1/*	$NetBSD: kcm_locl.h,v 1.2 2017/01/28 21:31:44 christos Exp $	*/
2
3/*
4 * Copyright (c) 2005, PADL Software Pty Ltd.
5 * All rights reserved.
6 *
7 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 *
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 *
20 * 3. Neither the name of PADL Software nor the names of its contributors
21 *    may be used to endorse or promote products derived from this software
22 *    without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37/*
38 * Id
39 */
40
41#ifndef __KCM_LOCL_H__
42#define __KCM_LOCL_H__
43
44#include "headers.h"
45
46#include <krb5/kcm.h>
47
48#define KCM_LOG_REQUEST(_context, _client, _opcode)	do { \
49    kcm_log(1, "%s request by process %d/uid %d", \
50	    kcm_op2string(_opcode), (_client)->pid, (_client)->uid); \
51    } while (0)
52
53#define KCM_LOG_REQUEST_NAME(_context, _client, _opcode, _name)	do { \
54    kcm_log(1, "%s request for cache %s by process %d/uid %d", \
55	    kcm_op2string(_opcode), (_name), (_client)->pid, (_client)->uid); \
56    } while (0)
57
58/* Cache management */
59
60#define KCM_FLAGS_VALID			0x0001
61#define KCM_FLAGS_USE_KEYTAB		0x0002
62#define KCM_FLAGS_RENEWABLE		0x0004
63#define KCM_FLAGS_OWNER_IS_SYSTEM	0x0008
64#define KCM_FLAGS_USE_CACHED_KEY	0x0010
65
66#define KCM_MASK_KEY_PRESENT		( KCM_FLAGS_USE_KEYTAB | \
67					  KCM_FLAGS_USE_CACHED_KEY )
68
69struct kcm_ccache_data;
70struct kcm_creds;
71
72struct kcm_default_cache {
73    uid_t uid;
74    pid_t session; /* really au_asid_t */
75    char *name;
76    struct kcm_default_cache *next;
77};
78
79extern struct kcm_default_cache *default_caches;
80
81struct kcm_creds {
82    kcmuuid_t uuid;
83    krb5_creds cred;
84    struct kcm_creds *next;
85};
86
87typedef struct kcm_ccache_data {
88    char *name;
89    kcmuuid_t uuid;
90    unsigned refcnt;
91    uint16_t flags;
92    uint16_t mode;
93    uid_t uid;
94    gid_t gid;
95    pid_t session; /* really au_asid_t */
96    krb5_principal client; /* primary client principal */
97    krb5_principal server; /* primary server principal (TGS if NULL) */
98    struct kcm_creds *creds;
99    krb5_deltat tkt_life;
100    krb5_deltat renew_life;
101    int32_t kdc_offset;
102    union {
103	krb5_keytab keytab;
104	krb5_keyblock keyblock;
105    } key;
106    HEIMDAL_MUTEX mutex;
107    struct kcm_ccache_data *next;
108} kcm_ccache_data;
109
110#define KCM_ASSERT_VALID(_ccache)		do { \
111    if (((_ccache)->flags & KCM_FLAGS_VALID) == 0) \
112	krb5_abortx(context, "kcm_free_ccache_data: ccache invalid"); \
113    else if ((_ccache)->refcnt == 0) \
114	krb5_abortx(context, "kcm_free_ccache_data: ccache refcnt == 0"); \
115    } while (0)
116
117typedef kcm_ccache_data *kcm_ccache;
118
119/* Event management */
120
121typedef struct kcm_event {
122    int valid;
123    time_t fire_time;
124    unsigned fire_count;
125    time_t expire_time;
126    time_t backoff_time;
127    enum {
128	KCM_EVENT_NONE = 0,
129	KCM_EVENT_ACQUIRE_CREDS,
130	KCM_EVENT_RENEW_CREDS,
131	KCM_EVENT_DESTROY_CREDS,
132	KCM_EVENT_DESTROY_EMPTY_CACHE
133    } action;
134    kcm_ccache ccache;
135    struct kcm_event *next;
136} kcm_event;
137
138/* wakeup interval for event queue */
139#define KCM_EVENT_QUEUE_INTERVAL		60
140#define KCM_EVENT_DEFAULT_BACKOFF_TIME		5
141#define KCM_EVENT_MAX_BACKOFF_TIME		(12 * 60 * 60)
142
143
144/* Request format is  LENGTH | MAJOR | MINOR | OPERATION | request */
145/* Response format is LENGTH | STATUS | response */
146
147typedef struct kcm_client {
148    pid_t pid;
149    uid_t uid;
150    gid_t gid;
151    pid_t session;
152} kcm_client;
153
154#define CLIENT_IS_ROOT(client) ((client)->uid == 0)
155
156/* Dispatch table */
157/* passed in OPERATION | ... ; returns STATUS | ... */
158typedef krb5_error_code (*kcm_method)(krb5_context, kcm_client *, kcm_operation, krb5_storage *, krb5_storage *);
159
160struct kcm_op {
161    const char *name;
162    kcm_method method;
163};
164
165#define DEFAULT_LOG_DEST    "0/FILE:" LOCALSTATEDIR "/log/kcmd.log"
166#define _PATH_KCM_CONF	    SYSCONFDIR "/kcm.conf"
167
168extern krb5_context kcm_context;
169extern char *socket_path;
170extern char *door_path;
171extern size_t max_request;
172extern sig_atomic_t exit_flag;
173extern int name_constraints;
174extern int detach_from_console;
175extern int daemon_child;
176extern int launchd_flag;
177extern int disallow_getting_krbtgt;
178
179#if 0
180extern const krb5_cc_ops krb5_kcmss_ops;
181#endif
182
183void	kcm_service(void *, const heim_idata *, const heim_icred,
184		    heim_ipc_complete, heim_sipc_call);
185
186#include <krb5/kcm-protos.h>
187
188#endif /* __KCM_LOCL_H__ */
189
190