kssl.h revision 296465 
1/* ssl/kssl.h -*- mode: C; c-file-style: "eay" -*- */
2/*
3 * Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project
4 * 2000. project 2000.
5 */
6/* ====================================================================
7 * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 *
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in
18 *    the documentation and/or other materials provided with the
19 *    distribution.
20 *
21 * 3. All advertising materials mentioning features or use of this
22 *    software must display the following acknowledgment:
23 *    "This product includes software developed by the OpenSSL Project
24 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
25 *
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 *    endorse or promote products derived from this software without
28 *    prior written permission. For written permission, please contact
29 *    licensing@OpenSSL.org.
30 *
31 * 5. Products derived from this software may not be called "OpenSSL"
32 *    nor may "OpenSSL" appear in their names without prior written
33 *    permission of the OpenSSL Project.
34 *
35 * 6. Redistributions of any form whatsoever must retain the following
36 *    acknowledgment:
37 *    "This product includes software developed by the OpenSSL Project
38 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
53 *
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com).  This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
57 *
58 */
59
60/*
61 **      19990701        VRS     Started.
62 */
63
64#ifndef KSSL_H
65# define KSSL_H
66
67# include <openssl/opensslconf.h>
68
69# ifndef OPENSSL_NO_KRB5
70
71#  include <stdio.h>
72#  include <ctype.h>
73#  include <krb5.h>
74
75#ifdef  __cplusplus
76extern "C" {
77#endif
78
79/*
80 *      Depending on which KRB5 implementation used, some types from
81 *      the other may be missing.  Resolve that here and now
82 */
83#  ifdef KRB5_HEIMDAL
84typedef unsigned char krb5_octet;
85#   define FAR
86#  else
87
88#   ifndef FAR
89#    define FAR
90#   endif
91
92#  endif
93
94/*-
95 *      Uncomment this to debug kssl problems or
96 *      to trace usage of the Kerberos session key
97 *
98 *      #define         KSSL_DEBUG
99 */
100
101#  ifndef KRB5SVC
102#   define KRB5SVC "host"
103#  endif
104
105#  ifndef KRB5KEYTAB
106#   define KRB5KEYTAB      "/etc/krb5.keytab"
107#  endif
108
109#  ifndef KRB5SENDAUTH
110#   define KRB5SENDAUTH    1
111#  endif
112
113#  ifndef KRB5CHECKAUTH
114#   define KRB5CHECKAUTH   1
115#  endif
116
117#  ifndef KSSL_CLOCKSKEW
118#   define KSSL_CLOCKSKEW  300;
119#  endif
120
121#  define KSSL_ERR_MAX    255
122typedef struct kssl_err_st {
123    int reason;
124    char text[KSSL_ERR_MAX + 1];
125} KSSL_ERR;
126
127/*-     Context for passing
128 *              (1) Kerberos session key to SSL, and
129 *              (2)     Config data between application and SSL lib
130 */
131typedef struct kssl_ctx_st {
132    /*      used by:    disposition:            */
133    char *service_name;         /* C,S default ok (kssl) */
134    char *service_host;         /* C input, REQUIRED */
135    char *client_princ;         /* S output from krb5 ticket */
136    char *keytab_file;          /* S NULL (/etc/krb5.keytab) */
137    char *cred_cache;           /* C NULL (default) */
138    krb5_enctype enctype;
139    int length;
140    krb5_octet FAR *key;
141} KSSL_CTX;
142
143#  define KSSL_CLIENT     1
144#  define KSSL_SERVER     2
145#  define KSSL_SERVICE    3
146#  define KSSL_KEYTAB     4
147
148#  define KSSL_CTX_OK     0
149#  define KSSL_CTX_ERR    1
150#  define KSSL_NOMEM      2
151
152/* Public (for use by applications that use OpenSSL with Kerberos 5 support */
153krb5_error_code kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text);
154KSSL_CTX *kssl_ctx_new(void);
155KSSL_CTX *kssl_ctx_free(KSSL_CTX *kssl_ctx);
156void kssl_ctx_show(KSSL_CTX *kssl_ctx);
157krb5_error_code kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
158                                  krb5_data *realm, krb5_data *entity,
159                                  int nentities);
160krb5_error_code kssl_cget_tkt(KSSL_CTX *kssl_ctx, krb5_data **enc_tktp,
161                              krb5_data *authenp, KSSL_ERR *kssl_err);
162krb5_error_code kssl_sget_tkt(KSSL_CTX *kssl_ctx, krb5_data *indata,
163                              krb5_ticket_times *ttimes, KSSL_ERR *kssl_err);
164krb5_error_code kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session);
165void kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text);
166void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data);
167krb5_error_code kssl_build_principal_2(krb5_context context,
168                                       krb5_principal *princ, int rlen,
169                                       const char *realm, int slen,
170                                       const char *svc, int hlen,
171                                       const char *host);
172krb5_error_code kssl_validate_times(krb5_timestamp atime,
173                                    krb5_ticket_times *ttimes);
174krb5_error_code kssl_check_authent(KSSL_CTX *kssl_ctx, krb5_data *authentp,
175                                   krb5_timestamp *atimep,
176                                   KSSL_ERR *kssl_err);
177unsigned char *kssl_skip_confound(krb5_enctype enctype, unsigned char *authn);
178
179#ifdef  __cplusplus
180}
181#endif
182# endif                         /* OPENSSL_NO_KRB5 */
183#endif                          /* KSSL_H */
184