kdb.h   [plain text]

/*
 * include/krb5/kdb.h
 *
 * Copyright 1990,1991 by the Massachusetts Institute of Technology.
 * All Rights Reserved.
 *
 * Export of this software from the United States of America may
 *   require a specific license from the United States Government.
 *   It is the responsibility of any person or organization contemplating
 *   export to obtain such a license before exporting.
 * 
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  Furthermore if you modify this software you must label
 * your software as modified software and not distribute it in such a
 * fashion that it might be confused with the original M.I.T. software.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 * 
 *
 * KDC Database interface definitions.
 */

/*
 * Copyright (C) 1998 by the FundsXpress, INC.
 * 
 * All rights reserved.
 * 
 * Export of this software from the United States of America may require
 * a specific license from the United States Government.  It is the
 * responsibility of any person or organization contemplating export to
 * obtain such a license before exporting.
 * 
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of FundsXpress. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  FundsXpress makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 * 
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#ifndef KRB5_KDB5__
#define KRB5_KDB5__

/* Salt types */
#define KRB5_KDB_SALTTYPE_NORMAL	0
#define KRB5_KDB_SALTTYPE_V4		1
#define KRB5_KDB_SALTTYPE_NOREALM	2
#define KRB5_KDB_SALTTYPE_ONLYREALM	3
#define KRB5_KDB_SALTTYPE_SPECIAL	4
#define KRB5_KDB_SALTTYPE_AFS3		5

/* Attributes */
#define	KRB5_KDB_DISALLOW_POSTDATED	0x00000001
#define	KRB5_KDB_DISALLOW_FORWARDABLE	0x00000002
#define	KRB5_KDB_DISALLOW_TGT_BASED	0x00000004
#define	KRB5_KDB_DISALLOW_RENEWABLE	0x00000008
#define	KRB5_KDB_DISALLOW_PROXIABLE	0x00000010
#define	KRB5_KDB_DISALLOW_DUP_SKEY	0x00000020
#define	KRB5_KDB_DISALLOW_ALL_TIX	0x00000040
#define	KRB5_KDB_REQUIRES_PRE_AUTH	0x00000080
#define KRB5_KDB_REQUIRES_HW_AUTH	0x00000100
#define	KRB5_KDB_REQUIRES_PWCHANGE	0x00000200
#define KRB5_KDB_DISALLOW_SVR		0x00001000
#define KRB5_KDB_PWCHANGE_SERVICE	0x00002000
#define KRB5_KDB_SUPPORT_DESMD5         0x00004000
#define	KRB5_KDB_NEW_PRINC		0x00008000

/* Creation flags */
#define KRB5_KDB_CREATE_BTREE		0x00000001
#define KRB5_KDB_CREATE_HASH		0x00000002

#if !defined(_WIN32)

/*
 * Note --- these structures cannot be modified without changing the
 * database version number in libkdb.a, but should be expandable by
 * adding new tl_data types.
 */
typedef struct _krb5_tl_data {
    struct _krb5_tl_data* tl_data_next;		/* NOT saved */
    krb5_int16 		  tl_data_type;		
    krb5_ui_2		  tl_data_length;	
    krb5_octet 	        * tl_data_contents;	
} krb5_tl_data;

/* 
 * If this ever changes up the version number and make the arrays be as
 * big as necessary.
 *
 * Currently the first type is the enctype and the second is the salt type.
 */
typedef struct _krb5_key_data {
    krb5_int16 		  key_data_ver;		/* Version */
    krb5_int16		  key_data_kvno;	/* Key Version */
    krb5_int16		  key_data_type[2];	/* Array of types */
    krb5_ui_2		  key_data_length[2];	/* Array of lengths */
    krb5_octet 	        * key_data_contents[2];	/* Array of pointers */
} krb5_key_data;

#define KRB5_KDB_V1_KEY_DATA_ARRAY	2	/* # of array elements */

typedef struct _krb5_keysalt {
    krb5_int16		  type;	
    krb5_data		  data;			/* Length, data */
} krb5_keysalt;

typedef struct _krb5_db_entry_new {
    krb5_magic 		  magic;		/* NOT saved */
    krb5_ui_2		  len;			
    krb5_flags 		  attributes;
    krb5_deltat		  max_life;
    krb5_deltat		  max_renewable_life;
    krb5_timestamp 	  expiration;	  	/* When the client expires */
    krb5_timestamp 	  pw_expiration;  	/* When its passwd expires */
    krb5_timestamp 	  last_success;		/* Last successful passwd */
    krb5_timestamp 	  last_failed;		/* Last failed passwd attempt */
    krb5_kvno 	 	  fail_auth_count; 	/* # of failed passwd attempt */
    krb5_int16 		  n_tl_data;
    krb5_int16 		  n_key_data;
    krb5_ui_2		  e_length;		/* Length of extra data */
    krb5_octet		* e_data;		/* Extra data to be saved */

    krb5_principal 	  princ;		/* Length, data */	
    krb5_tl_data	* tl_data;		/* Linked list */
    krb5_key_data       * key_data;		/* Array */
} krb5_db_entry;

#define	KRB5_KDB_MAGIC_NUMBER		0xdbdbdbdb
#define KRB5_KDB_V1_BASE_LENGTH		38
  
#define KRB5_TL_LAST_PWD_CHANGE		0x0001
#define KRB5_TL_MOD_PRINC		0x0002
#define KRB5_TL_KADM_DATA		0x0003
#define KRB5_TL_KADM5_E_DATA		0x0004
#define KRB5_TL_RB1_CHALLENGE		0x0005
#ifdef SECURID
#define KRB5_TL_SECURID_STATE           0x0006
#endif /* SECURID */
    
/*
 * Determines the number of failed KDC requests before DISALLOW_ALL_TIX is set
 * on the principal.
 */
#define KRB5_MAX_FAIL_COUNT		5

/* XXX depends on knowledge of krb5_parse_name() formats */
#define KRB5_KDB_M_NAME		"K/M"	/* Kerberos/Master */

/* prompts used by default when reading the KDC password from the keyboard. */
#define KRB5_KDC_MKEY_1	"Enter KDC database master key"
#define KRB5_KDC_MKEY_2	"Re-enter KDC database master key to verify"

extern char *krb5_mkey_pwd_prompt1;
extern char *krb5_mkey_pwd_prompt2;

/*
 * These macros specify the encoding of data within the database.
 *
 * Data encoding is little-endian.
 */
#define	krb5_kdb_decode_int16(cp, i16)	\
	*((krb5_int16 *) &(i16)) = (((krb5_int16) ((unsigned char) (cp)[0]))| \
			      ((krb5_int16) ((unsigned char) (cp)[1]) << 8))
#define	krb5_kdb_decode_int32(cp, i32)	\
	*((krb5_int32 *) &(i32)) = (((krb5_int32) ((unsigned char) (cp)[0]))| \
			      ((krb5_int32) ((unsigned char) (cp)[1]) << 8) | \
			      ((krb5_int32) ((unsigned char) (cp)[2]) << 16)| \
			      ((krb5_int32) ((unsigned char) (cp)[3]) << 24))
#define	krb5_kdb_encode_int16(i16, cp)	\
	{							\
	    (cp)[0] = (unsigned char) ((i16) & 0xff);		\
	    (cp)[1] = (unsigned char) (((i16) >> 8) & 0xff);	\
	}
#define	krb5_kdb_encode_int32(i32, cp)	\
	{							\
	    (cp)[0] = (unsigned char) ((i32) & 0xff);		\
	    (cp)[1] = (unsigned char) (((i32) >> 8) & 0xff);	\
	    (cp)[2] = (unsigned char) (((i32) >> 16) & 0xff);	\
	    (cp)[3] = (unsigned char) (((i32) >> 24) & 0xff);	\
	}

/* libkdb.spec */
krb5_error_code krb5_db_set_name (krb5_context, char * );
krb5_error_code krb5_db_init (krb5_context);
krb5_error_code krb5_db_fini (krb5_context);
krb5_error_code krb5_db_get_age (krb5_context, char *, time_t * );
krb5_error_code krb5_db_create (krb5_context, char *, krb5_int32 );
krb5_error_code krb5_db_rename (krb5_context, char *, char * );
krb5_error_code krb5_db_get_principal (krb5_context, krb5_const_principal ,
				       krb5_db_entry *, int *,
				       krb5_boolean * );
void krb5_db_free_principal (krb5_context, krb5_db_entry *, int  );
krb5_error_code krb5_db_put_principal (krb5_context, krb5_db_entry *, int * );
krb5_error_code krb5_db_delete_principal (krb5_context, krb5_const_principal,
					  int * );
krb5_error_code krb5_db_iterate (krb5_context,
				 krb5_error_code (* ) (krb5_pointer,
						       krb5_db_entry *),
				 krb5_pointer);
krb5_error_code krb5_db_iterate_ext (krb5_context,
				     krb5_error_code (* ) (krb5_pointer,
					  	           krb5_db_entry *),
				     krb5_pointer, int, int);
krb5_error_code krb5_db_verify_master_key (krb5_context, krb5_principal, 
					   krb5_keyblock *);
krb5_error_code krb5_db_store_mkey (krb5_context, char *, krb5_principal,
				    krb5_keyblock *);

krb5_error_code krb5_db_setup_mkey_name (krb5_context, const char *, 
					 const char *, char **,
					 krb5_principal *);

krb5_error_code krb5_db_set_mkey (krb5_context, krb5_keyblock *);

krb5_error_code krb5_db_get_mkey (krb5_context, krb5_keyblock **);
krb5_error_code krb5_db_destroy (krb5_context, char * );
krb5_error_code krb5_db_lock (krb5_context, int );
krb5_error_code krb5_db_unlock (krb5_context);
krb5_error_code krb5_db_set_nonblocking (krb5_context, krb5_boolean,
					 krb5_boolean * );
krb5_boolean krb5_db_set_lockmode (krb5_context, krb5_boolean);
krb5_error_code	krb5_db_fetch_mkey (krb5_context, krb5_principal, krb5_enctype,
				    krb5_boolean, krb5_boolean, char *,
				    krb5_data *, 
				    krb5_keyblock * );

krb5_error_code krb5_db_open_database (krb5_context);
krb5_error_code krb5_db_close_database (krb5_context);

krb5_error_code krb5_dbekd_encrypt_key_data (krb5_context,
					     const krb5_keyblock *,
					     const krb5_keyblock *,
					     const krb5_keysalt *,
					     int,
					     krb5_key_data *);
krb5_error_code krb5_dbekd_decrypt_key_data (krb5_context,
					     const krb5_keyblock *,
					     const krb5_key_data *,
					     krb5_keyblock *,
					     krb5_keysalt *);
krb5_error_code krb5_dbe_create_key_data (krb5_context,
					  krb5_db_entry *);
krb5_error_code krb5_dbe_update_tl_data (krb5_context,
					 krb5_db_entry *,
					 krb5_tl_data *);
krb5_error_code krb5_dbe_lookup_tl_data (krb5_context,
					 krb5_db_entry *,
					 krb5_tl_data *);
krb5_error_code krb5_dbe_update_last_pwd_change (krb5_context,
						 krb5_db_entry *,
						 krb5_timestamp);
krb5_error_code krb5_dbe_lookup_last_pwd_change (krb5_context,
						 krb5_db_entry *,
						 krb5_timestamp *);
krb5_error_code krb5_dbe_update_mod_princ_data (krb5_context,
						krb5_db_entry *,
						krb5_timestamp,
						krb5_const_principal);
krb5_error_code krb5_dbe_lookup_mod_princ_data (krb5_context,
						krb5_db_entry *,
						krb5_timestamp *,
						krb5_principal *);
int krb5_encode_princ_dbkey (krb5_context, krb5_data  *, krb5_const_principal);
void krb5_free_princ_dbkey (krb5_context, krb5_data *);
krb5_error_code krb5_encode_princ_contents (krb5_context, krb5_data *,
					    krb5_db_entry *);
void krb5_free_princ_contents (krb5_context, krb5_data  *);
krb5_error_code krb5_decode_princ_contents (krb5_context, krb5_data  *,
					    krb5_db_entry *);
void krb5_dbe_free_contents (krb5_context, krb5_db_entry *);

krb5_error_code krb5_dbe_find_enctype (krb5_context, krb5_db_entry *,
				       krb5_int32,
				       krb5_int32,
				       krb5_int32,
				       krb5_key_data **);

krb5_error_code krb5_dbe_search_enctype (krb5_context,
					 krb5_db_entry *,
					 krb5_int32 *,
					 krb5_int32,
					 krb5_int32,
					 krb5_int32,
					 krb5_key_data **);

struct __krb5_key_salt_tuple;

krb5_error_code krb5_dbe_cpw (krb5_context,
			      krb5_keyblock  *,
			      struct __krb5_key_salt_tuple *,
			      int,
			      char *,
			      int,
			      krb5_boolean,
			      krb5_db_entry *);
krb5_error_code krb5_dbe_apw (krb5_context,
			      krb5_keyblock  *,
			      struct __krb5_key_salt_tuple *,
			      int,
			      char *,
			      krb5_db_entry *);
krb5_error_code krb5_dbe_crk (krb5_context,
			      krb5_keyblock  *,
			      struct __krb5_key_salt_tuple *,
			      int,
			      krb5_boolean,
			      krb5_db_entry *);
krb5_error_code krb5_dbe_ark (krb5_context,
			      krb5_keyblock  *,
			      struct __krb5_key_salt_tuple *,
			      int,
			      krb5_db_entry *);

krb5_error_code krb5_ser_db_context_init (krb5_context);
 
#define KRB5_KDB_DEF_FLAGS	0

#endif /* !defined(_WIN32) */
#endif /* KRB5_KDB5__ */