/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */

/*

 * Copyright 1990, 1991, 2016 by the Massachusetts Institute of Technology.

 * All Rights Reserved.

 *

 * Export of this software from the United States of America may

 *   require a specific license from the United States Government.

 *   It is the responsibility of any person or organization contemplating

 *   export to obtain such a license before exporting.

 *

 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and

 * distribute this software and its documentation for any purpose and

 * without fee is hereby granted, provided that the above copyright

 * notice appear in all copies and that both that copyright notice and

 * this permission notice appear in supporting documentation, and that

 * the name of M.I.T. not be used in advertising or publicity pertaining

 * to distribution of the software without specific, written prior

 * permission.  Furthermore if you modify this software you must label

 * your software as modified software and not distribute it in such a

 * fashion that it might be confused with the original M.I.T. software.

 * M.I.T. makes no representations about the suitability of

 * this software for any purpose.  It is provided "as is" without express

 * or implied warranty.

 */

/*

 * Copyright (C) 1998 by the FundsXpress, INC.

 *

 * All rights reserved.

 *

 * Export of this software from the United States of America may require

 * a specific license from the United States Government.  It is the

 * responsibility of any person or organization contemplating export to

 * obtain such a license before exporting.

 *

 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and

 * distribute this software and its documentation for any purpose and

 * without fee is hereby granted, provided that the above copyright

 * notice appear in all copies and that both that copyright notice and

 * this permission notice appear in supporting documentation, and that

 * the name of FundsXpress. not be used in advertising or publicity pertaining

 * to distribution of the software without specific, written prior

 * permission.  FundsXpress makes no representations about the suitability of

 * this software for any purpose.  It is provided "as is" without express

 * or implied warranty.

 *

 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED

 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

 */

/*

 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

/* KDC Database interface definitions */

/* This API is not considered as stable as the main krb5 API.

 *

 * - We may make arbitrary incompatible changes between feature

 *   releases (e.g. from 1.7 to 1.8).

 * - We will make some effort to avoid making incompatible changes for

 *   bugfix releases, but will make them if necessary.

 */

#ifndef KRB5_KDB5__

#define KRB5_KDB5__

#include <krb5.h>

/* This version will be incremented when incompatible changes are made to the

 * KDB API, and will be kept in sync with the libkdb major version. */

#define KRB5_KDB_API_VERSION 10

/* Salt types */

#define KRB5_KDB_SALTTYPE_NORMAL        0

/* #define KRB5_KDB_SALTTYPE_V4            1 */

#define KRB5_KDB_SALTTYPE_NOREALM       2

#define KRB5_KDB_SALTTYPE_ONLYREALM     3

#define KRB5_KDB_SALTTYPE_SPECIAL       4

/* #define KRB5_KDB_SALTTYPE_AFS3          5 */

#define KRB5_KDB_SALTTYPE_CERTHASH      6

/* Attributes */

#define KRB5_KDB_DISALLOW_POSTDATED     0x00000001

#define KRB5_KDB_DISALLOW_FORWARDABLE   0x00000002

#define KRB5_KDB_DISALLOW_TGT_BASED     0x00000004

#define KRB5_KDB_DISALLOW_RENEWABLE     0x00000008

#define KRB5_KDB_DISALLOW_PROXIABLE     0x00000010

#define KRB5_KDB_DISALLOW_DUP_SKEY      0x00000020

#define KRB5_KDB_DISALLOW_ALL_TIX       0x00000040

#define KRB5_KDB_REQUIRES_PRE_AUTH      0x00000080

#define KRB5_KDB_REQUIRES_HW_AUTH       0x00000100

#define KRB5_KDB_REQUIRES_PWCHANGE      0x00000200

#define KRB5_KDB_DISALLOW_SVR           0x00001000

#define KRB5_KDB_PWCHANGE_SERVICE       0x00002000

#define KRB5_KDB_SUPPORT_DESMD5         0x00004000

#define KRB5_KDB_NEW_PRINC              0x00008000

#define KRB5_KDB_OK_AS_DELEGATE         0x00100000

#define KRB5_KDB_OK_TO_AUTH_AS_DELEGATE 0x00200000 /* S4U2Self OK */

#define KRB5_KDB_NO_AUTH_DATA_REQUIRED  0x00400000

#define KRB5_KDB_LOCKDOWN_KEYS          0x00800000

/* Creation flags */

#define KRB5_KDB_CREATE_BTREE           0x00000001

#define KRB5_KDB_CREATE_HASH            0x00000002

/* Entry get flags */

/* Name canonicalization requested */

#define KRB5_KDB_FLAG_CANONICALIZE              0x00000010

/* Include authorization data generated by backend */

#define KRB5_KDB_FLAG_INCLUDE_PAC               0x00000020

/* Is AS-REQ (client referrals only) */

#define KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY     0x00000040

/* Map cross-realm principals */

#define KRB5_KDB_FLAG_MAP_PRINCIPALS            0x00000080

/* Protocol transition */

#define KRB5_KDB_FLAG_PROTOCOL_TRANSITION       0x00000100

/* Constrained delegation */

#define KRB5_KDB_FLAG_CONSTRAINED_DELEGATION    0x00000200

/* User-to-user */

#define KRB5_KDB_FLAG_USER_TO_USER              0x00000800

/* Cross-realm */

#define KRB5_KDB_FLAG_CROSS_REALM               0x00001000

/* Issuing referral */

#define KRB5_KDB_FLAG_ISSUING_REFERRAL          0x00004000

#define KRB5_KDB_FLAGS_S4U                      ( KRB5_KDB_FLAG_PROTOCOL_TRANSITION | \

                                                  KRB5_KDB_FLAG_CONSTRAINED_DELEGATION )

/* KDB iteration flags */

#define KRB5_DB_ITER_WRITE      0x00000001

#define KRB5_DB_ITER_REV        0x00000002

#define KRB5_DB_ITER_RECURSE    0x00000004

/* String attribute names recognized by krb5 */

#define KRB5_KDB_SK_SESSION_ENCTYPES            "session_enctypes"

#define KRB5_KDB_SK_REQUIRE_AUTH                "require_auth"

#if !defined(_WIN32)

/*

 * Note --- these structures cannot be modified without changing the

 * database version number in libkdb.a, but should be expandable by

 * adding new tl_data types.

 */

typedef struct _krb5_tl_data {

    struct _krb5_tl_data* tl_data_next;         /* NOT saved */

    krb5_int16            tl_data_type;

    krb5_ui_2             tl_data_length;

    krb5_octet          * tl_data_contents;

} krb5_tl_data;

/* String attributes (currently stored inside tl-data) map C string keys to

 * values.  They can be set via kadmin and consumed by KDC plugins. */

typedef struct krb5_string_attr_st {

    char *key;

    char *value;

} krb5_string_attr;

/*

 * If this ever changes up the version number and make the arrays be as

 * big as necessary.

 *

 * Currently the first type is the enctype and the second is the salt type.

 */

typedef struct _krb5_key_data {

    krb5_int16            key_data_ver;         /* Version */

    krb5_ui_2             key_data_kvno;        /* Key Version */

    krb5_int16            key_data_type[2];     /* Array of types */

    krb5_ui_2             key_data_length[2];   /* Array of lengths */

    krb5_octet          * key_data_contents[2]; /* Array of pointers */

} krb5_key_data;

#define KRB5_KDB_V1_KEY_DATA_ARRAY      2       /* # of array elements */

typedef struct _krb5_keysalt {

    krb5_int16            type;

    krb5_data             data;                 /* Length, data */

} krb5_keysalt;

/*

 * A principal database entry.  Extensions to this structure currently use the

 * tl_data list.  The e_data and e_length fields are not used by any calling

 * code except kdb5_util dump and load, which marshal and unmarshal the array

 * in the dump record.  KDB modules may use these fields internally as long as

 * they set e_length appropriately (non-zero if the data should be marshalled

 * across dump and load, zero if not) and handle null e_data values in

 * caller-constructed principal entries.

 */

typedef struct _krb5_db_entry_new {

    krb5_magic            magic;                /* NOT saved */

    krb5_ui_2             len;

    krb5_ui_4             mask;                 /* members currently changed/set */

    krb5_flags            attributes;

    krb5_deltat           max_life;

    krb5_deltat           max_renewable_life;

    krb5_timestamp        expiration;           /* When the client expires */

    krb5_timestamp        pw_expiration;        /* When its passwd expires */

    krb5_timestamp        last_success;         /* Last successful passwd */

    krb5_timestamp        last_failed;          /* Last failed passwd attempt */

    krb5_kvno             fail_auth_count;      /* # of failed passwd attempt */

    krb5_int16            n_tl_data;

    krb5_int16            n_key_data;

    krb5_ui_2             e_length;             /* Length of extra data */

    krb5_octet          * e_data;               /* Extra data to be saved */

    krb5_principal        princ;                /* Length, data */

    krb5_tl_data        * tl_data;              /* Linked list */

    /* key_data must be sorted by kvno in descending order. */

    krb5_key_data       * key_data;             /* Array */

} krb5_db_entry;

typedef struct _osa_policy_ent_t {

    int               version;

    char      *name;

    krb5_ui_4       pw_min_life;

    krb5_ui_4       pw_max_life;

    krb5_ui_4       pw_min_length;

    krb5_ui_4       pw_min_classes;

    krb5_ui_4       pw_history_num;

    krb5_ui_4       policy_refcnt;              /* no longer used */

    /* Only valid if version > 1 */

    krb5_ui_4       pw_max_fail;                /* pwdMaxFailure */

    krb5_ui_4       pw_failcnt_interval;        /* pwdFailureCountInterval */

    krb5_ui_4       pw_lockout_duration;        /* pwdLockoutDuration */

    /* Only valid if version > 2 */

    krb5_ui_4       attributes;

    krb5_ui_4       max_life;

    krb5_ui_4       max_renewable_life;

    char          * allowed_keysalts;

    krb5_int16      n_tl_data;

    krb5_tl_data  * tl_data;

} osa_policy_ent_rec, *osa_policy_ent_t;

typedef       void    (*osa_adb_iter_policy_func) (void *, osa_policy_ent_t);

typedef struct __krb5_key_salt_tuple {

    krb5_enctype        ks_enctype;

    krb5_int32          ks_salttype;

} krb5_key_salt_tuple;

#define KRB5_KDB_MAGIC_NUMBER           0xdbdbdbdb

#define KRB5_KDB_V1_BASE_LENGTH         38

#define KRB5_KDB_MAX_ALLOWED_KS_LEN     512

#define KRB5_TL_LAST_PWD_CHANGE         0x0001

#define KRB5_TL_MOD_PRINC               0x0002

#define KRB5_TL_KADM_DATA               0x0003

#define KRB5_TL_KADM5_E_DATA            0x0004

#define KRB5_TL_RB1_CHALLENGE           0x0005

#ifdef SECURID

#define KRB5_TL_SECURID_STATE           0x0006

#endif /* SECURID */

#define KRB5_TL_USER_CERTIFICATE        0x0007

#define KRB5_TL_MKVNO                   0x0008

#define KRB5_TL_ACTKVNO                 0x0009

#define KRB5_TL_MKEY_AUX                0x000a

/* String attributes may not always be represented in tl-data.  kadmin clients

 * must use the get_strings and set_string RPCs. */

#define KRB5_TL_STRING_ATTRS            0x000b

#define KRB5_TL_PAC_LOGON_INFO          0x0100 /* NDR encoded validation info */

#define KRB5_TL_SERVER_REFERRAL         0x0200 /* ASN.1 encoded ServerReferralInfo */

#define KRB5_TL_SVR_REFERRAL_DATA       0x0300 /* ASN.1 encoded PA-SVR-REFERRAL-DATA */

#define KRB5_TL_CONSTRAINED_DELEGATION_ACL 0x0400 /* Each entry is a permitted SPN */

#define KRB5_TL_LM_KEY                  0x0500 /* LM OWF */

#define KRB5_TL_X509_SUBJECT_ISSUER_NAME 0x0600 /* IssuerDN<S>SubjectDN */

#define KRB5_TL_LAST_ADMIN_UNLOCK       0x0700 /* Timestamp of admin unlock */

#define KRB5_TL_DB_ARGS                 0x7fff

/* version number for KRB5_TL_ACTKVNO data */

#define KRB5_TL_ACTKVNO_VER     1

/* version number for KRB5_TL_MKEY_AUX data */

#define KRB5_TL_MKEY_AUX_VER    1

typedef struct _krb5_actkvno_node {

    struct _krb5_actkvno_node *next;

    krb5_kvno      act_kvno;

    krb5_timestamp act_time;

} krb5_actkvno_node;

typedef struct _krb5_mkey_aux_node {

    struct _krb5_mkey_aux_node *next;

    krb5_kvno        mkey_kvno; /* kvno of mkey protecting the latest_mkey */

    krb5_key_data    latest_mkey; /* most recent mkey */

} krb5_mkey_aux_node;

typedef struct _krb5_keylist_node {

    krb5_keyblock keyblock;

    krb5_kvno     kvno;

    struct _krb5_keylist_node *next;

} krb5_keylist_node;

/*

 * Determines the number of failed KDC requests before DISALLOW_ALL_TIX is set

 * on the principal.

 */

#define KRB5_MAX_FAIL_COUNT             5

/* XXX depends on knowledge of krb5_parse_name() formats */

#define KRB5_KDB_M_NAME         "K/M"   /* Kerberos/Master */

/* prompts used by default when reading the KDC password from the keyboard. */

#define KRB5_KDC_MKEY_1 "Enter KDC database master key"

#define KRB5_KDC_MKEY_2 "Re-enter KDC database master key to verify"

extern char *krb5_mkey_pwd_prompt1;

extern char *krb5_mkey_pwd_prompt2;

/*

 * These macros specify the encoding of data within the database.

 *

 * Data encoding is little-endian.

 */

#ifdef _KRB5_INT_H

#include "k5-platform.h"

#define krb5_kdb_decode_int16(cp, i16)          \

    *((krb5_int16 *) &(i16)) = load_16_le(cp)

#define krb5_kdb_decode_int32(cp, i32)          \

    *((krb5_int32 *) &(i32)) = load_32_le(cp)

#define krb5_kdb_encode_int16(i16, cp)  store_16_le(i16, cp)

#define krb5_kdb_encode_int32(i32, cp)  store_32_le(i32, cp)

#endif /* _KRB5_INT_H */

#define KRB5_KDB_OPEN_RW                0

#define KRB5_KDB_OPEN_RO                1

#ifndef KRB5_KDB_SRV_TYPE_KDC

#define KRB5_KDB_SRV_TYPE_KDC           0x0100

#endif

#ifndef KRB5_KDB_SRV_TYPE_ADMIN

#define KRB5_KDB_SRV_TYPE_ADMIN         0x0200

#endif

/* 0x0300 was KRB5_KDB_SRV_TYPE_PASSWD but it is no longer used. */

#ifndef KRB5_KDB_SRV_TYPE_OTHER

#define KRB5_KDB_SRV_TYPE_OTHER         0x0400

#endif

#define KRB5_KDB_OPT_SET_DB_NAME        0

#define KRB5_KDB_OPT_SET_LOCK_MODE      1

#define KRB5_DB_LOCKMODE_SHARED       0x0001

#define KRB5_DB_LOCKMODE_EXCLUSIVE    0x0002

#define KRB5_DB_LOCKMODE_PERMANENT    0x0008

/* libkdb.spec */

krb5_error_code krb5_db_setup_lib_handle(krb5_context kcontext);

krb5_error_code krb5_db_open( krb5_context kcontext, char **db_args, int mode );

krb5_error_code krb5_db_init  ( krb5_context kcontext );

krb5_error_code krb5_db_create ( krb5_context kcontext, char **db_args );

krb5_error_code krb5_db_inited  ( krb5_context kcontext );

krb5_error_code kdb5_db_create ( krb5_context kcontext, char **db_args );

krb5_error_code krb5_db_fini ( krb5_context kcontext );

const char * krb5_db_errcode2string ( krb5_context kcontext, long err_code );

krb5_error_code krb5_db_destroy ( krb5_context kcontext, char **db_args );

krb5_error_code krb5_db_promote ( krb5_context kcontext, char **db_args );

krb5_error_code krb5_db_get_age ( krb5_context kcontext, char *db_name, time_t *t );

krb5_error_code krb5_db_lock ( krb5_context kcontext, int lock_mode );

krb5_error_code krb5_db_unlock ( krb5_context kcontext );

krb5_error_code krb5_db_get_principal ( krb5_context kcontext,

                                        krb5_const_principal search_for,

                                        unsigned int flags,

                                        krb5_db_entry **entry );

void krb5_db_free_principal ( krb5_context kcontext, krb5_db_entry *entry );

krb5_error_code krb5_db_put_principal ( krb5_context kcontext,

                                        krb5_db_entry *entry );

krb5_error_code krb5_db_delete_principal ( krb5_context kcontext,

                                           krb5_principal search_for );

krb5_error_code krb5_db_rename_principal ( krb5_context kcontext,

                                           krb5_principal source,

                                           krb5_principal target );

/*

 * Iterate over principals in the KDB.  If the callback may write to the DB,

 * the caller must get an exclusive lock with krb5_db_lock before iterating,

 * and release it with krb5_db_unlock after iterating.

 */

krb5_error_code krb5_db_iterate ( krb5_context kcontext,

                                  char *match_entry,

                                  int (*func) (krb5_pointer, krb5_db_entry *),

                                  krb5_pointer func_arg, krb5_flags iterflags );

krb5_error_code krb5_db_store_master_key  ( krb5_context kcontext,

                                            char *keyfile,

                                            krb5_principal mname,

                                            krb5_kvno kvno,

                                            krb5_keyblock *key,

                                            char *master_pwd);

krb5_error_code krb5_db_store_master_key_list  ( krb5_context kcontext,

                                                 char *keyfile,

                                                 krb5_principal mname,

                                                 char *master_pwd);

krb5_error_code krb5_db_fetch_mkey  ( krb5_context   context,

                                      krb5_principal mname,

                                      krb5_enctype   etype,

                                      krb5_boolean   fromkeyboard,

                                      krb5_boolean   twice,

                                      char          *db_args,

                                      krb5_kvno     *kvno,

                                      krb5_data     *salt,

                                      krb5_keyblock *key);

krb5_error_code

krb5_db_fetch_mkey_list( krb5_context    context,

                         krb5_principal  mname,

                         const krb5_keyblock * mkey );

krb5_error_code

krb5_dbe_find_enctype( krb5_context     kcontext,

                       krb5_db_entry    *dbentp,

                       krb5_int32               ktype,

                       krb5_int32               stype,

                       krb5_int32               kvno,

                       krb5_key_data    **kdatap);

krb5_error_code krb5_dbe_search_enctype ( krb5_context kcontext,

                                          krb5_db_entry *dbentp,

                                          krb5_int32 *start,

                                          krb5_int32 ktype,

                                          krb5_int32 stype,

                                          krb5_int32 kvno,

                                          krb5_key_data **kdatap);

krb5_error_code

krb5_db_setup_mkey_name ( krb5_context context,

                          const char *keyname,

                          const char *realm,

                          char **fullname,

                          krb5_principal *principal);

/**

 * Decrypts the key given in @@a key_data. If @a mkey is specified, that

 * master key is used. If @a mkey is NULL, then all master keys are tried.

 */

krb5_error_code

krb5_dbe_decrypt_key_data( krb5_context         context,

                           const krb5_keyblock        * mkey,

                           const krb5_key_data        * key_data,

                           krb5_keyblock      * dbkey,

                           krb5_keysalt       * keysalt);

krb5_error_code

krb5_dbe_encrypt_key_data( krb5_context                 context,

                           const krb5_keyblock        * mkey,

                           const krb5_keyblock        * dbkey,

                           const krb5_keysalt         * keysalt,

                           int                          keyver,

                           krb5_key_data              * key_data);

krb5_error_code

krb5_dbe_fetch_act_key_list(krb5_context          context,

                            krb5_principal       princ,

                            krb5_actkvno_node  **act_key_list);

krb5_error_code

krb5_dbe_find_act_mkey( krb5_context          context,

                        krb5_actkvno_node   * act_mkey_list,

                        krb5_kvno           * act_kvno,

                        krb5_keyblock      ** act_mkey);

krb5_error_code

krb5_dbe_find_mkey( krb5_context         context,

                    krb5_db_entry      * entry,

                    krb5_keyblock      ** mkey);

/* Set *mkvno to mkvno in entry tl_data, or 0 if not present. */

krb5_error_code

krb5_dbe_lookup_mkvno( krb5_context    context,

                       krb5_db_entry * entry,

                       krb5_kvno     * mkvno);

krb5_keylist_node *

krb5_db_mkey_list_alias( krb5_context kcontext );

/* Set *mkvno to mkvno in entry tl_data, or minimum value from mkey_list. */

krb5_error_code

krb5_dbe_get_mkvno( krb5_context        context,

                    krb5_db_entry     * entry,

                    krb5_kvno         * mkvno);

krb5_error_code

krb5_dbe_lookup_mod_princ_data( krb5_context          context,

                                krb5_db_entry       * entry,

                                krb5_timestamp      * mod_time,

                                krb5_principal      * mod_princ);

krb5_error_code

krb5_dbe_lookup_mkey_aux( krb5_context         context,

                          krb5_db_entry      * entry,

                          krb5_mkey_aux_node ** mkey_aux_data_list);

krb5_error_code

krb5_dbe_update_mkvno( krb5_context    context,

                       krb5_db_entry * entry,

                       krb5_kvno       mkvno);

krb5_error_code

krb5_dbe_lookup_actkvno( krb5_context         context,

                         krb5_db_entry      * entry,

                         krb5_actkvno_node ** actkvno_list);

krb5_error_code

krb5_dbe_update_mkey_aux( krb5_context          context,

                          krb5_db_entry       * entry,

                          krb5_mkey_aux_node  * mkey_aux_data_list);

krb5_error_code

krb5_dbe_update_actkvno(krb5_context    context,

                        krb5_db_entry * entry,

                        const krb5_actkvno_node *actkvno_list);

krb5_error_code

krb5_dbe_update_last_pwd_change( krb5_context     context,

                                 krb5_db_entry  * entry,

                                 krb5_timestamp   stamp);

krb5_error_code

krb5_dbe_update_last_admin_unlock( krb5_context     context,

                                   krb5_db_entry  * entry,

                                   krb5_timestamp   stamp);

krb5_error_code

krb5_dbe_lookup_tl_data( krb5_context          context,

                         krb5_db_entry       * entry,

                         krb5_tl_data        * ret_tl_data);

krb5_error_code

krb5_dbe_create_key_data( krb5_context          context,

                          krb5_db_entry       * entry);

krb5_error_code

krb5_dbe_update_mod_princ_data( krb5_context          context,

                                krb5_db_entry       * entry,

                                krb5_timestamp        mod_date,

                                krb5_const_principal  mod_princ);

/*

 * These are wrappers around realloc() and free().  Applications and KDB

 * modules can use them when manipulating principal and policy entries to

 * ensure that they allocate and free memory in a manner compatible with the

 * library.  Using libkrb5 or libkbd5 functions to construct values (such as

 * krb5_copy_principal() to construct the princ field of a krb5_db_entry) is

 * also safe.  On Unix platforms, just using malloc() and free() is safe as

 * long as the application or module does not use a malloc replacement.

 */

void *krb5_db_alloc( krb5_context kcontext,

                     void *ptr,

                     size_t size );

void krb5_db_free( krb5_context kcontext,

                   void *ptr);

krb5_error_code

krb5_dbe_lookup_last_pwd_change( krb5_context          context,

                                 krb5_db_entry       * entry,

                                 krb5_timestamp      * stamp);

krb5_error_code

krb5_dbe_lookup_last_admin_unlock( krb5_context          context,

                                   krb5_db_entry       * entry,

                                   krb5_timestamp      * stamp);

/* Retrieve the set of string attributes in entry, in no particular order.

 * Free *strings_out with krb5_dbe_free_strings when done. */

krb5_error_code

krb5_dbe_get_strings(krb5_context context, krb5_db_entry *entry,

                     krb5_string_attr **strings_out, int *count_out);

/* Retrieve a single string attribute from entry, or NULL if there is no

 * attribute for key.  Free *value_out with krb5_dbe_free_string when done. */

krb5_error_code

krb5_dbe_get_string(krb5_context context, krb5_db_entry *entry,

                    const char *key, char **value_out);

/* Change or add a string attribute in entry, or delete it if value is NULL. */

krb5_error_code

krb5_dbe_set_string(krb5_context context, krb5_db_entry *entry,

                    const char *key, const char *value);

krb5_error_code

krb5_dbe_delete_tl_data( krb5_context    context,

                         krb5_db_entry * entry,

                         krb5_int16      tl_data_type);

krb5_error_code

krb5_db_update_tl_data(krb5_context          context,

                       krb5_int16          * n_tl_datap,

                       krb5_tl_data        **tl_datap,

                       krb5_tl_data        * new_tl_data);

krb5_error_code

krb5_dbe_update_tl_data( krb5_context          context,

                         krb5_db_entry       * entry,

                         krb5_tl_data        * new_tl_data);

/* Compute the salt for a key data entry given the corresponding principal. */

krb5_error_code

krb5_dbe_compute_salt(krb5_context context, const krb5_key_data *key,

                      krb5_const_principal princ, krb5_int16 *salttype_out,

                      krb5_data **salt_out);

/*

 * Modify the key data of entry to explicitly store salt values using the

 * KRB5_KDB_SALTTYPE_SPECIAL salt type.

 */

krb5_error_code

krb5_dbe_specialize_salt(krb5_context context, krb5_db_entry *entry);

krb5_error_code

krb5_dbe_cpw( krb5_context        kcontext,

              krb5_keyblock       * master_key,

              krb5_key_salt_tuple       * ks_tuple,

              int                         ks_tuple_count,

              char              * passwd,

              int                         new_kvno,

              krb5_boolean        keepold,

              krb5_db_entry     * db_entry);

krb5_error_code

krb5_dbe_ark( krb5_context        context,

              krb5_keyblock       * master_key,

              krb5_key_salt_tuple       * ks_tuple,

              int                         ks_tuple_count,

              krb5_db_entry     * db_entry);

krb5_error_code

krb5_dbe_crk( krb5_context        context,

              krb5_keyblock       * master_key,

              krb5_key_salt_tuple       * ks_tuple,

              int                         ks_tuple_count,

              krb5_boolean        keepold,

              krb5_db_entry     * db_entry);

krb5_error_code

krb5_dbe_apw( krb5_context        context,

              krb5_keyblock       * master_key,

              krb5_key_salt_tuple       * ks_tuple,

              int                         ks_tuple_count,

              char              * passwd,

              krb5_db_entry     * db_entry);

int

krb5_db_get_key_data_kvno( krb5_context    context,

                           int             count,

                           krb5_key_data * data);

krb5_error_code krb5_db_sign_authdata(krb5_context kcontext,

                                      unsigned int flags,

                                      krb5_const_principal client_princ,

                                      krb5_const_principal server_princ,

                                      krb5_db_entry *client,

                                      krb5_db_entry *server,

                                      krb5_db_entry *header_server,

                                      krb5_db_entry *local_tgt,

                                      krb5_keyblock *client_key,

                                      krb5_keyblock *server_key,

                                      krb5_keyblock *header_key,

                                      krb5_keyblock *local_tgt_key,

                                      krb5_keyblock *session_key,

                                      krb5_timestamp authtime,

                                      krb5_authdata **tgt_auth_data,

                                      void *ad_info,

                                      krb5_data ***auth_indicators,

                                      krb5_authdata ***signed_auth_data);

krb5_error_code krb5_db_check_transited_realms(krb5_context kcontext,

                                               const krb5_data *tr_contents,

                                               const krb5_data *client_realm,

                                               const krb5_data *server_realm);

krb5_error_code krb5_db_check_policy_as(krb5_context kcontext,

                                        krb5_kdc_req *request,

                                        krb5_db_entry *client,

                                        krb5_db_entry *server,

                                        krb5_timestamp kdc_time,

                                        const char **status,

                                        krb5_pa_data ***e_data);

krb5_error_code krb5_db_check_policy_tgs(krb5_context kcontext,

                                         krb5_kdc_req *request,

                                         krb5_db_entry *server,

                                         krb5_ticket *ticket,

                                         const char **status,

                                         krb5_pa_data ***e_data);

void krb5_db_audit_as_req(krb5_context kcontext, krb5_kdc_req *request,

                          const krb5_address *local_addr,

                          const krb5_address *remote_addr,

                          krb5_db_entry *client, krb5_db_entry *server,

                          krb5_timestamp authtime, krb5_error_code error_code);

void krb5_db_refresh_config(krb5_context kcontext);

krb5_error_code krb5_db_check_allowed_to_delegate(krb5_context kcontext,

                                                  krb5_const_principal client,

                                                  const krb5_db_entry *server,

                                                  krb5_const_principal proxy);

krb5_error_code krb5_db_get_s4u_x509_principal(krb5_context kcontext,

                                               const krb5_data *client_cert,

                                               krb5_const_principal in_princ,

                                               unsigned int flags,

                                               krb5_db_entry **entry);

krb5_error_code krb5_db_allowed_to_delegate_from(krb5_context context,

                                                 krb5_const_principal client,

                                                 krb5_const_principal server,

                                                 void *server_ad_info,

                                                 const krb5_db_entry *proxy);

krb5_error_code krb5_db_get_authdata_info(krb5_context context,

                                          unsigned int flags,

                                          krb5_authdata **in_authdata,

                                          krb5_const_principal client_princ,

                                          krb5_const_principal server_princ,

                                          krb5_keyblock *server_key,

                                          krb5_keyblock *krbtgt_key,

                                          krb5_db_entry *krbtgt,

                                          krb5_timestamp authtime,

                                          void **ad_info_out,

                                          krb5_principal *client_out);

void krb5_db_free_authdata_info(krb5_context context, void *ad_info);

/**

 * Sort an array of @a krb5_key_data keys in descending order by their kvno.

 * Key data order within a kvno is preserved.

 *

 * @param key_data

 *     The @a krb5_key_data array to sort.  This is sorted in place so the

 *     array will be modified.

 * @param key_data_length

 *     The length of @a key_data.

 */

void

krb5_dbe_sort_key_data(krb5_key_data *key_data, size_t key_data_length);

/* default functions. Should not be directly called */

/*

 *   Default functions prototype

 */

krb5_error_code

krb5_dbe_def_search_enctype( krb5_context kcontext,

                             krb5_db_entry *dbentp,

                             krb5_int32 *start,

                             krb5_int32 ktype,

                             krb5_int32 stype,

                             krb5_int32 kvno,

                             krb5_key_data **kdatap);

krb5_error_code

krb5_def_store_mkey_list( krb5_context context,

                          char *keyfile,

                          krb5_principal mname,

                          krb5_keylist_node *keylist,

                          char *master_pwd);

krb5_error_code

krb5_db_def_fetch_mkey( krb5_context   context,

                        krb5_principal mname,

                        krb5_keyblock *key,

                        krb5_kvno     *kvno,

                        char          *db_args);

krb5_error_code

krb5_def_fetch_mkey_list( krb5_context            context,

                          krb5_principal        mprinc,

                          const krb5_keyblock  *mkey,

                          krb5_keylist_node  **mkeys_list);

krb5_error_code

krb5_dbe_def_cpw( krb5_context    context,

                  krb5_keyblock       * master_key,

                  krb5_key_salt_tuple   * ks_tuple,

                  int                     ks_tuple_count,

                  char          * passwd,

                  int                     new_kvno,

                  krb5_boolean    keepold,

                  krb5_db_entry * db_entry);

krb5_error_code

krb5_dbe_def_decrypt_key_data( krb5_context             context,

                               const krb5_keyblock    * mkey,

                               const krb5_key_data    * key_data,

                               krb5_keyblock          * dbkey,

                               krb5_keysalt           * keysalt);

krb5_error_code

krb5_dbe_def_encrypt_key_data( krb5_context             context,

                               const krb5_keyblock    * mkey,

                               const krb5_keyblock    * dbkey,

                               const krb5_keysalt     * keysalt,

                               int                      keyver,

                               krb5_key_data          * key_data);

krb5_error_code

krb5_db_def_rename_principal( krb5_context kcontext,

                              krb5_const_principal source,

                              krb5_const_principal target);

krb5_error_code

krb5_db_create_policy( krb5_context kcontext,

                       osa_policy_ent_t policy);

krb5_error_code

krb5_db_get_policy ( krb5_context kcontext,

                     char *name,

                     osa_policy_ent_t *policy );

krb5_error_code

krb5_db_put_policy( krb5_context kcontext,

                    osa_policy_ent_t policy);

krb5_error_code

krb5_db_iter_policy( krb5_context kcontext,

                     char *match_entry,

                     osa_adb_iter_policy_func func,

                     void *data);

krb5_error_code

krb5_db_delete_policy( krb5_context kcontext,

                       char *policy);

void

krb5_db_free_policy( krb5_context kcontext,

                     osa_policy_ent_t policy);

krb5_error_code

krb5_db_set_context(krb5_context, void *db_context);

krb5_error_code

krb5_db_get_context(krb5_context, void **db_context);

void

krb5_dbe_free_key_data_contents(krb5_context, krb5_key_data *);

void

krb5_dbe_free_key_list(krb5_context, krb5_keylist_node *);

void

krb5_dbe_free_actkvno_list(krb5_context, krb5_actkvno_node *);

void

krb5_dbe_free_mkey_aux_list(krb5_context, krb5_mkey_aux_node *);

void

krb5_dbe_free_tl_data(krb5_context, krb5_tl_data *);

void

krb5_dbe_free_strings(krb5_context, krb5_string_attr *, int count);

void

krb5_dbe_free_string(krb5_context, char *);

/*

 * Register the KDB keytab type, allowing "KDB:" to be used as a keytab name.

 * For this type to work, the context used for keytab operations must have an

 * associated database handle (via krb5_db_open()).

 */

krb5_error_code krb5_db_register_keytab(krb5_context context);

#define KRB5_KDB_DEF_FLAGS      0

#define KDB_MAX_DB_NAME                 128

#define KDB_REALM_SECTION               "realms"