1 /* 2 * Copyright (c) 2005, PADL Software Pty Ltd. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * 3. Neither the name of PADL Software nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * $Id: kcm_locl.h 20470 2007-04-20 10:41:11Z lha $ 35 */ 36 37 #ifndef __KCM_LOCL_H__ 38 #define __KCM_LOCL_H__ 39 40 #include "headers.h" 41 42 #include <kcm.h> 43 44 #define KCM_LOG_REQUEST(_context, _client, _opcode) do { \ 45 kcm_log(1, "%s request by process %d/uid %d", \ 46 kcm_op2string(_opcode), (_client)->pid, (_client)->uid); \ 47 } while (0) 48 49 #define KCM_LOG_REQUEST_NAME(_context, _client, _opcode, _name) do { \ 50 kcm_log(1, "%s request for cache %s by process %d/uid %d", \ 51 kcm_op2string(_opcode), (_name), (_client)->pid, (_client)->uid); \ 52 } while (0) 53 54 /* Cache management */ 55 56 #define KCM_FLAGS_VALID 0x0001 57 #define KCM_FLAGS_USE_KEYTAB 0x0002 58 #define KCM_FLAGS_RENEWABLE 0x0004 59 #define KCM_FLAGS_OWNER_IS_SYSTEM 0x0008 60 #define KCM_FLAGS_USE_CACHED_KEY 0x0010 61 62 #define KCM_MASK_KEY_PRESENT ( KCM_FLAGS_USE_KEYTAB | \ 63 KCM_FLAGS_USE_CACHED_KEY ) 64 65 struct kcm_ccache_data; 66 struct kcm_creds; 67 68 typedef struct kcm_cursor { 69 pid_t pid; 70 uint32_t key; 71 struct kcm_creds *credp; /* pointer to next credential */ 72 struct kcm_cursor *next; 73 } kcm_cursor; 74 75 typedef struct kcm_ccache_data { 76 char *name; 77 unsigned refcnt; 78 uint16_t flags; 79 uint16_t mode; 80 uid_t uid; 81 gid_t gid; 82 krb5_principal client; /* primary client principal */ 83 krb5_principal server; /* primary server principal (TGS if NULL) */ 84 struct kcm_creds { 85 krb5_creds cred; /* XXX would be useful for have ACLs on creds */ 86 struct kcm_creds *next; 87 } *creds; 88 uint32_t n_cursor; 89 kcm_cursor *cursors; 90 krb5_deltat tkt_life; 91 krb5_deltat renew_life; 92 union { 93 krb5_keytab keytab; 94 krb5_keyblock keyblock; 95 } key; 96 HEIMDAL_MUTEX mutex; 97 struct kcm_ccache_data *next; 98 } kcm_ccache_data; 99 100 #define KCM_ASSERT_VALID(_ccache) do { \ 101 if (((_ccache)->flags & KCM_FLAGS_VALID) == 0) \ 102 krb5_abortx(context, "kcm_free_ccache_data: ccache invalid"); \ 103 else if ((_ccache)->refcnt == 0) \ 104 krb5_abortx(context, "kcm_free_ccache_data: ccache refcnt == 0"); \ 105 } while (0) 106 107 typedef kcm_ccache_data *kcm_ccache; 108 109 /* Event management */ 110 111 typedef struct kcm_event { 112 int valid; 113 time_t fire_time; 114 unsigned fire_count; 115 time_t expire_time; 116 time_t backoff_time; 117 enum { 118 KCM_EVENT_NONE = 0, 119 KCM_EVENT_ACQUIRE_CREDS, 120 KCM_EVENT_RENEW_CREDS, 121 KCM_EVENT_DESTROY_CREDS, 122 KCM_EVENT_DESTROY_EMPTY_CACHE 123 } action; 124 kcm_ccache ccache; 125 struct kcm_event *next; 126 } kcm_event; 127 128 /* wakeup interval for event queue */ 129 #define KCM_EVENT_QUEUE_INTERVAL 60 130 #define KCM_EVENT_DEFAULT_BACKOFF_TIME 5 131 #define KCM_EVENT_MAX_BACKOFF_TIME (12 * 60 * 60) 132 133 134 /* Request format is LENGTH | MAJOR | MINOR | OPERATION | request */ 135 /* Response format is LENGTH | STATUS | response */ 136 137 typedef struct kcm_client { 138 pid_t pid; 139 uid_t uid; 140 gid_t gid; 141 } kcm_client; 142 143 #define CLIENT_IS_ROOT(client) ((client)->uid == 0) 144 145 /* Dispatch table */ 146 /* passed in OPERATION | ... ; returns STATUS | ... */ 147 typedef krb5_error_code (*kcm_method)(krb5_context, kcm_client *, kcm_operation, krb5_storage *, krb5_storage *); 148 149 struct kcm_op { 150 const char *name; 151 kcm_method method; 152 }; 153 154 #define DEFAULT_LOG_DEST "0/FILE:" LOCALSTATEDIR "/log/kcmd.log" 155 #define _PATH_KCM_CONF SYSCONFDIR "/kcm.conf" 156 157 extern krb5_context kcm_context; 158 extern char *socket_path; 159 extern char *door_path; 160 extern size_t max_request; 161 extern sig_atomic_t exit_flag; 162 extern int name_constraints; 163 extern int detach_from_console; 164 extern int disallow_getting_krbtgt; 165 166 #if 0 167 extern const krb5_cc_ops krb5_kcmss_ops; 168 #endif 169 170 #include <kcm_protos.h> 171 172 #endif /* __KCM_LOCL_H__ */ 173 174