source: branches/samba-3.5.x/source4/heimdal/lib/krb5/krb5.h

Last change on this file was 414, checked in by Herwig Bauernfeind, 15 years ago

Samba 3.5.0: Initial import
File size: 26.7 KB
Line 
1/*
2 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34/* $Id$ */
35
36#ifndef __KRB5_H__
37#define __KRB5_H__
38
39#include <time.h>
40#include <krb5-types.h>
41
42#include <asn1_err.h>
43#include <krb5_err.h>
44#include <heim_err.h>
45#include <k524_err.h>
46
47#include <krb5_asn1.h>
48
49/* name confusion with MIT */
50#ifndef KRB5KDC_ERR_KEY_EXP
51#define KRB5KDC_ERR_KEY_EXP KRB5KDC_ERR_KEY_EXPIRED
52#endif
53
54#ifndef KRB5_DEPRECATED
55#if defined(__GNUC__) && ((__GNUC__ > 3) || ((__GNUC__ == 3) && (__GNUC_MINOR__ >= 1 )))
56#define KRB5_DEPRECATED __attribute__((deprecated))
57#elif defined(_MSC_VER) && (_MSC_VER>1200)
58#define KRB5_DEPRECATED __declspec(deprecated)
59#else
60#define KRB5_DEPRECATED
61#endif
62#endif
63
64/* simple constants */
65
66#ifndef TRUE
67#define TRUE 1
68#define FALSE 0
69#endif
70
71typedef int krb5_boolean;
72
73typedef int32_t krb5_error_code;
74
75typedef int krb5_kvno;
76
77typedef uint32_t krb5_flags;
78
79typedef void *krb5_pointer;
80typedef const void *krb5_const_pointer;
81
82struct krb5_crypto_data;
83typedef struct krb5_crypto_data *krb5_crypto;
84
85struct krb5_get_creds_opt_data;
86typedef struct krb5_get_creds_opt_data *krb5_get_creds_opt;
87
88struct krb5_digest_data;
89typedef struct krb5_digest_data *krb5_digest;
90struct krb5_ntlm_data;
91typedef struct krb5_ntlm_data *krb5_ntlm;
92
93struct krb5_pac_data;
94typedef struct krb5_pac_data *krb5_pac;
95
96typedef struct krb5_rd_req_in_ctx_data *krb5_rd_req_in_ctx;
97typedef struct krb5_rd_req_out_ctx_data *krb5_rd_req_out_ctx;
98
99typedef CKSUMTYPE krb5_cksumtype;
100
101typedef Checksum krb5_checksum;
102
103typedef ENCTYPE krb5_enctype;
104
105typedef struct krb5_get_init_creds_ctx *krb5_init_creds_context;
106
107typedef heim_octet_string krb5_data;
108
109/* PKINIT related forward declarations */
110struct ContentInfo;
111struct krb5_pk_identity;
112struct krb5_pk_cert;
113
114/* krb5_enc_data is a mit compat structure */
115typedef struct krb5_enc_data {
116 krb5_enctype enctype;
117 krb5_kvno kvno;
118 krb5_data ciphertext;
119} krb5_enc_data;
120
121/* alternative names */
122enum {
123 ENCTYPE_NULL = ETYPE_NULL,
124 ENCTYPE_DES_CBC_CRC = ETYPE_DES_CBC_CRC,
125 ENCTYPE_DES_CBC_MD4 = ETYPE_DES_CBC_MD4,
126 ENCTYPE_DES_CBC_MD5 = ETYPE_DES_CBC_MD5,
127 ENCTYPE_DES3_CBC_MD5 = ETYPE_DES3_CBC_MD5,
128 ENCTYPE_OLD_DES3_CBC_SHA1 = ETYPE_OLD_DES3_CBC_SHA1,
129 ENCTYPE_SIGN_DSA_GENERATE = ETYPE_SIGN_DSA_GENERATE,
130 ENCTYPE_ENCRYPT_RSA_PRIV = ETYPE_ENCRYPT_RSA_PRIV,
131 ENCTYPE_ENCRYPT_RSA_PUB = ETYPE_ENCRYPT_RSA_PUB,
132 ENCTYPE_DES3_CBC_SHA1 = ETYPE_DES3_CBC_SHA1,
133 ENCTYPE_AES128_CTS_HMAC_SHA1_96 = ETYPE_AES128_CTS_HMAC_SHA1_96,
134 ENCTYPE_AES256_CTS_HMAC_SHA1_96 = ETYPE_AES256_CTS_HMAC_SHA1_96,
135 ENCTYPE_ARCFOUR_HMAC = ETYPE_ARCFOUR_HMAC_MD5,
136 ENCTYPE_ARCFOUR_HMAC_MD5 = ETYPE_ARCFOUR_HMAC_MD5,
137 ENCTYPE_ARCFOUR_HMAC_MD5_56 = ETYPE_ARCFOUR_HMAC_MD5_56,
138 ENCTYPE_ENCTYPE_PK_CROSS = ETYPE_ENCTYPE_PK_CROSS,
139 ENCTYPE_DES_CBC_NONE = ETYPE_DES_CBC_NONE,
140 ENCTYPE_DES3_CBC_NONE = ETYPE_DES3_CBC_NONE,
141 ENCTYPE_DES_CFB64_NONE = ETYPE_DES_CFB64_NONE,
142 ENCTYPE_DES_PCBC_NONE = ETYPE_DES_PCBC_NONE
143};
144
145typedef PADATA_TYPE krb5_preauthtype;
146
147typedef enum krb5_key_usage {
148 KRB5_KU_PA_ENC_TIMESTAMP = 1,
149 /* AS-REQ PA-ENC-TIMESTAMP padata timestamp, encrypted with the
150 client key (section 5.4.1) */
151 KRB5_KU_TICKET = 2,
152 /* AS-REP Ticket and TGS-REP Ticket (includes tgs session key or
153 application session key), encrypted with the service key
154 (section 5.4.2) */
155 KRB5_KU_AS_REP_ENC_PART = 3,
156 /* AS-REP encrypted part (includes tgs session key or application
157 session key), encrypted with the client key (section 5.4.2) */
158 KRB5_KU_TGS_REQ_AUTH_DAT_SESSION = 4,
159 /* TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with the tgs
160 session key (section 5.4.1) */
161 KRB5_KU_TGS_REQ_AUTH_DAT_SUBKEY = 5,
162 /* TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with the tgs
163 authenticator subkey (section 5.4.1) */
164 KRB5_KU_TGS_REQ_AUTH_CKSUM = 6,
165 /* TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator cksum, keyed
166 with the tgs session key (sections 5.3.2, 5.4.1) */
167 KRB5_KU_TGS_REQ_AUTH = 7,
168 /* TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes tgs
169 authenticator subkey), encrypted with the tgs session key
170 (section 5.3.2) */
171 KRB5_KU_TGS_REP_ENC_PART_SESSION = 8,
172 /* TGS-REP encrypted part (includes application session key),
173 encrypted with the tgs session key (section 5.4.2) */
174 KRB5_KU_TGS_REP_ENC_PART_SUB_KEY = 9,
175 /* TGS-REP encrypted part (includes application session key),
176 encrypted with the tgs authenticator subkey (section 5.4.2) */
177 KRB5_KU_AP_REQ_AUTH_CKSUM = 10,
178 /* AP-REQ Authenticator cksum, keyed with the application session
179 key (section 5.3.2) */
180 KRB5_KU_AP_REQ_AUTH = 11,
181 /* AP-REQ Authenticator (includes application authenticator
182 subkey), encrypted with the application session key (section
183 5.3.2) */
184 KRB5_KU_AP_REQ_ENC_PART = 12,
185 /* AP-REP encrypted part (includes application session subkey),
186 encrypted with the application session key (section 5.5.2) */
187 KRB5_KU_KRB_PRIV = 13,
188 /* KRB-PRIV encrypted part, encrypted with a key chosen by the
189 application (section 5.7.1) */
190 KRB5_KU_KRB_CRED = 14,
191 /* KRB-CRED encrypted part, encrypted with a key chosen by the
192 application (section 5.8.1) */
193 KRB5_KU_KRB_SAFE_CKSUM = 15,
194 /* KRB-SAFE cksum, keyed with a key chosen by the application
195 (section 5.6.1) */
196 KRB5_KU_OTHER_ENCRYPTED = 16,
197 /* Data which is defined in some specification outside of
198 Kerberos to be encrypted using an RFC1510 encryption type. */
199 KRB5_KU_OTHER_CKSUM = 17,
200 /* Data which is defined in some specification outside of
201 Kerberos to be checksummed using an RFC1510 checksum type. */
202 KRB5_KU_KRB_ERROR = 18,
203 /* Krb-error checksum */
204 KRB5_KU_AD_KDC_ISSUED = 19,
205 /* AD-KDCIssued checksum */
206 KRB5_KU_MANDATORY_TICKET_EXTENSION = 20,
207 /* Checksum for Mandatory Ticket Extensions */
208 KRB5_KU_AUTH_DATA_TICKET_EXTENSION = 21,
209 /* Checksum in Authorization Data in Ticket Extensions */
210 KRB5_KU_USAGE_SEAL = 22,
211 /* seal in GSSAPI krb5 mechanism */
212 KRB5_KU_USAGE_SIGN = 23,
213 /* sign in GSSAPI krb5 mechanism */
214 KRB5_KU_USAGE_SEQ = 24,
215 /* SEQ in GSSAPI krb5 mechanism */
216 KRB5_KU_USAGE_ACCEPTOR_SEAL = 22,
217 /* acceptor sign in GSSAPI CFX krb5 mechanism */
218 KRB5_KU_USAGE_ACCEPTOR_SIGN = 23,
219 /* acceptor seal in GSSAPI CFX krb5 mechanism */
220 KRB5_KU_USAGE_INITIATOR_SEAL = 24,
221 /* initiator sign in GSSAPI CFX krb5 mechanism */
222 KRB5_KU_USAGE_INITIATOR_SIGN = 25,
223 /* initiator seal in GSSAPI CFX krb5 mechanism */
224 KRB5_KU_PA_SERVER_REFERRAL_DATA = 22,
225 /* encrypted server referral data */
226 KRB5_KU_SAM_CHECKSUM = 25,
227 /* Checksum for the SAM-CHECKSUM field */
228 KRB5_KU_SAM_ENC_TRACK_ID = 26,
229 /* Encryption of the SAM-TRACK-ID field */
230 KRB5_KU_PA_SERVER_REFERRAL = 26,
231 /* Keyusage for the server referral in a TGS req */
232 KRB5_KU_SAM_ENC_NONCE_SAD = 27,
233 /* Encryption of the SAM-NONCE-OR-SAD field */
234 KRB5_KU_PA_PKINIT_KX = 44,
235 /* Encryption type of the kdc session contribution in pk-init */
236 KRB5_KU_DIGEST_ENCRYPT = -18,
237 /* Encryption key usage used in the digest encryption field */
238 KRB5_KU_DIGEST_OPAQUE = -19,
239 /* Checksum key usage used in the digest opaque field */
240 KRB5_KU_KRB5SIGNEDPATH = -21,
241 /* Checksum key usage on KRB5SignedPath */
242 KRB5_KU_CANONICALIZED_NAMES = -23
243 /* Checksum key usage on PA-CANONICALIZED */
244} krb5_key_usage;
245
246typedef krb5_key_usage krb5_keyusage;
247
248typedef enum krb5_salttype {
249 KRB5_PW_SALT = KRB5_PADATA_PW_SALT,
250 KRB5_AFS3_SALT = KRB5_PADATA_AFS3_SALT
251}krb5_salttype;
252
253typedef struct krb5_salt {
254 krb5_salttype salttype;
255 krb5_data saltvalue;
256} krb5_salt;
257
258typedef ETYPE_INFO krb5_preauthinfo;
259
260typedef struct {
261 krb5_preauthtype type;
262 krb5_preauthinfo info; /* list of preauthinfo for this type */
263} krb5_preauthdata_entry;
264
265typedef struct krb5_preauthdata {
266 unsigned len;
267 krb5_preauthdata_entry *val;
268}krb5_preauthdata;
269
270typedef enum krb5_address_type {
271 KRB5_ADDRESS_INET = 2,
272 KRB5_ADDRESS_NETBIOS = 20,
273 KRB5_ADDRESS_INET6 = 24,
274 KRB5_ADDRESS_ADDRPORT = 256,
275 KRB5_ADDRESS_IPPORT = 257
276} krb5_address_type;
277
278enum {
279 AP_OPTS_USE_SESSION_KEY = 1,
280 AP_OPTS_MUTUAL_REQUIRED = 2,
281 AP_OPTS_USE_SUBKEY = 4 /* library internal */
282};
283
284typedef HostAddress krb5_address;
285
286typedef HostAddresses krb5_addresses;
287
288typedef enum krb5_keytype {
289 KEYTYPE_NULL = ETYPE_NULL,
290 KEYTYPE_DES = ETYPE_DES_CBC_CRC,
291 KEYTYPE_DES3 = ETYPE_OLD_DES3_CBC_SHA1,
292 KEYTYPE_AES128 = ETYPE_AES128_CTS_HMAC_SHA1_96,
293 KEYTYPE_AES256 = ETYPE_AES256_CTS_HMAC_SHA1_96,
294 KEYTYPE_ARCFOUR = ETYPE_ARCFOUR_HMAC_MD5,
295 KEYTYPE_ARCFOUR_56 = ETYPE_ARCFOUR_HMAC_MD5_56
296} krb5_keytype;
297
298typedef EncryptionKey krb5_keyblock;
299
300typedef AP_REQ krb5_ap_req;
301
302struct krb5_cc_ops;
303
304#define KRB5_DEFAULT_CCFILE_ROOT "/tmp/krb5cc_"
305
306#define KRB5_DEFAULT_CCROOT "FILE:" KRB5_DEFAULT_CCFILE_ROOT
307
308#define KRB5_ACCEPT_NULL_ADDRESSES(C) \
309 krb5_config_get_bool_default((C), NULL, TRUE, \
310 "libdefaults", "accept_null_addresses", \
311 NULL)
312
313typedef void *krb5_cc_cursor;
314typedef struct krb5_cccol_cursor *krb5_cccol_cursor;
315
316typedef struct krb5_ccache_data {
317 const struct krb5_cc_ops *ops;
318 krb5_data data;
319}krb5_ccache_data;
320
321typedef struct krb5_ccache_data *krb5_ccache;
322
323typedef struct krb5_context_data *krb5_context;
324
325typedef Realm krb5_realm;
326typedef const char *krb5_const_realm; /* stupid language */
327
328#define krb5_realm_length(r) strlen(r)
329#define krb5_realm_data(r) (r)
330
331typedef Principal krb5_principal_data;
332typedef struct Principal *krb5_principal;
333typedef const struct Principal *krb5_const_principal;
334typedef struct Principals *krb5_principals;
335
336typedef time_t krb5_deltat;
337typedef time_t krb5_timestamp;
338
339typedef struct krb5_times {
340 krb5_timestamp authtime;
341 krb5_timestamp starttime;
342 krb5_timestamp endtime;
343 krb5_timestamp renew_till;
344} krb5_times;
345
346typedef union {
347 TicketFlags b;
348 krb5_flags i;
349} krb5_ticket_flags;
350
351/* options for krb5_get_in_tkt() */
352#define KDC_OPT_FORWARDABLE (1 << 1)
353#define KDC_OPT_FORWARDED (1 << 2)
354#define KDC_OPT_PROXIABLE (1 << 3)
355#define KDC_OPT_PROXY (1 << 4)
356#define KDC_OPT_ALLOW_POSTDATE (1 << 5)
357#define KDC_OPT_POSTDATED (1 << 6)
358#define KDC_OPT_RENEWABLE (1 << 8)
359#define KDC_OPT_REQUEST_ANONYMOUS (1 << 14)
360#define KDC_OPT_DISABLE_TRANSITED_CHECK (1 << 26)
361#define KDC_OPT_RENEWABLE_OK (1 << 27)
362#define KDC_OPT_ENC_TKT_IN_SKEY (1 << 28)
363#define KDC_OPT_RENEW (1 << 30)
364#define KDC_OPT_VALIDATE (1 << 31)
365
366typedef union {
367 KDCOptions b;
368 krb5_flags i;
369} krb5_kdc_flags;
370
371/* flags for krb5_verify_ap_req */
372
373#define KRB5_VERIFY_AP_REQ_IGNORE_INVALID (1 << 0)
374
375#define KRB5_GC_CACHED (1U << 0)
376#define KRB5_GC_USER_USER (1U << 1)
377#define KRB5_GC_EXPIRED_OK (1U << 2)
378#define KRB5_GC_NO_STORE (1U << 3)
379#define KRB5_GC_FORWARDABLE (1U << 4)
380#define KRB5_GC_NO_TRANSIT_CHECK (1U << 5)
381#define KRB5_GC_CONSTRAINED_DELEGATION (1U << 6)
382#define KRB5_GC_CANONICALIZE (1U << 7)
383
384/* constants for compare_creds (and cc_retrieve_cred) */
385#define KRB5_TC_DONT_MATCH_REALM (1U << 31)
386#define KRB5_TC_MATCH_KEYTYPE (1U << 30)
387#define KRB5_TC_MATCH_KTYPE KRB5_TC_MATCH_KEYTYPE /* MIT name */
388#define KRB5_TC_MATCH_SRV_NAMEONLY (1 << 29)
389#define KRB5_TC_MATCH_FLAGS_EXACT (1 << 28)
390#define KRB5_TC_MATCH_FLAGS (1 << 27)
391#define KRB5_TC_MATCH_TIMES_EXACT (1 << 26)
392#define KRB5_TC_MATCH_TIMES (1 << 25)
393#define KRB5_TC_MATCH_AUTHDATA (1 << 24)
394#define KRB5_TC_MATCH_2ND_TKT (1 << 23)
395#define KRB5_TC_MATCH_IS_SKEY (1 << 22)
396
397typedef AuthorizationData krb5_authdata;
398
399typedef KRB_ERROR krb5_error;
400
401typedef struct krb5_creds {
402 krb5_principal client;
403 krb5_principal server;
404 krb5_keyblock session;
405 krb5_times times;
406 krb5_data ticket;
407 krb5_data second_ticket;
408 krb5_authdata authdata;
409 krb5_addresses addresses;
410 krb5_ticket_flags flags;
411} krb5_creds;
412
413typedef struct krb5_cc_cache_cursor_data *krb5_cc_cache_cursor;
414
415#define KRB5_CC_OPS_VERSION 2
416
417typedef struct krb5_cc_ops {
418 int version;
419 const char *prefix;
420 const char* (*get_name)(krb5_context, krb5_ccache);
421 krb5_error_code (*resolve)(krb5_context, krb5_ccache *, const char *);
422 krb5_error_code (*gen_new)(krb5_context, krb5_ccache *);
423 krb5_error_code (*init)(krb5_context, krb5_ccache, krb5_principal);
424 krb5_error_code (*destroy)(krb5_context, krb5_ccache);
425 krb5_error_code (*close)(krb5_context, krb5_ccache);
426 krb5_error_code (*store)(krb5_context, krb5_ccache, krb5_creds*);
427 krb5_error_code (*retrieve)(krb5_context, krb5_ccache,
428 krb5_flags, const krb5_creds*, krb5_creds *);
429 krb5_error_code (*get_princ)(krb5_context, krb5_ccache, krb5_principal*);
430 krb5_error_code (*get_first)(krb5_context, krb5_ccache, krb5_cc_cursor *);
431 krb5_error_code (*get_next)(krb5_context, krb5_ccache,
432 krb5_cc_cursor*, krb5_creds*);
433 krb5_error_code (*end_get)(krb5_context, krb5_ccache, krb5_cc_cursor*);
434 krb5_error_code (*remove_cred)(krb5_context, krb5_ccache,
435 krb5_flags, krb5_creds*);
436 krb5_error_code (*set_flags)(krb5_context, krb5_ccache, krb5_flags);
437 int (*get_version)(krb5_context, krb5_ccache);
438 krb5_error_code (*get_cache_first)(krb5_context, krb5_cc_cursor *);
439 krb5_error_code (*get_cache_next)(krb5_context, krb5_cc_cursor, krb5_ccache *);
440 krb5_error_code (*end_cache_get)(krb5_context, krb5_cc_cursor);
441 krb5_error_code (*move)(krb5_context, krb5_ccache, krb5_ccache);
442 krb5_error_code (*get_default_name)(krb5_context, char **);
443 krb5_error_code (*set_default)(krb5_context, krb5_ccache);
444 krb5_error_code (*lastchange)(krb5_context, krb5_ccache, krb5_timestamp *);
445} krb5_cc_ops;
446
447struct krb5_log_facility;
448
449struct krb5_config_binding {
450 enum { krb5_config_string, krb5_config_list } type;
451 char *name;
452 struct krb5_config_binding *next;
453 union {
454 char *string;
455 struct krb5_config_binding *list;
456 void *generic;
457 } u;
458};
459
460typedef struct krb5_config_binding krb5_config_binding;
461
462typedef krb5_config_binding krb5_config_section;
463
464typedef struct krb5_ticket {
465 EncTicketPart ticket;
466 krb5_principal client;
467 krb5_principal server;
468} krb5_ticket;
469
470typedef Authenticator krb5_authenticator_data;
471
472typedef krb5_authenticator_data *krb5_authenticator;
473
474struct krb5_rcache_data;
475typedef struct krb5_rcache_data *krb5_rcache;
476typedef Authenticator krb5_donot_replay;
477
478#define KRB5_STORAGE_HOST_BYTEORDER 0x01 /* old */
479#define KRB5_STORAGE_PRINCIPAL_WRONG_NUM_COMPONENTS 0x02
480#define KRB5_STORAGE_PRINCIPAL_NO_NAME_TYPE 0x04
481#define KRB5_STORAGE_KEYBLOCK_KEYTYPE_TWICE 0x08
482#define KRB5_STORAGE_BYTEORDER_MASK 0x60
483#define KRB5_STORAGE_BYTEORDER_BE 0x00 /* default */
484#define KRB5_STORAGE_BYTEORDER_LE 0x20
485#define KRB5_STORAGE_BYTEORDER_HOST 0x40
486#define KRB5_STORAGE_CREDS_FLAGS_WRONG_BITORDER 0x80
487
488struct krb5_storage_data;
489typedef struct krb5_storage_data krb5_storage;
490
491typedef struct krb5_keytab_entry {
492 krb5_principal principal;
493 krb5_kvno vno;
494 krb5_keyblock keyblock;
495 uint32_t timestamp;
496 uint32_t flags;
497 krb5_principals aliases;
498} krb5_keytab_entry;
499
500typedef struct krb5_kt_cursor {
501 int fd;
502 krb5_storage *sp;
503 void *data;
504} krb5_kt_cursor;
505
506struct krb5_keytab_data;
507
508typedef struct krb5_keytab_data *krb5_keytab;
509
510#define KRB5_KT_PREFIX_MAX_LEN 30
511
512struct krb5_keytab_data {
513 const char *prefix;
514 krb5_error_code (*resolve)(krb5_context, const char*, krb5_keytab);
515 krb5_error_code (*get_name)(krb5_context, krb5_keytab, char*, size_t);
516 krb5_error_code (*close)(krb5_context, krb5_keytab);
517 krb5_error_code (*destroy)(krb5_context, krb5_keytab);
518 krb5_error_code (*get)(krb5_context, krb5_keytab, krb5_const_principal,
519 krb5_kvno, krb5_enctype, krb5_keytab_entry*);
520 krb5_error_code (*start_seq_get)(krb5_context, krb5_keytab, krb5_kt_cursor*);
521 krb5_error_code (*next_entry)(krb5_context, krb5_keytab,
522 krb5_keytab_entry*, krb5_kt_cursor*);
523 krb5_error_code (*end_seq_get)(krb5_context, krb5_keytab, krb5_kt_cursor*);
524 krb5_error_code (*add)(krb5_context, krb5_keytab, krb5_keytab_entry*);
525 krb5_error_code (*remove)(krb5_context, krb5_keytab, krb5_keytab_entry*);
526 void *data;
527 int32_t version;
528};
529
530typedef struct krb5_keytab_data krb5_kt_ops;
531
532struct krb5_keytab_key_proc_args {
533 krb5_keytab keytab;
534 krb5_principal principal;
535};
536
537typedef struct krb5_keytab_key_proc_args krb5_keytab_key_proc_args;
538
539typedef struct krb5_replay_data {
540 krb5_timestamp timestamp;
541 int32_t usec;
542 uint32_t seq;
543} krb5_replay_data;
544
545/* flags for krb5_auth_con_setflags */
546enum {
547 KRB5_AUTH_CONTEXT_DO_TIME = 1,
548 KRB5_AUTH_CONTEXT_RET_TIME = 2,
549 KRB5_AUTH_CONTEXT_DO_SEQUENCE = 4,
550 KRB5_AUTH_CONTEXT_RET_SEQUENCE = 8,
551 KRB5_AUTH_CONTEXT_PERMIT_ALL = 16,
552 KRB5_AUTH_CONTEXT_USE_SUBKEY = 32,
553 KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED = 64
554};
555
556/* flags for krb5_auth_con_genaddrs */
557enum {
558 KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR = 1,
559 KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR = 3,
560 KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR = 4,
561 KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR = 12
562};
563
564typedef struct krb5_auth_context_data {
565 unsigned int flags;
566
567 krb5_address *local_address;
568 krb5_address *remote_address;
569 int16_t local_port;
570 int16_t remote_port;
571 krb5_keyblock *keyblock;
572 krb5_keyblock *local_subkey;
573 krb5_keyblock *remote_subkey;
574
575 uint32_t local_seqnumber;
576 uint32_t remote_seqnumber;
577
578 krb5_authenticator authenticator;
579
580 krb5_pointer i_vector;
581
582 krb5_rcache rcache;
583
584 krb5_keytype keytype; /* ¿requested key type ? */
585 krb5_cksumtype cksumtype; /* ¡requested checksum type! */
586
587}krb5_auth_context_data, *krb5_auth_context;
588
589typedef struct {
590 KDC_REP kdc_rep;
591 EncKDCRepPart enc_part;
592 KRB_ERROR error;
593} krb5_kdc_rep;
594
595extern const char *heimdal_version, *heimdal_long_version;
596
597typedef void (*krb5_log_log_func_t)(const char*, const char*, void*);
598typedef void (*krb5_log_close_func_t)(void*);
599
600typedef struct krb5_log_facility {
601 char *program;
602 int len;
603 struct facility *val;
604} krb5_log_facility;
605
606typedef EncAPRepPart krb5_ap_rep_enc_part;
607
608#define KRB5_RECVAUTH_IGNORE_VERSION 1
609
610#define KRB5_SENDAUTH_VERSION "KRB5_SENDAUTH_V1.0"
611
612#define KRB5_TGS_NAME_SIZE (6)
613#define KRB5_TGS_NAME ("krbtgt")
614#define KRB5_WELLKNOWN_NAME ("WELLKNOWN")
615#define KRB5_ANON_NAME ("ANONYMOUS")
616#define KRB5_DIGEST_NAME ("digest")
617
618typedef enum {
619 KRB5_PROMPT_TYPE_PASSWORD = 0x1,
620 KRB5_PROMPT_TYPE_NEW_PASSWORD = 0x2,
621 KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN = 0x3,
622 KRB5_PROMPT_TYPE_PREAUTH = 0x4,
623 KRB5_PROMPT_TYPE_INFO = 0x5
624} krb5_prompt_type;
625
626typedef struct _krb5_prompt {
627 const char *prompt;
628 int hidden;
629 krb5_data *reply;
630 krb5_prompt_type type;
631} krb5_prompt;
632
633typedef int (*krb5_prompter_fct)(krb5_context /*context*/,
634 void * /*data*/,
635 const char * /*name*/,
636 const char * /*banner*/,
637 int /*num_prompts*/,
638 krb5_prompt /*prompts*/[]);
639typedef krb5_error_code (*krb5_key_proc)(krb5_context /*context*/,
640 krb5_enctype /*type*/,
641 krb5_salt /*salt*/,
642 krb5_const_pointer /*keyseed*/,
643 krb5_keyblock ** /*key*/);
644typedef krb5_error_code (*krb5_decrypt_proc)(krb5_context /*context*/,
645 krb5_keyblock * /*key*/,
646 krb5_key_usage /*usage*/,
647 krb5_const_pointer /*decrypt_arg*/,
648 krb5_kdc_rep * /*dec_rep*/);
649typedef krb5_error_code (*krb5_s2k_proc)(krb5_context /*context*/,
650 krb5_enctype /*type*/,
651 krb5_const_pointer /*keyseed*/,
652 krb5_salt /*salt*/,
653 krb5_data * /*s2kparms*/,
654 krb5_keyblock ** /*key*/);
655
656struct _krb5_get_init_creds_opt_private;
657
658struct _krb5_get_init_creds_opt {
659 krb5_flags flags;
660 krb5_deltat tkt_life;
661 krb5_deltat renew_life;
662 int forwardable;
663 int proxiable;
664 int anonymous;
665 krb5_enctype *etype_list;
666 int etype_list_length;
667 krb5_addresses *address_list;
668 /* XXX the next three should not be used, as they may be
669 removed later */
670 krb5_preauthtype *preauth_list;
671 int preauth_list_length;
672 krb5_data *salt;
673 struct _krb5_get_init_creds_opt_private *opt_private;
674};
675
676typedef struct _krb5_get_init_creds_opt krb5_get_init_creds_opt;
677
678#define KRB5_GET_INIT_CREDS_OPT_TKT_LIFE 0x0001
679#define KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE 0x0002
680#define KRB5_GET_INIT_CREDS_OPT_FORWARDABLE 0x0004
681#define KRB5_GET_INIT_CREDS_OPT_PROXIABLE 0x0008
682#define KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST 0x0010
683#define KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST 0x0020
684#define KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST 0x0040
685#define KRB5_GET_INIT_CREDS_OPT_SALT 0x0080 /* no supported */
686#define KRB5_GET_INIT_CREDS_OPT_ANONYMOUS 0x0100
687#define KRB5_GET_INIT_CREDS_OPT_DISABLE_TRANSITED_CHECK 0x0200
688
689typedef struct _krb5_verify_init_creds_opt {
690 krb5_flags flags;
691 int ap_req_nofail;
692} krb5_verify_init_creds_opt;
693
694#define KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL 0x0001
695
696typedef struct krb5_verify_opt {
697 unsigned int flags;
698 krb5_ccache ccache;
699 krb5_keytab keytab;
700 krb5_boolean secure;
701 const char *service;
702} krb5_verify_opt;
703
704#define KRB5_VERIFY_LREALMS 1
705#define KRB5_VERIFY_NO_ADDRESSES 2
706
707#define KRB5_KPASSWD_VERS_CHANGEPW 1
708#define KRB5_KPASSWD_VERS_SETPW 0xff80
709
710#define KRB5_KPASSWD_SUCCESS 0
711#define KRB5_KPASSWD_MALFORMED 1
712#define KRB5_KPASSWD_HARDERROR 2
713#define KRB5_KPASSWD_AUTHERROR 3
714#define KRB5_KPASSWD_SOFTERROR 4
715#define KRB5_KPASSWD_ACCESSDENIED 5
716#define KRB5_KPASSWD_BAD_VERSION 6
717#define KRB5_KPASSWD_INITIAL_FLAG_NEEDED 7
718
719#define KPASSWD_PORT 464
720
721/* types for the new krbhst interface */
722struct krb5_krbhst_data;
723typedef struct krb5_krbhst_data *krb5_krbhst_handle;
724
725#define KRB5_KRBHST_KDC 1
726#define KRB5_KRBHST_ADMIN 2
727#define KRB5_KRBHST_CHANGEPW 3
728#define KRB5_KRBHST_KRB524 4
729#define KRB5_KRBHST_KCA 5
730
731typedef struct krb5_krbhst_info {
732 enum { KRB5_KRBHST_UDP,
733 KRB5_KRBHST_TCP,
734 KRB5_KRBHST_HTTP } proto;
735 unsigned short port;
736 unsigned short def_port;
737 struct addrinfo *ai;
738 struct krb5_krbhst_info *next;
739 char hostname[1]; /* has to come last */
740} krb5_krbhst_info;
741
742/* flags for krb5_krbhst_init_flags (and krb5_send_to_kdc_flags) */
743enum {
744 KRB5_KRBHST_FLAGS_MASTER = 1,
745 KRB5_KRBHST_FLAGS_LARGE_MSG = 2
746};
747
748typedef krb5_error_code (*krb5_send_to_kdc_func)(krb5_context,
749 void *,
750 krb5_krbhst_info *,
751 time_t,
752 const krb5_data *,
753 krb5_data *);
754
755/** flags for krb5_parse_name_flags */
756enum {
757 KRB5_PRINCIPAL_PARSE_NO_REALM = 1, /**< Require that there are no realm */
758 KRB5_PRINCIPAL_PARSE_REQUIRE_REALM = 2, /**< Require a realm present */
759 KRB5_PRINCIPAL_PARSE_ENTERPRISE = 4 /**< Parse as a NT-ENTERPRISE name */
760};
761
762/** flags for krb5_unparse_name_flags */
763enum {
764 KRB5_PRINCIPAL_UNPARSE_SHORT = 1, /**< No realm if it is the default realm */
765 KRB5_PRINCIPAL_UNPARSE_NO_REALM = 2, /**< No realm */
766 KRB5_PRINCIPAL_UNPARSE_DISPLAY = 4 /**< No quoting */
767};
768
769typedef struct krb5_sendto_ctx_data *krb5_sendto_ctx;
770
771#define KRB5_SENDTO_DONE 0
772#define KRB5_SENDTO_RESTART 1
773#define KRB5_SENDTO_CONTINUE 2
774
775typedef krb5_error_code (*krb5_sendto_ctx_func)(krb5_context, krb5_sendto_ctx, void *, const krb5_data *, int *);
776
777struct krb5_plugin;
778enum krb5_plugin_type {
779 PLUGIN_TYPE_DATA = 1,
780 PLUGIN_TYPE_FUNC
781};
782
783struct credentials; /* this is to keep the compiler happy */
784struct getargs;
785struct sockaddr;
786
787/**
788 * Semi private, not stable yet
789 */
790
791typedef struct krb5_crypto_iov {
792 unsigned int flags;
793 /* ignored */
794#define KRB5_CRYPTO_TYPE_EMPTY 0
795 /* OUT krb5_crypto_length(KRB5_CRYPTO_TYPE_HEADER) */
796#define KRB5_CRYPTO_TYPE_HEADER 1
797 /* IN and OUT */
798#define KRB5_CRYPTO_TYPE_DATA 2
799 /* IN */
800#define KRB5_CRYPTO_TYPE_SIGN_ONLY 3
801 /* (only for encryption) OUT krb5_crypto_length(KRB5_CRYPTO_TYPE_TRAILER) */
802#define KRB5_CRYPTO_TYPE_PADDING 4
803 /* OUT krb5_crypto_length(KRB5_CRYPTO_TYPE_TRAILER) */
804#define KRB5_CRYPTO_TYPE_TRAILER 5
805 /* OUT krb5_crypto_length(KRB5_CRYPTO_TYPE_CHECKSUM) */
806#define KRB5_CRYPTO_TYPE_CHECKSUM 6
807 krb5_data data;
808} krb5_crypto_iov;
809
810
811/* Glue for MIT */
812
813typedef struct {
814 int32_t lr_type;
815 krb5_timestamp value;
816} krb5_last_req_entry;
817
818typedef krb5_error_code
819(*krb5_gic_process_last_req)(krb5_context, krb5_last_req_entry **, void *);
820
821/*
822 *
823 */
824
825#include <krb5-protos.h>
826
827/* variables */
828
829extern KRB5_LIB_VARIABLE const char *krb5_config_file;
830extern KRB5_LIB_VARIABLE const char *krb5_defkeyname;
831
832
833extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_acc_ops;
834extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_fcc_ops;
835extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_mcc_ops;
836extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_kcm_ops;
837extern KRB5_LIB_VARIABLE const krb5_cc_ops krb5_scc_ops;
838
839extern KRB5_LIB_VARIABLE const krb5_kt_ops krb5_fkt_ops;
840extern KRB5_LIB_VARIABLE const krb5_kt_ops krb5_wrfkt_ops;
841extern KRB5_LIB_VARIABLE const krb5_kt_ops krb5_javakt_ops;
842extern KRB5_LIB_VARIABLE const krb5_kt_ops krb5_mkt_ops;
843extern KRB5_LIB_VARIABLE const krb5_kt_ops krb5_akf_ops;
844extern KRB5_LIB_VARIABLE const krb5_kt_ops krb4_fkt_ops;
845extern KRB5_LIB_VARIABLE const krb5_kt_ops krb5_srvtab_fkt_ops;
846extern KRB5_LIB_VARIABLE const krb5_kt_ops krb5_any_ops;
847
848extern KRB5_LIB_VARIABLE const char *krb5_cc_type_api;
849extern KRB5_LIB_VARIABLE const char *krb5_cc_type_file;
850extern KRB5_LIB_VARIABLE const char *krb5_cc_type_memory;
851extern KRB5_LIB_VARIABLE const char *krb5_cc_type_kcm;
852extern KRB5_LIB_VARIABLE const char *krb5_cc_type_scc;
853
854#endif /* __KRB5_H__ */
855
Note: See TracBrowser for help on using the repository browser.