1/*
2 * Copyright (c) 2005, PADL Software Pty Ltd.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * 3. Neither the name of PADL Software nor the names of its contributors
17 *    may be used to endorse or promote products derived from this software
18 *    without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33/*
34 * $Id: kcm_locl.h 20470 2007-04-20 10:41:11Z lha $
35 */
36
37#ifndef __KCM_LOCL_H__
38#define __KCM_LOCL_H__
39
40#include "headers.h"
41
42#include <kcm.h>
43
44#define KCM_LOG_REQUEST(_context, _client, _opcode)	do { \
45    kcm_log(1, "%s request by process %d/uid %d", \
46	    kcm_op2string(_opcode), (_client)->pid, (_client)->uid); \
47    } while (0)
48
49#define KCM_LOG_REQUEST_NAME(_context, _client, _opcode, _name)	do { \
50    kcm_log(1, "%s request for cache %s by process %d/uid %d", \
51	    kcm_op2string(_opcode), (_name), (_client)->pid, (_client)->uid); \
52    } while (0)
53
54/* Cache management */
55
56#define KCM_FLAGS_VALID			0x0001
57#define KCM_FLAGS_USE_KEYTAB		0x0002
58#define KCM_FLAGS_RENEWABLE		0x0004
59#define KCM_FLAGS_OWNER_IS_SYSTEM	0x0008
60#define KCM_FLAGS_USE_CACHED_KEY	0x0010
61
62#define KCM_MASK_KEY_PRESENT		( KCM_FLAGS_USE_KEYTAB | \
63					  KCM_FLAGS_USE_CACHED_KEY )
64
65struct kcm_ccache_data;
66struct kcm_creds;
67
68typedef struct kcm_cursor {
69    pid_t pid;
70    uint32_t key;
71    struct kcm_creds *credp;		/* pointer to next credential */
72    struct kcm_cursor *next;
73} kcm_cursor;
74
75typedef struct kcm_ccache_data {
76    char *name;
77    unsigned refcnt;
78    uint16_t flags;
79    uint16_t mode;
80    uid_t uid;
81    gid_t gid;
82    krb5_principal client; /* primary client principal */
83    krb5_principal server; /* primary server principal (TGS if NULL) */
84    struct kcm_creds {
85	krb5_creds cred; /* XXX would be useful for have ACLs on creds */
86	struct kcm_creds *next;
87    } *creds;
88    uint32_t n_cursor;
89    kcm_cursor *cursors;
90    krb5_deltat tkt_life;
91    krb5_deltat renew_life;
92    union {
93	krb5_keytab keytab;
94	krb5_keyblock keyblock;
95    } key;
96    HEIMDAL_MUTEX mutex;
97    struct kcm_ccache_data *next;
98} kcm_ccache_data;
99
100#define KCM_ASSERT_VALID(_ccache)		do { \
101    if (((_ccache)->flags & KCM_FLAGS_VALID) == 0) \
102	krb5_abortx(context, "kcm_free_ccache_data: ccache invalid"); \
103    else if ((_ccache)->refcnt == 0) \
104	krb5_abortx(context, "kcm_free_ccache_data: ccache refcnt == 0"); \
105    } while (0)
106
107typedef kcm_ccache_data *kcm_ccache;
108
109/* Event management */
110
111typedef struct kcm_event {
112    int valid;
113    time_t fire_time;
114    unsigned fire_count;
115    time_t expire_time;
116    time_t backoff_time;
117    enum {
118	KCM_EVENT_NONE = 0,
119	KCM_EVENT_ACQUIRE_CREDS,
120	KCM_EVENT_RENEW_CREDS,
121	KCM_EVENT_DESTROY_CREDS,
122	KCM_EVENT_DESTROY_EMPTY_CACHE
123    } action;
124    kcm_ccache ccache;
125    struct kcm_event *next;
126} kcm_event;
127
128/* wakeup interval for event queue */
129#define KCM_EVENT_QUEUE_INTERVAL		60
130#define KCM_EVENT_DEFAULT_BACKOFF_TIME		5
131#define KCM_EVENT_MAX_BACKOFF_TIME		(12 * 60 * 60)
132
133
134/* Request format is  LENGTH | MAJOR | MINOR | OPERATION | request */
135/* Response format is LENGTH | STATUS | response */
136
137typedef struct kcm_client {
138    pid_t pid;
139    uid_t uid;
140    gid_t gid;
141} kcm_client;
142
143#define CLIENT_IS_ROOT(client) ((client)->uid == 0)
144
145/* Dispatch table */
146/* passed in OPERATION | ... ; returns STATUS | ... */
147typedef krb5_error_code (*kcm_method)(krb5_context, kcm_client *, kcm_operation, krb5_storage *, krb5_storage *);
148
149struct kcm_op {
150    const char *name;
151    kcm_method method;
152};
153
154#define DEFAULT_LOG_DEST    "0/FILE:" LOCALSTATEDIR "/log/kcmd.log"
155#define _PATH_KCM_CONF	    SYSCONFDIR "/kcm.conf"
156
157extern krb5_context kcm_context;
158extern char *socket_path;
159extern char *door_path;
160extern size_t max_request;
161extern sig_atomic_t exit_flag;
162extern int name_constraints;
163extern int detach_from_console;
164extern int disallow_getting_krbtgt;
165
166#if 0
167extern const krb5_cc_ops krb5_kcmss_ops;
168#endif
169
170#include <kcm_protos.h>
171
172#endif /* __KCM_LOCL_H__ */
173
174