krb5_error_code KRB5_LIB_FUNCTION
krb5_get_server_rcache(krb5_context context,
const krb5_data *piece,
krb5_rcache *id)
{
krb5_rcache rcache;
krb5_error_code ret;
char *tmp = malloc(4 * piece->length + 1);
char *name;
if(tmp == NULL) {
krb5_set_error_string (context, "malloc: out of memory");
return ENOMEM;
}
strvisx(tmp, piece->data, piece->length, VIS_WHITE | VIS_OCTAL);
#ifdef HAVE_GETEUID
asprintf(&name, "FILE:rc_%s_%u", tmp, (unsigned)geteuid());
#else
asprintf(&name, "FILE:rc_%s", tmp);
#endif
free(tmp);
if(name == NULL) {
krb5_set_error_string (context, "malloc: out of memory");
return ENOMEM;
}
ret = krb5_rc_resolve_full(context, &rcache, name);
free(name);
if(ret)
return ret;
*id = rcache;
return ret;
}
/*
* krb5_rcache_internalize() - Internalize the krb5_rcache.
*/
static krb5_error_code
krb5_rcache_internalize(krb5_context kcontext, krb5_pointer *argp, krb5_octet **buffer, size_t *lenremain)
{
krb5_error_code kret;
krb5_rcache rcache = NULL;
krb5_int32 ibuf;
krb5_octet *bp;
size_t remain;
char *rcname = NULL;
bp = *buffer;
remain = *lenremain;
/* Read our magic number */
if (krb5_ser_unpack_int32(&ibuf, &bp, &remain) || ibuf != KV5M_RCACHE)
return EINVAL;
/* Get the length of the rcache name */
kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain);
if (kret)
return kret;
/* Get the rcache name. */
rcname = malloc(ibuf + 1);
if (!rcname)
return ENOMEM;
kret = krb5_ser_unpack_bytes((krb5_octet*)rcname, (size_t) ibuf,
&bp, &remain);
if (kret)
goto cleanup;
rcname[ibuf] = '\0';
/* Resolve and recover the rcache. */
kret = krb5_rc_resolve_full(kcontext, &rcache, rcname);
if (kret)
goto cleanup;
krb5_rc_recover(kcontext, rcache);
/* Read our magic number again. */
kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain);
if (kret)
goto cleanup;
if (ibuf != KV5M_RCACHE) {
kret = EINVAL;
goto cleanup;
}
*buffer = bp;
*lenremain = remain;
*argp = (krb5_pointer) rcache;
cleanup:
free(rcname);
if (kret != 0 && rcache)
krb5_rc_close(kcontext, rcache);
return kret;
}
/*
* krb5_rcache_internalize() - Internalize the krb5_rcache.
*/
static krb5_error_code
krb5_rcache_internalize(krb5_context kcontext, krb5_pointer *argp, krb5_octet **buffer, size_t *lenremain)
{
krb5_error_code kret;
krb5_rcache rcache;
krb5_int32 ibuf;
krb5_octet *bp;
size_t remain;
char *rcname;
bp = *buffer;
remain = *lenremain;
kret = EINVAL;
/* Read our magic number */
if (krb5_ser_unpack_int32(&ibuf, &bp, &remain))
ibuf = 0;
if (ibuf == KV5M_RCACHE) {
kret = ENOMEM;
/* Get the length of the rcache name */
kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain);
if (!kret &&
(rcname = (char *) malloc((size_t) (ibuf+1))) &&
!(kret = krb5_ser_unpack_bytes((krb5_octet *) rcname,
(size_t) ibuf,
&bp, &remain))) {
rcname[ibuf] = '\0';
if (!(kret = krb5_rc_resolve_full(kcontext, &rcache, rcname))) {
(void) krb5_rc_close(kcontext, rcache);
(void) krb5_rc_recover(kcontext, rcache);
if (!kret &&
!(kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain)) &&
(ibuf == KV5M_RCACHE)) {
*buffer = bp;
*lenremain = remain;
*argp = (krb5_pointer) rcache;
}
else
(void)krb5_rc_close(kcontext, rcache);
}
free(rcname);
}
}
return(kret);
}
/* Convert a JSON value to an rcache handle or to NULL. */
static int
json_to_rcache(krb5_context context, k5_json_value v, krb5_rcache *rcache_out)
{
krb5_rcache rcache;
*rcache_out = NULL;
if (k5_json_get_tid(v) == K5_JSON_TID_NULL)
return 0;
if (k5_json_get_tid(v) != K5_JSON_TID_STRING)
return -1;
if (krb5_rc_resolve_full(context, &rcache, (char *)k5_json_string_utf8(v)))
return -1;
if (krb5_rc_recover_or_initialize(context, rcache, context->clockskew)) {
krb5_rc_close(context, rcache);
return -1;
}
*rcache_out = rcache;
return 0;
}
static void
store(krb5_context ctx, char *rcspec, char *client, char *server, char *msg,
krb5_timestamp timestamp, krb5_int32 usec, krb5_timestamp now_timestamp,
krb5_int32 now_usec)
{
krb5_rcache rc = NULL;
krb5_error_code retval = 0;
char *hash = NULL;
krb5_donot_replay rep;
krb5_data d;
if (now_timestamp != 0)
krb5_set_debugging_time(ctx, now_timestamp, now_usec);
if ((retval = krb5_rc_resolve_full(ctx, &rc, rcspec)))
goto cleanup;
if ((retval = krb5_rc_recover_or_initialize(ctx, rc, ctx->clockskew)))
goto cleanup;
if (msg) {
d.data = msg;
d.length = strlen(msg);
if ((retval = krb5_rc_hash_message(ctx, &d, &hash)))
goto cleanup;
}
rep.client = client;
rep.server = server;
rep.msghash = hash;
rep.cusec = usec;
rep.ctime = timestamp;
retval = krb5_rc_store(ctx, rc, &rep);
cleanup:
if (retval == KRB5KRB_AP_ERR_REPEAT)
printf("Replay\n");
else if (!retval)
printf("Entry successfully stored\n");
else
fprintf(stderr, "Failure: %s\n", krb5_get_error_message(ctx, retval));
if (rc)
krb5_rc_close(ctx, rc);
if (hash)
free(hash);
}
static void
expunge(krb5_context ctx, char *rcspec, krb5_timestamp now_timestamp,
krb5_int32 now_usec)
{
krb5_rcache rc = NULL;
krb5_error_code retval = 0;
if (now_timestamp > 0)
krb5_set_debugging_time(ctx, now_timestamp, now_usec);
if ((retval = krb5_rc_resolve_full(ctx, &rc, rcspec)))
goto cleanup;
if ((retval = krb5_rc_recover_or_initialize(ctx, rc, ctx->clockskew)))
goto cleanup;
retval = krb5_rc_expunge(ctx, rc);
cleanup:
if (!retval)
printf("Cache successfully expunged\n");
else
fprintf(stderr, "Failure: %s\n", krb5_get_error_message(ctx, retval));
if (rc)
krb5_rc_close(ctx, rc);
}
/*
* Serialize krb5_rcache.
*/
static krb5_error_code
ser_rcache_test(krb5_context kcontext, int verbose)
{
krb5_error_code kret;
char rcname[128];
krb5_rcache rcache;
snprintf(rcname, sizeof(rcname), "dfl:temp_rc_%d", (int) getpid());
if (!(kret = krb5_rc_resolve_full(kcontext, &rcache, rcname)) &&
!(kret = ser_data(verbose, "> Resolved FILE rcache",
(krb5_pointer) rcache, KV5M_RCACHE)) &&
!(kret = krb5_rc_initialize(kcontext, rcache, 3600*24)) &&
!(kret = ser_data(verbose, "> Initialized FILE rcache",
(krb5_pointer) rcache, KV5M_RCACHE)) &&
!(kret = krb5_rc_destroy(kcontext, rcache))) {
if (verbose)
printf("* rcache test succeeded\n");
}
if (kret)
printf("* krb5_rcache test failed\n");
return(kret);
}
krb5_error_code KRB5_CALLCONV
krb5_get_server_rcache(krb5_context context, const krb5_data *piece,
krb5_rcache *rcptr)
{
krb5_rcache rcache = 0;
char *cachename = 0, *def_env = 0, *cachetype;
char tmp[4], *full_name;
krb5_error_code retval;
int p, i;
unsigned int len;
#ifdef HAVE_GETEUID
unsigned long tens;
unsigned long uid = geteuid();
#endif
if (piece == NULL)
return ENOMEM;
cachetype = krb5_rc_default_type(context);
/*
* Solaris Kerberos: Check to see if something other than the default replay
* cache name will be used. If so then skip over the construction of
* said name.
*/
if ((def_env = krb5_rc_default_name(context)) != 0) {
cachename = strdup(def_env);
if (cachename == NULL)
return (ENOMEM);
/*
* We expect to have the fully qualified rcache name (<type>:<name>),
* so we populate the default type here if the type is missing.
*/
if (strchr(cachename, ':') == NULL) {
full_name = malloc(strlen(cachetype) + 1 +
strlen(cachename) + 1);
if (full_name == NULL) {
free(cachename);
return(ENOMEM);
}
(void) sprintf(full_name, "%s:%s", cachetype, cachename);
free(cachename);
cachename = full_name;
}
goto skip_create;
}
len = piece->length + 3 + 1;
for (i = 0; i < piece->length; i++) {
if (piece->data[i] == '-')
len++;
else if (!isvalidrcname((int) piece->data[i]))
len += 3;
}
#ifdef HAVE_GETEUID
len += 2; /* _<uid> */
for (tens = 1; (uid / tens) > 9 ; tens *= 10)
len++;
#endif
cachename = malloc(strlen(cachetype) + 5 + len);
if (!cachename) {
retval = ENOMEM;
goto cleanup;
}
strcpy(cachename, cachetype);
p = strlen(cachename);
cachename[p++] = ':';
for (i = 0; i < piece->length; i++) {
if (piece->data[i] == '-') {
cachename[p++] = '-';
cachename[p++] = '-';
continue;
}
if (!isvalidrcname((int) piece->data[i])) {
sprintf(tmp, "%03o", piece->data[i]);
cachename[p++] = '-';
cachename[p++] = tmp[0];
cachename[p++] = tmp[1];
cachename[p++] = tmp[2];
continue;
}
cachename[p++] = piece->data[i];
}
#ifdef HAVE_GETEUID
cachename[p++] = '_';
while (tens) {
cachename[p++] = '0' + ((uid / tens) % 10);
tens /= 10;
}
#endif
cachename[p++] = '\0';
skip_create:
retval = krb5_rc_resolve_full(context, &rcache, cachename);
if (retval) {
rcache = 0;
goto cleanup;
}
/*
* First try to recover the replay cache; if that doesn't work,
* initialize it.
*/
retval = krb5_rc_recover_or_initialize(context, rcache, context->clockskew);
if (retval) {
krb5_rc_close(context, rcache);
rcache = 0;
goto cleanup;
}
*rcptr = rcache;
rcache = 0;
retval = 0;
cleanup:
if (rcache)
krb5_xfree(rcache);
if (cachename)
krb5_xfree(cachename);
return retval;
}
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_rc_default(krb5_context context,
krb5_rcache *id)
{
return krb5_rc_resolve_full(context, id, krb5_rc_default_name(context));
}
