lib/krb5/krb5_locl.h

   1 /*
   2  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 /* $Id$ */
  37
  38 #ifndef __KRB5_LOCL_H__
  39 #define __KRB5_LOCL_H__
  40
  41 #include <config.h>
  42
  43 #include <errno.h>
  44 #include <ctype.h>
  45 #include <string.h>
  46 #include <stdio.h>
  47 #include <stdlib.h>
  48 #include <limits.h>
  49
  50 #ifdef HAVE_POLL_H
  51 #include <sys/poll.h>
  52 #endif
  53
  54 #include <krb5-types.h>
  55
  56 #ifdef HAVE_SYS_TYPES_H
  57 #include <sys/types.h>
  58 #endif
  59 #ifdef HAVE_SYS_MMAN_H
  60 #include <sys/mman.h>
  61 #endif
  62 #ifdef HAVE_UNISTD_H
  63 #include <unistd.h>
  64 #endif
  65 #ifdef HAVE_FCNTL_H
  66 #include <fcntl.h>
  67 #endif
  68
  69 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
  70 #include <sys/ioctl.h>
  71 #endif
  72 #ifdef HAVE_PWD_H
  73 #undef _POSIX_PTHREAD_SEMANTICS
  74 /* This gets us the 5-arg getpwnam_r on Solaris 9.  */
  75 #define _POSIX_PTHREAD_SEMANTICS
  76 #include <pwd.h>
  77 #endif
  78
  79 #ifdef HAVE_SYS_PARAM_H
  80 #include <sys/param.h>
  81 #endif
  82 #include <time.h>
  83 #ifdef HAVE_SYS_TIME_H
  84 #include <sys/time.h>
  85 #endif
  86 #ifdef HAVE_SYS_SELECT_H
  87 #include <sys/select.h>
  88 #endif
  89 #ifdef HAVE_SYS_SOCKET_H
  90 #include <sys/socket.h>
  91 #endif
  92 #ifdef HAVE_NETINET_IN_H
  93 #include <netinet/in.h>
  94 #endif
  95 #ifdef HAVE_NETINET_IN6_H
  96 #include <netinet/in6.h>
  97 #endif
  98 #ifdef HAVE_NETINET6_IN6_H
  99 #include <netinet6/in6.h>
 100 #endif
 101 #ifdef HAVE_NETDB_H
 102 #include <netdb.h>
 103 #endif
 104 #ifdef _AIX
 105 struct ether_addr;
 106 struct mbuf;
 107 struct sockaddr_dl;
 108 #endif
 109 #ifdef HAVE_ARPA_INET_H
 110 #include <arpa/inet.h>
 111 #endif
 112 #ifdef HAVE_ARPA_NAMESER_H
 113 #include <arpa/nameser.h>
 114 #endif
 115 #ifdef HAVE_SYS_UIO_H
 116 #include <sys/uio.h>
 117 #endif
 118 #ifdef HAVE_SYS_FILIO_H
 119 #include <sys/filio.h>
 120 #endif
 121 #ifdef HAVE_SYS_FILE_H
 122 #include <sys/file.h>
 123 #endif
 124
 125 #include <com_err.h>
 126
 127 #include <heimbase.h>
 128
 129 #define HEIMDAL_TEXTDOMAIN "heimdal_krb5"
 130
 131 #ifdef LIBINTL
 132 #include <libintl.h>
 133 #define N_(x,y) dgettext(HEIMDAL_TEXTDOMAIN, x)
 134 #else
 135 #define N_(x,y) (x)
 136 #define bindtextdomain(package, localedir)
 137 #endif
 138
 139
 140 #ifdef HAVE_CRYPT_H
 141 #undef des_encrypt
 142 #define des_encrypt wingless_pigs_mostly_fail_to_fly
 143 #include <crypt.h>
 144 #undef des_encrypt
 145 #endif
 146
 147 #ifdef HAVE_DOOR_CREATE
 148 #include <door.h>
 149 #endif
 150
 151 #include <roken.h>
 152 #include <parse_time.h>
 153 #include <base64.h>
 154
 155 #include <wind.h>
 156
 157 #define HC_DEPRECATED_CRYPTO
 158 #include "crypto-headers.h"
 159
 160
 161 #include <krb5_asn1.h>
 162
 163 struct send_to_kdc;
 164
 165 /* XXX glue for pkinit */
 166 struct hx509_certs_data;
 167 struct krb5_pk_identity;
 168 struct krb5_pk_cert;
 169 struct ContentInfo;
 170 struct AlgorithmIdentifier;
 171 typedef struct krb5_pk_init_ctx_data *krb5_pk_init_ctx;
 172 struct krb5_dh_moduli;
 173
 174 /* v4 glue */
 175 struct _krb5_krb_auth_data;
 176
 177 #include <der.h>
 178
 179 #include <krb5.h>
 180 #include <krb5_err.h>
 181 #include <asn1_err.h>
 182 #ifdef PKINIT
 183 #include <hx509.h>
 184 #endif
 185
 186 #include "crypto.h"
 187
 188 #include <krb5-private.h>
 189
 190 #include "heim_threads.h"
 191
 192 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X)))
 193 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0)
 194
 195 #ifndef __func__
 196 #define __func__ "unknown-function"
 197 #endif
 198
 199 #define krb5_einval(context, argnum) _krb5_einval((context), __func__, (argnum))
 200
 201 #ifndef PATH_SEP
 202 #define PATH_SEP ":"
 203 #endif
 204
 205 /* should this be public? */
 206 #define KEYTAB_DEFAULT "FILE:" SYSCONFDIR "/krb5.keytab"
 207 #define KEYTAB_DEFAULT_MODIFY "FILE:" SYSCONFDIR "/krb5.keytab"
 208
 209
 210 #define MODULI_FILE SYSCONFDIR "/krb5.moduli"
 211
 212 #ifndef O_BINARY
 213 #define O_BINARY 0
 214 #endif
 215
 216 #ifndef O_CLOEXEC
 217 #define O_CLOEXEC 0
 218 #endif
 219
 220 #ifndef SOCK_CLOEXEC
 221 #define SOCK_CLOEXEC 0
 222 #endif
 223
 224
 225 #define KRB5_BUFSIZ 2048
 226
 227 typedef enum {
 228     KRB5_INIT_CREDS_TRISTATE_UNSET = 0,
 229     KRB5_INIT_CREDS_TRISTATE_TRUE,
 230     KRB5_INIT_CREDS_TRISTATE_FALSE
 231 } krb5_get_init_creds_tristate;
 232
 233 struct _krb5_get_init_creds_opt_private {
 234     int refcount;
 235     /* ENC_TIMESTAMP */
 236     const char *password;
 237     krb5_s2k_proc key_proc;
 238     /* PA_PAC_REQUEST */
 239     krb5_get_init_creds_tristate req_pac;
 240     /* PKINIT */
 241     krb5_pk_init_ctx pk_init_ctx;
 242     krb5_get_init_creds_tristate addressless;
 243     int flags;
 244 #define KRB5_INIT_CREDS_CANONICALIZE            1
 245 #define KRB5_INIT_CREDS_NO_C_CANON_CHECK        2
 246 #define KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK       4
 247     struct {
 248         krb5_gic_process_last_req func;
 249         void *ctx;
 250     } lr;
 251 };
 252
 253 typedef uint32_t krb5_enctype_set;
 254
 255 typedef struct krb5_context_data {
 256     krb5_enctype *etypes;
 257     krb5_enctype *etypes_des;/* deprecated */
 258     krb5_enctype *as_etypes;
 259     krb5_enctype *tgs_etypes;
 260     krb5_enctype *permitted_enctypes;
 261     char **default_realms;
 262     time_t max_skew;
 263     time_t kdc_timeout;
 264     time_t host_timeout;
 265     unsigned max_retries;
 266     int32_t kdc_sec_offset;
 267     int32_t kdc_usec_offset;
 268     krb5_config_section *cf;
 269     struct et_list *et_list;
 270     struct krb5_log_facility *warn_dest;
 271     struct krb5_log_facility *debug_dest;
 272     const krb5_cc_ops **cc_ops;
 273     int num_cc_ops;
 274     const char *http_proxy;
 275     const char *time_fmt;
 276     krb5_boolean log_utc;
 277     const char *default_keytab;
 278     const char *default_keytab_modify;
 279     krb5_boolean use_admin_kdc;
 280     krb5_addresses *extra_addresses;
 281     krb5_boolean scan_interfaces;       /* `ifconfig -a' */
 282     krb5_boolean srv_lookup;            /* do SRV lookups */
 283     krb5_boolean srv_try_txt;           /* try TXT records also */
 284     int32_t fcache_vno;                 /* create cache files w/ this
 285                                            version */
 286     int num_kt_types;                   /* # of registered keytab types */
 287     struct krb5_keytab_data *kt_types;  /* registered keytab types */
 288     const char *date_fmt;
 289     char *error_string;
 290     krb5_error_code error_code;
 291     krb5_addresses *ignore_addresses;
 292     char *default_cc_name;
 293     char *default_cc_name_env;
 294     int default_cc_name_set;
 295     void *mutex;                        /* protects error_string */
 296     int large_msg_size;
 297     int max_msg_size;
 298     int tgs_negative_timeout;           /* timeout for TGS negative cache */
 299     int flags;
 300 #define KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME    1
 301 #define KRB5_CTX_F_CHECK_PAC                    2
 302 #define KRB5_CTX_F_HOMEDIR_ACCESS               4
 303 #define KRB5_CTX_F_SOCKETS_INITIALIZED          8
 304 #define KRB5_CTX_F_RD_REQ_IGNORE                16
 305 #define KRB5_CTX_F_FCACHE_STRICT_CHECKING       32
 306     struct send_to_kdc *send_to_kdc;
 307 #ifdef PKINIT
 308     hx509_context hx509ctx;
 309 #endif
 310     unsigned int num_kdc_requests;
 311 } krb5_context_data;
 312
 313 #ifndef KRB5_USE_PATH_TOKENS
 314 #define KRB5_DEFAULT_CCNAME_FILE "FILE:/tmp/krb5cc_%{uid}"
 315 #define KRB5_DEFAULT_CCNAME_DIR "DIR:/tmp/krb5cc_%{uid}_dir/"
 316 #else
 317 #define KRB5_DEFAULT_CCNAME_FILE "FILE:%{TEMP}/krb5cc_%{uid}"
 318 #define KRB5_DEFAULT_CCNAME_DIR "DIR:%{TEMP}/krb5cc_%{uid}_dir/"
 319 #endif
 320 #define KRB5_DEFAULT_CCNAME_API "API:"
 321 #define KRB5_DEFAULT_CCNAME_KCM_KCM "KCM:%{uid}"
 322 #define KRB5_DEFAULT_CCNAME_KCM_API "API:%{uid}"
 323
 324 #define EXTRACT_TICKET_ALLOW_CNAME_MISMATCH             1
 325 #define EXTRACT_TICKET_ALLOW_SERVER_MISMATCH            2
 326 #define EXTRACT_TICKET_MATCH_REALM                      4
 327 #define EXTRACT_TICKET_AS_REQ                           8
 328 #define EXTRACT_TICKET_TIMESYNC                         16
 329
 330 /*
 331  * Configurable options
 332  */
 333
 334 #ifndef KRB5_DEFAULT_CCTYPE
 335 #ifdef __APPLE__
 336 #define KRB5_DEFAULT_CCTYPE (&krb5_acc_ops)
 337 #else
 338 #define KRB5_DEFAULT_CCTYPE (&krb5_fcc_ops)
 339 #endif
 340 #endif
 341
 342 #ifndef KRB5_ADDRESSLESS_DEFAULT
 343 #define KRB5_ADDRESSLESS_DEFAULT TRUE
 344 #endif
 345
 346 #ifndef KRB5_FORWARDABLE_DEFAULT
 347 #define KRB5_FORWARDABLE_DEFAULT TRUE
 348 #endif
 349
 350 #ifndef KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME
 351 #define KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME "org.h5l.Kerberos.configuration-changed"
 352 #endif
 353
 354 #ifndef KRB5_FALLBACK_DEFAULT
 355 #define KRB5_FALLBACK_DEFAULT TRUE
 356 #endif
 357
 358 #ifdef PKINIT
 359
 360 struct krb5_pk_identity {
 361     hx509_verify_ctx verify_ctx;
 362     hx509_certs certs;
 363     hx509_cert cert;
 364     hx509_certs anchors;
 365     hx509_certs certpool;
 366     hx509_revoke_ctx revokectx;
 367     int flags;
 368 #define PKINIT_BTMM 1
 369 };
 370
 371 enum krb5_pk_type {
 372     PKINIT_WIN2K = 1,
 373     PKINIT_27 = 2
 374 };
 375
 376 #endif /* PKINIT */
 377
 378 #define ISTILDE(x) (x == '~')
 379 #ifdef _WIN32
 380 # define ISPATHSEP(x) (x == '/' || x =='\\')
 381 #else
 382 # define ISPATHSEP(x) (x == '/')
 383 #endif
 384
 385 #endif /* __KRB5_LOCL_H__ */