xref: /freebsd/crypto/heimdal/lib/krb5/acache.c (revision 8d20be1e22095c27faf8fe8b2f0d089739cc742e) 
1 /*
2  * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * 3. Neither the name of the Institute nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 
36 #include "krb5_locl.h"
37 #include <krb5_ccapi.h>
38 #ifdef HAVE_DLFCN_H
39 #include <dlfcn.h>
40 #endif
41 
42 #ifndef KCM_IS_API_CACHE
43 
44 static HEIMDAL_MUTEX acc_mutex = HEIMDAL_MUTEX_INITIALIZER;
45 static cc_initialize_func init_func;
46 static void (KRB5_CALLCONV *set_target_uid)(uid_t);
47 static void (KRB5_CALLCONV *clear_target)(void);
48 
49 #ifdef HAVE_DLOPEN
50 static void *cc_handle;
51 #endif
52 
53 typedef struct krb5_acc {
54     char *cache_name;
55     cc_context_t context;
56     cc_ccache_t ccache;
57 } krb5_acc;
58 
59 static krb5_error_code KRB5_CALLCONV acc_close(krb5_context, krb5_ccache);
60 
61 #define ACACHE(X) ((krb5_acc *)(X)->data.data)
62 
63 static const struct {
64     cc_int32 error;
65     krb5_error_code ret;
66 } cc_errors[] = {
67     { ccErrBadName,		KRB5_CC_BADNAME },
68     { ccErrCredentialsNotFound,	KRB5_CC_NOTFOUND },
69     { ccErrCCacheNotFound,	KRB5_FCC_NOFILE },
70     { ccErrContextNotFound,	KRB5_CC_NOTFOUND },
71     { ccIteratorEnd,		KRB5_CC_END },
72     { ccErrNoMem,		KRB5_CC_NOMEM },
73     { ccErrServerUnavailable,	KRB5_CC_NOSUPP },
74     { ccErrInvalidCCache,	KRB5_CC_BADNAME },
75     { ccNoError,		0 }
76 };
77 
78 static krb5_error_code
79 translate_cc_error(krb5_context context, cc_int32 error)
80 {
81     size_t i;
82     krb5_clear_error_message(context);
83     for(i = 0; i < sizeof(cc_errors)/sizeof(cc_errors[0]); i++)
84 	if (cc_errors[i].error == error)
85 	    return cc_errors[i].ret;
86     return KRB5_FCC_INTERNAL;
87 }
88 
89 static krb5_error_code
90 init_ccapi(krb5_context context)
91 {
92     const char *lib = NULL;
93 
94     HEIMDAL_MUTEX_lock(&acc_mutex);
95     if (init_func) {
96 	HEIMDAL_MUTEX_unlock(&acc_mutex);
97 	if (context)
98 	    krb5_clear_error_message(context);
99 	return 0;
100     }
101 
102     if (context)
103 	lib = krb5_config_get_string(context, NULL,
104 				     "libdefaults", "ccapi_library",
105 				     NULL);
106     if (lib == NULL) {
107 #ifdef __APPLE__
108 	lib = "/System/Library/Frameworks/Kerberos.framework/Kerberos";
109 #elif defined(KRB5_USE_PATH_TOKENS) && defined(_WIN32)
110 	lib = "%{LIBDIR}/libkrb5_cc.dll";
111 #else
112 	lib = "/usr/lib/libkrb5_cc.so";
113 #endif
114     }
115 
116 #ifdef HAVE_DLOPEN
117 
118 #ifndef RTLD_LAZY
119 #define RTLD_LAZY 0
120 #endif
121 #ifndef RTLD_LOCAL
122 #define RTLD_LOCAL 0
123 #endif
124 
125 #ifdef KRB5_USE_PATH_TOKENS
126     {
127       char * explib = NULL;
128       if (_krb5_expand_path_tokens(context, lib, &explib) == 0) {
129 	cc_handle = dlopen(explib, RTLD_LAZY|RTLD_LOCAL);
130 	free(explib);
131       }
132     }
133 #else
134     cc_handle = dlopen(lib, RTLD_LAZY|RTLD_LOCAL);
135 #endif
136 
137     if (cc_handle == NULL) {
138 	HEIMDAL_MUTEX_unlock(&acc_mutex);
139 	if (context)
140 	    krb5_set_error_message(context, KRB5_CC_NOSUPP,
141 				   N_("Failed to load API cache module %s", "file"),
142 				   lib);
143 	return KRB5_CC_NOSUPP;
144     }
145 
146     init_func = (cc_initialize_func)dlsym(cc_handle, "cc_initialize");
147     set_target_uid = (void (KRB5_CALLCONV *)(uid_t))
148 	dlsym(cc_handle, "krb5_ipc_client_set_target_uid");
149     clear_target = (void (KRB5_CALLCONV *)(void))
150 	dlsym(cc_handle, "krb5_ipc_client_clear_target");
151     HEIMDAL_MUTEX_unlock(&acc_mutex);
152     if (init_func == NULL) {
153 	if (context)
154 	    krb5_set_error_message(context, KRB5_CC_NOSUPP,
155 				   N_("Failed to find cc_initialize"
156 				      "in %s: %s", "file, error"), lib, dlerror());
157 	dlclose(cc_handle);
158 	return KRB5_CC_NOSUPP;
159     }
160 
161     return 0;
162 #else
163     HEIMDAL_MUTEX_unlock(&acc_mutex);
164     if (context)
165 	krb5_set_error_message(context, KRB5_CC_NOSUPP,
166 			       N_("no support for shared object", ""));
167     return KRB5_CC_NOSUPP;
168 #endif
169 }
170 
171 void
172 _heim_krb5_ipc_client_set_target_uid(uid_t uid)
173 {
174     init_ccapi(NULL);
175     if (set_target_uid != NULL)
176         (*set_target_uid)(uid);
177 }
178 
179 void
180 _heim_krb5_ipc_client_clear_target(void)
181 {
182     init_ccapi(NULL);
183     if (clear_target != NULL)
184         (*clear_target)();
185 }
186 
187 static krb5_error_code
188 make_cred_from_ccred(krb5_context context,
189 		     const cc_credentials_v5_t *incred,
190 		     krb5_creds *cred)
191 {
192     krb5_error_code ret;
193     unsigned int i;
194 
195     memset(cred, 0, sizeof(*cred));
196 
197     ret = krb5_parse_name(context, incred->client, &cred->client);
198     if (ret)
199 	goto fail;
200 
201     ret = krb5_parse_name(context, incred->server, &cred->server);
202     if (ret)
203 	goto fail;
204 
205     cred->session.keytype = incred->keyblock.type;
206     cred->session.keyvalue.length = incred->keyblock.length;
207     cred->session.keyvalue.data = malloc(incred->keyblock.length);
208     if (cred->session.keyvalue.data == NULL)
209 	goto nomem;
210     memcpy(cred->session.keyvalue.data, incred->keyblock.data,
211 	   incred->keyblock.length);
212 
213     cred->times.authtime = incred->authtime;
214     cred->times.starttime = incred->starttime;
215     cred->times.endtime = incred->endtime;
216     cred->times.renew_till = incred->renew_till;
217 
218     ret = krb5_data_copy(&cred->ticket,
219 			 incred->ticket.data,
220 			 incred->ticket.length);
221     if (ret)
222 	goto nomem;
223 
224     ret = krb5_data_copy(&cred->second_ticket,
225 			 incred->second_ticket.data,
226 			 incred->second_ticket.length);
227     if (ret)
228 	goto nomem;
229 
230     cred->authdata.val = NULL;
231     cred->authdata.len = 0;
232 
233     cred->addresses.val = NULL;
234     cred->addresses.len = 0;
235 
236     for (i = 0; incred->authdata && incred->authdata[i]; i++)
237 	;
238 
239     if (i) {
240 	cred->authdata.val = calloc(i, sizeof(cred->authdata.val[0]));
241 	if (cred->authdata.val == NULL)
242 	    goto nomem;
243 	cred->authdata.len = i;
244 	for (i = 0; i < cred->authdata.len; i++) {
245 	    cred->authdata.val[i].ad_type = incred->authdata[i]->type;
246 	    ret = krb5_data_copy(&cred->authdata.val[i].ad_data,
247 				 incred->authdata[i]->data,
248 				 incred->authdata[i]->length);
249 	    if (ret)
250 		goto nomem;
251 	}
252     }
253 
254     for (i = 0; incred->addresses && incred->addresses[i]; i++)
255 	;
256 
257     if (i) {
258 	cred->addresses.val = calloc(i, sizeof(cred->addresses.val[0]));
259 	if (cred->addresses.val == NULL)
260 	    goto nomem;
261 	cred->addresses.len = i;
262 
263 	for (i = 0; i < cred->addresses.len; i++) {
264 	    cred->addresses.val[i].addr_type = incred->addresses[i]->type;
265 	    ret = krb5_data_copy(&cred->addresses.val[i].address,
266 				 incred->addresses[i]->data,
267 				 incred->addresses[i]->length);
268 	    if (ret)
269 		goto nomem;
270 	}
271     }
272 
273     cred->flags.i = 0;
274     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_FORWARDABLE)
275 	cred->flags.b.forwardable = 1;
276     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_FORWARDED)
277 	cred->flags.b.forwarded = 1;
278     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PROXIABLE)
279 	cred->flags.b.proxiable = 1;
280     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PROXY)
281 	cred->flags.b.proxy = 1;
282     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_MAY_POSTDATE)
283 	cred->flags.b.may_postdate = 1;
284     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_POSTDATED)
285 	cred->flags.b.postdated = 1;
286     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_INVALID)
287 	cred->flags.b.invalid = 1;
288     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_RENEWABLE)
289 	cred->flags.b.renewable = 1;
290     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_INITIAL)
291 	cred->flags.b.initial = 1;
292     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_PRE_AUTH)
293 	cred->flags.b.pre_authent = 1;
294     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_HW_AUTH)
295 	cred->flags.b.hw_authent = 1;
296     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_TRANSIT_POLICY_CHECKED)
297 	cred->flags.b.transited_policy_checked = 1;
298     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_OK_AS_DELEGATE)
299 	cred->flags.b.ok_as_delegate = 1;
300     if (incred->ticket_flags & KRB5_CCAPI_TKT_FLG_ANONYMOUS)
301 	cred->flags.b.anonymous = 1;
302 
303     return 0;
304 
305 nomem:
306     ret = ENOMEM;
307     krb5_set_error_message(context, ret, N_("malloc: out of memory", "malloc"));
308 
309 fail:
310     krb5_free_cred_contents(context, cred);
311     return ret;
312 }
313 
314 static void
315 free_ccred(cc_credentials_v5_t *cred)
316 {
317     int i;
318 
319     if (cred->addresses) {
320 	for (i = 0; cred->addresses[i] != 0; i++) {
321 	    if (cred->addresses[i]->data)
322 		free(cred->addresses[i]->data);
323 	    free(cred->addresses[i]);
324 	}
325 	free(cred->addresses);
326     }
327     if (cred->server)
328 	free(cred->server);
329     if (cred->client)
330 	free(cred->client);
331     memset(cred, 0, sizeof(*cred));
332 }
333 
334 static krb5_error_code
335 make_ccred_from_cred(krb5_context context,
336 		     const krb5_creds *incred,
337 		     cc_credentials_v5_t *cred)
338 {
339     krb5_error_code ret;
340     size_t i;
341 
342     memset(cred, 0, sizeof(*cred));
343 
344     ret = krb5_unparse_name(context, incred->client, &cred->client);
345     if (ret)
346 	goto fail;
347 
348     ret = krb5_unparse_name(context, incred->server, &cred->server);
349     if (ret)
350 	goto fail;
351 
352     cred->keyblock.type = incred->session.keytype;
353     cred->keyblock.length = incred->session.keyvalue.length;
354     cred->keyblock.data = incred->session.keyvalue.data;
355 
356     cred->authtime = incred->times.authtime;
357     cred->starttime = incred->times.starttime;
358     cred->endtime = incred->times.endtime;
359     cred->renew_till = incred->times.renew_till;
360 
361     cred->ticket.length = incred->ticket.length;
362     cred->ticket.data = incred->ticket.data;
363 
364     cred->second_ticket.length = incred->second_ticket.length;
365     cred->second_ticket.data = incred->second_ticket.data;
366 
367     /* XXX this one should also be filled in */
368     cred->authdata = NULL;
369 
370     cred->addresses = calloc(incred->addresses.len + 1,
371 			     sizeof(cred->addresses[0]));
372     if (cred->addresses == NULL) {
373 
374 	ret = ENOMEM;
375 	goto fail;
376     }
377 
378     for (i = 0; i < incred->addresses.len; i++) {
379 	cc_data *addr;
380 	addr = malloc(sizeof(*addr));
381 	if (addr == NULL) {
382 	    ret = ENOMEM;
383 	    goto fail;
384 	}
385 	addr->type = incred->addresses.val[i].addr_type;
386 	addr->length = incred->addresses.val[i].address.length;
387 	addr->data = malloc(addr->length);
388 	if (addr->data == NULL) {
389 	    free(addr);
390 	    ret = ENOMEM;
391 	    goto fail;
392 	}
393 	memcpy(addr->data, incred->addresses.val[i].address.data,
394 	       addr->length);
395 	cred->addresses[i] = addr;
396     }
397     cred->addresses[i] = NULL;
398 
399     cred->ticket_flags = 0;
400     if (incred->flags.b.forwardable)
401 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_FORWARDABLE;
402     if (incred->flags.b.forwarded)
403 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_FORWARDED;
404     if (incred->flags.b.proxiable)
405 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PROXIABLE;
406     if (incred->flags.b.proxy)
407 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PROXY;
408     if (incred->flags.b.may_postdate)
409 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_MAY_POSTDATE;
410     if (incred->flags.b.postdated)
411 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_POSTDATED;
412     if (incred->flags.b.invalid)
413 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_INVALID;
414     if (incred->flags.b.renewable)
415 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_RENEWABLE;
416     if (incred->flags.b.initial)
417 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_INITIAL;
418     if (incred->flags.b.pre_authent)
419 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_PRE_AUTH;
420     if (incred->flags.b.hw_authent)
421 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_HW_AUTH;
422     if (incred->flags.b.transited_policy_checked)
423 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_TRANSIT_POLICY_CHECKED;
424     if (incred->flags.b.ok_as_delegate)
425 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_OK_AS_DELEGATE;
426     if (incred->flags.b.anonymous)
427 	cred->ticket_flags |= KRB5_CCAPI_TKT_FLG_ANONYMOUS;
428 
429     return 0;
430 
431 fail:
432     free_ccred(cred);
433 
434     krb5_clear_error_message(context);
435     return ret;
436 }
437 
438 static cc_int32
439 get_cc_name(krb5_acc *a)
440 {
441     cc_string_t name;
442     cc_int32 error;
443 
444     error = (*a->ccache->func->get_name)(a->ccache, &name);
445     if (error)
446 	return error;
447 
448     a->cache_name = strdup(name->data);
449     (*name->func->release)(name);
450     if (a->cache_name == NULL)
451 	return ccErrNoMem;
452     return ccNoError;
453 }
454 
455 
456 static const char* KRB5_CALLCONV
457 acc_get_name(krb5_context context,
458 	     krb5_ccache id)
459 {
460     krb5_acc *a = ACACHE(id);
461     int32_t error;
462 
463     if (a->cache_name == NULL) {
464 	krb5_error_code ret;
465 	krb5_principal principal;
466 	char *name;
467 
468 	ret = _krb5_get_default_principal_local(context, &principal);
469 	if (ret)
470 	    return NULL;
471 
472 	ret = krb5_unparse_name(context, principal, &name);
473 	krb5_free_principal(context, principal);
474 	if (ret)
475 	    return NULL;
476 
477 	error = (*a->context->func->create_new_ccache)(a->context,
478 						       cc_credentials_v5,
479 						       name,
480 						       &a->ccache);
481 	krb5_xfree(name);
482 	if (error)
483 	    return NULL;
484 
485 	error = get_cc_name(a);
486 	if (error)
487 	    return NULL;
488     }
489 
490     return a->cache_name;
491 }
492 
493 static krb5_error_code KRB5_CALLCONV
494 acc_alloc(krb5_context context, krb5_ccache *id)
495 {
496     krb5_error_code ret;
497     cc_int32 error;
498     krb5_acc *a;
499 
500     ret = init_ccapi(context);
501     if (ret)
502 	return ret;
503 
504     ret = krb5_data_alloc(&(*id)->data, sizeof(*a));
505     if (ret) {
506 	krb5_clear_error_message(context);
507 	return ret;
508     }
509 
510     a = ACACHE(*id);
511 
512     error = (*init_func)(&a->context, ccapi_version_3, NULL, NULL);
513     if (error) {
514 	krb5_data_free(&(*id)->data);
515 	return translate_cc_error(context, error);
516     }
517 
518     a->cache_name = NULL;
519 
520     return 0;
521 }
522 
523 static krb5_error_code KRB5_CALLCONV
524 acc_resolve(krb5_context context, krb5_ccache *id, const char *res)
525 {
526     krb5_error_code ret;
527     cc_int32 error;
528     krb5_acc *a;
529 
530     ret = acc_alloc(context, id);
531     if (ret)
532 	return ret;
533 
534     a = ACACHE(*id);
535 
536     error = (*a->context->func->open_ccache)(a->context, res, &a->ccache);
537     if (error == ccNoError) {
538 	cc_time_t offset;
539 	error = get_cc_name(a);
540 	if (error != ccNoError) {
541 	    acc_close(context, *id);
542 	    *id = NULL;
543 	    return translate_cc_error(context, error);
544 	}
545 
546 	error = (*a->ccache->func->get_kdc_time_offset)(a->ccache,
547 							cc_credentials_v5,
548 							&offset);
549 	if (error == 0)
550 	    context->kdc_sec_offset = offset;
551 
552     } else if (error == ccErrCCacheNotFound) {
553 	a->ccache = NULL;
554 	a->cache_name = NULL;
555     } else {
556 	*id = NULL;
557 	return translate_cc_error(context, error);
558     }
559 
560     return 0;
561 }
562 
563 static krb5_error_code KRB5_CALLCONV
564 acc_gen_new(krb5_context context, krb5_ccache *id)
565 {
566     krb5_error_code ret;
567     krb5_acc *a;
568 
569     ret = acc_alloc(context, id);
570     if (ret)
571 	return ret;
572 
573     a = ACACHE(*id);
574 
575     a->ccache = NULL;
576     a->cache_name = NULL;
577 
578     return 0;
579 }
580 
581 static krb5_error_code KRB5_CALLCONV
582 acc_initialize(krb5_context context,
583 	       krb5_ccache id,
584 	       krb5_principal primary_principal)
585 {
586     krb5_acc *a = ACACHE(id);
587     krb5_error_code ret;
588     int32_t error;
589     char *name;
590 
591     ret = krb5_unparse_name(context, primary_principal, &name);
592     if (ret)
593 	return ret;
594 
595     if (a->cache_name == NULL) {
596 	error = (*a->context->func->create_new_ccache)(a->context,
597 						       cc_credentials_v5,
598 						       name,
599 						       &a->ccache);
600 	free(name);
601 	if (error == ccNoError)
602 	    error = get_cc_name(a);
603     } else {
604 	cc_credentials_iterator_t iter;
605 	cc_credentials_t ccred;
606 
607 	error = (*a->ccache->func->new_credentials_iterator)(a->ccache, &iter);
608 	if (error) {
609 	    free(name);
610 	    return translate_cc_error(context, error);
611 	}
612 
613 	while (1) {
614 	    error = (*iter->func->next)(iter, &ccred);
615 	    if (error)
616 		break;
617 	    (*a->ccache->func->remove_credentials)(a->ccache, ccred);
618 	    (*ccred->func->release)(ccred);
619 	}
620 	(*iter->func->release)(iter);
621 
622 	error = (*a->ccache->func->set_principal)(a->ccache,
623 						  cc_credentials_v5,
624 						  name);
625     }
626 
627     if (error == 0 && context->kdc_sec_offset)
628 	error = (*a->ccache->func->set_kdc_time_offset)(a->ccache,
629 							cc_credentials_v5,
630 							context->kdc_sec_offset);
631 
632     return translate_cc_error(context, error);
633 }
634 
635 static krb5_error_code KRB5_CALLCONV
636 acc_close(krb5_context context,
637 	  krb5_ccache id)
638 {
639     krb5_acc *a = ACACHE(id);
640 
641     if (a->ccache) {
642 	(*a->ccache->func->release)(a->ccache);
643 	a->ccache = NULL;
644     }
645     if (a->cache_name) {
646 	free(a->cache_name);
647 	a->cache_name = NULL;
648     }
649     if (a->context) {
650 	(*a->context->func->release)(a->context);
651 	a->context = NULL;
652     }
653     krb5_data_free(&id->data);
654     return 0;
655 }
656 
657 static krb5_error_code KRB5_CALLCONV
658 acc_destroy(krb5_context context,
659 	    krb5_ccache id)
660 {
661     krb5_acc *a = ACACHE(id);
662     cc_int32 error = 0;
663 
664     if (a->ccache) {
665 	error = (*a->ccache->func->destroy)(a->ccache);
666 	a->ccache = NULL;
667     }
668     if (a->context) {
669 	error = (a->context->func->release)(a->context);
670 	a->context = NULL;
671     }
672     return translate_cc_error(context, error);
673 }
674 
675 static krb5_error_code KRB5_CALLCONV
676 acc_store_cred(krb5_context context,
677 	       krb5_ccache id,
678 	       krb5_creds *creds)
679 {
680     krb5_acc *a = ACACHE(id);
681     cc_credentials_union cred;
682     cc_credentials_v5_t v5cred;
683     krb5_error_code ret;
684     cc_int32 error;
685 
686     if (a->ccache == NULL) {
687 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
688 			       N_("No API credential found", ""));
689 	return KRB5_CC_NOTFOUND;
690     }
691 
692     cred.version = cc_credentials_v5;
693     cred.credentials.credentials_v5 = &v5cred;
694 
695     ret = make_ccred_from_cred(context,
696 			       creds,
697 			       &v5cred);
698     if (ret)
699 	return ret;
700 
701     error = (*a->ccache->func->store_credentials)(a->ccache, &cred);
702     if (error)
703 	ret = translate_cc_error(context, error);
704 
705     free_ccred(&v5cred);
706 
707     return ret;
708 }
709 
710 static krb5_error_code KRB5_CALLCONV
711 acc_get_principal(krb5_context context,
712 		  krb5_ccache id,
713 		  krb5_principal *principal)
714 {
715     krb5_acc *a = ACACHE(id);
716     krb5_error_code ret;
717     int32_t error;
718     cc_string_t name;
719 
720     if (a->ccache == NULL) {
721 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
722 			       N_("No API credential found", ""));
723 	return KRB5_CC_NOTFOUND;
724     }
725 
726     error = (*a->ccache->func->get_principal)(a->ccache,
727 					      cc_credentials_v5,
728 					      &name);
729     if (error)
730 	return translate_cc_error(context, error);
731 
732     ret = krb5_parse_name(context, name->data, principal);
733 
734     (*name->func->release)(name);
735     return ret;
736 }
737 
738 static krb5_error_code KRB5_CALLCONV
739 acc_get_first (krb5_context context,
740 	       krb5_ccache id,
741 	       krb5_cc_cursor *cursor)
742 {
743     cc_credentials_iterator_t iter;
744     krb5_acc *a = ACACHE(id);
745     int32_t error;
746 
747     if (a->ccache == NULL) {
748 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
749 			       N_("No API credential found", ""));
750 	return KRB5_CC_NOTFOUND;
751     }
752 
753     error = (*a->ccache->func->new_credentials_iterator)(a->ccache, &iter);
754     if (error) {
755 	krb5_clear_error_message(context);
756 	return ENOENT;
757     }
758     *cursor = iter;
759     return 0;
760 }
761 
762 
763 static krb5_error_code KRB5_CALLCONV
764 acc_get_next (krb5_context context,
765 	      krb5_ccache id,
766 	      krb5_cc_cursor *cursor,
767 	      krb5_creds *creds)
768 {
769     cc_credentials_iterator_t iter = *cursor;
770     cc_credentials_t cred;
771     krb5_error_code ret;
772     int32_t error;
773 
774     while (1) {
775 	error = (*iter->func->next)(iter, &cred);
776 	if (error)
777 	    return translate_cc_error(context, error);
778 	if (cred->data->version == cc_credentials_v5)
779 	    break;
780 	(*cred->func->release)(cred);
781     }
782 
783     ret = make_cred_from_ccred(context,
784 			       cred->data->credentials.credentials_v5,
785 			       creds);
786     (*cred->func->release)(cred);
787     return ret;
788 }
789 
790 static krb5_error_code KRB5_CALLCONV
791 acc_end_get (krb5_context context,
792 	     krb5_ccache id,
793 	     krb5_cc_cursor *cursor)
794 {
795     cc_credentials_iterator_t iter = *cursor;
796     (*iter->func->release)(iter);
797     return 0;
798 }
799 
800 static krb5_error_code KRB5_CALLCONV
801 acc_remove_cred(krb5_context context,
802 		krb5_ccache id,
803 		krb5_flags which,
804 		krb5_creds *cred)
805 {
806     cc_credentials_iterator_t iter;
807     krb5_acc *a = ACACHE(id);
808     cc_credentials_t ccred;
809     krb5_error_code ret;
810     cc_int32 error;
811     char *client, *server;
812 
813     if (a->ccache == NULL) {
814 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
815 			       N_("No API credential found", ""));
816 	return KRB5_CC_NOTFOUND;
817     }
818 
819     if (cred->client) {
820 	ret = krb5_unparse_name(context, cred->client, &client);
821 	if (ret)
822 	    return ret;
823     } else
824 	client = NULL;
825 
826     ret = krb5_unparse_name(context, cred->server, &server);
827     if (ret) {
828 	free(client);
829 	return ret;
830     }
831 
832     error = (*a->ccache->func->new_credentials_iterator)(a->ccache, &iter);
833     if (error) {
834 	free(server);
835 	free(client);
836 	return translate_cc_error(context, error);
837     }
838 
839     ret = KRB5_CC_NOTFOUND;
840     while (1) {
841 	cc_credentials_v5_t *v5cred;
842 
843 	error = (*iter->func->next)(iter, &ccred);
844 	if (error)
845 	    break;
846 
847 	if (ccred->data->version != cc_credentials_v5)
848 	    goto next;
849 
850 	v5cred = ccred->data->credentials.credentials_v5;
851 
852 	if (client && strcmp(v5cred->client, client) != 0)
853 	    goto next;
854 
855 	if (strcmp(v5cred->server, server) != 0)
856 	    goto next;
857 
858 	(*a->ccache->func->remove_credentials)(a->ccache, ccred);
859 	ret = 0;
860     next:
861 	(*ccred->func->release)(ccred);
862     }
863 
864     (*iter->func->release)(iter);
865 
866     if (ret)
867 	krb5_set_error_message(context, ret,
868 			       N_("Can't find credential %s in cache",
869 				 "principal"), server);
870     free(server);
871     free(client);
872 
873     return ret;
874 }
875 
876 static krb5_error_code KRB5_CALLCONV
877 acc_set_flags(krb5_context context,
878 	      krb5_ccache id,
879 	      krb5_flags flags)
880 {
881     return 0;
882 }
883 
884 static int KRB5_CALLCONV
885 acc_get_version(krb5_context context,
886 		krb5_ccache id)
887 {
888     return 0;
889 }
890 
891 struct cache_iter {
892     cc_context_t context;
893     cc_ccache_iterator_t iter;
894 };
895 
896 static krb5_error_code KRB5_CALLCONV
897 acc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
898 {
899     struct cache_iter *iter;
900     krb5_error_code ret;
901     cc_int32 error;
902 
903     ret = init_ccapi(context);
904     if (ret)
905 	return ret;
906 
907     iter = calloc(1, sizeof(*iter));
908     if (iter == NULL) {
909 	krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
910 	return ENOMEM;
911     }
912 
913     error = (*init_func)(&iter->context, ccapi_version_3, NULL, NULL);
914     if (error) {
915 	free(iter);
916 	return translate_cc_error(context, error);
917     }
918 
919     error = (*iter->context->func->new_ccache_iterator)(iter->context,
920 							&iter->iter);
921     if (error) {
922 	free(iter);
923 	krb5_clear_error_message(context);
924 	return ENOENT;
925     }
926     *cursor = iter;
927     return 0;
928 }
929 
930 static krb5_error_code KRB5_CALLCONV
931 acc_get_cache_next(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
932 {
933     struct cache_iter *iter = cursor;
934     cc_ccache_t cache;
935     krb5_acc *a;
936     krb5_error_code ret;
937     int32_t error;
938 
939     error = (*iter->iter->func->next)(iter->iter, &cache);
940     if (error)
941 	return translate_cc_error(context, error);
942 
943     ret = _krb5_cc_allocate(context, &krb5_acc_ops, id);
944     if (ret) {
945 	(*cache->func->release)(cache);
946 	return ret;
947     }
948 
949     ret = acc_alloc(context, id);
950     if (ret) {
951 	(*cache->func->release)(cache);
952 	free(*id);
953 	return ret;
954     }
955 
956     a = ACACHE(*id);
957     a->ccache = cache;
958 
959     error = get_cc_name(a);
960     if (error) {
961 	acc_close(context, *id);
962 	*id = NULL;
963 	return translate_cc_error(context, error);
964     }
965     return 0;
966 }
967 
968 static krb5_error_code KRB5_CALLCONV
969 acc_end_cache_get(krb5_context context, krb5_cc_cursor cursor)
970 {
971     struct cache_iter *iter = cursor;
972 
973     (*iter->iter->func->release)(iter->iter);
974     iter->iter = NULL;
975     (*iter->context->func->release)(iter->context);
976     iter->context = NULL;
977     free(iter);
978     return 0;
979 }
980 
981 static krb5_error_code KRB5_CALLCONV
982 acc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
983 {
984     krb5_acc *afrom = ACACHE(from);
985     krb5_acc *ato = ACACHE(to);
986     int32_t error;
987 
988     if (ato->ccache == NULL) {
989 	cc_string_t name;
990 
991 	error = (*afrom->ccache->func->get_principal)(afrom->ccache,
992 						      cc_credentials_v5,
993 						      &name);
994 	if (error)
995 	    return translate_cc_error(context, error);
996 
997 	error = (*ato->context->func->create_new_ccache)(ato->context,
998 							 cc_credentials_v5,
999 							 name->data,
1000 							 &ato->ccache);
1001 	(*name->func->release)(name);
1002 	if (error)
1003 	    return translate_cc_error(context, error);
1004     }
1005 
1006     error = (*ato->ccache->func->move)(afrom->ccache, ato->ccache);
1007 
1008     acc_destroy(context, from);
1009 
1010     return translate_cc_error(context, error);
1011 }
1012 
1013 static krb5_error_code KRB5_CALLCONV
1014 acc_get_default_name(krb5_context context, char **str)
1015 {
1016     krb5_error_code ret;
1017     cc_context_t cc;
1018     cc_string_t name;
1019     int32_t error;
1020 
1021     ret = init_ccapi(context);
1022     if (ret)
1023 	return ret;
1024 
1025     error = (*init_func)(&cc, ccapi_version_3, NULL, NULL);
1026     if (error)
1027 	return translate_cc_error(context, error);
1028 
1029     error = (*cc->func->get_default_ccache_name)(cc, &name);
1030     if (error) {
1031 	(*cc->func->release)(cc);
1032 	return translate_cc_error(context, error);
1033     }
1034 
1035     error = asprintf(str, "API:%s", name->data);
1036     (*name->func->release)(name);
1037     (*cc->func->release)(cc);
1038 
1039     if (error < 0 || *str == NULL) {
1040 	krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1041 	return ENOMEM;
1042     }
1043     return 0;
1044 }
1045 
1046 static krb5_error_code KRB5_CALLCONV
1047 acc_set_default(krb5_context context, krb5_ccache id)
1048 {
1049     krb5_acc *a = ACACHE(id);
1050     cc_int32 error;
1051 
1052     if (a->ccache == NULL) {
1053 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
1054 			       N_("No API credential found", ""));
1055 	return KRB5_CC_NOTFOUND;
1056     }
1057 
1058     error = (*a->ccache->func->set_default)(a->ccache);
1059     if (error)
1060 	return translate_cc_error(context, error);
1061 
1062     return 0;
1063 }
1064 
1065 static krb5_error_code KRB5_CALLCONV
1066 acc_lastchange(krb5_context context, krb5_ccache id, krb5_timestamp *mtime)
1067 {
1068     krb5_acc *a = ACACHE(id);
1069     cc_int32 error;
1070     cc_time_t t;
1071 
1072     if (a->ccache == NULL) {
1073 	krb5_set_error_message(context, KRB5_CC_NOTFOUND,
1074 			       N_("No API credential found", ""));
1075 	return KRB5_CC_NOTFOUND;
1076     }
1077 
1078     error = (*a->ccache->func->get_change_time)(a->ccache, &t);
1079     if (error)
1080 	return translate_cc_error(context, error);
1081 
1082     *mtime = t;
1083 
1084     return 0;
1085 }
1086 
1087 /**
1088  * Variable containing the API based credential cache implemention.
1089  *
1090  * @ingroup krb5_ccache
1091  */
1092 
1093 KRB5_LIB_VARIABLE const krb5_cc_ops krb5_acc_ops = {
1094     KRB5_CC_OPS_VERSION,
1095     "API",
1096     acc_get_name,
1097     acc_resolve,
1098     acc_gen_new,
1099     acc_initialize,
1100     acc_destroy,
1101     acc_close,
1102     acc_store_cred,
1103     NULL, /* acc_retrieve */
1104     acc_get_principal,
1105     acc_get_first,
1106     acc_get_next,
1107     acc_end_get,
1108     acc_remove_cred,
1109     acc_set_flags,
1110     acc_get_version,
1111     acc_get_cache_first,
1112     acc_get_cache_next,
1113     acc_end_cache_get,
1114     acc_move,
1115     acc_get_default_name,
1116     acc_set_default,
1117     acc_lastchange,
1118     NULL,
1119     NULL,
1120 };
1121 
1122 #endif
1123