credentials in memory. If we also have a
969 struct WINBINDD_CCACHE_ENTRY for this username with a
970 refresh timer, then store the plaintext of the password
971 and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
972 *************************************************************/
974 NTSTATUS winbindd_add_memory_creds(const char *username,
975 uid_t uid,
976 const char *pass)
978 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
979 NTSTATUS status;
981 status = winbindd_add_memory_creds_internal(username, uid, pass);
982 if (!NT_STATUS_IS_OK(status)) {
983 return status;
986 if (entry) {
987 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
988 memcredp = find_memory_creds_by_name(username);
989 if (memcredp) {
990 entry->cred_ptr = memcredp;
994 return status;
997 /*************************************************************
998 Decrement the in-memory ref count - delete if zero.
999 *************************************************************/
1001 NTSTATUS winbindd_delete_memory_creds(const char *username)
1003 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
1004 struct WINBINDD_CCACHE_ENTRY *entry = NULL;
1005 NTSTATUS status = NT_STATUS_OK;
1007 memcredp = find_memory_creds_by_name(username);
1008 entry = get_ccache_by_username(username);
1010 if (!memcredp) {
1011 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
1012 username));
1013 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1016 if (memcredp->ref_count <= 0) {
1017 DEBUG(0,("winbindd_delete_memory_creds: logic error. "
1018 "ref count for user %s = %d\n",
1019 username, memcredp->ref_count));
1020 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
1023 memcredp->ref_count--;
1024 if (memcredp->ref_count <= 0) {
1025 delete_memory_creds(memcredp);
1026 DLIST_REMOVE(memory_creds_list, memcredp);
1027 talloc_destroy(memcredp);
1028 DEBUG(10,("winbindd_delete_memory_creds: "
1029 "deleted entry for user %s\n",
1030 username));
1031 } else {
1032 DEBUG(10,("winbindd_delete_memory_creds: "
1033 "entry for user %s ref_count now %d\n",
1034 username, memcredp->ref_count));
1037 if (entry) {
1038 /* Ensure we have no dangling references to this. */
1039 entry->cred_ptr = NULL;
1042 return status;
1045 /***********************************************************
1046 Replace the required creds with new ones (password change).
1047 ***********************************************************/
1049 NTSTATUS winbindd_replace_memory_creds(const char *username,
1050 const char *pass)
1052 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
1054 memcredp = find_memory_creds_by_name(username);
1055 if (!memcredp) {
1056 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
1057 username));
1058 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1061 DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
1062 username));
1064 return winbindd_replace_memory_creds_internal(memcredp, pass);