1 /* $NetBSD: kcm_locl.h,v 1.2 2017/01/28 21:31:44 christos Exp $ */ 2 3 /* 4 * Copyright (c) 2005, PADL Software Pty Ltd. 5 * All rights reserved. 6 * 7 * Portions Copyright (c) 2009 Apple Inc. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * 3. Neither the name of PADL Software nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 */ 36 37 /* 38 * Id 39 */ 40 41 #ifndef __KCM_LOCL_H__ 42 #define __KCM_LOCL_H__ 43 44 #include "headers.h" 45 46 #include <krb5/kcm.h> 47 48 #define KCM_LOG_REQUEST(_context, _client, _opcode) do { \ 49 kcm_log(1, "%s request by process %d/uid %d", \ 50 kcm_op2string(_opcode), (_client)->pid, (_client)->uid); \ 51 } while (0) 52 53 #define KCM_LOG_REQUEST_NAME(_context, _client, _opcode, _name) do { \ 54 kcm_log(1, "%s request for cache %s by process %d/uid %d", \ 55 kcm_op2string(_opcode), (_name), (_client)->pid, (_client)->uid); \ 56 } while (0) 57 58 /* Cache management */ 59 60 #define KCM_FLAGS_VALID 0x0001 61 #define KCM_FLAGS_USE_KEYTAB 0x0002 62 #define KCM_FLAGS_RENEWABLE 0x0004 63 #define KCM_FLAGS_OWNER_IS_SYSTEM 0x0008 64 #define KCM_FLAGS_USE_CACHED_KEY 0x0010 65 66 #define KCM_MASK_KEY_PRESENT ( KCM_FLAGS_USE_KEYTAB | \ 67 KCM_FLAGS_USE_CACHED_KEY ) 68 69 struct kcm_ccache_data; 70 struct kcm_creds; 71 72 struct kcm_default_cache { 73 uid_t uid; 74 pid_t session; /* really au_asid_t */ 75 char *name; 76 struct kcm_default_cache *next; 77 }; 78 79 extern struct kcm_default_cache *default_caches; 80 81 struct kcm_creds { 82 kcmuuid_t uuid; 83 krb5_creds cred; 84 struct kcm_creds *next; 85 }; 86 87 typedef struct kcm_ccache_data { 88 char *name; 89 kcmuuid_t uuid; 90 unsigned refcnt; 91 uint16_t flags; 92 uint16_t mode; 93 uid_t uid; 94 gid_t gid; 95 pid_t session; /* really au_asid_t */ 96 krb5_principal client; /* primary client principal */ 97 krb5_principal server; /* primary server principal (TGS if NULL) */ 98 struct kcm_creds *creds; 99 krb5_deltat tkt_life; 100 krb5_deltat renew_life; 101 int32_t kdc_offset; 102 union { 103 krb5_keytab keytab; 104 krb5_keyblock keyblock; 105 } key; 106 HEIMDAL_MUTEX mutex; 107 struct kcm_ccache_data *next; 108 } kcm_ccache_data; 109 110 #define KCM_ASSERT_VALID(_ccache) do { \ 111 if (((_ccache)->flags & KCM_FLAGS_VALID) == 0) \ 112 krb5_abortx(context, "kcm_free_ccache_data: ccache invalid"); \ 113 else if ((_ccache)->refcnt == 0) \ 114 krb5_abortx(context, "kcm_free_ccache_data: ccache refcnt == 0"); \ 115 } while (0) 116 117 typedef kcm_ccache_data *kcm_ccache; 118 119 /* Event management */ 120 121 typedef struct kcm_event { 122 int valid; 123 time_t fire_time; 124 unsigned fire_count; 125 time_t expire_time; 126 time_t backoff_time; 127 enum { 128 KCM_EVENT_NONE = 0, 129 KCM_EVENT_ACQUIRE_CREDS, 130 KCM_EVENT_RENEW_CREDS, 131 KCM_EVENT_DESTROY_CREDS, 132 KCM_EVENT_DESTROY_EMPTY_CACHE 133 } action; 134 kcm_ccache ccache; 135 struct kcm_event *next; 136 } kcm_event; 137 138 /* wakeup interval for event queue */ 139 #define KCM_EVENT_QUEUE_INTERVAL 60 140 #define KCM_EVENT_DEFAULT_BACKOFF_TIME 5 141 #define KCM_EVENT_MAX_BACKOFF_TIME (12 * 60 * 60) 142 143 144 /* Request format is LENGTH | MAJOR | MINOR | OPERATION | request */ 145 /* Response format is LENGTH | STATUS | response */ 146 147 typedef struct kcm_client { 148 pid_t pid; 149 uid_t uid; 150 gid_t gid; 151 pid_t session; 152 } kcm_client; 153 154 #define CLIENT_IS_ROOT(client) ((client)->uid == 0) 155 156 /* Dispatch table */ 157 /* passed in OPERATION | ... ; returns STATUS | ... */ 158 typedef krb5_error_code (*kcm_method)(krb5_context, kcm_client *, kcm_operation, krb5_storage *, krb5_storage *); 159 160 struct kcm_op { 161 const char *name; 162 kcm_method method; 163 }; 164 165 #define DEFAULT_LOG_DEST "0/FILE:" LOCALSTATEDIR "/log/kcmd.log" 166 #define _PATH_KCM_CONF SYSCONFDIR "/kcm.conf" 167 168 extern krb5_context kcm_context; 169 extern char *socket_path; 170 extern char *door_path; 171 extern size_t max_request; 172 extern sig_atomic_t exit_flag; 173 extern int name_constraints; 174 extern int detach_from_console; 175 extern int daemon_child; 176 extern int launchd_flag; 177 extern int disallow_getting_krbtgt; 178 179 #if 0 180 extern const krb5_cc_ops krb5_kcmss_ops; 181 #endif 182 183 void kcm_service(void *, const heim_idata *, const heim_icred, 184 heim_ipc_complete, heim_sipc_call); 185 186 #include <krb5/kcm-protos.h> 187 188 #endif /* __KCM_LOCL_H__ */ 189 190