source: heimdal/trunk/lib/krb5/init_creds.c

Last change on this file was 1, checked in by Paul Smedley, 10 years ago

Initial commit of Heimdal 1.5.3
File size: 12.1 KB
Line 
1/*
2 * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36#include "krb5_locl.h"
37
38#undef __attribute__
39#define __attribute__(x)
40
41/**
42 * @page krb5_init_creds_intro The initial credential handing functions
43 * @section section_krb5_init_creds Initial credential
44 *
45 * Functions to get initial credentials: @ref krb5_credential .
46 */
47
48/**
49 * Allocate a new krb5_get_init_creds_opt structure, free with
50 * krb5_get_init_creds_opt_free().
51 *
52 * @ingroup krb5_credential
53 */
54
55KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
56krb5_get_init_creds_opt_alloc(krb5_context context,
57 krb5_get_init_creds_opt **opt)
58{
59 krb5_get_init_creds_opt *o;
60
61 *opt = NULL;
62 o = calloc(1, sizeof(*o));
63 if (o == NULL) {
64 krb5_set_error_message(context, ENOMEM,
65 N_("malloc: out of memory", ""));
66 return ENOMEM;
67 }
68
69 o->opt_private = calloc(1, sizeof(*o->opt_private));
70 if (o->opt_private == NULL) {
71 krb5_set_error_message(context, ENOMEM,
72 N_("malloc: out of memory", ""));
73 free(o);
74 return ENOMEM;
75 }
76 o->opt_private->refcount = 1;
77 *opt = o;
78 return 0;
79}
80
81/**
82 * Free krb5_get_init_creds_opt structure.
83 *
84 * @ingroup krb5_credential
85 */
86
87KRB5_LIB_FUNCTION void KRB5_LIB_CALL
88krb5_get_init_creds_opt_free(krb5_context context,
89 krb5_get_init_creds_opt *opt)
90{
91 if (opt == NULL || opt->opt_private == NULL)
92 return;
93 if (opt->opt_private->refcount < 1) /* abort ? */
94 return;
95 if (--opt->opt_private->refcount == 0) {
96 _krb5_get_init_creds_opt_free_pkinit(opt);
97 free(opt->opt_private);
98 }
99 memset(opt, 0, sizeof(*opt));
100 free(opt);
101}
102
103static int
104get_config_time (krb5_context context,
105 const char *realm,
106 const char *name,
107 int def)
108{
109 int ret;
110
111 ret = krb5_config_get_time (context, NULL,
112 "realms",
113 realm,
114 name,
115 NULL);
116 if (ret >= 0)
117 return ret;
118 ret = krb5_config_get_time (context, NULL,
119 "libdefaults",
120 name,
121 NULL);
122 if (ret >= 0)
123 return ret;
124 return def;
125}
126
127static krb5_boolean
128get_config_bool (krb5_context context,
129 krb5_boolean def_value,
130 const char *realm,
131 const char *name)
132{
133 krb5_boolean b;
134
135 b = krb5_config_get_bool_default(context, NULL, def_value,
136 "realms", realm, name, NULL);
137 if (b != def_value)
138 return b;
139 b = krb5_config_get_bool_default (context, NULL, def_value,
140 "libdefaults", name, NULL);
141 if (b != def_value)
142 return b;
143 return def_value;
144}
145
146/*
147 * set all the values in `opt' to the appropriate values for
148 * application `appname' (default to getprogname() if NULL), and realm
149 * `realm'. First looks in [appdefaults] but falls back to
150 * [realms] or [libdefaults] for some of the values.
151 */
152
153KRB5_LIB_FUNCTION void KRB5_LIB_CALL
154krb5_get_init_creds_opt_set_default_flags(krb5_context context,
155 const char *appname,
156 krb5_const_realm realm,
157 krb5_get_init_creds_opt *opt)
158{
159 krb5_boolean b;
160 time_t t;
161
162 b = get_config_bool (context, KRB5_FORWARDABLE_DEFAULT,
163 realm, "forwardable");
164 krb5_appdefault_boolean(context, appname, realm, "forwardable", b, &b);
165 krb5_get_init_creds_opt_set_forwardable(opt, b);
166
167 b = get_config_bool (context, FALSE, realm, "proxiable");
168 krb5_appdefault_boolean(context, appname, realm, "proxiable", b, &b);
169 krb5_get_init_creds_opt_set_proxiable (opt, b);
170
171 krb5_appdefault_time(context, appname, realm, "ticket_lifetime", 0, &t);
172 if (t == 0)
173 t = get_config_time (context, realm, "ticket_lifetime", 0);
174 if(t != 0)
175 krb5_get_init_creds_opt_set_tkt_life(opt, t);
176
177 krb5_appdefault_time(context, appname, realm, "renew_lifetime", 0, &t);
178 if (t == 0)
179 t = get_config_time (context, realm, "renew_lifetime", 0);
180 if(t != 0)
181 krb5_get_init_creds_opt_set_renew_life(opt, t);
182
183 krb5_appdefault_boolean(context, appname, realm, "no-addresses",
184 KRB5_ADDRESSLESS_DEFAULT, &b);
185 krb5_get_init_creds_opt_set_addressless (context, opt, b);
186
187#if 0
188 krb5_appdefault_boolean(context, appname, realm, "anonymous", FALSE, &b);
189 krb5_get_init_creds_opt_set_anonymous (opt, b);
190
191 krb5_get_init_creds_opt_set_etype_list(opt, enctype,
192 etype_str.num_strings);
193
194 krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
195 krb5_data *salt);
196
197 krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
198 krb5_preauthtype *preauth_list,
199 int preauth_list_length);
200#endif
201}
202
203
204KRB5_LIB_FUNCTION void KRB5_LIB_CALL
205krb5_get_init_creds_opt_set_tkt_life(krb5_get_init_creds_opt *opt,
206 krb5_deltat tkt_life)
207{
208 opt->flags |= KRB5_GET_INIT_CREDS_OPT_TKT_LIFE;
209 opt->tkt_life = tkt_life;
210}
211
212KRB5_LIB_FUNCTION void KRB5_LIB_CALL
213krb5_get_init_creds_opt_set_renew_life(krb5_get_init_creds_opt *opt,
214 krb5_deltat renew_life)
215{
216 opt->flags |= KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE;
217 opt->renew_life = renew_life;
218}
219
220KRB5_LIB_FUNCTION void KRB5_LIB_CALL
221krb5_get_init_creds_opt_set_forwardable(krb5_get_init_creds_opt *opt,
222 int forwardable)
223{
224 opt->flags |= KRB5_GET_INIT_CREDS_OPT_FORWARDABLE;
225 opt->forwardable = forwardable;
226}
227
228KRB5_LIB_FUNCTION void KRB5_LIB_CALL
229krb5_get_init_creds_opt_set_proxiable(krb5_get_init_creds_opt *opt,
230 int proxiable)
231{
232 opt->flags |= KRB5_GET_INIT_CREDS_OPT_PROXIABLE;
233 opt->proxiable = proxiable;
234}
235
236KRB5_LIB_FUNCTION void KRB5_LIB_CALL
237krb5_get_init_creds_opt_set_etype_list(krb5_get_init_creds_opt *opt,
238 krb5_enctype *etype_list,
239 int etype_list_length)
240{
241 opt->flags |= KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST;
242 opt->etype_list = etype_list;
243 opt->etype_list_length = etype_list_length;
244}
245
246KRB5_LIB_FUNCTION void KRB5_LIB_CALL
247krb5_get_init_creds_opt_set_address_list(krb5_get_init_creds_opt *opt,
248 krb5_addresses *addresses)
249{
250 opt->flags |= KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST;
251 opt->address_list = addresses;
252}
253
254KRB5_LIB_FUNCTION void KRB5_LIB_CALL
255krb5_get_init_creds_opt_set_preauth_list(krb5_get_init_creds_opt *opt,
256 krb5_preauthtype *preauth_list,
257 int preauth_list_length)
258{
259 opt->flags |= KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST;
260 opt->preauth_list_length = preauth_list_length;
261 opt->preauth_list = preauth_list;
262}
263
264KRB5_LIB_FUNCTION void KRB5_LIB_CALL
265krb5_get_init_creds_opt_set_salt(krb5_get_init_creds_opt *opt,
266 krb5_data *salt)
267{
268 opt->flags |= KRB5_GET_INIT_CREDS_OPT_SALT;
269 opt->salt = salt;
270}
271
272KRB5_LIB_FUNCTION void KRB5_LIB_CALL
273krb5_get_init_creds_opt_set_anonymous(krb5_get_init_creds_opt *opt,
274 int anonymous)
275{
276 opt->flags |= KRB5_GET_INIT_CREDS_OPT_ANONYMOUS;
277 opt->anonymous = anonymous;
278}
279
280static krb5_error_code
281require_ext_opt(krb5_context context,
282 krb5_get_init_creds_opt *opt,
283 const char *type)
284{
285 if (opt->opt_private == NULL) {
286 krb5_set_error_message(context, EINVAL,
287 N_("%s on non extendable opt", ""), type);
288 return EINVAL;
289 }
290 return 0;
291}
292
293KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
294krb5_get_init_creds_opt_set_pa_password(krb5_context context,
295 krb5_get_init_creds_opt *opt,
296 const char *password,
297 krb5_s2k_proc key_proc)
298{
299 krb5_error_code ret;
300 ret = require_ext_opt(context, opt, "init_creds_opt_set_pa_password");
301 if (ret)
302 return ret;
303 opt->opt_private->password = password;
304 opt->opt_private->key_proc = key_proc;
305 return 0;
306}
307
308KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
309krb5_get_init_creds_opt_set_pac_request(krb5_context context,
310 krb5_get_init_creds_opt *opt,
311 krb5_boolean req_pac)
312{
313 krb5_error_code ret;
314 ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
315 if (ret)
316 return ret;
317 opt->opt_private->req_pac = req_pac ?
318 KRB5_INIT_CREDS_TRISTATE_TRUE :
319 KRB5_INIT_CREDS_TRISTATE_FALSE;
320 return 0;
321}
322
323KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
324krb5_get_init_creds_opt_set_addressless(krb5_context context,
325 krb5_get_init_creds_opt *opt,
326 krb5_boolean addressless)
327{
328 krb5_error_code ret;
329 ret = require_ext_opt(context, opt, "init_creds_opt_set_pac_req");
330 if (ret)
331 return ret;
332 if (addressless)
333 opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_TRUE;
334 else
335 opt->opt_private->addressless = KRB5_INIT_CREDS_TRISTATE_FALSE;
336 return 0;
337}
338
339KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
340krb5_get_init_creds_opt_set_canonicalize(krb5_context context,
341 krb5_get_init_creds_opt *opt,
342 krb5_boolean req)
343{
344 krb5_error_code ret;
345 ret = require_ext_opt(context, opt, "init_creds_opt_set_canonicalize");
346 if (ret)
347 return ret;
348 if (req)
349 opt->opt_private->flags |= KRB5_INIT_CREDS_CANONICALIZE;
350 else
351 opt->opt_private->flags &= ~KRB5_INIT_CREDS_CANONICALIZE;
352 return 0;
353}
354
355KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
356krb5_get_init_creds_opt_set_win2k(krb5_context context,
357 krb5_get_init_creds_opt *opt,
358 krb5_boolean req)
359{
360 krb5_error_code ret;
361 ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
362 if (ret)
363 return ret;
364 if (req) {
365 opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_CANON_CHECK;
366 opt->opt_private->flags |= KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
367 } else {
368 opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_CANON_CHECK;
369 opt->opt_private->flags &= ~KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
370 }
371 return 0;
372}
373
374
375KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
376krb5_get_init_creds_opt_set_process_last_req(krb5_context context,
377 krb5_get_init_creds_opt *opt,
378 krb5_gic_process_last_req func,
379 void *ctx)
380{
381 krb5_error_code ret;
382 ret = require_ext_opt(context, opt, "init_creds_opt_set_win2k");
383 if (ret)
384 return ret;
385
386 opt->opt_private->lr.func = func;
387 opt->opt_private->lr.ctx = ctx;
388
389 return 0;
390}
391
392
393#ifndef HEIMDAL_SMALLER
394
395/**
396 * Deprecated: use krb5_get_init_creds_opt_alloc().
397 *
398 * The reason krb5_get_init_creds_opt_init() is deprecated is that
399 * krb5_get_init_creds_opt is a static structure and for ABI reason it
400 * can't grow, ie can't add new functionality.
401 *
402 * @ingroup krb5_deprecated
403 */
404
405KRB5_LIB_FUNCTION void KRB5_LIB_CALL
406krb5_get_init_creds_opt_init(krb5_get_init_creds_opt *opt)
407 KRB5_DEPRECATED_FUNCTION("Use X instead")
408{
409 memset (opt, 0, sizeof(*opt));
410}
411
412/**
413 * Deprecated: use the new krb5_init_creds_init() and
414 * krb5_init_creds_get_error().
415 *
416 * @ingroup krb5_deprecated
417 */
418
419KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
420krb5_get_init_creds_opt_get_error(krb5_context context,
421 krb5_get_init_creds_opt *opt,
422 KRB_ERROR **error)
423 KRB5_DEPRECATED_FUNCTION("Use X instead")
424{
425 *error = calloc(1, sizeof(**error));
426 if (*error == NULL) {
427 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
428 return ENOMEM;
429 }
430
431 return 0;
432}
433
434#endif /* HEIMDAL_SMALLER */
Note: See TracBrowser for help on using the repository browser.