1 /*	$NetBSD: krb5_locl.h,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $	*/
2 
3 /*
4  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
5  * (Royal Institute of Technology, Stockholm, Sweden).
6  * All rights reserved.
7  *
8  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  *
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * 3. Neither the name of the Institute nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 /* Id */
39 
40 #ifndef __KRB5_LOCL_H__
41 #define __KRB5_LOCL_H__
42 
43 #include <config.h>
44 
45 #include <errno.h>
46 #include <ctype.h>
47 #include <string.h>
48 #include <stdio.h>
49 #include <stdlib.h>
50 #include <limits.h>
51 
52 #ifdef HAVE_POLL_H
53 #include <sys/poll.h>
54 #endif
55 
56 #include <krb5/krb5-types.h>
57 
58 #ifdef HAVE_SYS_TYPES_H
59 #include <sys/types.h>
60 #endif
61 #ifdef HAVE_SYS_MMAN_H
62 #include <sys/mman.h>
63 #endif
64 #ifdef HAVE_UNISTD_H
65 #include <unistd.h>
66 #endif
67 #ifdef HAVE_FCNTL_H
68 #include <fcntl.h>
69 #endif
70 
71 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
72 #include <sys/ioctl.h>
73 #endif
74 #ifdef HAVE_PWD_H
75 #undef _POSIX_PTHREAD_SEMANTICS
76 /* This gets us the 5-arg getpwnam_r on Solaris 9.  */
77 #define _POSIX_PTHREAD_SEMANTICS
78 #include <pwd.h>
79 #endif
80 
81 #ifdef HAVE_SYS_PARAM_H
82 #include <sys/param.h>
83 #endif
84 #include <time.h>
85 #ifdef HAVE_SYS_TIME_H
86 #include <sys/time.h>
87 #endif
88 #ifdef HAVE_SYS_SELECT_H
89 #include <sys/select.h>
90 #endif
91 #ifdef HAVE_SYS_SOCKET_H
92 #include <sys/socket.h>
93 #endif
94 #ifdef HAVE_NETINET_IN_H
95 #include <netinet/in.h>
96 #endif
97 #ifdef HAVE_NETINET_IN6_H
98 #include <netinet/in6.h>
99 #endif
100 #ifdef HAVE_NETINET6_IN6_H
101 #include <netinet6/in6.h>
102 #endif
103 #ifdef HAVE_NETDB_H
104 #include <netdb.h>
105 #endif
106 #ifdef _AIX
107 struct ether_addr;
108 struct mbuf;
109 struct sockaddr_dl;
110 #endif
111 #ifdef HAVE_ARPA_INET_H
112 #include <arpa/inet.h>
113 #endif
114 #ifdef HAVE_ARPA_NAMESER_H
115 #include <arpa/nameser.h>
116 #endif
117 #ifdef HAVE_SYS_UIO_H
118 #include <sys/uio.h>
119 #endif
120 #ifdef HAVE_SYS_FILIO_H
121 #include <sys/filio.h>
122 #endif
123 #ifdef HAVE_SYS_FILE_H
124 #include <sys/file.h>
125 #endif
126 
127 #include <krb5/com_err.h>
128 
129 #include <krb5/heimbase.h>
130 
131 #define HEIMDAL_TEXTDOMAIN "heimdal_krb5"
132 
133 #ifdef LIBINTL
134 #include <libintl.h>
135 #define N_(x,y) dgettext(HEIMDAL_TEXTDOMAIN, x)
136 #else
137 #define N_(x,y) (x)
138 #define bindtextdomain(package, localedir)
139 #endif
140 
141 
142 #ifdef HAVE_CRYPT_H
143 #undef des_encrypt
144 #define des_encrypt wingless_pigs_mostly_fail_to_fly
145 #include <crypt.h>
146 #undef des_encrypt
147 #endif
148 
149 #ifdef HAVE_DOOR_CREATE
150 #include <door.h>
151 #endif
152 
153 #include <krb5/roken.h>
154 #include <krb5/parse_time.h>
155 #include <krb5/base64.h>
156 
157 #include <krb5/wind.h>
158 
159 #define HC_DEPRECATED_CRYPTO
160 #include "crypto-headers.h"
161 
162 
163 #include <krb5/krb5_asn1.h>
164 
165 struct send_to_kdc;
166 
167 /* XXX glue for pkinit */
168 struct hx509_certs_data;
169 struct krb5_pk_identity;
170 struct krb5_pk_cert;
171 struct ContentInfo;
172 struct AlgorithmIdentifier;
173 typedef struct krb5_pk_init_ctx_data *krb5_pk_init_ctx;
174 struct krb5_dh_moduli;
175 
176 /* v4 glue */
177 struct _krb5_krb_auth_data;
178 
179 #include <krb5/der.h>
180 
181 #include <krb5/krb5.h>
182 #include <krb5/krb5_err.h>
183 #include <krb5/asn1_err.h>
184 #ifdef PKINIT
185 #include <krb5/hx509.h>
186 #endif
187 
188 #include "crypto.h"
189 
190 #include <krb5/krb5-private.h>
191 
192 #include "heim_threads.h"
193 
194 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X)))
195 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0)
196 
197 #ifndef __func__
198 #define __func__ "unknown-function"
199 #endif
200 
201 #define krb5_einval(context, argnum) _krb5_einval((context), __func__, (argnum))
202 
203 #ifndef PATH_SEP
204 #define PATH_SEP ":"
205 #endif
206 
207 /* should this be public? */
208 #define KEYTAB_DEFAULT "FILE:" SYSCONFDIR "/krb5.keytab"
209 #define KEYTAB_DEFAULT_MODIFY "FILE:" SYSCONFDIR "/krb5.keytab"
210 
211 
212 #define MODULI_FILE SYSCONFDIR "/krb5.moduli"
213 
214 #ifndef O_BINARY
215 #define O_BINARY 0
216 #endif
217 
218 #ifndef O_CLOEXEC
219 #define O_CLOEXEC 0
220 #endif
221 
222 #ifndef SOCK_CLOEXEC
223 #define SOCK_CLOEXEC 0
224 #endif
225 
226 
227 #define KRB5_BUFSIZ 2048
228 
229 typedef enum {
230     KRB5_INIT_CREDS_TRISTATE_UNSET = 0,
231     KRB5_INIT_CREDS_TRISTATE_TRUE,
232     KRB5_INIT_CREDS_TRISTATE_FALSE
233 } krb5_get_init_creds_tristate;
234 
235 struct _krb5_get_init_creds_opt_private {
236     int refcount;
237     /* ENC_TIMESTAMP */
238     const char *password;
239     krb5_s2k_proc key_proc;
240     /* PA_PAC_REQUEST */
241     krb5_get_init_creds_tristate req_pac;
242     /* PKINIT */
243     krb5_pk_init_ctx pk_init_ctx;
244     krb5_get_init_creds_tristate addressless;
245     int flags;
246 #define KRB5_INIT_CREDS_CANONICALIZE		1
247 #define KRB5_INIT_CREDS_NO_C_CANON_CHECK	2
248 #define KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK	4
249     struct {
250         krb5_gic_process_last_req func;
251         void *ctx;
252     } lr;
253 };
254 
255 typedef uint32_t krb5_enctype_set;
256 
257 typedef struct krb5_context_data {
258     krb5_enctype *etypes;
259     krb5_enctype *etypes_des;/* deprecated */
260     krb5_enctype *as_etypes;
261     krb5_enctype *tgs_etypes;
262     krb5_enctype *permitted_enctypes;
263     char **default_realms;
264     time_t max_skew;
265     time_t kdc_timeout;
266     unsigned max_retries;
267     int32_t kdc_sec_offset;
268     int32_t kdc_usec_offset;
269     krb5_config_section *cf;
270     struct et_list *et_list;
271     struct krb5_log_facility *warn_dest;
272     struct krb5_log_facility *debug_dest;
273     const krb5_cc_ops **cc_ops;
274     int num_cc_ops;
275     const char *http_proxy;
276     const char *time_fmt;
277     krb5_boolean log_utc;
278     const char *default_keytab;
279     const char *default_keytab_modify;
280     krb5_boolean use_admin_kdc;
281     krb5_addresses *extra_addresses;
282     krb5_boolean scan_interfaces;	/* `ifconfig -a' */
283     krb5_boolean srv_lookup;		/* do SRV lookups */
284     krb5_boolean srv_try_txt;		/* try TXT records also */
285     int32_t fcache_vno;			/* create cache files w/ this
286                                            version */
287     int num_kt_types;			/* # of registered keytab types */
288     struct krb5_keytab_data *kt_types;  /* registered keytab types */
289     const char *date_fmt;
290     char *error_string;
291     krb5_error_code error_code;
292     krb5_addresses *ignore_addresses;
293     char *default_cc_name;
294     char *default_cc_name_env;
295     int default_cc_name_set;
296     void *mutex;			/* protects error_string/error_buf */
297     int large_msg_size;
298     int flags;
299 #define KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME	1
300 #define KRB5_CTX_F_CHECK_PAC			2
301 #define KRB5_CTX_F_HOMEDIR_ACCESS		4
302 #define KRB5_CTX_F_SOCKETS_INITIALIZED          8
303 #define KRB5_CTX_F_RD_REQ_IGNORE		16
304     struct send_to_kdc *send_to_kdc;
305 #ifdef PKINIT
306     hx509_context hx509ctx;
307 #endif
308 } krb5_context_data;
309 
310 #ifndef KRB5_USE_PATH_TOKENS
311 #define KRB5_DEFAULT_CCNAME_FILE "FILE:/tmp/krb5cc_%{uid}"
312 #else
313 #define KRB5_DEFAULT_CCNAME_FILE "FILE:%{TEMP}/krb5cc_%{uid}"
314 #endif
315 #define KRB5_DEFAULT_CCNAME_API "API:"
316 #define KRB5_DEFAULT_CCNAME_KCM_KCM "KCM:%{uid}"
317 #define KRB5_DEFAULT_CCNAME_KCM_API "API:%{uid}"
318 
319 #define EXTRACT_TICKET_ALLOW_CNAME_MISMATCH		1
320 #define EXTRACT_TICKET_ALLOW_SERVER_MISMATCH		2
321 #define EXTRACT_TICKET_MATCH_REALM			4
322 #define EXTRACT_TICKET_AS_REQ				8
323 #define EXTRACT_TICKET_TIMESYNC				16
324 
325 /*
326  * Configurable options
327  */
328 
329 #ifndef KRB5_DEFAULT_CCTYPE
330 #ifdef __APPLE__
331 #define KRB5_DEFAULT_CCTYPE (&krb5_acc_ops)
332 #else
333 #define KRB5_DEFAULT_CCTYPE (&krb5_fcc_ops)
334 #endif
335 #endif
336 
337 #ifndef KRB5_ADDRESSLESS_DEFAULT
338 #define KRB5_ADDRESSLESS_DEFAULT TRUE
339 #endif
340 
341 #ifndef KRB5_FORWARDABLE_DEFAULT
342 #define KRB5_FORWARDABLE_DEFAULT TRUE
343 #endif
344 
345 #ifdef PKINIT
346 
347 struct krb5_pk_identity {
348     hx509_verify_ctx verify_ctx;
349     hx509_certs certs;
350     hx509_cert cert;
351     hx509_certs anchors;
352     hx509_certs certpool;
353     hx509_revoke_ctx revokectx;
354     int flags;
355 #define PKINIT_BTMM 1
356 };
357 
358 enum krb5_pk_type {
359     PKINIT_WIN2K = 1,
360     PKINIT_27 = 2
361 };
362 
363 #endif /* PKINIT */
364 
365 #endif /* __KRB5_LOCL_H__ */
366