1/* 2 * Copyright (c) 2005, PADL Software Pty Ltd. 3 * All rights reserved. 4 * 5 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * 3. Neither the name of PADL Software nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 */ 34 35/* 36 * $Id$ 37 */ 38 39#ifndef __KCM_LOCL_H__ 40#define __KCM_LOCL_H__ 41 42#include "headers.h" 43 44#include <kcm.h> 45 46#define KCM_LOG_REQUEST(_context, _client, _opcode) do { \ 47 kcm_log(1, "%s request by process %d/uid %d", \ 48 kcm_op2string(_opcode), (_client)->pid, (_client)->uid); \ 49 } while (0) 50 51#define KCM_LOG_REQUEST_NAME(_context, _client, _opcode, _name) do { \ 52 kcm_log(1, "%s request for cache %s by process %d/uid %d", \ 53 kcm_op2string(_opcode), (_name), (_client)->pid, (_client)->uid); \ 54 } while (0) 55 56/* Cache management */ 57 58#define KCM_FLAGS_USE_KEYTAB 0x0001 59#define KCM_FLAGS_USE_PASSWORD 0x0002 60 61#define KCM_FLAGS_RENEWABLE 0x0010 62#define KCM_FLAGS_OWNER_IS_SYSTEM 0x0020 63 64#define KCM_MASK_KEY_PRESENT (KCM_FLAGS_USE_KEYTAB|KCM_FLAGS_USE_PASSWORD) 65 66 67struct kcm_creds; 68 69struct kcm_default_cache { 70 uid_t uid; 71 pid_t session; /* really au_asid_t */ 72 char *name; 73 struct kcm_default_cache *next; 74}; 75 76extern struct kcm_default_cache *default_caches; 77 78struct kcm_creds { 79 kcmuuid_t uuid; 80 krb5_creds cred; 81 struct kcm_creds *next; 82}; 83 84struct kcm_ccache_data { 85 char *name; 86 kcmuuid_t uuid; 87 long holdcount; 88 unsigned refcnt; 89 uint16_t flags; 90 uid_t uid; 91 pid_t session; /* really au_asid_t */ 92 krb5_principal client; /* primary client principal */ 93 krb5_principal server; /* primary server principal (TGS if NULL) */ 94 struct kcm_creds *creds; 95 krb5_deltat tkt_life; 96 krb5_deltat renew_life; 97 int32_t kdc_offset; 98 heim_event_t renew_event; 99 time_t renew_time; 100 heim_event_t expire_event; 101 krb5_deltat expire; 102 time_t next_refresh_time; 103 /* key */ 104 krb5_keytab keytab; 105 char *password; 106 107 HEIMDAL_MUTEX mutex; 108 TAILQ_ENTRY(kcm_ccache_data) members; 109}; 110 111#define KCM_ASSERT_VALID(_ccache) do { \ 112 if ((_ccache)->refcnt == 0) \ 113 krb5_abortx(context, "kcm_free_ccache_data: ccache refcnt == 0"); \ 114 } while (0) 115 116typedef struct kcm_ccache_data *kcm_ccache; 117 118/* Request format is LENGTH | MAJOR | MINOR | OPERATION | request */ 119/* Response format is LENGTH | STATUS | response */ 120 121typedef struct kcm_client { 122 pid_t pid; 123 uid_t uid; 124 pid_t session; 125 char execpath[MAXPATHLEN]; 126} kcm_client; 127 128#define CLIENT_IS_ROOT(client) ((client)->uid == 0) 129 130/* Dispatch table */ 131/* passed in OPERATION | ... ; returns STATUS | ... */ 132typedef krb5_error_code (*kcm_method)(krb5_context, kcm_client *, kcm_operation, krb5_storage *, krb5_storage *); 133 134struct kcm_op { 135 const char *name; 136 kcm_method method; 137}; 138 139#define DEFAULT_LOG_DEST "0/SYSLOG:DEBUG:DAEMON" 140#define _PATH_KCM_CONF SYSCONFDIR "/kcm.conf" 141 142extern krb5_context kcm_context; 143extern char *socket_path; 144extern char *door_path; 145extern size_t max_request; 146extern sig_atomic_t exit_flag; 147extern int max_num_requests; 148extern int kcm_timeout; 149#ifdef SUPPORT_DETACH 150extern int detach_from_console; 151#endif 152extern int launchd_flag; 153extern int disallow_getting_krbtgt; 154extern int kcm_data_changed; 155extern int use_uid_matching; 156 157#if 0 158extern const krb5_cc_ops krb5_kcmss_ops; 159#endif 160 161#include <kcm-protos.h> 162 163#endif /* __KCM_LOCL_H__ */ 164 165