helpers/negotiate_auth/kerberos/negotiate_kerberos.h

   1 /*
   2  * -----------------------------------------------------------------------------
   3  *
   4  * Author: Markus Moeller (markus_moeller at compuserve.com)
   5  *
   6  * Copyright (C) 2013 Markus Moeller. All rights reserved.
   7  *
   8  *   This program is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU General Public License as published by
  10  *   the Free Software Foundation; either version 2 of the License, or
  11  *   (at your option) any later version.
  12  *
  13  *   This program is distributed in the hope that it will be useful,
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *   GNU General Public License for more details.
  17  *
  18  *   You should have received a copy of the GNU General Public License
  19  *   along with this program; if not, write to the Free Software
  20  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
  21  *
  22  *   As a special exemption, M Moeller gives permission to link this program
  23  *   with MIT, Heimdal or other GSS/Kerberos libraries, and distribute
  24  *   the resulting executable, without including the source code for
  25  *   the Libraries in the source distribution.
  26  *
  27  * -----------------------------------------------------------------------------
  28  */
  29
  30 #include <cstring>
  31 #include <ctime>
  32 #if HAVE_NETDB_H
  33 #include <netdb.h>
  34 #endif
  35 #if HAVE_UNISTD_H
  36 #include <unistd.h>
  37 #endif
  38
  39 #include "base64.h"
  40 #include "util.h"
  41
  42 #if HAVE_KRB5_H
  43 #if HAVE_BROKEN_SOLARIS_KRB5_H
  44 #warn "Warning! You have a broken Solaris <krb5.h> system header"
  45 #warn "http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6837512"
  46 #if defined(__cplusplus)
  47 #define KRB5INT_BEGIN_DECLS     extern "C" {
  48 #define KRB5INT_END_DECLS
  49 KRB5INT_BEGIN_DECLS
  50 #endif
  51 #endif /* HAVE_BROKEN_SOLARIS_KRB5_H */
  52 #if HAVE_BROKEN_HEIMDAL_KRB5_H
  53 extern "C" {
  54 #include <krb5.h>
  55 }
  56 #else
  57 #include <krb5.h>
  58 #endif
  59 #endif /* HAVE_KRB5_H */
  60
  61 #if HAVE_GSSAPI_GSSAPI_H
  62 #include <gssapi/gssapi.h>
  63 #elif HAVE_GSSAPI_H
  64 #include <gssapi.h>
  65 #endif
  66
  67 #if !HAVE_HEIMDAL_KERBEROS
  68 #if HAVE_GSSAPI_GSSAPI_KRB5_H
  69 #include <gssapi/gssapi_krb5.h>
  70 #endif
  71 #if HAVE_GSSAPI_GSSAPI_GENERIC_H
  72 #include <gssapi/gssapi_generic.h>
  73 #endif
  74 #if HAVE_GSSAPI_GSSAPI_EXT_H
  75 #include <gssapi/gssapi_ext.h>
  76 #endif
  77 #else
  78 #if HAVE_GSSAPI_GSSAPI_KRB5_H
  79 #include <gssapi/gssapi_krb5.h>
  80 #endif
  81 #endif
  82
  83 #ifndef gss_nt_service_name
  84 #define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
  85 #endif
  86
  87 #define PROGRAM "negotiate_kerberos_auth"
  88
  89 #ifndef MAX_AUTHTOKEN_LEN
  90 #define MAX_AUTHTOKEN_LEN   65535
  91 #endif
  92 #ifndef SQUID_KERB_AUTH_VERSION
  93 #define SQUID_KERB_AUTH_VERSION "3.0.4sq"
  94 #endif
  95
  96 char *gethost_name(void);
  97
  98 static const unsigned char ntlmProtocol[] = {'N', 'T', 'L', 'M', 'S', 'S', 'P', 0};
  99
 100 inline const char *
 101 LogTime()
 102 {
 103     struct tm *tm;
 104     struct timeval now;
 105     static time_t last_t = 0;
 106     static char buf[128];
 107
 108     gettimeofday(&now, NULL);
 109     if (now.tv_sec != last_t) {
 110         tm = localtime((time_t *) & now.tv_sec);
 111         strftime(buf, 127, "%Y/%m/%d %H:%M:%S", tm);
 112         last_t = now.tv_sec;
 113     }
 114     return buf;
 115 }
 116
 117 int check_gss_err(OM_uint32 major_status, OM_uint32 minor_status,
 118                   const char *function, int log, int sout);
 119
 120 char *gethost_name(void);
 121
 122 #if (defined(HAVE_GSSKRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT) || defined(HAVE_GSS_MAP_NAME_TO_ANY)) && HAVE_KRB5_PAC
 123 #define HAVE_PAC_SUPPORT 1
 124 #define MAX_PAC_GROUP_SIZE 200*60
 125 typedef struct {
 126     uint16_t length;
 127     uint16_t maxlength;
 128     uint32_t pointer;
 129 } RPC_UNICODE_STRING;
 130
 131 int check_k5_err(krb5_context context, const char *msg, krb5_error_code code);
 132 void align(int n);
 133 void getustr(RPC_UNICODE_STRING *string);
 134 char **getgids(char **Rids, uint32_t GroupIds, uint32_t GroupCount);
 135 char *getdomaingids(char *ad_groups, uint32_t DomainLogonId, char **Rids, uint32_t  GroupCount);
 136 char *getextrasids(char *ad_groups, uint32_t ExtraSids, uint32_t SidCount);
 137 uint64_t get6byt_be(void);
 138 uint32_t get4byt(void);
 139 uint16_t get2byt(void);
 140 uint8_t get1byt(void);
 141 char *xstrcpy( char *src, const char*dst);
 142 char *xstrcat( char *src, const char*dst);
 143 int checkustr(RPC_UNICODE_STRING *string);
 144 char *get_ad_groups(char *ad_groups, krb5_context context, krb5_pac pac);
 145 #else
 146 #define HAVE_PAC_SUPPORT 0
 147 #endif