lib/krb5/init_creds.c

   1 /*
   2  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "krb5_locl.h"
  37
  38 #undef __attribute__
  39 #define __attribute__(x)
  40
  41 /**
  42  * @page krb5_init_creds_intro The initial credential handing functions
  43  * @section section_krb5_init_creds Initial credential
  44  *
  45  * Functions to get initial credentials: @ref krb5_credential .
  46  */
  47
  48 /**
  49  * Allocate a new krb5_get_init_creds_opt structure, free with
  50  * krb5_get_init_creds_opt_free().
  51  *
  52  * @ingroup krb5_credential
  53  */
  54
  55 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
  56 krb5_get_init_creds_opt_alloc(krb5_context context,
  57                               krb5_get_init_creds_opt **opt)
  58 {
  59     krb5_get_init_creds_opt *o;
  60
  61     *opt = NULL;
  62     o = calloc(1, sizeof(*o));
  63     if (o == NULL)
  64         return krb5_enomem(context);
  65
  66     o->opt_private = calloc(1, sizeof(*o->opt_private));
  67     if (o->opt_private == NULL) {
  68         free(o);
  69         return krb5_enomem(context);
  70     }
  71     o->opt_private->refcount = 1;
  72     *opt = o;
  73     return 0;
  74 }
  75
  76 /**
  77  * Free krb5_get_init_creds_opt structure.
  78  *
  79  * @ingroup krb5_credential
  80  */
  81
  82 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
  83 krb5_get_init_creds_opt_free(krb5_context context,
  84                              krb5_get_init_creds_opt *opt)
  85 {
  86     if (opt == NULL || opt->opt_private == NULL)
  87         return;
  88     if (opt->opt_private->refcount < 1) /* abort ? */
  89         return;
  90     if (--opt->opt_private->refcount == 0) {
  91         _krb5_get_init_creds_opt_free_pkinit(opt);
  92         free(opt->opt_private);
  93     }
  94     memset(opt, 0, sizeof(*opt));
  95     free(opt);
  96 }
  97
  98 static int
  99 get_config_time (krb5_context context,
 100                  const char *realm,
 101                  const char *name,
 102                  int def)
 103 {
 104     int ret;
 105
 106     ret = krb5_config_get_time (context, NULL,
 107                                 "realms",
 108                                 realm,
 109                                 name,
 110                                 NULL);
 111     if (ret >= 0)
 112         return ret;
 113     ret = krb5_config_get_time (context, NULL,
 114                                 "libdefaults",
 115                                 name,
 116                                 NULL);
 117     if (ret >= 0)
 118         return ret;
 119     return def;
 120 }
 121
 122 static krb5_boolean
 123 get_config_bool (krb5_context context,
 124                  krb5_boolean def_value,
 125                  const char *realm,
 126                  const char *name)
 127 {
 128     krb5_boolean b;
 129
 130     b = krb5_config_get_bool_default(context, NULL, def_value,
 131                                      "realms", realm, name, NULL);
 132     if (b != def_value)
 133         return b;
 134     b = krb5_config_get_bool_default (context, NULL, def_value,
 135                                       "libdefaults", name, NULL);
 136     if (b != def_value)
 137         return b;
 138     return def_value;
 139 }
 140
 141 /*
 142  * set all the values in `opt' to the appropriate values for
 143  * application `appname' (default to getprogname() if NULL), and realm
 144  * `realm'.  First looks in [appdefaults] but falls back to
 145  * [realms] or [libdefaults] for some of the values.
 146  */
 147
 148 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 149 krb5_get_init_creds_opt_set_default_flags(krb5_context context,
 150                                           const char *appname,
 151                                           krb5_const_realm realm,
 152                                           krb5_get_init_creds_opt *opt)
 153 {
 154     krb5_boolean b;
 155     time_t t;
 156
 157     b = get_config_bool (context, KRB5_FORWARDABLE_DEFAULT,
 158                          realm, "forwardable");
 159     krb5_appdefault_boolean(context, appname, realm, "forwardable", b, &b);
 160     krb5_get_init_creds_opt_set_forwardable(opt, b);
 161
 162     b = get_config_bool (context, FALSE, realm, "proxiable");
 163     krb5_appdefault_boolean(context, appname, realm, "proxiable", b, &b);
 164     krb5_get_init_creds_opt_set_proxiable (opt, b);
 165
 166     krb5_appdefault_time(context, appname, realm, "ticket_lifetime", 0, &t);
 167     if (t == 0)
 168         t = get_config_time (context, realm, "ticket_lifetime", 0);
 169     if(t != 0)
 170         krb5_get_init_creds_opt_set_tkt_life(opt, t);
 171
 172     krb5_appdefault_time(context, appname, realm, "renew_lifetime", 0, &t);
 173     if (t == 0)
 174         t = get_config_time (context, realm, "renew_lifetime", 0);
 175     if(t != 0)
 176         krb5_get_init_creds_opt_set_renew_life(opt, t);
 177
 178     krb5_appdefault_boolean(context, appname, realm, "no-addresses",
 179                             KRB5_ADDRESSLESS_DEFAULT, &b);
 180     krb5_get_init_creds_opt_set_addressless (context, opt, b);
 181
 182 #if 0
 183     krb5_appdefault_boolean(context, appname, realm, "anonymous", FALSE, &b);
 184     krb5_get_init_creds_opt_set_anonymous (opt, b);
 185
 186     krb5_get_init_creds_opt_set_etype_list(opt, enctype,
 187                                            etype_str.num_strings);
 188
 189     krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
 190                                      krb5_data *salt);
 191
 192     krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
 193                                              krb5_preauthtype *preauth_list,
 194                                              int preauth_list_length);
 195 #endif
 196 }
 197
 198
 199 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 200 krb5_get_init_creds_opt_set_tkt_life(krb5_get_init_creds_opt *opt,
 201                                      krb5_deltat tkt_life)
 202 {
 203     opt->flags |= KRB5_GET_INIT_CREDS_OPT_TKT_LIFE;
 204     opt->tkt_life = tkt_life;
 205 }
 206
 207 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 208 krb5_get_init_creds_opt_set_renew_life(krb5_get_init_creds_opt *opt,
 209                                        krb5_deltat renew_life)
 210 {
 211     opt->flags |= KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE;
 212     opt->renew_life = renew_life;
 213 }
 214
 215 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 216 krb5_get_init_creds_opt_set_forwardable(krb5_get_init_creds_opt *opt,
 217                                         int forwardable)
 218 {
 219     opt->flags |= KRB5_GET_INIT_CREDS_OPT_FORWARDABLE;
 220     opt->forwardable = forwardable;
 221 }
 222
 223 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 224 krb5_get_init_creds_opt_set_proxiable(krb5_get_init_creds_opt *opt,
 225                                       int proxiable)
 226 {
 227     opt->flags |= KRB5_GET_INIT_CREDS_OPT_PROXIABLE;
 228     opt->proxiable = proxiable;
 229 }
 230
 231 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 232 krb5_get_init_creds_opt_set_etype_list(krb5_get_init_creds_opt *opt,
 233                                        krb5_enctype *etype_list,
 234                                        int etype_list_length)
 235 {
 236     opt->flags |= KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST;
 237     opt->etype_list = etype_list;
 238     opt->etype_list_length = etype_list_length;
 239 }
 240
 241 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 242 krb5_get_init_creds_opt_set_address_list(krb5_get_init_creds_opt *opt,
 243                                          krb5_addresses *addresses)
 244 {
 245     opt->flags |= KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST;
 246     opt->address_list = addresses;
 247 }
 248
 249 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 250 krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
 251                                          krb5_preauthtype *preauth_list,
 252                                          int preauth_list_length)
 253 {
 254     opt->flags |= KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST;
 255     opt->preauth_list_length = preauth_list_length;
 256     opt->preauth_list = preauth_list;
 257 }
 258
 259 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 260 krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
 261                                  krb5_data *salt)
 262 {
 263     opt->flags |= KRB5_GET_INIT_CREDS_OPT_SALT;
 264     opt->salt = salt;
 265 }
 266
 267 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 268 krb5_get_init_creds_opt_set_anonymous(krb5_get_init_creds_opt *opt,
 269                                       int anonymous)
 270 {
 271     opt->flags |= KRB5_GET_INIT_CREDS_OPT_ANONYMOUS;
 272     opt->anonymous = anonymous;
 273 }
 274
 275 static krb5_error_code
 276 require_ext_opt(krb5_context context,
 277                 krb5_get_init_creds_opt *opt,
 278                 const char *type)
 279 {
 280     if (opt->opt_private == NULL) {
 281         krb5_set_error_message(context, EINVAL,
 282                                N_("%s on non extendable opt", ""), type);
 283         return EINVAL;
 284     }
 285     return 0;
 286 }
 287
 288 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 289 krb5_get_init_creds_opt_set_pa_password(krb5_context context,
 290                                         krb5_get_init_creds_opt *opt,
 291                                         const char *password,
 292                                         krb5_s2k_proc key_proc)
 293 {
 294     krb5_error_code ret;
 295     ret = require_ext_opt(context, opt, "init_creds_opt_set_pa_password");
 296     if (ret)
 297         return ret;
 298     opt->opt_private->password = password;
 299     opt->opt_private->key_proc = key_proc;
 300     return 0;
 301 }
 302
 303 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 304 krb5_get_init_creds_opt_set_pac_request(krb5_context context,
 305                                         krb5_get_init_creds_opt *opt,
 306                                         krb5_boolean req_pac)
 307 {
 308     krb5_error_code ret;
 309     ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
 310     if (ret)
 311         return ret;
 312     opt->opt_private->req_pac = req_pac ?
 313         KRB5_INIT_CREDS_TRISTATE_TRUE :
 314         KRB5_INIT_CREDS_TRISTATE_FALSE;
 315     return 0;
 316 }
 317
 318 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 319 krb5_get_init_creds_opt_set_addressless(krb5_context context,
 320                                         krb5_get_init_creds_opt *opt,
 321                                         krb5_boolean addressless)
 322 {
 323     krb5_error_code ret;
 324     ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
 325     if (ret)
 326         return ret;
 327     if (addressless)
 328         opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_TRUE;
 329     else
 330         opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_FALSE;
 331     return 0;
 332 }
 333
 334 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 335 krb5_get_init_creds_opt_set_canonicalize(krb5_context context,
 336                                          krb5_get_init_creds_opt *opt,
 337                                          krb5_boolean req)
 338 {
 339     krb5_error_code ret;
 340     ret = require_ext_opt(context, opt, "init_creds_opt_set_canonicalize");
 341     if (ret)
 342         return ret;
 343     if (req)
 344         opt->opt_private->flags |= KRB5_INIT_CREDS_CANONICALIZE;
 345     else
 346         opt->opt_private->flags &= ~KRB5_INIT_CREDS_CANONICALIZE;
 347     return 0;
 348 }
 349
 350 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 351 krb5_get_init_creds_opt_set_win2k(krb5_context context,
 352                                   krb5_get_init_creds_opt *opt,
 353                                   krb5_boolean req)
 354 {
 355     krb5_error_code ret;
 356     ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
 357     if (ret)
 358         return ret;
 359     if (req) {
 360         opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_CANON_CHECK;
 361         opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
 362     } else {
 363         opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_CANON_CHECK;
 364         opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
 365     }
 366     return 0;
 367 }
 368
 369
 370 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 371 krb5_get_init_creds_opt_set_process_last_req(krb5_context context,
 372                                              krb5_get_init_creds_opt *opt,
 373                                              krb5_gic_process_last_req func,
 374                                              void *ctx)
 375 {
 376     krb5_error_code ret;
 377     ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
 378     if (ret)
 379         return ret;
 380
 381     opt->opt_private->lr.func = func;
 382     opt->opt_private->lr.ctx = ctx;
 383
 384     return 0;
 385 }
 386
 387
 388 #ifndef HEIMDAL_SMALLER
 389
 390 /**
 391  * Deprecated: use krb5_get_init_creds_opt_alloc().
 392  *
 393  * The reason krb5_get_init_creds_opt_init() is deprecated is that
 394  * krb5_get_init_creds_opt is a static structure and for ABI reason it
 395  * can't grow, ie can't add new functionality.
 396  *
 397  * @ingroup krb5_deprecated
 398  */
 399
 400 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
 401 krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt)
 402     KRB5_DEPRECATED_FUNCTION("Use X instead")
 403 {
 404     memset (opt, 0, sizeof(*opt));
 405 }
 406
 407 /**
 408  * Deprecated: use the new krb5_init_creds_init() and
 409  * krb5_init_creds_get_error().
 410  *
 411  * @ingroup krb5_deprecated
 412  */
 413
 414 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
 415 krb5_get_init_creds_opt_get_error(krb5_context context,
 416                                   krb5_get_init_creds_opt *opt,
 417                                   KRB_ERROR **error)
 418     KRB5_DEPRECATED_FUNCTION("Use X instead")
 419 {
 420     *error = calloc(1, sizeof(**error));
 421     if (*error == NULL)
 422         return krb5_enomem(context);
 423
 424     return 0;
 425 }
 426
 427 #endif /* HEIMDAL_SMALLER */