static int
dump_one (krb5_context context, HDB *db, hdb_entry_ex *entry, void *v)
{
krb5_error_code ret;
krb5_storage *dump = (krb5_storage *)v;
krb5_storage *sp;
krb5_data data;
ret = hdb_entry2value (context, &entry->entry, &data);
if (ret)
return ret;
ret = krb5_data_realloc (&data, data.length + 4);
if (ret)
goto done;
memmove ((char *)data.data + 4, data.data, data.length - 4);
sp = krb5_storage_from_data(&data);
if (sp == NULL) {
ret = ENOMEM;
goto done;
}
ret = krb5_store_uint32(sp, ONE_PRINC);
krb5_storage_free(sp);
if (ret == 0)
ret = krb5_store_data(dump, data);
done:
krb5_data_free (&data);
return ret;
}
static int
prop_one (krb5_context context, HDB *db, hdb_entry *entry, void *v)
{
krb5_error_code ret;
krb5_storage *sp;
krb5_data data;
struct slave *slave = (struct slave *)v;
ret = hdb_entry2value (context, entry, &data);
if (ret)
return ret;
ret = krb5_data_realloc (&data, data.length + 4);
if (ret) {
krb5_data_free (&data);
return ret;
}
memmove ((char *)data.data + 4, data.data, data.length - 4);
sp = krb5_storage_from_data(&data);
if (sp == NULL) {
krb5_data_free (&data);
return ENOMEM;
}
krb5_store_int32(sp, ONE_PRINC);
krb5_storage_free(sp);
ret = krb5_write_priv_message (context, slave->ac, &slave->fd, &data);
krb5_data_free (&data);
return ret;
}
kadm5_ret_t
kadm5_log_modify (kadm5_server_context *context,
hdb_entry *ent,
u_int32_t mask)
{
krb5_storage *sp;
kadm5_ret_t ret;
krb5_data value;
u_int32_t len;
kadm5_log_context *log_context = &context->log_context;
krb5_data_zero(&value);
sp = krb5_storage_emem();
ret = hdb_entry2value (context->context, ent, &value);
if (ret)
goto failed;
ret = kadm5_log_preamble (context, sp, kadm_modify);
if (ret)
goto failed;
len = value.length + 4;
ret = krb5_store_int32 (sp, len);
if (ret)
goto failed;
ret = krb5_store_int32 (sp, mask);
if (ret)
goto failed;
krb5_storage_write (sp, value.data, value.length);
ret = krb5_store_int32 (sp, len);
if (ret)
goto failed;
ret = kadm5_log_postamble (log_context, sp);
if (ret)
goto failed;
ret = kadm5_log_flush (log_context, sp);
if (ret)
goto failed;
krb5_data_free(&value);
krb5_storage_free (sp);
return kadm5_log_end (context);
failed:
krb5_data_free(&value);
krb5_storage_free(sp);
return ret;
}
kadm5_ret_t
kadm5_log_create (kadm5_server_context *context,
hdb_entry *ent)
{
krb5_storage *sp;
kadm5_ret_t ret;
krb5_data value;
kadm5_log_context *log_context = &context->log_context;
sp = krb5_storage_emem();
ret = hdb_entry2value (context->context, ent, &value);
if (ret) {
krb5_storage_free(sp);
return ret;
}
ret = kadm5_log_preamble (context, sp, kadm_create);
if (ret) {
krb5_data_free (&value);
krb5_storage_free(sp);
return ret;
}
krb5_store_int32 (sp, value.length);
krb5_storage_write(sp, value.data, value.length);
krb5_store_int32 (sp, value.length);
krb5_data_free (&value);
ret = kadm5_log_postamble (log_context, sp);
if (ret) {
krb5_storage_free (sp);
return ret;
}
ret = kadm5_log_flush (log_context, sp);
krb5_storage_free (sp);
if (ret)
return ret;
ret = kadm5_log_end (context);
return ret;
}
krb5_error_code
v5_prop(krb5_context context, HDB *db, hdb_entry_ex *entry, void *appdata)
{
krb5_error_code ret;
struct prop_data *pd = appdata;
krb5_data data;
if(encrypt_flag) {
ret = hdb_seal_keys_mkey(context, &entry->entry, mkey5);
if (ret) {
krb5_warn(context, ret, "hdb_seal_keys_mkey");
return ret;
}
}
if(decrypt_flag) {
ret = hdb_unseal_keys_mkey(context, &entry->entry, mkey5);
if (ret) {
krb5_warn(context, ret, "hdb_unseal_keys_mkey");
return ret;
}
}
ret = hdb_entry2value(context, &entry->entry, &data);
if(ret) {
krb5_warn(context, ret, "hdb_entry2value");
return ret;
}
if(to_stdout)
ret = krb5_write_message(context, &pd->sock, &data);
else
ret = krb5_write_priv_message(context, pd->auth_context,
&pd->sock, &data);
krb5_data_free(&data);
return ret;
}
/**
* Stores an hdb_entry in the database. If flags contains HDB_F_REPLACE
* a previous entry may be replaced.
*
* @param context The current krb5_context
* @param db Heimdal database handle
* @param flags May currently only contain HDB_F_REPLACE
* @param entry The data to store
*
* @return 0 if everything worked, an error code if not
*/
static krb5_error_code
hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
hdb_entry_ex *entry)
{
int ret;
int i;
sqlite_int64 entry_id;
char *principal_string = NULL;
char *alias_string;
const HDB_Ext_Aliases *aliases;
hdb_sqlite_db *hsdb = (hdb_sqlite_db *)(db->hdb_db);
krb5_data value;
sqlite3_stmt *get_ids = hsdb->get_ids;
ret = hdb_sqlite_exec_stmt(context, hsdb->db,
"BEGIN IMMEDIATE TRANSACTION", EINVAL);
if(ret != SQLITE_OK) {
krb5_set_error_string(context, "SQLite BEGIN TRANSACTION failed: %s",
sqlite3_errmsg(hsdb->db));
goto rollback;
}
ret = krb5_unparse_name(context,
entry->entry.principal, &principal_string);
if (ret) {
goto rollback;
}
ret = hdb_seal_keys(context, db, &entry->entry);
if(ret) {
goto rollback;
}
ret = hdb_entry2value(context, &entry->entry, &value);
if(ret) {
goto rollback;
}
sqlite3_bind_text(get_ids, 1, principal_string, -1, SQLITE_STATIC);
ret = hdb_sqlite_step(context, hsdb->db, get_ids);
if(ret == SQLITE_DONE) { /* No such principal */
sqlite3_bind_blob(hsdb->add_entry, 1,
value.data, value.length, SQLITE_STATIC);
ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_entry);
sqlite3_clear_bindings(hsdb->add_entry);
sqlite3_reset(hsdb->add_entry);
if(ret != SQLITE_DONE)
goto rollback;
sqlite3_bind_text(hsdb->add_principal, 1,
principal_string, -1, SQLITE_STATIC);
ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_principal);
sqlite3_clear_bindings(hsdb->add_principal);
sqlite3_reset(hsdb->add_principal);
if(ret != SQLITE_DONE)
goto rollback;
entry_id = sqlite3_column_int64(get_ids, 1);
} else if(ret == SQLITE_ROW) { /* Found a principal */
if(! (flags & HDB_F_REPLACE)) /* Not allowed to replace it */
goto rollback;
entry_id = sqlite3_column_int64(get_ids, 1);
sqlite3_bind_int64(hsdb->delete_aliases, 1, entry_id);
ret = hdb_sqlite_step_once(context, db, hsdb->delete_aliases);
if(ret != SQLITE_DONE)
goto rollback;
sqlite3_bind_blob(hsdb->update_entry, 1,
value.data, value.length, SQLITE_STATIC);
sqlite3_bind_int64(hsdb->update_entry, 2, entry_id);
ret = hdb_sqlite_step_once(context, db, hsdb->update_entry);
if(ret != SQLITE_DONE)
goto rollback;
} else {
/* Error! */
goto rollback;
}
ret = hdb_entry_get_aliases(&entry->entry, &aliases);
if(ret || aliases == NULL)
goto commit;
for(i = 0; i < aliases->aliases.len; i++) {
ret = krb5_unparse_name(context, &aliases->aliases.val[i],
&alias_string);
if (ret) {
free(alias_string);
goto rollback;
}
sqlite3_bind_text(hsdb->add_alias, 1, alias_string,
-1, SQLITE_STATIC);
sqlite3_bind_int64(hsdb->add_alias, 2, entry_id);
ret = hdb_sqlite_step_once(context, db, hsdb->add_alias);
free(alias_string);
if(ret != SQLITE_DONE)
goto rollback;
}
ret = 0;
commit:
free(principal_string);
krb5_data_free(&value);
sqlite3_clear_bindings(get_ids);
sqlite3_reset(get_ids);
ret = hdb_sqlite_exec_stmt(context, hsdb->db, "COMMIT", EINVAL);
if(ret != SQLITE_OK)
krb5_warnx(context, "hdb-sqlite: COMMIT problem: %d: %s",
ret, sqlite3_errmsg(hsdb->db));
return ret;
rollback:
krb5_warnx(context, "hdb-sqlite: store rollback problem: %d: %s",
ret, sqlite3_errmsg(hsdb->db));
free(principal_string);
ret = hdb_sqlite_exec_stmt(context, hsdb->db,
"ROLLBACK", EINVAL);
return ret;
}
kadm5_ret_t
kadm5_log_rename (kadm5_server_context *context,
krb5_principal source,
hdb_entry *ent)
{
krb5_storage *sp;
kadm5_ret_t ret;
off_t off;
off_t len;
krb5_data value;
kadm5_log_context *log_context = &context->log_context;
krb5_data_zero(&value);
sp = krb5_storage_emem();
ret = hdb_entry2value (context->context, ent, &value);
if (ret)
goto failed;
ret = kadm5_log_preamble (context, sp, kadm_rename);
if (ret)
goto failed;
ret = krb5_store_int32 (sp, 0);
if (ret)
goto failed;
off = krb5_storage_seek (sp, 0, SEEK_CUR);
ret = krb5_store_principal (sp, source);
if (ret)
goto failed;
krb5_storage_write(sp, value.data, value.length);
len = krb5_storage_seek (sp, 0, SEEK_CUR) - off;
krb5_storage_seek(sp, -(len + 4), SEEK_CUR);
ret = krb5_store_int32 (sp, len);
if (ret)
goto failed;
krb5_storage_seek(sp, len, SEEK_CUR);
ret = krb5_store_int32 (sp, len);
if (ret)
goto failed;
ret = kadm5_log_postamble (log_context, sp);
if (ret)
goto failed;
ret = kadm5_log_flush (log_context, sp);
if (ret)
goto failed;
krb5_storage_free (sp);
krb5_data_free (&value);
return kadm5_log_end (context);
failed:
krb5_data_free(&value);
krb5_storage_free(sp);
return ret;
}
/**
* Stores an hdb_entry in the database. If flags contains HDB_F_REPLACE
* a previous entry may be replaced.
*
* @param context The current krb5_context
* @param db Heimdal database handle
* @param flags May currently only contain HDB_F_REPLACE
* @param entry The data to store
*
* @return 0 if everything worked, an error code if not
*/
static krb5_error_code
hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
hdb_entry_ex *entry)
{
int ret;
int i;
sqlite_int64 entry_id;
const HDB_Ext_Aliases *aliases;
hdb_sqlite_db *hsdb = (hdb_sqlite_db *)(db->hdb_db);
krb5_data value;
sqlite3_stmt *get_ids = hsdb->get_ids;
krb5_data_zero(&value);
ret = hdb_sqlite_exec_stmt(context, hsdb,
"BEGIN IMMEDIATE TRANSACTION",
HDB_ERR_UK_SERROR);
if(ret != SQLITE_OK) {
ret = HDB_ERR_UK_SERROR;
krb5_set_error_message(context, ret,
"SQLite BEGIN TRANSACTION failed: %s",
sqlite3_errmsg(hsdb->db));
goto rollback;
}
ret = hdb_seal_keys(context, db, &entry->entry);
if(ret) {
goto rollback;
}
ret = hdb_entry2value(context, &entry->entry, &value);
if(ret) {
goto rollback;
}
ret = bind_principal(context, entry->entry.principal, get_ids, 1);
if (ret)
goto rollback;
ret = hdb_sqlite_step(context, hsdb->db, get_ids);
if(ret == SQLITE_DONE) { /* No such principal */
sqlite3_bind_blob(hsdb->add_entry, 1,
value.data, value.length, SQLITE_STATIC);
ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_entry);
sqlite3_clear_bindings(hsdb->add_entry);
sqlite3_reset(hsdb->add_entry);
if (ret != SQLITE_DONE && ret != SQLITE_CONSTRAINT) {
ret = HDB_ERR_UK_SERROR;
goto rollback;
}
if (ret == SQLITE_CONSTRAINT) {
ret = HDB_ERR_EXISTS;
goto rollback;
}
ret = 0;
ret = bind_principal(context, entry->entry.principal, hsdb->add_principal, 1);
if (ret)
goto rollback;
ret = hdb_sqlite_step(context, hsdb->db, hsdb->add_principal);
sqlite3_clear_bindings(hsdb->add_principal);
sqlite3_reset(hsdb->add_principal);
if (ret != SQLITE_DONE && ret != SQLITE_CONSTRAINT) {
ret = HDB_ERR_UK_SERROR;
goto rollback;
}
if (ret == SQLITE_CONSTRAINT) {
ret = HDB_ERR_EXISTS;
goto rollback;
}
/* Now let's learn what Entry ID we got for the new principal */
sqlite3_reset(get_ids);
ret = hdb_sqlite_step(context, hsdb->db, get_ids);
if (ret != SQLITE_ROW) {
ret = HDB_ERR_UK_SERROR;
goto rollback;
}
entry_id = sqlite3_column_int64(get_ids, 1);
ret = 0;
} else if(ret == SQLITE_ROW) { /* Found a principal */
if(! (flags & HDB_F_REPLACE)) /* Not allowed to replace it */
goto rollback;
entry_id = sqlite3_column_int64(get_ids, 1);
sqlite3_bind_int64(hsdb->delete_aliases, 1, entry_id);
ret = hdb_sqlite_step_once(context, db, hsdb->delete_aliases);
if (ret != SQLITE_DONE) {
ret = HDB_ERR_UK_SERROR;
goto rollback;
}
sqlite3_bind_blob(hsdb->update_entry, 1,
value.data, value.length, SQLITE_STATIC);
sqlite3_bind_int64(hsdb->update_entry, 2, entry_id);
ret = hdb_sqlite_step_once(context, db, hsdb->update_entry);
if (ret != SQLITE_DONE) {
ret = HDB_ERR_UK_SERROR;
goto rollback;
}
} else {
/* Error! */
ret = HDB_ERR_UK_SERROR;
goto rollback;
}
ret = hdb_entry_get_aliases(&entry->entry, &aliases);
if(ret || aliases == NULL)
goto commit;
for(i = 0; i < aliases->aliases.len; i++) {
ret = bind_principal(context, &aliases->aliases.val[i], hsdb->add_alias, 1);
if (ret)
goto rollback;
sqlite3_bind_int64(hsdb->add_alias, 2, entry_id);
ret = hdb_sqlite_step_once(context, db, hsdb->add_alias);
if (ret == SQLITE_CONSTRAINT) {
ret = HDB_ERR_EXISTS;
goto rollback;
}
if (ret != SQLITE_DONE) {
ret = HDB_ERR_UK_SERROR;
goto rollback;
}
}
commit:
krb5_data_free(&value);
sqlite3_clear_bindings(get_ids);
sqlite3_reset(get_ids);
if ((flags & HDB_F_PRECHECK)) {
(void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
return 0;
}
ret = hdb_sqlite_exec_stmt(context, hsdb, "COMMIT", HDB_ERR_UK_SERROR);
if(ret != SQLITE_OK)
krb5_warnx(context, "hdb-sqlite: COMMIT problem: %ld: %s",
(long)HDB_ERR_UK_SERROR, sqlite3_errmsg(hsdb->db));
return ret == SQLITE_OK ? 0 : HDB_ERR_UK_SERROR;
rollback:
krb5_data_free(&value);
sqlite3_clear_bindings(get_ids);
sqlite3_reset(get_ids);
krb5_warnx(context, "hdb-sqlite: store rollback problem: %d: %s",
ret, sqlite3_errmsg(hsdb->db));
(void) hdb_sqlite_exec_stmt(context, hsdb, "ROLLBACK", 0);
return ret;
}
