1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /*
3 * Copyright (C) 1989,1990,1991,1992,1993,1994,1995,2000,2001,
4 * 2003,2006,2007,2008,2009 by the Massachusetts Institute of Technology,
5 * Cambridge, MA, USA. All Rights Reserved.
6 *
7 * This software is being provided to you, the LICENSEE, by the
8 * Massachusetts Institute of Technology (M.I.T.) under the following
9 * license. By obtaining, using and/or copying this software, you agree
10 * that you have read, understood, and will comply with these terms and
11 * conditions:
12 *
13 * Export of this software from the United States of America may
14 * require a specific license from the United States Government.
15 * It is the responsibility of any person or organization contemplating
16 * export to obtain such a license before exporting.
17 *
18 * WITHIN THAT CONSTRAINT, permission to use, copy, modify and distribute
19 * this software and its documentation for any purpose and without fee or
20 * royalty is hereby granted, provided that you agree to comply with the
21 * following copyright notice and statements, including the disclaimer, and
22 * that the same appear on ALL copies of the software and documentation,
23 * including modifications that you make for internal use or for
24 * distribution:
25 *
26 * THIS SOFTWARE IS PROVIDED "AS IS", AND M.I.T. MAKES NO REPRESENTATIONS
27 * OR WARRANTIES, EXPRESS OR IMPLIED. By way of example, but not
28 * limitation, M.I.T. MAKES NO REPRESENTATIONS OR WARRANTIES OF
29 * MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF
30 * THE LICENSED SOFTWARE OR DOCUMENTATION WILL NOT INFRINGE ANY THIRD PARTY
31 * PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS.
32 *
33 * The name of the Massachusetts Institute of Technology or M.I.T. may NOT
34 * be used in advertising or publicity pertaining to distribution of the
35 * software. Title to copyright in this software and any associated
36 * documentation shall at all times remain with M.I.T., and USER agrees to
37 * preserve same.
38 *
39 * Furthermore if you modify this software you must label
40 * your software as modified software and not distribute it in such a
41 * fashion that it might be confused with the original M.I.T. software.
42 */
43 /*
44 * Copyright (C) 1998 by the FundsXpress, INC.
45 *
46 * All rights reserved.
47 *
48 * Export of this software from the United States of America may require
49 * a specific license from the United States Government. It is the
50 * responsibility of any person or organization contemplating export to
51 * obtain such a license before exporting.
52 *
53 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
54 * distribute this software and its documentation for any purpose and
55 * without fee is hereby granted, provided that the above copyright
56 * notice appear in all copies and that both that copyright notice and
57 * this permission notice appear in supporting documentation, and that
58 * the name of FundsXpress. not be used in advertising or publicity pertaining
59 * to distribution of the software without specific, written prior
60 * permission. FundsXpress makes no representations about the suitability of
61 * this software for any purpose. It is provided "as is" without express
62 * or implied warranty.
63 *
64 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
65 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
66 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
67 */
68
69 /*
70 * This prototype for k5-int.h (Krb5 internals include file)
71 * includes the user-visible definitions from krb5.h and then
72 * includes other definitions that are not user-visible but are
73 * required for compiling Kerberos internal routines.
74 *
75 * John Gilmore, Cygnus Support, Sat Jan 21 22:45:52 PST 1995
76 */
77
78 #ifndef _KRB5_INT_H
79 #define _KRB5_INT_H
80
81 #ifdef KRB5_GENERAL__
82 #error krb5.h included before k5-int.h
83 #endif /* KRB5_GENERAL__ */
84
85 #include "osconf.h"
86
87 #if defined(__MACH__) && defined(__APPLE__)
88 # include <TargetConditionals.h>
89 # if TARGET_RT_MAC_CFM
90 # error "Use KfM 4.0 SDK headers for CFM compilation."
91 # endif
92 #endif
93
94 /*
95 * Begin "k5-config.h"
96 */
97 #ifndef KRB5_CONFIG__
98 #define KRB5_CONFIG__
99
100 /*
101 * Machine-type definitions: PC Clone 386 running Microloss Windows
102 */
103
104 #if defined(_MSDOS) || defined(_WIN32)
105 #include "win-mac.h"
106
107 /* Kerberos Windows initialization file */
108 #define KERBEROS_INI "kerberos.ini"
109 #define INI_FILES "Files"
110 #define INI_KRB_CCACHE "krb5cc" /* Location of the ccache */
111 #define INI_KRB5_CONF "krb5.ini" /* Location of krb5.conf file */
112 #endif
113
114 #include "autoconf.h"
115
116 #ifndef KRB5_SYSTYPES__
117 #define KRB5_SYSTYPES__
118
119 #ifdef HAVE_SYS_TYPES_H /* From autoconf.h */
120 #include <sys/types.h>
121 #else /* HAVE_SYS_TYPES_H */
122 typedef unsigned long u_long;
123 typedef unsigned int u_int;
124 typedef unsigned short u_short;
125 typedef unsigned char u_char;
126 #endif /* HAVE_SYS_TYPES_H */
127 #endif /* KRB5_SYSTYPES__ */
128
129
130 #include "k5-platform.h"
131
132 #define KRB5_KDB_MAX_LIFE (60*60*24) /* one day */
133 #define KRB5_KDB_MAX_RLIFE (60*60*24*7) /* one week */
134 #define KRB5_KDB_EXPIRATION 2145830400 /* Thu Jan 1 00:00:00 2038 UTC */
135
136 /*
137 * Windows requires a different api interface to each function. Here
138 * just define it as NULL.
139 */
140 #ifndef KRB5_CALLCONV
141 #define KRB5_CALLCONV
142 #define KRB5_CALLCONV_C
143 #endif
144 #ifndef O_BINARY
145 #define O_BINARY 0
146 #endif
147
148 /* #define KRB5_OLD_CRYPTO is done in krb5.h */
149
150 #endif /* KRB5_CONFIG__ */
151
152 /*
153 * End "k5-config.h"
154 */
155
156 /*
157 * After loading the configuration definitions, load the Kerberos definitions.
158 */
159 #include <errno.h>
160 #include "krb5.h"
161 #include <krb5/plugin.h>
162 #include "profile.h"
163
164 #include "port-sockets.h"
165 #include "socket-utils.h"
166
167 /* Get mutex support; currently used only for the replay cache. */
168 #include "k5-thread.h"
169
170 /* Get error info support. */
171 #include "k5-err.h"
172
173 /* Get string buffer support. */
174 #include "k5-buf.h"
175
176 /* Define tracing macros. */
177 #include "k5-trace.h"
178
179 /* Profile variables. Constants are named KRB5_CONF_STRING, where STRING
180 * matches the variable name. Keep these alphabetized. */
181 #define KRB5_CONF_ACL_FILE "acl_file"
182 #define KRB5_CONF_ADMIN_SERVER "admin_server"
183 #define KRB5_CONF_ALLOW_DES3 "allow_des3"
184 #define KRB5_CONF_ALLOW_RC4 "allow_rc4"
185 #define KRB5_CONF_ALLOW_WEAK_CRYPTO "allow_weak_crypto"
186 #define KRB5_CONF_AUTH_TO_LOCAL "auth_to_local"
187 #define KRB5_CONF_AUTH_TO_LOCAL_NAMES "auth_to_local_names"
188 #define KRB5_CONF_CANONICALIZE "canonicalize"
189 #define KRB5_CONF_CCACHE_TYPE "ccache_type"
190 #define KRB5_CONF_CLOCKSKEW "clockskew"
191 #define KRB5_CONF_DATABASE_NAME "database_name"
192 #define KRB5_CONF_DB_MODULE_DIR "db_module_dir"
193 #define KRB5_CONF_DEBUG "debug"
194 #define KRB5_CONF_DEFAULT "default"
195 #define KRB5_CONF_DEFAULT_CCACHE_NAME "default_ccache_name"
196 #define KRB5_CONF_DEFAULT_CLIENT_KEYTAB_NAME "default_client_keytab_name"
197 #define KRB5_CONF_DEFAULT_DOMAIN "default_domain"
198 #define KRB5_CONF_DEFAULT_KEYTAB_NAME "default_keytab_name"
199 #define KRB5_CONF_DEFAULT_PRINCIPAL_EXPIRATION "default_principal_expiration"
200 #define KRB5_CONF_DEFAULT_PRINCIPAL_FLAGS "default_principal_flags"
201 #define KRB5_CONF_DEFAULT_RCACHE_NAME "default_rcache_name"
202 #define KRB5_CONF_DEFAULT_REALM "default_realm"
203 #define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes"
204 #define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes"
205 #define KRB5_CONF_DICT_FILE "dict_file"
206 #define KRB5_CONF_DISABLE "disable"
207 #define KRB5_CONF_DISABLE_ENCRYPTED_TIMESTAMP "disable_encrypted_timestamp"
208 #define KRB5_CONF_DISABLE_LAST_SUCCESS "disable_last_success"
209 #define KRB5_CONF_DISABLE_LOCKOUT "disable_lockout"
210 #define KRB5_CONF_DISABLE_PAC "disable_pac"
211 #define KRB5_CONF_DNS_CANONICALIZE_HOSTNAME "dns_canonicalize_hostname"
212 #define KRB5_CONF_DNS_FALLBACK "dns_fallback"
213 #define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc"
214 #define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm"
215 #define KRB5_CONF_DNS_URI_LOOKUP "dns_uri_lookup"
216 #define KRB5_CONF_DOMAIN_REALM "domain_realm"
217 #define KRB5_CONF_ENABLE_ONLY "enable_only"
218 #define KRB5_CONF_ENCRYPTED_CHALLENGE_INDICATOR "encrypted_challenge_indicator"
219 #define KRB5_CONF_ENFORCE_OK_AS_DELEGATE "enforce_ok_as_delegate"
220 #define KRB5_CONF_ERR_FMT "err_fmt"
221 #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses"
222 #define KRB5_CONF_FORWARDABLE "forwardable"
223 #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services"
224 #define KRB5_CONF_HTTP_ANCHORS "http_anchors"
225 #define KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME "ignore_acceptor_hostname"
226 #define KRB5_CONF_IPROP_ENABLE "iprop_enable"
227 #define KRB5_CONF_IPROP_LISTEN "iprop_listen"
228 #define KRB5_CONF_IPROP_LOGFILE "iprop_logfile"
229 #define KRB5_CONF_IPROP_MASTER_ULOGSIZE "iprop_master_ulogsize"
230 #define KRB5_CONF_IPROP_PORT "iprop_port"
231 #define KRB5_CONF_IPROP_RESYNC_TIMEOUT "iprop_resync_timeout"
232 #define KRB5_CONF_IPROP_REPLICA_POLL "iprop_replica_poll"
233 #define KRB5_CONF_IPROP_SLAVE_POLL "iprop_slave_poll"
234 #define KRB5_CONF_IPROP_ULOGSIZE "iprop_ulogsize"
235 #define KRB5_CONF_K5LOGIN_AUTHORITATIVE "k5login_authoritative"
236 #define KRB5_CONF_K5LOGIN_DIRECTORY "k5login_directory"
237 #define KRB5_CONF_KADMIND_LISTEN "kadmind_listen"
238 #define KRB5_CONF_KADMIND_PORT "kadmind_port"
239 #define KRB5_CONF_KCM_MACH_SERVICE "kcm_mach_service"
240 #define KRB5_CONF_KCM_SOCKET "kcm_socket"
241 #define KRB5_CONF_KDC "kdc"
242 #define KRB5_CONF_KDCDEFAULTS "kdcdefaults"
243 #define KRB5_CONF_KDC_DEFAULT_OPTIONS "kdc_default_options"
244 #define KRB5_CONF_KDC_LISTEN "kdc_listen"
245 #define KRB5_CONF_KDC_MAX_DGRAM_REPLY_SIZE "kdc_max_dgram_reply_size"
246 #define KRB5_CONF_KDC_PORTS "kdc_ports"
247 #define KRB5_CONF_KDC_TCP_PORTS "kdc_tcp_ports"
248 #define KRB5_CONF_KDC_TCP_LISTEN "kdc_tcp_listen"
249 #define KRB5_CONF_KDC_TCP_LISTEN_BACKLOG "kdc_tcp_listen_backlog"
250 #define KRB5_CONF_KDC_TIMESYNC "kdc_timesync"
251 #define KRB5_CONF_KEY_STASH_FILE "key_stash_file"
252 #define KRB5_CONF_KPASSWD_LISTEN "kpasswd_listen"
253 #define KRB5_CONF_KPASSWD_PORT "kpasswd_port"
254 #define KRB5_CONF_KPASSWD_SERVER "kpasswd_server"
255 #define KRB5_CONF_KRB524_SERVER "krb524_server"
256 #define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server"
257 #define KRB5_CONF_LDAP_KADMIND_DN "ldap_kadmind_dn"
258 #define KRB5_CONF_LDAP_KADMIND_SASL_AUTHCID "ldap_kadmind_sasl_authcid"
259 #define KRB5_CONF_LDAP_KADMIND_SASL_AUTHZID "ldap_kadmind_sasl_authzid"
260 #define KRB5_CONF_LDAP_KADMIND_SASL_MECH "ldap_kadmind_sasl_mech"
261 #define KRB5_CONF_LDAP_KADMIND_SASL_REALM "ldap_kadmind_sasl_realm"
262 #define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn"
263 #define KRB5_CONF_LDAP_KDC_SASL_AUTHCID "ldap_kdc_sasl_authcid"
264 #define KRB5_CONF_LDAP_KDC_SASL_AUTHZID "ldap_kdc_sasl_authzid"
265 #define KRB5_CONF_LDAP_KDC_SASL_MECH "ldap_kdc_sasl_mech"
266 #define KRB5_CONF_LDAP_KDC_SASL_REALM "ldap_kdc_sasl_realm"
267 #define KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN "ldap_kerberos_container_dn"
268 #define KRB5_CONF_LDAP_SERVERS "ldap_servers"
269 #define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file"
270 #define KRB5_CONF_LIBDEFAULTS "libdefaults"
271 #define KRB5_CONF_LOGGING "logging"
272 #define KRB5_CONF_MAPSIZE "mapsize"
273 #define KRB5_CONF_MASTER_KDC "master_kdc"
274 #define KRB5_CONF_MASTER_KEY_NAME "master_key_name"
275 #define KRB5_CONF_MASTER_KEY_TYPE "master_key_type"
276 #define KRB5_CONF_MAX_LIFE "max_life"
277 #define KRB5_CONF_MAX_READERS "max_readers"
278 #define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life"
279 #define KRB5_CONF_MODULE "module"
280 #define KRB5_CONF_NOADDRESSES "noaddresses"
281 #define KRB5_CONF_NOSYNC "nosync"
282 #define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral"
283 #define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes"
284 #define KRB5_CONF_PLUGINS "plugins"
285 #define KRB5_CONF_PLUGIN_BASE_DIR "plugin_base_dir"
286 #define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types"
287 #define KRB5_CONF_PRIMARY_KDC "primary_kdc"
288 #define KRB5_CONF_PROXIABLE "proxiable"
289 #define KRB5_CONF_QUALIFY_SHORTNAME "qualify_shortname"
290 #define KRB5_CONF_RDNS "rdns"
291 #define KRB5_CONF_REALMS "realms"
292 #define KRB5_CONF_REALM_TRY_DOMAINS "realm_try_domains"
293 #define KRB5_CONF_REJECT_BAD_TRANSIT "reject_bad_transit"
294 #define KRB5_CONF_RENEW_LIFETIME "renew_lifetime"
295 #define KRB5_CONF_RESTRICT_ANONYMOUS_TO_TGT "restrict_anonymous_to_tgt"
296 #define KRB5_CONF_SUPPORTED_ENCTYPES "supported_enctypes"
297 #define KRB5_CONF_SPAKE_PREAUTH_INDICATOR "spake_preauth_indicator"
298 #define KRB5_CONF_SPAKE_PREAUTH_KDC_CHALLENGE "spake_preauth_kdc_challenge"
299 #define KRB5_CONF_SPAKE_PREAUTH_GROUPS "spake_preauth_groups"
300 #define KRB5_CONF_TICKET_LIFETIME "ticket_lifetime"
301 #define KRB5_CONF_UDP_PREFERENCE_LIMIT "udp_preference_limit"
302 #define KRB5_CONF_UNLOCKITER "unlockiter"
303 #define KRB5_CONF_V4_INSTANCE_CONVERT "v4_instance_convert"
304 #define KRB5_CONF_V4_REALM "v4_realm"
305 #define KRB5_CONF_VERIFY_AP_REQ_NOFAIL "verify_ap_req_nofail"
306 #define KRB5_CONF_CLIENT_AWARE_GSS_BINDINGS "client_aware_channel_bindings"
307
308 /* Cache configuration variables */
309 #define KRB5_CC_CONF_FAST_AVAIL "fast_avail"
310 #define KRB5_CC_CONF_PA_CONFIG_DATA "pa_config_data"
311 #define KRB5_CC_CONF_PA_TYPE "pa_type"
312 #define KRB5_CC_CONF_PROXY_IMPERSONATOR "proxy_impersonator"
313 #define KRB5_CC_CONF_REFRESH_TIME "refresh_time"
314 #define KRB5_CC_CONF_START_REALM "start_realm"
315
316 /* Error codes used in KRB_ERROR protocol messages.
317 Return values of library routines are based on a different error table
318 (which allows non-ambiguous error codes between subsystems) */
319
320 /* KDC errors */
321 #define KDC_ERR_NONE 0 /* No error */
322 #define KDC_ERR_NAME_EXP 1 /* Client's entry in DB expired */
323 #define KDC_ERR_SERVICE_EXP 2 /* Server's entry in DB expired */
324 #define KDC_ERR_BAD_PVNO 3 /* Requested pvno not supported */
325 #define KDC_ERR_C_OLD_MAST_KVNO 4 /* C's key encrypted in old master */
326 #define KDC_ERR_S_OLD_MAST_KVNO 5 /* S's key encrypted in old master */
327 #define KDC_ERR_C_PRINCIPAL_UNKNOWN 6 /* Client not found in Kerberos DB */
328 #define KDC_ERR_S_PRINCIPAL_UNKNOWN 7 /* Server not found in Kerberos DB */
329 #define KDC_ERR_PRINCIPAL_NOT_UNIQUE 8 /* Multiple entries in Kerberos DB */
330 #define KDC_ERR_NULL_KEY 9 /* The C or S has a null key */
331 #define KDC_ERR_CANNOT_POSTDATE 10 /* Tkt ineligible for postdating */
332 #define KDC_ERR_NEVER_VALID 11 /* Requested starttime > endtime */
333 #define KDC_ERR_POLICY 12 /* KDC policy rejects request */
334 #define KDC_ERR_BADOPTION 13 /* KDC can't do requested opt. */
335 #define KDC_ERR_ENCTYPE_NOSUPP 14 /* No support for encryption type */
336 #define KDC_ERR_SUMTYPE_NOSUPP 15 /* No support for checksum type */
337 #define KDC_ERR_PADATA_TYPE_NOSUPP 16 /* No support for padata type */
338 #define KDC_ERR_TRTYPE_NOSUPP 17 /* No support for transited type */
339 #define KDC_ERR_CLIENT_REVOKED 18 /* C's creds have been revoked */
340 #define KDC_ERR_SERVICE_REVOKED 19 /* S's creds have been revoked */
341 #define KDC_ERR_TGT_REVOKED 20 /* TGT has been revoked */
342 #define KDC_ERR_CLIENT_NOTYET 21 /* C not yet valid */
343 #define KDC_ERR_SERVICE_NOTYET 22 /* S not yet valid */
344 #define KDC_ERR_KEY_EXP 23 /* Password has expired */
345 #define KDC_ERR_PREAUTH_FAILED 24 /* Preauthentication failed */
346 #define KDC_ERR_PREAUTH_REQUIRED 25 /* Additional preauthentication */
347 /* required */
348 #define KDC_ERR_SERVER_NOMATCH 26 /* Requested server and */
349 /* ticket don't match*/
350 #define KDC_ERR_MUST_USE_USER2USER 27 /* Server principal valid for */
351 /* user2user only */
352 #define KDC_ERR_PATH_NOT_ACCEPTED 28 /* KDC policy rejected transited */
353 /* path */
354 #define KDC_ERR_SVC_UNAVAILABLE 29 /* A service is not
355 * available that is
356 * required to process the
357 * request */
358 /* Application errors */
359 #define KRB_AP_ERR_BAD_INTEGRITY 31 /* Decrypt integrity check failed */
360 #define KRB_AP_ERR_TKT_EXPIRED 32 /* Ticket expired */
361 #define KRB_AP_ERR_TKT_NYV 33 /* Ticket not yet valid */
362 #define KRB_AP_ERR_REPEAT 34 /* Request is a replay */
363 #define KRB_AP_ERR_NOT_US 35 /* The ticket isn't for us */
364 #define KRB_AP_ERR_BADMATCH 36 /* Ticket/authenticator don't match */
365 #define KRB_AP_ERR_SKEW 37 /* Clock skew too great */
366 #define KRB_AP_ERR_BADADDR 38 /* Incorrect net address */
367 #define KRB_AP_ERR_BADVERSION 39 /* Protocol version mismatch */
368 #define KRB_AP_ERR_MSG_TYPE 40 /* Invalid message type */
369 #define KRB_AP_ERR_MODIFIED 41 /* Message stream modified */
370 #define KRB_AP_ERR_BADORDER 42 /* Message out of order */
371 #define KRB_AP_ERR_BADKEYVER 44 /* Key version is not available */
372 #define KRB_AP_ERR_NOKEY 45 /* Service key not available */
373 #define KRB_AP_ERR_MUT_FAIL 46 /* Mutual authentication failed */
374 #define KRB_AP_ERR_BADDIRECTION 47 /* Incorrect message direction */
375 #define KRB_AP_ERR_METHOD 48 /* Alternative authentication */
376 /* method required */
377 #define KRB_AP_ERR_BADSEQ 49 /* Incorrect sequence numnber */
378 /* in message */
379 #define KRB_AP_ERR_INAPP_CKSUM 50 /* Inappropriate type of */
380 /* checksum in message */
381 #define KRB_AP_PATH_NOT_ACCEPTED 51 /* Policy rejects transited path */
382 #define KRB_ERR_RESPONSE_TOO_BIG 52 /* Response too big for UDP, */
383 /* retry with TCP */
384
385 /* other errors */
386 #define KRB_ERR_GENERIC 60 /* Generic error (description */
387 /* in e-text) */
388 #define KRB_ERR_FIELD_TOOLONG 61 /* Field is too long for impl. */
389
390 /* PKINIT server-reported errors */
391 #define KDC_ERR_CLIENT_NOT_TRUSTED 62 /* client cert not trusted */
392 #define KDC_ERR_KDC_NOT_TRUSTED 63
393 #define KDC_ERR_INVALID_SIG 64 /* client signature verify failed */
394 #define KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED 65 /* invalid Diffie-Hellman parameters */
395 #define KDC_ERR_CERTIFICATE_MISMATCH 66
396 #define KRB_AP_ERR_NO_TGT 67
397 #define KDC_ERR_WRONG_REALM 68
398 #define KRB_AP_ERR_USER_TO_USER_REQUIRED 69
399 #define KDC_ERR_CANT_VERIFY_CERTIFICATE 70 /* client cert not verifiable to */
400 /* trusted root cert */
401 #define KDC_ERR_INVALID_CERTIFICATE 71 /* client cert had invalid signature */
402 #define KDC_ERR_REVOKED_CERTIFICATE 72 /* client cert was revoked */
403 #define KDC_ERR_REVOCATION_STATUS_UNKNOWN 73 /* client cert revoked, reason unknown */
404 #define KDC_ERR_REVOCATION_STATUS_UNAVAILABLE 74
405 #define KDC_ERR_CLIENT_NAME_MISMATCH 75 /* mismatch between client cert and */
406 /* principal name */
407 #define KDC_ERR_INCONSISTENT_KEY_PURPOSE 77 /* bad extended key use */
408 #define KDC_ERR_DIGEST_IN_CERT_NOT_ACCEPTED 78 /* bad digest algorithm in client cert */
409 #define KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED 79 /* missing paChecksum in PA-PK-AS-REQ */
410 #define KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED 80 /* bad digest algorithm in SignedData */
411 #define KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED 81
412 #define KRB_AP_ERR_IAKERB_KDC_NOT_FOUND 85 /* The IAKERB proxy could
413 not find a KDC */
414 #define KRB_AP_ERR_IAKERB_KDC_NO_RESPONSE 86 /* The KDC did not respond
415 to the IAKERB proxy */
416 #define KDC_ERR_PREAUTH_EXPIRED 90 /* RFC 6113 */
417 #define KDC_ERR_MORE_PREAUTH_DATA_REQUIRED 91 /* RFC 6113 */
418 #define KRB_ERR_MAX 127 /* err table base max offset for protocol err codes */
419
420 /*
421 * A null-terminated array of this structure is returned by the KDC as
422 * the data part of the ETYPE_INFO preauth type. It informs the
423 * client which encryption types are supported.
424 * The same data structure is used by both etype-info and etype-info2
425 * but s2kparams must be null when encoding etype-info.
426 */
427 typedef struct _krb5_etype_info_entry {
428 krb5_magic magic;
429 krb5_enctype etype;
430 unsigned int length;
431 krb5_octet *salt;
432 krb5_data s2kparams;
433 } krb5_etype_info_entry;
434
435 /*
436 * This is essentially -1 without sign extension which can screw up
437 * comparisons on 64 bit machines. If the length is this value, then
438 * the salt data is not present. This is to distinguish between not
439 * being set and being of 0 length.
440 */
441 #define KRB5_ETYPE_NO_SALT VALID_UINT_BITS
442
443 typedef krb5_etype_info_entry ** krb5_etype_info;
444
445 /* RFC 4537 */
446 typedef struct _krb5_etype_list {
447 int length;
448 krb5_enctype *etypes;
449 } krb5_etype_list;
450
451 /* sam_type values -- informational only */
452 #define PA_SAM_TYPE_ENIGMA 1 /* Enigma Logic */
453 #define PA_SAM_TYPE_DIGI_PATH 2 /* Digital Pathways */
454 #define PA_SAM_TYPE_SKEY_K0 3 /* S/key where KDC has key 0 */
455 #define PA_SAM_TYPE_SKEY 4 /* Traditional S/Key */
456 #define PA_SAM_TYPE_SECURID 5 /* Security Dynamics */
457 #define PA_SAM_TYPE_CRYPTOCARD 6 /* CRYPTOCard */
458 #if 1 /* XXX need to figure out who has which numbers assigned */
459 #define PA_SAM_TYPE_ACTIVCARD_DEC 6 /* ActivCard decimal mode */
460 #define PA_SAM_TYPE_ACTIVCARD_HEX 7 /* ActivCard hex mode */
461 #define PA_SAM_TYPE_DIGI_PATH_HEX 8 /* Digital Pathways hex mode */
462 #endif
463 #define PA_SAM_TYPE_EXP_BASE 128 /* experimental */
464 #define PA_SAM_TYPE_GRAIL (PA_SAM_TYPE_EXP_BASE+0) /* testing */
465 #define PA_SAM_TYPE_SECURID_PREDICT (PA_SAM_TYPE_EXP_BASE+1) /* special */
466
467 typedef struct _krb5_sam_challenge_2 {
468 krb5_data sam_challenge_2_body;
469 krb5_checksum **sam_cksum; /* Array of checksums */
470 } krb5_sam_challenge_2;
471
472 typedef struct _krb5_sam_challenge_2_body {
473 krb5_magic magic;
474 krb5_int32 sam_type; /* information */
475 krb5_flags sam_flags; /* KRB5_SAM_* values */
476 krb5_data sam_type_name;
477 krb5_data sam_track_id;
478 krb5_data sam_challenge_label;
479 krb5_data sam_challenge;
480 krb5_data sam_response_prompt;
481 krb5_data sam_pk_for_sad;
482 krb5_int32 sam_nonce;
483 krb5_enctype sam_etype;
484 } krb5_sam_challenge_2_body;
485
486 typedef struct _krb5_sam_response_2 {
487 krb5_magic magic;
488 krb5_int32 sam_type; /* informational */
489 krb5_flags sam_flags; /* KRB5_SAM_* values */
490 krb5_data sam_track_id; /* copied */
491 krb5_enc_data sam_enc_nonce_or_sad; /* krb5_enc_sam_response_enc */
492 krb5_int32 sam_nonce;
493 } krb5_sam_response_2;
494
495 typedef struct _krb5_enc_sam_response_enc_2 {
496 krb5_magic magic;
497 krb5_int32 sam_nonce;
498 krb5_data sam_sad;
499 } krb5_enc_sam_response_enc_2;
500
501 /*
502 * Keep the pkinit definitions in a separate file so that the plugin
503 * only has to include k5-int-pkinit.h rather than k5-int.h
504 */
505
506 #include "k5-int-pkinit.h"
507
508 #define KRB5_OTP_FLAG_NEXTOTP 0x40000000
509 #define KRB5_OTP_FLAG_COMBINE 0x20000000
510 #define KRB5_OTP_FLAG_COLLECT_PIN 0x10000000
511 #define KRB5_OTP_FLAG_NO_COLLECT_PIN 0x08000000
512 #define KRB5_OTP_FLAG_ENCRYPT_NONCE 0x04000000
513 #define KRB5_OTP_FLAG_SEPARATE_PIN 0x02000000
514 #define KRB5_OTP_FLAG_CHECK_DIGIT 0x01000000
515
516 #define KRB5_OTP_FORMAT_DECIMAL 0x00000000
517 #define KRB5_OTP_FORMAT_HEXADECIMAL 0x00000001
518 #define KRB5_OTP_FORMAT_ALPHANUMERIC 0x00000002
519 #define KRB5_OTP_FORMAT_BINARY 0x00000003
520 #define KRB5_OTP_FORMAT_BASE64 0x00000004
521
522 typedef struct _krb5_otp_tokeninfo {
523 krb5_flags flags;
524 krb5_data vendor;
525 krb5_data challenge;
526 krb5_int32 length; /* -1 for unspecified */
527 krb5_int32 format; /* -1 for unspecified */
528 krb5_data token_id;
529 krb5_data alg_id;
530 krb5_algorithm_identifier **supported_hash_alg;
531 krb5_int32 iteration_count; /* -1 for unspecified */
532 } krb5_otp_tokeninfo;
533
534 typedef struct _krb5_pa_otp_challenge {
535 krb5_data nonce;
536 krb5_data service;
537 krb5_otp_tokeninfo **tokeninfo;
538 krb5_data salt;
539 krb5_data s2kparams;
540 } krb5_pa_otp_challenge;
541
542 typedef struct _krb5_pa_otp_req {
543 krb5_int32 flags;
544 krb5_data nonce;
545 krb5_enc_data enc_data;
546 krb5_algorithm_identifier *hash_alg;
547 krb5_int32 iteration_count; /* -1 for unspecified */
548 krb5_data otp_value;
549 krb5_data pin;
550 krb5_data challenge;
551 krb5_timestamp time;
552 krb5_data counter;
553 krb5_int32 format; /* -1 for unspecified */
554 krb5_data token_id;
555 krb5_data alg_id;
556 krb5_data vendor;
557 } krb5_pa_otp_req;
558
559 typedef struct _krb5_kkdcp_message {
560 krb5_data kerb_message;
561 krb5_data target_domain;
562 krb5_int32 dclocator_hint;
563 } krb5_kkdcp_message;
564
565 /* Plain text of an encrypted PA-FX-COOKIE value produced by the KDC. */
566 typedef struct _krb5_secure_cookie {
567 time_t time;
568 krb5_pa_data **data;
569 } krb5_secure_cookie;
570
571 typedef struct _krb5_pa_pac_options {
572 krb5_flags options;
573 } krb5_pa_pac_options;
574
575 /* In PAC options, indicates Resource-Based Constrained Delegation support. */
576 #define KRB5_PA_PAC_OPTIONS_RBCD 0x10000000
577
578 #include <stdlib.h>
579 #include <string.h>
580
581 #ifndef HAVE_STRDUP
582 extern char *strdup (const char *);
583 #endif
584
585 #ifdef HAVE_UNISTD_H
586 #include <unistd.h>
587 #endif
588
589 #ifdef HAVE_SYS_TIME_H
590 #include <sys/time.h>
591 #endif
592 #include <time.h>
593
594 #ifdef HAVE_SYS_STAT_H
595 #include <sys/stat.h> /* struct stat, stat() */
596 #endif
597
598 #ifdef HAVE_SYS_PARAM_H
599 #include <sys/param.h> /* MAXPATHLEN */
600 #endif
601
602 #ifdef HAVE_SYS_FILE_H
603 #include <sys/file.h> /* prototypes for file-related
604 syscalls; flags for open &
605 friends */
606 #endif
607
608 #ifdef HAVE_FCNTL_H
609 #include <fcntl.h>
610 #endif
611
612 #include <stdio.h>
613
614 #include "k5-gmt_mktime.h"
615
616 /* libos.spec */
617 krb5_error_code krb5_lock_file(krb5_context, int, int);
618 krb5_error_code krb5_unlock_file(krb5_context, int);
619 krb5_error_code krb5_sendto_kdc(krb5_context, const krb5_data *,
620 const krb5_data *, krb5_data *, int *, int);
621
622 krb5_error_code krb5int_init_context_kdc(krb5_context *);
623
624 struct derived_key {
625 krb5_data constant;
626 krb5_key dkey;
627 struct derived_key *next;
628 };
629
630 /* Internal structure of an opaque key identifier */
631 struct krb5_key_st {
632 krb5_keyblock keyblock;
633 int refcount;
634 struct derived_key *derived;
635 /*
636 * Cache of data private to the cipher implementation, which we
637 * don't want to have to recompute for every operation. This may
638 * include key schedules, iteration counts, etc.
639 *
640 * The cipher implementation is responsible for setting this up
641 * whenever needed, and the enc_provider key_cleanup method must
642 * then be provided to dispose of it.
643 */
644 void *cache;
645 };
646
647 krb5_error_code
648 krb5int_arcfour_gsscrypt(const krb5_keyblock *keyblock, krb5_keyusage usage,
649 const krb5_data *kd_data, krb5_crypto_iov *data,
650 size_t num_data);
651
652 #define K5_SHA256_HASHLEN (256 / 8)
653
654 /* Write the SHA-256 hash of in (containing n elements) to out. */
655 krb5_error_code
656 k5_sha256(const krb5_data *in, size_t n, uint8_t out[K5_SHA256_HASHLEN]);
657
658 /* Convenience function: zap and free ptr if it is non-NULL. */
659 static inline void
zapfree(void * ptr,size_t len)660 zapfree(void *ptr, size_t len)
661 {
662 if (ptr != NULL) {
663 zap(ptr, len);
664 free(ptr);
665 }
666 }
667
668 /* Convenience function: zap and free zero-terminated str if it is non-NULL. */
669 static inline void
zapfreestr(void * str)670 zapfreestr(void *str)
671 {
672 if (str != NULL) {
673 zap(str, strlen((char *)str));
674 free(str);
675 }
676 }
677
678 /* Convenience function: zap and free krb5_data pointer if it is non-NULL. */
679 static inline void
zapfreedata(krb5_data * data)680 zapfreedata(krb5_data *data)
681 {
682 if (data != NULL) {
683 zapfree(data->data, data->length);
684 free(data);
685 }
686 }
687
688 void krb5int_c_free_keyblock(krb5_context, krb5_keyblock *key);
689 void krb5int_c_free_keyblock_contents(krb5_context, krb5_keyblock *);
690 krb5_error_code krb5int_c_init_keyblock(krb5_context, krb5_enctype enctype,
691 size_t length, krb5_keyblock **out);
692 krb5_error_code krb5int_c_copy_keyblock(krb5_context context,
693 const krb5_keyblock *from,
694 krb5_keyblock **to);
695 krb5_error_code krb5int_c_copy_keyblock_contents(krb5_context context,
696 const krb5_keyblock *from,
697 krb5_keyblock *to);
698
699 krb5_error_code krb5_crypto_us_timeofday(krb5_timestamp *, krb5_int32 *);
700
701 /*
702 * End "los-proto.h"
703 */
704
705 typedef struct _krb5_os_context {
706 krb5_magic magic;
707 krb5_int32 time_offset;
708 krb5_int32 usec_offset;
709 krb5_int32 os_flags;
710 char * default_ccname;
711 } *krb5_os_context;
712
713 /*
714 * Flags for the os_flags field
715 *
716 * KRB5_OS_TOFFSET_VALID means that the time offset fields are valid.
717 * The intention is that this facility to correct the system clocks so
718 * that they reflect the "real" time, for systems where for some
719 * reason we can't set the system clock. Instead we calculate the
720 * offset between the system time and real time, and store the offset
721 * in the os context so that we can correct the system clock as necessary.
722 *
723 * KRB5_OS_TOFFSET_TIME means that the time offset fields should be
724 * returned as the time by the krb5 time routines. This should only
725 * be used for testing purposes (obviously!)
726 */
727 #define KRB5_OS_TOFFSET_VALID 1
728 #define KRB5_OS_TOFFSET_TIME 2
729
730 /* lock mode flags */
731 #define KRB5_LOCKMODE_SHARED 0x0001
732 #define KRB5_LOCKMODE_EXCLUSIVE 0x0002
733 #define KRB5_LOCKMODE_DONTBLOCK 0x0004
734 #define KRB5_LOCKMODE_UNLOCK 0x0008
735
736 /*
737 * Begin "preauth.h"
738 *
739 * (Originally written by Glen Machin at Sandia Labs.)
740 */
741 /*
742 * Sandia National Laboratories also makes no representations about the
743 * suitability of the modifications, or additions to this software for
744 * any purpose. It is provided "as is" without express or implied warranty.
745 */
746 #ifndef KRB5_PREAUTH__
747 #define KRB5_PREAUTH__
748
749 typedef struct _krb5_pa_enc_ts {
750 krb5_timestamp patimestamp;
751 krb5_int32 pausec;
752 } krb5_pa_enc_ts;
753
754 typedef struct _krb5_pa_for_user {
755 krb5_principal user;
756 krb5_checksum cksum;
757 krb5_data auth_package;
758 } krb5_pa_for_user;
759
760 typedef struct _krb5_s4u_userid {
761 krb5_int32 nonce;
762 krb5_principal user;
763 krb5_data subject_cert;
764 krb5_flags options;
765 } krb5_s4u_userid;
766
767 #define KRB5_S4U_OPTS_CHECK_LOGON_HOURS 0x40000000 /* check logon hour restrictions */
768 #define KRB5_S4U_OPTS_USE_REPLY_KEY_USAGE 0x20000000 /* sign with usage 27 instead of 26 */
769
770 typedef struct _krb5_pa_s4u_x509_user {
771 krb5_s4u_userid user_id;
772 krb5_checksum cksum;
773 } krb5_pa_s4u_x509_user;
774
775 enum {
776 KRB5_FAST_ARMOR_AP_REQUEST = 0x1
777 };
778
779 typedef struct _krb5_fast_armor {
780 krb5_int32 armor_type;
781 krb5_data armor_value;
782 } krb5_fast_armor;
783 typedef struct _krb5_fast_armored_req {
784 krb5_magic magic;
785 krb5_fast_armor *armor;
786 krb5_checksum req_checksum;
787 krb5_enc_data enc_part;
788 } krb5_fast_armored_req;
789
790 typedef struct _krb5_fast_req {
791 krb5_magic magic;
792 krb5_flags fast_options;
793 /* padata from req_body is used*/
794 krb5_kdc_req *req_body;
795 } krb5_fast_req;
796
797 /* Bits 0-15 are critical in FAST options (RFC 6113 section 7.3). */
798 #define UNSUPPORTED_CRITICAL_FAST_OPTIONS 0xbfff0000
799 #define KRB5_FAST_OPTION_HIDE_CLIENT_NAMES 0x40000000
800
801 typedef struct _krb5_fast_finished {
802 krb5_timestamp timestamp;
803 krb5_int32 usec;
804 krb5_principal client;
805 krb5_checksum ticket_checksum;
806 } krb5_fast_finished;
807
808 typedef struct _krb5_fast_response {
809 krb5_magic magic;
810 krb5_pa_data **padata;
811 krb5_keyblock *strengthen_key;
812 krb5_fast_finished *finished;
813 krb5_int32 nonce;
814 } krb5_fast_response;
815
816 typedef struct _krb5_ad_kdcissued {
817 krb5_checksum ad_checksum;
818 krb5_principal i_principal;
819 krb5_authdata **elements;
820 } krb5_ad_kdcissued;
821
822 typedef struct _krb5_iakerb_header {
823 krb5_data target_realm;
824 krb5_data *cookie;
825 } krb5_iakerb_header;
826
827 typedef struct _krb5_iakerb_finished {
828 krb5_checksum checksum;
829 } krb5_iakerb_finished;
830
831 typedef struct _krb5_verifier_mac {
832 krb5_principal princ;
833 krb5_kvno kvno;
834 krb5_enctype enctype;
835 krb5_checksum checksum;
836 } krb5_verifier_mac;
837
838 /*
839 * AD-CAMMAC's other-verifiers field is a sequence of Verifier, which is an
840 * extensible choice with only one selection, Verifier-MAC. For the time being
841 * we will represent this field directly as an array of krb5_verifier_mac.
842 * That will have to change if other selections are added.
843 */
844 typedef struct _krb5_cammac {
845 krb5_authdata **elements;
846 krb5_verifier_mac *kdc_verifier;
847 krb5_verifier_mac *svc_verifier;
848 krb5_verifier_mac **other_verifiers;
849 } krb5_cammac;
850
851 void krb5_free_etype_info(krb5_context, krb5_etype_info);
852
853 krb5_pa_data *
854 krb5int_find_pa_data(krb5_context, krb5_pa_data *const *, krb5_preauthtype);
855 /* Does not return a copy; original padata sequence responsible for freeing*/
856
857 /* Allocate a pa-data object with uninitialized contents of size len. If len
858 * is 0, set the contents field to NULL. */
859 krb5_error_code
860 k5_alloc_pa_data(krb5_preauthtype pa_type, size_t len, krb5_pa_data **out);
861
862 /* Free a single pa-data object. */
863 void
864 k5_free_pa_data_element(krb5_pa_data *pa);
865
866 /* Without copying, add single element *pa to *list, reallocating as necessary.
867 * If *list is NULL, allocate a new list. Set *pa to NULL on success. */
868 krb5_error_code
869 k5_add_pa_data_element(krb5_pa_data ***list, krb5_pa_data **pa);
870
871 /* Without copying, add a pa-data element of type pa_type to *list with the
872 * contents in data. Set *data to empty_data() on success. */
873 krb5_error_code
874 k5_add_pa_data_from_data(krb5_pa_data ***list, krb5_preauthtype pa_type,
875 krb5_data *data);
876
877 /* Add an empty pa-data element of type pa_type to *list. */
878 krb5_error_code
879 k5_add_empty_pa_data(krb5_pa_data ***list, krb5_preauthtype pa_type);
880
881 #endif /* KRB5_PREAUTH__ */
882 /*
883 * End "preauth.h"
884 */
885
886 krb5_error_code
887 krb5int_copy_data_contents(krb5_context, const krb5_data *, krb5_data *);
888
889 krb5_error_code
890 krb5int_copy_data_contents_add0(krb5_context, const krb5_data *, krb5_data *);
891
892 void KRB5_CALLCONV
893 krb5_free_sam_challenge_2(krb5_context, krb5_sam_challenge_2 *);
894
895 void KRB5_CALLCONV
896 krb5_free_sam_challenge_2_body(krb5_context, krb5_sam_challenge_2_body *);
897
898 void KRB5_CALLCONV
899 krb5_free_sam_response_2(krb5_context, krb5_sam_response_2 *);
900
901 void KRB5_CALLCONV
902 krb5_free_enc_sam_response_enc_2(krb5_context, krb5_enc_sam_response_enc_2 *);
903
904 void KRB5_CALLCONV
905 krb5_free_sam_challenge_2_contents(krb5_context, krb5_sam_challenge_2 *);
906
907 void KRB5_CALLCONV
908 krb5_free_sam_challenge_2_body_contents(krb5_context,
909 krb5_sam_challenge_2_body *);
910
911 void KRB5_CALLCONV
912 krb5_free_sam_response_2_contents(krb5_context, krb5_sam_response_2 *);
913
914 void KRB5_CALLCONV
915 krb5_free_enc_sam_response_enc_2_contents(krb5_context,
916 krb5_enc_sam_response_enc_2 * );
917
918 void KRB5_CALLCONV
919 krb5_free_pa_enc_ts(krb5_context, krb5_pa_enc_ts *);
920
921 void KRB5_CALLCONV
922 krb5_free_pa_for_user(krb5_context, krb5_pa_for_user *);
923
924 void KRB5_CALLCONV
925 krb5_free_s4u_userid_contents(krb5_context, krb5_s4u_userid *);
926
927 void KRB5_CALLCONV
928 krb5_free_pa_s4u_x509_user(krb5_context, krb5_pa_s4u_x509_user *);
929
930 void KRB5_CALLCONV
931 krb5_free_pa_pac_req(krb5_context, krb5_pa_pac_req * );
932
933 void KRB5_CALLCONV krb5_free_fast_armor(krb5_context, krb5_fast_armor *);
934 void KRB5_CALLCONV krb5_free_fast_armored_req(krb5_context,
935 krb5_fast_armored_req *);
936 void KRB5_CALLCONV krb5_free_fast_req(krb5_context, krb5_fast_req *);
937 void KRB5_CALLCONV krb5_free_fast_finished(krb5_context, krb5_fast_finished *);
938 void KRB5_CALLCONV krb5_free_fast_response(krb5_context, krb5_fast_response *);
939 void KRB5_CALLCONV krb5_free_ad_kdcissued(krb5_context, krb5_ad_kdcissued *);
940 void KRB5_CALLCONV krb5_free_iakerb_header(krb5_context, krb5_iakerb_header *);
941 void KRB5_CALLCONV krb5_free_iakerb_finished(krb5_context,
942 krb5_iakerb_finished *);
943 void k5_free_algorithm_identifier(krb5_context context,
944 krb5_algorithm_identifier *val);
945 void k5_free_otp_tokeninfo(krb5_context context, krb5_otp_tokeninfo *val);
946 void k5_free_pa_otp_challenge(krb5_context context,
947 krb5_pa_otp_challenge *val);
948 void k5_free_pa_otp_req(krb5_context context, krb5_pa_otp_req *val);
949 void k5_free_kkdcp_message(krb5_context context, krb5_kkdcp_message *val);
950 void k5_free_cammac(krb5_context context, krb5_cammac *val);
951 void k5_free_secure_cookie(krb5_context context, krb5_secure_cookie *val);
952
953 krb5_error_code
954 k5_unwrap_cammac_svc(krb5_context context, const krb5_authdata *ad,
955 const krb5_keyblock *key, krb5_authdata ***adata_out);
956 krb5_error_code
957 k5_authind_decode(const krb5_authdata *ad, krb5_data ***indicators);
958
959 /* #include "krb5/wordsize.h" -- comes in through base-defs.h. */
960 #include "com_err.h"
961 #include "k5-plugin.h"
962
963 #include <krb5/authdata_plugin.h>
964
965 struct _krb5_authdata_context {
966 krb5_magic magic;
967 int n_modules;
968 struct _krb5_authdata_context_module {
969 krb5_authdatatype ad_type;
970 void *plugin_context;
971 authdata_client_plugin_fini_proc client_fini;
972 krb5_flags flags;
973 krb5plugin_authdata_client_ftable_v0 *ftable;
974 authdata_client_request_init_proc client_req_init;
975 authdata_client_request_fini_proc client_req_fini;
976 const char *name;
977 void *request_context;
978 void **request_context_pp;
979 } *modules;
980 struct plugin_dir_handle plugins;
981 };
982
983 typedef struct _krb5_authdata_context *krb5_authdata_context;
984
985 void
986 k5_free_data_ptr_list(krb5_data **list);
987
988 void
989 k5_zapfree_pa_data(krb5_pa_data **val);
990
991 void KRB5_CALLCONV
992 krb5int_free_data_list(krb5_context context, krb5_data *data);
993
994 krb5_error_code KRB5_CALLCONV
995 krb5_authdata_context_init(krb5_context kcontext,
996 krb5_authdata_context *pcontext);
997
998 void KRB5_CALLCONV
999 krb5_authdata_context_free(krb5_context kcontext,
1000 krb5_authdata_context context);
1001
1002 krb5_error_code KRB5_CALLCONV
1003 krb5_authdata_export_authdata(krb5_context kcontext,
1004 krb5_authdata_context context, krb5_flags usage,
1005 krb5_authdata ***pauthdata);
1006
1007 krb5_error_code KRB5_CALLCONV
1008 krb5_authdata_get_attribute_types(krb5_context kcontext,
1009 krb5_authdata_context context,
1010 krb5_data **attrs);
1011
1012 krb5_error_code KRB5_CALLCONV
1013 krb5_authdata_get_attribute(krb5_context kcontext,
1014 krb5_authdata_context context,
1015 const krb5_data *attribute,
1016 krb5_boolean *authenticated,
1017 krb5_boolean *complete, krb5_data *value,
1018 krb5_data *display_value, int *more);
1019
1020 krb5_error_code KRB5_CALLCONV
1021 krb5_authdata_set_attribute(krb5_context kcontext,
1022 krb5_authdata_context context,
1023 krb5_boolean complete, const krb5_data *attribute,
1024 const krb5_data *value);
1025
1026 krb5_error_code KRB5_CALLCONV
1027 krb5_authdata_delete_attribute(krb5_context kcontext,
1028 krb5_authdata_context context,
1029 const krb5_data *attribute);
1030
1031 krb5_error_code KRB5_CALLCONV
1032 krb5_authdata_import_attributes(krb5_context kcontext,
1033 krb5_authdata_context context,
1034 krb5_flags usage, const krb5_data *attributes);
1035
1036 krb5_error_code KRB5_CALLCONV
1037 krb5_authdata_export_attributes(krb5_context kcontext,
1038 krb5_authdata_context context,
1039 krb5_flags usage, krb5_data **pattributes);
1040
1041 krb5_error_code KRB5_CALLCONV
1042 krb5_authdata_export_internal(krb5_context kcontext,
1043 krb5_authdata_context context,
1044 krb5_boolean restrict_authenticated,
1045 const char *module, void **ptr);
1046
1047 krb5_error_code KRB5_CALLCONV
1048 krb5_authdata_context_copy(krb5_context kcontext, krb5_authdata_context src,
1049 krb5_authdata_context *dst);
1050
1051 krb5_error_code KRB5_CALLCONV
1052 krb5_authdata_free_internal(krb5_context kcontext,
1053 krb5_authdata_context context, const char *module,
1054 void *ptr);
1055
1056 /*** Plugin framework ***/
1057
1058 /*
1059 * This framework can be used to create pluggable interfaces. Not all existing
1060 * pluggable interface use this framework, but new ones should. A new
1061 * pluggable interface entails:
1062 *
1063 * - An interface ID definition in the list of #defines below.
1064 *
1065 * - A name in the interface_names array in lib/krb5/krb/plugins.c.
1066 *
1067 * - An installed public header file in include/krb5. The public header should
1068 * include <krb5/plugin.h> and should declare a vtable structure for each
1069 * supported major version of the interface.
1070 *
1071 * - A consumer API implementation, located within the code unit which makes
1072 * use of the pluggable interface. The consumer API should consist of:
1073 *
1074 * . An interface-specific handle type which contains a vtable structure for
1075 * the module (or a union of several such structures, if there are multiple
1076 * supported major versions) and, optionally, resource data bound to the
1077 * handle.
1078 *
1079 * . An interface-specific loader function which creates a handle or list of
1080 * handles. A list of handles would be created if the interface is a
1081 * one-to-many interface where the consumer wants to consult all available
1082 * modules; a single handle would be created for an interface where the
1083 * consumer wants to consult a specific module. The loader function should
1084 * use k5_plugin_load or k5_plugin_load_all to produce one or a list of
1085 * vtable initializer functions, and should use those functions to fill in
1086 * the vtable structure for the module (if necessary, trying each supported
1087 * major version starting from the most recent). The loader function can
1088 * also bind resource data into the handle based on caller arguments, if
1089 * appropriate.
1090 *
1091 * . For each plugin method, a wrapper function which accepts a krb5_context,
1092 * a plugin handle, and the method arguments. Wrapper functions should
1093 * invoke the method function contained in the handle's vtable.
1094 *
1095 * - Possibly, built-in implementations of the interface, also located within
1096 * the code unit which makes use of the interface. Built-in implementations
1097 * must be registered with k5_plugin_register before the first call to
1098 * k5_plugin_load or k5_plugin_load_all.
1099 *
1100 * A pluggable interface should have one or more currently supported major
1101 * versions, starting at 1. Each major version should have a current minor
1102 * version, also starting at 1. If new methods are added to a vtable, the
1103 * minor version should be incremented and the vtable structure should document
1104 * where each minor vtable version ends. If method signatures for a vtable are
1105 * changed, the major version should be incremented.
1106 *
1107 * Plugin module implementations (either built-in or dynamically loaded) should
1108 * define a function named <interfacename>_<modulename>_initvt, matching the
1109 * signature of krb5_plugin_initvt_fn as declared in include/krb5/plugin.h.
1110 * The initvt function should check the given maj_ver argument against its own
1111 * supported major versions, cast the vtable pointer to the appropriate
1112 * interface-specific vtable type, and fill in the vtable methods, stopping as
1113 * appropriate for the given min_ver. Memory for the vtable structure is
1114 * allocated by the caller, not by the module.
1115 *
1116 * Dynamic plugin modules are registered with the framework through the
1117 * [plugins] section of the profile, as described in the admin documentation
1118 * and krb5.conf man page.
1119 */
1120
1121 struct plugin_mapping;
1122
1123 /* Holds krb5_context information about each pluggable interface. */
1124 struct plugin_interface {
1125 struct plugin_mapping **modules;
1126 krb5_boolean configured;
1127 };
1128
1129 /* A list of plugin interface IDs. Make sure to increment
1130 * PLUGIN_NUM_INTERFACES when a new interface is added, and add an entry to the
1131 * interface_names table in lib/krb5/krb/plugin.c. */
1132 #define PLUGIN_INTERFACE_PWQUAL 0
1133 #define PLUGIN_INTERFACE_KADM5_HOOK 1
1134 #define PLUGIN_INTERFACE_CLPREAUTH 2
1135 #define PLUGIN_INTERFACE_KDCPREAUTH 3
1136 #define PLUGIN_INTERFACE_CCSELECT 4
1137 #define PLUGIN_INTERFACE_LOCALAUTH 5
1138 #define PLUGIN_INTERFACE_HOSTREALM 6
1139 #define PLUGIN_INTERFACE_AUDIT 7
1140 #define PLUGIN_INTERFACE_TLS 8
1141 #define PLUGIN_INTERFACE_KDCAUTHDATA 9
1142 #define PLUGIN_INTERFACE_CERTAUTH 10
1143 #define PLUGIN_INTERFACE_KADM5_AUTH 11
1144 #define PLUGIN_INTERFACE_KDCPOLICY 12
1145 #define PLUGIN_NUM_INTERFACES 13
1146
1147 /* Retrieve the plugin module of type interface_id and name modname,
1148 * storing the result into module. */
1149 krb5_error_code
1150 k5_plugin_load(krb5_context context, int interface_id, const char *modname,
1151 krb5_plugin_initvt_fn *module);
1152
1153 /* Retrieve all plugin modules of type interface_id, storing the result
1154 * into modules. Free the result with k5_plugin_free_handles. */
1155 krb5_error_code
1156 k5_plugin_load_all(krb5_context context, int interface_id,
1157 krb5_plugin_initvt_fn **modules);
1158
1159 /* Release a module list allocated by k5_plugin_load_all. */
1160 void
1161 k5_plugin_free_modules(krb5_context context, krb5_plugin_initvt_fn *modules);
1162
1163 /* Register a plugin module of type interface_id and name modname. */
1164 krb5_error_code
1165 k5_plugin_register(krb5_context context, int interface_id, const char *modname,
1166 krb5_plugin_initvt_fn module);
1167
1168 /*
1169 * Register a plugin module which is part of the krb5 tree but is built as a
1170 * dynamic plugin. Look for the module in modsubdir relative to the
1171 * context->base_plugin_dir.
1172 */
1173 krb5_error_code
1174 k5_plugin_register_dyn(krb5_context context, int interface_id,
1175 const char *modname, const char *modsubdir);
1176
1177 /* Destroy the module state within context; used by krb5_free_context. */
1178 void
1179 k5_plugin_free_context(krb5_context context);
1180
1181 enum dns_canonhost {
1182 CANONHOST_FALSE = 0,
1183 CANONHOST_TRUE = 1,
1184 CANONHOST_FALLBACK = 2
1185 };
1186
1187 struct _kdb5_dal_handle; /* private, in kdb5.h */
1188 typedef struct _kdb5_dal_handle kdb5_dal_handle;
1189 struct _kdb_log_context;
1190 typedef struct krb5_preauth_context_st *krb5_preauth_context;
1191 struct ccselect_module_handle;
1192 struct localauth_module_handle;
1193 struct hostrealm_module_handle;
1194 struct k5_tls_vtable_st;
1195 struct _krb5_context {
1196 krb5_magic magic;
1197 krb5_enctype *tgs_etypes;
1198 struct _krb5_os_context os_context;
1199 char *default_realm;
1200 profile_t profile;
1201 kdb5_dal_handle *dal_handle;
1202 /* allowable clock skew */
1203 krb5_deltat clockskew;
1204 krb5_flags kdc_default_options;
1205 krb5_flags library_options;
1206 krb5_boolean profile_secure;
1207 int fcc_default_format;
1208 krb5_prompt_type *prompt_types;
1209 /* Message size above which we'll try TCP first in send-to-kdc
1210 type code. Aside from the 2**16 size limit, we put no
1211 absolute limit on the UDP packet size. */
1212 int udp_pref_limit;
1213
1214 /* Use the config-file ktypes instead of app-specified? */
1215 krb5_boolean use_conf_ktypes;
1216
1217 /* locate_kdc module stuff */
1218 struct plugin_dir_handle libkrb5_plugins;
1219
1220 /* preauth module stuff */
1221 krb5_preauth_context preauth_context;
1222
1223 /* cache module stuff */
1224 struct ccselect_module_handle **ccselect_handles;
1225
1226 /* localauth module stuff */
1227 struct localauth_module_handle **localauth_handles;
1228
1229 /* hostrealm module stuff */
1230 struct hostrealm_module_handle **hostrealm_handles;
1231
1232 /* TLS module vtable (if loaded) */
1233 struct k5_tls_vtable_st *tls;
1234
1235 /* error detail info */
1236 struct errinfo err;
1237 char *err_fmt;
1238
1239 /* For Sun iprop code; does this really have to be here? */
1240 struct _kdb_log_context *kdblog_context;
1241
1242 krb5_boolean allow_weak_crypto;
1243 krb5_boolean allow_des3;
1244 krb5_boolean allow_rc4;
1245 krb5_boolean ignore_acceptor_hostname;
1246 krb5_boolean enforce_ok_as_delegate;
1247 enum dns_canonhost dns_canonicalize_hostname;
1248
1249 krb5_trace_callback trace_callback;
1250 void *trace_callback_data;
1251
1252 krb5_pre_send_fn kdc_send_hook;
1253 void *kdc_send_hook_data;
1254
1255 krb5_post_recv_fn kdc_recv_hook;
1256 void *kdc_recv_hook_data;
1257
1258 struct plugin_interface plugins[PLUGIN_NUM_INTERFACES];
1259 char *plugin_base_dir;
1260 };
1261
1262 /* could be used in a table to find an etype and initialize a block */
1263
1264
1265 #define KRB5_LIBOPT_SYNC_KDCTIME 0x0001
1266
1267 /* internal message representations */
1268
1269 typedef struct _krb5_safe {
1270 krb5_magic magic;
1271 krb5_data user_data; /* user data */
1272 krb5_timestamp timestamp; /* client time, optional */
1273 krb5_int32 usec; /* microsecond portion of time,
1274 optional */
1275 krb5_ui_4 seq_number; /* sequence #, optional */
1276 krb5_address *s_address; /* sender address */
1277 krb5_address *r_address; /* recipient address, optional */
1278 krb5_checksum *checksum; /* data integrity checksum */
1279 } krb5_safe;
1280
1281 typedef struct _krb5_priv {
1282 krb5_magic magic;
1283 krb5_enc_data enc_part; /* encrypted part */
1284 } krb5_priv;
1285
1286 typedef struct _krb5_priv_enc_part {
1287 krb5_magic magic;
1288 krb5_data user_data; /* user data */
1289 krb5_timestamp timestamp; /* client time, optional */
1290 krb5_int32 usec; /* microsecond portion of time, opt. */
1291 krb5_ui_4 seq_number; /* sequence #, optional */
1292 krb5_address *s_address; /* sender address */
1293 krb5_address *r_address; /* recipient address, optional */
1294 } krb5_priv_enc_part;
1295
1296 void KRB5_CALLCONV krb5_free_safe(krb5_context, krb5_safe *);
1297 void KRB5_CALLCONV krb5_free_priv(krb5_context, krb5_priv *);
1298 void KRB5_CALLCONV krb5_free_priv_enc_part(krb5_context, krb5_priv_enc_part *);
1299
1300 /*
1301 * Begin "asn1.h"
1302 */
1303 #ifndef KRB5_ASN1__
1304 #define KRB5_ASN1__
1305
1306 /* ASN.1 encoding knowledge; KEEP IN SYNC WITH ASN.1 defs! */
1307 /* here we use some knowledge of ASN.1 encodings */
1308 /*
1309 Ticket is APPLICATION 1.
1310 Authenticator is APPLICATION 2.
1311 AS_REQ is APPLICATION 10.
1312 AS_REP is APPLICATION 11.
1313 TGS_REQ is APPLICATION 12.
1314 TGS_REP is APPLICATION 13.
1315 AP_REQ is APPLICATION 14.
1316 AP_REP is APPLICATION 15.
1317 KRB_SAFE is APPLICATION 20.
1318 KRB_PRIV is APPLICATION 21.
1319 KRB_CRED is APPLICATION 22.
1320 EncASRepPart is APPLICATION 25.
1321 EncTGSRepPart is APPLICATION 26.
1322 EncAPRepPart is APPLICATION 27.
1323 EncKrbPrivPart is APPLICATION 28.
1324 EncKrbCredPart is APPLICATION 29.
1325 KRB_ERROR is APPLICATION 30.
1326 */
1327 /* allow either constructed or primitive encoding, so check for bit 6
1328 set or reset */
1329 #define krb5int_is_app_tag(dat,tag) \
1330 ((dat != NULL) && (dat)->length && \
1331 ((((dat)->data[0] & ~0x20) == ((tag) | 0x40))))
1332 #define krb5_is_krb_ticket(dat) krb5int_is_app_tag(dat, 1)
1333 #define krb5_is_krb_authenticator(dat) krb5int_is_app_tag(dat, 2)
1334 #define krb5_is_as_req(dat) krb5int_is_app_tag(dat, 10)
1335 #define krb5_is_as_rep(dat) krb5int_is_app_tag(dat, 11)
1336 #define krb5_is_tgs_req(dat) krb5int_is_app_tag(dat, 12)
1337 #define krb5_is_tgs_rep(dat) krb5int_is_app_tag(dat, 13)
1338 #define krb5_is_ap_req(dat) krb5int_is_app_tag(dat, 14)
1339 #define krb5_is_ap_rep(dat) krb5int_is_app_tag(dat, 15)
1340 #define krb5_is_krb_safe(dat) krb5int_is_app_tag(dat, 20)
1341 #define krb5_is_krb_priv(dat) krb5int_is_app_tag(dat, 21)
1342 #define krb5_is_krb_cred(dat) krb5int_is_app_tag(dat, 22)
1343 #define krb5_is_krb_enc_as_rep_part(dat) krb5int_is_app_tag(dat, 25)
1344 #define krb5_is_krb_enc_tgs_rep_part(dat) krb5int_is_app_tag(dat, 26)
1345 #define krb5_is_krb_enc_ap_rep_part(dat) krb5int_is_app_tag(dat, 27)
1346 #define krb5_is_krb_enc_krb_priv_part(dat) krb5int_is_app_tag(dat, 28)
1347 #define krb5_is_krb_enc_krb_cred_part(dat) krb5int_is_app_tag(dat, 29)
1348 #define krb5_is_krb_error(dat) krb5int_is_app_tag(dat, 30)
1349
1350 /*************************************************************************
1351 * Prototypes for krb5_encode.c
1352 *************************************************************************/
1353
1354 /*
1355 krb5_error_code encode_krb5_structure(const krb5_structure *rep,
1356 krb5_data **code);
1357 modifies *code
1358 effects Returns the ASN.1 encoding of *rep in **code.
1359 Returns ASN1_MISSING_FIELD if a required field is empty in *rep.
1360 Returns ENOMEM if memory runs out.
1361 */
1362
1363 krb5_error_code
1364 encode_krb5_authenticator(const krb5_authenticator *rep, krb5_data **code);
1365
1366 krb5_error_code
1367 encode_krb5_ticket(const krb5_ticket *rep, krb5_data **code);
1368
1369 krb5_error_code
1370 encode_krb5_enc_tkt_part(const krb5_enc_tkt_part *rep, krb5_data **code);
1371
1372 krb5_error_code
1373 encode_krb5_enc_kdc_rep_part(const krb5_enc_kdc_rep_part *rep,
1374 krb5_data **code);
1375
1376 /* yes, the translation is identical to that used for KDC__REP */
1377 krb5_error_code
1378 encode_krb5_as_rep(const krb5_kdc_rep *rep, krb5_data **code);
1379
1380 /* yes, the translation is identical to that used for KDC__REP */
1381 krb5_error_code
1382 encode_krb5_tgs_rep(const krb5_kdc_rep *rep, krb5_data **code);
1383
1384 krb5_error_code
1385 encode_krb5_ap_req(const krb5_ap_req *rep, krb5_data **code);
1386
1387 krb5_error_code
1388 encode_krb5_ap_rep(const krb5_ap_rep *rep, krb5_data **code);
1389
1390 krb5_error_code
1391 encode_krb5_ap_rep_enc_part(const krb5_ap_rep_enc_part *rep, krb5_data **code);
1392
1393 krb5_error_code
1394 encode_krb5_as_req(const krb5_kdc_req *rep, krb5_data **code);
1395
1396 krb5_error_code
1397 encode_krb5_tgs_req(const krb5_kdc_req *rep, krb5_data **code);
1398
1399 krb5_error_code
1400 encode_krb5_kdc_req_body(const krb5_kdc_req *rep, krb5_data **code);
1401
1402 krb5_error_code
1403 encode_krb5_safe(const krb5_safe *rep, krb5_data **code);
1404
1405 struct krb5_safe_with_body {
1406 krb5_safe *safe;
1407 krb5_data *body;
1408 };
1409 krb5_error_code
1410 encode_krb5_safe_with_body(const struct krb5_safe_with_body *rep,
1411 krb5_data **code);
1412
1413 krb5_error_code
1414 encode_krb5_priv(const krb5_priv *rep, krb5_data **code);
1415
1416 krb5_error_code
1417 encode_krb5_enc_priv_part(const krb5_priv_enc_part *rep, krb5_data **code);
1418
1419 krb5_error_code
1420 encode_krb5_cred(const krb5_cred *rep, krb5_data **code);
1421 krb5_error_code
1422 encode_krb5_checksum(const krb5_checksum *, krb5_data **);
1423
1424 krb5_error_code
1425 encode_krb5_enc_cred_part(const krb5_cred_enc_part *rep, krb5_data **code);
1426
1427 krb5_error_code
1428 encode_krb5_error(const krb5_error *rep, krb5_data **code);
1429
1430 krb5_error_code
1431 encode_krb5_authdata(krb5_authdata *const *rep, krb5_data **code);
1432
1433 krb5_error_code
1434 encode_krb5_padata_sequence(krb5_pa_data *const *rep, krb5_data **code);
1435
1436 krb5_error_code
1437 encode_krb5_typed_data(krb5_pa_data *const *rep, krb5_data **code);
1438
1439 krb5_error_code
1440 encode_krb5_etype_info(krb5_etype_info_entry *const *, krb5_data **code);
1441
1442 krb5_error_code
1443 encode_krb5_etype_info2(krb5_etype_info_entry *const *, krb5_data **code);
1444
1445 krb5_error_code
1446 encode_krb5_pa_enc_ts(const krb5_pa_enc_ts *, krb5_data **);
1447
1448 krb5_error_code
1449 encode_krb5_sam_challenge_2(const krb5_sam_challenge_2 * , krb5_data **);
1450
1451 krb5_error_code
1452 encode_krb5_sam_challenge_2_body(const krb5_sam_challenge_2_body *,
1453 krb5_data **);
1454
1455 krb5_error_code
1456 encode_krb5_enc_sam_response_enc_2(const krb5_enc_sam_response_enc_2 *,
1457 krb5_data **);
1458
1459 krb5_error_code
1460 encode_krb5_sam_response_2(const krb5_sam_response_2 * , krb5_data **);
1461
1462 struct krb5_setpw_req {
1463 krb5_principal target;
1464 krb5_data password;
1465 };
1466 krb5_error_code
1467 encode_krb5_setpw_req(const struct krb5_setpw_req *rep, krb5_data **code);
1468
1469 krb5_error_code
1470 encode_krb5_pa_for_user(const krb5_pa_for_user *, krb5_data **);
1471
1472 krb5_error_code
1473 encode_krb5_s4u_userid(const krb5_s4u_userid *, krb5_data **);
1474
1475 krb5_error_code
1476 encode_krb5_pa_s4u_x509_user(const krb5_pa_s4u_x509_user *, krb5_data **);
1477
1478 krb5_error_code
1479 encode_krb5_pa_pac_req(const krb5_pa_pac_req *, krb5_data **);
1480
1481 krb5_error_code
1482 encode_krb5_etype_list(const krb5_etype_list * , krb5_data **);
1483
1484 krb5_error_code
1485 encode_krb5_pa_fx_fast_request(const krb5_fast_armored_req *, krb5_data **);
1486
1487 krb5_error_code
1488 encode_krb5_fast_req(const krb5_fast_req *, krb5_data **);
1489
1490 krb5_error_code
1491 encode_krb5_pa_fx_fast_reply(const krb5_enc_data *, krb5_data **);
1492
1493 krb5_error_code
1494 encode_krb5_iakerb_header(const krb5_iakerb_header *, krb5_data **);
1495
1496 krb5_error_code
1497 encode_krb5_iakerb_finished(const krb5_iakerb_finished *, krb5_data **);
1498
1499 krb5_error_code
1500 encode_krb5_fast_response(const krb5_fast_response *, krb5_data **);
1501
1502 krb5_error_code
1503 encode_krb5_ad_kdcissued(const krb5_ad_kdcissued *, krb5_data **);
1504
1505 krb5_error_code
1506 encode_krb5_otp_tokeninfo(const krb5_otp_tokeninfo *, krb5_data **);
1507
1508 krb5_error_code
1509 encode_krb5_pa_otp_challenge(const krb5_pa_otp_challenge *, krb5_data **);
1510
1511 krb5_error_code
1512 encode_krb5_pa_otp_req(const krb5_pa_otp_req *, krb5_data **);
1513
1514 krb5_error_code
1515 encode_krb5_pa_otp_enc_req(const krb5_data *, krb5_data **);
1516
1517 krb5_error_code
1518 encode_krb5_kkdcp_message(const krb5_kkdcp_message *, krb5_data **);
1519
1520 krb5_error_code
1521 encode_krb5_cammac(const krb5_cammac *, krb5_data **);
1522
1523 krb5_error_code
1524 encode_utf8_strings(krb5_data *const *ut8fstrings, krb5_data **);
1525
1526 krb5_error_code
1527 encode_krb5_secure_cookie(const krb5_secure_cookie *, krb5_data **);
1528
1529 krb5_error_code
1530 encode_krb5_pa_pac_options(const krb5_pa_pac_options *, krb5_data **);
1531
1532 /*************************************************************************
1533 * End of prototypes for krb5_encode.c
1534 *************************************************************************/
1535
1536 krb5_error_code
1537 decode_krb5_sam_challenge_2(const krb5_data *, krb5_sam_challenge_2 **);
1538
1539 krb5_error_code
1540 decode_krb5_sam_challenge_2_body(const krb5_data *,
1541 krb5_sam_challenge_2_body **);
1542
1543 krb5_error_code
1544 decode_krb5_enc_sam_response_enc_2(const krb5_data *,
1545 krb5_enc_sam_response_enc_2 **);
1546
1547 krb5_error_code
1548 decode_krb5_sam_response_2(const krb5_data *, krb5_sam_response_2 **);
1549
1550
1551 /*************************************************************************
1552 * Prototypes for krb5_decode.c
1553 *************************************************************************/
1554 /*
1555 krb5_error_code decode_krb5_structure(const krb5_data *code,
1556 krb5_structure **rep);
1557
1558 requires Expects **rep to not have been allocated;
1559 a new *rep is allocated regardless of the old value.
1560 effects Decodes *code into **rep.
1561 Returns ENOMEM if memory is exhausted.
1562 Returns asn1 and krb5 errors.
1563 */
1564
1565 krb5_error_code
1566 decode_krb5_authenticator(const krb5_data *code, krb5_authenticator **rep);
1567
1568 krb5_error_code
1569 decode_krb5_ticket(const krb5_data *code, krb5_ticket **rep);
1570
1571 krb5_error_code
1572 decode_krb5_encryption_key(const krb5_data *output, krb5_keyblock **rep);
1573
1574 krb5_error_code
1575 decode_krb5_enc_tkt_part(const krb5_data *output, krb5_enc_tkt_part **rep);
1576
1577 krb5_error_code
1578 decode_krb5_enc_kdc_rep_part(const krb5_data *output,
1579 krb5_enc_kdc_rep_part **rep);
1580
1581 krb5_error_code
1582 decode_krb5_as_rep(const krb5_data *output, krb5_kdc_rep **rep);
1583
1584 krb5_error_code
1585 decode_krb5_tgs_rep(const krb5_data *output, krb5_kdc_rep **rep);
1586
1587 krb5_error_code
1588 decode_krb5_ap_req(const krb5_data *output, krb5_ap_req **rep);
1589
1590 krb5_error_code
1591 decode_krb5_ap_rep(const krb5_data *output, krb5_ap_rep **rep);
1592
1593 krb5_error_code
1594 decode_krb5_ap_rep_enc_part(const krb5_data *output,
1595 krb5_ap_rep_enc_part **rep);
1596
1597 krb5_error_code
1598 decode_krb5_as_req(const krb5_data *output, krb5_kdc_req **rep);
1599
1600 krb5_error_code
1601 decode_krb5_tgs_req(const krb5_data *output, krb5_kdc_req **rep);
1602
1603 krb5_error_code
1604 decode_krb5_kdc_req_body(const krb5_data *output, krb5_kdc_req **rep);
1605
1606 krb5_error_code
1607 decode_krb5_safe(const krb5_data *output, krb5_safe **rep);
1608
1609 krb5_error_code
1610 decode_krb5_safe_with_body(const krb5_data *output, krb5_safe **rep,
1611 krb5_data **body);
1612
1613 krb5_error_code
1614 decode_krb5_priv(const krb5_data *output, krb5_priv **rep);
1615
1616 krb5_error_code
1617 decode_krb5_enc_priv_part(const krb5_data *output, krb5_priv_enc_part **rep);
1618 krb5_error_code
1619 decode_krb5_checksum(const krb5_data *, krb5_checksum **);
1620
1621 krb5_error_code
1622 decode_krb5_cred(const krb5_data *output, krb5_cred **rep);
1623
1624 krb5_error_code
1625 decode_krb5_enc_cred_part(const krb5_data *output, krb5_cred_enc_part **rep);
1626
1627 krb5_error_code
1628 decode_krb5_error(const krb5_data *output, krb5_error **rep);
1629
1630 krb5_error_code
1631 decode_krb5_authdata(const krb5_data *output, krb5_authdata ***rep);
1632
1633 krb5_error_code
1634 decode_krb5_padata_sequence(const krb5_data *output, krb5_pa_data ***rep);
1635
1636 krb5_error_code
1637 decode_krb5_typed_data(const krb5_data *, krb5_pa_data ***);
1638
1639 krb5_error_code
1640 decode_krb5_etype_info(const krb5_data *output, krb5_etype_info_entry ***rep);
1641
1642 krb5_error_code
1643 decode_krb5_etype_info2(const krb5_data *output, krb5_etype_info_entry ***rep);
1644
1645 krb5_error_code
1646 decode_krb5_enc_data(const krb5_data *output, krb5_enc_data **rep);
1647
1648 krb5_error_code
1649 decode_krb5_pa_enc_ts(const krb5_data *output, krb5_pa_enc_ts **rep);
1650
1651 krb5_error_code
1652 decode_krb5_setpw_req(const krb5_data *, krb5_data **, krb5_principal *);
1653
1654 krb5_error_code
1655 decode_krb5_pa_for_user(const krb5_data *, krb5_pa_for_user **);
1656
1657 krb5_error_code
1658 decode_krb5_pa_s4u_x509_user(const krb5_data *, krb5_pa_s4u_x509_user **);
1659
1660 krb5_error_code
1661 decode_krb5_pa_pac_req(const krb5_data *, krb5_pa_pac_req **);
1662
1663 krb5_error_code
1664 decode_krb5_etype_list(const krb5_data *, krb5_etype_list **);
1665
1666 krb5_error_code
1667 decode_krb5_pa_fx_fast_request(const krb5_data *, krb5_fast_armored_req **);
1668
1669 krb5_error_code
1670 decode_krb5_fast_req(const krb5_data *, krb5_fast_req **);
1671
1672 krb5_error_code
1673 decode_krb5_pa_fx_fast_reply(const krb5_data *, krb5_enc_data **);
1674
1675 krb5_error_code
1676 decode_krb5_fast_response(const krb5_data *, krb5_fast_response **);
1677
1678 krb5_error_code
1679 decode_krb5_ad_kdcissued(const krb5_data *, krb5_ad_kdcissued **);
1680
1681 krb5_error_code
1682 decode_krb5_iakerb_header(const krb5_data *, krb5_iakerb_header **);
1683
1684 krb5_error_code
1685 decode_krb5_iakerb_finished(const krb5_data *, krb5_iakerb_finished **);
1686
1687 krb5_error_code
1688 decode_krb5_otp_tokeninfo(const krb5_data *, krb5_otp_tokeninfo **);
1689
1690 krb5_error_code
1691 decode_krb5_pa_otp_challenge(const krb5_data *, krb5_pa_otp_challenge **);
1692
1693 krb5_error_code
1694 decode_krb5_pa_otp_req(const krb5_data *, krb5_pa_otp_req **);
1695
1696 krb5_error_code
1697 decode_krb5_pa_otp_enc_req(const krb5_data *, krb5_data **);
1698
1699 krb5_error_code
1700 decode_krb5_kkdcp_message(const krb5_data *, krb5_kkdcp_message **);
1701
1702 krb5_error_code
1703 decode_krb5_cammac(const krb5_data *, krb5_cammac **);
1704
1705 krb5_error_code
1706 decode_utf8_strings(const krb5_data *, krb5_data ***);
1707
1708 krb5_error_code
1709 decode_krb5_secure_cookie(const krb5_data *, krb5_secure_cookie **);
1710
1711 krb5_error_code
1712 decode_krb5_pa_pac_options(const krb5_data *, krb5_pa_pac_options **);
1713
1714 struct _krb5_key_data; /* kdb.h */
1715
1716 struct ldap_seqof_key_data {
1717 krb5_int32 mkvno; /* Master key version number */
1718 krb5_ui_2 kvno; /* kvno of key_data elements (all the same) */
1719 struct _krb5_key_data *key_data;
1720 krb5_int16 n_key_data;
1721 };
1722 typedef struct ldap_seqof_key_data ldap_seqof_key_data;
1723
1724 krb5_error_code
1725 krb5int_ldap_encode_sequence_of_keys(const ldap_seqof_key_data *val,
1726 krb5_data **code);
1727
1728 krb5_error_code
1729 krb5int_ldap_decode_sequence_of_keys(const krb5_data *in,
1730 ldap_seqof_key_data **rep);
1731
1732 /*************************************************************************
1733 * End of prototypes for krb5_decode.c
1734 *************************************************************************/
1735
1736 #endif /* KRB5_ASN1__ */
1737 /*
1738 * End "asn1.h"
1739 */
1740
1741
1742 /*
1743 * Internal krb5 library routines
1744 */
1745 krb5_error_code
1746 krb5_encrypt_tkt_part(krb5_context, const krb5_keyblock *, krb5_ticket *);
1747
1748 krb5_error_code
1749 krb5_encode_kdc_rep(krb5_context, krb5_msgtype, const krb5_enc_kdc_rep_part *,
1750 int using_subkey, const krb5_keyblock *, krb5_kdc_rep *,
1751 krb5_data ** );
1752
1753 /* Return true if s is non-empty and composed solely of digits. */
1754 krb5_boolean
1755 k5_is_string_numeric(const char *s);
1756
1757 krb5_error_code
1758 k5_parse_host_string(const char *address, int default_port, char **host_out,
1759 int *port_out);
1760
1761 krb5_error_code
1762 k5_size_authdata_context(krb5_context kcontext, krb5_authdata_context context,
1763 size_t *sizep);
1764
1765 krb5_error_code
1766 k5_externalize_authdata_context(krb5_context kcontext,
1767 krb5_authdata_context context,
1768 krb5_octet **buffer, size_t *lenremain);
1769
1770 krb5_error_code
1771 k5_internalize_authdata_context(krb5_context kcontext,
1772 krb5_authdata_context *ptr,
1773 krb5_octet **buffer, size_t *lenremain);
1774
1775 krb5_error_code
1776 k5_size_auth_context(krb5_auth_context auth_context, size_t *sizep);
1777
1778 krb5_error_code
1779 k5_externalize_auth_context(krb5_auth_context auth_context,
1780 krb5_octet **buffer, size_t *lenremain);
1781 krb5_error_code
1782 k5_internalize_auth_context(krb5_auth_context *argp,
1783 krb5_octet **buffer, size_t *lenremain);
1784
1785 krb5_error_code
1786 k5_size_authdata(krb5_authdata *authdata, size_t *sizep);
1787
1788 krb5_error_code
1789 k5_externalize_authdata(krb5_authdata *authdata,
1790 krb5_octet **buffer, size_t *lenremain);
1791
1792 krb5_error_code
1793 k5_internalize_authdata(krb5_authdata **authdata,
1794 krb5_octet **buffer, size_t *lenremain);
1795
1796 krb5_error_code
1797 k5_size_address(krb5_address *address, size_t *sizep);
1798
1799 krb5_error_code
1800 k5_externalize_address(krb5_address *address,
1801 krb5_octet **buffer, size_t *lenremain);
1802
1803 krb5_error_code
1804 k5_internalize_address(krb5_address **argp,
1805 krb5_octet **buffer, size_t *lenremain);
1806
1807 krb5_error_code
1808 k5_size_authenticator(krb5_authenticator *authenticator, size_t *sizep);
1809
1810 krb5_error_code
1811 k5_externalize_authenticator(krb5_authenticator *authenticator,
1812 krb5_octet **buffer, size_t *lenremain);
1813
1814 krb5_error_code
1815 k5_internalize_authenticator(krb5_authenticator **argp,
1816 krb5_octet **buffer, size_t *lenremain);
1817
1818 krb5_error_code
1819 k5_size_checksum(krb5_checksum *checksum, size_t *sizep);
1820
1821 krb5_error_code
1822 k5_externalize_checksum(krb5_checksum *checksum,
1823 krb5_octet **buffer, size_t *lenremain);
1824
1825 krb5_error_code
1826 k5_internalize_checksum(krb5_checksum **argp,
1827 krb5_octet **buffer, size_t *lenremain);
1828
1829 krb5_error_code
1830 k5_size_context(krb5_context context, size_t *sizep);
1831
1832 krb5_error_code
1833 k5_externalize_context(krb5_context context,
1834 krb5_octet **buffer, size_t *lenremain);
1835
1836 krb5_error_code
1837 k5_internalize_context(krb5_context *argp,
1838 krb5_octet **buffer, size_t *lenremain);
1839
1840 krb5_error_code
1841 k5_size_keyblock(krb5_keyblock *keyblock, size_t *sizep);
1842
1843 krb5_error_code
1844 k5_externalize_keyblock(krb5_keyblock *keyblock,
1845 krb5_octet **buffer, size_t *lenremain);
1846
1847 krb5_error_code
1848 k5_internalize_keyblock(krb5_keyblock **argp,
1849 krb5_octet **buffer, size_t *lenremain);
1850
1851 krb5_error_code
1852 k5_size_principal(krb5_principal principal, size_t *sizep);
1853
1854 krb5_error_code
1855 k5_externalize_principal(krb5_principal principal,
1856 krb5_octet **buffer, size_t *lenremain);
1857
1858 krb5_error_code
1859 k5_internalize_principal(krb5_principal *argp,
1860 krb5_octet **buffer, size_t *lenremain);
1861
1862 /*
1863 * Initialization routines.
1864 */
1865
1866 /* [De]serialize 4-byte integer */
1867 krb5_error_code KRB5_CALLCONV
1868 krb5_ser_pack_int32(krb5_int32, krb5_octet **, size_t *);
1869
1870 krb5_error_code KRB5_CALLCONV
1871 krb5_ser_unpack_int32(krb5_int32 *, krb5_octet **, size_t *);
1872
1873 /* [De]serialize 8-byte integer */
1874 krb5_error_code KRB5_CALLCONV
1875 krb5_ser_pack_int64(int64_t, krb5_octet **, size_t *);
1876
1877 krb5_error_code KRB5_CALLCONV
1878 krb5_ser_unpack_int64(int64_t *, krb5_octet **, size_t *);
1879
1880 /* [De]serialize byte string */
1881 krb5_error_code KRB5_CALLCONV
1882 krb5_ser_pack_bytes(krb5_octet *, size_t, krb5_octet **, size_t *);
1883
1884 krb5_error_code KRB5_CALLCONV
1885 krb5_ser_unpack_bytes(krb5_octet *, size_t, krb5_octet **, size_t *);
1886
1887 krb5_error_code KRB5_CALLCONV
1888 krb5int_cc_default(krb5_context, krb5_ccache *);
1889
1890 krb5_error_code
1891 k5_cc_store_primary_cred(krb5_context, krb5_ccache, krb5_creds *);
1892
1893 /* Fill in the buffer with random alphanumeric data. */
1894 krb5_error_code
1895 krb5int_random_string(krb5_context, char *string, unsigned int length);
1896
1897 /* value to use when requesting a keytab entry and KVNO doesn't matter */
1898 #define IGNORE_VNO 0
1899 /* value to use when requesting a keytab entry and enctype doesn't matter */
1900 #define IGNORE_ENCTYPE 0
1901
1902 /* To keep happy libraries which are (for now) accessing internal stuff */
1903
1904 /* Make sure to increment by one when changing the struct */
1905 #define KRB5INT_ACCESS_STRUCT_VERSION 23
1906
1907 typedef struct _krb5int_access {
1908 krb5_error_code (*auth_con_get_subkey_enctype)(krb5_context,
1909 krb5_auth_context,
1910 krb5_enctype *);
1911
1912 krb5_error_code (*mandatory_cksumtype)(krb5_context, krb5_enctype,
1913 krb5_cksumtype *);
1914 krb5_error_code (KRB5_CALLCONV *ser_pack_int64)(int64_t, krb5_octet **,
1915 size_t *);
1916 krb5_error_code (KRB5_CALLCONV *ser_unpack_int64)(int64_t *, krb5_octet **,
1917 size_t *);
1918
1919 /* Used for KDB LDAP back end. */
1920 krb5_error_code
1921 (*asn1_ldap_encode_sequence_of_keys)(const ldap_seqof_key_data *val,
1922 krb5_data **code);
1923
1924 krb5_error_code
1925 (*asn1_ldap_decode_sequence_of_keys)(const krb5_data *in,
1926 ldap_seqof_key_data **);
1927
1928 /*
1929 * pkinit asn.1 encode/decode functions
1930 */
1931 krb5_error_code
1932 (*encode_krb5_auth_pack)(const krb5_auth_pack *rep, krb5_data **code);
1933
1934 krb5_error_code
1935 (*encode_krb5_kdc_dh_key_info)(const krb5_kdc_dh_key_info *rep,
1936 krb5_data **code);
1937
1938 krb5_error_code
1939 (*encode_krb5_pa_pk_as_rep)(const krb5_pa_pk_as_rep *rep,
1940 krb5_data **code);
1941
1942 krb5_error_code
1943 (*encode_krb5_pa_pk_as_req)(const krb5_pa_pk_as_req *rep,
1944 krb5_data **code);
1945
1946 krb5_error_code
1947 (*encode_krb5_reply_key_pack)(const krb5_reply_key_pack *,
1948 krb5_data **code);
1949
1950 krb5_error_code
1951 (*encode_krb5_td_dh_parameters)(krb5_algorithm_identifier *const *,
1952 krb5_data **code);
1953
1954 krb5_error_code
1955 (*encode_krb5_td_trusted_certifiers)(krb5_external_principal_identifier *
1956 const *, krb5_data **code);
1957
1958 krb5_error_code
1959 (*decode_krb5_auth_pack)(const krb5_data *, krb5_auth_pack **);
1960
1961 krb5_error_code
1962 (*decode_krb5_pa_pk_as_req)(const krb5_data *, krb5_pa_pk_as_req **);
1963
1964 krb5_error_code
1965 (*decode_krb5_pa_pk_as_rep)(const krb5_data *, krb5_pa_pk_as_rep **);
1966
1967 krb5_error_code
1968 (*decode_krb5_kdc_dh_key_info)(const krb5_data *, krb5_kdc_dh_key_info **);
1969
1970 krb5_error_code
1971 (*decode_krb5_principal_name)(const krb5_data *, krb5_principal_data **);
1972
1973 krb5_error_code
1974 (*decode_krb5_reply_key_pack)(const krb5_data *, krb5_reply_key_pack **);
1975
1976 krb5_error_code
1977 (*decode_krb5_td_dh_parameters)(const krb5_data *,
1978 krb5_algorithm_identifier ***);
1979
1980 krb5_error_code
1981 (*decode_krb5_td_trusted_certifiers)(const krb5_data *,
1982 krb5_external_principal_identifier
1983 ***);
1984
1985 krb5_error_code
1986 (*encode_krb5_kdc_req_body)(const krb5_kdc_req *rep, krb5_data **code);
1987
1988 void
1989 (KRB5_CALLCONV *free_kdc_req)(krb5_context, krb5_kdc_req * );
1990 void
1991 (*set_prompt_types)(krb5_context, krb5_prompt_type *);
1992 } krb5int_access;
1993
1994 #define KRB5INT_ACCESS_VERSION \
1995 (((krb5_int32)((sizeof(krb5int_access) & 0xFFFF) | \
1996 (KRB5INT_ACCESS_STRUCT_VERSION << 16))) & 0xFFFFFFFF)
1997
1998 krb5_error_code KRB5_CALLCONV
1999 krb5int_accessor(krb5int_access*, krb5_int32);
2000
2001 krb5_error_code KRB5_CALLCONV
2002 krb5int_cc_user_set_default_name(krb5_context context, const char *name);
2003
2004 krb5_error_code k5_rc_default(krb5_context context, krb5_rcache *rc_out);
2005 krb5_error_code k5_rc_resolve(krb5_context context, const char *name,
2006 krb5_rcache *rc_out);
2007 void k5_rc_close(krb5_context context, krb5_rcache rc);
2008 krb5_error_code k5_rc_store(krb5_context context, krb5_rcache rc,
2009 const krb5_enc_data *authenticator);
2010 const char *k5_rc_get_name(krb5_context context, krb5_rcache rc);
2011
2012 /* Set *tag_out to the integrity tag of *enc. (Does not allocate memory;
2013 * returned buffer is a subrange of *ctext.) */
2014 krb5_error_code
2015 k5_rc_tag_from_ciphertext(krb5_context context, const krb5_enc_data *enc,
2016 krb5_data *tag_out);
2017
2018 /*
2019 * This structure was exposed and used in macros in krb5 1.2, so do not
2020 * change its ABI.
2021 */
2022 typedef struct _krb5_kt_ops {
2023 krb5_magic magic;
2024 char *prefix;
2025
2026 /* routines always present */
2027 krb5_error_code (KRB5_CALLCONV *resolve)(krb5_context, const char *,
2028 krb5_keytab *);
2029 krb5_error_code (KRB5_CALLCONV *get_name)(krb5_context, krb5_keytab,
2030 char *, unsigned int);
2031 krb5_error_code (KRB5_CALLCONV *close)(krb5_context, krb5_keytab);
2032 krb5_error_code (KRB5_CALLCONV *get)(krb5_context, krb5_keytab,
2033 krb5_const_principal, krb5_kvno,
2034 krb5_enctype, krb5_keytab_entry *);
2035 krb5_error_code (KRB5_CALLCONV *start_seq_get)(krb5_context, krb5_keytab,
2036 krb5_kt_cursor *);
2037 krb5_error_code (KRB5_CALLCONV *get_next)(krb5_context, krb5_keytab,
2038 krb5_keytab_entry *,
2039 krb5_kt_cursor *);
2040 krb5_error_code (KRB5_CALLCONV *end_get)(krb5_context, krb5_keytab,
2041 krb5_kt_cursor *);
2042 /* routines to be included on extended version (write routines) */
2043 krb5_error_code (KRB5_CALLCONV *add)(krb5_context, krb5_keytab,
2044 krb5_keytab_entry *);
2045 krb5_error_code (KRB5_CALLCONV *remove)(krb5_context, krb5_keytab,
2046 krb5_keytab_entry *);
2047 } krb5_kt_ops;
2048
2049 /* Not sure it's ready for exposure just yet. */
2050 extern krb5_error_code
2051 krb5int_c_mandatory_cksumtype(krb5_context, krb5_enctype, krb5_cksumtype *);
2052
2053 /*
2054 * Referral definitions and subfunctions.
2055 */
2056 #define KRB5_REFERRAL_MAXHOPS 10
2057
2058 struct _krb5_kt { /* should move into k5-int.h */
2059 krb5_magic magic;
2060 const struct _krb5_kt_ops *ops;
2061 krb5_pointer data;
2062 };
2063
2064 krb5_error_code krb5_get_default_in_tkt_ktypes(krb5_context, krb5_enctype **);
2065
2066 krb5_error_code KRB5_CALLCONV
2067 krb5_get_tgs_ktypes(krb5_context, krb5_const_principal, krb5_enctype **);
2068
2069 krb5_boolean krb5_is_permitted_enctype(krb5_context, krb5_enctype);
2070
2071 krb5_boolean KRB5_CALLCONV krb5int_c_weak_enctype(krb5_enctype);
2072 krb5_boolean KRB5_CALLCONV krb5int_c_deprecated_enctype(krb5_enctype);
2073 krb5_error_code k5_enctype_to_ssf(krb5_enctype enctype, unsigned int *ssf_out);
2074
2075 krb5_error_code krb5_kdc_rep_decrypt_proc(krb5_context, const krb5_keyblock *,
2076 krb5_const_pointer, krb5_kdc_rep *);
2077 krb5_error_code KRB5_CALLCONV krb5_decrypt_tkt_part(krb5_context,
2078 const krb5_keyblock *,
2079 krb5_ticket * );
2080
2081 krb5_error_code krb5_get_cred_via_tkt(krb5_context, krb5_creds *, krb5_flags,
2082 krb5_address *const *, krb5_creds *,
2083 krb5_creds **);
2084
2085 krb5_error_code KRB5_CALLCONV krb5_copy_addr(krb5_context,
2086 const krb5_address *,
2087 krb5_address **);
2088
2089 void krb5_init_ets(krb5_context);
2090 void krb5_free_ets(krb5_context);
2091 krb5_error_code krb5_generate_subkey(krb5_context, const krb5_keyblock *,
2092 krb5_keyblock **);
2093 krb5_error_code krb5_generate_subkey_extended(krb5_context,
2094 const krb5_keyblock *,
2095 krb5_enctype, krb5_keyblock **);
2096 krb5_error_code krb5_generate_seq_number(krb5_context, const krb5_keyblock *,
2097 krb5_ui_4 *);
2098
2099 krb5_error_code KRB5_CALLCONV krb5_kt_register(krb5_context,
2100 const struct _krb5_kt_ops *);
2101
2102 krb5_error_code k5_kt_get_principal(krb5_context context, krb5_keytab keytab,
2103 krb5_principal *princ_out);
2104
2105 krb5_error_code k5_kt_have_match(krb5_context context, krb5_keytab keytab,
2106 krb5_principal mprinc);
2107
2108 krb5_error_code krb5_principal2salt_norealm(krb5_context, krb5_const_principal,
2109 krb5_data *);
2110
2111 unsigned int KRB5_CALLCONV krb5_get_notification_message(void);
2112
2113 /* chk_trans.c */
2114 krb5_error_code krb5_check_transited_list(krb5_context, const krb5_data *trans,
2115 const krb5_data *realm1,
2116 const krb5_data *realm2);
2117
2118 /* free_rtree.c */
2119 void krb5_free_realm_tree(krb5_context, krb5_principal *);
2120
2121 void KRB5_CALLCONV krb5_free_authenticator_contents(krb5_context,
2122 krb5_authenticator *);
2123
2124 void KRB5_CALLCONV krb5_free_address(krb5_context, krb5_address *);
2125
2126 void KRB5_CALLCONV krb5_free_enc_tkt_part(krb5_context, krb5_enc_tkt_part *);
2127
2128 void KRB5_CALLCONV krb5_free_tickets(krb5_context, krb5_ticket **);
2129 void KRB5_CALLCONV krb5_free_kdc_req(krb5_context, krb5_kdc_req *);
2130 void KRB5_CALLCONV krb5_free_kdc_rep(krb5_context, krb5_kdc_rep *);
2131 void KRB5_CALLCONV krb5_free_last_req(krb5_context, krb5_last_req_entry **);
2132 void KRB5_CALLCONV krb5_free_enc_kdc_rep_part(krb5_context,
2133 krb5_enc_kdc_rep_part *);
2134 void KRB5_CALLCONV krb5_free_ap_req(krb5_context, krb5_ap_req *);
2135 void KRB5_CALLCONV krb5_free_ap_rep(krb5_context, krb5_ap_rep *);
2136 void KRB5_CALLCONV krb5_free_cred(krb5_context, krb5_cred *);
2137 void KRB5_CALLCONV krb5_free_cred_enc_part(krb5_context, krb5_cred_enc_part *);
2138 void KRB5_CALLCONV krb5_free_pa_data(krb5_context, krb5_pa_data **);
2139 void KRB5_CALLCONV krb5_free_tkt_authent(krb5_context, krb5_tkt_authent *);
2140 void KRB5_CALLCONV krb5_free_enc_data(krb5_context, krb5_enc_data *);
2141 krb5_error_code krb5_set_config_files(krb5_context, const char **);
2142
2143 krb5_error_code KRB5_CALLCONV krb5_get_default_config_files(char ***filenames);
2144
2145 void KRB5_CALLCONV krb5_free_config_files(char **filenames);
2146
2147 krb5_error_code krb5_rd_req_decoded(krb5_context, krb5_auth_context *,
2148 const krb5_ap_req *, krb5_const_principal,
2149 krb5_keytab, krb5_flags *, krb5_ticket **);
2150
2151 krb5_error_code krb5_rd_req_decoded_anyflag(krb5_context, krb5_auth_context *,
2152 const krb5_ap_req *,
2153 krb5_const_principal, krb5_keytab,
2154 krb5_flags *, krb5_ticket **);
2155
2156 krb5_error_code KRB5_CALLCONV
2157 krb5_cc_register(krb5_context, const krb5_cc_ops *, krb5_boolean );
2158
2159 krb5_error_code krb5_walk_realm_tree(krb5_context, const krb5_data *,
2160 const krb5_data *, krb5_principal **,
2161 int);
2162
2163 krb5_error_code
2164 krb5_auth_con_set_safe_cksumtype(krb5_context, krb5_auth_context,
2165 krb5_cksumtype);
2166
2167 krb5_error_code krb5_auth_con_setivector(krb5_context, krb5_auth_context,
2168 krb5_pointer);
2169
2170 krb5_error_code krb5_auth_con_getivector(krb5_context, krb5_auth_context,
2171 krb5_pointer *);
2172
2173 krb5_error_code krb5_auth_con_setpermetypes(krb5_context, krb5_auth_context,
2174 const krb5_enctype *);
2175
2176 krb5_error_code krb5_auth_con_getpermetypes(krb5_context, krb5_auth_context,
2177 krb5_enctype **);
2178
2179 krb5_error_code krb5_auth_con_get_subkey_enctype(krb5_context context,
2180 krb5_auth_context,
2181 krb5_enctype *);
2182
2183 krb5_error_code
2184 krb5_auth_con_get_authdata_context(krb5_context context,
2185 krb5_auth_context auth_context,
2186 krb5_authdata_context *ad_context);
2187
2188 krb5_error_code
2189 krb5_auth_con_set_authdata_context(krb5_context context,
2190 krb5_auth_context auth_context,
2191 krb5_authdata_context ad_context);
2192
2193 krb5_error_code krb5_read_message(krb5_context, krb5_pointer, krb5_data *);
2194 krb5_error_code krb5_write_message(krb5_context, krb5_pointer, krb5_data *);
2195 int krb5_net_read(krb5_context, int , char *, int);
2196 int krb5_net_write(krb5_context, int , const char *, int);
2197
2198 krb5_error_code KRB5_CALLCONV krb5_get_realm_domain(krb5_context,
2199 const char *, char ** );
2200
2201 krb5_error_code krb5_gen_portaddr(krb5_context, const krb5_address *,
2202 krb5_const_pointer, krb5_address **);
2203
2204 krb5_error_code krb5_gen_replay_name(krb5_context, const krb5_address *,
2205 const char *, char **);
2206 krb5_error_code krb5_make_fulladdr(krb5_context, krb5_address *,
2207 krb5_address *, krb5_address *);
2208
2209 krb5_error_code krb5_set_debugging_time(krb5_context, krb5_timestamp,
2210 krb5_int32);
2211 krb5_error_code krb5_use_natural_time(krb5_context);
2212 krb5_error_code krb5_set_time_offsets(krb5_context, krb5_timestamp,
2213 krb5_int32);
2214
2215 /* Some data comparison and conversion functions. */
2216 static inline int
data_eq(krb5_data d1,krb5_data d2)2217 data_eq(krb5_data d1, krb5_data d2)
2218 {
2219 return (d1.length == d2.length && (d1.length == 0 ||
2220 !memcmp(d1.data, d2.data, d1.length)));
2221 }
2222
2223 static inline int
data_eq_string(krb5_data d,const char * s)2224 data_eq_string (krb5_data d, const char *s)
2225 {
2226 return (d.length == strlen(s) && (d.length == 0 ||
2227 !memcmp(d.data, s, d.length)));
2228 }
2229
2230 static inline krb5_data
make_data(void * data,unsigned int len)2231 make_data(void *data, unsigned int len)
2232 {
2233 krb5_data d;
2234
2235 d.magic = KV5M_DATA;
2236 d.data = (char *) data;
2237 d.length = len;
2238 return d;
2239 }
2240
2241 static inline krb5_data
empty_data()2242 empty_data()
2243 {
2244 return make_data(NULL, 0);
2245 }
2246
2247 static inline krb5_data
string2data(char * str)2248 string2data(char *str)
2249 {
2250 return make_data(str, strlen(str));
2251 }
2252
2253 static inline krb5_error_code
alloc_data(krb5_data * data,unsigned int len)2254 alloc_data(krb5_data *data, unsigned int len)
2255 {
2256 /* Allocate at least one byte since zero-byte allocs may return NULL. */
2257 char *ptr = (char *) calloc((len > 0) ? len : 1, 1);
2258
2259 if (ptr == NULL)
2260 return ENOMEM;
2261 data->magic = KV5M_DATA;
2262 data->data = ptr;
2263 data->length = len;
2264 return 0;
2265 }
2266
2267 static inline int
authdata_eq(krb5_authdata a1,krb5_authdata a2)2268 authdata_eq(krb5_authdata a1, krb5_authdata a2)
2269 {
2270 return (a1.ad_type == a2.ad_type && a1.length == a2.length &&
2271 (a1.length == 0 || !memcmp(a1.contents, a2.contents, a1.length)));
2272 }
2273
2274 /* Allocate zeroed memory; set *code to 0 on success or ENOMEM on failure. */
2275 static inline void *
k5calloc(size_t nmemb,size_t size,krb5_error_code * code)2276 k5calloc(size_t nmemb, size_t size, krb5_error_code *code)
2277 {
2278 void *ptr;
2279
2280 /* Allocate at least one byte since zero-byte allocs may return NULL. */
2281 ptr = calloc(nmemb ? nmemb : 1, size ? size : 1);
2282 *code = (ptr == NULL) ? ENOMEM : 0;
2283 return ptr;
2284 }
2285
2286 /* Allocate zeroed memory; set *code to 0 on success or ENOMEM on failure. */
2287 static inline void *
k5alloc(size_t size,krb5_error_code * code)2288 k5alloc(size_t size, krb5_error_code *code)
2289 {
2290 return k5calloc(1, size, code);
2291 }
2292
2293 /* Return a copy of the len bytes of memory at in; set *code to 0 or ENOMEM. */
2294 static inline void *
k5memdup(const void * in,size_t len,krb5_error_code * code)2295 k5memdup(const void *in, size_t len, krb5_error_code *code)
2296 {
2297 void *ptr = k5alloc(len, code);
2298
2299 if (ptr != NULL && len > 0)
2300 memcpy(ptr, in, len);
2301 return ptr;
2302 }
2303
2304 /* Like k5memdup, but add a final null byte. */
2305 static inline void *
k5memdup0(const void * in,size_t len,krb5_error_code * code)2306 k5memdup0(const void *in, size_t len, krb5_error_code *code)
2307 {
2308 void *ptr = k5alloc(len + 1, code);
2309
2310 if (ptr != NULL && len > 0)
2311 memcpy(ptr, in, len);
2312 return ptr;
2313 }
2314
2315 /* Convert a krb5_timestamp to a time_t value, treating the negative range of
2316 * krb5_timestamp as times between 2038 and 2106 (if time_t is 64-bit). */
2317 static inline time_t
ts2tt(krb5_timestamp timestamp)2318 ts2tt(krb5_timestamp timestamp)
2319 {
2320 return (time_t)(uint32_t)timestamp;
2321 }
2322
2323 /* Return the delta between two timestamps (a - b) as a signed 32-bit value,
2324 * without relying on undefined behavior. */
2325 static inline krb5_deltat
ts_delta(krb5_timestamp a,krb5_timestamp b)2326 ts_delta(krb5_timestamp a, krb5_timestamp b)
2327 {
2328 return (krb5_deltat)((uint32_t)a - (uint32_t)b);
2329 }
2330
2331 /* Return (end - start) as an unsigned 32-bit value, or 0 if start > end. */
2332 static inline uint32_t
ts_interval(krb5_timestamp start,krb5_timestamp end)2333 ts_interval(krb5_timestamp start, krb5_timestamp end)
2334 {
2335 if ((uint32_t)start > (uint32_t)end)
2336 return 0;
2337 return (uint32_t)end - (uint32_t)start;
2338 }
2339
2340 /* Increment a timestamp by a signed 32-bit interval, without relying on
2341 * undefined behavior. */
2342 static inline krb5_timestamp
ts_incr(krb5_timestamp ts,krb5_deltat delta)2343 ts_incr(krb5_timestamp ts, krb5_deltat delta)
2344 {
2345 return (krb5_timestamp)((uint32_t)ts + (uint32_t)delta);
2346 }
2347
2348 /* Return true if a comes after b. */
2349 static inline krb5_boolean
ts_after(krb5_timestamp a,krb5_timestamp b)2350 ts_after(krb5_timestamp a, krb5_timestamp b)
2351 {
2352 return (uint32_t)a > (uint32_t)b;
2353 }
2354
2355 /* Return true if a and b are within d seconds. */
2356 static inline krb5_boolean
ts_within(krb5_timestamp a,krb5_timestamp b,krb5_deltat d)2357 ts_within(krb5_timestamp a, krb5_timestamp b, krb5_deltat d)
2358 {
2359 return !ts_after(a, ts_incr(b, d)) && !ts_after(b, ts_incr(a, d));
2360 }
2361
2362 krb5_error_code KRB5_CALLCONV
2363 krb5_get_credentials_for_user(krb5_context context, krb5_flags options,
2364 krb5_ccache ccache,
2365 krb5_creds *in_creds,
2366 krb5_data *cert,
2367 krb5_creds **out_creds);
2368
2369 krb5_error_code KRB5_CALLCONV
2370 krb5_get_credentials_for_proxy(krb5_context context,
2371 krb5_flags options,
2372 krb5_ccache ccache,
2373 krb5_creds *in_creds,
2374 krb5_ticket *evidence_tkt,
2375 krb5_creds **out_creds);
2376
2377 krb5_error_code KRB5_CALLCONV
2378 krb5int_get_authdata_containee_types(krb5_context context,
2379 const krb5_authdata *container,
2380 unsigned int *nad_types,
2381 krb5_authdatatype **ad_types);
2382
2383 krb5_error_code krb5int_parse_enctype_list(krb5_context context,
2384 const char *profkey, char *profstr,
2385 krb5_enctype *default_list,
2386 krb5_enctype **result);
2387
2388 krb5_boolean k5_etypes_contains(const krb5_enctype *list, krb5_enctype etype);
2389
2390 void k5_change_error_message_code(krb5_context ctx, krb5_error_code oldcode,
2391 krb5_error_code newcode);
2392
2393 /* Define shorter internal names for setting error messages. */
2394 #define k5_setmsg krb5_set_error_message
2395 #define k5_prependmsg krb5_prepend_error_message
2396 #define k5_wrapmsg krb5_wrap_error_message
2397
2398 /*
2399 * Like krb5_principal_compare(), but with canonicalization of sname if
2400 * fallback is enabled. This function should be avoided if multiple matches
2401 * are required, since repeated canonicalization is inefficient.
2402 */
2403 krb5_boolean
2404 k5_sname_compare(krb5_context context, krb5_const_principal sname,
2405 krb5_const_principal princ);
2406
2407 #endif /* _KRB5_INT_H */
2408