providers/krb5/krb5_renew_tgt.c

	krb5_renew_tgt.c revision f3f9ce8024d7610439d6c70ddafab1ab025cf8a8
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose/*
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    SSSD
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    Kerberos 5 Backend Module -- Renew a TGT automatically
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    Authors:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        Sumit Bose <sbose@redhat.com>
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    Copyright (C) 2010 Red Hat
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    This program is free software; you can redistribute it and/or modify
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    it under the terms of the GNU General Public License as published by
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    the Free Software Foundation; either version 3 of the License, or
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    (at your option) any later version.
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    This program is distributed in the hope that it will be useful,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    but WITHOUT ANY WARRANTY; without even the implied warranty of
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    GNU General Public License for more details.
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    You should have received a copy of the GNU General Public License
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    along with this program.  If not, see <http://www.gnu.org/licenses/>.
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose*/
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include <security/pam_modules.h>
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include "util/util.h"
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include "providers/krb5/krb5_common.h"
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#include "providers/krb5/krb5_auth.h"
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose#define INITIAL_TGT_TABLE_SIZE 10
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestruct renew_tgt_ctx {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_table_t *tgt_table;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct be_ctx *be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct tevent_context *ev;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct krb5_ctx *krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t timer_interval;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct tevent_timer *te;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    bool added_to_online_callbacks;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose};
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestruct renew_data {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t start_time;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t lifetime;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t start_renew_at;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct pam_data *pd;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose};
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestruct auth_data {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct be_ctx *be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct krb5_ctx *krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct pam_data *pd;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_table_t *table;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_key_t key;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose};
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_done(struct tevent_req *req);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt(struct tevent_context *ev, struct tevent_timer *te,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                      struct timeval current_time, void *private_data)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct auth_data *auth_data = talloc_get_type(private_data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                  struct auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct tevent_req *req;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    req = krb5_auth_send(auth_data, ev, auth_data->be_ctx, auth_data->pd,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                         auth_data->krb5_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (req == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("krb5_auth_send failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        talloc_free(auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    tevent_req_set_callback(req, renew_tgt_done, auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_done(struct tevent_req *req)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct auth_data *auth_data = tevent_req_callback_data(req,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                           struct auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int pam_status = PAM_SYSTEM_ERR;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int dp_err;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = krb5_auth_recv(req, &pam_status, &dp_err);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_free(req);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("krb5_auth request failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    } else {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        switch (pam_status) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            case PAM_SUCCESS:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                DEBUG(4, ("Successfully renewed TGT for user [%s].\n",
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                          auth_data->pd->user));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                break;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            case PAM_AUTHINFO_UNAVAIL:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            case PAM_AUTHTOK_LOCK_BUSY:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                DEBUG(4, ("Cannot renewed TGT for user [%s] while offline, "
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                          "will retry later.\n",
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                          auth_data->pd->user));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                break;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            default:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                DEBUG(1, ("Failed to renew TGT for user [%s].\n",
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                          auth_data->pd->user));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                ret = hash_delete(auth_data->table, &auth_data->key);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                if (ret != HASH_SUCCESS) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    DEBUG(1, ("hash_delete failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_zfree(auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic errno_t renew_all_tgts(struct renew_tgt_ctx *renew_tgt_ctx)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_entry_t *entries;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    unsigned long count;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    size_t c;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    time_t now;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct auth_data *auth_data;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_data *renew_data;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct tevent_timer *te;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = hash_entries(renew_tgt_ctx->tgt_table, &count, &entries);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != HASH_SUCCESS) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("hash_entries failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    now = time(NULL);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    for (c = 0; c < count; c++) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        renew_data = talloc_get_type(entries[c].value.ptr, struct renew_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(9, ("Checking [%s] for renewal at [%.24s].\n", entries[c].key.str,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                  ctime(&renew_data->start_renew_at)));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        if (renew_data->start_renew_at < now) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            auth_data = talloc_zero(renew_tgt_ctx, struct auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            if (auth_data == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                DEBUG(1, ("talloc_zero failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            } else {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->pd = renew_data->pd;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->krb5_ctx = renew_tgt_ctx->krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->be_ctx = renew_tgt_ctx->be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->table = renew_tgt_ctx->tgt_table;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->key.type = entries[c].key.type;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                auth_data->key.str = talloc_strdup(auth_data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                   entries[c].key.str);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                if (auth_data->key.str == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    DEBUG(1, ("talloc_strdup failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    te = NULL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                } else {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    te = tevent_add_timer(renew_tgt_ctx->ev,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                          auth_data, tevent_timeval_current(),
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                          renew_tgt, auth_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    if (te == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                        DEBUG(1, ("tevent_add_timer failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            if (auth_data == NULL || te == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                DEBUG(1, ("Failed to renew TGT in [%s].\n", entries[c].key.str));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                ret = hash_delete(renew_tgt_ctx->tgt_table, &entries[c].key);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                if (ret != HASH_SUCCESS) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                    DEBUG(1, ("hash_delete failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_free(entries);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_handler(struct renew_tgt_ctx *renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_online_callback(void *private_data)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_tgt_ctx *renew_tgt_ctx = talloc_get_type(private_data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                          struct renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_tgt_ctx->added_to_online_callbacks = false;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_handler(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_tgt_timer_handler(struct tevent_context *ev,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                    struct tevent_timer *te,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                    struct timeval current_time, void *data)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_tgt_ctx *renew_tgt_ctx = talloc_get_type(data,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                          struct renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_handler(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosestatic void renew_handler(struct renew_tgt_ctx *renew_tgt_ctx)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct timeval next;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (be_is_offline(renew_tgt_ctx->be_ctx)) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        if (renew_tgt_ctx->added_to_online_callbacks) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            DEBUG(3, ("Renewal task was already added to online callbacks.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(7, ("Offline, adding renewal task to online callbacks.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = be_add_online_cb(renew_tgt_ctx->krb5_ctx, renew_tgt_ctx->be_ctx,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                               renew_tgt_online_callback, renew_tgt_ctx, NULL);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        if (ret == EOK) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            renew_tgt_ctx->added_to_online_callbacks = true;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("Failed to add the renewal task to online callbacks, "
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                  "continue normal operation.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    } else {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = renew_all_tgts(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        if (ret != EOK) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            DEBUG(1, ("renew_all_tgts failed. "
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                      "Disabling automatic TGT renewal\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            sss_log(SSS_LOG_ERR, "Disabling automatic TGT renewal.");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            talloc_zfree(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    DEBUG(7, ("Adding new renew timer.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    next = tevent_timeval_current_ofs(renew_tgt_ctx->timer_interval,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                      0);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_tgt_ctx->te = tevent_add_timer(renew_tgt_ctx->ev, renew_tgt_ctx,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                         next, renew_tgt_timer_handler,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                         renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (renew_tgt_ctx->te == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("tevent_add_timer failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        sss_log(SSS_LOG_ERR, "Disabling automatic TGT renewal.");
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        talloc_zfree(renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Boseerrno_t init_renew_tgt(struct krb5_ctx *krb5_ctx, struct be_ctx *be_ctx,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                       struct tevent_context *ev, time_t renew_intv)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct timeval next;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx = talloc_zero(krb5_ctx, struct renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (krb5_ctx->renew_tgt_ctx == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("talloc_zero failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = sss_hash_create(krb5_ctx->renew_tgt_ctx, INITIAL_TGT_TABLE_SIZE,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                          &krb5_ctx->renew_tgt_ctx->tgt_table);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != EOK) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("sss_hash_create failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto fail;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->be_ctx = be_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->krb5_ctx = krb5_ctx;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->ev = ev;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->timer_interval = renew_intv;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->added_to_online_callbacks = false;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    next = tevent_timeval_current_ofs(krb5_ctx->renew_tgt_ctx->timer_interval,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                      0);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    krb5_ctx->renew_tgt_ctx->te = tevent_add_timer(ev, krb5_ctx->renew_tgt_ctx,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                   next, renew_tgt_timer_handler,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                                   krb5_ctx->renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (krb5_ctx->renew_tgt_ctx->te == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("tevent_add_timer failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto fail;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosefail:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_zfree(krb5_ctx->renew_tgt_ctx);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Boseerrno_t add_tgt_to_renew_table(struct krb5_ctx *krb5_ctx, const char *ccfile,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                               struct tgt_times *tgtt, struct pam_data *pd)
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose{
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    char *key_str = NULL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    int ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_key_t key;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    hash_value_t value;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    struct renew_data *renew_data = NULL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (krb5_ctx->renew_tgt_ctx == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(7 ,("Renew context not initialized, "
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                  "automatic renewal not available.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (pd->cmd != SSS_PAM_AUTHENTICATE && pd->cmd != SSS_CMD_RENEW &&
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        pd->cmd != SSS_PAM_CHAUTHTOK) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("Unexpected pam task [%d].\n", pd->cmd));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        return EINVAL;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    key.type = HASH_KEY_STRING;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ccfile[0] == '/') {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        key_str = talloc_asprintf(NULL, "FILE:%s", ccfile);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        if (key_str == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            DEBUG(1, ("talloc_asprintf doneed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            ret = ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose            goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    } else {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        key_str = talloc_strdup(NULL, ccfile);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    key.str = key_str;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data = talloc_zero(krb5_ctx->renew_tgt_ctx, struct renew_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (renew_data == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("talloc_zero doneed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->start_time = tgtt->starttime;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->lifetime = tgtt->endtime;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->start_renew_at = (time_t) (tgtt->starttime +
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                        0.5 *(tgtt->endtime - tgtt->starttime));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = copy_pam_data(renew_data, pd, &renew_data->pd);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != EOK) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("copy_pam_data doneed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (renew_data->pd->newauthtok_type != SSS_AUTHTOK_TYPE_EMPTY) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        talloc_zfree(renew_data->pd->newauthtok);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        renew_data->pd->newauthtok_size = 0;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        renew_data->pd->newauthtok_type = SSS_AUTHTOK_TYPE_EMPTY;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_zfree(renew_data->pd->authtok);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->pd->authtok = (uint8_t *) talloc_strdup(renew_data->pd, key.str);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (renew_data->pd->authtok == NULL) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("talloc_strdup failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = ENOMEM;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->pd->authtok_size = strlen((char *) renew_data->pd->authtok) + 1;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->pd->authtok_type = SSS_AUTHTOK_TYPE_CCFILE;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    renew_data->pd->cmd = SSS_CMD_RENEW;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    value.type = HASH_VALUE_PTR;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    value.ptr = renew_data;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = hash_enter(krb5_ctx->renew_tgt_ctx->tgt_table, &key, &value);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != HASH_SUCCESS) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        DEBUG(1, ("hash_enter failed.\n"));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        ret = EFAULT;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        goto done;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    DEBUG(7, ("Added [%s] for renewal at [%.24s].\n", key_str,
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose                                           ctime(&renew_data->start_renew_at)));
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    ret = EOK;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bosedone:
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    talloc_free(key_str);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    if (ret != EOK) {
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose        talloc_free(renew_data);
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    }
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose    return ret;
f3f9ce8024d7610439d6c70ddafab1ab025cf8a8Sumit Bose}