xref: /minix3/crypto/external/bsd/heimdal/dist/lib/hdb/hdb.h (revision 0a6a1f1d05b60e214de2f05a7310ddd1f0e590e7)
1 /*	$NetBSD: hdb.h,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
5  * (Royal Institute of Technology, Stockholm, Sweden).
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * 3. Neither the name of the Institute nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 
36 /* Id */
37 
38 #ifndef __HDB_H__
39 #define __HDB_H__
40 
41 #include <krb5/krb5.h>
42 
43 #include <krb5/hdb_err.h>
44 
45 #include <krb5/heim_asn1.h>
46 #include <krb5/hdb_asn1.h>
47 
48 struct hdb_dbinfo;
49 
50 enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
51 
52 /* flags for various functions */
53 #define HDB_F_DECRYPT		1	/* decrypt keys */
54 #define HDB_F_REPLACE		2	/* replace entry */
55 #define HDB_F_GET_CLIENT	4	/* fetch client */
56 #define HDB_F_GET_SERVER	8	/* fetch server */
57 #define HDB_F_GET_KRBTGT	16	/* fetch krbtgt */
58 #define HDB_F_GET_ANY		28	/* fetch any of client,server,krbtgt */
59 #define HDB_F_CANON		32	/* want canonicalition */
60 #define HDB_F_ADMIN_DATA	64	/* want data that kdc don't use  */
61 #define HDB_F_KVNO_SPECIFIED	128	/* we want a particular KVNO */
62 #define HDB_F_CURRENT_KVNO	256	/* we want the current KVNO */
63 /* 512, 1024, 2048 are reserved for kvno operations that is not part of the 1.5 branch */
64 #define HDB_F_ALL_KVNOS		2048	/* we want all the keys, live or not */
65 #define HDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */
66 #define HDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */
67 
68 /* hdb_capability_flags */
69 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
70 #define HDB_CAP_F_HANDLE_PASSWORDS	2
71 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS	4
72 
73 /* auth status values */
74 #define HDB_AUTH_SUCCESS		0
75 #define HDB_AUTH_WRONG_PASSWORD		1
76 #define HDB_AUTH_INVALID_SIGNATURE	2
77 
78 /* key usage for master key */
79 #define HDB_KU_MKEY	0x484442
80 
81 typedef struct hdb_master_key_data *hdb_master_key;
82 
83 /**
84  * hdb_entry_ex is a wrapper structure around the hdb_entry structure
85  * that allows backends to keep a pointer to the backing store, ie in
86  * ->hdb_fetch_kvno(), so that we the kadmin/kpasswd backend gets around to
87  * ->hdb_store(), the backend doesn't need to lookup the entry again.
88  */
89 
90 typedef struct hdb_entry_ex {
91     void *ctx;
92     hdb_entry entry;
93     void (*free_entry)(krb5_context, struct hdb_entry_ex *);
94 } hdb_entry_ex;
95 
96 
97 /**
98  * HDB backend function pointer structure
99  *
100  * The HDB structure is what the KDC and kadmind framework uses to
101  * query the backend database when talking about principals.
102  */
103 
104 typedef struct HDB{
105     void *hdb_db;
106     void *hdb_dbc; /** don't use, only for DB3 */
107     char *hdb_name;
108     int hdb_master_key_set;
109     hdb_master_key hdb_master_key;
110     int hdb_openp;
111     int hdb_capability_flags;
112     /**
113      * Open (or create) the a Kerberos database.
114      *
115      * Open (or create) the a Kerberos database that was resolved with
116      * hdb_create(). The third and fourth flag to the function are the
117      * same as open(), thus passing O_CREAT will create the data base
118      * if it doesn't exists.
119      *
120      * Then done the caller should call hdb_close(), and to release
121      * all resources hdb_destroy().
122      */
123     krb5_error_code (*hdb_open)(krb5_context, struct HDB*, int, mode_t);
124     /**
125      * Close the database for transaction
126      *
127      * Closes the database for further transactions, wont release any
128      * permanant resources. the database can be ->hdb_open-ed again.
129      */
130     krb5_error_code (*hdb_close)(krb5_context, struct HDB*);
131     /**
132      * Free an entry after use.
133      */
134     void	    (*hdb_free)(krb5_context, struct HDB*, hdb_entry_ex*);
135     /**
136      * Fetch an entry from the backend
137      *
138      * Fetch an entry from the backend, flags are what type of entry
139      * should be fetch: client, server, krbtgt.
140      * knvo (if specified and flags HDB_F_KVNO_SPECIFIED set) is the kvno to get
141      */
142     krb5_error_code (*hdb_fetch_kvno)(krb5_context, struct HDB*,
143 				      krb5_const_principal, unsigned, krb5_kvno,
144 				      hdb_entry_ex*);
145     /**
146      * Store an entry to database
147      */
148     krb5_error_code (*hdb_store)(krb5_context, struct HDB*,
149 				 unsigned, hdb_entry_ex*);
150     /**
151      * Remove an entry from the database.
152      */
153     krb5_error_code (*hdb_remove)(krb5_context, struct HDB*,
154 				  krb5_const_principal);
155     /**
156      * As part of iteration, fetch one entry
157      */
158     krb5_error_code (*hdb_firstkey)(krb5_context, struct HDB*,
159 				    unsigned, hdb_entry_ex*);
160     /**
161      * As part of iteration, fetch next entry
162      */
163     krb5_error_code (*hdb_nextkey)(krb5_context, struct HDB*,
164 				   unsigned, hdb_entry_ex*);
165     /**
166      * Lock database
167      *
168      * A lock can only be held by one consumers. Transaction can still
169      * happen on the database while the lock is held, so the entry is
170      * only useful for syncroning creation of the database and renaming of the database.
171      */
172     krb5_error_code (*hdb_lock)(krb5_context, struct HDB*, int);
173     /**
174      * Unlock database
175      */
176     krb5_error_code (*hdb_unlock)(krb5_context, struct HDB*);
177     /**
178      * Rename the data base.
179      *
180      * Assume that the database is not hdb_open'ed and not locked.
181      */
182     krb5_error_code (*hdb_rename)(krb5_context, struct HDB*, const char*);
183     /**
184      * Get an hdb_entry from a classical DB backend
185      *
186      * If the database is a classical DB (ie BDB, NDBM, GDBM, etc)
187      * backend, this function will take a principal key (krb5_data)
188      * and return all data related to principal in the return
189      * krb5_data. The returned encoded entry is of type hdb_entry or
190      * hdb_entry_alias.
191      */
192     krb5_error_code (*hdb__get)(krb5_context, struct HDB*,
193 				krb5_data, krb5_data*);
194     /**
195      * Store an hdb_entry from a classical DB backend
196      *
197      * Same discussion as in @ref HDB::hdb__get
198      */
199     krb5_error_code (*hdb__put)(krb5_context, struct HDB*, int,
200 				krb5_data, krb5_data);
201     /**
202      * Delete and hdb_entry from a classical DB backend
203      *
204      * Same discussion as in @ref HDB::hdb__get
205      */
206     krb5_error_code (*hdb__del)(krb5_context, struct HDB*, krb5_data);
207     /**
208      * Destroy the handle to the database.
209      *
210      * Destroy the handle to the database, deallocate all memory and
211      * related resources. Does not remove any permanent data. Its the
212      * logical reverse of hdb_create() function that is the entry
213      * point for the module.
214      */
215     krb5_error_code (*hdb_destroy)(krb5_context, struct HDB*);
216     /**
217      * Get the list of realms this backend handles.
218      * This call is optional to support. The returned realms are used
219      * for announcing the realms over bonjour. Free returned array
220      * with krb5_free_host_realm().
221      */
222     krb5_error_code (*hdb_get_realms)(krb5_context, struct HDB *, krb5_realm **);
223     /**
224      * Change password.
225      *
226      * Will update keys for the entry when given password.  The new
227      * keys must be written into the entry and will then later be
228      * ->hdb_store() into the database. The backend will still perform
229      * all other operations, increasing the kvno, and update
230      * modification timestamp.
231      *
232      * The backend needs to call _kadm5_set_keys() and perform password
233      * quality checks.
234      */
235     krb5_error_code (*hdb_password)(krb5_context, struct HDB*, hdb_entry_ex*, const char *, int);
236 
237     /**
238      * Auth feedback
239      *
240      * This is a feedback call that allows backends that provides
241      * lockout functionality to register failure and/or successes.
242      *
243      * In case the entry is locked out, the backend should set the
244      * hdb_entry.flags.locked-out flag.
245      */
246     krb5_error_code (*hdb_auth_status)(krb5_context, struct HDB *, hdb_entry_ex *, int);
247     /**
248      * Check if delegation is allowed.
249      */
250     krb5_error_code (*hdb_check_constrained_delegation)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
251 
252     /**
253      * Check if this name is an alias for the supplied client for PKINIT userPrinicpalName logins
254      */
255     krb5_error_code (*hdb_check_pkinit_ms_upn_match)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
256 
257     /**
258      * Check if s4u2self is allowed from this client to this server
259      */
260     krb5_error_code (*hdb_check_s4u2self)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
261 }HDB;
262 
263 #define HDB_INTERFACE_VERSION	7
264 
265 struct hdb_so_method {
266     int version;
267     const char *prefix;
268     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
269 };
270 
271 typedef krb5_error_code (*hdb_foreach_func_t)(krb5_context, HDB*,
272 					      hdb_entry_ex*, void*);
273 extern krb5_kt_ops hdb_kt_ops;
274 
275 struct hdb_method {
276     int interface_version;
277     const char *prefix;
278     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
279 };
280 
281 extern const int hdb_interface_version;
282 
283 #include <krb5/hdb-protos.h>
284 
285 #endif /* __HDB_H__ */
286