1 /* 2 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 /* $Id$ */ 37 38 #ifndef __KRB5_LOCL_H__ 39 #define __KRB5_LOCL_H__ 40 41 #include <config.h> 42 43 #include <errno.h> 44 #include <ctype.h> 45 #include <string.h> 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <limits.h> 49 50 #include <krb5-types.h> 51 52 #ifdef HAVE_SYS_TYPES_H 53 #include <sys/types.h> 54 #endif 55 #ifdef HAVE_SYS_MMAN_H 56 #include <sys/mman.h> 57 #endif 58 #ifdef HAVE_UNISTD_H 59 #include <unistd.h> 60 #endif 61 #ifdef HAVE_FCNTL_H 62 #include <fcntl.h> 63 #endif 64 65 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40 66 #include <sys/ioctl.h> 67 #endif 68 #ifdef HAVE_PWD_H 69 #undef _POSIX_PTHREAD_SEMANTICS 70 /* This gets us the 5-arg getpwnam_r on Solaris 9. */ 71 #define _POSIX_PTHREAD_SEMANTICS 72 #include <pwd.h> 73 #endif 74 75 #ifdef HAVE_SYS_PARAM_H 76 #include <sys/param.h> 77 #endif 78 #include <time.h> 79 #ifdef HAVE_SYS_TIME_H 80 #include <sys/time.h> 81 #endif 82 #ifdef HAVE_SYS_SELECT_H 83 #include <sys/select.h> 84 #endif 85 #ifdef HAVE_SYS_SOCKET_H 86 #include <sys/socket.h> 87 #endif 88 #ifdef HAVE_NETINET_IN_H 89 #include <netinet/in.h> 90 #endif 91 #ifdef HAVE_NETINET_IN6_H 92 #include <netinet/in6.h> 93 #endif 94 #ifdef HAVE_NETINET6_IN6_H 95 #include <netinet6/in6.h> 96 #endif 97 #ifdef HAVE_NETDB_H 98 #include <netdb.h> 99 #endif 100 #ifdef _AIX 101 struct ether_addr; 102 struct mbuf; 103 struct sockaddr_dl; 104 #endif 105 #ifdef HAVE_ARPA_INET_H 106 #include <arpa/inet.h> 107 #endif 108 #ifdef HAVE_ARPA_NAMESER_H 109 #include <arpa/nameser.h> 110 #endif 111 #ifdef HAVE_SYS_UIO_H 112 #include <sys/uio.h> 113 #endif 114 #ifdef HAVE_SYS_FILIO_H 115 #include <sys/filio.h> 116 #endif 117 #ifdef HAVE_SYS_FILE_H 118 #include <sys/file.h> 119 #endif 120 121 #include <com_err.h> 122 123 #include <heimbase.h> 124 125 #define HEIMDAL_TEXTDOMAIN "heimdal_krb5" 126 127 #ifdef LIBINTL 128 #include <libintl.h> 129 #define N_(x,y) dgettext(HEIMDAL_TEXTDOMAIN, x) 130 #else 131 #define N_(x,y) (x) 132 #define bindtextdomain(package, localedir) 133 #endif 134 135 136 #ifdef HAVE_CRYPT_H 137 #undef des_encrypt 138 #define des_encrypt wingless_pigs_mostly_fail_to_fly 139 #include <crypt.h> 140 #undef des_encrypt 141 #endif 142 143 #ifdef HAVE_DOOR_CREATE 144 #include <door.h> 145 #endif 146 147 #include <roken.h> 148 #include <parse_time.h> 149 #include <base64.h> 150 151 #include <wind.h> 152 153 #define HC_DEPRECATED_CRYPTO 154 #include "crypto-headers.h" 155 156 157 #include <krb5_asn1.h> 158 159 struct send_to_kdc; 160 161 /* XXX glue for pkinit */ 162 struct hx509_certs_data; 163 struct krb5_pk_identity; 164 struct krb5_pk_cert; 165 struct ContentInfo; 166 struct AlgorithmIdentifier; 167 typedef struct krb5_pk_init_ctx_data *krb5_pk_init_ctx; 168 struct krb5_dh_moduli; 169 170 /* v4 glue */ 171 struct _krb5_krb_auth_data; 172 173 #include <der.h> 174 175 #include <krb5.h> 176 #include <krb5_err.h> 177 #include <asn1_err.h> 178 #ifdef PKINIT 179 #include <hx509.h> 180 #endif 181 182 #include "crypto.h" 183 184 #include <krb5-private.h> 185 186 #include "heim_threads.h" 187 188 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X))) 189 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0) 190 191 #ifndef __func__ 192 #define __func__ "unknown-function" 193 #endif 194 195 #define krb5_einval(context, argnum) _krb5_einval((context), __func__, (argnum)) 196 197 #ifndef PATH_SEP 198 #define PATH_SEP ":" 199 #endif 200 201 /* should this be public? */ 202 #define KEYTAB_DEFAULT "FILE:" SYSCONFDIR "/krb5.keytab" 203 #define KEYTAB_DEFAULT_MODIFY "FILE:" SYSCONFDIR "/krb5.keytab" 204 205 206 #define MODULI_FILE SYSCONFDIR "/krb5.moduli" 207 208 #ifndef O_BINARY 209 #define O_BINARY 0 210 #endif 211 212 #ifndef O_CLOEXEC 213 #define O_CLOEXEC 0 214 #endif 215 216 #ifndef SOCK_CLOEXEC 217 #define SOCK_CLOEXEC 0 218 #endif 219 220 221 #define KRB5_BUFSIZ 2048 222 223 typedef enum { 224 KRB5_INIT_CREDS_TRISTATE_UNSET = 0, 225 KRB5_INIT_CREDS_TRISTATE_TRUE, 226 KRB5_INIT_CREDS_TRISTATE_FALSE 227 } krb5_get_init_creds_tristate; 228 229 struct _krb5_get_init_creds_opt_private { 230 int refcount; 231 /* ENC_TIMESTAMP */ 232 const char *password; 233 krb5_s2k_proc key_proc; 234 /* PA_PAC_REQUEST */ 235 krb5_get_init_creds_tristate req_pac; 236 /* PKINIT */ 237 krb5_pk_init_ctx pk_init_ctx; 238 krb5_get_init_creds_tristate addressless; 239 int flags; 240 #define KRB5_INIT_CREDS_CANONICALIZE 1 241 #define KRB5_INIT_CREDS_NO_C_CANON_CHECK 2 242 #define KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK 4 243 #define KRB5_INIT_CREDS_PKINIT_KX_VALID 32 244 struct { 245 krb5_gic_process_last_req func; 246 void *ctx; 247 } lr; 248 }; 249 250 typedef uint32_t krb5_enctype_set; 251 252 typedef struct krb5_context_data { 253 krb5_enctype *etypes; 254 krb5_enctype *etypes_des;/* deprecated */ 255 krb5_enctype *as_etypes; 256 krb5_enctype *tgs_etypes; 257 krb5_enctype *permitted_enctypes; 258 char **default_realms; 259 time_t max_skew; 260 time_t kdc_timeout; 261 unsigned max_retries; 262 int32_t kdc_sec_offset; 263 int32_t kdc_usec_offset; 264 krb5_config_section *cf; 265 struct et_list *et_list; 266 struct krb5_log_facility *warn_dest; 267 struct krb5_log_facility *debug_dest; 268 const krb5_cc_ops **cc_ops; 269 int num_cc_ops; 270 const char *http_proxy; 271 const char *time_fmt; 272 krb5_boolean log_utc; 273 const char *default_keytab; 274 const char *default_keytab_modify; 275 krb5_boolean use_admin_kdc; 276 krb5_addresses *extra_addresses; 277 krb5_boolean scan_interfaces; /* `ifconfig -a' */ 278 krb5_boolean srv_lookup; /* do SRV lookups */ 279 krb5_boolean srv_try_txt; /* try TXT records also */ 280 int32_t fcache_vno; /* create cache files w/ this 281 version */ 282 int num_kt_types; /* # of registered keytab types */ 283 struct krb5_keytab_data *kt_types; /* registered keytab types */ 284 const char *date_fmt; 285 char *error_string; 286 krb5_error_code error_code; 287 krb5_addresses *ignore_addresses; 288 char *default_cc_name; 289 char *default_cc_name_env; 290 int default_cc_name_set; 291 void *mutex; /* protects error_string/error_buf */ 292 int large_msg_size; 293 int flags; 294 #define KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME 1 295 #define KRB5_CTX_F_CHECK_PAC 2 296 #define KRB5_CTX_F_HOMEDIR_ACCESS 4 297 #define KRB5_CTX_F_SOCKETS_INITIALIZED 8 298 #define KRB5_CTX_F_RD_REQ_IGNORE 16 299 struct send_to_kdc *send_to_kdc; 300 #ifdef PKINIT 301 hx509_context hx509ctx; 302 #endif 303 } krb5_context_data; 304 305 #ifndef KRB5_USE_PATH_TOKENS 306 #define KRB5_DEFAULT_CCNAME_FILE "FILE:/tmp/krb5cc_%{uid}" 307 #else 308 #define KRB5_DEFAULT_CCNAME_FILE "FILE:%{TEMP}/krb5cc_%{uid}" 309 #endif 310 #define KRB5_DEFAULT_CCNAME_API "API:" 311 #define KRB5_DEFAULT_CCNAME_KCM_KCM "KCM:%{uid}" 312 #define KRB5_DEFAULT_CCNAME_KCM_API "API:%{uid}" 313 314 #define EXTRACT_TICKET_ALLOW_CNAME_MISMATCH 1 315 #define EXTRACT_TICKET_ALLOW_SERVER_MISMATCH 2 316 #define EXTRACT_TICKET_MATCH_REALM 4 317 #define EXTRACT_TICKET_AS_REQ 8 318 #define EXTRACT_TICKET_TIMESYNC 16 319 320 /* 321 * Configurable options 322 */ 323 324 #ifndef KRB5_DEFAULT_CCTYPE 325 #ifdef __APPLE__ 326 #define KRB5_DEFAULT_CCTYPE (&krb5_acc_ops) 327 #else 328 #define KRB5_DEFAULT_CCTYPE (&krb5_fcc_ops) 329 #endif 330 #endif 331 332 #ifndef KRB5_ADDRESSLESS_DEFAULT 333 #define KRB5_ADDRESSLESS_DEFAULT TRUE 334 #endif 335 336 #ifndef KRB5_FORWARDABLE_DEFAULT 337 #define KRB5_FORWARDABLE_DEFAULT TRUE 338 #endif 339 340 #ifdef PKINIT 341 342 struct krb5_pk_identity { 343 hx509_verify_ctx verify_ctx; 344 hx509_certs certs; 345 hx509_cert cert; 346 hx509_certs anchors; 347 hx509_certs certpool; 348 hx509_revoke_ctx revokectx; 349 int flags; 350 #define PKINIT_BTMM 1 351 }; 352 353 enum krb5_pk_type { 354 PKINIT_WIN2K = 1, 355 PKINIT_27 = 2 356 }; 357 358 #endif /* PKINIT */ 359 360 #endif /* __KRB5_LOCL_H__ */ 361