Edit File by line

/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */

[0] Fix | Delete

/* include/krb5/certauth_plugin.h - certauth plugin header. */

[1] Fix | Delete

[2] Fix | Delete

[3] Fix | Delete

[4] Fix | Delete

[5] Fix | Delete

* Redistribution and use in source and binary forms, with or without

[6] Fix | Delete

* modification, are permitted provided that the following conditions

[7] Fix | Delete

* are met:

[8] Fix | Delete

[9] Fix | Delete

* * Redistributions of source code must retain the above copyright

[10] Fix | Delete

* notice, this list of conditions and the following disclaimer.

[11] Fix | Delete

[12] Fix | Delete

* * Redistributions in binary form must reproduce the above copyright

[13] Fix | Delete

* notice, this list of conditions and the following disclaimer in

[14] Fix | Delete

* the documentation and/or other materials provided with the

[15] Fix | Delete

* distribution.

[16] Fix | Delete

[17] Fix | Delete

* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

[18] Fix | Delete

* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

[19] Fix | Delete

* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS

[20] Fix | Delete

* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

[21] Fix | Delete

* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,

[22] Fix | Delete

* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

[23] Fix | Delete

* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

[24] Fix | Delete

* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

[25] Fix | Delete

* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

[26] Fix | Delete

* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

[27] Fix | Delete

* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

[28] Fix | Delete

* OF THE POSSIBILITY OF SUCH DAMAGE.

[29] Fix | Delete

[30] Fix | Delete

[31] Fix | Delete

[32] Fix | Delete

* Declarations for certauth plugin module implementors.

[33] Fix | Delete

[34] Fix | Delete

* The certauth pluggable interface currently has only one supported major

[35] Fix | Delete

* version, which is 1. Major version 1 has a current minor version number of

[36] Fix | Delete

* 1.

[37] Fix | Delete

[38] Fix | Delete

* certauth plugin modules should define a function named

[39] Fix | Delete

* certauth_<modulename>_initvt, matching the signature:

[40] Fix | Delete

[41] Fix | Delete

* krb5_error_code

[42] Fix | Delete

* certauth_modname_initvt(krb5_context context, int maj_ver, int min_ver,

[43] Fix | Delete

* krb5_plugin_vtable vtable);

[44] Fix | Delete

[45] Fix | Delete

* The initvt function should:

[46] Fix | Delete

[47] Fix | Delete

* - Check that the supplied maj_ver number is supported by the module, or

[48] Fix | Delete

* return KRB5_PLUGIN_VER_NOTSUPP if it is not.

[49] Fix | Delete

[50] Fix | Delete

* - Cast the vtable pointer as appropriate for maj_ver:

[51] Fix | Delete

* maj_ver == 1: Cast to krb5_certauth_vtable

[52] Fix | Delete

[53] Fix | Delete

* - Initialize the methods of the vtable, stopping as appropriate for the

[54] Fix | Delete

* supplied min_ver. Optional methods may be left uninitialized.

[55] Fix | Delete

[56] Fix | Delete

* Memory for the vtable is allocated by the caller, not by the module.

[57] Fix | Delete

[58] Fix | Delete

[59] Fix | Delete

#ifndef KRB5_CERTAUTH_PLUGIN_H

[60] Fix | Delete

#define KRB5_CERTAUTH_PLUGIN_H

[61] Fix | Delete

[62] Fix | Delete

#include <krb5/krb5.h>

[63] Fix | Delete

#include <krb5/plugin.h>

[64] Fix | Delete

[65] Fix | Delete

/* Abstract module data type. */

[66] Fix | Delete

typedef struct krb5_certauth_moddata_st *krb5_certauth_moddata;

[67] Fix | Delete

[68] Fix | Delete

/* A module can optionally include <kdb.h> to inspect the client principal

[69] Fix | Delete

* entry when authorizing a request. */

[70] Fix | Delete

struct _krb5_db_entry_new;

[71] Fix | Delete

[72] Fix | Delete

[73] Fix | Delete

* Optional: Initialize module data.

[74] Fix | Delete

[75] Fix | Delete

typedef krb5_error_code

[76] Fix | Delete

(*krb5_certauth_init_fn)(krb5_context context,

[77] Fix | Delete

krb5_certauth_moddata *moddata_out);

[78] Fix | Delete

[79] Fix | Delete

[80] Fix | Delete

* Optional: Clean up the module data.

[81] Fix | Delete

[82] Fix | Delete

typedef void

[83] Fix | Delete

(*krb5_certauth_fini_fn)(krb5_context context, krb5_certauth_moddata moddata);

[84] Fix | Delete

[85] Fix | Delete

[86] Fix | Delete

* Mandatory: return 0 or KRB5_CERTAUTH_HWAUTH if the DER-encoded cert is

[87] Fix | Delete

* authorized for PKINIT authentication by princ; otherwise return one of the

[88] Fix | Delete

* following error codes:

[89] Fix | Delete

* - KRB5KDC_ERR_CLIENT_NAME_MISMATCH - incorrect SAN value

[90] Fix | Delete

* - KRB5KDC_ERR_INCONSISTENT_KEY_PURPOSE - incorrect EKU

[91] Fix | Delete

* - KRB5KDC_ERR_CERTIFICATE_MISMATCH - other extension error

[92] Fix | Delete

* - KRB5_PLUGIN_NO_HANDLE - the module has no opinion about cert

[93] Fix | Delete

[94] Fix | Delete

* Returning KRB5_CERTAUTH_HWAUTH will cause the hw-authent flag to be set in

[95] Fix | Delete

* the issued ticket (new in release 1.19).

[96] Fix | Delete

[97] Fix | Delete

* - opts is used by built-in modules to receive internal data, and must be

[98] Fix | Delete

* ignored by other modules.

[99] Fix | Delete

* - db_entry receives the client principal database entry, and can be ignored

[100] Fix | Delete

* by modules that do not link with libkdb5.

[101] Fix | Delete

* - *authinds_out optionally returns a null-terminated list of authentication

[102] Fix | Delete

* indicator strings upon KRB5_PLUGIN_NO_HANDLE or accepted authorization.

[103] Fix | Delete

[104] Fix | Delete

typedef krb5_error_code

[105] Fix | Delete

(*krb5_certauth_authorize_fn)(krb5_context context,

[106] Fix | Delete

krb5_certauth_moddata moddata,

[107] Fix | Delete

const uint8_t *cert, size_t cert_len,

[108] Fix | Delete

krb5_const_principal princ, const void *opts,

[109] Fix | Delete

const struct _krb5_db_entry_new *db_entry,

[110] Fix | Delete

char ***authinds_out);

[111] Fix | Delete

[112] Fix | Delete

[113] Fix | Delete

* Free indicators allocated by a module. Mandatory if authorize returns

[114] Fix | Delete

* authentication indicators.

[115] Fix | Delete

[116] Fix | Delete

typedef void

[117] Fix | Delete

(*krb5_certauth_free_indicator_fn)(krb5_context context,

[118] Fix | Delete

krb5_certauth_moddata moddata,

[119] Fix | Delete

char **authinds);

[120] Fix | Delete

[121] Fix | Delete

typedef struct krb5_certauth_vtable_st {

[122] Fix | Delete

const char *name;

[123] Fix | Delete

krb5_certauth_init_fn init;

[124] Fix | Delete

krb5_certauth_fini_fn fini;

[125] Fix | Delete

krb5_certauth_authorize_fn authorize;

[126] Fix | Delete

krb5_certauth_free_indicator_fn free_ind;

[127] Fix | Delete

} *krb5_certauth_vtable;

[128] Fix | Delete

[129] Fix | Delete

#endif /* KRB5_CERTAUTH_PLUGIN_H */

[130] Fix | Delete

[131] Fix | Delete