/* Convert a JSON value to an rcache handle or to NULL. */
static int
json_to_rcache(krb5_context context, k5_json_value v, krb5_rcache *rcache_out)
{
krb5_rcache rcache;
*rcache_out = NULL;
if (k5_json_get_tid(v) == K5_JSON_TID_NULL)
return 0;
if (k5_json_get_tid(v) != K5_JSON_TID_STRING)
return -1;
if (krb5_rc_resolve_full(context, &rcache, (char *)k5_json_string_utf8(v)))
return -1;
if (krb5_rc_recover_or_initialize(context, rcache, context->clockskew)) {
krb5_rc_close(context, rcache);
return -1;
}
*rcache_out = rcache;
return 0;
}
static void
store(krb5_context ctx, char *rcspec, char *client, char *server, char *msg,
krb5_timestamp timestamp, krb5_int32 usec, krb5_timestamp now_timestamp,
krb5_int32 now_usec)
{
krb5_rcache rc = NULL;
krb5_error_code retval = 0;
char *hash = NULL;
krb5_donot_replay rep;
krb5_data d;
if (now_timestamp != 0)
krb5_set_debugging_time(ctx, now_timestamp, now_usec);
if ((retval = krb5_rc_resolve_full(ctx, &rc, rcspec)))
goto cleanup;
if ((retval = krb5_rc_recover_or_initialize(ctx, rc, ctx->clockskew)))
goto cleanup;
if (msg) {
d.data = msg;
d.length = strlen(msg);
if ((retval = krb5_rc_hash_message(ctx, &d, &hash)))
goto cleanup;
}
rep.client = client;
rep.server = server;
rep.msghash = hash;
rep.cusec = usec;
rep.ctime = timestamp;
retval = krb5_rc_store(ctx, rc, &rep);
cleanup:
if (retval == KRB5KRB_AP_ERR_REPEAT)
printf("Replay\n");
else if (!retval)
printf("Entry successfully stored\n");
else
fprintf(stderr, "Failure: %s\n", krb5_get_error_message(ctx, retval));
if (rc)
krb5_rc_close(ctx, rc);
if (hash)
free(hash);
}
static void
expunge(krb5_context ctx, char *rcspec, krb5_timestamp now_timestamp,
krb5_int32 now_usec)
{
krb5_rcache rc = NULL;
krb5_error_code retval = 0;
if (now_timestamp > 0)
krb5_set_debugging_time(ctx, now_timestamp, now_usec);
if ((retval = krb5_rc_resolve_full(ctx, &rc, rcspec)))
goto cleanup;
if ((retval = krb5_rc_recover_or_initialize(ctx, rc, ctx->clockskew)))
goto cleanup;
retval = krb5_rc_expunge(ctx, rc);
cleanup:
if (!retval)
printf("Cache successfully expunged\n");
else
fprintf(stderr, "Failure: %s\n", krb5_get_error_message(ctx, retval));
if (rc)
krb5_rc_close(ctx, rc);
}
krb5_error_code KRB5_CALLCONV
krb5_get_server_rcache(krb5_context context, const krb5_data *piece,
krb5_rcache *rcptr)
{
krb5_rcache rcache = 0;
char *cachename = 0, *def_env = 0, *cachetype;
char tmp[4], *full_name;
krb5_error_code retval;
int p, i;
unsigned int len;
#ifdef HAVE_GETEUID
unsigned long tens;
unsigned long uid = geteuid();
#endif
if (piece == NULL)
return ENOMEM;
cachetype = krb5_rc_default_type(context);
/*
* Solaris Kerberos: Check to see if something other than the default replay
* cache name will be used. If so then skip over the construction of
* said name.
*/
if ((def_env = krb5_rc_default_name(context)) != 0) {
cachename = strdup(def_env);
if (cachename == NULL)
return (ENOMEM);
/*
* We expect to have the fully qualified rcache name (<type>:<name>),
* so we populate the default type here if the type is missing.
*/
if (strchr(cachename, ':') == NULL) {
full_name = malloc(strlen(cachetype) + 1 +
strlen(cachename) + 1);
if (full_name == NULL) {
free(cachename);
return(ENOMEM);
}
(void) sprintf(full_name, "%s:%s", cachetype, cachename);
free(cachename);
cachename = full_name;
}
goto skip_create;
}
len = piece->length + 3 + 1;
for (i = 0; i < piece->length; i++) {
if (piece->data[i] == '-')
len++;
else if (!isvalidrcname((int) piece->data[i]))
len += 3;
}
#ifdef HAVE_GETEUID
len += 2; /* _<uid> */
for (tens = 1; (uid / tens) > 9 ; tens *= 10)
len++;
#endif
cachename = malloc(strlen(cachetype) + 5 + len);
if (!cachename) {
retval = ENOMEM;
goto cleanup;
}
strcpy(cachename, cachetype);
p = strlen(cachename);
cachename[p++] = ':';
for (i = 0; i < piece->length; i++) {
if (piece->data[i] == '-') {
cachename[p++] = '-';
cachename[p++] = '-';
continue;
}
if (!isvalidrcname((int) piece->data[i])) {
sprintf(tmp, "%03o", piece->data[i]);
cachename[p++] = '-';
cachename[p++] = tmp[0];
cachename[p++] = tmp[1];
cachename[p++] = tmp[2];
continue;
}
cachename[p++] = piece->data[i];
}
#ifdef HAVE_GETEUID
cachename[p++] = '_';
while (tens) {
cachename[p++] = '0' + ((uid / tens) % 10);
tens /= 10;
}
#endif
cachename[p++] = '\0';
skip_create:
retval = krb5_rc_resolve_full(context, &rcache, cachename);
if (retval) {
rcache = 0;
goto cleanup;
}
/*
* First try to recover the replay cache; if that doesn't work,
* initialize it.
*/
retval = krb5_rc_recover_or_initialize(context, rcache, context->clockskew);
if (retval) {
krb5_rc_close(context, rcache);
rcache = 0;
goto cleanup;
}
*rcptr = rcache;
rcache = 0;
retval = 0;
cleanup:
if (rcache)
krb5_xfree(rcache);
if (cachename)
krb5_xfree(cachename);
return retval;
}
