lib/hdb/hdb.h

   1 /*
   2  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 /* $Id$ */
  35
  36 #ifndef __HDB_H__
  37 #define __HDB_H__
  38
  39 #include <stdio.h>
  40
  41 #include <krb5.h>
  42
  43 #include <hdb_err.h>
  44
  45 #include <heimbase-svc.h>
  46 #include <heim_asn1.h>
  47 #include <hdb_asn1.h>
  48
  49 #define HDB_DB_FORMAT hdb_db_format
  50
  51 typedef HDB_keyset hdb_keyset;
  52 typedef HDB_entry hdb_entry;
  53 typedef HDB_entry_alias hdb_entry_alias;
  54
  55 struct hdb_dbinfo;
  56
  57 enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
  58
  59 /* flags for various functions */
  60 #define HDB_F_DECRYPT           0x00001 /* decrypt keys */
  61 #define HDB_F_REPLACE           0x00002 /* replace entry */
  62 #define HDB_F_GET_CLIENT        0x00004 /* fetch client */
  63 #define HDB_F_GET_SERVER        0x00008 /* fetch server */
  64 #define HDB_F_GET_KRBTGT        0x00010 /* fetch krbtgt */
  65 #define HDB_F_GET_ANY           ( HDB_F_GET_CLIENT | \
  66                                   HDB_F_GET_SERVER | \
  67                                   HDB_F_GET_KRBTGT ) /* fetch any of client,server,krbtgt */
  68 #define HDB_F_CANON             0x00020 /* want canonicalition */
  69 #define HDB_F_ADMIN_DATA        0x00040 /* want data that kdc don't use  */
  70 #define HDB_F_KVNO_SPECIFIED    0x00080 /* we want a particular KVNO */
  71 #define HDB_F_LIVE_CLNT_KVNOS   0x00200 /* we want all live keys for pre-auth */
  72 #define HDB_F_LIVE_SVC_KVNOS    0x00400 /* we want all live keys for tix */
  73 #define HDB_F_ALL_KVNOS         0x00800 /* we want all the keys, live or not */
  74 #define HDB_F_FOR_AS_REQ        0x01000 /* fetch is for a AS REQ */
  75 #define HDB_F_FOR_TGS_REQ       0x02000 /* fetch is for a TGS REQ */
  76 #define HDB_F_PRECHECK          0x04000 /* check that the operation would succeed */
  77 #define HDB_F_DELAY_NEW_KEYS    0x08000 /* apply [hdb] new_service_key_delay */
  78 #define HDB_F_SYNTHETIC_OK      0x10000 /* synthetic principal for PKINIT or GSS preauth OK */
  79 #define HDB_F_GET_FAST_COOKIE   0x20000 /* fetch the FX-COOKIE key (not a normal principal) */
  80
  81 /* hdb_capability_flags */
  82 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
  83 #define HDB_CAP_F_HANDLE_PASSWORDS      2
  84 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS  4
  85 #define HDB_CAP_F_SHARED_DIRECTORY      8
  86
  87 #define heim_pcontext krb5_context
  88 #define heim_pconfig void *
  89
  90 typedef struct hdb_request_desc {
  91     HEIM_SVC_REQUEST_DESC_COMMON_ELEMENTS;
  92 } *hdb_request_t;
  93
  94 #undef heim_pcontext
  95 #undef heim_pconfig
  96
  97 /* key usage for master key */
  98 #define HDB_KU_MKEY     0x484442
  99
 100 /*
 101  * Second component of WELLKNOWN namespace principals, the third component is
 102  * the common DNS suffix of the implied virtual hosts.
 103  */
 104 #define HDB_WK_NAMESPACE "HOSTBASED-NAMESPACE"
 105
 106 typedef struct hdb_master_key_data *hdb_master_key;
 107
 108 /**
 109  * HDB backend function pointer structure
 110  *
 111  * The HDB structure is what the KDC and kadmind framework uses to
 112  * query the backend database when talking about principals.
 113  */
 114
 115 typedef struct HDB {
 116     void *hdb_db;
 117     void *hdb_dbc; /** don't use, only for DB3 */
 118     const char *hdb_method_name;
 119     char *hdb_name;
 120     int hdb_master_key_set;
 121     hdb_master_key hdb_master_key;
 122     int hdb_openp;
 123     int hdb_capability_flags;
 124     int lock_count;
 125     int lock_type;
 126     /*
 127      * These fields cache config values.
 128      *
 129      * XXX Move these into a structure that we point to so that we
 130      * don't need to break the ABI every time we add a field.
 131      */
 132     int enable_virtual_hostbased_princs;
 133     size_t virtual_hostbased_princ_ndots;   /* Min. # of .s in hostname */
 134     size_t virtual_hostbased_princ_maxdots; /* Max. # of .s in namespace */
 135     char **virtual_hostbased_princ_svcs;    /* Which svcs are not wildcarded */
 136     time_t new_service_key_delay;           /* Delay for new keys */
 137     /**
 138      * Open (or create) the a Kerberos database.
 139      *
 140      * Open (or create) the a Kerberos database that was resolved with
 141      * hdb_create(). The third and fourth flag to the function are the
 142      * same as open(), thus passing O_CREAT will create the data base
 143      * if it doesn't exists.
 144      *
 145      * Then done the caller should call hdb_close(), and to release
 146      * all resources hdb_destroy().
 147      */
 148     krb5_error_code (*hdb_open)(krb5_context, struct HDB*, int, mode_t);
 149     /**
 150      * Close the database for transaction
 151      *
 152      * Closes the database for further transactions, wont release any
 153      * permanant resources. the database can be ->hdb_open-ed again.
 154      */
 155     krb5_error_code (*hdb_close)(krb5_context, struct HDB*);
 156     /**
 157      * Free backend-specific entry context.
 158      */
 159     void            (*hdb_free_entry_context)(krb5_context, struct HDB*, hdb_entry*);
 160     /**
 161      * Fetch an entry from the backend
 162      *
 163      * Fetch an entry from the backend, flags are what type of entry
 164      * should be fetch: client, server, krbtgt.
 165      * knvo (if specified and flags HDB_F_KVNO_SPECIFIED set) is the kvno to get
 166      */
 167     krb5_error_code (*hdb_fetch_kvno)(krb5_context, struct HDB*,
 168                                       krb5_const_principal, unsigned, krb5_kvno,
 169                                       hdb_entry*);
 170     /**
 171      * Store an entry to database
 172      */
 173     krb5_error_code (*hdb_store)(krb5_context, struct HDB*,
 174                                  unsigned, hdb_entry*);
 175     /**
 176      * Remove an entry from the database.
 177      */
 178     krb5_error_code (*hdb_remove)(krb5_context, struct HDB*,
 179                                   unsigned, krb5_const_principal);
 180     /**
 181      * As part of iteration, fetch one entry
 182      */
 183     krb5_error_code (*hdb_firstkey)(krb5_context, struct HDB*,
 184                                     unsigned, hdb_entry*);
 185     /**
 186      * As part of iteration, fetch next entry
 187      */
 188     krb5_error_code (*hdb_nextkey)(krb5_context, struct HDB*,
 189                                    unsigned, hdb_entry*);
 190     /**
 191      * Lock database
 192      *
 193      * A lock can only be held by one consumers. Transaction can still
 194      * happen on the database while the lock is held, so the entry is
 195      * only useful for syncroning creation of the database and renaming of the database.
 196      */
 197     krb5_error_code (*hdb_lock)(krb5_context, struct HDB*, int);
 198     /**
 199      * Unlock database
 200      */
 201     krb5_error_code (*hdb_unlock)(krb5_context, struct HDB*);
 202     /**
 203      * Rename the data base.
 204      *
 205      * Assume that the database is not hdb_open'ed and not locked.
 206      */
 207     krb5_error_code (*hdb_rename)(krb5_context, struct HDB*, const char*);
 208     /**
 209      * Get an hdb_entry from a classical DB backend
 210      *
 211      * This function takes a principal key (krb5_data) and returns all
 212      * data related to principal in the return krb5_data. The returned
 213      * encoded entry is of type hdb_entry or hdb_entry_alias.
 214      */
 215     krb5_error_code (*hdb__get)(krb5_context, struct HDB*,
 216                                 krb5_data, krb5_data*);
 217     /**
 218      * Store an hdb_entry from a classical DB backend
 219      *
 220      * This function takes a principal key (krb5_data) and encoded
 221      * hdb_entry or hdb_entry_alias as the data to store.
 222      *
 223      * For a file-based DB, this must synchronize to disk when done.
 224      * This is sub-optimal for kadm5_s_rename_principal(), and for
 225      * kadm5_s_modify_principal() when using principal aliases; to
 226      * improve this so that only one fsync() need be done
 227      * per-transaction will require HDB API extensions.
 228      */
 229     krb5_error_code (*hdb__put)(krb5_context, struct HDB*, int,
 230                                 krb5_data, krb5_data);
 231     /**
 232      * Delete and hdb_entry from a classical DB backend
 233      *
 234      * This function takes a principal key (krb5_data) naming the record
 235      * to delete.
 236      *
 237      * Same discussion as in @ref HDB::hdb__put
 238      */
 239     krb5_error_code (*hdb__del)(krb5_context, struct HDB*, krb5_data);
 240     /**
 241      * Destroy the handle to the database.
 242      *
 243      * Destroy the handle to the database, deallocate all memory and
 244      * related resources. Does not remove any permanent data. Its the
 245      * logical reverse of hdb_create() function that is the entry
 246      * point for the module.
 247      */
 248     krb5_error_code (*hdb_destroy)(krb5_context, struct HDB*);
 249     /**
 250      * Get the list of realms this backend handles.
 251      * This call is optional to support. The returned realms are used
 252      * for announcing the realms over bonjour. Free returned array
 253      * with krb5_free_host_realm().
 254      */
 255     krb5_error_code (*hdb_get_realms)(krb5_context, struct HDB *, krb5_realm **);
 256     /**
 257      * Change password.
 258      *
 259      * Will update keys for the entry when given password.  The new
 260      * keys must be written into the entry and will then later be
 261      * ->hdb_store() into the database. The backend will still perform
 262      * all other operations, increasing the kvno, and update
 263      * modification timestamp.
 264      *
 265      * The backend needs to call _kadm5_set_keys() and perform password
 266      * quality checks.
 267      */
 268     krb5_error_code (*hdb_password)(krb5_context, struct HDB*, hdb_entry*, const char *, int);
 269
 270     /**
 271      * Authentication auditing. Note that this function is called by
 272      * both the AS and TGS, but currently only the AS sets the auth
 273      * event type. This may change in a future version.
 274      *
 275      * Event details are available by querying the request using
 276      * heim_audit_getkv(HDB_REQUEST_KV_...).
 277      *
 278      * In case the entry is locked out, the backend should set the
 279      * hdb_entry.flags.locked-out flag.
 280      */
 281     krb5_error_code (*hdb_audit)(krb5_context, struct HDB *, hdb_entry *, hdb_request_t);
 282
 283     /**
 284      * Check if delegation is allowed.
 285      */
 286     krb5_error_code (*hdb_check_constrained_delegation)(krb5_context, struct HDB *, hdb_entry *, krb5_const_principal);
 287
 288     /**
 289      * Check if this name is an alias for the supplied client for PKINIT userPrinicpalName logins
 290      */
 291     krb5_error_code (*hdb_check_pkinit_ms_upn_match)(krb5_context, struct HDB *, hdb_entry *, krb5_const_principal);
 292
 293     /**
 294      * Check if s4u2self is allowed from this client to this server or the SPN is a valid SPN of this client (for user2user)
 295      */
 296     krb5_error_code (*hdb_check_client_matches_target_service)(krb5_context, struct HDB *, hdb_entry *, hdb_entry *);
 297
 298     /**
 299      * Enable/disable synchronous updates
 300      *
 301      * Calling this with 0 disables sync.  Calling it with non-zero enables
 302      * sync and does an fsync().
 303      */
 304     krb5_error_code (*hdb_set_sync)(krb5_context, struct HDB *, int);
 305 }HDB;
 306
 307 #define HDB_INTERFACE_VERSION   11
 308
 309 struct hdb_method {
 310     int                 version;
 311     unsigned int        is_file_based:1;
 312     unsigned int        can_taste:1;
 313     krb5_error_code     (*init)(krb5_context, void **);
 314     void                (*fini)(void *);
 315     const char *prefix;
 316     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
 317 };
 318
 319 /* dump entry format, for hdb_print_entry() */
 320 typedef enum hdb_dump_format {
 321     HDB_DUMP_HEIMDAL = 0,
 322     HDB_DUMP_MIT = 1,
 323 } hdb_dump_format_t;
 324
 325 struct hdb_print_entry_arg {
 326     FILE *out;
 327     hdb_dump_format_t fmt;
 328 };
 329
 330 typedef krb5_error_code (*hdb_foreach_func_t)(krb5_context, HDB*,
 331                                               hdb_entry*, void*);
 332 extern krb5_kt_ops hdb_kt_ops;
 333 extern krb5_kt_ops hdb_get_kt_ops;
 334
 335 extern const int hdb_interface_version;
 336
 337 #include <hdb-protos.h>
 338
 339 #endif /* __HDB_H__ */