source4/kdc/sdb.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Database Glue between Samba and the KDC
   5
   6    Copyright (C) Guenther Deschner <gd@samba.org> 2014
   7    Copyright (C) Andreas Schneider <asn@samba.org> 2014
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #ifndef _KDC_SDB_H_
  25 #define _KDC_SDB_H_
  26
  27 struct sdb_salt {
  28         unsigned int type;
  29         krb5_data salt;
  30 };
  31
  32 struct sdb_key {
  33         krb5_keyblock key;
  34         struct sdb_salt *salt;
  35 };
  36
  37 struct sdb_keys {
  38         unsigned int len;
  39         struct sdb_key *val;
  40 };
  41
  42 struct sdb_event {
  43         krb5_principal principal;
  44         time_t time;
  45 };
  46
  47 struct sdb_etypes {
  48         unsigned len;
  49         krb5_enctype *val;
  50 };
  51
  52 struct SDBFlags {
  53         unsigned int initial:1;
  54         unsigned int forwardable:1;
  55         unsigned int proxiable:1;
  56         unsigned int renewable:1;
  57         unsigned int postdate:1;
  58         unsigned int server:1;
  59         unsigned int client:1;
  60         unsigned int invalid:1;
  61         unsigned int require_preauth:1;
  62         unsigned int change_pw:1;
  63         unsigned int require_hwauth:1;
  64         unsigned int ok_as_delegate:1;
  65         unsigned int user_to_user:1;
  66         unsigned int immutable:1;
  67         unsigned int trusted_for_delegation:1;
  68         unsigned int allow_kerberos4:1;
  69         unsigned int allow_digest:1;
  70         unsigned int locked_out:1;
  71         unsigned int require_pwchange:1;
  72         unsigned int materialize:1;
  73         unsigned int virtual_keys:1;
  74         unsigned int virtual:1;
  75         unsigned int synthetic:1;
  76         unsigned int no_auth_data_reqd:1;
  77         unsigned int auth_data_reqd:1;
  78         unsigned int _unused25:1;
  79         unsigned int _unused26:1;
  80         unsigned int _unused27:1;
  81         unsigned int _unused28:1;
  82         unsigned int _unused29:1;
  83         unsigned int force_canonicalize:1;
  84         unsigned int do_not_store:1;
  85 };
  86
  87 struct sdb_entry {
  88         struct samba_kdc_entry *skdc_entry;
  89         krb5_principal principal;
  90         unsigned int kvno;
  91         struct sdb_keys keys;
  92         struct sdb_etypes *etypes;
  93         struct sdb_keys old_keys;
  94         struct sdb_keys older_keys;
  95         struct sdb_etypes *session_etypes;
  96         struct sdb_event created_by;
  97         struct sdb_event *modified_by;
  98         time_t *valid_start;
  99         time_t *valid_end;
 100         time_t *pw_end;
 101         int *max_life;
 102         int *max_renew;
 103         struct SDBFlags flags;
 104 };
 105
 106 #define SDB_ERR_NOENTRY 36150275
 107 #define SDB_ERR_NOT_FOUND_HERE 36150287
 108 #define SDB_ERR_WRONG_REALM 36150289
 109
 110 /* These must match the values in hdb.h */
 111
 112 #define SDB_F_DECRYPT           1       /* decrypt keys */
 113 #define SDB_F_GET_CLIENT        4       /* fetch client */
 114 #define SDB_F_GET_SERVER        8       /* fetch server */
 115 #define SDB_F_GET_KRBTGT        16      /* fetch krbtgt */
 116 #define SDB_F_GET_ANY           28      /* fetch any of client,server,krbtgt */
 117 #define SDB_F_CANON             32      /* want canonicalization */
 118 #define SDB_F_ADMIN_DATA        64      /* want data that kdc don't use  */
 119 #define SDB_F_KVNO_SPECIFIED    128     /* we want a particular KVNO */
 120 #define SDB_F_FOR_AS_REQ        4096    /* fetch is for a AS REQ */
 121 #define SDB_F_FOR_TGS_REQ       8192    /* fetch is for a TGS REQ */
 122 #define SDB_F_ARMOR_PRINCIPAL 262144    /* fetch is for the client of an armor ticket */
 123 #define SDB_F_USER2USER_PRINCIPAL 524288/* fetch is for the server of a user2user tgs-req */
 124
 125 #define SDB_F_HDB_MASK          (SDB_F_DECRYPT | \
 126                                  SDB_F_GET_CLIENT| \
 127                                  SDB_F_GET_SERVER | \
 128                                  SDB_F_GET_KRBTGT | \
 129                                  SDB_F_CANON | \
 130                                  SDB_F_ADMIN_DATA | \
 131                                  SDB_F_KVNO_SPECIFIED | \
 132                                  SDB_F_FOR_AS_REQ | \
 133                                  SDB_F_FOR_TGS_REQ | \
 134                                  SDB_F_ARMOR_PRINCIPAL| \
 135                                  SDB_F_USER2USER_PRINCIPAL)
 136
 137 /* These are not supported by HDB */
 138 #define SDB_F_FORCE_CANON       16384   /* force canonicalization */
 139 #define SDB_F_RODC_NUMBER_SPECIFIED     32768   /* we want a particular RODC number */
 140
 141 void sdb_key_free(struct sdb_key *key);
 142 void sdb_keys_free(struct sdb_keys *keys);
 143 void sdb_entry_free(struct sdb_entry *e);
 144 krb5_error_code sdb_entry_set_etypes(struct sdb_entry *s);
 145 krb5_error_code sdb_entry_set_session_etypes(struct sdb_entry *s,
 146                                              bool add_aes256,
 147                                              bool add_aes128,
 148                                              bool add_rc4);
 149
 150 #endif /* _KDC_SDB_H_ */