forked from public/pyceo
335 lines
12 KiB
C
335 lines
12 KiB
C
/*
|
|
* include/krb5/kdb.h
|
|
*
|
|
* Copyright 1990,1991 by the Massachusetts Institute of Technology.
|
|
* All Rights Reserved.
|
|
*
|
|
* Export of this software from the United States of America may
|
|
* require a specific license from the United States Government.
|
|
* It is the responsibility of any person or organization contemplating
|
|
* export to obtain such a license before exporting.
|
|
*
|
|
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
|
|
* distribute this software and its documentation for any purpose and
|
|
* without fee is hereby granted, provided that the above copyright
|
|
* notice appear in all copies and that both that copyright notice and
|
|
* this permission notice appear in supporting documentation, and that
|
|
* the name of M.I.T. not be used in advertising or publicity pertaining
|
|
* to distribution of the software without specific, written prior
|
|
* permission. Furthermore if you modify this software you must label
|
|
* your software as modified software and not distribute it in such a
|
|
* fashion that it might be confused with the original M.I.T. software.
|
|
* M.I.T. makes no representations about the suitability of
|
|
* this software for any purpose. It is provided "as is" without express
|
|
* or implied warranty.
|
|
*
|
|
*
|
|
* KDC Database interface definitions.
|
|
*/
|
|
|
|
/*
|
|
* Copyright (C) 1998 by the FundsXpress, INC.
|
|
*
|
|
* All rights reserved.
|
|
*
|
|
* Export of this software from the United States of America may require
|
|
* a specific license from the United States Government. It is the
|
|
* responsibility of any person or organization contemplating export to
|
|
* obtain such a license before exporting.
|
|
*
|
|
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
|
|
* distribute this software and its documentation for any purpose and
|
|
* without fee is hereby granted, provided that the above copyright
|
|
* notice appear in all copies and that both that copyright notice and
|
|
* this permission notice appear in supporting documentation, and that
|
|
* the name of FundsXpress. not be used in advertising or publicity pertaining
|
|
* to distribution of the software without specific, written prior
|
|
* permission. FundsXpress makes no representations about the suitability of
|
|
* this software for any purpose. It is provided "as is" without express
|
|
* or implied warranty.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
|
|
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
|
|
*/
|
|
|
|
#ifndef KRB5_KDB5__
|
|
#define KRB5_KDB5__
|
|
|
|
/* Salt types */
|
|
#define KRB5_KDB_SALTTYPE_NORMAL 0
|
|
#define KRB5_KDB_SALTTYPE_V4 1
|
|
#define KRB5_KDB_SALTTYPE_NOREALM 2
|
|
#define KRB5_KDB_SALTTYPE_ONLYREALM 3
|
|
#define KRB5_KDB_SALTTYPE_SPECIAL 4
|
|
#define KRB5_KDB_SALTTYPE_AFS3 5
|
|
|
|
/* Attributes */
|
|
#define KRB5_KDB_DISALLOW_POSTDATED 0x00000001
|
|
#define KRB5_KDB_DISALLOW_FORWARDABLE 0x00000002
|
|
#define KRB5_KDB_DISALLOW_TGT_BASED 0x00000004
|
|
#define KRB5_KDB_DISALLOW_RENEWABLE 0x00000008
|
|
#define KRB5_KDB_DISALLOW_PROXIABLE 0x00000010
|
|
#define KRB5_KDB_DISALLOW_DUP_SKEY 0x00000020
|
|
#define KRB5_KDB_DISALLOW_ALL_TIX 0x00000040
|
|
#define KRB5_KDB_REQUIRES_PRE_AUTH 0x00000080
|
|
#define KRB5_KDB_REQUIRES_HW_AUTH 0x00000100
|
|
#define KRB5_KDB_REQUIRES_PWCHANGE 0x00000200
|
|
#define KRB5_KDB_DISALLOW_SVR 0x00001000
|
|
#define KRB5_KDB_PWCHANGE_SERVICE 0x00002000
|
|
#define KRB5_KDB_SUPPORT_DESMD5 0x00004000
|
|
#define KRB5_KDB_NEW_PRINC 0x00008000
|
|
|
|
/* Creation flags */
|
|
#define KRB5_KDB_CREATE_BTREE 0x00000001
|
|
#define KRB5_KDB_CREATE_HASH 0x00000002
|
|
|
|
#if !defined(_WIN32)
|
|
|
|
/*
|
|
* Note --- these structures cannot be modified without changing the
|
|
* database version number in libkdb.a, but should be expandable by
|
|
* adding new tl_data types.
|
|
*/
|
|
typedef struct _krb5_tl_data {
|
|
struct _krb5_tl_data* tl_data_next; /* NOT saved */
|
|
krb5_int16 tl_data_type;
|
|
krb5_ui_2 tl_data_length;
|
|
krb5_octet * tl_data_contents;
|
|
} krb5_tl_data;
|
|
|
|
/*
|
|
* If this ever changes up the version number and make the arrays be as
|
|
* big as necessary.
|
|
*
|
|
* Currently the first type is the enctype and the second is the salt type.
|
|
*/
|
|
typedef struct _krb5_key_data {
|
|
krb5_int16 key_data_ver; /* Version */
|
|
krb5_int16 key_data_kvno; /* Key Version */
|
|
krb5_int16 key_data_type[2]; /* Array of types */
|
|
krb5_ui_2 key_data_length[2]; /* Array of lengths */
|
|
krb5_octet * key_data_contents[2]; /* Array of pointers */
|
|
} krb5_key_data;
|
|
|
|
#define KRB5_KDB_V1_KEY_DATA_ARRAY 2 /* # of array elements */
|
|
|
|
typedef struct _krb5_keysalt {
|
|
krb5_int16 type;
|
|
krb5_data data; /* Length, data */
|
|
} krb5_keysalt;
|
|
|
|
typedef struct _krb5_db_entry_new {
|
|
krb5_magic magic; /* NOT saved */
|
|
krb5_ui_2 len;
|
|
krb5_flags attributes;
|
|
krb5_deltat max_life;
|
|
krb5_deltat max_renewable_life;
|
|
krb5_timestamp expiration; /* When the client expires */
|
|
krb5_timestamp pw_expiration; /* When its passwd expires */
|
|
krb5_timestamp last_success; /* Last successful passwd */
|
|
krb5_timestamp last_failed; /* Last failed passwd attempt */
|
|
krb5_kvno fail_auth_count; /* # of failed passwd attempt */
|
|
krb5_int16 n_tl_data;
|
|
krb5_int16 n_key_data;
|
|
krb5_ui_2 e_length; /* Length of extra data */
|
|
krb5_octet * e_data; /* Extra data to be saved */
|
|
|
|
krb5_principal princ; /* Length, data */
|
|
krb5_tl_data * tl_data; /* Linked list */
|
|
krb5_key_data * key_data; /* Array */
|
|
} krb5_db_entry;
|
|
|
|
#define KRB5_KDB_MAGIC_NUMBER 0xdbdbdbdb
|
|
#define KRB5_KDB_V1_BASE_LENGTH 38
|
|
|
|
#define KRB5_TL_LAST_PWD_CHANGE 0x0001
|
|
#define KRB5_TL_MOD_PRINC 0x0002
|
|
#define KRB5_TL_KADM_DATA 0x0003
|
|
#define KRB5_TL_KADM5_E_DATA 0x0004
|
|
#define KRB5_TL_RB1_CHALLENGE 0x0005
|
|
#ifdef SECURID
|
|
#define KRB5_TL_SECURID_STATE 0x0006
|
|
#endif /* SECURID */
|
|
|
|
/*
|
|
* Determines the number of failed KDC requests before DISALLOW_ALL_TIX is set
|
|
* on the principal.
|
|
*/
|
|
#define KRB5_MAX_FAIL_COUNT 5
|
|
|
|
/* XXX depends on knowledge of krb5_parse_name() formats */
|
|
#define KRB5_KDB_M_NAME "K/M" /* Kerberos/Master */
|
|
|
|
/* prompts used by default when reading the KDC password from the keyboard. */
|
|
#define KRB5_KDC_MKEY_1 "Enter KDC database master key"
|
|
#define KRB5_KDC_MKEY_2 "Re-enter KDC database master key to verify"
|
|
|
|
extern char *krb5_mkey_pwd_prompt1;
|
|
extern char *krb5_mkey_pwd_prompt2;
|
|
|
|
/*
|
|
* These macros specify the encoding of data within the database.
|
|
*
|
|
* Data encoding is little-endian.
|
|
*/
|
|
#define krb5_kdb_decode_int16(cp, i16) \
|
|
*((krb5_int16 *) &(i16)) = (((krb5_int16) ((unsigned char) (cp)[0]))| \
|
|
((krb5_int16) ((unsigned char) (cp)[1]) << 8))
|
|
#define krb5_kdb_decode_int32(cp, i32) \
|
|
*((krb5_int32 *) &(i32)) = (((krb5_int32) ((unsigned char) (cp)[0]))| \
|
|
((krb5_int32) ((unsigned char) (cp)[1]) << 8) | \
|
|
((krb5_int32) ((unsigned char) (cp)[2]) << 16)| \
|
|
((krb5_int32) ((unsigned char) (cp)[3]) << 24))
|
|
#define krb5_kdb_encode_int16(i16, cp) \
|
|
{ \
|
|
(cp)[0] = (unsigned char) ((i16) & 0xff); \
|
|
(cp)[1] = (unsigned char) (((i16) >> 8) & 0xff); \
|
|
}
|
|
#define krb5_kdb_encode_int32(i32, cp) \
|
|
{ \
|
|
(cp)[0] = (unsigned char) ((i32) & 0xff); \
|
|
(cp)[1] = (unsigned char) (((i32) >> 8) & 0xff); \
|
|
(cp)[2] = (unsigned char) (((i32) >> 16) & 0xff); \
|
|
(cp)[3] = (unsigned char) (((i32) >> 24) & 0xff); \
|
|
}
|
|
|
|
/* libkdb.spec */
|
|
krb5_error_code krb5_db_set_name (krb5_context, char * );
|
|
krb5_error_code krb5_db_init (krb5_context);
|
|
krb5_error_code krb5_db_fini (krb5_context);
|
|
krb5_error_code krb5_db_get_age (krb5_context, char *, time_t * );
|
|
krb5_error_code krb5_db_create (krb5_context, char *, krb5_int32 );
|
|
krb5_error_code krb5_db_rename (krb5_context, char *, char * );
|
|
krb5_error_code krb5_db_get_principal (krb5_context, krb5_const_principal ,
|
|
krb5_db_entry *, int *,
|
|
krb5_boolean * );
|
|
void krb5_db_free_principal (krb5_context, krb5_db_entry *, int );
|
|
krb5_error_code krb5_db_put_principal (krb5_context, krb5_db_entry *, int * );
|
|
krb5_error_code krb5_db_delete_principal (krb5_context, krb5_const_principal,
|
|
int * );
|
|
krb5_error_code krb5_db_iterate (krb5_context,
|
|
krb5_error_code (* ) (krb5_pointer,
|
|
krb5_db_entry *),
|
|
krb5_pointer);
|
|
krb5_error_code krb5_db_iterate_ext (krb5_context,
|
|
krb5_error_code (* ) (krb5_pointer,
|
|
krb5_db_entry *),
|
|
krb5_pointer, int, int);
|
|
krb5_error_code krb5_db_verify_master_key (krb5_context, krb5_principal,
|
|
krb5_keyblock *);
|
|
krb5_error_code krb5_db_store_mkey (krb5_context, char *, krb5_principal,
|
|
krb5_keyblock *);
|
|
|
|
krb5_error_code krb5_db_setup_mkey_name (krb5_context, const char *,
|
|
const char *, char **,
|
|
krb5_principal *);
|
|
|
|
krb5_error_code krb5_db_set_mkey (krb5_context, krb5_keyblock *);
|
|
|
|
krb5_error_code krb5_db_get_mkey (krb5_context, krb5_keyblock **);
|
|
krb5_error_code krb5_db_destroy (krb5_context, char * );
|
|
krb5_error_code krb5_db_lock (krb5_context, int );
|
|
krb5_error_code krb5_db_unlock (krb5_context);
|
|
krb5_error_code krb5_db_set_nonblocking (krb5_context, krb5_boolean,
|
|
krb5_boolean * );
|
|
krb5_boolean krb5_db_set_lockmode (krb5_context, krb5_boolean);
|
|
krb5_error_code krb5_db_fetch_mkey (krb5_context, krb5_principal, krb5_enctype,
|
|
krb5_boolean, krb5_boolean, char *,
|
|
krb5_data *,
|
|
krb5_keyblock * );
|
|
|
|
krb5_error_code krb5_db_open_database (krb5_context);
|
|
krb5_error_code krb5_db_close_database (krb5_context);
|
|
|
|
krb5_error_code krb5_dbekd_encrypt_key_data (krb5_context,
|
|
const krb5_keyblock *,
|
|
const krb5_keyblock *,
|
|
const krb5_keysalt *,
|
|
int,
|
|
krb5_key_data *);
|
|
krb5_error_code krb5_dbekd_decrypt_key_data (krb5_context,
|
|
const krb5_keyblock *,
|
|
const krb5_key_data *,
|
|
krb5_keyblock *,
|
|
krb5_keysalt *);
|
|
krb5_error_code krb5_dbe_create_key_data (krb5_context,
|
|
krb5_db_entry *);
|
|
krb5_error_code krb5_dbe_update_tl_data (krb5_context,
|
|
krb5_db_entry *,
|
|
krb5_tl_data *);
|
|
krb5_error_code krb5_dbe_lookup_tl_data (krb5_context,
|
|
krb5_db_entry *,
|
|
krb5_tl_data *);
|
|
krb5_error_code krb5_dbe_update_last_pwd_change (krb5_context,
|
|
krb5_db_entry *,
|
|
krb5_timestamp);
|
|
krb5_error_code krb5_dbe_lookup_last_pwd_change (krb5_context,
|
|
krb5_db_entry *,
|
|
krb5_timestamp *);
|
|
krb5_error_code krb5_dbe_update_mod_princ_data (krb5_context,
|
|
krb5_db_entry *,
|
|
krb5_timestamp,
|
|
krb5_const_principal);
|
|
krb5_error_code krb5_dbe_lookup_mod_princ_data (krb5_context,
|
|
krb5_db_entry *,
|
|
krb5_timestamp *,
|
|
krb5_principal *);
|
|
int krb5_encode_princ_dbkey (krb5_context, krb5_data *, krb5_const_principal);
|
|
void krb5_free_princ_dbkey (krb5_context, krb5_data *);
|
|
krb5_error_code krb5_encode_princ_contents (krb5_context, krb5_data *,
|
|
krb5_db_entry *);
|
|
void krb5_free_princ_contents (krb5_context, krb5_data *);
|
|
krb5_error_code krb5_decode_princ_contents (krb5_context, krb5_data *,
|
|
krb5_db_entry *);
|
|
void krb5_dbe_free_contents (krb5_context, krb5_db_entry *);
|
|
|
|
krb5_error_code krb5_dbe_find_enctype (krb5_context, krb5_db_entry *,
|
|
krb5_int32,
|
|
krb5_int32,
|
|
krb5_int32,
|
|
krb5_key_data **);
|
|
|
|
krb5_error_code krb5_dbe_search_enctype (krb5_context,
|
|
krb5_db_entry *,
|
|
krb5_int32 *,
|
|
krb5_int32,
|
|
krb5_int32,
|
|
krb5_int32,
|
|
krb5_key_data **);
|
|
|
|
struct __krb5_key_salt_tuple;
|
|
|
|
krb5_error_code krb5_dbe_cpw (krb5_context,
|
|
krb5_keyblock *,
|
|
struct __krb5_key_salt_tuple *,
|
|
int,
|
|
char *,
|
|
int,
|
|
krb5_boolean,
|
|
krb5_db_entry *);
|
|
krb5_error_code krb5_dbe_apw (krb5_context,
|
|
krb5_keyblock *,
|
|
struct __krb5_key_salt_tuple *,
|
|
int,
|
|
char *,
|
|
krb5_db_entry *);
|
|
krb5_error_code krb5_dbe_crk (krb5_context,
|
|
krb5_keyblock *,
|
|
struct __krb5_key_salt_tuple *,
|
|
int,
|
|
krb5_boolean,
|
|
krb5_db_entry *);
|
|
krb5_error_code krb5_dbe_ark (krb5_context,
|
|
krb5_keyblock *,
|
|
struct __krb5_key_salt_tuple *,
|
|
int,
|
|
krb5_db_entry *);
|
|
|
|
krb5_error_code krb5_ser_db_context_init (krb5_context);
|
|
|
|
#define KRB5_KDB_DEF_FLAGS 0
|
|
|
|
#endif /* !defined(_WIN32) */
|
|
#endif /* KRB5_KDB5__ */
|