Castling may be performed in one of two directions — toward the h-file, which is called kingside castling or short castling, or toward the a-file, which is called queenside castling or long castling. The king must not have previously moved, and the rook involved (either the h-file rook or the a-file rook) must also not have previously moved.
There must be no pieces between the king and the rook in the chosen direction. For short castling, this means the f1 and g1 squares (for white) or the f8 and g8 squares (for black) must be empty. For long castling, the b1, c1, and d1 squares (for white) or the b8, c8, and d8 squares (for black) must be empty.
To execute the castling move, first the king is moved along the rank two squares in the chosen direction. Then the rook on that side is moved the opposite direction and placed just on the other side of the king. For short castling this means the king moves from the e-file to the g-file and the rook moves from the h-file to the f-file. For long castling this means the king moves from the e-file to the c-file and the rook moves from the a-file to the d-file.
In this diagram, White is castling short (with the h-file rook) and Black is castling long (with the a-file rook). Note how in each case the king moves two squares toward the edge, and the rook moves toward the center to the other side of the king.
You cannot castle if you are currently in check, so castling cannot be used to escape from an attack on the king. You also cannot castle if the square your king would "pass through" while castling is under attack. This is probably the rule that confuses the most players. So if you are White, you can't castle short if the f1 square is currently attacked, and you can't castle long if the d1-square is currently attacked. For Black these would be the f8 or d8 squares. And, like any other move in chess, you can't end up in check when your move is over. So the square the king ends on (either c1 or g1 for White, c8 or g8 for Black) cannot be under attack either.
This diagram shows the danger squares (the squares which cannot be under attack from any enemy piece) for castling in either direction — short for White and long for Black. Each square that is marked with an "X" must be free from attack. Note that this includes the king's starting square, the king's finishing square, and the square in between. Note also that the rook is not marked, it doesn't matter if it is under attack or not. It's a common misconception that the rook cannot be under attack or pass through attack, but as you can see that is not true. Only the three squares that are touched by the king itself are restricted.
You may occasionally see a rule saying something like "the rook cannot end up under attack" or similar. This is really trying to say the same thing as "the king cannot pass through check" (note that the square the king passes through is the same square the rook ends up on). While well-intentioned, wording the rule this way has probably caused more confusion and is likely the reason many players mistakenly believe the rook can't be exposed to attack when castling.
Here's a concise summary of when you can and can't castle: