OpenSolaris_b135/lib/pam_modules/authtok_check/dict.c
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include <sys/stat.h>
#include <stdio.h>
#include <syslog.h>
#include <fcntl.h>
#include <time.h>
#include <errno.h>
#include <signal.h>
#include "packer.h"
static int lockfd = -1;
static struct flock flock = { 0, 0, 0, 0, 0, 0 };
char dblock[PATH_MAX];
#define LOCK_WAIT 1000000
#define LOCK_RETRIES 60
/*
* lock_db()
*
* Create a lockfile to prevent simultaneous access to the database
* creation routines. We set a timeout to LOCK_WAIT seconds. If we
* haven't obtained a lock after LOCK_RETIRES attempts, we bail out.
*
* returns 0 on succes, -1 on (lock) failure.
* side effect: the directory "path" will be created if it didn't exist.
*/
int
lock_db(char *path)
{
int retval;
struct stat st;
int retries = 0;
/* create directory "path" if it doesn't exist */
if (stat(path, &st) == -1) {
if (errno != ENOENT ||
(mkdir(path, 0755) == -1 || chmod(path, 0755) == -1))
return (-1);
}
(void) snprintf(dblock, sizeof (dblock), "%s/authtok_check.lock", path);
if ((lockfd = open(dblock, O_WRONLY|O_CREAT|O_EXCL, 0400)) == -1) {
if (errno == EEXIST)
lockfd = open(dblock, O_WRONLY);
if (lockfd == -1) {
int olderrno = errno;
syslog(LOG_ERR, "pam_authtok_check::pam_sm_chauthtok: "
"can't open lockfile: %s", strerror(errno));
errno = olderrno;
return (-1);
}
}
do {
flock.l_type = F_WRLCK;
retval = fcntl(lockfd, F_SETLK, &flock);
if (retval == -1)
(void) usleep(LOCK_WAIT);
} while (retval == -1 && ++retries < LOCK_RETRIES);
if (retval == -1) {
int errno_saved = errno;
syslog(LOG_ERR, "pam_authtok_check::pam_sm_chauthtok: timeout "
"waiting for dictionary lock.");
errno = errno_saved;
}
return (retval);
}
/*
* unlock_db()
*
* Release the database lock
*/
void
unlock_db(void)
{
if (lockfd != -1) {
flock.l_type = F_UNLCK;
(void) fcntl(lockfd, F_SETLK, &flock);
(void) close(lockfd);
lockfd = -1;
}
}
/*
* database_present()
*
* returns 0 if the database files are found, and the database size is
* greater than 0 and the database version matches the current version.
*/
int
database_present(char *path)
{
struct stat st;
char dict_hwm[PATH_MAX];
char dict_pwd[PATH_MAX];
char dict_pwi[PATH_MAX];
PWDICT *dict;
(void) snprintf(dict_hwm, sizeof (dict_hwm), "%s/%s", path,
DICT_DATABASE_HWM);
(void) snprintf(dict_pwd, sizeof (dict_pwd), "%s/%s", path,
DICT_DATABASE_PWD);
(void) snprintf(dict_pwi, sizeof (dict_pwi), "%s/%s", path,
DICT_DATABASE_PWI);
if (stat(dict_hwm, &st) == -1 ||
(stat(dict_pwd, &st) == -1 || st.st_size == 0) ||
stat(dict_pwi, &st) == -1)
return (NO_DICTDATABASE);
/* verify database version number by trying to open it */
if ((dict = PWOpen(path, "r")) == NULL) {
/* the files are there, but an outdated version */
PWRemove(path);
return (NO_DICTDATABASE);
}
(void) PWClose(dict);
return (0);
}
/*
* build_dict_database(list, char *path)
*
* Create the Crack Dictionary Database based on the list of sources
* dictionaries specified in "list". Store the database in "path".
*/
int
build_dict_database(char *list, char *path)
{
return (packer(list, path) == -1 ? DICTDATABASE_BUILD_ERR : 0);
}
/*
* Rebuild the database in "path" if the database is older than one of the
* files listed in "list", or older than the config-file PWADMIN.
*/
int
update_dict_database(char *list, char *path)
{
struct stat st_db;
struct stat st_file;
char *buf;
char *listcopy;
boolean_t update_needed = B_FALSE;
char dbase_pwd[PATH_MAX];
(void) snprintf(dbase_pwd, sizeof (dbase_pwd), "%s/%s", path,
DICT_DATABASE_PWD);
if (stat(dbase_pwd, &st_db) == -1)
return (DICTFILE_ERR);
if ((listcopy = strdup(list)) == NULL)
return (DICTFILE_ERR);
buf = strtok(listcopy, "\t ,");
/* Compare mtime of each listed dictionary against DB mtime */
while (update_needed == B_FALSE && buf != NULL) {
if (stat(buf, &st_file) == -1) {
if (errno == ENOENT) {
syslog(LOG_ERR,
"pam_authtok_check:update_dict_database: "
"dictionary \"%s\" not present.", buf);
} else {
syslog(LOG_ERR,
"pam_authtok_check:update_dict_database: "
"stat(%s) failed: %s", buf,
strerror(errno));
}
free(listcopy);
return (DICTFILE_ERR);
}
if (st_db.st_mtime < st_file.st_mtime)
update_needed = B_TRUE; /* database out of date */
buf = strtok(NULL, "\t ,");
}
free(listcopy);
/*
* If /etc/default/passwd is updated, generate the database.
* Because this is the only way we can check if files have been
* added/deleted from DICTIONLIST.
* Drawback: the database will also be generated when other
* tunables are changed.
*/
if (stat(PWADMIN, &st_file) != -1 && st_db.st_mtime < st_file.st_mtime)
update_needed = B_TRUE;
if (update_needed) {
/*
* Since we actually rebuild the database, we need to remove
* the old database first.
*/
PWRemove(path);
return (build_dict_database(list, path));
}
return (0);
}
/*
* Build or update database, while holding the global lock.
*/
int
make_dict_database(char *list, char *path)
{
int r = -1;
if (lock_db(path) == 0) {
if (database_present(path) == NO_DICTDATABASE)
r = build_dict_database(list, path);
else
r = update_dict_database(list, path);
unlock_db();
}
return (r);
}