1 /* $NetBSD: hdb.h,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 /* Id */ 37 38 #ifndef __HDB_H__ 39 #define __HDB_H__ 40 41 #include <krb5/krb5.h> 42 43 #include <krb5/hdb_err.h> 44 45 #include <krb5/heim_asn1.h> 46 #include <krb5/hdb_asn1.h> 47 48 struct hdb_dbinfo; 49 50 enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; 51 52 /* flags for various functions */ 53 #define HDB_F_DECRYPT 1 /* decrypt keys */ 54 #define HDB_F_REPLACE 2 /* replace entry */ 55 #define HDB_F_GET_CLIENT 4 /* fetch client */ 56 #define HDB_F_GET_SERVER 8 /* fetch server */ 57 #define HDB_F_GET_KRBTGT 16 /* fetch krbtgt */ 58 #define HDB_F_GET_ANY 28 /* fetch any of client,server,krbtgt */ 59 #define HDB_F_CANON 32 /* want canonicalition */ 60 #define HDB_F_ADMIN_DATA 64 /* want data that kdc don't use */ 61 #define HDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ 62 #define HDB_F_CURRENT_KVNO 256 /* we want the current KVNO */ 63 /* 512, 1024, 2048 are reserved for kvno operations that is not part of the 1.5 branch */ 64 #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ 65 #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ 66 #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ 67 68 /* hdb_capability_flags */ 69 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 70 #define HDB_CAP_F_HANDLE_PASSWORDS 2 71 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS 4 72 73 /* auth status values */ 74 #define HDB_AUTH_SUCCESS 0 75 #define HDB_AUTH_WRONG_PASSWORD 1 76 #define HDB_AUTH_INVALID_SIGNATURE 2 77 78 /* key usage for master key */ 79 #define HDB_KU_MKEY 0x484442 80 81 typedef struct hdb_master_key_data *hdb_master_key; 82 83 /** 84 * hdb_entry_ex is a wrapper structure around the hdb_entry structure 85 * that allows backends to keep a pointer to the backing store, ie in 86 * ->hdb_fetch_kvno(), so that we the kadmin/kpasswd backend gets around to 87 * ->hdb_store(), the backend doesn't need to lookup the entry again. 88 */ 89 90 typedef struct hdb_entry_ex { 91 void *ctx; 92 hdb_entry entry; 93 void (*free_entry)(krb5_context, struct hdb_entry_ex *); 94 } hdb_entry_ex; 95 96 97 /** 98 * HDB backend function pointer structure 99 * 100 * The HDB structure is what the KDC and kadmind framework uses to 101 * query the backend database when talking about principals. 102 */ 103 104 typedef struct HDB{ 105 void *hdb_db; 106 void *hdb_dbc; /** don't use, only for DB3 */ 107 char *hdb_name; 108 int hdb_master_key_set; 109 hdb_master_key hdb_master_key; 110 int hdb_openp; 111 int hdb_capability_flags; 112 /** 113 * Open (or create) the a Kerberos database. 114 * 115 * Open (or create) the a Kerberos database that was resolved with 116 * hdb_create(). The third and fourth flag to the function are the 117 * same as open(), thus passing O_CREAT will create the data base 118 * if it doesn't exists. 119 * 120 * Then done the caller should call hdb_close(), and to release 121 * all resources hdb_destroy(). 122 */ 123 krb5_error_code (*hdb_open)(krb5_context, struct HDB*, int, mode_t); 124 /** 125 * Close the database for transaction 126 * 127 * Closes the database for further transactions, wont release any 128 * permanant resources. the database can be ->hdb_open-ed again. 129 */ 130 krb5_error_code (*hdb_close)(krb5_context, struct HDB*); 131 /** 132 * Free an entry after use. 133 */ 134 void (*hdb_free)(krb5_context, struct HDB*, hdb_entry_ex*); 135 /** 136 * Fetch an entry from the backend 137 * 138 * Fetch an entry from the backend, flags are what type of entry 139 * should be fetch: client, server, krbtgt. 140 * knvo (if specified and flags HDB_F_KVNO_SPECIFIED set) is the kvno to get 141 */ 142 krb5_error_code (*hdb_fetch_kvno)(krb5_context, struct HDB*, 143 krb5_const_principal, unsigned, krb5_kvno, 144 hdb_entry_ex*); 145 /** 146 * Store an entry to database 147 */ 148 krb5_error_code (*hdb_store)(krb5_context, struct HDB*, 149 unsigned, hdb_entry_ex*); 150 /** 151 * Remove an entry from the database. 152 */ 153 krb5_error_code (*hdb_remove)(krb5_context, struct HDB*, 154 krb5_const_principal); 155 /** 156 * As part of iteration, fetch one entry 157 */ 158 krb5_error_code (*hdb_firstkey)(krb5_context, struct HDB*, 159 unsigned, hdb_entry_ex*); 160 /** 161 * As part of iteration, fetch next entry 162 */ 163 krb5_error_code (*hdb_nextkey)(krb5_context, struct HDB*, 164 unsigned, hdb_entry_ex*); 165 /** 166 * Lock database 167 * 168 * A lock can only be held by one consumers. Transaction can still 169 * happen on the database while the lock is held, so the entry is 170 * only useful for syncroning creation of the database and renaming of the database. 171 */ 172 krb5_error_code (*hdb_lock)(krb5_context, struct HDB*, int); 173 /** 174 * Unlock database 175 */ 176 krb5_error_code (*hdb_unlock)(krb5_context, struct HDB*); 177 /** 178 * Rename the data base. 179 * 180 * Assume that the database is not hdb_open'ed and not locked. 181 */ 182 krb5_error_code (*hdb_rename)(krb5_context, struct HDB*, const char*); 183 /** 184 * Get an hdb_entry from a classical DB backend 185 * 186 * If the database is a classical DB (ie BDB, NDBM, GDBM, etc) 187 * backend, this function will take a principal key (krb5_data) 188 * and return all data related to principal in the return 189 * krb5_data. The returned encoded entry is of type hdb_entry or 190 * hdb_entry_alias. 191 */ 192 krb5_error_code (*hdb__get)(krb5_context, struct HDB*, 193 krb5_data, krb5_data*); 194 /** 195 * Store an hdb_entry from a classical DB backend 196 * 197 * Same discussion as in @ref HDB::hdb__get 198 */ 199 krb5_error_code (*hdb__put)(krb5_context, struct HDB*, int, 200 krb5_data, krb5_data); 201 /** 202 * Delete and hdb_entry from a classical DB backend 203 * 204 * Same discussion as in @ref HDB::hdb__get 205 */ 206 krb5_error_code (*hdb__del)(krb5_context, struct HDB*, krb5_data); 207 /** 208 * Destroy the handle to the database. 209 * 210 * Destroy the handle to the database, deallocate all memory and 211 * related resources. Does not remove any permanent data. Its the 212 * logical reverse of hdb_create() function that is the entry 213 * point for the module. 214 */ 215 krb5_error_code (*hdb_destroy)(krb5_context, struct HDB*); 216 /** 217 * Get the list of realms this backend handles. 218 * This call is optional to support. The returned realms are used 219 * for announcing the realms over bonjour. Free returned array 220 * with krb5_free_host_realm(). 221 */ 222 krb5_error_code (*hdb_get_realms)(krb5_context, struct HDB *, krb5_realm **); 223 /** 224 * Change password. 225 * 226 * Will update keys for the entry when given password. The new 227 * keys must be written into the entry and will then later be 228 * ->hdb_store() into the database. The backend will still perform 229 * all other operations, increasing the kvno, and update 230 * modification timestamp. 231 * 232 * The backend needs to call _kadm5_set_keys() and perform password 233 * quality checks. 234 */ 235 krb5_error_code (*hdb_password)(krb5_context, struct HDB*, hdb_entry_ex*, const char *, int); 236 237 /** 238 * Auth feedback 239 * 240 * This is a feedback call that allows backends that provides 241 * lockout functionality to register failure and/or successes. 242 * 243 * In case the entry is locked out, the backend should set the 244 * hdb_entry.flags.locked-out flag. 245 */ 246 krb5_error_code (*hdb_auth_status)(krb5_context, struct HDB *, hdb_entry_ex *, int); 247 /** 248 * Check if delegation is allowed. 249 */ 250 krb5_error_code (*hdb_check_constrained_delegation)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal); 251 252 /** 253 * Check if this name is an alias for the supplied client for PKINIT userPrinicpalName logins 254 */ 255 krb5_error_code (*hdb_check_pkinit_ms_upn_match)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal); 256 257 /** 258 * Check if s4u2self is allowed from this client to this server 259 */ 260 krb5_error_code (*hdb_check_s4u2self)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal); 261 }HDB; 262 263 #define HDB_INTERFACE_VERSION 7 264 265 struct hdb_so_method { 266 int version; 267 const char *prefix; 268 krb5_error_code (*create)(krb5_context, HDB **, const char *filename); 269 }; 270 271 typedef krb5_error_code (*hdb_foreach_func_t)(krb5_context, HDB*, 272 hdb_entry_ex*, void*); 273 extern krb5_kt_ops hdb_kt_ops; 274 275 struct hdb_method { 276 int interface_version; 277 const char *prefix; 278 krb5_error_code (*create)(krb5_context, HDB **, const char *filename); 279 }; 280 281 extern const int hdb_interface_version; 282 283 #include <krb5/hdb-protos.h> 284 285 #endif /* __HDB_H__ */ 286