lib/krb5/krb5_locl.h

   1 /*
   2  * Copyright (c) 1997-2016 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 /* $Id$ */
  37
  38 #ifndef __KRB5_LOCL_H__
  39 #define __KRB5_LOCL_H__
  40
  41 #include <config.h>
  42 #include <roken.h>
  43
  44 #include <ctype.h>
  45
  46 #ifdef HAVE_POLL_H
  47 #include <sys/poll.h>
  48 #endif
  49
  50 #include <krb5-types.h>
  51
  52 #ifdef HAVE_SYS_TYPES_H
  53 #include <sys/types.h>
  54 #endif
  55 #ifdef HAVE_SYS_MMAN_H
  56 #include <sys/mman.h>
  57 #endif
  58
  59 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
  60 #include <sys/ioctl.h>
  61 #endif
  62 #ifdef HAVE_PWD_H
  63 #undef _POSIX_PTHREAD_SEMANTICS
  64 /* This gets us the 5-arg getpwnam_r on Solaris 9.  */
  65 #define _POSIX_PTHREAD_SEMANTICS
  66 #include <pwd.h>
  67 #endif
  68
  69 #ifdef HAVE_SYS_SELECT_H
  70 #include <sys/select.h>
  71 #endif
  72 #ifdef _AIX
  73 struct mbuf;
  74 #endif
  75 #ifdef HAVE_SYS_FILIO_H
  76 #include <sys/filio.h>
  77 #endif
  78 #ifdef HAVE_SYS_FILE_H
  79 #include <sys/file.h>
  80 #endif
  81
  82 #include <com_err.h>
  83
  84 #include <heimbase.h>
  85 #include "heimbase-atomics.h"
  86
  87 #define HEIMDAL_TEXTDOMAIN "heimdal_krb5"
  88
  89 #ifdef LIBINTL
  90 #include <libintl.h>
  91 #define N_(x,y) dgettext(HEIMDAL_TEXTDOMAIN, x)
  92 #else
  93 #define N_(x,y) (x)
  94 #define bindtextdomain(package, localedir)
  95 #endif
  96
  97
  98 #ifdef HAVE_CRYPT_H
  99 #undef des_encrypt
 100 #define des_encrypt wingless_pigs_mostly_fail_to_fly
 101 #include <crypt.h>
 102 #undef des_encrypt
 103 #endif
 104
 105 #ifdef HAVE_DOOR_CREATE
 106 #include <door.h>
 107 #endif
 108
 109 #include <parse_time.h>
 110 #include <base64.h>
 111
 112 #include <wind.h>
 113
 114 /*
 115  * We use OpenSSL for EC, but to do this we need to disable cross-references
 116  * between OpenSSL and hcrypto bn.h and such.  Source files that use OpenSSL EC
 117  * must define HEIM_NO_CRYPTO_HDRS before including this file.
 118  */
 119 #define HC_DEPRECATED_CRYPTO
 120 #ifndef HEIM_NO_CRYPTO_HDRS
 121 #include "crypto-headers.h"
 122 #endif
 123
 124
 125 #include <krb5_asn1.h>
 126 typedef Krb5Int32 krb5int32;
 127 typedef Krb5UInt32 krb5uint32;
 128 #include <pkinit_asn1.h>
 129
 130 struct send_to_kdc;
 131
 132 /* XXX glue for pkinit */
 133 struct hx509_certs_data;
 134 struct krb5_pk_identity;
 135 struct krb5_pk_cert;
 136 struct ContentInfo;
 137 struct AlgorithmIdentifier;
 138 typedef struct krb5_pk_init_ctx_data *krb5_pk_init_ctx;
 139 struct krb5_dh_moduli;
 140 struct krb5_fast_state;
 141 struct krb5_gss_init_ctx_data;
 142
 143 /* v4 glue */
 144 struct _krb5_krb_auth_data;
 145
 146 struct krb5_gss_init_ctx_data;
 147 typedef struct krb5_gss_init_ctx_data *krb5_gss_init_ctx;
 148
 149 struct gss_ctx_id_t_desc_struct;
 150 struct gss_cred_id_t_desc_struct;
 151 struct gss_OID_desc_struct;
 152
 153 #include <der.h>
 154
 155 #include <krb5.h>
 156 #include <krb5_err.h>
 157 #include <k5e1_err.h>
 158 #include <asn1_err.h>
 159 #ifdef PKINIT
 160 #include <hx509.h>
 161 #endif
 162
 163 #include "crypto.h"
 164
 165 typedef krb5_error_code (KRB5_LIB_CALL *krb5_gssic_step)(
 166     krb5_context,
 167     krb5_gss_init_ctx,
 168     const krb5_creds *,
 169     struct gss_ctx_id_t_desc_struct **,
 170     KDCOptions options,
 171     krb5_data *,
 172     krb5_data *,
 173     krb5_data *);
 174
 175 typedef krb5_error_code (KRB5_LIB_CALL *krb5_gssic_finish)(
 176     krb5_context,
 177     krb5_gss_init_ctx,
 178     const krb5_creds *,
 179     struct gss_ctx_id_t_desc_struct *,
 180     krb5int32,
 181     krb5_enctype,
 182     krb5_principal *,
 183     krb5_keyblock **);
 184
 185 typedef void (KRB5_LIB_CALL *krb5_gssic_release_cred)(
 186     krb5_context,
 187     krb5_gss_init_ctx,
 188     struct gss_cred_id_t_desc_struct *);
 189
 190 typedef void (KRB5_LIB_CALL *krb5_gssic_delete_sec_context)(
 191     krb5_context,
 192     krb5_gss_init_ctx,
 193     struct gss_ctx_id_t_desc_struct *);
 194
 195 #define KRB5_GSS_IC_FLAG_RELEASE_CRED 1
 196
 197 #include <krb5-private.h>
 198
 199 #include "heim_threads.h"
 200
 201 extern const char _krb5_wellknown_lkdc[];
 202
 203 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X)))
 204 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0)
 205
 206 #define krb5_einval(context, argnum) _krb5_einval((context), __func__, (argnum))
 207
 208 #ifndef PATH_SEP
 209 #define PATH_SEP ":"
 210 #endif
 211
 212 /* should this be public? */
 213 #define KEYTAB_DEFAULT "FILE:" SYSCONFDIR "/krb5.keytab"
 214 #define KEYTAB_DEFAULT_MODIFY "FILE:" SYSCONFDIR "/krb5.keytab"
 215
 216 #ifndef CLIENT_KEYTAB_DEFAULT
 217 #define CLIENT_KEYTAB_DEFAULT   "FILE:" LOCALSTATEDIR "/user/%{euid}/client.keytab";
 218 #endif
 219
 220 #define MODULI_FILE SYSCONFDIR "/krb5.moduli"
 221
 222 #ifndef O_BINARY
 223 #define O_BINARY 0
 224 #endif
 225
 226 #ifndef O_CLOEXEC
 227 #define O_CLOEXEC 0
 228 #endif
 229
 230 #ifndef SOCK_CLOEXEC
 231 #define SOCK_CLOEXEC 0
 232 #endif
 233
 234
 235 #define KRB5_BUFSIZ 2048
 236
 237 typedef enum {
 238     KRB5_INIT_CREDS_TRISTATE_UNSET = 0,
 239     KRB5_INIT_CREDS_TRISTATE_TRUE,
 240     KRB5_INIT_CREDS_TRISTATE_FALSE
 241 } krb5_get_init_creds_tristate;
 242
 243 struct _krb5_get_init_creds_opt_private {
 244     int refcount;
 245     /* ENC_TIMESTAMP */
 246     const char *password;
 247     krb5_s2k_proc key_proc;
 248     /* PA_PAC_REQUEST */
 249     krb5_get_init_creds_tristate req_pac;
 250     /* PKINIT */
 251     krb5_pk_init_ctx pk_init_ctx;
 252     krb5_get_init_creds_tristate addressless;
 253     int flags;
 254 #define KRB5_INIT_CREDS_DONE                                1
 255 #define KRB5_INIT_CREDS_CANONICALIZE                        2
 256 #define KRB5_INIT_CREDS_NO_C_CANON_CHECK                    4
 257 #define KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK                   8
 258 #define KRB5_INIT_CREDS_PKINIT_KX_VALID                     32
 259 #define KRB5_INIT_CREDS_PKINIT_NO_KRBTGT_OTHERNAME_CHECK    64
 260     struct {
 261         krb5_gic_process_last_req func;
 262         void *ctx;
 263     } lr;
 264 };
 265
 266 typedef uint32_t krb5_enctype_set;
 267
 268 /*
 269  * Do not remove or reorder the fields of this structure.
 270  * Fields that are no longer used should be marked "deprecated".
 271  * New fields should always be appended to the end of the
 272  * structure.
 273  *
 274  * Although this structure is internal it is shared with
 275  * plugins and such changes will result in data corruption
 276  * if plugins are not built with a matching version.
 277  */
 278 typedef struct krb5_context_data {
 279     heim_context hcontext;
 280     krb5_enctype *etypes;
 281     krb5_enctype *cfg_etypes;
 282     krb5_enctype *etypes_des;/* deprecated */
 283     krb5_enctype *as_etypes;
 284     krb5_enctype *tgs_etypes;
 285     krb5_enctype *permitted_enctypes;
 286     char **default_realms;
 287     time_t max_skew;
 288     time_t kdc_timeout;
 289     time_t host_timeout;
 290     unsigned max_retries;
 291     int32_t kdc_sec_offset;
 292     int32_t kdc_usec_offset;
 293     krb5_config_section *cf;
 294     const krb5_cc_ops **cc_ops;
 295     int num_cc_ops;
 296     const char *http_proxy;
 297     const char *time_fmt;
 298     krb5_boolean log_utc;
 299     const char *default_keytab;
 300     const char *default_keytab_modify;
 301     krb5_boolean use_admin_kdc;
 302     krb5_addresses *extra_addresses;
 303     krb5_boolean scan_interfaces;       /* `ifconfig -a' */
 304     krb5_boolean srv_lookup;            /* do SRV lookups */
 305     krb5_boolean srv_try_txt;           /* try TXT records also */
 306     int32_t fcache_vno;                 /* create cache files w/ this
 307                                            version */
 308     int num_kt_types;                   /* # of registered keytab types */
 309     struct krb5_keytab_data *kt_types;  /* registered keytab types */
 310     const char *date_fmt;
 311     krb5_error_code error_code;
 312     krb5_addresses *ignore_addresses;
 313     char *default_cc_name;
 314     char *default_cc_name_env;
 315     char *configured_default_cc_name;
 316     int default_cc_name_set;
 317     int large_msg_size;
 318     int max_msg_size;
 319     int tgs_negative_timeout;           /* timeout for TGS negative cache */
 320     int flags;
 321 #define KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME    1
 322 #define KRB5_CTX_F_CHECK_PAC                    2
 323 #define KRB5_CTX_F_HOMEDIR_ACCESS               4
 324 #define KRB5_CTX_F_SOCKETS_INITIALIZED          8
 325 #define KRB5_CTX_F_RD_REQ_IGNORE                16
 326 #define KRB5_CTX_F_FCACHE_STRICT_CHECKING       32
 327 #define KRB5_CTX_F_ENFORCE_OK_AS_DELEGATE       64
 328 #define KRB5_CTX_F_REPORT_CANONICAL_CLIENT_NAME 128
 329     struct send_to_kdc *send_to_kdc;
 330 #ifdef PKINIT
 331     hx509_context hx509ctx;
 332 #endif
 333     unsigned int num_kdc_requests;
 334     krb5_name_canon_rule name_canon_rules;
 335     size_t config_include_depth;
 336     krb5_boolean no_ticket_store;       /* Don't store service tickets */
 337 } krb5_context_data;
 338
 339 #define KRB5_DEFAULT_CCNAME_FILE "FILE:%{TEMP}/krb5cc_%{uid}"
 340 #define KRB5_DEFAULT_CCNAME_DIR "DIR:%{TEMP}/krb5cc_%{uid}_dir/"
 341 #define KRB5_DEFAULT_CCNAME_API "API:"
 342 #define KRB5_DEFAULT_CCNAME_KCM_KCM "KCM:%{uid}"
 343 #define KRB5_DEFAULT_CCNAME_KCM_API "API:%{uid}"
 344
 345 #define EXTRACT_TICKET_ALLOW_CNAME_MISMATCH             1
 346 #define EXTRACT_TICKET_ALLOW_SERVER_MISMATCH            2
 347 #define EXTRACT_TICKET_MATCH_REALM                      4
 348 #define EXTRACT_TICKET_AS_REQ                           8
 349 #define EXTRACT_TICKET_TIMESYNC                         16
 350 #define EXTRACT_TICKET_MATCH_ANON                       32
 351
 352 /*
 353  * Configurable options
 354  */
 355
 356 #ifndef KRB5_DEFAULT_CCTYPE
 357 #ifdef __APPLE__
 358 #define KRB5_DEFAULT_CCTYPE (&krb5_acc_ops)
 359 #else
 360 #define KRB5_DEFAULT_CCTYPE (&krb5_fcc_ops)
 361 #endif
 362 #endif
 363
 364 #ifndef KRB5_ADDRESSLESS_DEFAULT
 365 #define KRB5_ADDRESSLESS_DEFAULT TRUE
 366 #endif
 367
 368 #ifndef KRB5_FORWARDABLE_DEFAULT
 369 #define KRB5_FORWARDABLE_DEFAULT TRUE
 370 #endif
 371
 372 #ifndef KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME
 373 #define KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME "org.h5l.Kerberos.configuration-changed"
 374 #endif
 375
 376 #ifndef KRB5_FALLBACK_DEFAULT
 377 #define KRB5_FALLBACK_DEFAULT TRUE
 378 #endif
 379
 380 #ifndef KRB5_TKT_LIFETIME_DEFAULT
 381 # define KRB5_TKT_LIFETIME_DEFAULT        15778800  /* seconds */
 382 #endif
 383
 384 #ifndef KRB5_TKT_RENEW_LIFETIME_DEFAULT
 385 # define KRB5_TKT_RENEW_LIFETIME_DEFAULT  15778800  /* seconds */
 386 #endif
 387
 388 #ifdef PKINIT
 389
 390 struct krb5_pk_identity {
 391     hx509_verify_ctx verify_ctx;
 392     hx509_certs certs;
 393     hx509_cert cert;
 394     hx509_certs anchors;
 395     hx509_certs certpool;
 396     hx509_revoke_ctx revokectx;
 397     int flags;
 398 #define PKINIT_BTMM 1
 399 #define PKINIT_NO_KDC_ANCHOR 2
 400 };
 401
 402 enum krb5_pk_type {
 403     PKINIT_WIN2K = 1,
 404     PKINIT_27 = 2
 405 };
 406
 407 enum keyex_enum { USE_RSA, USE_DH, USE_ECDH };
 408
 409 struct krb5_pk_init_ctx_data {
 410     struct krb5_pk_identity *id;
 411     enum keyex_enum keyex;
 412     union {
 413         DH *dh;
 414         void *eckey;
 415     } u;
 416     krb5_data *clientDHNonce;
 417     struct krb5_dh_moduli **m;
 418     hx509_peer_info peer;
 419     enum krb5_pk_type type;
 420     unsigned int require_binding:1;
 421     unsigned int require_eku:1;
 422     unsigned int require_krbtgt_otherName:1;
 423     unsigned int require_hostname_match:1;
 424     unsigned int trustedCertifiers:1;
 425     unsigned int anonymous:1;
 426     unsigned int kdc_verified:1;
 427 };
 428
 429 #endif /* PKINIT */
 430
 431 struct krb5_fast_state {
 432     enum PA_FX_FAST_REQUEST_enum type;
 433     unsigned int flags;
 434 #define KRB5_FAST_REPLY_KEY_USE_TO_ENCRYPT_THE_REPLY    0x0001
 435 #define KRB5_FAST_REPLY_KEY_USE_IN_TRANSACTION          0x0002
 436 #define KRB5_FAST_KDC_REPLY_KEY_REPLACED                0x0004
 437 #define KRB5_FAST_REPLY_REPLY_VERIFIED                  0x0008
 438 #define KRB5_FAST_STRONG                                0x0010
 439 #define KRB5_FAST_EXPECTED                              0x0020 /* in exchange with KDC, fast was discovered */
 440 #define KRB5_FAST_REQUIRED                              0x0040 /* fast required by action of caller */
 441 #define KRB5_FAST_DISABLED                              0x0080
 442
 443 #define KRB5_FAST_AP_ARMOR_SERVICE                      0x0100
 444 #define KRB5_FAST_OPTIMISTIC                            0x0200 /* Optimistic try, like Anon + PKINIT or service fast bit */
 445 #define KRB5_FAST_REQUIRE_ENC_PA                        0x0400
 446
 447 #define KRB5_FAST_AS_REQ                                0x1000
 448 #define KRB5_FAST_ANON_PKINIT_ARMOR                     0x2000
 449 #define KRB5_FAST_KDC_VERIFIED                          0x4000
 450
 451     krb5_keyblock *reply_key;
 452     krb5_ccache armor_ccache;
 453     krb5_auth_context armor_ac;
 454     KrbFastArmor *armor_data;
 455     krb5_principal armor_service;
 456     krb5_crypto armor_crypto;
 457     krb5_keyblock armor_key;
 458     krb5_keyblock *strengthen_key;
 459
 460     /* KRB5_FAST_ANON_PKINIT_ARMOR */
 461     krb5_get_init_creds_opt *anon_pkinit_opt;
 462     krb5_init_creds_context anon_pkinit_ctx;
 463 };
 464
 465 struct krb5_decrypt_tkt_with_subkey_state {
 466     krb5_keyblock *subkey;
 467     struct krb5_fast_state *fast_state;
 468 };
 469
 470 #define ISTILDE(x) (x == '~')
 471 #ifdef _WIN32
 472 # define ISPATHSEP(x) (x == '/' || x =='\\')
 473 #else
 474 # define ISPATHSEP(x) (x == '/')
 475 #endif
 476
 477 /* Flag in KRB5_AUTHDATA_AP_OPTIONS */
 478 #define KERB_AP_OPTIONS_CBT 0x00004000
 479
 480 /* Flag in PAC_ATTRIBUTES_INFO */
 481 #define KRB5_PAC_WAS_REQUESTED          0x1
 482 #define KRB5_PAC_WAS_GIVEN_IMPLICITLY   0x2
 483
 484 #endif /* __KRB5_LOCL_H__ */