kcm/kcm_locl.h

   1 /*
   2  * Copyright (c) 2005, PADL Software Pty Ltd.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  *
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * 3. Neither the name of PADL Software nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 /*
  34  * $Id$
  35  */
  36
  37 #ifndef __KCM_LOCL_H__
  38 #define __KCM_LOCL_H__
  39
  40 #include "headers.h"
  41
  42 #include <kcm.h>
  43
  44 #define KCM_LOG_REQUEST(_context, _client, _opcode)     do { \
  45     kcm_log(1, "%s request by process %d/uid %d", \
  46             kcm_op2string(_opcode), (_client)->pid, (_client)->uid); \
  47     } while (0)
  48
  49 #define KCM_LOG_REQUEST_NAME(_context, _client, _opcode, _name) do { \
  50     kcm_log(1, "%s request for cache %s by process %d/uid %d", \
  51             kcm_op2string(_opcode), (_name), (_client)->pid, (_client)->uid); \
  52     } while (0)
  53
  54 /* Cache management */
  55
  56 #define KCM_FLAGS_VALID                 0x0001
  57 #define KCM_FLAGS_USE_KEYTAB            0x0002
  58 #define KCM_FLAGS_RENEWABLE             0x0004
  59 #define KCM_FLAGS_OWNER_IS_SYSTEM       0x0008
  60 #define KCM_FLAGS_USE_CACHED_KEY        0x0010
  61
  62 #define KCM_MASK_KEY_PRESENT            ( KCM_FLAGS_USE_KEYTAB | \
  63                                           KCM_FLAGS_USE_CACHED_KEY )
  64
  65 struct kcm_ccache_data;
  66 struct kcm_creds;
  67
  68 struct kcm_creds {
  69     kcmuuid_t uuid;
  70     krb5_creds cred;
  71     struct kcm_creds *next;
  72 };
  73
  74 typedef struct kcm_ccache_data {
  75     char *name;
  76     unsigned refcnt;
  77     uint16_t flags;
  78     uint16_t mode;
  79     uid_t uid;
  80     gid_t gid;
  81     krb5_principal client; /* primary client principal */
  82     krb5_principal server; /* primary server principal (TGS if NULL) */
  83     struct kcm_creds *creds;
  84     krb5_deltat tkt_life;
  85     krb5_deltat renew_life;
  86     union {
  87         krb5_keytab keytab;
  88         krb5_keyblock keyblock;
  89     } key;
  90     HEIMDAL_MUTEX mutex;
  91     struct kcm_ccache_data *next;
  92 } kcm_ccache_data;
  93
  94 #define KCM_ASSERT_VALID(_ccache)               do { \
  95     if (((_ccache)->flags & KCM_FLAGS_VALID) == 0) \
  96         krb5_abortx(context, "kcm_free_ccache_data: ccache invalid"); \
  97     else if ((_ccache)->refcnt == 0) \
  98         krb5_abortx(context, "kcm_free_ccache_data: ccache refcnt == 0"); \
  99     } while (0)
 100
 101 typedef kcm_ccache_data *kcm_ccache;
 102
 103 /* Event management */
 104
 105 typedef struct kcm_event {
 106     int valid;
 107     time_t fire_time;
 108     unsigned fire_count;
 109     time_t expire_time;
 110     time_t backoff_time;
 111     enum {
 112         KCM_EVENT_NONE = 0,
 113         KCM_EVENT_ACQUIRE_CREDS,
 114         KCM_EVENT_RENEW_CREDS,
 115         KCM_EVENT_DESTROY_CREDS,
 116         KCM_EVENT_DESTROY_EMPTY_CACHE
 117     } action;
 118     kcm_ccache ccache;
 119     struct kcm_event *next;
 120 } kcm_event;
 121
 122 /* wakeup interval for event queue */
 123 #define KCM_EVENT_QUEUE_INTERVAL                60
 124 #define KCM_EVENT_DEFAULT_BACKOFF_TIME          5
 125 #define KCM_EVENT_MAX_BACKOFF_TIME              (12 * 60 * 60)
 126
 127
 128 /* Request format is  LENGTH | MAJOR | MINOR | OPERATION | request */
 129 /* Response format is LENGTH | STATUS | response */
 130
 131 typedef struct kcm_client {
 132     pid_t pid;
 133     uid_t uid;
 134     gid_t gid;
 135 } kcm_client;
 136
 137 #define CLIENT_IS_ROOT(client) ((client)->uid == 0)
 138
 139 /* Dispatch table */
 140 /* passed in OPERATION | ... ; returns STATUS | ... */
 141 typedef krb5_error_code (*kcm_method)(krb5_context, kcm_client *, kcm_operation, krb5_storage *, krb5_storage *);
 142
 143 struct kcm_op {
 144     const char *name;
 145     kcm_method method;
 146 };
 147
 148 #define DEFAULT_LOG_DEST    "0/FILE:" LOCALSTATEDIR "/log/kcmd.log"
 149 #define _PATH_KCM_CONF      SYSCONFDIR "/kcm.conf"
 150
 151 extern krb5_context kcm_context;
 152 extern char *socket_path;
 153 extern char *door_path;
 154 extern size_t max_request;
 155 extern sig_atomic_t exit_flag;
 156 extern int name_constraints;
 157 #ifdef SUPPORT_DETACH
 158 extern int detach_from_console;
 159 #endif
 160 extern int disallow_getting_krbtgt;
 161
 162 #if 0
 163 extern const krb5_cc_ops krb5_kcmss_ops;
 164 #endif
 165
 166 #include <kcm-protos.h>
 167
 168 #endif /* __KCM_LOCL_H__ */
 169