crypto/external/bsd/heimdal/dist/lib/hdb/hdb.h

   1 /*      $NetBSD: hdb.h,v 1.1.1.3 2014/04/24 12:45:28 pettai Exp $       */
   2
   3 /*
   4  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
   5  * (Royal Institute of Technology, Stockholm, Sweden).
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 /* Id */
  37
  38 #ifndef __HDB_H__
  39 #define __HDB_H__
  40
  41 #include <krb5/krb5.h>
  42
  43 #include <krb5/hdb_err.h>
  44
  45 #include <krb5/heim_asn1.h>
  46 #include <krb5/hdb_asn1.h>
  47
  48 struct hdb_dbinfo;
  49
  50 enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
  51
  52 /* flags for various functions */
  53 #define HDB_F_DECRYPT           1       /* decrypt keys */
  54 #define HDB_F_REPLACE           2       /* replace entry */
  55 #define HDB_F_GET_CLIENT        4       /* fetch client */
  56 #define HDB_F_GET_SERVER        8       /* fetch server */
  57 #define HDB_F_GET_KRBTGT        16      /* fetch krbtgt */
  58 #define HDB_F_GET_ANY           28      /* fetch any of client,server,krbtgt */
  59 #define HDB_F_CANON             32      /* want canonicalition */
  60 #define HDB_F_ADMIN_DATA        64      /* want data that kdc don't use  */
  61 #define HDB_F_KVNO_SPECIFIED    128     /* we want a particular KVNO */
  62 #define HDB_F_CURRENT_KVNO      256     /* we want the current KVNO */
  63 /* 512, 1024, 2048 are reserved for kvno operations that is not part of the 1.5 branch */
  64 #define HDB_F_ALL_KVNOS         2048    /* we want all the keys, live or not */
  65 #define HDB_F_FOR_AS_REQ        4096    /* fetch is for a AS REQ */
  66 #define HDB_F_FOR_TGS_REQ       8192    /* fetch is for a TGS REQ */
  67
  68 /* hdb_capability_flags */
  69 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
  70 #define HDB_CAP_F_HANDLE_PASSWORDS      2
  71 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS  4
  72
  73 /* auth status values */
  74 #define HDB_AUTH_SUCCESS                0
  75 #define HDB_AUTH_WRONG_PASSWORD         1
  76 #define HDB_AUTH_INVALID_SIGNATURE      2
  77
  78 /* key usage for master key */
  79 #define HDB_KU_MKEY     0x484442
  80
  81 typedef struct hdb_master_key_data *hdb_master_key;
  82
  83 /**
  84  * hdb_entry_ex is a wrapper structure around the hdb_entry structure
  85  * that allows backends to keep a pointer to the backing store, ie in
  86  * ->hdb_fetch_kvno(), so that we the kadmin/kpasswd backend gets around to
  87  * ->hdb_store(), the backend doesn't need to lookup the entry again.
  88  */
  89
  90 typedef struct hdb_entry_ex {
  91     void *ctx;
  92     hdb_entry entry;
  93     void (*free_entry)(krb5_context, struct hdb_entry_ex *);
  94 } hdb_entry_ex;
  95
  96
  97 /**
  98  * HDB backend function pointer structure
  99  *
 100  * The HDB structure is what the KDC and kadmind framework uses to
 101  * query the backend database when talking about principals.
 102  */
 103
 104 typedef struct HDB{
 105     void *hdb_db;
 106     void *hdb_dbc; /** don't use, only for DB3 */
 107     char *hdb_name;
 108     int hdb_master_key_set;
 109     hdb_master_key hdb_master_key;
 110     int hdb_openp;
 111     int hdb_capability_flags;
 112     /**
 113      * Open (or create) the a Kerberos database.
 114      *
 115      * Open (or create) the a Kerberos database that was resolved with
 116      * hdb_create(). The third and fourth flag to the function are the
 117      * same as open(), thus passing O_CREAT will create the data base
 118      * if it doesn't exists.
 119      *
 120      * Then done the caller should call hdb_close(), and to release
 121      * all resources hdb_destroy().
 122      */
 123     krb5_error_code (*hdb_open)(krb5_context, struct HDB*, int, mode_t);
 124     /**
 125      * Close the database for transaction
 126      *
 127      * Closes the database for further transactions, wont release any
 128      * permanant resources. the database can be ->hdb_open-ed again.
 129      */
 130     krb5_error_code (*hdb_close)(krb5_context, struct HDB*);
 131     /**
 132      * Free an entry after use.
 133      */
 134     void            (*hdb_free)(krb5_context, struct HDB*, hdb_entry_ex*);
 135     /**
 136      * Fetch an entry from the backend
 137      *
 138      * Fetch an entry from the backend, flags are what type of entry
 139      * should be fetch: client, server, krbtgt.
 140      * knvo (if specified and flags HDB_F_KVNO_SPECIFIED set) is the kvno to get
 141      */
 142     krb5_error_code (*hdb_fetch_kvno)(krb5_context, struct HDB*,
 143                                       krb5_const_principal, unsigned, krb5_kvno,
 144                                       hdb_entry_ex*);
 145     /**
 146      * Store an entry to database
 147      */
 148     krb5_error_code (*hdb_store)(krb5_context, struct HDB*,
 149                                  unsigned, hdb_entry_ex*);
 150     /**
 151      * Remove an entry from the database.
 152      */
 153     krb5_error_code (*hdb_remove)(krb5_context, struct HDB*,
 154                                   krb5_const_principal);
 155     /**
 156      * As part of iteration, fetch one entry
 157      */
 158     krb5_error_code (*hdb_firstkey)(krb5_context, struct HDB*,
 159                                     unsigned, hdb_entry_ex*);
 160     /**
 161      * As part of iteration, fetch next entry
 162      */
 163     krb5_error_code (*hdb_nextkey)(krb5_context, struct HDB*,
 164                                    unsigned, hdb_entry_ex*);
 165     /**
 166      * Lock database
 167      *
 168      * A lock can only be held by one consumers. Transaction can still
 169      * happen on the database while the lock is held, so the entry is
 170      * only useful for syncroning creation of the database and renaming of the database.
 171      */
 172     krb5_error_code (*hdb_lock)(krb5_context, struct HDB*, int);
 173     /**
 174      * Unlock database
 175      */
 176     krb5_error_code (*hdb_unlock)(krb5_context, struct HDB*);
 177     /**
 178      * Rename the data base.
 179      *
 180      * Assume that the database is not hdb_open'ed and not locked.
 181      */
 182     krb5_error_code (*hdb_rename)(krb5_context, struct HDB*, const char*);
 183     /**
 184      * Get an hdb_entry from a classical DB backend
 185      *
 186      * If the database is a classical DB (ie BDB, NDBM, GDBM, etc)
 187      * backend, this function will take a principal key (krb5_data)
 188      * and return all data related to principal in the return
 189      * krb5_data. The returned encoded entry is of type hdb_entry or
 190      * hdb_entry_alias.
 191      */
 192     krb5_error_code (*hdb__get)(krb5_context, struct HDB*,
 193                                 krb5_data, krb5_data*);
 194     /**
 195      * Store an hdb_entry from a classical DB backend
 196      *
 197      * Same discussion as in @ref HDB::hdb__get
 198      */
 199     krb5_error_code (*hdb__put)(krb5_context, struct HDB*, int,
 200                                 krb5_data, krb5_data);
 201     /**
 202      * Delete and hdb_entry from a classical DB backend
 203      *
 204      * Same discussion as in @ref HDB::hdb__get
 205      */
 206     krb5_error_code (*hdb__del)(krb5_context, struct HDB*, krb5_data);
 207     /**
 208      * Destroy the handle to the database.
 209      *
 210      * Destroy the handle to the database, deallocate all memory and
 211      * related resources. Does not remove any permanent data. Its the
 212      * logical reverse of hdb_create() function that is the entry
 213      * point for the module.
 214      */
 215     krb5_error_code (*hdb_destroy)(krb5_context, struct HDB*);
 216     /**
 217      * Get the list of realms this backend handles.
 218      * This call is optional to support. The returned realms are used
 219      * for announcing the realms over bonjour. Free returned array
 220      * with krb5_free_host_realm().
 221      */
 222     krb5_error_code (*hdb_get_realms)(krb5_context, struct HDB *, krb5_realm **);
 223     /**
 224      * Change password.
 225      *
 226      * Will update keys for the entry when given password.  The new
 227      * keys must be written into the entry and will then later be
 228      * ->hdb_store() into the database. The backend will still perform
 229      * all other operations, increasing the kvno, and update
 230      * modification timestamp.
 231      *
 232      * The backend needs to call _kadm5_set_keys() and perform password
 233      * quality checks.
 234      */
 235     krb5_error_code (*hdb_password)(krb5_context, struct HDB*, hdb_entry_ex*, const char *, int);
 236
 237     /**
 238      * Auth feedback
 239      *
 240      * This is a feedback call that allows backends that provides
 241      * lockout functionality to register failure and/or successes.
 242      *
 243      * In case the entry is locked out, the backend should set the
 244      * hdb_entry.flags.locked-out flag.
 245      */
 246     krb5_error_code (*hdb_auth_status)(krb5_context, struct HDB *, hdb_entry_ex *, int);
 247     /**
 248      * Check if delegation is allowed.
 249      */
 250     krb5_error_code (*hdb_check_constrained_delegation)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
 251
 252     /**
 253      * Check if this name is an alias for the supplied client for PKINIT userPrinicpalName logins
 254      */
 255     krb5_error_code (*hdb_check_pkinit_ms_upn_match)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
 256
 257     /**
 258      * Check if s4u2self is allowed from this client to this server
 259      */
 260     krb5_error_code (*hdb_check_s4u2self)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
 261 }HDB;
 262
 263 #define HDB_INTERFACE_VERSION   7
 264
 265 struct hdb_so_method {
 266     int version;
 267     const char *prefix;
 268     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
 269 };
 270
 271 typedef krb5_error_code (*hdb_foreach_func_t)(krb5_context, HDB*,
 272                                               hdb_entry_ex*, void*);
 273 extern krb5_kt_ops hdb_kt_ops;
 274
 275 struct hdb_method {
 276     int interface_version;
 277     const char *prefix;
 278     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
 279 };
 280
 281 extern const int hdb_interface_version;
 282
 283 #include <krb5/hdb-protos.h>
 284
 285 #endif /* __HDB_H__ */