crypto/dist/heimdal/lib/krb5/init_creds.c

   1 /*
   2  * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 __RCSID("$Heimdal: init_creds.c 21711 2007-07-27 14:22:02Z lha $"
  37         "$NetBSD$");
  38
  39 void KRB5_LIB_FUNCTION
  40 krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt)
  41 {
  42     memset (opt, 0, sizeof(*opt));
  43     opt->flags = 0;
  44     opt->opt_private = NULL;
  45 }
  46
  47 krb5_error_code KRB5_LIB_FUNCTION
  48 krb5_get_init_creds_opt_alloc(krb5_context context,
  49                               krb5_get_init_creds_opt **opt)
  50 {
  51     krb5_get_init_creds_opt *o;
  52
  53     *opt = NULL;
  54     o = calloc(1, sizeof(*o));
  55     if (o == NULL) {
  56         krb5_set_error_string(context, "out of memory");
  57         return ENOMEM;
  58     }
  59     krb5_get_init_creds_opt_init(o);
  60     o->opt_private = calloc(1, sizeof(*o->opt_private));
  61     if (o->opt_private == NULL) {
  62         krb5_set_error_string(context, "out of memory");
  63         free(o);
  64         return ENOMEM;
  65     }
  66     o->opt_private->refcount = 1;
  67     *opt = o;
  68     return 0;
  69 }
  70
  71 krb5_error_code
  72 _krb5_get_init_creds_opt_copy(krb5_context context,
  73                               const krb5_get_init_creds_opt *in,
  74                               krb5_get_init_creds_opt **out)
  75 {
  76     krb5_get_init_creds_opt *opt;
  77
  78     *out = NULL;
  79     opt = calloc(1, sizeof(*opt));
  80     if (opt == NULL) {
  81         krb5_set_error_string(context, "out of memory");
  82         return ENOMEM;
  83     }
  84     if (in)
  85         *opt = *in;
  86     if(opt->opt_private == NULL) {
  87         opt->opt_private = calloc(1, sizeof(*opt->opt_private));
  88         if (opt->opt_private == NULL) {
  89             krb5_set_error_string(context, "out of memory");
  90             free(opt);
  91             return ENOMEM;
  92         }
  93         opt->opt_private->refcount = 1;
  94     } else
  95         opt->opt_private->refcount++;
  96     *out = opt;
  97     return 0;
  98 }
  99
 100 void KRB5_LIB_FUNCTION
 101 _krb5_get_init_creds_opt_free_krb5_error(krb5_get_init_creds_opt *opt)
 102 {
 103     if (opt->opt_private == NULL || opt->opt_private->error == NULL)
 104         return;
 105     free_KRB_ERROR(opt->opt_private->error);
 106     free(opt->opt_private->error);
 107     opt->opt_private->error = NULL;
 108 }
 109
 110 void KRB5_LIB_FUNCTION
 111 _krb5_get_init_creds_opt_set_krb5_error(krb5_context context,
 112                                         krb5_get_init_creds_opt *opt,
 113                                         const KRB_ERROR *error)
 114 {
 115     krb5_error_code ret;
 116
 117     if (opt->opt_private == NULL)
 118         return;
 119
 120     _krb5_get_init_creds_opt_free_krb5_error(opt);
 121
 122     opt->opt_private->error = malloc(sizeof(*opt->opt_private->error));
 123     if (opt->opt_private->error == NULL)
 124         return;
 125     ret = copy_KRB_ERROR(error, opt->opt_private->error);
 126     if (ret) {
 127         free(opt->opt_private->error);
 128         opt->opt_private->error = NULL;
 129     }
 130 }
 131
 132
 133 void KRB5_LIB_FUNCTION
 134 krb5_get_init_creds_opt_free(krb5_context context,
 135                              krb5_get_init_creds_opt *opt)
 136 {
 137     if (opt == NULL || opt->opt_private == NULL)
 138         return;
 139     if (opt->opt_private->refcount < 1) /* abort ? */
 140         return;
 141     if (--opt->opt_private->refcount == 0) {
 142         _krb5_get_init_creds_opt_free_krb5_error(opt);
 143         _krb5_get_init_creds_opt_free_pkinit(opt);
 144         free(opt->opt_private);
 145     }
 146     memset(opt, 0, sizeof(*opt));
 147     free(opt);
 148 }
 149
 150 static int
 151 get_config_time (krb5_context context,
 152                  const char *realm,
 153                  const char *name,
 154                  int def)
 155 {
 156     int ret;
 157
 158     ret = krb5_config_get_time (context, NULL,
 159                                 "realms",
 160                                 realm,
 161                                 name,
 162                                 NULL);
 163     if (ret >= 0)
 164         return ret;
 165     ret = krb5_config_get_time (context, NULL,
 166                                 "libdefaults",
 167                                 name,
 168                                 NULL);
 169     if (ret >= 0)
 170         return ret;
 171     return def;
 172 }
 173
 174 static krb5_boolean
 175 get_config_bool (krb5_context context,
 176                  const char *realm,
 177                  const char *name)
 178 {
 179     return krb5_config_get_bool (context,
 180                                  NULL,
 181                                  "realms",
 182                                  realm,
 183                                  name,
 184                                  NULL)
 185         || krb5_config_get_bool (context,
 186                                  NULL,
 187                                  "libdefaults",
 188                                  name,
 189                                  NULL);
 190 }
 191
 192 /*
 193  * set all the values in `opt' to the appropriate values for
 194  * application `appname' (default to getprogname() if NULL), and realm
 195  * `realm'.  First looks in [appdefaults] but falls back to
 196  * [realms] or [libdefaults] for some of the values.
 197  */
 198
 199 void KRB5_LIB_FUNCTION
 200 krb5_get_init_creds_opt_set_default_flags(krb5_context context,
 201                                           const char *appname,
 202                                           krb5_const_realm realm,
 203                                           krb5_get_init_creds_opt *opt)
 204 {
 205     krb5_boolean b;
 206     time_t t;
 207
 208     b = get_config_bool (context, realm, "forwardable");
 209     krb5_appdefault_boolean(context, appname, realm, "forwardable", b, &b);
 210     krb5_get_init_creds_opt_set_forwardable(opt, b);
 211
 212     b = get_config_bool (context, realm, "proxiable");
 213     krb5_appdefault_boolean(context, appname, realm, "proxiable", b, &b);
 214     krb5_get_init_creds_opt_set_proxiable (opt, b);
 215
 216     krb5_appdefault_time(context, appname, realm, "ticket_lifetime", 0, &t);
 217     if (t == 0)
 218         t = get_config_time (context, realm, "ticket_lifetime", 0);
 219     if(t != 0)
 220         krb5_get_init_creds_opt_set_tkt_life(opt, t);
 221
 222     krb5_appdefault_time(context, appname, realm, "renew_lifetime", 0, &t);
 223     if (t == 0)
 224         t = get_config_time (context, realm, "renew_lifetime", 0);
 225     if(t != 0)
 226         krb5_get_init_creds_opt_set_renew_life(opt, t);
 227
 228     krb5_appdefault_boolean(context, appname, realm, "no-addresses",
 229                             KRB5_ADDRESSLESS_DEFAULT, &b);
 230     krb5_get_init_creds_opt_set_addressless (context, opt, b);
 231
 232 #if 0
 233     krb5_appdefault_boolean(context, appname, realm, "anonymous", FALSE, &b);
 234     krb5_get_init_creds_opt_set_anonymous (opt, b);
 235
 236     krb5_get_init_creds_opt_set_etype_list(opt, enctype,
 237                                            etype_str.num_strings);
 238
 239     krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
 240                                      krb5_data *salt);
 241
 242     krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
 243                                              krb5_preauthtype *preauth_list,
 244                                              int preauth_list_length);
 245 #endif
 246 }
 247
 248
 249 void KRB5_LIB_FUNCTION
 250 krb5_get_init_creds_opt_set_tkt_life(krb5_get_init_creds_opt *opt,
 251                                      krb5_deltat tkt_life)
 252 {
 253     opt->flags |= KRB5_GET_INIT_CREDS_OPT_TKT_LIFE;
 254     opt->tkt_life = tkt_life;
 255 }
 256
 257 void KRB5_LIB_FUNCTION
 258 krb5_get_init_creds_opt_set_renew_life(krb5_get_init_creds_opt *opt,
 259                                        krb5_deltat renew_life)
 260 {
 261     opt->flags |= KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE;
 262     opt->renew_life = renew_life;
 263 }
 264
 265 void KRB5_LIB_FUNCTION
 266 krb5_get_init_creds_opt_set_forwardable(krb5_get_init_creds_opt *opt,
 267                                         int forwardable)
 268 {
 269     opt->flags |= KRB5_GET_INIT_CREDS_OPT_FORWARDABLE;
 270     opt->forwardable = forwardable;
 271 }
 272
 273 void KRB5_LIB_FUNCTION
 274 krb5_get_init_creds_opt_set_proxiable(krb5_get_init_creds_opt *opt,
 275                                       int proxiable)
 276 {
 277     opt->flags |= KRB5_GET_INIT_CREDS_OPT_PROXIABLE;
 278     opt->proxiable = proxiable;
 279 }
 280
 281 void KRB5_LIB_FUNCTION
 282 krb5_get_init_creds_opt_set_etype_list(krb5_get_init_creds_opt *opt,
 283                                        krb5_enctype *etype_list,
 284                                        int etype_list_length)
 285 {
 286     opt->flags |= KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST;
 287     opt->etype_list = etype_list;
 288     opt->etype_list_length = etype_list_length;
 289 }
 290
 291 void KRB5_LIB_FUNCTION
 292 krb5_get_init_creds_opt_set_address_list(krb5_get_init_creds_opt *opt,
 293                                          krb5_addresses *addresses)
 294 {
 295     opt->flags |= KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST;
 296     opt->address_list = addresses;
 297 }
 298
 299 void KRB5_LIB_FUNCTION
 300 krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
 301                                          krb5_preauthtype *preauth_list,
 302                                          int preauth_list_length)
 303 {
 304     opt->flags |= KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST;
 305     opt->preauth_list_length = preauth_list_length;
 306     opt->preauth_list = preauth_list;
 307 }
 308
 309 void KRB5_LIB_FUNCTION
 310 krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
 311                                  krb5_data *salt)
 312 {
 313     opt->flags |= KRB5_GET_INIT_CREDS_OPT_SALT;
 314     opt->salt = salt;
 315 }
 316
 317 void KRB5_LIB_FUNCTION
 318 krb5_get_init_creds_opt_set_anonymous(krb5_get_init_creds_opt *opt,
 319                                       int anonymous)
 320 {
 321     opt->flags |= KRB5_GET_INIT_CREDS_OPT_ANONYMOUS;
 322     opt->anonymous = anonymous;
 323 }
 324
 325 static krb5_error_code
 326 require_ext_opt(krb5_context context,
 327                 krb5_get_init_creds_opt *opt,
 328                 const char *type)
 329 {
 330     if (opt->opt_private == NULL) {
 331         krb5_set_error_string(context, "%s on non extendable opt", type);
 332         return EINVAL;
 333     }
 334     return 0;
 335 }
 336
 337 krb5_error_code KRB5_LIB_FUNCTION
 338 krb5_get_init_creds_opt_set_pa_password(krb5_context context,
 339                                         krb5_get_init_creds_opt *opt,
 340                                         const char *password,
 341                                         krb5_s2k_proc key_proc)
 342 {
 343     krb5_error_code ret;
 344     ret = require_ext_opt(context, opt, "init_creds_opt_set_pa_password");
 345     if (ret)
 346         return ret;
 347     opt->opt_private->password = password;
 348     opt->opt_private->key_proc = key_proc;
 349     return 0;
 350 }
 351
 352 krb5_error_code KRB5_LIB_FUNCTION
 353 krb5_get_init_creds_opt_set_pac_request(krb5_context context,
 354                                         krb5_get_init_creds_opt *opt,
 355                                         krb5_boolean req_pac)
 356 {
 357     krb5_error_code ret;
 358     ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
 359     if (ret)
 360         return ret;
 361     opt->opt_private->req_pac = req_pac ?
 362         KRB5_INIT_CREDS_TRISTATE_TRUE :
 363         KRB5_INIT_CREDS_TRISTATE_FALSE;
 364     return 0;
 365 }
 366
 367 krb5_error_code KRB5_LIB_FUNCTION
 368 krb5_get_init_creds_opt_get_error(krb5_context context,
 369                                   krb5_get_init_creds_opt *opt,
 370                                   KRB_ERROR **error)
 371 {
 372     krb5_error_code ret;
 373
 374     *error = NULL;
 375
 376     ret = require_ext_opt(context, opt, "init_creds_opt_get_error");
 377     if (ret)
 378         return ret;
 379
 380     if (opt->opt_private->error == NULL)
 381         return 0;
 382
 383     *error = malloc(sizeof(**error));
 384     if (*error == NULL) {
 385         krb5_set_error_string(context, "malloc - out memory");
 386         return ENOMEM;
 387     }
 388
 389     ret = copy_KRB_ERROR(opt->opt_private->error, *error);
 390     if (ret)
 391         krb5_clear_error_string(context);
 392
 393     return 0;
 394 }
 395
 396 krb5_error_code KRB5_LIB_FUNCTION
 397 krb5_get_init_creds_opt_set_addressless(krb5_context context,
 398                                         krb5_get_init_creds_opt *opt,
 399                                         krb5_boolean addressless)
 400 {
 401     krb5_error_code ret;
 402     ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
 403     if (ret)
 404         return ret;
 405     if (addressless)
 406         opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_TRUE;
 407     else
 408         opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_FALSE;
 409     return 0;
 410 }
 411
 412 krb5_error_code KRB5_LIB_FUNCTION
 413 krb5_get_init_creds_opt_set_canonicalize(krb5_context context,
 414                                          krb5_get_init_creds_opt *opt,
 415                                          krb5_boolean req)
 416 {
 417     krb5_error_code ret;
 418     ret = require_ext_opt(context, opt, "init_creds_opt_set_canonicalize");
 419     if (ret)
 420         return ret;
 421     if (req)
 422         opt->opt_private->flags |= KRB5_INIT_CREDS_CANONICALIZE;
 423     else
 424         opt->opt_private->flags &= ~KRB5_INIT_CREDS_CANONICALIZE;
 425     return 0;
 426 }
 427
 428 krb5_error_code KRB5_LIB_FUNCTION
 429 krb5_get_init_creds_opt_set_win2k(krb5_context context,
 430                                   krb5_get_init_creds_opt *opt,
 431                                   krb5_boolean req)
 432 {
 433     krb5_error_code ret;
 434     ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
 435     if (ret)
 436         return ret;
 437     if (req)
 438         opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_CANON_CHECK;
 439     else
 440         opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_CANON_CHECK;
 441     return 0;
 442 }
 443