--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ Database Glue between Samba and the KDC
+
+ Copyright (C) Guenther Deschner <gd@samba.org> 2014
+ Copyright (C) Andreas Schneider <asn@samba.org> 2014
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "system/kerberos.h"
+#include "sdb.h"
+#include "lib/krb5_wrap/krb5_samba.h"
+
+void sdb_free_entry(struct sdb_entry_ex *ent)
+{
+ struct sdb_key *k;
+ size_t i;
+
+ if (ent->free_entry) {
+ (*ent->free_entry)(ent);
+ }
+
+ for (i = 0; i < ent->entry.keys.len; i++) {
+ k = &ent->entry.keys.val[i];
+
+ /*
+ * Passing NULL as the Kerberos context is intentional here, as
+ * both Heimdal and MIT libraries don't use the context when
+ * clearing the keyblocks.
+ */
+ krb5_free_keyblock_contents(NULL, &k->key);
+ }
+
+ free_sdb_entry(&ent->entry);
+}
+
+static void free_sdb_key(struct sdb_key *k)
+{
+ if (k == NULL) {
+ return;
+ }
+
+ if (k->mkvno) {
+ free(k->mkvno);
+ }
+
+ /* keyblock not alloced */
+
+ if (k->salt) {
+ kerberos_free_data_contents(NULL, &k->salt->salt);
+ }
+
+ ZERO_STRUCTP(k);
+}
+
+void free_sdb_entry(struct sdb_entry *s)
+{
+ unsigned int i;
+
+ /*
+ * Passing NULL as the Kerberos context is intentional here, as both
+ * Heimdal and MIT libraries don't use the context when clearing the
+ * principals.
+ */
+ krb5_free_principal(NULL, s->principal);
+
+ if (s->keys.len) {
+ for (i=0; i < s->keys.len; i++) {
+ free_sdb_key(&s->keys.val[i]);
+ }
+ free(s->keys.val);
+ }
+ krb5_free_principal(NULL, s->created_by.principal);
+ if (s->modified_by) {
+ krb5_free_principal(NULL, s->modified_by->principal);
+ }
+ SAFE_FREE(s->valid_start);
+ SAFE_FREE(s->valid_end);
+ SAFE_FREE(s->pw_end);
+ if (s->etypes) {
+ if (s->etypes->len) {
+ free(s->etypes->val);
+ }
+ free(s->etypes);
+ }
+
+ ZERO_STRUCTP(s);
+}
+
+struct SDBFlags int2SDBFlags(unsigned n)
+{
+ struct SDBFlags flags;
+
+ memset(&flags, 0, sizeof(flags));
+
+ flags.initial = (n >> 0) & 1;
+ flags.forwardable = (n >> 1) & 1;
+ flags.proxiable = (n >> 2) & 1;
+ flags.renewable = (n >> 3) & 1;
+ flags.postdate = (n >> 4) & 1;
+ flags.server = (n >> 5) & 1;
+ flags.client = (n >> 6) & 1;
+ flags.invalid = (n >> 7) & 1;
+ flags.require_preauth = (n >> 8) & 1;
+ flags.change_pw = (n >> 9) & 1;
+ flags.require_hwauth = (n >> 10) & 1;
+ flags.ok_as_delegate = (n >> 11) & 1;
+ flags.user_to_user = (n >> 12) & 1;
+ flags.immutable = (n >> 13) & 1;
+ flags.trusted_for_delegation = (n >> 14) & 1;
+ flags.allow_kerberos4 = (n >> 15) & 1;
+ flags.allow_digest = (n >> 16) & 1;
+ flags.locked_out = (n >> 17) & 1;
+ flags.do_not_store = (n >> 31) & 1;
+ return flags;
+}
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ Database Glue between Samba and the KDC
+
+ Copyright (C) Guenther Deschner <gd@samba.org> 2014
+ Copyright (C) Andreas Schneider <asn@samba.org> 2014
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _KDC_SDB_H_
+#define _KDC_SDB_H_
+
+struct sdb_salt {
+ unsigned int type;
+ krb5_data salt;
+};
+
+struct sdb_key {
+ unsigned int *mkvno;
+ krb5_keyblock key;
+ struct sdb_salt *salt;
+};
+
+struct sdb_keys {
+ unsigned int len;
+ struct sdb_key *val;
+};
+
+struct sdb_event {
+ krb5_principal principal;
+ time_t time;
+};
+
+struct SDBFlags {
+ unsigned int initial:1;
+ unsigned int forwardable:1;
+ unsigned int proxiable:1;
+ unsigned int renewable:1;
+ unsigned int postdate:1;
+ unsigned int server:1;
+ unsigned int client:1;
+ unsigned int invalid:1;
+ unsigned int require_preauth:1;
+ unsigned int change_pw:1;
+ unsigned int require_hwauth:1;
+ unsigned int ok_as_delegate:1;
+ unsigned int user_to_user:1;
+ unsigned int immutable:1;
+ unsigned int trusted_for_delegation:1;
+ unsigned int allow_kerberos4:1;
+ unsigned int allow_digest:1;
+ unsigned int locked_out:1;
+ unsigned int _unused18:1;
+ unsigned int _unused19:1;
+ unsigned int _unused20:1;
+ unsigned int _unused21:1;
+ unsigned int _unused22:1;
+ unsigned int _unused23:1;
+ unsigned int _unused24:1;
+ unsigned int _unused25:1;
+ unsigned int _unused26:1;
+ unsigned int _unused27:1;
+ unsigned int _unused28:1;
+ unsigned int _unused29:1;
+ unsigned int _unused30:1;
+ unsigned int do_not_store:1;
+};
+
+struct sdb_entry {
+ krb5_principal principal;
+ unsigned int kvno;
+ struct sdb_keys keys;
+ struct sdb_event created_by;
+ struct sdb_event *modified_by;
+ time_t *valid_start;
+ time_t *valid_end;
+ time_t *pw_end;
+ unsigned int *max_life;
+ unsigned int *max_renew;
+ struct SDBFlags flags;
+ struct sdb_entry_etypes {
+ unsigned int len;
+ unsigned int *val;
+ } *etypes;
+};
+
+struct sdb_entry_ex {
+ void *ctx;
+ struct sdb_entry entry;
+ void (*free_entry)(struct sdb_entry_ex *);
+};
+
+#define SDB_ERR_NOENTRY 36150275
+#define SDB_ERR_NOT_FOUND_HERE 36150287
+#define SDB_ERR_WRONG_REALM 36150289
+
+#define SDB_F_DECRYPT 1 /* decrypt keys */
+#define SDB_F_GET_CLIENT 4 /* fetch client */
+#define SDB_F_GET_SERVER 8 /* fetch server */
+#define SDB_F_GET_KRBTGT 16 /* fetch krbtgt */
+#define SDB_F_GET_ANY 28 /* fetch any of client,server,krbtgt */
+#define SDB_F_CANON 32 /* want canonicalition */
+#define SDB_F_ADMIN_DATA 64 /* want data that kdc don't use */
+#define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */
+#define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */
+#define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */
+
+void sdb_free_entry(struct sdb_entry_ex *e);
+void free_sdb_entry(struct sdb_entry *s);
+struct SDBFlags int2SDBFlags(unsigned n);
+
+#endif /* _KDC_SDB_H_ */
git.samba.org / obnox / samba / samba-obnox.git / commitdiff