1 /*
2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 #include "krb5_locl.h"
37 #include "hdb_locl.h"
38
39 #ifdef HAVE_DLFCN_H
40 #include <dlfcn.h>
41 #endif
42
43 /*! @mainpage Heimdal database backend library
44 *
45 * @section intro Introduction
46 *
47 * Heimdal libhdb library provides the backend support for Heimdal kdc
48 * and kadmind. Its here where plugins for diffrent database engines
49 * can be pluged in and extend support for here Heimdal get the
50 * principal and policy data from.
51 *
52 * Example of Heimdal backend are:
53 * - Berkeley DB 1.85
54 * - Berkeley DB 3.0
55 * - Berkeley DB 4.0
56 * - New Berkeley DB
57 * - LDAP
58 *
59 *
60 * The project web page: http://www.h5l.org/
61 *
62 */
63
64 const int hdb_interface_version = HDB_INTERFACE_VERSION;
65
66 static struct hdb_method methods[] = {
67 #if HAVE_DB1 || HAVE_DB3
68 { HDB_INTERFACE_VERSION, "db:", hdb_db_create},
69 #endif
70 #if HAVE_DB1
71 { HDB_INTERFACE_VERSION, "mit-db:", hdb_mdb_create},
72 #endif
73 #if HAVE_NDBM
74 { HDB_INTERFACE_VERSION, "ndbm:", hdb_ndbm_create},
75 #endif
76 { HDB_INTERFACE_VERSION, "keytab:", hdb_keytab_create},
77 #if defined(OPENLDAP) && !defined(OPENLDAP_MODULE)
78 { HDB_INTERFACE_VERSION, "ldap:", hdb_ldap_create},
79 { HDB_INTERFACE_VERSION, "ldapi:", hdb_ldapi_create},
80 #endif
81 #ifdef HAVE_SQLITE3
82 { HDB_INTERFACE_VERSION, "sqlite:", hdb_sqlite_create},
83 #endif
84 {0, NULL, NULL}
85 };
86
87 #if HAVE_DB1 || HAVE_DB3
88 static struct hdb_method dbmetod =
89 { HDB_INTERFACE_VERSION, "", hdb_db_create };
90 #elif defined(HAVE_NDBM)
91 static struct hdb_method dbmetod =
92 { HDB_INTERFACE_VERSION, "", hdb_ndbm_create };
93 #endif
94
95
96 krb5_error_code
hdb_next_enctype2key(krb5_context context,const hdb_entry * e,krb5_enctype enctype,Key ** key)97 hdb_next_enctype2key(krb5_context context,
98 const hdb_entry *e,
99 krb5_enctype enctype,
100 Key **key)
101 {
102 Key *k;
103
104 for (k = *key ? (*key) + 1 : e->keys.val;
105 k < e->keys.val + e->keys.len;
106 k++)
107 {
108 if(k->key.keytype == enctype){
109 *key = k;
110 return 0;
111 }
112 }
113 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
114 "No next enctype %d for hdb-entry",
115 (int)enctype);
116 return KRB5_PROG_ETYPE_NOSUPP; /* XXX */
117 }
118
119 krb5_error_code
hdb_enctype2key(krb5_context context,hdb_entry * e,krb5_enctype enctype,Key ** key)120 hdb_enctype2key(krb5_context context,
121 hdb_entry *e,
122 krb5_enctype enctype,
123 Key **key)
124 {
125 *key = NULL;
126 return hdb_next_enctype2key(context, e, enctype, key);
127 }
128
129 void
hdb_free_key(Key * key)130 hdb_free_key(Key *key)
131 {
132 memset(key->key.keyvalue.data,
133 0,
134 key->key.keyvalue.length);
135 free_Key(key);
136 free(key);
137 }
138
139
140 krb5_error_code
hdb_lock(int fd,int operation)141 hdb_lock(int fd, int operation)
142 {
143 int i, code = 0;
144
145 for(i = 0; i < 3; i++){
146 code = flock(fd, (operation == HDB_RLOCK ? LOCK_SH : LOCK_EX) | LOCK_NB);
147 if(code == 0 || errno != EWOULDBLOCK)
148 break;
149 sleep(1);
150 }
151 if(code == 0)
152 return 0;
153 if(errno == EWOULDBLOCK)
154 return HDB_ERR_DB_INUSE;
155 return HDB_ERR_CANT_LOCK_DB;
156 }
157
158 krb5_error_code
hdb_unlock(int fd)159 hdb_unlock(int fd)
160 {
161 int code;
162 code = flock(fd, LOCK_UN);
163 if(code)
164 return 4711 /* XXX */;
165 return 0;
166 }
167
168 void
hdb_free_entry(krb5_context context,hdb_entry_ex * ent)169 hdb_free_entry(krb5_context context, hdb_entry_ex *ent)
170 {
171 Key *k;
172 int i;
173
174 if (ent->free_entry)
175 (*ent->free_entry)(context, ent);
176
177 for(i = 0; i < ent->entry.keys.len; i++) {
178 k = &ent->entry.keys.val[i];
179
180 memset (k->key.keyvalue.data, 0, k->key.keyvalue.length);
181 }
182 free_hdb_entry(&ent->entry);
183 }
184
185 krb5_error_code
hdb_foreach(krb5_context context,HDB * db,unsigned flags,hdb_foreach_func_t func,void * data)186 hdb_foreach(krb5_context context,
187 HDB *db,
188 unsigned flags,
189 hdb_foreach_func_t func,
190 void *data)
191 {
192 krb5_error_code ret;
193 hdb_entry_ex entry;
194 ret = db->hdb_firstkey(context, db, flags, &entry);
195 if (ret == 0)
196 krb5_clear_error_message(context);
197 while(ret == 0){
198 ret = (*func)(context, db, &entry, data);
199 hdb_free_entry(context, &entry);
200 if(ret == 0)
201 ret = db->hdb_nextkey(context, db, flags, &entry);
202 }
203 if(ret == HDB_ERR_NOENTRY)
204 ret = 0;
205 return ret;
206 }
207
208 krb5_error_code
hdb_check_db_format(krb5_context context,HDB * db)209 hdb_check_db_format(krb5_context context, HDB *db)
210 {
211 krb5_data tag;
212 krb5_data version;
213 krb5_error_code ret, ret2;
214 unsigned ver;
215 int foo;
216
217 ret = db->hdb_lock(context, db, HDB_RLOCK);
218 if (ret)
219 return ret;
220
221 tag.data = (void *)(intptr_t)HDB_DB_FORMAT_ENTRY;
222 tag.length = strlen(tag.data);
223 ret = (*db->hdb__get)(context, db, tag, &version);
224 ret2 = db->hdb_unlock(context, db);
225 if(ret)
226 return ret;
227 if (ret2)
228 return ret2;
229 foo = sscanf(version.data, "%u", &ver);
230 krb5_data_free (&version);
231 if (foo != 1)
232 return HDB_ERR_BADVERSION;
233 if(ver != HDB_DB_FORMAT)
234 return HDB_ERR_BADVERSION;
235 return 0;
236 }
237
238 krb5_error_code
hdb_init_db(krb5_context context,HDB * db)239 hdb_init_db(krb5_context context, HDB *db)
240 {
241 krb5_error_code ret, ret2;
242 krb5_data tag;
243 krb5_data version;
244 char ver[32];
245
246 ret = hdb_check_db_format(context, db);
247 if(ret != HDB_ERR_NOENTRY)
248 return ret;
249
250 ret = db->hdb_lock(context, db, HDB_WLOCK);
251 if (ret)
252 return ret;
253
254 tag.data = (void *)(intptr_t)HDB_DB_FORMAT_ENTRY;
255 tag.length = strlen(tag.data);
256 snprintf(ver, sizeof(ver), "%u", HDB_DB_FORMAT);
257 version.data = ver;
258 version.length = strlen(version.data) + 1; /* zero terminated */
259 ret = (*db->hdb__put)(context, db, 0, tag, version);
260 ret2 = db->hdb_unlock(context, db);
261 if (ret) {
262 if (ret2)
263 krb5_clear_error_message(context);
264 return ret;
265 }
266 return ret2;
267 }
268
269 #ifdef HAVE_DLOPEN
270
271 /*
272 * Load a dynamic backend from /usr/heimdal/lib/hdb_NAME.so,
273 * looking for the hdb_NAME_create symbol.
274 */
275
276 static const struct hdb_method *
find_dynamic_method(krb5_context context,const char * filename,const char ** rest)277 find_dynamic_method (krb5_context context,
278 const char *filename,
279 const char **rest)
280 {
281 static struct hdb_method method;
282 struct hdb_so_method *mso;
283 char *prefix, *path, *symbol;
284 const char *p;
285 void *dl;
286 size_t len;
287
288 p = strchr(filename, ':');
289
290 /* if no prefix, don't know what module to load, just ignore it */
291 if (p == NULL)
292 return NULL;
293
294 len = p - filename;
295 *rest = filename + len + 1;
296
297 prefix = malloc(len + 1);
298 if (prefix == NULL)
299 krb5_errx(context, 1, "out of memory");
300 strlcpy(prefix, filename, len + 1);
301
302 if (asprintf(&path, LIBDIR "/hdb_%s.so", prefix) == -1)
303 krb5_errx(context, 1, "out of memory");
304
305 #ifndef RTLD_NOW
306 #define RTLD_NOW 0
307 #endif
308 #ifndef RTLD_GLOBAL
309 #define RTLD_GLOBAL 0
310 #endif
311
312 dl = dlopen(path, RTLD_NOW | RTLD_GLOBAL);
313 if (dl == NULL) {
314 krb5_warnx(context, "error trying to load dynamic module %s: %s\n",
315 path, dlerror());
316 free(prefix);
317 free(path);
318 return NULL;
319 }
320
321 if (asprintf(&symbol, "hdb_%s_interface", prefix) == -1)
322 krb5_errx(context, 1, "out of memory");
323
324 mso = (struct hdb_so_method *) dlsym(dl, symbol);
325 if (mso == NULL) {
326 krb5_warnx(context, "error finding symbol %s in %s: %s\n",
327 symbol, path, dlerror());
328 dlclose(dl);
329 free(symbol);
330 free(prefix);
331 free(path);
332 return NULL;
333 }
334 free(path);
335 free(symbol);
336
337 if (mso->version != HDB_INTERFACE_VERSION) {
338 krb5_warnx(context,
339 "error wrong version in shared module %s "
340 "version: %d should have been %d\n",
341 prefix, mso->version, HDB_INTERFACE_VERSION);
342 dlclose(dl);
343 free(prefix);
344 return NULL;
345 }
346
347 if (mso->create == NULL) {
348 krb5_errx(context, 1,
349 "no entry point function in shared mod %s ",
350 prefix);
351 dlclose(dl);
352 free(prefix);
353 return NULL;
354 }
355
356 method.create = mso->create;
357 method.prefix = prefix;
358
359 return &method;
360 }
361 #endif /* HAVE_DLOPEN */
362
363 /*
364 * find the relevant method for `filename', returning a pointer to the
365 * rest in `rest'.
366 * return NULL if there's no such method.
367 */
368
369 static const struct hdb_method *
find_method(const char * filename,const char ** rest)370 find_method (const char *filename, const char **rest)
371 {
372 const struct hdb_method *h;
373
374 for (h = methods; h->prefix != NULL; ++h) {
375 if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0) {
376 *rest = filename + strlen(h->prefix);
377 return h;
378 }
379 }
380 #if defined(HAVE_DB1) || defined(HAVE_DB3) || defined(HAVE_NDBM)
381 if (strncmp(filename, "/", 1) == 0
382 || strncmp(filename, "./", 2) == 0
383 || strncmp(filename, "../", 3) == 0)
384 {
385 *rest = filename;
386 return &dbmetod;
387 }
388 #endif
389
390 return NULL;
391 }
392
393 krb5_error_code
hdb_list_builtin(krb5_context context,char ** list)394 hdb_list_builtin(krb5_context context, char **list)
395 {
396 const struct hdb_method *h;
397 size_t len = 0;
398 char *buf = NULL;
399
400 for (h = methods; h->prefix != NULL; ++h) {
401 if (h->prefix[0] == '\0')
402 continue;
403 len += strlen(h->prefix) + 2;
404 }
405
406 len += 1;
407 buf = malloc(len);
408 if (buf == NULL) {
409 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
410 return ENOMEM;
411 }
412 buf[0] = '\0';
413
414 for (h = methods; h->prefix != NULL; ++h) {
415 if (h != methods)
416 strlcat(buf, ", ", len);
417 strlcat(buf, h->prefix, len);
418 }
419 *list = buf;
420 return 0;
421 }
422
423 krb5_error_code
_hdb_keytab2hdb_entry(krb5_context context,const krb5_keytab_entry * ktentry,hdb_entry_ex * entry)424 _hdb_keytab2hdb_entry(krb5_context context,
425 const krb5_keytab_entry *ktentry,
426 hdb_entry_ex *entry)
427 {
428 entry->entry.kvno = ktentry->vno;
429 entry->entry.created_by.time = ktentry->timestamp;
430
431 entry->entry.keys.val = calloc(1, sizeof(entry->entry.keys.val[0]));
432 if (entry->entry.keys.val == NULL)
433 return ENOMEM;
434 entry->entry.keys.len = 1;
435
436 entry->entry.keys.val[0].mkvno = NULL;
437 entry->entry.keys.val[0].salt = NULL;
438
439 return krb5_copy_keyblock_contents(context,
440 &ktentry->keyblock,
441 &entry->entry.keys.val[0].key);
442 }
443
444 /**
445 * Create a handle for a Kerberos database
446 *
447 * Create a handle for a Kerberos database backend specified by a
448 * filename. Doesn't create a file if its doesn't exists, you have to
449 * use O_CREAT to tell the backend to create the file.
450 */
451
452 krb5_error_code
hdb_create(krb5_context context,HDB ** db,const char * filename)453 hdb_create(krb5_context context, HDB **db, const char *filename)
454 {
455 const struct hdb_method *h;
456 const char *residual;
457 krb5_error_code ret;
458 struct krb5_plugin *list = NULL, *e;
459
460 if(filename == NULL)
461 filename = HDB_DEFAULT_DB;
462 krb5_add_et_list(context, initialize_hdb_error_table_r);
463 h = find_method (filename, &residual);
464
465 if (h == NULL) {
466 ret = _krb5_plugin_find(context, PLUGIN_TYPE_DATA, "hdb", &list);
467 if(ret == 0 && list != NULL) {
468 for (e = list; e != NULL; e = _krb5_plugin_get_next(e)) {
469 h = _krb5_plugin_get_symbol(e);
470 if (strncmp (filename, h->prefix, strlen(h->prefix)) == 0
471 && h->interface_version == HDB_INTERFACE_VERSION) {
472 residual = filename + strlen(h->prefix);
473 break;
474 }
475 }
476 if (e == NULL) {
477 h = NULL;
478 _krb5_plugin_free(list);
479 }
480 }
481 }
482
483 #ifdef HAVE_DLOPEN
484 if (h == NULL)
485 h = find_dynamic_method (context, filename, &residual);
486 #endif
487 if (h == NULL)
488 krb5_errx(context, 1, "No database support for %s", filename);
489 return (*h->create)(context, db, residual);
490 }
491