1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ 2 /* include/krb5/kdcpolicy_plugin.h - KDC policy plugin interface */ 3 /* 4 * Copyright (C) 2017 by Red Hat, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * * Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * * Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in 16 * the documentation and/or other materials provided with the 17 * distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 24 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 26 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 28 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 30 * OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* 34 * Declarations for kdcpolicy plugin module implementors. 35 * 36 * The kdcpolicy pluggable interface currently has only one supported major 37 * version, which is 1. Major version 1 has a current minor version number of 38 * 1. 39 * 40 * kdcpolicy plugin modules should define a function named 41 * kdcpolicy_<modulename>_initvt, matching the signature: 42 * 43 * krb5_error_code 44 * kdcpolicy_modname_initvt(krb5_context context, int maj_ver, int min_ver, 45 * krb5_plugin_vtable vtable); 46 * 47 * The initvt function should: 48 * 49 * - Check that the supplied maj_ver number is supported by the module, or 50 * return KRB5_PLUGIN_VER_NOTSUPP if it is not. 51 * 52 * - Cast the vtable pointer as appropriate for maj_ver: 53 * maj_ver == 1: Cast to krb5_kdcpolicy_vtable 54 * 55 * - Initialize the methods of the vtable, stopping as appropriate for the 56 * supplied min_ver. Optional methods may be left uninitialized. 57 * 58 * Memory for the vtable is allocated by the caller, not by the module. 59 */ 60 61 #ifndef KRB5_POLICY_PLUGIN_H 62 #define KRB5_POLICY_PLUGIN_H 63 64 #include <krb5/krb5.h> 65 66 /* Abstract module datatype. */ 67 typedef struct krb5_kdcpolicy_moddata_st *krb5_kdcpolicy_moddata; 68 69 /* A module can optionally include kdb.h to inspect principal entries when 70 * authorizing requests. */ 71 struct _krb5_db_entry_new; 72 73 /* 74 * Optional: Initialize module data. Return 0 on success, 75 * KRB5_PLUGIN_NO_HANDLE if the module is inoperable (due to configuration, for 76 * example), and any other error code to abort KDC startup. Optionally set 77 * *data_out to a module data object to be passed to future calls. 78 */ 79 typedef krb5_error_code 80 (*krb5_kdcpolicy_init_fn)(krb5_context context, 81 krb5_kdcpolicy_moddata *data_out); 82 83 /* Optional: Clean up module data. */ 84 typedef krb5_error_code 85 (*krb5_kdcpolicy_fini_fn)(krb5_context context, 86 krb5_kdcpolicy_moddata moddata); 87 88 /* 89 * Optional: return an error code and set status to an appropriate string 90 * literal to deny an AS request; otherwise return 0. lifetime_out, if set, 91 * restricts the ticket lifetime. renew_lifetime_out, if set, restricts the 92 * ticket renewable lifetime. 93 */ 94 typedef krb5_error_code 95 (*krb5_kdcpolicy_check_as_fn)(krb5_context context, 96 krb5_kdcpolicy_moddata moddata, 97 const krb5_kdc_req *request, 98 const struct _krb5_db_entry_new *client, 99 const struct _krb5_db_entry_new *server, 100 const char *const *auth_indicators, 101 const char **status, krb5_deltat *lifetime_out, 102 krb5_deltat *renew_lifetime_out); 103 104 /* 105 * Optional: return an error code and set status to an appropriate string 106 * literal to deny a TGS request; otherwise return 0. lifetime_out, if set, 107 * restricts the ticket lifetime. renew_lifetime_out, if set, restricts the 108 * ticket renewable lifetime. 109 */ 110 typedef krb5_error_code 111 (*krb5_kdcpolicy_check_tgs_fn)(krb5_context context, 112 krb5_kdcpolicy_moddata moddata, 113 const krb5_kdc_req *request, 114 const struct _krb5_db_entry_new *server, 115 const krb5_ticket *ticket, 116 const char *const *auth_indicators, 117 const char **status, krb5_deltat *lifetime_out, 118 krb5_deltat *renew_lifetime_out); 119 120 typedef struct krb5_kdcpolicy_vtable_st { 121 const char *name; 122 krb5_kdcpolicy_init_fn init; 123 krb5_kdcpolicy_fini_fn fini; 124 krb5_kdcpolicy_check_as_fn check_as; 125 krb5_kdcpolicy_check_tgs_fn check_tgs; 126 } *krb5_kdcpolicy_vtable; 127 128 #endif /* KRB5_POLICY_PLUGIN_H */ 129