projects / awesomized / libmemcached / blob
? search:


ee22586810b6fde66ed18a21d158a2ac518c57a6
[awesomized/libmemcached] / libmemcached / sasl.cc
1 /* vim:expandtab:shiftwidth=2:tabstop=2:smarttab:
2 *
3 * Libmemcached library
4 *
5 * Copyright (C) 2011-2012 Data Differential, http://datadifferential.com/
6 * Copyright (C) 2006-2009 Brian Aker All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are
10 * met:
11 *
12 * * Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * * Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following disclaimer
17 * in the documentation and/or other materials provided with the
18 * distribution.
19 *
20 * * The names of its contributors may not be used to endorse or
21 * promote products derived from this software without specific prior
22 * written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
27 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
28 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
29 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
30 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
34 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 *
36 */
37
38 #include "libmemcached/common.h"
39 #include <cassert>
40
41 #if defined(LIBMEMCACHED_WITH_SASL_SUPPORT) && LIBMEMCACHED_WITH_SASL_SUPPORT
42
43 #if defined(HAVE_LIBSASL) && HAVE_LIBSASL
44 #include <sasl/sasl.h>
45 #endif
46
47 #include <pthread.h>
48
49 void memcached_set_sasl_callbacks(memcached_st *shell,
50 const sasl_callback_t *callbacks)
51 {
52 Memcached* self= memcached2Memcached(shell);
53 if (self)
54 {
55 self->sasl.callbacks= const_cast<sasl_callback_t *>(callbacks);
56 self->sasl.is_allocated= false;
57 }
58 }
59
60 sasl_callback_t *memcached_get_sasl_callbacks(memcached_st *shell)
61 {
62 Memcached* self= memcached2Memcached(shell);
63 if (self)
64 {
65 return self->sasl.callbacks;
66 }
67
68 return NULL;
69 }
70
71 /**
72 * Resolve the names for both ends of a connection
73 * @param fd socket to check
74 * @param laddr local address (out)
75 * @param raddr remote address (out)
76 * @return true on success false otherwise (errno contains more info)
77 */
78 static memcached_return_t resolve_names(memcached_instance_st& server, char *laddr, size_t laddr_length, char *raddr, size_t raddr_length)
79 {
80 char host[MEMCACHED_NI_MAXHOST];
81 char port[MEMCACHED_NI_MAXSERV];
82 struct sockaddr_storage saddr;
83 socklen_t salen= sizeof(saddr);
84
85 if (getsockname(server.fd, (struct sockaddr *)&saddr, &salen) < 0)
86 {
87 return memcached_set_error(server, MEMCACHED_HOST_LOOKUP_FAILURE, MEMCACHED_AT);
88 }
89
90 if (getnameinfo((struct sockaddr *)&saddr, salen, host, sizeof(host), port, sizeof(port), NI_NUMERICHOST | NI_NUMERICSERV) < 0)
91 {
92 return memcached_set_error(server, MEMCACHED_HOST_LOOKUP_FAILURE, MEMCACHED_AT);
93 }
94
95 (void)snprintf(laddr, laddr_length, "%s;%s", host, port);
96 salen= sizeof(saddr);
97
98 if (getpeername(server.fd, (struct sockaddr *)&saddr, &salen) < 0)
99 {
100 return memcached_set_error(server, MEMCACHED_HOST_LOOKUP_FAILURE, MEMCACHED_AT);
101 }
102
103 if (getnameinfo((struct sockaddr *)&saddr, salen, host, sizeof(host),
104 port, sizeof(port), NI_NUMERICHOST | NI_NUMERICSERV) < 0)
105 {
106 return memcached_set_error(server, MEMCACHED_HOST_LOOKUP_FAILURE, MEMCACHED_AT);
107 }
108
109 (void)snprintf(raddr, raddr_length, "%s;%s", host, port);
110
111 return MEMCACHED_SUCCESS;
112 }
113
114 extern "C" {
115
116 static void sasl_shutdown_function()
117 {
118 sasl_done();
119 }
120
121 static volatile int sasl_startup_state= SASL_OK;
122 pthread_mutex_t sasl_startup_state_LOCK= PTHREAD_MUTEX_INITIALIZER;
123 static pthread_once_t sasl_startup_once= PTHREAD_ONCE_INIT;
124 static void sasl_startup_function(void)
125 {
126 sasl_startup_state= sasl_client_init(NULL);
127
128 if (sasl_startup_state == SASL_OK)
129 {
130 (void)atexit(sasl_shutdown_function);
131 }
132 }
133
134 } // extern "C"
135
136 memcached_return_t memcached_sasl_authenticate_connection(memcached_instance_st* server)
137 {
138 if (LIBMEMCACHED_WITH_SASL_SUPPORT == 0)
139 {
140 return MEMCACHED_NOT_SUPPORTED;
141 }
142
143 if (server == NULL)
144 {
145 return MEMCACHED_INVALID_ARGUMENTS;
146 }
147
148 /* SANITY CHECK: SASL can only be used with the binary protocol */
149 if (memcached_is_binary(server->root) == false)
150 {
151 return memcached_set_error(*server, MEMCACHED_INVALID_ARGUMENTS, MEMCACHED_AT,
152 memcached_literal_param("memcached_sasl_authenticate_connection() is not supported via the ASCII protocol"));
153 }
154
155 /* Try to get the supported mech from the server. Servers without SASL
156 * support will return UNKNOWN COMMAND, so we can just treat that
157 * as authenticated
158 */
159 protocol_binary_request_no_extras request= { };
160
161 initialize_binary_request(server, request.message.header);
162
163 request.message.header.request.opcode= PROTOCOL_BINARY_CMD_SASL_LIST_MECHS;
164
165 if (memcached_io_write(server, request.bytes, sizeof(request.bytes), true) != sizeof(request.bytes))
166 {
167 return MEMCACHED_WRITE_FAILURE;
168 }
169 assert_msg(server->fd != INVALID_SOCKET, "Programmer error, invalid socket");
170
171 memcached_server_response_increment(server);
172
173 char mech[MEMCACHED_MAX_BUFFER];
174 memcached_return_t rc= memcached_response(server, mech, sizeof(mech), NULL);
175 if (memcached_failed(rc))
176 {
177 if (rc == MEMCACHED_PROTOCOL_ERROR)
178 {
179 /* If the server doesn't support SASL it will return PROTOCOL_ERROR.
180 * This error may also be returned for other errors, but let's assume
181 * that the server don't support SASL and treat it as success and
182 * let the client fail with the next operation if the error was
183 * caused by another problem....
184 */
185 rc= MEMCACHED_SUCCESS;
186 }
187
188 return rc;
189 }
190 assert_msg(server->fd != INVALID_SOCKET, "Programmer error, invalid socket");
191
192 /* set ip addresses */
193 char laddr[MEMCACHED_NI_MAXHOST + MEMCACHED_NI_MAXSERV];
194 char raddr[MEMCACHED_NI_MAXHOST + MEMCACHED_NI_MAXSERV];
195
196 if (memcached_failed(rc= resolve_names(*server, laddr, sizeof(laddr), raddr, sizeof(raddr))))
197 {
198 return rc;
199 }
200
201 int pthread_error;
202 if ((pthread_error= pthread_once(&sasl_startup_once, sasl_startup_function)) != 0)
203 {
204 return memcached_set_errno(*server, pthread_error, MEMCACHED_AT);
205 }
206
207 (void)pthread_mutex_lock(&sasl_startup_state_LOCK);
208 if (sasl_startup_state != SASL_OK)
209 {
210 const char *sasl_error_msg= sasl_errstring(sasl_startup_state, NULL, NULL);
211 return memcached_set_error(*server, MEMCACHED_AUTH_PROBLEM, MEMCACHED_AT,
212 memcached_string_make_from_cstr(sasl_error_msg));
213 }
214 (void)pthread_mutex_unlock(&sasl_startup_state_LOCK);
215
216 sasl_conn_t *conn;
217 int ret;
218 if ((ret= sasl_client_new("memcached", server->_hostname, laddr, raddr, server->root->sasl.callbacks, 0, &conn) ) != SASL_OK)
219 {
220 const char *sasl_error_msg= sasl_errstring(ret, NULL, NULL);
221
222 sasl_dispose(&conn);
223
224 return memcached_set_error(*server, MEMCACHED_AUTH_PROBLEM, MEMCACHED_AT,
225 memcached_string_make_from_cstr(sasl_error_msg));
226 }
227
228 const char *data;
229 const char *chosenmech;
230 unsigned int len;
231 ret= sasl_client_start(conn, mech, NULL, &data, &len, &chosenmech);
232 if (ret != SASL_OK and ret != SASL_CONTINUE)
233 {
234 const char *sasl_error_msg= sasl_errstring(ret, NULL, NULL);
235
236 sasl_dispose(&conn);
237
238 return memcached_set_error(*server, MEMCACHED_AUTH_PROBLEM, MEMCACHED_AT,
239 memcached_string_make_from_cstr(sasl_error_msg));
240 }
241 uint16_t keylen= (uint16_t)strlen(chosenmech);
242 request.message.header.request.opcode= PROTOCOL_BINARY_CMD_SASL_AUTH;
243 request.message.header.request.keylen= htons(keylen);
244 request.message.header.request.bodylen= htonl(len + keylen);
245
246 do {
247 /* send the packet */
248
249 libmemcached_io_vector_st vector[]=
250 {
251 { request.bytes, sizeof(request.bytes) },
252 { chosenmech, keylen },
253 { data, len }
254 };
255
256 assert_msg(server->fd != INVALID_SOCKET, "Programmer error, invalid socket");
257 if (memcached_io_writev(server, vector, 3, true) == false)
258 {
259 rc= MEMCACHED_WRITE_FAILURE;
260 break;
261 }
262 assert_msg(server->fd != INVALID_SOCKET, "Programmer error, invalid socket");
263 memcached_server_response_increment(server);
264
265 /* read the response */
266 assert_msg(server->fd != INVALID_SOCKET, "Programmer error, invalid socket");
267 rc= memcached_response(server, NULL, 0, NULL);
268 if (rc != MEMCACHED_AUTH_CONTINUE)
269 {
270 break;
271 }
272 assert_msg(server->fd != INVALID_SOCKET, "Programmer error, invalid socket");
273
274 ret= sasl_client_step(conn, memcached_result_value(&server->root->result),
275 (unsigned int)memcached_result_length(&server->root->result),
276 NULL, &data, &len);
277
278 if (ret != SASL_OK && ret != SASL_CONTINUE)
279 {
280 rc= MEMCACHED_AUTH_PROBLEM;
281 break;
282 }
283
284 request.message.header.request.opcode= PROTOCOL_BINARY_CMD_SASL_STEP;
285 request.message.header.request.bodylen= htonl(len + keylen);
286 } while (true);
287
288 /* Release resources */
289 sasl_dispose(&conn);
290
291 return memcached_set_error(*server, rc, MEMCACHED_AT);
292 }
293
294 static int get_username(void *context, int id, const char **result, unsigned int *len)
295 {
296 if (!context || !result || (id != SASL_CB_USER && id != SASL_CB_AUTHNAME))
297 {
298 return SASL_BADPARAM;
299 }
300
301 *result= (char *)context;
302 if (len)
303 {
304 *len= (unsigned int)strlen(*result);
305 }
306
307 return SASL_OK;
308 }
309
310 static int get_password(sasl_conn_t *conn, void *context, int id,
311 sasl_secret_t **psecret)
312 {
313 if (!conn || ! psecret || id != SASL_CB_PASS)
314 {
315 return SASL_BADPARAM;
316 }
317
318 *psecret= (sasl_secret_t *)context;
319
320 return SASL_OK;
321 }
322
323 memcached_return_t memcached_set_sasl_auth_data(memcached_st *shell,
324 const char *username,
325 const char *password)
326 {
327 Memcached* ptr= memcached2Memcached(shell);
328 if (LIBMEMCACHED_WITH_SASL_SUPPORT == 0)
329 {
330 return MEMCACHED_NOT_SUPPORTED;
331 }
332
333 if (ptr == NULL or username == NULL or password == NULL)
334 {
335 return MEMCACHED_INVALID_ARGUMENTS;
336 }
337
338 memcached_return_t ret;
339 if (memcached_failed(ret= memcached_behavior_set(ptr, MEMCACHED_BEHAVIOR_BINARY_PROTOCOL, 1)))
340 {
341 return memcached_set_error(*ptr, ret, MEMCACHED_AT, memcached_literal_param("Unable change to binary protocol which is required for SASL."));
342 }
343
344 memcached_destroy_sasl_auth_data(ptr);
345
346 sasl_callback_t *callbacks= libmemcached_xcalloc(ptr, 4, sasl_callback_t);
347 size_t password_length= strlen(password);
348 size_t username_length= strlen(username);
349 char *name= (char *)libmemcached_malloc(ptr, username_length +1);
350 sasl_secret_t *secret= (sasl_secret_t*)libmemcached_malloc(ptr, password_length +1 + sizeof(sasl_secret_t));
351
352 if (callbacks == NULL or name == NULL or secret == NULL)
353 {
354 libmemcached_free(ptr, callbacks);
355 libmemcached_free(ptr, name);
356 libmemcached_free(ptr, secret);
357 return memcached_set_error(*ptr, MEMCACHED_MEMORY_ALLOCATION_FAILURE, MEMCACHED_AT);
358 }
359
360 secret->len= password_length;
361 memcpy(secret->data, password, password_length);
362 secret->data[password_length]= 0;
363
364 callbacks[0].id= SASL_CB_USER;
365 callbacks[0].proc= (int (*)())get_username;
366 callbacks[0].context= strncpy(name, username, username_length +1);
367 callbacks[1].id= SASL_CB_AUTHNAME;
368 callbacks[1].proc= (int (*)())get_username;
369 callbacks[1].context= name;
370 callbacks[2].id= SASL_CB_PASS;
371 callbacks[2].proc= (int (*)())get_password;
372 callbacks[2].context= secret;
373 callbacks[3].id= SASL_CB_LIST_END;
374
375 ptr->sasl.callbacks= callbacks;
376 ptr->sasl.is_allocated= true;
377
378 return MEMCACHED_SUCCESS;
379 }
380
381 memcached_return_t memcached_destroy_sasl_auth_data(memcached_st *shell)
382 {
383 if (LIBMEMCACHED_WITH_SASL_SUPPORT == 0)
384 {
385 return MEMCACHED_NOT_SUPPORTED;
386 }
387
388 Memcached* ptr= memcached2Memcached(shell);
389 if (ptr == NULL)
390 {
391 return MEMCACHED_INVALID_ARGUMENTS;
392 }
393
394 if (ptr->sasl.callbacks == NULL)
395 {
396 return MEMCACHED_SUCCESS;
397 }
398
399 if (ptr->sasl.is_allocated)
400 {
401 libmemcached_free(ptr, ptr->sasl.callbacks[0].context);
402 libmemcached_free(ptr, ptr->sasl.callbacks[2].context);
403 libmemcached_free(ptr, (void*)ptr->sasl.callbacks);
404 ptr->sasl.is_allocated= false;
405 }
406
407 ptr->sasl.callbacks= NULL;
408
409 return MEMCACHED_SUCCESS;
410 }
411
412 memcached_return_t memcached_clone_sasl(memcached_st *clone, const memcached_st *source)
413 {
414 if (LIBMEMCACHED_WITH_SASL_SUPPORT == 0)
415 {
416 return MEMCACHED_NOT_SUPPORTED;
417 }
418
419 if (clone == NULL or source == NULL)
420 {
421 return MEMCACHED_INVALID_ARGUMENTS;
422 }
423
424 if (source->sasl.callbacks == NULL)
425 {
426 return MEMCACHED_SUCCESS;
427 }
428
429 /* Hopefully we are using our own callback mechanisms.. */
430 if (source->sasl.callbacks[0].id == SASL_CB_USER &&
431 source->sasl.callbacks[0].proc == (int (*)())get_username &&
432 source->sasl.callbacks[1].id == SASL_CB_AUTHNAME &&
433 source->sasl.callbacks[1].proc == (int (*)())get_username &&
434 source->sasl.callbacks[2].id == SASL_CB_PASS &&
435 source->sasl.callbacks[2].proc == (int (*)())get_password &&
436 source->sasl.callbacks[3].id == SASL_CB_LIST_END)
437 {
438 sasl_secret_t *secret= (sasl_secret_t *)source->sasl.callbacks[2].context;
439 return memcached_set_sasl_auth_data(clone,
440 (const char*)source->sasl.callbacks[0].context,
441 (const char*)secret->data);
442 }
443
444 /*
445 * But we're not. It may work if we know what the user tries to pass
446 * into the list, but if we don't know the ID we don't know how to handle
447 * the context...
448 */
449 ptrdiff_t total= 0;
450
451 while (source->sasl.callbacks[total].id != SASL_CB_LIST_END)
452 {
453 switch (source->sasl.callbacks[total].id)
454 {
455 case SASL_CB_USER:
456 case SASL_CB_AUTHNAME:
457 case SASL_CB_PASS:
458 break;
459 default:
460 /* I don't know how to deal with this... */
461 return MEMCACHED_NOT_SUPPORTED;
462 }
463
464 ++total;
465 }
466
467 sasl_callback_t *callbacks= libmemcached_xcalloc(clone, total +1, sasl_callback_t);
468 if (callbacks == NULL)
469 {
470 return MEMCACHED_MEMORY_ALLOCATION_FAILURE;
471 }
472 memcpy(callbacks, source->sasl.callbacks, (total + 1) * sizeof(sasl_callback_t));
473
474 /* Now update the context... */
475 for (ptrdiff_t x= 0; x < total; ++x)
476 {
477 if (callbacks[x].id == SASL_CB_USER || callbacks[x].id == SASL_CB_AUTHNAME)
478 {
479 callbacks[x].context= (sasl_callback_t*)libmemcached_malloc(clone, strlen((const char*)source->sasl.callbacks[x].context));
480
481 if (callbacks[x].context == NULL)
482 {
483 /* Failed to allocate memory, clean up previously allocated memory */
484 for (ptrdiff_t y= 0; y < x; ++y)
485 {
486 libmemcached_free(clone, clone->sasl.callbacks[y].context);
487 }
488
489 libmemcached_free(clone, callbacks);
490 return MEMCACHED_MEMORY_ALLOCATION_FAILURE;
491 }
492 strncpy((char*)callbacks[x].context, (const char*)source->sasl.callbacks[x].context, sizeof(callbacks[x].context));
493 }
494 else
495 {
496 sasl_secret_t *src= (sasl_secret_t *)source->sasl.callbacks[x].context;
497 sasl_secret_t *n= (sasl_secret_t*)libmemcached_malloc(clone, src->len + 1 + sizeof(*n));
498 if (n == NULL)
499 {
500 /* Failed to allocate memory, clean up previously allocated memory */
501 for (ptrdiff_t y= 0; y < x; ++y)
502 {
503 libmemcached_free(clone, clone->sasl.callbacks[y].context);
504 }
505
506 libmemcached_free(clone, callbacks);
507 return MEMCACHED_MEMORY_ALLOCATION_FAILURE;
508 }
509 memcpy(n, src, src->len + 1 + sizeof(*n));
510 callbacks[x].context= n;
511 }
512 }
513
514 clone->sasl.callbacks= callbacks;
515 clone->sasl.is_allocated= true;
516
517 return MEMCACHED_SUCCESS;
518 }
519
520 #else
521
522 void memcached_set_sasl_callbacks(memcached_st *, const sasl_callback_t *)
523 {
524 }
525
526 sasl_callback_t *memcached_get_sasl_callbacks(memcached_st *)
527 {
528 return NULL;
529 }
530
531 memcached_return_t memcached_set_sasl_auth_data(memcached_st *, const char *, const char *)
532 {
533 return MEMCACHED_NOT_SUPPORTED;
534 }
535
536 memcached_return_t memcached_clone_sasl(memcached_st *, const memcached_st *)
537 {
538 return MEMCACHED_NOT_SUPPORTED;
539 }
540
541 #endif
Resurrection of libmemcached