1 /* 2 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5 6 /* 7 * include/krb5/kdb.h 8 * 9 * Copyright 1990,1991 by the Massachusetts Institute of Technology. 10 * All Rights Reserved. 11 * 12 * Export of this software from the United States of America may 13 * require a specific license from the United States Government. 14 * It is the responsibility of any person or organization contemplating 15 * export to obtain such a license before exporting. 16 * 17 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 18 * distribute this software and its documentation for any purpose and 19 * without fee is hereby granted, provided that the above copyright 20 * notice appear in all copies and that both that copyright notice and 21 * this permission notice appear in supporting documentation, and that 22 * the name of M.I.T. not be used in advertising or publicity pertaining 23 * to distribution of the software without specific, written prior 24 * permission. Furthermore if you modify this software you must label 25 * your software as modified software and not distribute it in such a 26 * fashion that it might be confused with the original M.I.T. software. 27 * M.I.T. makes no representations about the suitability of 28 * this software for any purpose. It is provided "as is" without express 29 * or implied warranty. 30 * 31 * 32 * KDC Database interface definitions. 33 */ 34 35 /* 36 * Copyright (C) 1998 by the FundsXpress, INC. 37 * 38 * All rights reserved. 39 * 40 * Export of this software from the United States of America may require 41 * a specific license from the United States Government. It is the 42 * responsibility of any person or organization contemplating export to 43 * obtain such a license before exporting. 44 * 45 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 46 * distribute this software and its documentation for any purpose and 47 * without fee is hereby granted, provided that the above copyright 48 * notice appear in all copies and that both that copyright notice and 49 * this permission notice appear in supporting documentation, and that 50 * the name of FundsXpress. not be used in advertising or publicity pertaining 51 * to distribution of the software without specific, written prior 52 * permission. FundsXpress makes no representations about the suitability of 53 * this software for any purpose. It is provided "as is" without express 54 * or implied warranty. 55 * 56 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 57 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 58 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 59 */ 60 61 #ifndef KRB5_KDB5__ 62 #define KRB5_KDB5__ 63 64 #pragma ident "%Z%%M% %I% %E% SMI" 65 66 /* Salt types */ 67 #define KRB5_KDB_SALTTYPE_NORMAL 0 68 #define KRB5_KDB_SALTTYPE_V4 1 69 #define KRB5_KDB_SALTTYPE_NOREALM 2 70 #define KRB5_KDB_SALTTYPE_ONLYREALM 3 71 #define KRB5_KDB_SALTTYPE_SPECIAL 4 72 #define KRB5_KDB_SALTTYPE_AFS3 5 73 74 /* Attributes */ 75 #define KRB5_KDB_DISALLOW_POSTDATED 0x00000001 76 #define KRB5_KDB_DISALLOW_FORWARDABLE 0x00000002 77 #define KRB5_KDB_DISALLOW_TGT_BASED 0x00000004 78 #define KRB5_KDB_DISALLOW_RENEWABLE 0x00000008 79 #define KRB5_KDB_DISALLOW_PROXIABLE 0x00000010 80 #define KRB5_KDB_DISALLOW_DUP_SKEY 0x00000020 81 #define KRB5_KDB_DISALLOW_ALL_TIX 0x00000040 82 #define KRB5_KDB_REQUIRES_PRE_AUTH 0x00000080 83 #define KRB5_KDB_REQUIRES_HW_AUTH 0x00000100 84 #define KRB5_KDB_REQUIRES_PWCHANGE 0x00000200 85 #define KRB5_KDB_DISALLOW_SVR 0x00001000 86 #define KRB5_KDB_PWCHANGE_SERVICE 0x00002000 87 #define KRB5_KDB_SUPPORT_DESMD5 0x00004000 88 #define KRB5_KDB_NEW_PRINC 0x00008000 89 90 /* Creation flags */ 91 #define KRB5_KDB_CREATE_BTREE 0x00000001 92 #define KRB5_KDB_CREATE_HASH 0x00000002 93 94 #if !defined(_WIN32) 95 96 /* 97 * Note --- these structures cannot be modified without changing the 98 * database version number in libkdb.a, but should be expandable by 99 * adding new tl_data types. 100 */ 101 typedef struct _krb5_tl_data { 102 struct _krb5_tl_data* tl_data_next; /* NOT saved */ 103 krb5_int16 tl_data_type; 104 krb5_ui_2 tl_data_length; 105 krb5_octet * tl_data_contents; 106 } krb5_tl_data; 107 108 /* 109 * If this ever changes up the version number and make the arrays be as 110 * big as necessary. 111 * 112 * Currently the first type is the enctype and the second is the salt type. 113 */ 114 typedef struct _krb5_key_data { 115 krb5_int16 key_data_ver; /* Version */ 116 krb5_int16 key_data_kvno; /* Key Version */ 117 krb5_int16 key_data_type[2]; /* Array of types */ 118 #if 0 119 /* 120 * SUNW14resync (mech) 121 * This has changed in the mech so we change it here also 122 * prior to the admin resync. 123 */ 124 krb5_ui_2 key_data_length[2]; Array of lengths 125 #endif 126 krb5_int16 key_data_length[2]; /* Array of lengths */ 127 krb5_octet * key_data_contents[2]; /* Array of pointers */ 128 } krb5_key_data; 129 130 #define KRB5_KDB_V1_KEY_DATA_ARRAY 2 /* # of array elements */ 131 132 typedef struct _krb5_keysalt { 133 krb5_int16 type; 134 krb5_data data; /* Length, data */ 135 } krb5_keysalt; 136 137 typedef struct _krb5_db_entry_new { 138 krb5_magic magic; /* NOT saved */ 139 krb5_ui_2 len; 140 krb5_flags attributes; 141 krb5_deltat max_life; 142 krb5_deltat max_renewable_life; 143 krb5_timestamp expiration; /* When the client expires */ 144 krb5_timestamp pw_expiration; /* When its passwd expires */ 145 krb5_timestamp last_success; /* Last successful passwd */ 146 krb5_timestamp last_failed; /* Last failed passwd attempt */ 147 krb5_kvno fail_auth_count; /* # of failed passwd attempt */ 148 krb5_int16 n_tl_data; 149 krb5_int16 n_key_data; 150 krb5_ui_2 e_length; /* Length of extra data */ 151 krb5_octet * e_data; /* Extra data to be saved */ 152 153 krb5_principal princ; /* Length, data */ 154 krb5_tl_data * tl_data; /* Linked list */ 155 krb5_key_data * key_data; /* Array */ 156 } krb5_db_entry; 157 158 #define KRB5_KDB_MAGIC_NUMBER 0xdbdbdbdb 159 #define KRB5_KDB_V1_BASE_LENGTH 38 160 161 #define KRB5_TL_LAST_PWD_CHANGE 0x0001 162 #define KRB5_TL_MOD_PRINC 0x0002 163 #define KRB5_TL_KADM_DATA 0x0003 164 #define KRB5_TL_KADM5_E_DATA 0x0004 165 #define KRB5_TL_RB1_CHALLENGE 0x0005 166 #ifdef SECURID 167 #define KRB5_TL_SECURID_STATE 0x0006 168 #endif /* SECURID */ 169 170 /* 171 * Determines the number of failed KDC requests before DISALLOW_ALL_TIX is set 172 * on the principal. 173 */ 174 #define KRB5_MAX_FAIL_COUNT 5 175 176 /* XXX depends on knowledge of krb5_parse_name() formats */ 177 #define KRB5_KDB_M_NAME "K/M" /* Kerberos/Master */ 178 179 /* prompts used by default when reading the KDC password from the keyboard. */ 180 #define KRB5_KDC_MKEY_1 "Enter KDC database master key" 181 #define KRB5_KDC_MKEY_2 "Re-enter KDC database master key to verify" 182 183 extern char *krb5_mkey_pwd_prompt1; 184 extern char *krb5_mkey_pwd_prompt2; 185 186 /* 187 * These macros specify the encoding of data within the database. 188 * 189 * Data encoding is little-endian. 190 */ 191 #define krb5_kdb_decode_int16(cp, i16) \ 192 *((krb5_int16 *) &(i16)) = (((krb5_int16) ((unsigned char) (cp)[0]))| \ 193 ((krb5_int16) ((unsigned char) (cp)[1]) << 8)) 194 #define krb5_kdb_decode_int32(cp, i32) \ 195 *((krb5_int32 *) &(i32)) = (((krb5_int32) ((unsigned char) (cp)[0]))| \ 196 ((krb5_int32) ((unsigned char) (cp)[1]) << 8) | \ 197 ((krb5_int32) ((unsigned char) (cp)[2]) << 16)| \ 198 ((krb5_int32) ((unsigned char) (cp)[3]) << 24)) 199 #define krb5_kdb_encode_int16(i16, cp) \ 200 { \ 201 (cp)[0] = (unsigned char) ((i16) & 0xff); \ 202 (cp)[1] = (unsigned char) (((i16) >> 8) & 0xff); \ 203 } 204 #define krb5_kdb_encode_int32(i32, cp) \ 205 { \ 206 (cp)[0] = (unsigned char) ((i32) & 0xff); \ 207 (cp)[1] = (unsigned char) (((i32) >> 8) & 0xff); \ 208 (cp)[2] = (unsigned char) (((i32) >> 16) & 0xff); \ 209 (cp)[3] = (unsigned char) (((i32) >> 24) & 0xff); \ 210 } 211 212 /* libkdb.spec */ 213 krb5_error_code krb5_db_set_name (krb5_context, char * ); 214 krb5_error_code krb5_db_init (krb5_context); 215 krb5_error_code krb5_db_fini (krb5_context); 216 krb5_error_code krb5_db_get_age (krb5_context, char *, time_t * ); 217 krb5_error_code krb5_db_create (krb5_context, char *, krb5_int32 ); 218 krb5_error_code krb5_db_rename (krb5_context, char *, char * ); 219 krb5_error_code krb5_db_get_principal (krb5_context, krb5_const_principal , 220 krb5_db_entry *, int *, 221 krb5_boolean * ); 222 void krb5_db_free_principal (krb5_context, krb5_db_entry *, int ); 223 krb5_error_code krb5_db_put_principal (krb5_context, krb5_db_entry *, int * ); 224 krb5_error_code krb5_db_delete_principal (krb5_context, krb5_const_principal, 225 int * ); 226 krb5_error_code krb5_db_iterate (krb5_context, 227 krb5_error_code (* ) (krb5_pointer, 228 krb5_db_entry *), 229 krb5_pointer); 230 krb5_error_code krb5_db_iterate_ext (krb5_context, 231 krb5_error_code (* ) (krb5_pointer, 232 krb5_db_entry *), 233 krb5_pointer, int, int); 234 krb5_error_code krb5_db_verify_master_key (krb5_context, krb5_principal, 235 krb5_keyblock *); 236 krb5_error_code krb5_db_store_mkey (krb5_context, char *, krb5_principal, 237 krb5_keyblock *); 238 239 krb5_error_code krb5_db_setup_mkey_name (krb5_context, const char *, 240 const char *, char **, 241 krb5_principal *); 242 243 krb5_error_code krb5_db_set_mkey (krb5_context, krb5_keyblock *); 244 245 krb5_error_code krb5_db_get_mkey (krb5_context, krb5_keyblock **); 246 krb5_error_code krb5_db_destroy (krb5_context, char * ); 247 krb5_error_code krb5_db_lock (krb5_context, int ); 248 krb5_error_code krb5_db_unlock (krb5_context); 249 krb5_error_code krb5_db_set_nonblocking (krb5_context, krb5_boolean, 250 krb5_boolean * ); 251 krb5_boolean krb5_db_set_lockmode (krb5_context, krb5_boolean); 252 krb5_error_code krb5_db_fetch_mkey (krb5_context, krb5_principal, krb5_enctype, 253 krb5_boolean, krb5_boolean, char *, 254 krb5_data *, 255 krb5_keyblock * ); 256 257 krb5_error_code krb5_db_open_database (krb5_context); 258 krb5_error_code krb5_db_close_database (krb5_context); 259 260 krb5_error_code krb5_dbekd_encrypt_key_data (krb5_context, 261 const krb5_keyblock *, 262 const krb5_keyblock *, 263 const krb5_keysalt *, 264 int, 265 krb5_key_data *); 266 krb5_error_code krb5_dbekd_decrypt_key_data (krb5_context, 267 const krb5_keyblock *, 268 const krb5_key_data *, 269 krb5_keyblock *, 270 krb5_keysalt *); 271 krb5_error_code krb5_dbe_create_key_data (krb5_context, 272 krb5_db_entry *); 273 krb5_error_code krb5_dbe_update_tl_data (krb5_context, 274 krb5_db_entry *, 275 krb5_tl_data *); 276 krb5_error_code krb5_dbe_lookup_tl_data (krb5_context, 277 krb5_db_entry *, 278 krb5_tl_data *); 279 krb5_error_code krb5_dbe_update_last_pwd_change (krb5_context, 280 krb5_db_entry *, 281 krb5_timestamp); 282 krb5_error_code krb5_dbe_lookup_last_pwd_change (krb5_context, 283 krb5_db_entry *, 284 krb5_timestamp *); 285 krb5_error_code krb5_dbe_update_mod_princ_data (krb5_context, 286 krb5_db_entry *, 287 krb5_timestamp, 288 krb5_const_principal); 289 krb5_error_code krb5_dbe_lookup_mod_princ_data (krb5_context, 290 krb5_db_entry *, 291 krb5_timestamp *, 292 krb5_principal *); 293 int krb5_encode_princ_dbkey (krb5_context, krb5_data *, krb5_const_principal); 294 void krb5_free_princ_dbkey (krb5_context, krb5_data *); 295 krb5_error_code krb5_encode_princ_contents (krb5_context, krb5_data *, 296 krb5_db_entry *); 297 void krb5_free_princ_contents (krb5_context, krb5_data *); 298 krb5_error_code krb5_decode_princ_contents (krb5_context, krb5_data *, 299 krb5_db_entry *); 300 void krb5_dbe_free_contents (krb5_context, krb5_db_entry *); 301 302 krb5_error_code krb5_dbe_find_enctype (krb5_context, krb5_db_entry *, 303 krb5_int32, 304 krb5_int32, 305 krb5_int32, 306 krb5_key_data **); 307 308 krb5_error_code krb5_dbe_search_enctype (krb5_context, 309 krb5_db_entry *, 310 krb5_int32 *, 311 krb5_int32, 312 krb5_int32, 313 krb5_int32, 314 krb5_key_data **); 315 316 struct __krb5_key_salt_tuple; 317 318 krb5_error_code krb5_dbe_cpw (krb5_context, 319 krb5_keyblock *, 320 struct __krb5_key_salt_tuple *, 321 int, 322 char *, 323 int, 324 krb5_boolean, 325 krb5_db_entry *); 326 krb5_error_code krb5_dbe_apw (krb5_context, 327 krb5_keyblock *, 328 struct __krb5_key_salt_tuple *, 329 int, 330 char *, 331 krb5_db_entry *); 332 krb5_error_code krb5_dbe_crk (krb5_context, 333 krb5_keyblock *, 334 struct __krb5_key_salt_tuple *, 335 int, 336 krb5_boolean, 337 krb5_db_entry *); 338 krb5_error_code krb5_dbe_ark (krb5_context, 339 krb5_keyblock *, 340 struct __krb5_key_salt_tuple *, 341 int, 342 krb5_db_entry *); 343 344 krb5_error_code krb5_ser_db_context_init (krb5_context); 345 346 #define KRB5_KDB_DEF_FLAGS 0 347 348 #endif /* !defined(_WIN32) */ 349 #endif /* KRB5_KDB5__ */ 350