krb5_error_code
kcm_ccache_destroy_client(krb5_context context,
kcm_client *client,
const char *name)
{
krb5_error_code ret;
kcm_ccache ccache;
const char *estr;
ret = kcm_ccache_resolve(context, name, &ccache);
if (ret) {
estr = krb5_get_error_message(context, ret);
kcm_log(1, "Failed to resolve cache %s: %s", name, estr);
krb5_free_error_message(context, estr);
return ret;
}
ret = kcm_access(context, client, KCM_OP_DESTROY, ccache);
kcm_cleanup_events(context, ccache);
kcm_release_ccache(context, ccache);
if (ret)
return ret;
return kcm_ccache_destroy(context, name);
}
static krb5_error_code
kcmss_destroy(krb5_context context,
krb5_ccache id)
{
krb5_error_code ret;
kcm_ccache c = KCMCACHE(id);
KCM_ASSERT_VALID(c);
ret = kcm_ccache_destroy(context, CACHENAME(id));
return ret;
}
krb5_error_code
kcm_ccache_destroy_if_empty(krb5_context context,
kcm_ccache ccache)
{
krb5_error_code ret;
KCM_ASSERT_VALID(ccache);
if (ccache->creds == NULL) {
ret = kcm_ccache_destroy(context, ccache->name);
} else
ret = 0;
return ret;
}
krb5_error_code
kcm_ccache_destroy_client(krb5_context context,
kcm_client *client,
const char *name)
{
krb5_error_code ret;
kcm_ccache ccache;
ret = kcm_ccache_resolve_by_name(context, name, &ccache);
if (ret) {
kcm_log(1, "Failed to resolve cache %s", name);
return ret;
}
ret = kcm_access(context, client, KCM_OP_DESTROY, ccache);
kcm_release_ccache(context, ccache);
if (ret)
return ret;
return kcm_ccache_destroy(context, name);
}
krb5_error_code
kcm_ccache_new_client(krb5_context context,
kcm_client *client,
const char *name,
kcm_ccache *ccache_p)
{
krb5_error_code ret;
kcm_ccache ccache;
/* We insist the ccache name starts with UID or UID: */
if (name_constraints != 0) {
char prefix[64];
size_t prefix_len;
int bad = 1;
snprintf(prefix, sizeof(prefix), "%ld:", (long)client->uid);
prefix_len = strlen(prefix);
if (strncmp(name, prefix, prefix_len) == 0)
bad = 0;
else {
prefix[prefix_len - 1] = '\0';
if (strcmp(name, prefix) == 0)
bad = 0;
}
/* Allow root to create badly-named ccaches */
if (bad && !CLIENT_IS_ROOT(client))
return KRB5_CC_BADNAME;
}
ret = kcm_ccache_resolve(context, name, &ccache);
if (ret == 0) {
if ((ccache->uid != client->uid ||
ccache->gid != client->gid) && !CLIENT_IS_ROOT(client))
return KRB5_FCC_PERM;
} else if (ret != KRB5_FCC_NOFILE && !(CLIENT_IS_ROOT(client) && ret == KRB5_FCC_PERM)) {
return ret;
}
if (ret == KRB5_FCC_NOFILE) {
ret = kcm_ccache_new(context, name, &ccache);
if (ret) {
kcm_log(1, "Failed to initialize cache %s: %s",
name, krb5_get_err_text(context, ret));
return ret;
}
/* bind to current client */
ccache->uid = client->uid;
ccache->gid = client->gid;
ccache->session = client->session;
} else {
ret = kcm_zero_ccache_data(context, ccache);
if (ret) {
kcm_log(1, "Failed to empty cache %s: %s",
name, krb5_get_err_text(context, ret));
kcm_release_ccache(context, ccache);
return ret;
}
kcm_cleanup_events(context, ccache);
}
ret = kcm_access(context, client, KCM_OP_INITIALIZE, ccache);
if (ret) {
kcm_release_ccache(context, ccache);
kcm_ccache_destroy(context, name);
return ret;
}
/*
* Finally, if the user is root and the cache was created under
* another user's name, chown the cache to that user and their
* default gid.
*/
if (CLIENT_IS_ROOT(client)) {
unsigned long uid;
int matches = sscanf(name,"%ld:",&uid);
if (matches == 0)
matches = sscanf(name,"%ld",&uid);
if (matches == 1) {
struct passwd *pwd = getpwuid(uid);
if (pwd != NULL) {
gid_t gid = pwd->pw_gid;
kcm_chown(context, client, ccache, uid, gid);
}
}
}
*ccache_p = ccache;
return 0;
}
static krb5_error_code
kcm_fire_event(krb5_context context,
kcm_event **e)
{
kcm_event *event;
krb5_error_code ret;
krb5_creds *credp = NULL;
int oneshot = 1;
event = *e;
switch (event->action) {
case KCM_EVENT_ACQUIRE_CREDS:
ret = kcm_ccache_acquire(context, event->ccache, &credp);
oneshot = 0;
break;
case KCM_EVENT_RENEW_CREDS:
ret = kcm_ccache_refresh(context, event->ccache, &credp);
if (ret == KRB5KRB_AP_ERR_TKT_EXPIRED) {
ret = kcm_ccache_acquire(context, event->ccache, &credp);
}
oneshot = 0;
break;
case KCM_EVENT_DESTROY_CREDS:
ret = kcm_ccache_destroy(context, event->ccache->name);
break;
case KCM_EVENT_DESTROY_EMPTY_CACHE:
ret = kcm_ccache_destroy_if_empty(context, event->ccache);
break;
default:
ret = KRB5_FCC_INTERNAL;
break;
}
event->fire_count++;
if (ret) {
/* Reschedule failed event for another time */
event->fire_time += event->backoff_time;
if (event->backoff_time < KCM_EVENT_MAX_BACKOFF_TIME)
event->backoff_time *= 2;
/* Remove it if it would never get executed */
if (event->expire_time &&
event->fire_time > event->expire_time)
kcm_remove_event_internal(context, e);
} else {
if (!oneshot) {
char *cpn;
if (krb5_unparse_name(context, event->ccache->client,
&cpn))
cpn = NULL;
kcm_log(0, "%s credentials in cache %s for principal %s",
(event->action == KCM_EVENT_ACQUIRE_CREDS) ?
"Acquired" : "Renewed",
event->ccache->name,
(cpn != NULL) ? cpn : "<none>");
if (cpn != NULL)
free(cpn);
/* Succeeded, but possibly replaced with another event */
ret = kcm_ccache_make_default_event(context, event, credp);
if (ret || event->action == KCM_EVENT_NONE)
oneshot = 1;
else
log_event(event, "requeuing");
}
if (oneshot)
kcm_remove_event_internal(context, e);
}
return ret;
}
krb5_error_code
kcm_ccache_new_client(krb5_context context,
kcm_client *client,
const char *name,
kcm_ccache *ccache_p)
{
krb5_error_code ret;
kcm_ccache ccache;
ret = kcm_ccache_resolve_by_name(context, name, &ccache);
if (ret == 0) {
if ((ccache->uid != client->uid) && !CLIENT_IS_ROOT(client))
return KRB5_FCC_PERM;
} else if (ret != KRB5_FCC_NOFILE && !(CLIENT_IS_ROOT(client) && ret == KRB5_FCC_PERM)) {
return ret;
}
if (ret == KRB5_FCC_NOFILE) {
ret = kcm_ccache_new(context, name, &ccache);
if (ret) {
kcm_log(1, "Failed to initialize cache %s", name);
return ret;
}
/* bind to current client */
ccache->uid = client->uid;
ccache->session = client->session;
/*
* add notification when the session goes away, so we can
* remove the credential
*/
kcm_session_add(client->session);
} else {
ret = kcm_zero_ccache_data(context, ccache);
if (ret) {
kcm_log(1, "Failed to empty cache %s", name);
kcm_release_ccache(context, ccache);
return ret;
}
heim_ipc_event_cancel(ccache->renew_event);
heim_ipc_event_cancel(ccache->expire_event);
}
ret = kcm_access(context, client, KCM_OP_INITIALIZE, ccache);
if (ret) {
kcm_release_ccache(context, ccache);
kcm_ccache_destroy(context, name);
return ret;
}
/*
* Finally, if the user is root and the cache was created under
* another user's name, chown the cache to that user.
*/
if (CLIENT_IS_ROOT(client)) {
unsigned long uid;
int matches = sscanf(name,"%ld:",&uid);
if (matches == 0)
matches = sscanf(name,"%ld",&uid);
if (matches == 1) {
kcm_chown(context, client, ccache, (uid_t)uid);
}
}
*ccache_p = ccache;
return 0;
}
