/* Unix SMB/CIFS implementation. Database Glue between Samba and the KDC Copyright (C) Guenther Deschner 2014 Copyright (C) Andreas Schneider 2014 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #ifndef _KDC_SDB_H_ #define _KDC_SDB_H_ struct sdb_salt { unsigned int type; krb5_data salt; }; struct sdb_key { krb5_keyblock key; struct sdb_salt *salt; }; struct sdb_keys { unsigned int len; struct sdb_key *val; }; struct sdb_event { krb5_principal principal; time_t time; }; struct sdb_etypes { unsigned len; krb5_enctype *val; }; struct SDBFlags { unsigned int initial:1; unsigned int forwardable:1; unsigned int proxiable:1; unsigned int renewable:1; unsigned int postdate:1; unsigned int server:1; unsigned int client:1; unsigned int invalid:1; unsigned int require_preauth:1; unsigned int change_pw:1; unsigned int require_hwauth:1; unsigned int ok_as_delegate:1; unsigned int user_to_user:1; unsigned int immutable:1; unsigned int trusted_for_delegation:1; unsigned int allow_kerberos4:1; unsigned int allow_digest:1; unsigned int locked_out:1; unsigned int require_pwchange:1; unsigned int materialize:1; unsigned int virtual_keys:1; unsigned int virtual:1; unsigned int synthetic:1; unsigned int no_auth_data_reqd:1; unsigned int auth_data_reqd:1; unsigned int _unused25:1; unsigned int _unused26:1; unsigned int _unused27:1; unsigned int _unused28:1; unsigned int _unused29:1; unsigned int force_canonicalize:1; unsigned int do_not_store:1; }; struct sdb_entry { struct samba_kdc_entry *skdc_entry; krb5_principal principal; unsigned int kvno; struct sdb_keys keys; struct sdb_etypes *etypes; struct sdb_keys old_keys; struct sdb_keys older_keys; struct sdb_etypes *session_etypes; struct sdb_event created_by; struct sdb_event *modified_by; time_t *valid_start; time_t *valid_end; time_t *pw_end; int *max_life; int *max_renew; struct SDBFlags flags; }; #define SDB_ERR_NOENTRY 36150275 #define SDB_ERR_NOT_FOUND_HERE 36150287 #define SDB_ERR_WRONG_REALM 36150289 /* These must match the values in hdb.h */ #define SDB_F_DECRYPT 1 /* decrypt keys */ #define SDB_F_GET_CLIENT 4 /* fetch client */ #define SDB_F_GET_SERVER 8 /* fetch server */ #define SDB_F_GET_KRBTGT 16 /* fetch krbtgt */ #define SDB_F_GET_ANY 28 /* fetch any of client,server,krbtgt */ #define SDB_F_CANON 32 /* want canonicalization */ #define SDB_F_ADMIN_DATA 64 /* want data that kdc don't use */ #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ #define SDB_F_ARMOR_PRINCIPAL 262144 /* fetch is for the client of an armor ticket */ #define SDB_F_USER2USER_PRINCIPAL 524288/* fetch is for the server of a user2user tgs-req */ #define SDB_F_HDB_MASK (SDB_F_DECRYPT | \ SDB_F_GET_CLIENT| \ SDB_F_GET_SERVER | \ SDB_F_GET_KRBTGT | \ SDB_F_CANON | \ SDB_F_ADMIN_DATA | \ SDB_F_KVNO_SPECIFIED | \ SDB_F_FOR_AS_REQ | \ SDB_F_FOR_TGS_REQ | \ SDB_F_ARMOR_PRINCIPAL| \ SDB_F_USER2USER_PRINCIPAL) /* These are not supported by HDB */ #define SDB_F_FORCE_CANON 16384 /* force canonicalization */ #define SDB_F_RODC_NUMBER_SPECIFIED 32768 /* we want a particular RODC number */ void sdb_key_free(struct sdb_key *key); void sdb_keys_free(struct sdb_keys *keys); void sdb_entry_free(struct sdb_entry *e); krb5_error_code sdb_entry_set_etypes(struct sdb_entry *s); krb5_error_code sdb_entry_set_session_etypes(struct sdb_entry *s, bool add_aes256, bool add_aes128, bool add_rc4); #endif /* _KDC_SDB_H_ */