src/plugins/preauth/pkinit/pkinit_trace.h

   1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
   2 /* plugins/preauth/pkinit/pkinit_trace.h - PKINIT tracing macros */
   3 /*
   4  * Copyright (C) 2012 by the Massachusetts Institute of Technology.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * * Redistributions of source code must retain the above copyright
  12  *   notice, this list of conditions and the following disclaimer.
  13  *
  14  * * Redistributions in binary form must reproduce the above copyright
  15  *   notice, this list of conditions and the following disclaimer in
  16  *   the documentation and/or other materials provided with the
  17  *   distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  23  * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
  24  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  25  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  26  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  28  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  30  * OF THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #ifndef PKINIT_TRACE_H
  34 #define PKINIT_TRACE_H
  35
  36 #include "k5-trace.h"
  37
  38 #define TRACE_PKINIT_CLIENT_EKU_ACCEPT(c)                       \
  39     TRACE(c, "PKINIT client found acceptable EKU in KDC cert")
  40 #define TRACE_PKINIT_CLIENT_EKU_REJECT(c)                               \
  41     TRACE(c, "PKINIT client found no acceptable EKU in KDC cert")
  42 #define TRACE_PKINIT_CLIENT_EKU_SKIP(c)                                 \
  43     TRACE(c, "PKINIT client skipping EKU check due to configuration")
  44 #define TRACE_PKINIT_CLIENT_KDF_ALG(c, kdf, keyblock)                   \
  45     TRACE(c, "PKINIT client used KDF {hexdata} to compute reply key "   \
  46           "{keyblock}", kdf, keyblock)
  47 #define TRACE_PKINIT_CLIENT_KDF_OS2K(c, keyblock)                       \
  48     TRACE(c, "PKINIT client used octetstring2key to compute reply key " \
  49           "{keyblock}", keyblock)
  50 #define TRACE_PKINIT_CLIENT_NO_IDENTITY(c)                              \
  51     TRACE(c, "PKINIT client has no configured identity; giving up")
  52 #define TRACE_PKINIT_CLIENT_REP_CHECKSUM_FAIL(c, expected, received)    \
  53     TRACE(c, "PKINIT client checksum mismatch: expected {cksum}, "      \
  54           "received {cksum}", expected, received)
  55 #define TRACE_PKINIT_CLIENT_REP_DH(c)                   \
  56     TRACE(c, "PKINIT client verified DH reply")
  57 #define TRACE_PKINIT_CLIENT_REP_DH_FAIL(c)              \
  58     TRACE(c, "PKINIT client could not verify DH reply")
  59 #define TRACE_PKINIT_CLIENT_REP_RSA(c)                  \
  60     TRACE(c, "PKINIT client verified RSA reply")
  61 #define TRACE_PKINIT_CLIENT_REP_RSA_KEY(c, keyblock, cksum)             \
  62     TRACE(c, "PKINIT client retrieved reply key {keyblock} from RSA "   \
  63           "reply (checksum {cksum})", keyblock, cksum)
  64 #define TRACE_PKINIT_CLIENT_REP_RSA_FAIL(c)                     \
  65     TRACE(c, "PKINIT client could not verify RSA reply")
  66 #define TRACE_PKINIT_CLIENT_REQ_CHECKSUM(c, cksum)                      \
  67     TRACE(c, "PKINIT client computed kdc-req-body checksum {cksum}", cksum)
  68 #define TRACE_PKINIT_CLIENT_REQ_DH(c)                           \
  69     TRACE(c, "PKINIT client making DH request")
  70 #define TRACE_PKINIT_CLIENT_REQ_RSA(c)                  \
  71     TRACE(c, "PKINIT client making RSA request")
  72 #define TRACE_PKINIT_CLIENT_SAN_CONFIG_DNSNAME(c, host)                 \
  73     TRACE(c, "PKINIT client config accepts KDC dNSName SAN {string}", host)
  74 #define TRACE_PKINIT_CLIENT_SAN_MATCH_DNSNAME(c, host)                  \
  75     TRACE(c, "PKINIT client matched KDC hostname {string} against "     \
  76           "dNSName SAN; EKU check still required", host)
  77 #define TRACE_PKINIT_CLIENT_SAN_MATCH_NONE(c)                           \
  78     TRACE(c, "PKINIT client found no acceptable SAN in KDC cert")
  79 #define TRACE_PKINIT_CLIENT_SAN_MATCH_PRINC(c, princ)                   \
  80     TRACE(c, "PKINIT client matched KDC principal {princ} against "     \
  81           "id-pkinit-san; no EKU check required", princ)
  82 #define TRACE_PKINIT_CLIENT_SAN_ERR(c)                          \
  83     TRACE(c, "PKINIT client failed to decode SANs in KDC cert")
  84 #define TRACE_PKINIT_CLIENT_SAN_KDCCERT_DNSNAME(c, host)                \
  85     TRACE(c, "PKINIT client found dNSName SAN in KDC cert: {string}", host)
  86 #define TRACE_PKINIT_CLIENT_SAN_KDCCERT_PRINC(c, princ)                 \
  87     TRACE(c, "PKINIT client found id-pkinit-san in KDC cert: {princ}", princ)
  88 #define TRACE_PKINIT_CLIENT_TRYAGAIN(c)                                 \
  89     TRACE(c, "PKINIT client trying again with KDC-provided parameters")
  90 #endif /* PKINIT_TRACE_H */