1 /* $NetBSD: init_creds.c,v 1.1.1.2 2014/04/24 12:45:50 pettai Exp $ */
2
3 /*
4 * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 *
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 *
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 *
21 * 3. Neither the name of the Institute nor the names of its contributors
22 * may be used to endorse or promote products derived from this software
23 * without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 */
37
38 #include "krb5_locl.h"
39
40 #undef __attribute__
41 #define __attribute__(x)
42
43 /**
44 * @page krb5_init_creds_intro The initial credential handing functions
45 * @section section_krb5_init_creds Initial credential
46 *
47 * Functions to get initial credentials: @ref krb5_credential .
48 */
49
50 /**
51 * Allocate a new krb5_get_init_creds_opt structure, free with
52 * krb5_get_init_creds_opt_free().
53 *
54 * @ingroup krb5_credential
55 */
56
57 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_alloc(krb5_context context,krb5_get_init_creds_opt ** opt)58 krb5_get_init_creds_opt_alloc(krb5_context context,
59 krb5_get_init_creds_opt **opt)
60 {
61 krb5_get_init_creds_opt *o;
62
63 *opt = NULL;
64 o = calloc(1, sizeof(*o));
65 if (o == NULL) {
66 krb5_set_error_message(context, ENOMEM,
67 N_("malloc: out of memory", ""));
68 return ENOMEM;
69 }
70
71 o->opt_private = calloc(1, sizeof(*o->opt_private));
72 if (o->opt_private == NULL) {
73 krb5_set_error_message(context, ENOMEM,
74 N_("malloc: out of memory", ""));
75 free(o);
76 return ENOMEM;
77 }
78 o->opt_private->refcount = 1;
79 *opt = o;
80 return 0;
81 }
82
83 /**
84 * Free krb5_get_init_creds_opt structure.
85 *
86 * @ingroup krb5_credential
87 */
88
89 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_free(krb5_context context,krb5_get_init_creds_opt * opt)90 krb5_get_init_creds_opt_free(krb5_context context,
91 krb5_get_init_creds_opt *opt)
92 {
93 if (opt == NULL || opt->opt_private == NULL)
94 return;
95 if (opt->opt_private->refcount < 1) /* abort ? */
96 return;
97 if (--opt->opt_private->refcount == 0) {
98 _krb5_get_init_creds_opt_free_pkinit(opt);
99 free(opt->opt_private);
100 }
101 memset(opt, 0, sizeof(*opt));
102 free(opt);
103 }
104
105 static int
get_config_time(krb5_context context,const char * realm,const char * name,int def)106 get_config_time (krb5_context context,
107 const char *realm,
108 const char *name,
109 int def)
110 {
111 int ret;
112
113 ret = krb5_config_get_time (context, NULL,
114 "realms",
115 realm,
116 name,
117 NULL);
118 if (ret >= 0)
119 return ret;
120 ret = krb5_config_get_time (context, NULL,
121 "libdefaults",
122 name,
123 NULL);
124 if (ret >= 0)
125 return ret;
126 return def;
127 }
128
129 static krb5_boolean
get_config_bool(krb5_context context,krb5_boolean def_value,const char * realm,const char * name)130 get_config_bool (krb5_context context,
131 krb5_boolean def_value,
132 const char *realm,
133 const char *name)
134 {
135 krb5_boolean b;
136
137 b = krb5_config_get_bool_default(context, NULL, def_value,
138 "realms", realm, name, NULL);
139 if (b != def_value)
140 return b;
141 b = krb5_config_get_bool_default (context, NULL, def_value,
142 "libdefaults", name, NULL);
143 if (b != def_value)
144 return b;
145 return def_value;
146 }
147
148 /*
149 * set all the values in `opt' to the appropriate values for
150 * application `appname' (default to getprogname() if NULL), and realm
151 * `realm'. First looks in [appdefaults] but falls back to
152 * [realms] or [libdefaults] for some of the values.
153 */
154
155 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_default_flags(krb5_context context,const char * appname,krb5_const_realm realm,krb5_get_init_creds_opt * opt)156 krb5_get_init_creds_opt_set_default_flags(krb5_context context,
157 const char *appname,
158 krb5_const_realm realm,
159 krb5_get_init_creds_opt *opt)
160 {
161 krb5_boolean b;
162 time_t t;
163
164 b = get_config_bool (context, KRB5_FORWARDABLE_DEFAULT,
165 realm, "forwardable");
166 krb5_appdefault_boolean(context, appname, realm, "forwardable", b, &b);
167 krb5_get_init_creds_opt_set_forwardable(opt, b);
168
169 b = get_config_bool (context, FALSE, realm, "proxiable");
170 krb5_appdefault_boolean(context, appname, realm, "proxiable", b, &b);
171 krb5_get_init_creds_opt_set_proxiable (opt, b);
172
173 krb5_appdefault_time(context, appname, realm, "ticket_lifetime", 0, &t);
174 if (t == 0)
175 t = get_config_time (context, realm, "ticket_lifetime", 0);
176 if(t != 0)
177 krb5_get_init_creds_opt_set_tkt_life(opt, t);
178
179 krb5_appdefault_time(context, appname, realm, "renew_lifetime", 0, &t);
180 if (t == 0)
181 t = get_config_time (context, realm, "renew_lifetime", 0);
182 if(t != 0)
183 krb5_get_init_creds_opt_set_renew_life(opt, t);
184
185 krb5_appdefault_boolean(context, appname, realm, "no-addresses",
186 KRB5_ADDRESSLESS_DEFAULT, &b);
187 krb5_get_init_creds_opt_set_addressless (context, opt, b);
188
189 #if 0
190 krb5_appdefault_boolean(context, appname, realm, "anonymous", FALSE, &b);
191 krb5_get_init_creds_opt_set_anonymous (opt, b);
192
193 krb5_get_init_creds_opt_set_etype_list(opt, enctype,
194 etype_str.num_strings);
195
196 krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
197 krb5_data *salt);
198
199 krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
200 krb5_preauthtype *preauth_list,
201 int preauth_list_length);
202 #endif
203 }
204
205
206 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_tkt_life(krb5_get_init_creds_opt * opt,krb5_deltat tkt_life)207 krb5_get_init_creds_opt_set_tkt_life(krb5_get_init_creds_opt *opt,
208 krb5_deltat tkt_life)
209 {
210 opt->flags |= KRB5_GET_INIT_CREDS_OPT_TKT_LIFE;
211 opt->tkt_life = tkt_life;
212 }
213
214 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_renew_life(krb5_get_init_creds_opt * opt,krb5_deltat renew_life)215 krb5_get_init_creds_opt_set_renew_life(krb5_get_init_creds_opt *opt,
216 krb5_deltat renew_life)
217 {
218 opt->flags |= KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE;
219 opt->renew_life = renew_life;
220 }
221
222 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_forwardable(krb5_get_init_creds_opt * opt,int forwardable)223 krb5_get_init_creds_opt_set_forwardable(krb5_get_init_creds_opt *opt,
224 int forwardable)
225 {
226 opt->flags |= KRB5_GET_INIT_CREDS_OPT_FORWARDABLE;
227 opt->forwardable = forwardable;
228 }
229
230 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_proxiable(krb5_get_init_creds_opt * opt,int proxiable)231 krb5_get_init_creds_opt_set_proxiable(krb5_get_init_creds_opt *opt,
232 int proxiable)
233 {
234 opt->flags |= KRB5_GET_INIT_CREDS_OPT_PROXIABLE;
235 opt->proxiable = proxiable;
236 }
237
238 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_etype_list(krb5_get_init_creds_opt * opt,krb5_enctype * etype_list,int etype_list_length)239 krb5_get_init_creds_opt_set_etype_list(krb5_get_init_creds_opt *opt,
240 krb5_enctype *etype_list,
241 int etype_list_length)
242 {
243 opt->flags |= KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST;
244 opt->etype_list = etype_list;
245 opt->etype_list_length = etype_list_length;
246 }
247
248 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_address_list(krb5_get_init_creds_opt * opt,krb5_addresses * addresses)249 krb5_get_init_creds_opt_set_address_list(krb5_get_init_creds_opt *opt,
250 krb5_addresses *addresses)
251 {
252 opt->flags |= KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST;
253 opt->address_list = addresses;
254 }
255
256 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt * opt,krb5_preauthtype * preauth_list,int preauth_list_length)257 krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
258 krb5_preauthtype *preauth_list,
259 int preauth_list_length)
260 {
261 opt->flags |= KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST;
262 opt->preauth_list_length = preauth_list_length;
263 opt->preauth_list = preauth_list;
264 }
265
266 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt * opt,krb5_data * salt)267 krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
268 krb5_data *salt)
269 {
270 opt->flags |= KRB5_GET_INIT_CREDS_OPT_SALT;
271 opt->salt = salt;
272 }
273
274 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_set_anonymous(krb5_get_init_creds_opt * opt,int anonymous)275 krb5_get_init_creds_opt_set_anonymous(krb5_get_init_creds_opt *opt,
276 int anonymous)
277 {
278 opt->flags |= KRB5_GET_INIT_CREDS_OPT_ANONYMOUS;
279 opt->anonymous = anonymous;
280 }
281
282 static krb5_error_code
require_ext_opt(krb5_context context,krb5_get_init_creds_opt * opt,const char * type)283 require_ext_opt(krb5_context context,
284 krb5_get_init_creds_opt *opt,
285 const char *type)
286 {
287 if (opt->opt_private == NULL) {
288 krb5_set_error_message(context, EINVAL,
289 N_("%s on non extendable opt", ""), type);
290 return EINVAL;
291 }
292 return 0;
293 }
294
295 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_set_pa_password(krb5_context context,krb5_get_init_creds_opt * opt,const char * password,krb5_s2k_proc key_proc)296 krb5_get_init_creds_opt_set_pa_password(krb5_context context,
297 krb5_get_init_creds_opt *opt,
298 const char *password,
299 krb5_s2k_proc key_proc)
300 {
301 krb5_error_code ret;
302 ret = require_ext_opt(context, opt, "init_creds_opt_set_pa_password");
303 if (ret)
304 return ret;
305 opt->opt_private->password = password;
306 opt->opt_private->key_proc = key_proc;
307 return 0;
308 }
309
310 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_set_pac_request(krb5_context context,krb5_get_init_creds_opt * opt,krb5_boolean req_pac)311 krb5_get_init_creds_opt_set_pac_request(krb5_context context,
312 krb5_get_init_creds_opt *opt,
313 krb5_boolean req_pac)
314 {
315 krb5_error_code ret;
316 ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
317 if (ret)
318 return ret;
319 opt->opt_private->req_pac = req_pac ?
320 KRB5_INIT_CREDS_TRISTATE_TRUE :
321 KRB5_INIT_CREDS_TRISTATE_FALSE;
322 return 0;
323 }
324
325 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_set_addressless(krb5_context context,krb5_get_init_creds_opt * opt,krb5_boolean addressless)326 krb5_get_init_creds_opt_set_addressless(krb5_context context,
327 krb5_get_init_creds_opt *opt,
328 krb5_boolean addressless)
329 {
330 krb5_error_code ret;
331 ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
332 if (ret)
333 return ret;
334 if (addressless)
335 opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_TRUE;
336 else
337 opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_FALSE;
338 return 0;
339 }
340
341 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_set_canonicalize(krb5_context context,krb5_get_init_creds_opt * opt,krb5_boolean req)342 krb5_get_init_creds_opt_set_canonicalize(krb5_context context,
343 krb5_get_init_creds_opt *opt,
344 krb5_boolean req)
345 {
346 krb5_error_code ret;
347 ret = require_ext_opt(context, opt, "init_creds_opt_set_canonicalize");
348 if (ret)
349 return ret;
350 if (req)
351 opt->opt_private->flags |= KRB5_INIT_CREDS_CANONICALIZE;
352 else
353 opt->opt_private->flags &= ~KRB5_INIT_CREDS_CANONICALIZE;
354 return 0;
355 }
356
357 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_set_win2k(krb5_context context,krb5_get_init_creds_opt * opt,krb5_boolean req)358 krb5_get_init_creds_opt_set_win2k(krb5_context context,
359 krb5_get_init_creds_opt *opt,
360 krb5_boolean req)
361 {
362 krb5_error_code ret;
363 ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
364 if (ret)
365 return ret;
366 if (req) {
367 opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_CANON_CHECK;
368 opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
369 } else {
370 opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_CANON_CHECK;
371 opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
372 }
373 return 0;
374 }
375
376
377 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_set_process_last_req(krb5_context context,krb5_get_init_creds_opt * opt,krb5_gic_process_last_req func,void * ctx)378 krb5_get_init_creds_opt_set_process_last_req(krb5_context context,
379 krb5_get_init_creds_opt *opt,
380 krb5_gic_process_last_req func,
381 void *ctx)
382 {
383 krb5_error_code ret;
384 ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
385 if (ret)
386 return ret;
387
388 opt->opt_private->lr.func = func;
389 opt->opt_private->lr.ctx = ctx;
390
391 return 0;
392 }
393
394
395 #ifndef HEIMDAL_SMALLER
396
397 /**
398 * Deprecated: use krb5_get_init_creds_opt_alloc().
399 *
400 * The reason krb5_get_init_creds_opt_init() is deprecated is that
401 * krb5_get_init_creds_opt is a static structure and for ABI reason it
402 * can't grow, ie can't add new functionality.
403 *
404 * @ingroup krb5_deprecated
405 */
406
407 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
krb5_get_init_creds_opt_init(krb5_get_init_creds_opt * opt)408 krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt)
409 KRB5_DEPRECATED_FUNCTION("Use X instead")
410 {
411 memset (opt, 0, sizeof(*opt));
412 }
413
414 /**
415 * Deprecated: use the new krb5_init_creds_init() and
416 * krb5_init_creds_get_error().
417 *
418 * @ingroup krb5_deprecated
419 */
420
421 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_get_init_creds_opt_get_error(krb5_context context,krb5_get_init_creds_opt * opt,KRB_ERROR ** error)422 krb5_get_init_creds_opt_get_error(krb5_context context,
423 krb5_get_init_creds_opt *opt,
424 KRB_ERROR **error)
425 KRB5_DEPRECATED_FUNCTION("Use X instead")
426 {
427 *error = calloc(1, sizeof(**error));
428 if (*error == NULL) {
429 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
430 return ENOMEM;
431 }
432
433 return 0;
434 }
435
436 #endif /* HEIMDAL_SMALLER */
437