pam_modules/authtok_check/dict.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <sys/stat.h>
#include <stdio.h>
#include <syslog.h>
#include <fcntl.h>
#include <time.h>
#include <errno.h>
#include <signal.h>
#include "packer.h"

static int lockfd = -1;
static struct flock flock = { 0, 0, 0, 0, 0, 0 };

char dblock[PATH_MAX];

#define	LOCK_WAIT	1000000
#define	LOCK_RETRIES	60

/*
 * lock_db()
 *
 * Create a lockfile to prevent simultaneous access to the database
 * creation routines. We set a timeout to LOCK_WAIT seconds. If we
 * haven't obtained a lock after LOCK_RETIRES attempts, we bail out.
 *
 * returns 0 on succes, -1 on (lock) failure.
 * side effect: the directory "path" will be created if it didn't exist.
 */
int
lock_db(char *path)
{
	int retval;
	struct stat st;
	int retries = 0;

	/* create directory "path" if it doesn't exist */
	if (stat(path, &st) == -1) {
		if (errno != ENOENT ||
		    (mkdir(path, 0755) == -1 || chmod(path, 0755) == -1))
			return (-1);
	}

	(void) snprintf(dblock, sizeof (dblock), "%s/authtok_check.lock", path);

	if ((lockfd = open(dblock, O_WRONLY|O_CREAT|O_EXCL, 0400)) == -1) {
		if (errno == EEXIST)
			lockfd = open(dblock, O_WRONLY);
		if (lockfd == -1) {
			int olderrno = errno;
			syslog(LOG_ERR, "pam_authtok_check::pam_sm_chauthtok: "
			    "can't open lockfile: %s", strerror(errno));
			errno = olderrno;
			return (-1);
		}
	}

	do {
		flock.l_type = F_WRLCK;
		retval = fcntl(lockfd, F_SETLK, &flock);
		if (retval == -1)
			(void) usleep(LOCK_WAIT);
	} while (retval == -1 && ++retries < LOCK_RETRIES);

	if (retval == -1) {
		int errno_saved = errno;
		syslog(LOG_ERR, "pam_authtok_check::pam_sm_chauthtok: timeout "
		    "waiting for dictionary lock.");
		errno = errno_saved;
	}

	return (retval);
}

/*
 * unlock_db()
 *
 * Release the database lock
 */
void
unlock_db(void)
{
	if (lockfd != -1) {
		flock.l_type = F_UNLCK;
		(void) fcntl(lockfd, F_SETLK, &flock);
		(void) close(lockfd);
		lockfd = -1;
	}
}

/*
 * database_present()
 *
 * returns 0 if the database files are found, and the database size is
 * greater than 0 and the database version matches the current version.
 */
int
database_present(char *path)
{
	struct stat st;
	char dict_hwm[PATH_MAX];
	char dict_pwd[PATH_MAX];
	char dict_pwi[PATH_MAX];
	PWDICT *dict;

	(void) snprintf(dict_hwm, sizeof (dict_hwm), "%s/%s", path,
	    DICT_DATABASE_HWM);
	(void) snprintf(dict_pwd, sizeof (dict_pwd), "%s/%s", path,
	    DICT_DATABASE_PWD);
	(void) snprintf(dict_pwi, sizeof (dict_pwi), "%s/%s", path,
	    DICT_DATABASE_PWI);

	if (stat(dict_hwm, &st) == -1 ||
	    (stat(dict_pwd, &st) == -1 || st.st_size == 0) ||
	    stat(dict_pwi, &st) == -1)
		return (NO_DICTDATABASE);

	/* verify database version number by trying to open it */
	if ((dict = PWOpen(path, "r")) == NULL) {
		/* the files are there, but an outdated version */
		PWRemove(path);
		return (NO_DICTDATABASE);
	}
	(void) PWClose(dict);
	return (0);
}

/*
 * build_dict_database(list, char *path)
 *
 * Create the Crack Dictionary Database based on the list of sources
 * dictionaries specified in "list". Store the database in "path".
 */
int
build_dict_database(char *list, char *path)
{
	return (packer(list, path) == -1 ? DICTDATABASE_BUILD_ERR : 0);
}

/*
 * Rebuild the database in "path" if the database is older than one of the
 * files listed in "list", or older than the config-file PWADMIN.
 */
int
update_dict_database(char *list, char *path)
{
	struct stat st_db;
	struct stat st_file;
	char *buf;
	char *listcopy;
	boolean_t update_needed = B_FALSE;
	char dbase_pwd[PATH_MAX];

	(void) snprintf(dbase_pwd, sizeof (dbase_pwd), "%s/%s", path,
	    DICT_DATABASE_PWD);

	if (stat(dbase_pwd, &st_db) == -1)
		return (DICTFILE_ERR);

	if ((listcopy = strdup(list)) == NULL)
		return (DICTFILE_ERR);

	buf = strtok(listcopy,  "\t ,");

	/* Compare mtime of each listed dictionary against DB mtime */
	while (update_needed == B_FALSE && buf != NULL) {
		if (stat(buf, &st_file) == -1) {
			if (errno == ENOENT) {
				syslog(LOG_ERR,
				    "pam_authtok_check:update_dict_database: "
				    "dictionary \"%s\" not present.", buf);
			} else {
				syslog(LOG_ERR,
				    "pam_authtok_check:update_dict_database: "
				    "stat(%s) failed: %s", buf,
				    strerror(errno));
			}
			free(listcopy);
			return (DICTFILE_ERR);
		}
		if (st_db.st_mtime < st_file.st_mtime)
			update_needed = B_TRUE;	/* database out of date */
		buf = strtok(NULL, "\t ,");
	}

	free(listcopy);

	/*
	 * If /etc/default/passwd is updated, generate the database.
	 * Because this is the only way we can check if files have been
	 * added/deleted from DICTIONLIST.
	 * Drawback: the database will also be generated when other
	 * tunables are changed.
	 */
	if (stat(PWADMIN, &st_file) != -1 && st_db.st_mtime < st_file.st_mtime)
		update_needed = B_TRUE;

	if (update_needed) {
		/*
		 * Since we actually rebuild the database, we need to remove
		 * the old database first.
		 */
		PWRemove(path);
		return (build_dict_database(list, path));
	}

	return (0);
}

/*
 * Build or update database, while holding the global lock.
 */
int
make_dict_database(char *list, char *path)
{
	int r = -1;

	if (lock_db(path) == 0) {
		if (database_present(path) == NO_DICTDATABASE)
			r = build_dict_database(list, path);
		else
			r = update_dict_database(list, path);
		unlock_db();
	}
	return (r);
}