s3-talloc Change TALLOC_ZERO_P() to talloc_zero()
[nivanova/samba-autobuild/.git] / source3 / winbindd / winbindd_cred_cache.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Winbind daemon - krb5 credential cache functions
5    and in-memory cache functions.
6
7    Copyright (C) Guenther Deschner 2005-2006
8    Copyright (C) Jeremy Allison 2006
9
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19
20    You should have received a copy of the GNU General Public License
21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "winbindd.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "smb_krb5.h"
28 #include "libads/kerberos_proto.h"
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
32
33 /* uncomment this to do fast debugging on the krb5 ticket renewal event */
34 #ifdef DEBUG_KRB5_TKT_RENEWAL
35 #undef DEBUG_KRB5_TKT_RENEWAL
36 #endif
37
38 #define MAX_CCACHES 100
39
40 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
41 static void krb5_ticket_gain_handler(struct event_context *,
42                                      struct timed_event *,
43                                      struct timeval,
44                                      void *);
45 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *,
46                                      struct timeval);
47
48 /* The Krb5 ticket refresh handler should be scheduled
49    at one-half of the period from now till the tkt
50    expiration */
51
52 static time_t krb5_event_refresh_time(time_t end_time)
53 {
54         time_t rest = end_time - time(NULL);
55         return end_time - rest/2;
56 }
57
58 /****************************************************************
59  Find an entry by name.
60 ****************************************************************/
61
62 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
63 {
64         struct WINBINDD_CCACHE_ENTRY *entry;
65
66         for (entry = ccache_list; entry; entry = entry->next) {
67                 if (strequal(entry->username, username)) {
68                         return entry;
69                 }
70         }
71         return NULL;
72 }
73
74 /****************************************************************
75  How many do we have ?
76 ****************************************************************/
77
78 static int ccache_entry_count(void)
79 {
80         struct WINBINDD_CCACHE_ENTRY *entry;
81         int i = 0;
82
83         for (entry = ccache_list; entry; entry = entry->next) {
84                 i++;
85         }
86         return i;
87 }
88
89 void ccache_remove_all_after_fork(void)
90 {
91         struct WINBINDD_CCACHE_ENTRY *cur, *next;
92
93         for (cur = ccache_list; cur; cur = next) {
94                 next = cur->next;
95                 DLIST_REMOVE(ccache_list, cur);
96                 TALLOC_FREE(cur->event);
97                 TALLOC_FREE(cur);
98         }
99
100         return;
101 }
102
103 /****************************************************************
104  Do the work of refreshing the ticket.
105 ****************************************************************/
106
107 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
108                                         struct timed_event *te,
109                                         struct timeval now,
110                                         void *private_data)
111 {
112         struct WINBINDD_CCACHE_ENTRY *entry =
113                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
114 #ifdef HAVE_KRB5
115         int ret;
116         time_t new_start;
117         time_t expire_time = 0;
118         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
119 #endif
120
121         DEBUG(10,("krb5_ticket_refresh_handler called\n"));
122         DEBUGADD(10,("event called for: %s, %s\n",
123                 entry->ccname, entry->username));
124
125         TALLOC_FREE(entry->event);
126
127 #ifdef HAVE_KRB5
128
129         /* Kinit again if we have the user password and we can't renew the old
130          * tgt anymore 
131          * NB
132          * This happens when machine are put to sleep for a very long time. */
133
134         if (entry->renew_until < time(NULL)) {
135 rekinit:
136                 if (cred_ptr && cred_ptr->pass) {
137
138                         set_effective_uid(entry->uid);
139
140                         ret = kerberos_kinit_password_ext(entry->principal_name,
141                                                           cred_ptr->pass,
142                                                           0, /* hm, can we do time correction here ? */
143                                                           &entry->refresh_time,
144                                                           &entry->renew_until,
145                                                           entry->ccname,
146                                                           False, /* no PAC required anymore */
147                                                           True,
148                                                           WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
149                                                           NULL);
150                         gain_root_privilege();
151
152                         if (ret) {
153                                 DEBUG(3,("krb5_ticket_refresh_handler: "
154                                         "could not re-kinit: %s\n",
155                                         error_message(ret)));
156                                 /* destroy the ticket because we cannot rekinit
157                                  * it, ignore error here */
158                                 ads_kdestroy(entry->ccname);
159
160                                 /* Don't break the ticket refresh chain: retry 
161                                  * refreshing ticket sometime later when KDC is 
162                                  * unreachable -- BoYang. More error code handling
163                                  * here? 
164                                  * */
165
166                                 if ((ret == KRB5_KDC_UNREACH)
167                                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
168 #if defined(DEBUG_KRB5_TKT_RENEWAL)
169                                         new_start = time(NULL) + 30;
170 #else
171                                         new_start = time(NULL) +
172                                                     MAX(30, lp_winbind_cache_time());
173 #endif
174                                         add_krb5_ticket_gain_handler_event(entry,
175                                                         timeval_set(new_start, 0));
176                                         return;
177                                 }
178                                 TALLOC_FREE(entry->event);
179                                 return;
180                         }
181
182                         DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
183                                 "for: %s in ccache: %s\n",
184                                 entry->principal_name, entry->ccname));
185
186 #if defined(DEBUG_KRB5_TKT_RENEWAL)
187                         new_start = time(NULL) + 30;
188 #else
189                         /* The tkt should be refreshed at one-half the period
190                            from now to the expiration time */
191                         expire_time = entry->refresh_time;
192                         new_start = krb5_event_refresh_time(entry->refresh_time);
193 #endif
194                         goto done;
195                 } else {
196                                 /* can this happen? 
197                                  * No cached credentials
198                                  * destroy ticket and refresh chain 
199                                  * */
200                                 ads_kdestroy(entry->ccname);
201                                 TALLOC_FREE(entry->event);
202                                 return;
203                 }
204         }
205
206         set_effective_uid(entry->uid);
207
208         ret = smb_krb5_renew_ticket(entry->ccname,
209                                     entry->principal_name,
210                                     entry->service,
211                                     &new_start);
212 #if defined(DEBUG_KRB5_TKT_RENEWAL)
213         new_start = time(NULL) + 30;
214 #else
215         expire_time = new_start;
216         new_start = krb5_event_refresh_time(new_start);
217 #endif
218
219         gain_root_privilege();
220
221         if (ret) {
222                 DEBUG(3,("krb5_ticket_refresh_handler: "
223                         "could not renew tickets: %s\n",
224                         error_message(ret)));
225                 /* maybe we are beyond the renewing window */
226
227                 /* evil rises here, we refresh ticket failed,
228                  * but the ticket might be expired. Therefore,
229                  * When we refresh ticket failed, destory the 
230                  * ticket */
231
232                 ads_kdestroy(entry->ccname);
233
234                 /* avoid breaking the renewal chain: retry in
235                  * lp_winbind_cache_time() seconds when the KDC was not
236                  * available right now. 
237                  * the return code can be KRB5_REALM_CANT_RESOLVE. 
238                  * More error code handling here? */
239
240                 if ((ret == KRB5_KDC_UNREACH) 
241                     || (ret == KRB5_REALM_CANT_RESOLVE)) {
242 #if defined(DEBUG_KRB5_TKT_RENEWAL)
243                         new_start = time(NULL) + 30;
244 #else
245                         new_start = time(NULL) +
246                                     MAX(30, lp_winbind_cache_time());
247 #endif
248                         /* ticket is destroyed here, we have to regain it
249                          * if it is possible */
250                         add_krb5_ticket_gain_handler_event(entry,
251                                                 timeval_set(new_start, 0));
252                         return;
253                 }
254
255                 /* This is evil, if the ticket was already expired.
256                  * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
257                  * But there is still a chance that we can rekinit it. 
258                  *
259                  * This happens when user login in online mode, and then network
260                  * down or something cause winbind goes offline for a very long time,
261                  * and then goes online again. ticket expired, renew failed.
262                  * This happens when machine are put to sleep for a long time,
263                  * but shorter than entry->renew_util.
264                  * NB
265                  * Looks like the KDC is reachable, we want to rekinit as soon as
266                  * possible instead of waiting some time later. */
267                 if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
268                     || (ret == KRB5_FCC_NOFILE)) goto rekinit;
269
270                 return;
271         }
272
273 done:
274         /* in cases that ticket will be unrenewable soon, we don't try to renew ticket 
275          * but try to regain ticket if it is possible */
276         if (entry->renew_until && expire_time
277              && (entry->renew_until <= expire_time)) {
278                 /* try to regain ticket 10 seconds before expiration */
279                 expire_time -= 10;
280                 add_krb5_ticket_gain_handler_event(entry,
281                                         timeval_set(expire_time, 0));
282                 return;
283         }
284
285         if (entry->refresh_time == 0) {
286                 entry->refresh_time = new_start;
287         }
288         entry->event = event_add_timed(winbind_event_context(), entry,
289                                        timeval_set(new_start, 0),
290                                        krb5_ticket_refresh_handler,
291                                        entry);
292
293 #endif
294 }
295
296 /****************************************************************
297  Do the work of regaining a ticket when coming from offline auth.
298 ****************************************************************/
299
300 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
301                                      struct timed_event *te,
302                                      struct timeval now,
303                                      void *private_data)
304 {
305         struct WINBINDD_CCACHE_ENTRY *entry =
306                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
307 #ifdef HAVE_KRB5
308         int ret;
309         struct timeval t;
310         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
311         struct winbindd_domain *domain = NULL;
312 #endif
313
314         DEBUG(10,("krb5_ticket_gain_handler called\n"));
315         DEBUGADD(10,("event called for: %s, %s\n",
316                 entry->ccname, entry->username));
317
318         TALLOC_FREE(entry->event);
319
320 #ifdef HAVE_KRB5
321
322         if (!cred_ptr || !cred_ptr->pass) {
323                 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
324                 return;
325         }
326
327         if ((domain = find_domain_from_name(entry->realm)) == NULL) {
328                 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
329                 return;
330         }
331
332         if (!domain->online) {
333                 goto retry_later;
334         }
335
336         set_effective_uid(entry->uid);
337
338         ret = kerberos_kinit_password_ext(entry->principal_name,
339                                           cred_ptr->pass,
340                                           0, /* hm, can we do time correction here ? */
341                                           &entry->refresh_time,
342                                           &entry->renew_until,
343                                           entry->ccname,
344                                           False, /* no PAC required anymore */
345                                           True,
346                                           WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
347                                           NULL);
348         gain_root_privilege();
349
350         if (ret) {
351                 DEBUG(3,("krb5_ticket_gain_handler: "
352                         "could not kinit: %s\n",
353                         error_message(ret)));
354                 /* evil. If we cannot do it, destroy any the __maybe__ 
355                  * __existing__ ticket */
356                 ads_kdestroy(entry->ccname);
357                 goto retry_later;
358         }
359
360         DEBUG(10,("krb5_ticket_gain_handler: "
361                 "successful kinit for: %s in ccache: %s\n",
362                 entry->principal_name, entry->ccname));
363
364         goto got_ticket;
365
366   retry_later:
367  
368 #if defined(DEBUG_KRB5_TKT_RENEWAL)
369         t = timeval_set(time(NULL) + 30, 0);
370 #else
371         t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
372 #endif
373
374         add_krb5_ticket_gain_handler_event(entry, t);
375         return;
376
377   got_ticket:
378
379 #if defined(DEBUG_KRB5_TKT_RENEWAL)
380         t = timeval_set(time(NULL) + 30, 0);
381 #else
382         t = timeval_set(krb5_event_refresh_time(entry->refresh_time), 0);
383 #endif
384
385         if (entry->refresh_time == 0) {
386                 entry->refresh_time = t.tv_sec;
387         }
388         entry->event = event_add_timed(winbind_event_context(),
389                                        entry,
390                                        t,
391                                        krb5_ticket_refresh_handler,
392                                        entry);
393
394         return;
395 #endif
396 }
397
398 /**************************************************************
399  The gain initial ticket case is recognised as entry->refresh_time
400  is always zero.
401 **************************************************************/
402
403 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
404                                      struct timeval t)
405 {
406         entry->refresh_time = 0;
407         entry->event = event_add_timed(winbind_event_context(),
408                                        entry,
409                                        t,
410                                        krb5_ticket_gain_handler,
411                                        entry);
412 }
413
414 void ccache_regain_all_now(void)
415 {
416         struct WINBINDD_CCACHE_ENTRY *cur;
417         struct timeval t = timeval_current();
418
419         for (cur = ccache_list; cur; cur = cur->next) {
420                 struct timed_event *new_event;
421
422                 /*
423                  * if refresh_time is 0, we know that the
424                  * the event has the krb5_ticket_gain_handler
425                  */
426                 if (cur->refresh_time == 0) {
427                         new_event = event_add_timed(winbind_event_context(),
428                                                     cur,
429                                                     t,
430                                                     krb5_ticket_gain_handler,
431                                                     cur);
432                 } else {
433                         new_event = event_add_timed(winbind_event_context(),
434                                                     cur,
435                                                     t,
436                                                     krb5_ticket_refresh_handler,
437                                                     cur);
438                 }
439
440                 if (!new_event) {
441                         continue;
442                 }
443
444                 TALLOC_FREE(cur->event);
445                 cur->event = new_event;
446         }
447
448         return;
449 }
450
451 /****************************************************************
452  Check if an ccache entry exists.
453 ****************************************************************/
454
455 bool ccache_entry_exists(const char *username)
456 {
457         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
458         return (entry != NULL);
459 }
460
461 /****************************************************************
462  Ensure we're changing the correct entry.
463 ****************************************************************/
464
465 bool ccache_entry_identical(const char *username,
466                             uid_t uid,
467                             const char *ccname)
468 {
469         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
470
471         if (!entry) {
472                 return False;
473         }
474
475         if (entry->uid != uid) {
476                 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
477                         (unsigned int)entry->uid, (unsigned int)uid));
478                 return False;
479         }
480         if (!strcsequal(entry->ccname, ccname)) {
481                 DEBUG(0,("cache_entry_identical: "
482                         "ccnames differ: (cache) %s != (client) %s\n",
483                         entry->ccname, ccname));
484                 return False;
485         }
486         return True;
487 }
488
489 NTSTATUS add_ccache_to_list(const char *princ_name,
490                             const char *ccname,
491                             const char *service,
492                             const char *username,
493                             const char *realm,
494                             uid_t uid,
495                             time_t create_time,
496                             time_t ticket_end,
497                             time_t renew_until,
498                             bool postponed_request)
499 {
500         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
501         struct timeval t;
502         NTSTATUS ntret;
503 #ifdef HAVE_KRB5
504         int ret;
505 #endif
506
507         if ((username == NULL && princ_name == NULL) ||
508             ccname == NULL || uid < 0) {
509                 return NT_STATUS_INVALID_PARAMETER;
510         }
511
512         if (ccache_entry_count() + 1 > MAX_CCACHES) {
513                 DEBUG(10,("add_ccache_to_list: "
514                         "max number of ccaches reached\n"));
515                 return NT_STATUS_NO_MORE_ENTRIES;
516         }
517
518         /* If it is cached login, destroy krb5 ticket
519          * to avoid surprise. */
520 #ifdef HAVE_KRB5
521         if (postponed_request) {
522                 /* ignore KRB5_FCC_NOFILE error here */
523                 ret = ads_kdestroy(ccname);
524                 if (ret == KRB5_FCC_NOFILE) {
525                         ret = 0;
526                 }
527                 if (ret) {
528                         DEBUG(0, ("add_ccache_to_list: failed to destroy "
529                                    "user krb5 ccache %s with %s\n", ccname,
530                                    error_message(ret)));
531                         return krb5_to_nt_status(ret);
532                 }
533                 DEBUG(10, ("add_ccache_to_list: successfully destroyed "
534                            "krb5 ccache %s for user %s\n", ccname,
535                            username));
536         }
537 #endif
538
539         /* Reference count old entries */
540         entry = get_ccache_by_username(username);
541         if (entry) {
542                 /* Check cached entries are identical. */
543                 if (!ccache_entry_identical(username, uid, ccname)) {
544                         return NT_STATUS_INVALID_PARAMETER;
545                 }
546                 entry->ref_count++;
547                 DEBUG(10,("add_ccache_to_list: "
548                         "ref count on entry %s is now %d\n",
549                         username, entry->ref_count));
550                 /* FIXME: in this case we still might want to have a krb5 cred
551                  * event handler created - gd
552                  * Add ticket refresh handler here */
553
554                 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
555                         return NT_STATUS_OK;
556                 }
557
558                 if (!entry->event) {
559                         if (postponed_request) {
560                                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
561                                 add_krb5_ticket_gain_handler_event(entry, t);
562                         } else {
563                                 /* Renew at 1/2 the ticket expiration time */
564 #if defined(DEBUG_KRB5_TKT_RENEWAL)
565                                 t = timeval_set(time(NULL)+30, 0);
566 #else
567                                 t = timeval_set(krb5_event_refresh_time(ticket_end),
568                                                 0);
569 #endif
570                                 if (!entry->refresh_time) {
571                                         entry->refresh_time = t.tv_sec;
572                                 }
573                                 entry->event = event_add_timed(winbind_event_context(),
574                                                                entry,
575                                                                t,
576                                                                krb5_ticket_refresh_handler,
577                                                                entry);
578                         }
579
580                         if (!entry->event) {
581                                 ntret = remove_ccache(username);
582                                 if (!NT_STATUS_IS_OK(ntret)) {
583                                         DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
584                                                   "ccache %s for user %s\n", entry->ccname,
585                                                   entry->username));
586                                         DEBUG(0, ("add_ccache_to_list: error is %s\n",
587                                                   nt_errstr(ntret)));
588                                         return ntret;
589                                 }
590                                 return NT_STATUS_NO_MEMORY;
591                         }
592
593                         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
594                 }
595
596                 return NT_STATUS_OK;
597         }
598
599         entry = talloc(NULL, struct WINBINDD_CCACHE_ENTRY);
600         if (!entry) {
601                 return NT_STATUS_NO_MEMORY;
602         }
603
604         ZERO_STRUCTP(entry);
605
606         if (username) {
607                 entry->username = talloc_strdup(entry, username);
608                 if (!entry->username) {
609                         goto no_mem;
610                 }
611         }
612         if (princ_name) {
613                 entry->principal_name = talloc_strdup(entry, princ_name);
614                 if (!entry->principal_name) {
615                         goto no_mem;
616                 }
617         }
618         if (service) {
619                 entry->service = talloc_strdup(entry, service);
620                 if (!entry->service) {
621                         goto no_mem;
622                 }
623         }
624
625         entry->ccname = talloc_strdup(entry, ccname);
626         if (!entry->ccname) {
627                 goto no_mem;
628         }
629
630         entry->realm = talloc_strdup(entry, realm);
631         if (!entry->realm) {
632                 goto no_mem;
633         }
634
635         entry->create_time = create_time;
636         entry->renew_until = renew_until;
637         entry->uid = uid;
638         entry->ref_count = 1;
639
640         if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
641                 goto add_entry;
642         }
643
644         if (postponed_request) {
645                 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
646                 add_krb5_ticket_gain_handler_event(entry, t);
647         } else {
648                 /* Renew at 1/2 the ticket expiration time */
649 #if defined(DEBUG_KRB5_TKT_RENEWAL)
650                 t = timeval_set(time(NULL)+30, 0);
651 #else
652                 t = timeval_set(krb5_event_refresh_time(ticket_end), 0);
653 #endif
654                 if (entry->refresh_time == 0) {
655                         entry->refresh_time = t.tv_sec;
656                 }
657                 entry->event = event_add_timed(winbind_event_context(),
658                                                entry,
659                                                t,
660                                                krb5_ticket_refresh_handler,
661                                                entry);
662         }
663
664         if (!entry->event) {
665                 goto no_mem;
666         }
667
668         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
669
670  add_entry:
671
672         DLIST_ADD(ccache_list, entry);
673
674         DEBUG(10,("add_ccache_to_list: "
675                 "added ccache [%s] for user [%s] to the list\n",
676                 ccname, username));
677
678         return NT_STATUS_OK;
679
680  no_mem:
681
682         TALLOC_FREE(entry);
683         return NT_STATUS_NO_MEMORY;
684 }
685
686 /*******************************************************************
687  Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer
688  referenced.
689  *******************************************************************/
690
691 NTSTATUS remove_ccache(const char *username)
692 {
693         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
694         NTSTATUS status = NT_STATUS_OK;
695 #ifdef HAVE_KRB5
696         krb5_error_code ret;
697 #endif
698
699         if (!entry) {
700                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
701         }
702
703         if (entry->ref_count <= 0) {
704                 DEBUG(0,("remove_ccache: logic error. "
705                         "ref count for user %s = %d\n",
706                         username, entry->ref_count));
707                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
708         }
709
710         entry->ref_count--;
711
712         if (entry->ref_count > 0) {
713                 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
714                         username, entry->ref_count));
715                 return NT_STATUS_OK;
716         }
717
718         /* no references any more */
719
720         DLIST_REMOVE(ccache_list, entry);
721         TALLOC_FREE(entry->event); /* unregisters events */
722
723 #ifdef HAVE_KRB5
724         ret = ads_kdestroy(entry->ccname);
725
726         /* we ignore the error when there has been no credential cache */
727         if (ret == KRB5_FCC_NOFILE) {
728                 ret = 0;
729         } else if (ret) {
730                 DEBUG(0,("remove_ccache: "
731                         "failed to destroy user krb5 ccache %s with: %s\n",
732                         entry->ccname, error_message(ret)));
733         } else {
734                 DEBUG(10,("remove_ccache: "
735                         "successfully destroyed krb5 ccache %s for user %s\n",
736                         entry->ccname, username));
737         }
738         status = krb5_to_nt_status(ret);
739 #endif
740
741         TALLOC_FREE(entry);
742         DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
743
744         return status;
745 }
746
747 /*******************************************************************
748  In memory credentials cache code.
749 *******************************************************************/
750
751 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
752
753 /***********************************************************
754  Find an entry on the list by name.
755 ***********************************************************/
756
757 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
758 {
759         struct WINBINDD_MEMORY_CREDS *p;
760
761         for (p = memory_creds_list; p; p = p->next) {
762                 if (strequal(p->username, username)) {
763                         return p;
764                 }
765         }
766         return NULL;
767 }
768
769 /***********************************************************
770  Store the required creds and mlock them.
771 ***********************************************************/
772
773 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp,
774                                    const char *pass)
775 {
776 #if !defined(HAVE_MLOCK)
777         return NT_STATUS_OK;
778 #else
779         /* new_entry->nt_hash is the base pointer for the block
780            of memory pointed into by new_entry->lm_hash and
781            new_entry->pass (if we're storing plaintext). */
782
783         memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
784         if (pass) {
785                 memcredp->len += strlen(pass)+1;
786         }
787
788
789 #if defined(LINUX)
790         /* aligning the memory on on x86_64 and compiling
791            with gcc 4.1 using -O2 causes a segv in the
792            next memset()  --jerry */
793         memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
794 #else
795         /* On non-linux platforms, mlock()'d memory must be aligned */
796         memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
797                                                getpagesize(), memcredp->len);
798 #endif
799         if (!memcredp->nt_hash) {
800                 return NT_STATUS_NO_MEMORY;
801         }
802         memset(memcredp->nt_hash, 0x0, memcredp->len);
803
804         memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
805
806 #ifdef DEBUG_PASSWORD
807         DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
808 #endif
809         if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
810                 DEBUG(0,("failed to mlock memory: %s (%d)\n",
811                         strerror(errno), errno));
812                 SAFE_FREE(memcredp->nt_hash);
813                 return map_nt_error_from_unix(errno);
814         }
815
816 #ifdef DEBUG_PASSWORD
817         DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
818 #endif
819
820         /* Create and store the password hashes. */
821         E_md4hash(pass, memcredp->nt_hash);
822         E_deshash(pass, memcredp->lm_hash);
823
824         if (pass) {
825                 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
826                 memcpy(memcredp->pass, pass,
827                        memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
828         }
829
830         return NT_STATUS_OK;
831 #endif
832 }
833
834 /***********************************************************
835  Destroy existing creds.
836 ***********************************************************/
837
838 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
839 {
840 #if !defined(HAVE_MUNLOCK)
841         return NT_STATUS_OK;
842 #else
843         if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
844                 DEBUG(0,("failed to munlock memory: %s (%d)\n",
845                         strerror(errno), errno));
846                 return map_nt_error_from_unix(errno);
847         }
848         memset(memcredp->nt_hash, '\0', memcredp->len);
849         SAFE_FREE(memcredp->nt_hash);
850         memcredp->nt_hash = NULL;
851         memcredp->lm_hash = NULL;
852         memcredp->pass = NULL;
853         memcredp->len = 0;
854         return NT_STATUS_OK;
855 #endif
856 }
857
858 /***********************************************************
859  Replace the required creds with new ones (password change).
860 ***********************************************************/
861
862 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
863                                                        const char *pass)
864 {
865         NTSTATUS status = delete_memory_creds(memcredp);
866         if (!NT_STATUS_IS_OK(status)) {
867                 return status;
868         }
869         return store_memory_creds(memcredp, pass);
870 }
871
872 /*************************************************************
873  Store credentials in memory in a list.
874 *************************************************************/
875
876 static NTSTATUS winbindd_add_memory_creds_internal(const char *username,
877                                                    uid_t uid,
878                                                    const char *pass)
879 {
880         /* Shortcut to ensure we don't store if no mlock. */
881 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
882         return NT_STATUS_OK;
883 #else
884         NTSTATUS status;
885         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
886
887         memcredp = find_memory_creds_by_name(username);
888         if (uid == (uid_t)-1) {
889                 DEBUG(0,("winbindd_add_memory_creds_internal: "
890                         "invalid uid for user %s.\n", username));
891                 return NT_STATUS_INVALID_PARAMETER;
892         }
893
894         if (memcredp) {
895                 /* Already exists. Increment the reference count and replace stored creds. */
896                 if (uid != memcredp->uid) {
897                         DEBUG(0,("winbindd_add_memory_creds_internal: "
898                                 "uid %u for user %s doesn't "
899                                 "match stored uid %u. Replacing.\n",
900                                 (unsigned int)uid, username,
901                                 (unsigned int)memcredp->uid));
902                         memcredp->uid = uid;
903                 }
904                 memcredp->ref_count++;
905                 DEBUG(10,("winbindd_add_memory_creds_internal: "
906                         "ref count for user %s is now %d\n",
907                         username, memcredp->ref_count));
908                 return winbindd_replace_memory_creds_internal(memcredp, pass);
909         }
910
911         memcredp = talloc_zero(NULL, struct WINBINDD_MEMORY_CREDS);
912         if (!memcredp) {
913                 return NT_STATUS_NO_MEMORY;
914         }
915         memcredp->username = talloc_strdup(memcredp, username);
916         if (!memcredp->username) {
917                 talloc_destroy(memcredp);
918                 return NT_STATUS_NO_MEMORY;
919         }
920
921         status = store_memory_creds(memcredp, pass);
922         if (!NT_STATUS_IS_OK(status)) {
923                 talloc_destroy(memcredp);
924                 return status;
925         }
926
927         memcredp->uid = uid;
928         memcredp->ref_count = 1;
929         DLIST_ADD(memory_creds_list, memcredp);
930
931         DEBUG(10,("winbindd_add_memory_creds_internal: "
932                 "added entry for user %s\n", username));
933
934         return NT_STATUS_OK;
935 #endif
936 }
937
938 /*************************************************************
939  Store users credentials in memory. If we also have a
940  struct WINBINDD_CCACHE_ENTRY for this username with a
941  refresh timer, then store the plaintext of the password
942  and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
943 *************************************************************/
944
945 NTSTATUS winbindd_add_memory_creds(const char *username,
946                                    uid_t uid,
947                                    const char *pass)
948 {
949         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
950         NTSTATUS status;
951
952         status = winbindd_add_memory_creds_internal(username, uid, pass);
953         if (!NT_STATUS_IS_OK(status)) {
954                 return status;
955         }
956
957         if (entry) {
958                 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
959                 memcredp = find_memory_creds_by_name(username);
960                 if (memcredp) {
961                         entry->cred_ptr = memcredp;
962                 }
963         }
964
965         return status;
966 }
967
968 /*************************************************************
969  Decrement the in-memory ref count - delete if zero.
970 *************************************************************/
971
972 NTSTATUS winbindd_delete_memory_creds(const char *username)
973 {
974         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
975         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
976         NTSTATUS status = NT_STATUS_OK;
977
978         memcredp = find_memory_creds_by_name(username);
979         entry = get_ccache_by_username(username);
980
981         if (!memcredp) {
982                 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
983                         username));
984                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
985         }
986
987         if (memcredp->ref_count <= 0) {
988                 DEBUG(0,("winbindd_delete_memory_creds: logic error. "
989                         "ref count for user %s = %d\n",
990                         username, memcredp->ref_count));
991                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
992         }
993
994         memcredp->ref_count--;
995         if (memcredp->ref_count <= 0) {
996                 delete_memory_creds(memcredp);
997                 DLIST_REMOVE(memory_creds_list, memcredp);
998                 talloc_destroy(memcredp);
999                 DEBUG(10,("winbindd_delete_memory_creds: "
1000                         "deleted entry for user %s\n",
1001                         username));
1002         } else {
1003                 DEBUG(10,("winbindd_delete_memory_creds: "
1004                         "entry for user %s ref_count now %d\n",
1005                         username, memcredp->ref_count));
1006         }
1007
1008         if (entry) {
1009                 /* Ensure we have no dangling references to this. */
1010                 entry->cred_ptr = NULL;
1011         }
1012
1013         return status;
1014 }
1015
1016 /***********************************************************
1017  Replace the required creds with new ones (password change).
1018 ***********************************************************/
1019
1020 NTSTATUS winbindd_replace_memory_creds(const char *username,
1021                                        const char *pass)
1022 {
1023         struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
1024
1025         memcredp = find_memory_creds_by_name(username);
1026         if (!memcredp) {
1027                 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
1028                         username));
1029                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1030         }
1031
1032         DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
1033                 username));
1034
1035         return winbindd_replace_memory_creds_internal(memcredp, pass);
1036 }