1*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 2*0Sstevel@tonic-gate 3*0Sstevel@tonic-gate /* 4*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 5*0Sstevel@tonic-gate * 6*0Sstevel@tonic-gate * Openvision retains the copyright to derivative works of 7*0Sstevel@tonic-gate * this source code. Do *NOT* create a derivative of this 8*0Sstevel@tonic-gate * source code before consulting with your legal department. 9*0Sstevel@tonic-gate * Do *NOT* integrate *ANY* of this source code into another 10*0Sstevel@tonic-gate * product before consulting with your legal department. 11*0Sstevel@tonic-gate * 12*0Sstevel@tonic-gate * For further information, read the top-level Openvision 13*0Sstevel@tonic-gate * copyright which is contained in the top-level MIT Kerberos 14*0Sstevel@tonic-gate * copyright. 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING 17*0Sstevel@tonic-gate * 18*0Sstevel@tonic-gate */ 19*0Sstevel@tonic-gate 20*0Sstevel@tonic-gate 21*0Sstevel@tonic-gate /* 22*0Sstevel@tonic-gate * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved 23*0Sstevel@tonic-gate * 24*0Sstevel@tonic-gate * $Header: /afs/athena.mit.edu/astaff/project/krbdev/.cvsroot/src/lib/kadm5/srv/svr_policy.c,v 1.1 1996/07/24 22:23:36 tlyu Exp $ 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #if !defined(lint) && !defined(__CODECENTER__) 28*0Sstevel@tonic-gate static char *rcsid = "$Header: /afs/athena.mit.edu/astaff/project/krbdev/.cvsroot/src/lib/kadm5/srv/svr_policy.c,v 1.1 1996/07/24 22:23:36 tlyu Exp $"; 29*0Sstevel@tonic-gate #endif 30*0Sstevel@tonic-gate 31*0Sstevel@tonic-gate #include <sys/types.h> 32*0Sstevel@tonic-gate #include <kadm5/admin.h> 33*0Sstevel@tonic-gate #include "adb.h" 34*0Sstevel@tonic-gate #include "server_internal.h" 35*0Sstevel@tonic-gate #include <stdlib.h> 36*0Sstevel@tonic-gate 37*0Sstevel@tonic-gate #define MAX_PW_HISTORY 10 38*0Sstevel@tonic-gate #define MIN_PW_HISTORY 1 39*0Sstevel@tonic-gate #define MIN_PW_CLASSES 1 40*0Sstevel@tonic-gate #define MAX_PW_CLASSES 5 41*0Sstevel@tonic-gate #define MIN_PW_LENGTH 1 42*0Sstevel@tonic-gate 43*0Sstevel@tonic-gate /* 44*0Sstevel@tonic-gate * Function: kadm5_create_policy 45*0Sstevel@tonic-gate * 46*0Sstevel@tonic-gate * Purpose: Create Policies in the policy DB. 47*0Sstevel@tonic-gate * 48*0Sstevel@tonic-gate * Arguments: 49*0Sstevel@tonic-gate * entry (input) The policy entry to be written out to the DB. 50*0Sstevel@tonic-gate * mask (input) Specifies which fields in entry are to ge written out 51*0Sstevel@tonic-gate * and which get default values. 52*0Sstevel@tonic-gate * <return value> 0 if sucsessfull otherwise an error code is returned. 53*0Sstevel@tonic-gate * 54*0Sstevel@tonic-gate * Requires: 55*0Sstevel@tonic-gate * Entry must be a valid principal entry, and mask have a valid value. 56*0Sstevel@tonic-gate * 57*0Sstevel@tonic-gate * Effects: 58*0Sstevel@tonic-gate * Verifies that mask does not specify that the refcount should 59*0Sstevel@tonic-gate * be set as part of the creation, and calls 60*0Sstevel@tonic-gate * kadm5_create_policy_internal. If the refcount *is* 61*0Sstevel@tonic-gate * specified, returns KADM5_BAD_MASK. 62*0Sstevel@tonic-gate */ 63*0Sstevel@tonic-gate 64*0Sstevel@tonic-gate kadm5_ret_t 65*0Sstevel@tonic-gate kadm5_create_policy(void *server_handle, 66*0Sstevel@tonic-gate kadm5_policy_ent_t entry, long mask) 67*0Sstevel@tonic-gate { 68*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 69*0Sstevel@tonic-gate 70*0Sstevel@tonic-gate if (mask & KADM5_REF_COUNT) 71*0Sstevel@tonic-gate return KADM5_BAD_MASK; 72*0Sstevel@tonic-gate else 73*0Sstevel@tonic-gate return kadm5_create_policy_internal(server_handle, entry, mask); 74*0Sstevel@tonic-gate } 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gate /* 77*0Sstevel@tonic-gate * Function: kadm5_create_policy_internal 78*0Sstevel@tonic-gate * 79*0Sstevel@tonic-gate * Purpose: Create Policies in the policy DB. 80*0Sstevel@tonic-gate * 81*0Sstevel@tonic-gate * Arguments: 82*0Sstevel@tonic-gate * entry (input) The policy entry to be written out to the DB. 83*0Sstevel@tonic-gate * mask (input) Specifies which fields in entry are to ge written out 84*0Sstevel@tonic-gate * and which get default values. 85*0Sstevel@tonic-gate * <return value> 0 if sucsessfull otherwise an error code is returned. 86*0Sstevel@tonic-gate * 87*0Sstevel@tonic-gate * Requires: 88*0Sstevel@tonic-gate * Entry must be a valid principal entry, and mask have a valid value. 89*0Sstevel@tonic-gate * 90*0Sstevel@tonic-gate * Effects: 91*0Sstevel@tonic-gate * Writes the data to the database, and does a database sync if 92*0Sstevel@tonic-gate * sucsessfull. 93*0Sstevel@tonic-gate * 94*0Sstevel@tonic-gate */ 95*0Sstevel@tonic-gate 96*0Sstevel@tonic-gate kadm5_ret_t 97*0Sstevel@tonic-gate kadm5_create_policy_internal(void *server_handle, 98*0Sstevel@tonic-gate kadm5_policy_ent_t entry, long mask) 99*0Sstevel@tonic-gate { 100*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 101*0Sstevel@tonic-gate osa_policy_ent_rec pent; 102*0Sstevel@tonic-gate int ret; 103*0Sstevel@tonic-gate char *p; 104*0Sstevel@tonic-gate 105*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 106*0Sstevel@tonic-gate 107*0Sstevel@tonic-gate if ((entry == (kadm5_policy_ent_t) NULL) || (entry->policy == NULL)) 108*0Sstevel@tonic-gate return EINVAL; 109*0Sstevel@tonic-gate if(strlen(entry->policy) == 0) 110*0Sstevel@tonic-gate return KADM5_BAD_POLICY; 111*0Sstevel@tonic-gate if (!(mask & KADM5_POLICY)) 112*0Sstevel@tonic-gate return KADM5_BAD_MASK; 113*0Sstevel@tonic-gate 114*0Sstevel@tonic-gate pent.name = entry->policy; 115*0Sstevel@tonic-gate p = entry->policy; 116*0Sstevel@tonic-gate while(*p != '\0') { 117*0Sstevel@tonic-gate if(*p < ' ' || *p > '~') 118*0Sstevel@tonic-gate return KADM5_BAD_POLICY; 119*0Sstevel@tonic-gate else 120*0Sstevel@tonic-gate p++; 121*0Sstevel@tonic-gate } 122*0Sstevel@tonic-gate if (!(mask & KADM5_PW_MAX_LIFE)) 123*0Sstevel@tonic-gate pent.pw_max_life = 0; 124*0Sstevel@tonic-gate else 125*0Sstevel@tonic-gate pent.pw_max_life = entry->pw_max_life; 126*0Sstevel@tonic-gate if (!(mask & KADM5_PW_MIN_LIFE)) 127*0Sstevel@tonic-gate pent.pw_min_life = 0; 128*0Sstevel@tonic-gate else { 129*0Sstevel@tonic-gate if((mask & KADM5_PW_MAX_LIFE)) { 130*0Sstevel@tonic-gate if(entry->pw_min_life > entry->pw_max_life && entry->pw_max_life != 0) 131*0Sstevel@tonic-gate return KADM5_BAD_MIN_PASS_LIFE; 132*0Sstevel@tonic-gate } 133*0Sstevel@tonic-gate pent.pw_min_life = entry->pw_min_life; 134*0Sstevel@tonic-gate } 135*0Sstevel@tonic-gate if (!(mask & KADM5_PW_MIN_LENGTH)) 136*0Sstevel@tonic-gate pent.pw_min_length = MIN_PW_LENGTH; 137*0Sstevel@tonic-gate else { 138*0Sstevel@tonic-gate if(entry->pw_min_length < MIN_PW_LENGTH) 139*0Sstevel@tonic-gate return KADM5_BAD_LENGTH; 140*0Sstevel@tonic-gate pent.pw_min_length = entry->pw_min_length; 141*0Sstevel@tonic-gate } 142*0Sstevel@tonic-gate if (!(mask & KADM5_PW_MIN_CLASSES)) 143*0Sstevel@tonic-gate pent.pw_min_classes = MIN_PW_CLASSES; 144*0Sstevel@tonic-gate else { 145*0Sstevel@tonic-gate if(entry->pw_min_classes > MAX_PW_CLASSES || entry->pw_min_classes < MIN_PW_CLASSES) 146*0Sstevel@tonic-gate return KADM5_BAD_CLASS; 147*0Sstevel@tonic-gate pent.pw_min_classes = entry->pw_min_classes; 148*0Sstevel@tonic-gate } 149*0Sstevel@tonic-gate if (!(mask & KADM5_PW_HISTORY_NUM)) 150*0Sstevel@tonic-gate pent.pw_history_num = MIN_PW_HISTORY; 151*0Sstevel@tonic-gate else { 152*0Sstevel@tonic-gate if(entry->pw_history_num < MIN_PW_HISTORY || 153*0Sstevel@tonic-gate entry->pw_history_num > MAX_PW_HISTORY) 154*0Sstevel@tonic-gate return KADM5_BAD_HISTORY; 155*0Sstevel@tonic-gate else 156*0Sstevel@tonic-gate pent.pw_history_num = entry->pw_history_num; 157*0Sstevel@tonic-gate } 158*0Sstevel@tonic-gate if (!(mask & KADM5_REF_COUNT)) 159*0Sstevel@tonic-gate pent.policy_refcnt = 0; 160*0Sstevel@tonic-gate else 161*0Sstevel@tonic-gate pent.policy_refcnt = entry->policy_refcnt; 162*0Sstevel@tonic-gate if ((ret = osa_adb_create_policy(handle->policy_db, &pent)) == OSA_ADB_OK) 163*0Sstevel@tonic-gate return KADM5_OK; 164*0Sstevel@tonic-gate else 165*0Sstevel@tonic-gate return ret; 166*0Sstevel@tonic-gate } 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate kadm5_ret_t 169*0Sstevel@tonic-gate kadm5_delete_policy(void *server_handle, kadm5_policy_t name) 170*0Sstevel@tonic-gate { 171*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 172*0Sstevel@tonic-gate osa_policy_ent_t entry; 173*0Sstevel@tonic-gate int ret; 174*0Sstevel@tonic-gate 175*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate if(name == (kadm5_policy_t) NULL) 178*0Sstevel@tonic-gate return EINVAL; 179*0Sstevel@tonic-gate if(strlen(name) == 0) 180*0Sstevel@tonic-gate return KADM5_BAD_POLICY; 181*0Sstevel@tonic-gate if ((ret = osa_adb_get_policy(handle->policy_db, name, &entry)) != OSA_ADB_OK) 182*0Sstevel@tonic-gate return ret; 183*0Sstevel@tonic-gate if(entry->policy_refcnt != 0) { 184*0Sstevel@tonic-gate osa_free_policy_ent(entry); 185*0Sstevel@tonic-gate return KADM5_POLICY_REF; 186*0Sstevel@tonic-gate } 187*0Sstevel@tonic-gate osa_free_policy_ent(entry); 188*0Sstevel@tonic-gate if ((ret = osa_adb_destroy_policy(handle->policy_db, name)) == OSA_ADB_OK) 189*0Sstevel@tonic-gate return KADM5_OK; 190*0Sstevel@tonic-gate else 191*0Sstevel@tonic-gate return ret; 192*0Sstevel@tonic-gate } 193*0Sstevel@tonic-gate 194*0Sstevel@tonic-gate kadm5_ret_t 195*0Sstevel@tonic-gate kadm5_modify_policy(void *server_handle, 196*0Sstevel@tonic-gate kadm5_policy_ent_t entry, long mask) 197*0Sstevel@tonic-gate { 198*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 199*0Sstevel@tonic-gate 200*0Sstevel@tonic-gate if (mask & KADM5_REF_COUNT) 201*0Sstevel@tonic-gate return KADM5_BAD_MASK; 202*0Sstevel@tonic-gate else 203*0Sstevel@tonic-gate return kadm5_modify_policy_internal(server_handle, entry, mask); 204*0Sstevel@tonic-gate } 205*0Sstevel@tonic-gate 206*0Sstevel@tonic-gate kadm5_ret_t 207*0Sstevel@tonic-gate kadm5_modify_policy_internal(void *server_handle, 208*0Sstevel@tonic-gate kadm5_policy_ent_t entry, long mask) 209*0Sstevel@tonic-gate { 210*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 211*0Sstevel@tonic-gate osa_policy_ent_t p; 212*0Sstevel@tonic-gate int ret; 213*0Sstevel@tonic-gate 214*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 215*0Sstevel@tonic-gate 216*0Sstevel@tonic-gate if((entry == (kadm5_policy_ent_t) NULL) || (entry->policy == NULL)) 217*0Sstevel@tonic-gate return EINVAL; 218*0Sstevel@tonic-gate if(strlen(entry->policy) == 0) 219*0Sstevel@tonic-gate return KADM5_BAD_POLICY; 220*0Sstevel@tonic-gate if((mask & KADM5_POLICY)) 221*0Sstevel@tonic-gate return KADM5_BAD_MASK; 222*0Sstevel@tonic-gate 223*0Sstevel@tonic-gate switch ((ret = osa_adb_get_policy(handle->policy_db, entry->policy, &p))) { 224*0Sstevel@tonic-gate case OSA_ADB_OK: 225*0Sstevel@tonic-gate break; 226*0Sstevel@tonic-gate case OSA_ADB_NOENT: 227*0Sstevel@tonic-gate return KADM5_UNK_POLICY; 228*0Sstevel@tonic-gate default: 229*0Sstevel@tonic-gate break; 230*0Sstevel@tonic-gate } 231*0Sstevel@tonic-gate if ((mask & KADM5_PW_MAX_LIFE)) 232*0Sstevel@tonic-gate p->pw_max_life = entry->pw_max_life; 233*0Sstevel@tonic-gate if ((mask & KADM5_PW_MIN_LIFE)) { 234*0Sstevel@tonic-gate if(entry->pw_min_life > p->pw_max_life && p->pw_max_life != 0) { 235*0Sstevel@tonic-gate osa_free_policy_ent(p); 236*0Sstevel@tonic-gate return KADM5_BAD_MIN_PASS_LIFE; 237*0Sstevel@tonic-gate } 238*0Sstevel@tonic-gate p->pw_min_life = entry->pw_min_life; 239*0Sstevel@tonic-gate } 240*0Sstevel@tonic-gate if ((mask & KADM5_PW_MIN_LENGTH)) { 241*0Sstevel@tonic-gate if(entry->pw_min_length < MIN_PW_LENGTH) { 242*0Sstevel@tonic-gate osa_free_policy_ent(p); 243*0Sstevel@tonic-gate return KADM5_BAD_LENGTH; 244*0Sstevel@tonic-gate } 245*0Sstevel@tonic-gate p->pw_min_length = entry->pw_min_length; 246*0Sstevel@tonic-gate } 247*0Sstevel@tonic-gate if ((mask & KADM5_PW_MIN_CLASSES)) { 248*0Sstevel@tonic-gate if(entry->pw_min_classes > MAX_PW_CLASSES || 249*0Sstevel@tonic-gate entry->pw_min_classes < MIN_PW_CLASSES) { 250*0Sstevel@tonic-gate osa_free_policy_ent(p); 251*0Sstevel@tonic-gate return KADM5_BAD_CLASS; 252*0Sstevel@tonic-gate } 253*0Sstevel@tonic-gate p->pw_min_classes = entry->pw_min_classes; 254*0Sstevel@tonic-gate } 255*0Sstevel@tonic-gate if ((mask & KADM5_PW_HISTORY_NUM)) { 256*0Sstevel@tonic-gate if(entry->pw_history_num < MIN_PW_HISTORY || 257*0Sstevel@tonic-gate entry->pw_history_num > MAX_PW_HISTORY) { 258*0Sstevel@tonic-gate osa_free_policy_ent(p); 259*0Sstevel@tonic-gate return KADM5_BAD_HISTORY; 260*0Sstevel@tonic-gate } 261*0Sstevel@tonic-gate p->pw_history_num = entry->pw_history_num; 262*0Sstevel@tonic-gate } 263*0Sstevel@tonic-gate if ((mask & KADM5_REF_COUNT)) 264*0Sstevel@tonic-gate p->policy_refcnt = entry->policy_refcnt; 265*0Sstevel@tonic-gate switch ((ret = osa_adb_put_policy(handle->policy_db, p))) { 266*0Sstevel@tonic-gate case OSA_ADB_OK: 267*0Sstevel@tonic-gate ret = KADM5_OK; 268*0Sstevel@tonic-gate break; 269*0Sstevel@tonic-gate case OSA_ADB_NOENT: /* this should not happen here ... */ 270*0Sstevel@tonic-gate ret = KADM5_UNK_POLICY; 271*0Sstevel@tonic-gate break; 272*0Sstevel@tonic-gate } 273*0Sstevel@tonic-gate osa_free_policy_ent(p); 274*0Sstevel@tonic-gate return ret; 275*0Sstevel@tonic-gate } 276*0Sstevel@tonic-gate 277*0Sstevel@tonic-gate kadm5_ret_t 278*0Sstevel@tonic-gate kadm5_get_policy(void *server_handle, kadm5_policy_t name, 279*0Sstevel@tonic-gate kadm5_policy_ent_t entry) 280*0Sstevel@tonic-gate { 281*0Sstevel@tonic-gate osa_policy_ent_t t; 282*0Sstevel@tonic-gate kadm5_policy_ent_rec entry_local, **entry_orig, *new; 283*0Sstevel@tonic-gate int ret; 284*0Sstevel@tonic-gate kadm5_server_handle_t handle = server_handle; 285*0Sstevel@tonic-gate 286*0Sstevel@tonic-gate CHECK_HANDLE(server_handle); 287*0Sstevel@tonic-gate 288*0Sstevel@tonic-gate /* 289*0Sstevel@tonic-gate * In version 1, entry is a pointer to a kadm5_policy_ent_t that 290*0Sstevel@tonic-gate * should be filled with allocated memory. 291*0Sstevel@tonic-gate */ 292*0Sstevel@tonic-gate if (handle->api_version == KADM5_API_VERSION_1) { 293*0Sstevel@tonic-gate entry_orig = (kadm5_policy_ent_rec **) entry; 294*0Sstevel@tonic-gate *entry_orig = NULL; 295*0Sstevel@tonic-gate entry = &entry_local; 296*0Sstevel@tonic-gate } 297*0Sstevel@tonic-gate 298*0Sstevel@tonic-gate if (name == (kadm5_policy_t) NULL) 299*0Sstevel@tonic-gate return EINVAL; 300*0Sstevel@tonic-gate if(strlen(name) == 0) 301*0Sstevel@tonic-gate return KADM5_BAD_POLICY; 302*0Sstevel@tonic-gate switch((ret = osa_adb_get_policy(handle->policy_db, name, &t))) { 303*0Sstevel@tonic-gate case OSA_ADB_OK: 304*0Sstevel@tonic-gate break; 305*0Sstevel@tonic-gate case OSA_ADB_NOENT: 306*0Sstevel@tonic-gate return KADM5_UNK_POLICY; 307*0Sstevel@tonic-gate default: 308*0Sstevel@tonic-gate return ret; 309*0Sstevel@tonic-gate } 310*0Sstevel@tonic-gate if ((entry->policy = (char *) malloc(strlen(t->name) + 1)) == NULL) { 311*0Sstevel@tonic-gate osa_free_policy_ent(t); 312*0Sstevel@tonic-gate return ENOMEM; 313*0Sstevel@tonic-gate } 314*0Sstevel@tonic-gate strcpy(entry->policy, t->name); 315*0Sstevel@tonic-gate entry->pw_min_life = t->pw_min_life; 316*0Sstevel@tonic-gate entry->pw_max_life = t->pw_max_life; 317*0Sstevel@tonic-gate entry->pw_min_length = t->pw_min_length; 318*0Sstevel@tonic-gate entry->pw_min_classes = t->pw_min_classes; 319*0Sstevel@tonic-gate entry->pw_history_num = t->pw_history_num; 320*0Sstevel@tonic-gate entry->policy_refcnt = t->policy_refcnt; 321*0Sstevel@tonic-gate osa_free_policy_ent(t); 322*0Sstevel@tonic-gate 323*0Sstevel@tonic-gate if (handle->api_version == KADM5_API_VERSION_1) { 324*0Sstevel@tonic-gate new = (kadm5_policy_ent_t) malloc(sizeof(kadm5_policy_ent_rec)); 325*0Sstevel@tonic-gate if (new == NULL) { 326*0Sstevel@tonic-gate free(entry->policy); 327*0Sstevel@tonic-gate osa_free_policy_ent(t); 328*0Sstevel@tonic-gate return ENOMEM; 329*0Sstevel@tonic-gate } 330*0Sstevel@tonic-gate *new = *entry; 331*0Sstevel@tonic-gate *entry_orig = new; 332*0Sstevel@tonic-gate } 333*0Sstevel@tonic-gate 334*0Sstevel@tonic-gate return KADM5_OK; 335*0Sstevel@tonic-gate } 336