xref: /freebsd/crypto/heimdal/lib/hdb/hdb.h (revision 6a068746777241722b2b32c5d0bc443a2a64d80b)
1 /*
2  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 /* $Id$ */
35 
36 #ifndef __HDB_H__
37 #define __HDB_H__
38 
39 #include <krb5.h>
40 
41 #include <hdb_err.h>
42 
43 #include <heim_asn1.h>
44 #include <hdb_asn1.h>
45 
46 struct hdb_dbinfo;
47 
48 enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
49 
50 /* flags for various functions */
51 #define HDB_F_DECRYPT		1	/* decrypt keys */
52 #define HDB_F_REPLACE		2	/* replace entry */
53 #define HDB_F_GET_CLIENT	4	/* fetch client */
54 #define HDB_F_GET_SERVER	8	/* fetch server */
55 #define HDB_F_GET_KRBTGT	16	/* fetch krbtgt */
56 #define HDB_F_GET_ANY		28	/* fetch any of client,server,krbtgt */
57 #define HDB_F_CANON		32	/* want canonicalition */
58 #define HDB_F_ADMIN_DATA	64	/* want data that kdc don't use  */
59 #define HDB_F_KVNO_SPECIFIED	128	/* we want a particular KVNO */
60 #define HDB_F_CURRENT_KVNO	256	/* we want the current KVNO */
61 /* 512, 1024, 2048 are reserved for kvno operations that is not part of the 1.5 branch */
62 #define HDB_F_ALL_KVNOS		2048	/* we want all the keys, live or not */
63 #define HDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */
64 #define HDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */
65 
66 /* hdb_capability_flags */
67 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
68 #define HDB_CAP_F_HANDLE_PASSWORDS	2
69 #define HDB_CAP_F_PASSWORD_UPDATE_KEYS	4
70 
71 /* auth status values */
72 #define HDB_AUTH_SUCCESS		0
73 #define HDB_AUTH_WRONG_PASSWORD		1
74 #define HDB_AUTH_INVALID_SIGNATURE	2
75 
76 /* key usage for master key */
77 #define HDB_KU_MKEY	0x484442
78 
79 typedef struct hdb_master_key_data *hdb_master_key;
80 
81 /**
82  * hdb_entry_ex is a wrapper structure around the hdb_entry structure
83  * that allows backends to keep a pointer to the backing store, ie in
84  * ->hdb_fetch_kvno(), so that we the kadmin/kpasswd backend gets around to
85  * ->hdb_store(), the backend doesn't need to lookup the entry again.
86  */
87 
88 typedef struct hdb_entry_ex {
89     void *ctx;
90     hdb_entry entry;
91     void (*free_entry)(krb5_context, struct hdb_entry_ex *);
92 } hdb_entry_ex;
93 
94 
95 /**
96  * HDB backend function pointer structure
97  *
98  * The HDB structure is what the KDC and kadmind framework uses to
99  * query the backend database when talking about principals.
100  */
101 
102 typedef struct HDB{
103     void *hdb_db;
104     void *hdb_dbc; /** don't use, only for DB3 */
105     char *hdb_name;
106     int hdb_master_key_set;
107     hdb_master_key hdb_master_key;
108     int hdb_openp;
109     int hdb_capability_flags;
110     /**
111      * Open (or create) the a Kerberos database.
112      *
113      * Open (or create) the a Kerberos database that was resolved with
114      * hdb_create(). The third and fourth flag to the function are the
115      * same as open(), thus passing O_CREAT will create the data base
116      * if it doesn't exists.
117      *
118      * Then done the caller should call hdb_close(), and to release
119      * all resources hdb_destroy().
120      */
121     krb5_error_code (*hdb_open)(krb5_context, struct HDB*, int, mode_t);
122     /**
123      * Close the database for transaction
124      *
125      * Closes the database for further transactions, wont release any
126      * permanant resources. the database can be ->hdb_open-ed again.
127      */
128     krb5_error_code (*hdb_close)(krb5_context, struct HDB*);
129     /**
130      * Free an entry after use.
131      */
132     void	    (*hdb_free)(krb5_context, struct HDB*, hdb_entry_ex*);
133     /**
134      * Fetch an entry from the backend
135      *
136      * Fetch an entry from the backend, flags are what type of entry
137      * should be fetch: client, server, krbtgt.
138      * knvo (if specified and flags HDB_F_KVNO_SPECIFIED set) is the kvno to get
139      */
140     krb5_error_code (*hdb_fetch_kvno)(krb5_context, struct HDB*,
141 				      krb5_const_principal, unsigned, krb5_kvno,
142 				      hdb_entry_ex*);
143     /**
144      * Store an entry to database
145      */
146     krb5_error_code (*hdb_store)(krb5_context, struct HDB*,
147 				 unsigned, hdb_entry_ex*);
148     /**
149      * Remove an entry from the database.
150      */
151     krb5_error_code (*hdb_remove)(krb5_context, struct HDB*,
152 				  krb5_const_principal);
153     /**
154      * As part of iteration, fetch one entry
155      */
156     krb5_error_code (*hdb_firstkey)(krb5_context, struct HDB*,
157 				    unsigned, hdb_entry_ex*);
158     /**
159      * As part of iteration, fetch next entry
160      */
161     krb5_error_code (*hdb_nextkey)(krb5_context, struct HDB*,
162 				   unsigned, hdb_entry_ex*);
163     /**
164      * Lock database
165      *
166      * A lock can only be held by one consumers. Transaction can still
167      * happen on the database while the lock is held, so the entry is
168      * only useful for syncroning creation of the database and renaming of the database.
169      */
170     krb5_error_code (*hdb_lock)(krb5_context, struct HDB*, int);
171     /**
172      * Unlock database
173      */
174     krb5_error_code (*hdb_unlock)(krb5_context, struct HDB*);
175     /**
176      * Rename the data base.
177      *
178      * Assume that the database is not hdb_open'ed and not locked.
179      */
180     krb5_error_code (*hdb_rename)(krb5_context, struct HDB*, const char*);
181     /**
182      * Get an hdb_entry from a classical DB backend
183      *
184      * If the database is a classical DB (ie BDB, NDBM, GDBM, etc)
185      * backend, this function will take a principal key (krb5_data)
186      * and return all data related to principal in the return
187      * krb5_data. The returned encoded entry is of type hdb_entry or
188      * hdb_entry_alias.
189      */
190     krb5_error_code (*hdb__get)(krb5_context, struct HDB*,
191 				krb5_data, krb5_data*);
192     /**
193      * Store an hdb_entry from a classical DB backend
194      *
195      * Same discussion as in @ref HDB::hdb__get
196      */
197     krb5_error_code (*hdb__put)(krb5_context, struct HDB*, int,
198 				krb5_data, krb5_data);
199     /**
200      * Delete and hdb_entry from a classical DB backend
201      *
202      * Same discussion as in @ref HDB::hdb__get
203      */
204     krb5_error_code (*hdb__del)(krb5_context, struct HDB*, krb5_data);
205     /**
206      * Destroy the handle to the database.
207      *
208      * Destroy the handle to the database, deallocate all memory and
209      * related resources. Does not remove any permanent data. Its the
210      * logical reverse of hdb_create() function that is the entry
211      * point for the module.
212      */
213     krb5_error_code (*hdb_destroy)(krb5_context, struct HDB*);
214     /**
215      * Get the list of realms this backend handles.
216      * This call is optional to support. The returned realms are used
217      * for announcing the realms over bonjour. Free returned array
218      * with krb5_free_host_realm().
219      */
220     krb5_error_code (*hdb_get_realms)(krb5_context, struct HDB *, krb5_realm **);
221     /**
222      * Change password.
223      *
224      * Will update keys for the entry when given password.  The new
225      * keys must be written into the entry and will then later be
226      * ->hdb_store() into the database. The backend will still perform
227      * all other operations, increasing the kvno, and update
228      * modification timestamp.
229      *
230      * The backend needs to call _kadm5_set_keys() and perform password
231      * quality checks.
232      */
233     krb5_error_code (*hdb_password)(krb5_context, struct HDB*, hdb_entry_ex*, const char *, int);
234 
235     /**
236      * Auth feedback
237      *
238      * This is a feedback call that allows backends that provides
239      * lockout functionality to register failure and/or successes.
240      *
241      * In case the entry is locked out, the backend should set the
242      * hdb_entry.flags.locked-out flag.
243      */
244     krb5_error_code (*hdb_auth_status)(krb5_context, struct HDB *, hdb_entry_ex *, int);
245     /**
246      * Check if delegation is allowed.
247      */
248     krb5_error_code (*hdb_check_constrained_delegation)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
249 
250     /**
251      * Check if this name is an alias for the supplied client for PKINIT userPrinicpalName logins
252      */
253     krb5_error_code (*hdb_check_pkinit_ms_upn_match)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
254 
255     /**
256      * Check if s4u2self is allowed from this client to this server
257      */
258     krb5_error_code (*hdb_check_s4u2self)(krb5_context, struct HDB *, hdb_entry_ex *, krb5_const_principal);
259 }HDB;
260 
261 #define HDB_INTERFACE_VERSION	7
262 
263 struct hdb_so_method {
264     int version;
265     const char *prefix;
266     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
267 };
268 
269 typedef krb5_error_code (*hdb_foreach_func_t)(krb5_context, HDB*,
270 					      hdb_entry_ex*, void*);
271 extern krb5_kt_ops hdb_kt_ops;
272 
273 struct hdb_method {
274     int interface_version;
275     const char *prefix;
276     krb5_error_code (*create)(krb5_context, HDB **, const char *filename);
277 };
278 
279 extern const int hdb_interface_version;
280 
281 #include <hdb-protos.h>
282 
283 #endif /* __HDB_H__ */
284