third_party/heimdal/lib/krb5/krb5_locl.h

   1 /*
   2  * Copyright (c) 1997-2016 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 /* $Id$ */
  37
  38 #ifndef __KRB5_LOCL_H__
  39 #define __KRB5_LOCL_H__
  40
  41 #include <config.h>
  42 #include <roken.h>
  43
  44 #include <ctype.h>
  45
  46 #ifdef HAVE_POLL_H
  47 #include <sys/poll.h>
  48 #endif
  49
  50 #include <krb5-types.h>
  51
  52 #ifdef HAVE_SYS_TYPES_H
  53 #include <sys/types.h>
  54 #endif
  55 #ifdef HAVE_SYS_MMAN_H
  56 #include <sys/mman.h>
  57 #endif
  58
  59 #if defined(HAVE_SYS_IOCTL_H) && SunOS != 40
  60 #include <sys/ioctl.h>
  61 #endif
  62 #ifdef HAVE_PWD_H
  63 #undef _POSIX_PTHREAD_SEMANTICS
  64 /* This gets us the 5-arg getpwnam_r on Solaris 9.  */
  65 #define _POSIX_PTHREAD_SEMANTICS
  66 #include <pwd.h>
  67 #endif
  68
  69 #ifdef HAVE_SYS_SELECT_H
  70 #include <sys/select.h>
  71 #endif
  72 #ifdef _AIX
  73 struct mbuf;
  74 #endif
  75 #ifdef HAVE_SYS_FILIO_H
  76 #include <sys/filio.h>
  77 #endif
  78 #ifdef HAVE_SYS_FILE_H
  79 #include <sys/file.h>
  80 #endif
  81
  82 #include <com_err.h>
  83
  84 #include <heimbase.h>
  85 #include "heimbase-atomics.h"
  86
  87 #define HEIMDAL_TEXTDOMAIN "heimdal_krb5"
  88
  89 #ifdef LIBINTL
  90 #include <libintl.h>
  91 #undef N_
  92 #define N_(x,y) dgettext(HEIMDAL_TEXTDOMAIN, x)
  93 #else
  94 #undef N_
  95 #define N_(x,y) (x)
  96 #define bindtextdomain(package, localedir)
  97 #endif
  98
  99
 100 #ifdef HAVE_CRYPT_H
 101 #undef des_encrypt
 102 #define des_encrypt wingless_pigs_mostly_fail_to_fly
 103 #include <crypt.h>
 104 #undef des_encrypt
 105 #endif
 106
 107 #ifdef HAVE_DOOR_CREATE
 108 #include <door.h>
 109 #endif
 110
 111 #include <parse_time.h>
 112 #include <base64.h>
 113
 114 #include <wind.h>
 115
 116 /*
 117  * We use OpenSSL for EC, but to do this we need to disable cross-references
 118  * between OpenSSL and hcrypto bn.h and such.  Source files that use OpenSSL EC
 119  * must define HEIM_NO_CRYPTO_HDRS before including this file.
 120  */
 121 #define HC_DEPRECATED_CRYPTO
 122 #ifndef HEIM_NO_CRYPTO_HDRS
 123 #include "crypto-headers.h"
 124 #endif
 125
 126
 127 #include <krb5_asn1.h>
 128 typedef Krb5Int32 krb5int32;
 129 typedef Krb5UInt32 krb5uint32;
 130 #include <pkinit_asn1.h>
 131
 132 struct send_to_kdc;
 133
 134 /* XXX glue for pkinit */
 135 struct hx509_certs_data;
 136 struct krb5_pk_identity;
 137 struct krb5_pk_cert;
 138 struct ContentInfo;
 139 struct AlgorithmIdentifier;
 140 typedef struct krb5_pk_init_ctx_data *krb5_pk_init_ctx;
 141 struct krb5_dh_moduli;
 142 struct krb5_fast_state;
 143 struct krb5_gss_init_ctx_data;
 144
 145 /* v4 glue */
 146 struct _krb5_krb_auth_data;
 147
 148 struct krb5_gss_init_ctx_data;
 149 typedef struct krb5_gss_init_ctx_data *krb5_gss_init_ctx;
 150
 151 struct gss_ctx_id_t_desc_struct;
 152 struct gss_cred_id_t_desc_struct;
 153 struct gss_OID_desc_struct;
 154
 155 #include <der.h>
 156
 157 #include <krb5.h>
 158 #include <krb5_err.h>
 159 #include <k5e1_err.h>
 160 #include <asn1_err.h>
 161 #ifdef PKINIT
 162 #include <hx509.h>
 163 #endif
 164
 165 #include "crypto.h"
 166
 167 typedef krb5_error_code (KRB5_LIB_CALL *krb5_gssic_step)(
 168     krb5_context,
 169     krb5_gss_init_ctx,
 170     const krb5_creds *,
 171     struct gss_ctx_id_t_desc_struct **,
 172     KDCOptions options,
 173     krb5_data *,
 174     krb5_data *,
 175     krb5_data *);
 176
 177 typedef krb5_error_code (KRB5_LIB_CALL *krb5_gssic_finish)(
 178     krb5_context,
 179     krb5_gss_init_ctx,
 180     const krb5_creds *,
 181     struct gss_ctx_id_t_desc_struct *,
 182     krb5int32,
 183     krb5_enctype,
 184     krb5_principal *,
 185     krb5_keyblock **);
 186
 187 typedef void (KRB5_LIB_CALL *krb5_gssic_release_cred)(
 188     krb5_context,
 189     krb5_gss_init_ctx,
 190     struct gss_cred_id_t_desc_struct *);
 191
 192 typedef void (KRB5_LIB_CALL *krb5_gssic_delete_sec_context)(
 193     krb5_context,
 194     krb5_gss_init_ctx,
 195     struct gss_ctx_id_t_desc_struct *);
 196
 197 #define KRB5_GSS_IC_FLAG_RELEASE_CRED 1
 198
 199 #include <krb5-private.h>
 200
 201 #include "heim_threads.h"
 202
 203 extern const char _krb5_wellknown_lkdc[];
 204
 205 #define ALLOC(X, N) (X) = calloc((N), sizeof(*(X)))
 206 #define ALLOC_SEQ(X, N) do { (X)->len = (N); ALLOC((X)->val, (N)); } while(0)
 207
 208 #define krb5_einval(context, argnum) _krb5_einval((context), __func__, (argnum))
 209
 210 #ifndef PATH_SEP
 211 #define PATH_SEP ":"
 212 #endif
 213
 214 /* should this be public? */
 215 #define KEYTAB_DEFAULT "FILE:" SYSCONFDIR "/krb5.keytab"
 216 #define KEYTAB_DEFAULT_MODIFY "FILE:" SYSCONFDIR "/krb5.keytab"
 217
 218 #ifndef CLIENT_KEYTAB_DEFAULT
 219 #define CLIENT_KEYTAB_DEFAULT   "FILE:" LOCALSTATEDIR "/user/%{euid}/client.keytab";
 220 #endif
 221
 222 #define MODULI_FILE SYSCONFDIR "/krb5.moduli"
 223
 224 #ifndef O_BINARY
 225 #define O_BINARY 0
 226 #endif
 227
 228 #ifndef O_CLOEXEC
 229 #define O_CLOEXEC 0
 230 #endif
 231
 232 #ifndef SOCK_CLOEXEC
 233 #define SOCK_CLOEXEC 0
 234 #endif
 235
 236
 237 #define KRB5_BUFSIZ 2048
 238
 239 typedef enum {
 240     KRB5_INIT_CREDS_TRISTATE_UNSET = 0,
 241     KRB5_INIT_CREDS_TRISTATE_TRUE,
 242     KRB5_INIT_CREDS_TRISTATE_FALSE
 243 } krb5_get_init_creds_tristate;
 244
 245 struct _krb5_get_init_creds_opt_private {
 246     int refcount;
 247     /* ENC_TIMESTAMP */
 248     const char *password;
 249     krb5_s2k_proc key_proc;
 250     /* PA_PAC_REQUEST */
 251     krb5_get_init_creds_tristate req_pac;
 252     /* PKINIT */
 253     krb5_pk_init_ctx pk_init_ctx;
 254     krb5_get_init_creds_tristate addressless;
 255     int flags;
 256 #define KRB5_INIT_CREDS_DONE                                1
 257 #define KRB5_INIT_CREDS_CANONICALIZE                        2
 258 #define KRB5_INIT_CREDS_NO_C_CANON_CHECK                    4
 259 #define KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK                   8
 260 #define KRB5_INIT_CREDS_PKINIT_KX_VALID                     32
 261 #define KRB5_INIT_CREDS_PKINIT_NO_KRBTGT_OTHERNAME_CHECK    64
 262     struct {
 263         krb5_gic_process_last_req func;
 264         void *ctx;
 265     } lr;
 266
 267     krb5_flags fast_flags;
 268     char *fast_armor_ccache_name;
 269 };
 270
 271 typedef uint32_t krb5_enctype_set;
 272
 273 /*
 274  * Do not remove or reorder the fields of this structure.
 275  * Fields that are no longer used should be marked "deprecated".
 276  * New fields should always be appended to the end of the
 277  * structure.
 278  *
 279  * Although this structure is internal it is shared with
 280  * plugins and such changes will result in data corruption
 281  * if plugins are not built with a matching version.
 282  */
 283 typedef struct krb5_context_data {
 284     heim_context hcontext;
 285     krb5_enctype *etypes;
 286     krb5_enctype *cfg_etypes;
 287     krb5_enctype *etypes_des;/* deprecated */
 288     krb5_enctype *as_etypes;
 289     krb5_enctype *tgs_etypes;
 290     krb5_enctype *permitted_enctypes;
 291     char **default_realms;
 292     time_t max_skew;
 293     time_t kdc_timeout;
 294     time_t host_timeout;
 295     unsigned max_retries;
 296     int32_t kdc_sec_offset;
 297     int32_t kdc_usec_offset;
 298     krb5_config_section *cf;
 299     const krb5_cc_ops **cc_ops;
 300     int num_cc_ops;
 301     const char *http_proxy;
 302     const char *time_fmt;
 303     krb5_boolean log_utc;
 304     const char *default_keytab;
 305     const char *default_keytab_modify;
 306     krb5_boolean use_admin_kdc;
 307     krb5_addresses *extra_addresses;
 308     krb5_boolean scan_interfaces;       /* `ifconfig -a' */
 309     krb5_boolean srv_lookup;            /* do SRV lookups */
 310     krb5_boolean srv_try_txt;           /* try TXT records also */
 311     int32_t fcache_vno;                 /* create cache files w/ this
 312                                            version */
 313     int num_kt_types;                   /* # of registered keytab types */
 314     struct krb5_keytab_data *kt_types;  /* registered keytab types */
 315     const char *date_fmt;
 316     krb5_error_code error_code;
 317     krb5_addresses *ignore_addresses;
 318     char *default_cc_name;
 319     char *default_cc_name_env;
 320     char *configured_default_cc_name;
 321     int default_cc_name_set;
 322     int large_msg_size;
 323     int max_msg_size;
 324     int tgs_negative_timeout;           /* timeout for TGS negative cache */
 325     int flags;
 326 #define KRB5_CTX_F_DNS_CANONICALIZE_HOSTNAME    1
 327 #define KRB5_CTX_F_CHECK_PAC                    2
 328 #define KRB5_CTX_F_HOMEDIR_ACCESS               4
 329 #define KRB5_CTX_F_SOCKETS_INITIALIZED          8
 330 #define KRB5_CTX_F_RD_REQ_IGNORE                16
 331 #define KRB5_CTX_F_FCACHE_STRICT_CHECKING       32
 332 #define KRB5_CTX_F_ENFORCE_OK_AS_DELEGATE       64
 333 #define KRB5_CTX_F_REPORT_CANONICAL_CLIENT_NAME 128
 334     struct send_to_kdc *send_to_kdc;
 335 #ifdef PKINIT
 336     hx509_context hx509ctx;
 337 #endif
 338     unsigned int num_kdc_requests;
 339     krb5_name_canon_rule name_canon_rules;
 340     size_t config_include_depth;
 341     krb5_boolean no_ticket_store;       /* Don't store service tickets */
 342 } krb5_context_data;
 343
 344 #define KRB5_DEFAULT_CCNAME_FILE "FILE:%{TEMP}/krb5cc_%{uid}"
 345 #define KRB5_DEFAULT_CCNAME_DIR "DIR:%{TEMP}/krb5cc_%{uid}_dir/"
 346 #define KRB5_DEFAULT_CCNAME_API "API:"
 347 #define KRB5_DEFAULT_CCNAME_KCM_KCM "KCM:%{uid}"
 348 #define KRB5_DEFAULT_CCNAME_KCM_API "API:%{uid}"
 349
 350 #define EXTRACT_TICKET_ALLOW_CNAME_MISMATCH             1
 351 #define EXTRACT_TICKET_ALLOW_SERVER_MISMATCH            2
 352 #define EXTRACT_TICKET_MATCH_REALM                      4
 353 #define EXTRACT_TICKET_AS_REQ                           8
 354 #define EXTRACT_TICKET_TIMESYNC                         16
 355 #define EXTRACT_TICKET_MATCH_ANON                       32
 356
 357 /*
 358  * Configurable options
 359  */
 360
 361 #ifndef KRB5_DEFAULT_CCTYPE
 362 #ifdef __APPLE__
 363 #define KRB5_DEFAULT_CCTYPE (&krb5_acc_ops)
 364 #else
 365 #define KRB5_DEFAULT_CCTYPE (&krb5_fcc_ops)
 366 #endif
 367 #endif
 368
 369 #ifndef KRB5_ADDRESSLESS_DEFAULT
 370 #define KRB5_ADDRESSLESS_DEFAULT TRUE
 371 #endif
 372
 373 #ifndef KRB5_FORWARDABLE_DEFAULT
 374 #define KRB5_FORWARDABLE_DEFAULT TRUE
 375 #endif
 376
 377 #ifndef KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME
 378 #define KRB5_CONFIGURATION_CHANGE_NOTIFY_NAME "org.h5l.Kerberos.configuration-changed"
 379 #endif
 380
 381 #ifndef KRB5_FALLBACK_DEFAULT
 382 #define KRB5_FALLBACK_DEFAULT TRUE
 383 #endif
 384
 385 #ifndef KRB5_TKT_LIFETIME_DEFAULT
 386 # define KRB5_TKT_LIFETIME_DEFAULT        15778800  /* seconds */
 387 #endif
 388
 389 #ifndef KRB5_TKT_RENEW_LIFETIME_DEFAULT
 390 # define KRB5_TKT_RENEW_LIFETIME_DEFAULT  15778800  /* seconds */
 391 #endif
 392
 393 #ifdef PKINIT
 394
 395 struct krb5_pk_identity {
 396     hx509_verify_ctx verify_ctx;
 397     hx509_certs certs;
 398     hx509_cert cert;
 399     hx509_certs anchors;
 400     hx509_certs certpool;
 401     hx509_revoke_ctx revokectx;
 402     int flags;
 403 #define PKINIT_BTMM 1
 404 #define PKINIT_NO_KDC_ANCHOR 2
 405 };
 406
 407 enum krb5_pk_type {
 408     PKINIT_WIN2K = 1,
 409     PKINIT_27 = 2
 410 };
 411
 412 enum keyex_enum { USE_RSA, USE_DH, USE_ECDH };
 413
 414 struct krb5_pk_init_ctx_data {
 415     struct krb5_pk_identity *id;
 416     enum keyex_enum keyex;
 417     union {
 418         DH *dh;
 419         void *eckey;
 420     } u;
 421     krb5_data *clientDHNonce;
 422     struct krb5_dh_moduli **m;
 423     hx509_peer_info peer;
 424     enum krb5_pk_type type;
 425     unsigned int require_binding:1;
 426     unsigned int require_eku:1;
 427     unsigned int require_krbtgt_otherName:1;
 428     unsigned int require_hostname_match:1;
 429     unsigned int trustedCertifiers:1;
 430     unsigned int anonymous:1;
 431     unsigned int kdc_verified:1;
 432 };
 433
 434 #endif /* PKINIT */
 435
 436 struct krb5_fast_state {
 437     enum PA_FX_FAST_REQUEST_enum type;
 438     unsigned int flags;
 439 #define KRB5_FAST_PUBLIC_FLAGS                          0x0000ff
 440 /* #define KRB5_FAST_REQUIRED                           0x000001 - fast required by action of caller defined in krb5.h*/
 441
 442 #define KRB5_FAST_REPLY_KEY_USE_TO_ENCRYPT_THE_REPLY    0x000100
 443 #define KRB5_FAST_REPLY_KEY_USE_IN_TRANSACTION          0x000200
 444 #define KRB5_FAST_KDC_REPLY_KEY_REPLACED                0x000400
 445 #define KRB5_FAST_REPLY_REPLY_VERIFIED                  0x000800
 446 #define KRB5_FAST_STRONG                                0x001000
 447 #define KRB5_FAST_EXPECTED                              0x002000 /* in exchange with KDC, fast was discovered */
 448 #define KRB5_FAST_DISABLED                              0x008000
 449
 450 #define KRB5_FAST_AP_ARMOR_SERVICE                      0x010000
 451 #define KRB5_FAST_OPTIMISTIC                            0x020000 /* Optimistic try, like Anon + PKINIT or service fast bit */
 452 #define KRB5_FAST_REQUIRE_ENC_PA                        0x040000
 453
 454 #define KRB5_FAST_AS_REQ                                0x100000
 455 #define KRB5_FAST_ANON_PKINIT_ARMOR                     0x200000
 456 #define KRB5_FAST_KDC_VERIFIED                          0x400000
 457
 458     krb5_keyblock *reply_key;
 459     krb5_ccache armor_ccache;
 460     krb5_auth_context armor_ac;
 461     KrbFastArmor *armor_data;
 462     krb5_principal armor_service;
 463     krb5_crypto armor_crypto;
 464     krb5_keyblock armor_key;
 465     krb5_keyblock *strengthen_key;
 466
 467     /* KRB5_FAST_ANON_PKINIT_ARMOR */
 468     krb5_get_init_creds_opt *anon_pkinit_opt;
 469     krb5_init_creds_context anon_pkinit_ctx;
 470 };
 471
 472 struct krb5_decrypt_tkt_with_subkey_state {
 473     krb5_keyblock *subkey;
 474     struct krb5_fast_state *fast_state;
 475 };
 476
 477 #define ISTILDE(x) (x == '~')
 478 #ifdef _WIN32
 479 # define ISPATHSEP(x) (x == '/' || x =='\\')
 480 #else
 481 # define ISPATHSEP(x) (x == '/')
 482 #endif
 483
 484 /* Flag in KRB5_AUTHDATA_AP_OPTIONS */
 485 #define KERB_AP_OPTIONS_CBT 0x00004000
 486
 487 /* Flag in PAC_ATTRIBUTES_INFO */
 488 #define KRB5_PAC_WAS_REQUESTED          0x1
 489 #define KRB5_PAC_WAS_GIVEN_IMPLICITLY   0x2
 490
 491 #endif /* __KRB5_LOCL_H__ */