1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
|
/*
* $Source$
* $Author$
* $Id$
*
* Copyright 1990,1991 by the Massachusetts Institute of Technology.
* All Rights Reserved.
*
* Export of this software from the United States of America may
* require a specific license from the United States Government.
* It is the responsibility of any person or organization contemplating
* export to obtain such a license before exporting.
*
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
* notice appear in all copies and that both that copyright notice and
* this permission notice appear in supporting documentation, and that
* the name of M.I.T. not be used in advertising or publicity pertaining
* to distribution of the software without specific, written prior
* permission. M.I.T. makes no representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* or implied warranty.
*
*
* KDC Database interface definitions.
*/
#ifndef KRB5_KDB5__
#define KRB5_KDB5__
/* this is the same structure as krb5_keyblock, but with a different name to
enable compile-time catching of programmer confusion between encrypted &
decrypted keys in the database */
typedef struct _krb5_encrypted_keyblock {
krb5_keytype keytype;
int length;
krb5_octet *contents;
} krb5_encrypted_keyblock;
typedef struct _krb5_db_entry {
krb5_principal principal;
krb5_encrypted_keyblock key;
krb5_kvno kvno;
krb5_deltat max_life;
krb5_deltat max_renewable_life;
krb5_kvno mkvno; /* master encryption key vno */
krb5_timestamp expiration; /* This is when the client expires */
krb5_timestamp pw_expiration; /* This is when its password does */
krb5_timestamp last_pwd_change; /* Last time of password change */
krb5_timestamp last_success; /* Last successful password */
krb5_timestamp last_failed; /* Last failed password attempt */
krb5_kvno fail_auth_count; /* # of failed password attempts */
krb5_principal mod_name;
krb5_timestamp mod_date;
krb5_flags attributes;
krb5_int32 salt_type:8,
salt_length:24;
krb5_octet *salt;
krb5_encrypted_keyblock alt_key;
krb5_int32 alt_salt_type:8,
alt_salt_length:24;
krb5_octet *alt_salt;
krb5_int32 expansion[8];
} krb5_db_entry;
#ifdef SANDIA /* SANDIA Enhancement (Pre-Auth/Blacklist) */
#define KRB5_MAX_FAIL_COUNT 5
#endif
#define KRB5_KDB_SALTTYPE_NORMAL 0
#define KRB5_KDB_SALTTYPE_V4 1
#define KRB5_KDB_SALTTYPE_NOREALM 2
#define KRB5_KDB_SALTTYPE_ONLYREALM 3
#define KRB5_KDB_SALTTYPE_SPECIAL 4
#define KRB5_KDB_DISALLOW_POSTDATED 0x00000001
#define KRB5_KDB_DISALLOW_FORWARDABLE 0x00000002
#define KRB5_KDB_DISALLOW_TGT_BASED 0x00000004
#define KRB5_KDB_DISALLOW_RENEWABLE 0x00000008
#define KRB5_KDB_DISALLOW_PROXIABLE 0x00000010
#define KRB5_KDB_DISALLOW_DUP_SKEY 0x00000020
#define KRB5_KDB_DISALLOW_ALL_TIX 0x00000040
#define KRB5_KDB_REQUIRES_PRE_AUTH 0x00000080
#define KRB5_KDB_REQUIRES_HW_AUTH 0x00000100
#define KRB5_KDB_REQUIRES_PWCHANGE 0x00000200
#define KRB5_KDB_DISALLOW_SVR 0x00001000
#define KRB5_KDB_PWCHANGE_SERVICE 0x00002000
/* XXX depends on knowledge of krb5_parse_name() formats */
#define KRB5_KDB_M_NAME "K/M" /* Kerberos/Master */
#define KDB_CONVERT_KEY_TO_DB(in,out) krb5_kdb_encrypt_key(&master_encblock, in, out)
#define KDB_CONVERT_KEY_OUTOF_DB(in, out) krb5_kdb_decrypt_key(&master_encblock, in, out)
/* prompts used by default when reading the KDC password from the keyboard. */
#define KRB5_KDC_MKEY_1 "Enter KDC database master key:"
#define KRB5_KDC_MKEY_2 "Re-enter KDC database master key to verify:"
extern char *krb5_mkey_pwd_prompt1;
extern char *krb5_mkey_pwd_prompt2;
/* libkdb.spec */
krb5_error_code krb5_db_set_name
PROTOTYPE((char * ));
krb5_error_code krb5_db_init
PROTOTYPE((void ));
krb5_error_code krb5_db_fini
PROTOTYPE((void ));
krb5_error_code krb5_db_get_age
PROTOTYPE((char *,
time_t * ));
krb5_error_code krb5_db_create
PROTOTYPE((char * ));
krb5_error_code krb5_db_rename
PROTOTYPE((char *,
char * ));
krb5_error_code krb5_db_get_principal
PROTOTYPE((krb5_principal ,
krb5_db_entry *,
int *,
krb5_boolean * ));
void krb5_db_free_principal
PROTOTYPE((krb5_db_entry *,
int ));
krb5_error_code krb5_db_put_principal
PROTOTYPE((krb5_db_entry *,
int * ));
krb5_error_code krb5_db_delete_principal
PROTOTYPE((krb5_principal,
int * ));
krb5_error_code krb5_db_iterate
PROTOTYPE((krb5_error_code (* ) PROTOTYPE((krb5_pointer,
krb5_db_entry *)),
krb5_pointer ));
krb5_error_code krb5_db_verify_master_key
PROTOTYPE((krb5_principal, krb5_keyblock *, krb5_encrypt_block *));
krb5_error_code krb5_db_store_mkey PROTOTYPE((char *,
krb5_principal,
krb5_keyblock *));
krb5_error_code krb5_kdb_encrypt_key
PROTOTYPE((krb5_encrypt_block *,
const krb5_keyblock *,
krb5_encrypted_keyblock *));
krb5_error_code krb5_kdb_decrypt_key
PROTOTYPE((krb5_encrypt_block *,
const krb5_encrypted_keyblock *,
krb5_keyblock *));
krb5_error_code krb5_db_setup_mkey_name
PROTOTYPE((const char *, const char *, char **, krb5_principal *));
krb5_error_code krb5_db_lock
PROTOTYPE((int ));
krb5_error_code krb5_db_unlock
PROTOTYPE ((void ));
/* need to play games here, since we take a pointer and the real thing,
and it might be narrow. */
#ifdef NARROW_PROTOTYPES
krb5_error_code krb5_db_set_nonblocking
PROTOTYPE((krb5_boolean,
krb5_boolean * ));
krb5_boolean krb5_db_set_lockmode
PROTOTYPE((krb5_boolean ));
#else
krb5_error_code krb5_db_set_nonblocking
PROTOTYPE((int, /* krb5_boolean */
krb5_boolean * ));
krb5_boolean krb5_db_set_lockmode
PROTOTYPE((int /* krb5_boolean */ ));
#endif /* NARROW_PROTOTYPES */
#include <krb5/widen.h>
/* Only put things which don't have pointers to the narrow types in this
section */
krb5_error_code krb5_db_fetch_mkey
PROTOTYPE((krb5_principal, krb5_encrypt_block *, krb5_boolean,
krb5_boolean, krb5_data *, krb5_keyblock * ));
#include <krb5/narrow.h>
#define KRB5_KDB_DEF_FLAGS 0
#endif /* KRB5_KDB5__ */
|
