get_init_creds_opt extensibility

 r18922@cathode-dark-space:  coffman | 2006-12-04 18:30:15 -0500
 First cut at making the get_init_creds_opt structure extendable
 and adding library functions to set options for preauthentication
 plugins.
 
 This does *not* include a compatibility function to work like
 Heimdal's krb5_get_init_creds_opt_set_pkinit() function.
 
 Hopefully, the test code that doesn't belong in kinit.c is
 obvious.
 
 
 r18929@cathode-dark-space:  coffman | 2006-12-07 10:01:20 -0500
 Remove extra "user_id" parameter.
 
 Add function which duplicates the Heimdal interface (if we can agree on
 what the matching attribute names should be).
 
 r18934@cathode-dark-space:  coffman | 2006-12-08 15:28:03 -0500
 Update to use the simplified interface for krb5_get_init_creds_opt_set_pa()
 
 Add code in kinit to process "-X" options as preauth options and pass
 them along.
 
 
 
 r18936@cathode-dark-space:  coffman | 2006-12-11 12:04:26 -0500
 Move prototypes for get_init_creds_opt_get_pa() and
 krb5_get_init_creds_opt_free_pa() into the
 preauth_plugin.h header rather than krb5.hin.
 
 

ticket: new
status: open
component: krb5-libs

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19127 dc483132-0cff-0310-8789-dd5450dbe970

3 files changed, 157 insertions, 7 deletions

diff --git a/src/include/k5-int.h b/src/include/k5-int.h
index ac4bb62d2..21b0f4d01 100644
--- a/src/include/k5-int.h
+++ b/src/include/k5-int.h
@@ -876,6 +876,7 @@ typedef struct _krb5_preauth_context {
 	krb5_error_code (*client_process)(krb5_context context,
 					  void *plugin_context,
 					  void *request_context,
+					  krb5_get_init_creds_opt *opt,
 					  preauth_get_client_data_proc get_data_proc,
 					  krb5_preauth_client_rock *rock,
 					  krb5_kdc_req *request,
@@ -893,6 +894,7 @@ typedef struct _krb5_preauth_context {
 	krb5_error_code (*client_tryagain)(krb5_context context,
 					   void *plugin_context,
 					   void *request_context,
+					   krb5_get_init_creds_opt *opt,
 					   preauth_get_client_data_proc get_data_proc,
 					   krb5_preauth_client_rock *rock,
 					   krb5_kdc_req *request,
@@ -908,6 +910,7 @@ typedef struct _krb5_preauth_context {
 					   krb5_data *s2kparams,
 					   krb5_keyblock *as_key,
 					   krb5_pa_data **new_pa_data);
+	supply_gic_opts_proc client_supply_gic_opts;
 	void (*client_req_init)(krb5_context context, void *plugin_context,
 			       void **request_context);
 	void (*client_req_fini)(krb5_context context, void *plugin_context,
@@ -1014,6 +1017,74 @@ void krb5_free_etype_info
 /*
  * End "preauth.h"
  */
+
+/*
+ * Extending the krb5_get_init_creds_opt structure.  The original
+ * krb5_get_init_creds_opt structure is defined publicly.  The
+ * new extended version is private.  The original interface
+ * assumed a pre-allocated structure which was passed to
+ * krb5_get_init_creds_init().  The new interface assumes that
+ * the caller will call krb5_get_init_creds_alloc() and
+ * krb5_get_init_creds_free().
+ *
+ * Callers MUST NOT call krb5_get_init_creds_init() after allocating an
+ * opts structure using krb5_get_init_creds_alloc().  To do so will
+ * introduce memory leaks.  Unfortunately, there is no way to enforce
+ * this behavior.
+ *
+ * Two private flags are added for backward compatibility.
+ * KRB5_GET_INIT_CREDS_OPT_EXTENDED says that the structure was allocated
+ * with the new krb5_get_init_creds_opt_alloc() function.
+ * KRB5_GET_INIT_CREDS_OPT_SHADOWED is set to indicate that the extended
+ * structure is a shadow copy of an original krb5_get_init_creds_opt
+ * structure.  
+ * If KRB5_GET_INIT_CREDS_OPT_SHADOWED is set after a call to
+ * krb5int_gic_opt_to_opte(), the resulting extended structure should be
+ * freed (using krb5_get_init_creds_free).  Otherwise, the original
+ * structure was already extended and there is no need to free it.
+ */
+
+#define KRB5_GET_INIT_CREDS_OPT_EXTENDED 0x80000000
+#define KRB5_GET_INIT_CREDS_OPT_SHADOWED 0x40000000
+
+#define krb5_gic_opt_is_extended(s) \
+    (((s)->flags & KRB5_GET_INIT_CREDS_OPT_EXTENDED) ? 1 : 0)
+#define krb5_gic_opt_is_shadowed(s) \
+    (((s)->flags & KRB5_GET_INIT_CREDS_OPT_SHADOWED) ? 1 : 0)
+
+
+typedef struct _krb5_gic_opt_private {
+    int num_preauth_data;
+    krb5_gic_opt_pa_data *preauth_data;
+} krb5_gic_opt_private;
+
+typedef struct _krb5_gic_opt_ext {
+    krb5_flags flags;
+    krb5_deltat tkt_life;
+    krb5_deltat renew_life;
+    int forwardable;
+    int proxiable;
+    krb5_enctype *etype_list;
+    int etype_list_length;
+    krb5_address **address_list;
+    krb5_preauthtype *preauth_list;
+    int preauth_list_length;
+    krb5_data *salt;
+    /*
+     * Do not change anything above this point in this structure.
+     * It is identical to the public krb5_get_init_creds_opt structure.
+     * New members must be added below.
+     */
+    krb5_gic_opt_private *opt_private;
+} krb5_gic_opt_ext;
+
+krb5_error_code
+krb5int_gic_opt_to_opte(krb5_context context,
+                        krb5_get_init_creds_opt *opt,
+                        krb5_gic_opt_ext **opte,
+                        unsigned int force,
+                        const char *where);
+
 krb5_error_code
 krb5int_copy_data_contents (krb5_context, const krb5_data *, krb5_data *);
 
@@ -1040,14 +1111,14 @@ krb5_get_init_creds
 		void *prompter_data,
 		krb5_deltat start_time,
 		char *in_tkt_service,
-		krb5_get_init_creds_opt *gic_options,
+		krb5_gic_opt_ext *gic_options,
 		krb5_gic_get_as_key_fct gak,
 		void *gak_data,
 		int *master,
 		krb5_kdc_rep **as_reply);
 
-void krb5int_populate_gic_opt (
-    krb5_context, krb5_get_init_creds_opt *,
+krb5_error_code krb5int_populate_gic_opt (
+    krb5_context, krb5_gic_opt_ext **,
     krb5_flags options, krb5_address * const *addrs, krb5_enctype *ktypes,
     krb5_preauthtype *pre_auth_types, krb5_creds *creds);
 
@@ -1062,7 +1133,8 @@ krb5_error_code KRB5_CALLCONV krb5_do_preauth
 	 krb5_enctype *etype, krb5_keyblock *as_key,
 	 krb5_prompter_fct prompter, void *prompter_data,
 	 krb5_gic_get_as_key_fct gak_fct, void *gak_data,
-	 krb5_preauth_client_rock *get_data_rock);
+	 krb5_preauth_client_rock *get_data_rock,
+	 krb5_gic_opt_ext *opte);
 krb5_error_code KRB5_CALLCONV krb5_do_preauth_tryagain
 	(krb5_context context,
 	 krb5_kdc_req *request,
@@ -1074,7 +1146,8 @@ krb5_error_code KRB5_CALLCONV krb5_do_preauth_tryagain
 	 krb5_enctype *etype, krb5_keyblock *as_key,
 	 krb5_prompter_fct prompter, void *prompter_data,
 	 krb5_gic_get_as_key_fct gak_fct, void *gak_data,
-	 krb5_preauth_client_rock *get_data_rock);
+	 krb5_preauth_client_rock *get_data_rock,
+	 krb5_gic_opt_ext *opte);
 void KRB5_CALLCONV krb5_init_preauth_context
 	(krb5_context);
 void KRB5_CALLCONV krb5_free_preauth_context
@@ -1082,7 +1155,7 @@ void KRB5_CALLCONV krb5_free_preauth_context
 void KRB5_CALLCONV krb5_clear_preauth_context_use_counts
 	(krb5_context);
 void KRB5_CALLCONV krb5_preauth_prepare_request
-	(krb5_context, krb5_get_init_creds_opt *, krb5_kdc_req *);
+	(krb5_context, krb5_gic_opt_ext *, krb5_kdc_req *);
 void KRB5_CALLCONV krb5_preauth_request_context_init
 	(krb5_context);
 void KRB5_CALLCONV krb5_preauth_request_context_fini
diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
index 1c5f15738..ff0a31be7 100644
--- a/src/include/krb5/krb5.hin
+++ b/src/include/krb5/krb5.hin
@@ -2081,6 +2081,16 @@ typedef struct _krb5_get_init_creds_opt {
 #define KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT	0x0100
 
 
+krb5_error_code KRB5_CALLCONV
+krb5_get_init_creds_opt_alloc
+(krb5_context context,
+		krb5_get_init_creds_opt **opt);
+
+void KRB5_CALLCONV
+krb5_get_init_creds_opt_free
+(krb5_context context,
+		krb5_get_init_creds_opt *opt);
+
 void KRB5_CALLCONV
 krb5_get_init_creds_opt_init
 (krb5_get_init_creds_opt *opt);
@@ -2132,6 +2142,27 @@ krb5_get_init_creds_opt_set_change_password_prompt
 (krb5_get_init_creds_opt *opt,
 		int prompt);
 
+/* Generic preauth option attribute/value pairs */
+typedef struct _krb5_gic_opt_pa_data {
+    char *attr;
+    char *value;
+} krb5_gic_opt_pa_data;
+
+/*
+ * This function allows the caller to supply options to preauth
+ * plugins.  Preauth plugin modules are given a chance to look
+ * at each option at the time this function is called in ordre
+ * to check the validity of the option.
+ * The 'opt' pointer supplied to this function must have been
+ * obtained using krb5_get_init_creds_opt_alloc()
+ */
+krb5_error_code KRB5_CALLCONV
+krb5_get_init_creds_opt_set_pa
+		(krb5_context context,
+		krb5_get_init_creds_opt *opt,
+		const char *attr,
+		const char *value);
+
 krb5_error_code KRB5_CALLCONV
 krb5_get_init_creds_password
 (krb5_context context,
diff --git a/src/include/krb5/preauth_plugin.h b/src/include/krb5/preauth_plugin.h
index f8a9db1a1..7243a00b1 100644
--- a/src/include/krb5/preauth_plugin.h
+++ b/src/include/krb5/preauth_plugin.h
@@ -158,6 +158,17 @@ typedef krb5_error_code
 			   void *gak_data);
 
 /*
+ * Client function which receives krb5_get_init_creds_opt information.
+ * The attr and value information supplied should be copied locally by
+ * the module if it wishes to reference it after returning from this call.
+ */
+typedef krb5_error_code
+(*supply_gic_opts_proc)(krb5_context context,
+			void *plugin_context,
+			krb5_get_init_creds_opt *opt,
+			const char *attr,
+			const char *value);
+/*
  * The function table / structure which a preauth client module must export as
  * "preauthentication_client_0".  If the interfaces work correctly, future
  * versions of the table will add either more callbacks or more arguments to
@@ -207,6 +218,7 @@ typedef struct krb5plugin_preauth_client_ftable_v0 {
     krb5_error_code (*process)(krb5_context context,
 			       void *plugin_context,
 			       void *request_context,
+			       krb5_get_init_creds_opt *opt,
 			       preauth_get_client_data_proc get_data_proc,
 			       struct _krb5_preauth_client_rock *rock,
 			       krb5_kdc_req *request,
@@ -227,8 +239,9 @@ typedef struct krb5plugin_preauth_client_ftable_v0 {
     krb5_error_code (*tryagain)(krb5_context context,
 				void *plugin_context,
 				void *request_context,
+				krb5_get_init_creds_opt *opt,
 				preauth_get_client_data_proc get_data_proc,
-			        struct _krb5_preauth_client_rock *rock,
+				struct _krb5_preauth_client_rock *rock,
 				krb5_kdc_req *request,
 				krb5_data *encoded_request_body,
 				krb5_data *encoded_previous_request,
@@ -241,6 +254,12 @@ typedef struct krb5plugin_preauth_client_ftable_v0 {
 				krb5_data *salt, krb5_data *s2kparams,
 				krb5_keyblock *as_key,
 				krb5_pa_data **out_pa_data);
+    /*
+     * Client function which receives krb5_get_init_creds_opt information.
+     * The attr and value information supplied should be copied locally by
+     * the module if it wishes to reference it after returning from this call.
+     */
+    supply_gic_opts_proc gic_opts;
 } krb5plugin_preauth_client_ftable_v0;
 
 /*
@@ -323,4 +342,31 @@ typedef struct krb5plugin_preauth_server_ftable_v0 {
    					      void *pa_module_context,
 					      void **request_pa_context);
 } krb5plugin_preauth_server_ftable_v0;
+
+
+/*
+ * This function allows a preauth plugin to obtain preauth
+ * options.  The preauth_data returned from this function
+ * should be freed by calling krb5_get_init_creds_opt_free_pa().
+ *
+ * The 'opt' pointer supplied to this function must have been
+ * obtained using krb5_get_init_creds_opt_alloc()
+ */
+krb5_error_code KRB5_CALLCONV
+krb5_get_init_creds_opt_get_pa
+		(krb5_context context,
+		krb5_get_init_creds_opt *opt,
+		int *num_preauth_data,
+		krb5_gic_opt_pa_data **preauth_data);
+
+/*
+ * This function frees the preauth_data that was returned by
+ * krb5_get_init_creds_opt_get_pa().
+ */
+void KRB5_CALLCONV
+krb5_get_init_creds_opt_free_pa
+		(krb5_context context,
+		 int num_preauth_data,
+		 krb5_gic_opt_pa_data *preauth_data);
+
 #endif /* KRB5_PREAUTH_PLUGIN_H_INCLUDED */