providers/krb5/krb5_renew_tgt.c

f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose/*
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    SSSD
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    Kerberos 5 Backend Module -- Renew a TGT automatically
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    Authors:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        Sumit Bose <sbose@redhat.com>
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    Copyright (C) 2010 Red Hat
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    This program is free software; you can redistribute it and/or modify
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    it under the terms of the GNU General Public License as published by
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    the Free Software Foundation; either version 3 of the License, or
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    (at your option) any later version.
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    This program is distributed in the hope that it will be useful,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    but WITHOUT ANY WARRANTY; without even the implied warranty of
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    GNU General Public License for more details.
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    You should have received a copy of the GNU General Public License
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    along with this program.  If not, see <http://www.gnu.org/licenses/>.
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose*/
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include <security/pam_modules.h>
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include "util/util.h"
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include "providers/krb5/krb5_common.h"
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include "providers/krb5/krb5_auth.h"
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose#include "providers/krb5/krb5_utils.h"
45aeb924ec3ac448bb8d174a5cc061ed98b147c7Jakub Hrozek#include "providers/krb5/krb5_ccache.h"
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#define INITIAL_TGT_TABLE_SIZE 10
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestruct renew_tgt_ctx {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_table_t *tgt_table;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct be_ctx *be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct tevent_context *ev;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct krb5_ctx *krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t timer_interval;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct tevent_timer *te;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose};
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestruct renew_data {
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    const char *ccfile;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t start_time;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t lifetime;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t start_renew_at;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct pam_data *pd;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose};
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestruct auth_data {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct be_ctx *be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct krb5_ctx *krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct pam_data *pd;
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    struct renew_data *renew_data;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_table_t *table;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_key_t key;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose};
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_done(struct tevent_req *req);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt(struct tevent_context *ev, struct tevent_timer *te,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                      struct timeval current_time, void *private_data)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct auth_data *auth_data = talloc_get_type(private_data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                  struct auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct tevent_req *req;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
01ec08efd0e166ac6f390f8627c6d08dcc63ccc4Jakub Hrozek    req = krb5_auth_queue_send(auth_data, ev, auth_data->be_ctx, auth_data->pd,
01ec08efd0e166ac6f390f8627c6d08dcc63ccc4Jakub Hrozek                               auth_data->krb5_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (req == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "krb5_auth_send failed.\n");
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose/* Give back the pam data to the renewal item to be able to retry at the next
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * time the renewals re run. */
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose        auth_data->renew_data->pd = talloc_steal(auth_data->renew_data,
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose                                                 auth_data->pd);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        talloc_free(auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    tevent_req_set_callback(req, renew_tgt_done, auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_done(struct tevent_req *req)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct auth_data *auth_data = tevent_req_callback_data(req,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                           struct auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int pam_status = PAM_SYSTEM_ERR;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int dp_err;
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose    hash_value_t value;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
01ec08efd0e166ac6f390f8627c6d08dcc63ccc4Jakub Hrozek    ret = krb5_auth_queue_recv(req, &pam_status, &dp_err);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_free(req);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "krb5_auth request failed.\n");
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        if (auth_data->renew_data != NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov            DEBUG(SSSDBG_FUNC_DATA, "Giving back pam data.\n");
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose            auth_data->renew_data->pd = talloc_steal(auth_data->renew_data,
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose                                                     auth_data->pd);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    } else {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        switch (pam_status) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            case PAM_SUCCESS:
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_CONF_SETTINGS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                      "Successfully renewed TGT for user [%s].\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                          auth_data->pd->user);
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose/* In general a successful renewal will update the renewal item and free the
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * old data. But if the TGT has reached the end of his renewable lifetime it
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * will not be put into the list of renewable tickets again. In this case the
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * renewal item is not updated and the value from the hash and the one we have
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * stored are the same. Since the TGT cannot be renewed anymore we want to
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * remove it from the list of renewable tickets. */
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                ret = hash_lookup(auth_data->table, &auth_data->key, &value);
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                if (ret == HASH_SUCCESS) {
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                    if (value.type == HASH_VALUE_PTR &&
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                        auth_data->renew_data == talloc_get_type(value.ptr,
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                                                           struct renew_data)) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                        DEBUG(SSSDBG_FUNC_DATA,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                              "New TGT was not added for renewal, "
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                                  "removing list entry for user [%s].\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                                  auth_data->pd->user);
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                        ret = hash_delete(auth_data->table, &auth_data->key);
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                        if (ret != HASH_SUCCESS) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                            DEBUG(SSSDBG_CRIT_FAILURE, "hash_delete failed.\n");
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                        }
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                    }
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                break;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            case PAM_AUTHINFO_UNAVAIL:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            case PAM_AUTHTOK_LOCK_BUSY:
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_CONF_SETTINGS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                      "Cannot renewed TGT for user [%s] while offline, "
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                          "will retry later.\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                          auth_data->pd->user);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose                if (auth_data->renew_data != NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_FUNC_DATA, "Giving back pam data.\n");
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose                    auth_data->renew_data->pd = talloc_steal(auth_data->renew_data,
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose                                                             auth_data->pd);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                break;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            default:
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                      "Failed to renew TGT for user [%s].\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                          auth_data->pd->user);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                ret = hash_delete(auth_data->table, &auth_data->key);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                if (ret != HASH_SUCCESS) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_CRIT_FAILURE, "hash_delete failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_zfree(auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic errno_t renew_all_tgts(struct renew_tgt_ctx *renew_tgt_ctx)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_entry_t *entries;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    unsigned long count;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    size_t c;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t now;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct auth_data *auth_data;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_data *renew_data;
9f37bb2012faa136ef7c1f9fe93689ce2be85637Ondrej Kos    struct tevent_timer *te = NULL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = hash_entries(renew_tgt_ctx->tgt_table, &count, &entries);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != HASH_SUCCESS) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "hash_entries failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    now = time(NULL);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    for (c = 0; c < count; c++) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        renew_data = talloc_get_type(entries[c].value.ptr, struct renew_data);
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_TRACE_ALL,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "Checking [%s] for renewal at [%.24s].\n", renew_data->ccfile,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                  ctime(&renew_data->start_renew_at));
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose        /* If renew_data->pd == NULL a renewal request for this data is
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose         * currently running so we skip it. */
08c427fc3cdec58b670de02a6c39d2ec4d753050Sumit Bose        if (renew_data->start_renew_at < now && renew_data->pd != NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            auth_data = talloc_zero(renew_tgt_ctx, struct auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            if (auth_data == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_CRIT_FAILURE, "talloc_zero failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            } else {
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose/* We need to steal the pam_data here, because a successful renewal of the
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * ticket might add a new renewal item to the list with the same key (upn).
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * This would delete renew_data and all its children. But we cannot be sure
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * that adding the new renewal item is the last operation of the renewal
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * process with access the pam_data. To be on the safe side we steal the
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * pam_data and make it a child of auth_data which is only freed after the
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * renewal process is finished. In the case of an error during renewal we
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * might want to steal the pam_data back to renew_data before freeing
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose * auth_data to allow a new renewal attempt. */
cc0f97794926a426ee82df343dc223c9648ed064Sumit Bose                auth_data->pd = talloc_move(auth_data, &renew_data->pd);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->krb5_ctx = renew_tgt_ctx->krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->be_ctx = renew_tgt_ctx->be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->table = renew_tgt_ctx->tgt_table;
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose                auth_data->renew_data = renew_data;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->key.type = entries[c].key.type;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->key.str = talloc_strdup(auth_data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                   entries[c].key.str);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                if (auth_data->key.str == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_CRIT_FAILURE, "talloc_strdup failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                } else {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    te = tevent_add_timer(renew_tgt_ctx->ev,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                          auth_data, tevent_timeval_current(),
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                          renew_tgt, auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    if (te == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                        DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                              "tevent_add_timer failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            if (auth_data == NULL || te == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                      "Failed to renew TGT in [%s].\n", renew_data->ccfile);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                ret = hash_delete(renew_tgt_ctx->tgt_table, &entries[c].key);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                if (ret != HASH_SUCCESS) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_CRIT_FAILURE, "hash_delete failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_free(entries);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_handler(struct renew_tgt_ctx *renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
7591a7368078c2b4cde744ede431260fd663903aSumit Bosestatic void renew_tgt_offline_callback(void *private_data)
7591a7368078c2b4cde744ede431260fd663903aSumit Bose{
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    struct renew_tgt_ctx *renew_tgt_ctx = talloc_get_type(private_data,
7591a7368078c2b4cde744ede431260fd663903aSumit Bose                                                          struct renew_tgt_ctx);
7591a7368078c2b4cde744ede431260fd663903aSumit Bose
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    talloc_zfree(renew_tgt_ctx->te);
7591a7368078c2b4cde744ede431260fd663903aSumit Bose}
7591a7368078c2b4cde744ede431260fd663903aSumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_online_callback(void *private_data)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_tgt_ctx *renew_tgt_ctx = talloc_get_type(private_data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                          struct renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_handler(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_timer_handler(struct tevent_context *ev,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                    struct tevent_timer *te,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                    struct timeval current_time, void *data)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_tgt_ctx *renew_tgt_ctx = talloc_get_type(data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                          struct renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    /* forget the timer event, it will be freed by the tevent timer loop */
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    renew_tgt_ctx->te = NULL;
7591a7368078c2b4cde744ede431260fd663903aSumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_handler(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_handler(struct renew_tgt_ctx *renew_tgt_ctx)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct timeval next;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (be_is_offline(renew_tgt_ctx->be_ctx)) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CONF_SETTINGS, "Offline, disable renew timer.\n");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose        return;
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    ret = renew_all_tgts(renew_tgt_ctx);
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "renew_all_tgts failed. "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                  "Disabling automatic TGT renewal\n");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose        sss_log(SSS_LOG_ERR, "Disabling automatic TGT renewal.");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose        talloc_zfree(renew_tgt_ctx);
7591a7368078c2b4cde744ede431260fd663903aSumit Bose        return;
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    }
7591a7368078c2b4cde744ede431260fd663903aSumit Bose
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    if (renew_tgt_ctx->te != NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_TRACE_LIBS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "There is an active renewal timer, doing nothing.\n");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose        return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov    DEBUG(SSSDBG_TRACE_LIBS, "Adding new renew timer.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    next = tevent_timeval_current_ofs(renew_tgt_ctx->timer_interval,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                      0);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_tgt_ctx->te = tevent_add_timer(renew_tgt_ctx->ev, renew_tgt_ctx,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                         next, renew_tgt_timer_handler,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                         renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (renew_tgt_ctx->te == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_add_timer failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        sss_log(SSS_LOG_ERR, "Disabling automatic TGT renewal.");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        talloc_zfree(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bosestatic void renew_del_cb(hash_entry_t *entry, hash_destroy_enum type, void *pvt)
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose{
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    struct renew_data *renew_data;
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    if (entry->value.type == HASH_VALUE_PTR) {
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        renew_data = talloc_get_type(entry->value.ptr, struct renew_data);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        talloc_zfree(renew_data);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        return;
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    }
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov    DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov          "Unexpected value type [%d].\n", entry->value.type);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose}
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bosestatic errno_t check_ccache_file(struct renew_tgt_ctx *renew_tgt_ctx,
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose                                 const char *ccache_file, const char *upn,
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose                                 const char *user_name)
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose{
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    int ret;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    struct stat stat_buf;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    struct tgt_times tgtt;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    struct pam_data pd;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    time_t now;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    const char *filename;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (ccache_file == NULL || upn == NULL || user_name == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_TRACE_FUNC,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "Missing one of the needed attributes: [%s][%s][%s].\n",
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose                  ccache_file == NULL ? "cache file missing" : ccache_file,
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose                  upn == NULL ? "principal missing" : upn,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                  user_name == NULL ? "user name missing" : user_name);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        return EINVAL;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (strncmp(ccache_file, "FILE:", 5) == 0) {
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        filename = ccache_file + 5;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    } else {
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        filename = ccache_file;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    ret = stat(filename, &stat_buf);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (ret != EOK) {
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        if (ret == ENOENT) {
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose            return EOK;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        return ret;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov    DEBUG(SSSDBG_TRACE_ALL, "Found ccache file [%s].\n", ccache_file);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    memset(&tgtt, 0, sizeof(tgtt));
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    ret = get_ccache_file_data(ccache_file, upn, &tgtt);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "get_ccache_file_data failed.\n");
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        return ret;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    memset(&pd, 0, sizeof(pd));
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    pd.cmd = SSS_CMD_RENEW;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    pd.user = discard_const_p(char, user_name);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    now = time(NULL);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (tgtt.renew_till > tgtt.endtime && tgtt.renew_till > now &&
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        tgtt.endtime > now) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_TRACE_LIBS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "Adding [%s] for automatic renewal.\n", ccache_file);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        ret = add_tgt_to_renew_table(renew_tgt_ctx->krb5_ctx, ccache_file,
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose                                     &tgtt, &pd, upn);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov            DEBUG(SSSDBG_CRIT_FAILURE, "add_tgt_to_renew_table failed, "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                      "automatic renewal not possible.\n");
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    } else {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_TRACE_ALL,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "TGT in [%s] for [%s] is too old.\n", ccache_file, upn);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    return EOK;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose}
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bosestatic errno_t check_ccache_files(struct renew_tgt_ctx *renew_tgt_ctx)
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose{
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    TALLOC_CTX *tmp_ctx;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    int ret;
0e238c259c066cf997aaa940d33d6bda96c15925Sumit Bose    const char *ccache_filter = "(&("SYSDB_CCACHE_FILE"=*)("SYSDB_UC"))";
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    const char *ccache_attrs[] = { SYSDB_CCACHE_FILE, SYSDB_UPN, SYSDB_NAME,
764aa04ee92dbbd0d1eca6703294135eb97fda6dSumit Bose                                   SYSDB_CANONICAL_UPN, NULL };
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    size_t msgs_count = 0;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    struct ldb_message **msgs = NULL;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    size_t c;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    const char *ccache_file;
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose    char *upn;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    const char *user_name;
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose    struct ldb_dn *base_dn;
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose    char *user_dom;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    tmp_ctx = talloc_new(NULL);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (tmp_ctx == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new failed.\n");
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        return ENOMEM;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
df0596ec12bc5091608371e2977f3111241e8cafSimo Sorce    base_dn = sysdb_base_dn(renew_tgt_ctx->be_ctx->domain->sysdb, tmp_ctx);
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose    if (base_dn == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov        DEBUG(SSSDBG_OP_FAILURE, "sysdb_base_dn failed.\n");
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose        ret = ENOMEM;
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose        goto done;
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose    }
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose
df0596ec12bc5091608371e2977f3111241e8cafSimo Sorce    ret = sysdb_search_entry(tmp_ctx, renew_tgt_ctx->be_ctx->domain->sysdb, base_dn,
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose                             LDB_SCOPE_SUBTREE, ccache_filter, ccache_attrs,
28269b2c1fa38e4579853b7afbe30381a8ab8912Sumit Bose                             &msgs_count, &msgs);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_search_entry failed.\n");
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        goto done;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (msgs_count == 0) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_TRACE_ALL,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "No entries with ccache file found in cache.\n");
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        ret = EOK;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        goto done;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
0e65abe5cf2abf5d4b431cf6bd161b419f07901dLukas Slebodnik    DEBUG(SSSDBG_TRACE_ALL,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov          "Found [%zu] entries with ccache file in cache.\n", msgs_count);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    for (c = 0; c < msgs_count; c++) {
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        user_name = ldb_msg_find_attr_as_string(msgs[c], SYSDB_NAME, NULL);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        if (user_name == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov            DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                  "No user name found, this is a severe error, "
5a299e7c9f634ae86c9bd7e0a1e681aed79de6b5Jakub Hrozek                  "but we ignore it here.\n");
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose            continue;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
5a299e7c9f634ae86c9bd7e0a1e681aed79de6b5Jakub Hrozek        ret = sss_parse_internal_fqname(tmp_ctx, user_name, NULL, &user_dom);
5a299e7c9f634ae86c9bd7e0a1e681aed79de6b5Jakub Hrozek        if (ret != EOK) {
5a299e7c9f634ae86c9bd7e0a1e681aed79de6b5Jakub Hrozek            DEBUG(SSSDBG_OP_FAILURE,
5a299e7c9f634ae86c9bd7e0a1e681aed79de6b5Jakub Hrozek                  "Cannot parse internal fqname [%d]: %s\n",
5a299e7c9f634ae86c9bd7e0a1e681aed79de6b5Jakub Hrozek                  ret, sss_strerror(ret));
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose            goto done;
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose        }
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose        ret = find_or_guess_upn(tmp_ctx, msgs[c], renew_tgt_ctx->krb5_ctx,
80a874555d8b2737827bb150133ba70a83c65bb7Jakub Hrozek                                renew_tgt_ctx->be_ctx->domain,
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose                                user_name, user_dom, &upn);
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose        if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov            DEBUG(SSSDBG_OP_FAILURE, "find_or_guess_upn failed.\n");
964628ab89229e9266adc5f4f8a26222734788b7Sumit Bose            goto done;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        ccache_file = ldb_msg_find_attr_as_string(msgs[c], SYSDB_CCACHE_FILE,
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose                                                  NULL);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        ret = check_ccache_file(renew_tgt_ctx, ccache_file, upn, user_name);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov            DEBUG(SSSDBG_FUNC_DATA,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                  "Failed to check ccache file [%s].\n", ccache_file);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose        }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    ret = EOK;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bosedone:
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    talloc_free(tmp_ctx);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    return ret;
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose}
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Boseerrno_t init_renew_tgt(struct krb5_ctx *krb5_ctx, struct be_ctx *be_ctx,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                       struct tevent_context *ev, time_t renew_intv)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct timeval next;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx = talloc_zero(krb5_ctx, struct renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (krb5_ctx->renew_tgt_ctx == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_zero failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    ret = sss_hash_create_ex(krb5_ctx->renew_tgt_ctx, INITIAL_TGT_TABLE_SIZE,
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose                             &krb5_ctx->renew_tgt_ctx->tgt_table, 0, 0, 0, 0,
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose                             renew_del_cb, NULL);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "sss_hash_create failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto fail;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->be_ctx = be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->krb5_ctx = krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->ev = ev;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->timer_interval = renew_intv;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    ret = check_ccache_files(krb5_ctx->renew_tgt_ctx);
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "Failed to read ccache files, continuing ...\n");
318f12c90208971a5b6d3574f0026601161d81c7Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    next = tevent_timeval_current_ofs(krb5_ctx->renew_tgt_ctx->timer_interval,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                      0);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->te = tevent_add_timer(ev, krb5_ctx->renew_tgt_ctx,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                   next, renew_tgt_timer_handler,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                   krb5_ctx->renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (krb5_ctx->renew_tgt_ctx->te == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_add_timer failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto fail;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov    DEBUG(SSSDBG_TRACE_LIBS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov          "Adding offline callback to remove renewal timer.\n");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    ret = be_add_offline_cb(krb5_ctx->renew_tgt_ctx, be_ctx,
7591a7368078c2b4cde744ede431260fd663903aSumit Bose                            renew_tgt_offline_callback, krb5_ctx->renew_tgt_ctx,
7591a7368078c2b4cde744ede431260fd663903aSumit Bose                            NULL);
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to add offline callback.\n");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose        goto fail;
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    }
7591a7368078c2b4cde744ede431260fd663903aSumit Bose
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov    DEBUG(SSSDBG_TRACE_LIBS, "Adding renewal task to online callbacks.\n");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    ret = be_add_online_cb(krb5_ctx->renew_tgt_ctx, be_ctx,
7591a7368078c2b4cde744ede431260fd663903aSumit Bose                           renew_tgt_online_callback, krb5_ctx->renew_tgt_ctx,
7591a7368078c2b4cde744ede431260fd663903aSumit Bose                           NULL);
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "Failed to add renewal task to online callbacks.\n");
7591a7368078c2b4cde744ede431260fd663903aSumit Bose        goto fail;
7591a7368078c2b4cde744ede431260fd663903aSumit Bose    }
7591a7368078c2b4cde744ede431260fd663903aSumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosefail:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_zfree(krb5_ctx->renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Boseerrno_t add_tgt_to_renew_table(struct krb5_ctx *krb5_ctx, const char *ccfile,
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose                               struct tgt_times *tgtt, struct pam_data *pd,
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose                               const char *upn)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_key_t key;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_value_t value;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_data *renew_data = NULL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (krb5_ctx->renew_tgt_ctx == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_TRACE_LIBS ,"Renew context not initialized, "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                  "automatic renewal not available.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (pd->cmd != SSS_PAM_AUTHENTICATE && pd->cmd != SSS_CMD_RENEW &&
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        pd->cmd != SSS_PAM_CHAUTHTOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "Unexpected pam task [%d].\n", pd->cmd);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return EINVAL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    if (upn == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "Missing user principal name.\n");
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        return EINVAL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    /* hash_enter copies the content of the hash string, so it is safe to use
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose     * discard_const_p here. */
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    key.type = HASH_KEY_STRING;
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    key.str = discard_const_p(char, upn);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data = talloc_zero(krb5_ctx->renew_tgt_ctx, struct renew_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (renew_data == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_zero failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    if (ccfile[0] == '/') {
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        renew_data->ccfile = talloc_asprintf(renew_data, "FILE:%s", ccfile);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        if (renew_data->ccfile == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov            DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose            ret = ENOMEM;
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose            goto done;
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        }
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    } else {
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose        renew_data->ccfile = talloc_strdup(renew_data, ccfile);
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose    }
589dd0f6600515926e4e514442c62366db0a62b3Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->start_time = tgtt->starttime;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->lifetime = tgtt->endtime;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->start_renew_at = (time_t) (tgtt->starttime +
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                        0.5 *(tgtt->endtime - tgtt->starttime));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = copy_pam_data(renew_data, pd, &renew_data->pd);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "copy_pam_data failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
9acfb09f7969a69f58bd45c856b01700541853caLukas Slebodnik    sss_authtok_set_empty(renew_data->pd->newauthtok);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
9acfb09f7969a69f58bd45c856b01700541853caLukas Slebodnik    ret = sss_authtok_set_ccfile(renew_data->pd->authtok, renew_data->ccfile, 0);
64af76e2bef2565caa9738f675c108a4b3789237Simo Sorce    if (ret) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to store ccfile in auth token.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->pd->cmd = SSS_CMD_RENEW;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    value.type = HASH_VALUE_PTR;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    value.ptr = renew_data;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = hash_enter(krb5_ctx->renew_tgt_ctx->tgt_table, &key, &value);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != HASH_SUCCESS) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "hash_enter failed.\n");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = EFAULT;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov    DEBUG(SSSDBG_TRACE_LIBS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov          "Added [%s] for renewal at [%.24s].\n", renew_data->ccfile,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                                           ctime(&renew_data->start_renew_at));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosedone:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != EOK) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        talloc_free(renew_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}