krb5_error_code KRB5_LIB_FUNCTION krb5_get_server_rcache(krb5_context context, const krb5_data *piece, krb5_rcache *id) { krb5_rcache rcache; krb5_error_code ret; char *tmp = malloc(4 * piece->length + 1); char *name; if(tmp == NULL) { krb5_set_error_string (context, "malloc: out of memory"); return ENOMEM; } strvisx(tmp, piece->data, piece->length, VIS_WHITE | VIS_OCTAL); #ifdef HAVE_GETEUID asprintf(&name, "FILE:rc_%s_%u", tmp, (unsigned)geteuid()); #else asprintf(&name, "FILE:rc_%s", tmp); #endif free(tmp); if(name == NULL) { krb5_set_error_string (context, "malloc: out of memory"); return ENOMEM; } ret = krb5_rc_resolve_full(context, &rcache, name); free(name); if(ret) return ret; *id = rcache; return ret; }
/* * krb5_rcache_internalize() - Internalize the krb5_rcache. */ static krb5_error_code krb5_rcache_internalize(krb5_context kcontext, krb5_pointer *argp, krb5_octet **buffer, size_t *lenremain) { krb5_error_code kret; krb5_rcache rcache = NULL; krb5_int32 ibuf; krb5_octet *bp; size_t remain; char *rcname = NULL; bp = *buffer; remain = *lenremain; /* Read our magic number */ if (krb5_ser_unpack_int32(&ibuf, &bp, &remain) || ibuf != KV5M_RCACHE) return EINVAL; /* Get the length of the rcache name */ kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain); if (kret) return kret; /* Get the rcache name. */ rcname = malloc(ibuf + 1); if (!rcname) return ENOMEM; kret = krb5_ser_unpack_bytes((krb5_octet*)rcname, (size_t) ibuf, &bp, &remain); if (kret) goto cleanup; rcname[ibuf] = '\0'; /* Resolve and recover the rcache. */ kret = krb5_rc_resolve_full(kcontext, &rcache, rcname); if (kret) goto cleanup; krb5_rc_recover(kcontext, rcache); /* Read our magic number again. */ kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain); if (kret) goto cleanup; if (ibuf != KV5M_RCACHE) { kret = EINVAL; goto cleanup; } *buffer = bp; *lenremain = remain; *argp = (krb5_pointer) rcache; cleanup: free(rcname); if (kret != 0 && rcache) krb5_rc_close(kcontext, rcache); return kret; }
/* * krb5_rcache_internalize() - Internalize the krb5_rcache. */ static krb5_error_code krb5_rcache_internalize(krb5_context kcontext, krb5_pointer *argp, krb5_octet **buffer, size_t *lenremain) { krb5_error_code kret; krb5_rcache rcache; krb5_int32 ibuf; krb5_octet *bp; size_t remain; char *rcname; bp = *buffer; remain = *lenremain; kret = EINVAL; /* Read our magic number */ if (krb5_ser_unpack_int32(&ibuf, &bp, &remain)) ibuf = 0; if (ibuf == KV5M_RCACHE) { kret = ENOMEM; /* Get the length of the rcache name */ kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain); if (!kret && (rcname = (char *) malloc((size_t) (ibuf+1))) && !(kret = krb5_ser_unpack_bytes((krb5_octet *) rcname, (size_t) ibuf, &bp, &remain))) { rcname[ibuf] = '\0'; if (!(kret = krb5_rc_resolve_full(kcontext, &rcache, rcname))) { (void) krb5_rc_close(kcontext, rcache); (void) krb5_rc_recover(kcontext, rcache); if (!kret && !(kret = krb5_ser_unpack_int32(&ibuf, &bp, &remain)) && (ibuf == KV5M_RCACHE)) { *buffer = bp; *lenremain = remain; *argp = (krb5_pointer) rcache; } else (void)krb5_rc_close(kcontext, rcache); } free(rcname); } } return(kret); }
/* Convert a JSON value to an rcache handle or to NULL. */ static int json_to_rcache(krb5_context context, k5_json_value v, krb5_rcache *rcache_out) { krb5_rcache rcache; *rcache_out = NULL; if (k5_json_get_tid(v) == K5_JSON_TID_NULL) return 0; if (k5_json_get_tid(v) != K5_JSON_TID_STRING) return -1; if (krb5_rc_resolve_full(context, &rcache, (char *)k5_json_string_utf8(v))) return -1; if (krb5_rc_recover_or_initialize(context, rcache, context->clockskew)) { krb5_rc_close(context, rcache); return -1; } *rcache_out = rcache; return 0; }
static void store(krb5_context ctx, char *rcspec, char *client, char *server, char *msg, krb5_timestamp timestamp, krb5_int32 usec, krb5_timestamp now_timestamp, krb5_int32 now_usec) { krb5_rcache rc = NULL; krb5_error_code retval = 0; char *hash = NULL; krb5_donot_replay rep; krb5_data d; if (now_timestamp != 0) krb5_set_debugging_time(ctx, now_timestamp, now_usec); if ((retval = krb5_rc_resolve_full(ctx, &rc, rcspec))) goto cleanup; if ((retval = krb5_rc_recover_or_initialize(ctx, rc, ctx->clockskew))) goto cleanup; if (msg) { d.data = msg; d.length = strlen(msg); if ((retval = krb5_rc_hash_message(ctx, &d, &hash))) goto cleanup; } rep.client = client; rep.server = server; rep.msghash = hash; rep.cusec = usec; rep.ctime = timestamp; retval = krb5_rc_store(ctx, rc, &rep); cleanup: if (retval == KRB5KRB_AP_ERR_REPEAT) printf("Replay\n"); else if (!retval) printf("Entry successfully stored\n"); else fprintf(stderr, "Failure: %s\n", krb5_get_error_message(ctx, retval)); if (rc) krb5_rc_close(ctx, rc); if (hash) free(hash); }
static void expunge(krb5_context ctx, char *rcspec, krb5_timestamp now_timestamp, krb5_int32 now_usec) { krb5_rcache rc = NULL; krb5_error_code retval = 0; if (now_timestamp > 0) krb5_set_debugging_time(ctx, now_timestamp, now_usec); if ((retval = krb5_rc_resolve_full(ctx, &rc, rcspec))) goto cleanup; if ((retval = krb5_rc_recover_or_initialize(ctx, rc, ctx->clockskew))) goto cleanup; retval = krb5_rc_expunge(ctx, rc); cleanup: if (!retval) printf("Cache successfully expunged\n"); else fprintf(stderr, "Failure: %s\n", krb5_get_error_message(ctx, retval)); if (rc) krb5_rc_close(ctx, rc); }
/* * Serialize krb5_rcache. */ static krb5_error_code ser_rcache_test(krb5_context kcontext, int verbose) { krb5_error_code kret; char rcname[128]; krb5_rcache rcache; snprintf(rcname, sizeof(rcname), "dfl:temp_rc_%d", (int) getpid()); if (!(kret = krb5_rc_resolve_full(kcontext, &rcache, rcname)) && !(kret = ser_data(verbose, "> Resolved FILE rcache", (krb5_pointer) rcache, KV5M_RCACHE)) && !(kret = krb5_rc_initialize(kcontext, rcache, 3600*24)) && !(kret = ser_data(verbose, "> Initialized FILE rcache", (krb5_pointer) rcache, KV5M_RCACHE)) && !(kret = krb5_rc_destroy(kcontext, rcache))) { if (verbose) printf("* rcache test succeeded\n"); } if (kret) printf("* krb5_rcache test failed\n"); return(kret); }
krb5_error_code KRB5_CALLCONV krb5_get_server_rcache(krb5_context context, const krb5_data *piece, krb5_rcache *rcptr) { krb5_rcache rcache = 0; char *cachename = 0, *def_env = 0, *cachetype; char tmp[4], *full_name; krb5_error_code retval; int p, i; unsigned int len; #ifdef HAVE_GETEUID unsigned long tens; unsigned long uid = geteuid(); #endif if (piece == NULL) return ENOMEM; cachetype = krb5_rc_default_type(context); /* * Solaris Kerberos: Check to see if something other than the default replay * cache name will be used. If so then skip over the construction of * said name. */ if ((def_env = krb5_rc_default_name(context)) != 0) { cachename = strdup(def_env); if (cachename == NULL) return (ENOMEM); /* * We expect to have the fully qualified rcache name (<type>:<name>), * so we populate the default type here if the type is missing. */ if (strchr(cachename, ':') == NULL) { full_name = malloc(strlen(cachetype) + 1 + strlen(cachename) + 1); if (full_name == NULL) { free(cachename); return(ENOMEM); } (void) sprintf(full_name, "%s:%s", cachetype, cachename); free(cachename); cachename = full_name; } goto skip_create; } len = piece->length + 3 + 1; for (i = 0; i < piece->length; i++) { if (piece->data[i] == '-') len++; else if (!isvalidrcname((int) piece->data[i])) len += 3; } #ifdef HAVE_GETEUID len += 2; /* _<uid> */ for (tens = 1; (uid / tens) > 9 ; tens *= 10) len++; #endif cachename = malloc(strlen(cachetype) + 5 + len); if (!cachename) { retval = ENOMEM; goto cleanup; } strcpy(cachename, cachetype); p = strlen(cachename); cachename[p++] = ':'; for (i = 0; i < piece->length; i++) { if (piece->data[i] == '-') { cachename[p++] = '-'; cachename[p++] = '-'; continue; } if (!isvalidrcname((int) piece->data[i])) { sprintf(tmp, "%03o", piece->data[i]); cachename[p++] = '-'; cachename[p++] = tmp[0]; cachename[p++] = tmp[1]; cachename[p++] = tmp[2]; continue; } cachename[p++] = piece->data[i]; } #ifdef HAVE_GETEUID cachename[p++] = '_'; while (tens) { cachename[p++] = '0' + ((uid / tens) % 10); tens /= 10; } #endif cachename[p++] = '\0'; skip_create: retval = krb5_rc_resolve_full(context, &rcache, cachename); if (retval) { rcache = 0; goto cleanup; } /* * First try to recover the replay cache; if that doesn't work, * initialize it. */ retval = krb5_rc_recover_or_initialize(context, rcache, context->clockskew); if (retval) { krb5_rc_close(context, rcache); rcache = 0; goto cleanup; } *rcptr = rcache; rcache = 0; retval = 0; cleanup: if (rcache) krb5_xfree(rcache); if (cachename) krb5_xfree(cachename); return retval; }
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_rc_default(krb5_context context, krb5_rcache *id) { return krb5_rc_resolve_full(context, id, krb5_rc_default_name(context)); }