1 /* $NetBSD: krb5_locl.h,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * 3. Neither the name of the Institute nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 /* Id */ 39 40 #ifndef __KRB5_LOCL_H__ 41 #define __KRB5_LOCL_H__ 42 43 #include <config.h> 44 45 #include <errno.h> 46 #include <ctype.h> 47 #include <string.h> 48 #include <stdio.h> 49 #include <stdlib.h> 50 #include <limits.h> 51 52 #ifdef HAVE_POLL_H 53 #include <sys/poll.h> 54 #endif 55 56 #include <krb5/krb5-types.h> 57 58 #ifdef HAVE_SYS_TYPES_H 59 #include <sys/types.h> 60 #endif 61 #ifdef HAVE_SYS_MMAN_H 62 #include <sys/mman.h> 63 #endif 64 #ifdef HAVE_UNISTD_H 65 #include <unistd.h> 66 #endif 67 #ifdef HAVE_FCNTL_H 68 #include <fcntl.h> 69 #endif 70 71 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40 72 #include <sys/ioctl.h> 73 #endif 74 #ifdef HAVE_PWD_H 75 #undef _POSIX_PTHREAD_SEMANTICS 76 /* This gets us the 5-arg getpwnam_r on Solaris 9. */ 77 #define _POSIX_PTHREAD_SEMANTICS 78 #include <pwd.h> 79 #endif 80 81 #ifdef HAVE_SYS_PARAM_H 82 #include <sys/param.h> 83 #endif 84 #include <time.h> 85 #ifdef HAVE_SYS_TIME_H 86 #include <sys/time.h> 87 #endif 88 #ifdef HAVE_SYS_SELECT_H 89 #include <sys/select.h> 90 #endif 91 #ifdef HAVE_SYS_SOCKET_H 92 #include <sys/socket.h> 93 #endif 94 #ifdef HAVE_NETINET_IN_H 95 #include <netinet/in.h> 96 #endif 97 #ifdef HAVE_NETINET_IN6_H 98 #include <netinet/in6.h> 99 #endif 100 #ifdef HAVE_NETINET6_IN6_H 101 #include <netinet6/in6.h> 102 #endif 103 #ifdef HAVE_NETDB_H 104 #include <netdb.h> 105 #endif 106 #ifdef _AIX 107 struct ether_addr; 108 struct mbuf; 109 struct sockaddr_dl; 110 #endif 111 #ifdef HAVE_ARPA_INET_H 112 #include <arpa/inet.h> 113 #endif 114 #ifdef HAVE_ARPA_NAMESER_H 115 #include <arpa/nameser.h> 116 #endif 117 #ifdef HAVE_SYS_UIO_H 118 #include <sys/uio.h> 119 #endif 120 #ifdef HAVE_SYS_FILIO_H 121 #include <sys/filio.h> 122 #endif 123 #ifdef HAVE_SYS_FILE_H 124 #include <sys/file.h> 125 #endif 126 127 #include <krb5/com_err.h> 128 129 #include <krb5/heimbase.h> 130 131 #define HEIMDAL_TEXTDOMAIN "heimdal_krb5" 132 133 #ifdef LIBINTL 134 #include <libintl.h> 135 #define N_(x,y) dgettext(HEIMDAL_TEXTDOMAIN, x) 136 #else 137 #define N_(x,y) (x) 138 #define bindtextdomain(package, localedir) 139 #endif 140 141 142 #ifdef HAVE_CRYPT_H 143 #undef des_encrypt 144 #define des_encrypt wingless_pigs_mostly_fail_to_fly 145 #include <crypt.h> 146 #undef des_encrypt 147 #endif 148 149 #ifdef HAVE_DOOR_CREATE 150 #include <door.h> 151 #endif 152 153 #include <krb5/roken.h> 154 #include <krb5/parse_time.h> 155 #include <krb5/base64.h> 156 157 #include <krb5/wind.h> 158 159 #define HC_DEPRECATED_CRYPTO 160 #include "crypto-headers.h" 161 162 163 #include <krb5/krb5_asn1.h> 164 165 struct send_to_kdc; 166 167 /* XXX glue for pkinit */ 168 struct hx509_certs_data; 169 struct krb5_pk_identity; 170 struct krb5_pk_cert; 171 struct ContentInfo; 172 struct AlgorithmIdentifier; 173 typedef struct krb5_pk_init_ctx_data *krb5_pk_init_ctx; 174 struct krb5_dh_moduli; 175 176 /* v4 glue */ 177 struct _krb5_krb_auth_data; 178 179 #include <krb5/der.h> 180 181 #include <krb5/krb5.h> 182 #include <krb5/krb5_err.h> 183 #include <krb5/asn1_err.h> 184 #ifdef PKINIT 185 #include <krb5/hx509.h> 186 #endif 187 188 #include "crypto.h" 189 190 #include <krb5/krb5-private.h> 191 192 #include "heim_threads.h" 193 194 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X))) 195 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0) 196 197 #ifndef __func__ 198 #define __func__ "unknown-function" 199 #endif 200 201 #define krb5_einval(context, argnum) _krb5_einval((context), __func__, (argnum)) 202 203 #ifndef PATH_SEP 204 #define PATH_SEP ":" 205 #endif 206 207 /* should this be public? */ 208 #define KEYTAB_DEFAULT "FILE:" SYSCONFDIR "/krb5.keytab" 209 #define KEYTAB_DEFAULT_MODIFY "FILE:" SYSCONFDIR "/krb5.keytab" 210 211 212 #define MODULI_FILE SYSCONFDIR "/krb5.moduli" 213 214 #ifndef O_BINARY 215 #define O_BINARY 0 216 #endif 217 218 #ifndef O_CLOEXEC 219 #define O_CLOEXEC 0 220 #endif 221 222 #ifndef SOCK_CLOEXEC 223 #define SOCK_CLOEXEC 0 224 #endif 225 226 227 #define KRB5_BUFSIZ 2048 228 229 typedef enum { 230 KRB5_INIT_CREDS_TRISTATE_UNSET = 0, 231 KRB5_INIT_CREDS_TRISTATE_TRUE, 232 KRB5_INIT_CREDS_TRISTATE_FALSE 233 } krb5_get_init_creds_tristate; 234 235 struct _krb5_get_init_creds_opt_private { 236 int refcount; 237 /* ENC_TIMESTAMP */ 238 const char *password; 239 krb5_s2k_proc key_proc; 240 /* PA_PAC_REQUEST */ 241 krb5_get_init_creds_tristate req_pac; 242 /* PKINIT */ 243 krb5_pk_init_ctx pk_init_ctx; 244 krb5_get_init_creds_tristate addressless; 245 int flags; 246 #define KRB5_INIT_CREDS_CANONICALIZE 1 247 #define KRB5_INIT_CREDS_NO_C_CANON_CHECK 2 248 #define KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK 4 249 struct { 250 krb5_gic_process_last_req func; 251 void *ctx; 252 } lr; 253 }; 254 255 typedef uint32_t krb5_enctype_set; 256 257 typedef struct krb5_context_data { 258 krb5_enctype *etypes; 259 krb5_enctype *etypes_des;/* deprecated */ 260 krb5_enctype *as_etypes; 261 krb5_enctype *tgs_etypes; 262 krb5_enctype *permitted_enctypes; 263 char **default_realms; 264 time_t max_skew; 265 time_t kdc_timeout; 266 unsigned max_retries; 267 int32_t kdc_sec_offset; 268 int32_t kdc_usec_offset; 269 krb5_config_section *cf; 270 struct et_list *et_list; 271 struct krb5_log_facility *warn_dest; 272 struct krb5_log_facility *debug_dest; 273 const krb5_cc_ops **cc_ops; 274 int num_cc_ops; 275 const char *http_proxy; 276 const char *time_fmt; 277 krb5_boolean log_utc; 278 const char *default_keytab; 279 const char *default_keytab_modify; 280 krb5_boolean use_admin_kdc; 281 krb5_addresses *extra_addresses; 282 krb5_boolean scan_interfaces; /* `ifconfig -a' */ 283 krb5_boolean srv_lookup; /* do SRV lookups */ 284 krb5_boolean srv_try_txt; /* try TXT records also */ 285 int32_t fcache_vno; /* create cache files w/ this 286 version */ 287 int num_kt_types; /* # of registered keytab types */ 288 struct krb5_keytab_data *kt_types; /* registered keytab types */ 289 const char *date_fmt; 290 char *error_string; 291 krb5_error_code error_code; 292 krb5_addresses *ignore_addresses; 293 char *default_cc_name; 294 char *default_cc_name_env; 295 int default_cc_name_set; 296 void *mutex; /* protects error_string/error_buf */ 297 int large_msg_size; 298 int flags; 299 #define KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME 1 300 #define KRB5_CTX_F_CHECK_PAC 2 301 #define KRB5_CTX_F_HOMEDIR_ACCESS 4 302 #define KRB5_CTX_F_SOCKETS_INITIALIZED 8 303 #define KRB5_CTX_F_RD_REQ_IGNORE 16 304 struct send_to_kdc *send_to_kdc; 305 #ifdef PKINIT 306 hx509_context hx509ctx; 307 #endif 308 } krb5_context_data; 309 310 #ifndef KRB5_USE_PATH_TOKENS 311 #define KRB5_DEFAULT_CCNAME_FILE "FILE:/tmp/krb5cc_%{uid}" 312 #else 313 #define KRB5_DEFAULT_CCNAME_FILE "FILE:%{TEMP}/krb5cc_%{uid}" 314 #endif 315 #define KRB5_DEFAULT_CCNAME_API "API:" 316 #define KRB5_DEFAULT_CCNAME_KCM_KCM "KCM:%{uid}" 317 #define KRB5_DEFAULT_CCNAME_KCM_API "API:%{uid}" 318 319 #define EXTRACT_TICKET_ALLOW_CNAME_MISMATCH 1 320 #define EXTRACT_TICKET_ALLOW_SERVER_MISMATCH 2 321 #define EXTRACT_TICKET_MATCH_REALM 4 322 #define EXTRACT_TICKET_AS_REQ 8 323 #define EXTRACT_TICKET_TIMESYNC 16 324 325 /* 326 * Configurable options 327 */ 328 329 #ifndef KRB5_DEFAULT_CCTYPE 330 #ifdef __APPLE__ 331 #define KRB5_DEFAULT_CCTYPE (&krb5_acc_ops) 332 #else 333 #define KRB5_DEFAULT_CCTYPE (&krb5_fcc_ops) 334 #endif 335 #endif 336 337 #ifndef KRB5_ADDRESSLESS_DEFAULT 338 #define KRB5_ADDRESSLESS_DEFAULT TRUE 339 #endif 340 341 #ifndef KRB5_FORWARDABLE_DEFAULT 342 #define KRB5_FORWARDABLE_DEFAULT TRUE 343 #endif 344 345 #ifdef PKINIT 346 347 struct krb5_pk_identity { 348 hx509_verify_ctx verify_ctx; 349 hx509_certs certs; 350 hx509_cert cert; 351 hx509_certs anchors; 352 hx509_certs certpool; 353 hx509_revoke_ctx revokectx; 354 int flags; 355 #define PKINIT_BTMM 1 356 }; 357 358 enum krb5_pk_type { 359 PKINIT_WIN2K = 1, 360 PKINIT_27 = 2 361 }; 362 363 #endif /* PKINIT */ 364 365 #endif /* __KRB5_LOCL_H__ */ 366