#define KRB5_DB_LOCKMODE_PERMANENT 0x0008
/* db_invoke methods */
-#define KRB5_KDB_METHOD_AUDIT_AS 0x00000050
-#define KRB5_KDB_METHOD_AUDIT_TGS 0x00000060
#define KRB5_KDB_METHOD_REFRESH_POLICY 0x00000070
#define KRB5_KDB_METHOD_CHECK_ALLOWED_TO_DELEGATE 0x00000080
-typedef struct _kdb_audit_as_req {
- krb5_magic magic;
- krb5_kdc_req *request;
- krb5_db_entry *client;
- krb5_db_entry *server;
- krb5_timestamp authtime;
- krb5_error_code error_code;
-} kdb_audit_as_req;
-
-typedef struct _kdb_audit_tgs_req {
- krb5_magic magic;
- krb5_kdc_req *request;
- krb5_const_principal client;
- krb5_db_entry *server;
- krb5_timestamp authtime;
- krb5_error_code error_code;
-} kdb_audit_tgs_req;
-
typedef struct _kdb_check_allowed_to_delegate_req {
krb5_magic magic;
const krb5_db_entry *server;
const char **status,
krb5_data *e_data);
+krb5_error_code krb5_db_audit_as_req(krb5_context kcontext,
+ krb5_kdc_req *request,
+ krb5_db_entry *client,
+ krb5_db_entry *server,
+ krb5_timestamp authtime,
+ krb5_error_code error_code);
+
krb5_error_code krb5_db_invoke ( krb5_context kcontext,
unsigned int method,
const krb5_data *req,
* DAL. It is passed to init_library to allow KDB modules to detect when
* they are being loaded by an incompatible version of the KDC.
*/
-#define KRB5_KDB_DAL_VERSION 20100712
+#define KRB5_KDB_DAL_VERSION 20100713
/*
* A krb5_context can hold one database object. Modules should use
const char **status,
krb5_data *e_data);
+ /*
+ * Optional: This method informs the module of a successful or unsuccessful
+ * AS request. The resulting error code is currently ignored by the KDC.
+ */
+ krb5_error_code (*audit_as_req)(krb5_context kcontext,
+ krb5_kdc_req *request,
+ krb5_db_entry *client,
+ krb5_db_entry *server,
+ krb5_timestamp authtime,
+ krb5_error_code error_code);
+
+ /* Note: there is currently no method for auditing TGS requests. */
+
/*
* Optional: Perform an operation on input data req with output stored in
* rep. Return KRB5_PLUGIN_OP_NOTSUPP if the module does not implement the
* method. Defined methods are:
*
- * KRB5_KDB_METHOD_AUDIT_AS: req contains a kdb_audit_as_req structure.
- * Informs the module of a successful or unsuccessful AS request. Do
- * not place any data in rep.
- *
- * KRB5_KDB_METHOD_AUDIT_TGS: Same as above, except req contains a
- * kdb_audit_tgs_req structure.
- *
* KRB5_KDB_METHOD_REFRESH_POLICY: req and rep are NULL. Informs the
* module that the KDC received a request to reload configuration
* (that is, a SIGHUP).
ktypestr, fromstring, status,
cname2, sname2, emsg ? ", " : "", emsg ? emsg : "");
}
+ (void) krb5_db_audit_as_req(kdc_context, request, client, server,
+ authtime, errcode);
#if 0
/* Sun (OpenSolaris) version would probably something like this.
The client and server names passed can be null, unlike in the
audit_krb5kdc_as_req(some in_addr *, (in_port_t)from->port, 0,
cname, sname, errcode);
#endif
-#if 1
- {
- kdb_audit_as_req req;
- krb5_data req_data;
- krb5_data rep_data;
-
- memset(&req, 0, sizeof(req));
-
- req.request = request;
- req.client = client;
- req.server = server;
- req.authtime = authtime;
- req.error_code = errcode;
-
- req_data.data = (void *)&req;
- req_data.length = sizeof(req);
-
- rep_data.data = NULL;
- rep_data.length = 0;
-
- (void) krb5_db_invoke(kdc_context,
- KRB5_KDB_METHOD_AUDIT_AS,
- &req_data,
- &rep_data);
- assert(rep_data.length == 0);
- }
-#endif
}
/* Here "status" must be non-null. Error code
e_data);
}
+krb5_error_code
+krb5_db_audit_as_req(krb5_context kcontext, krb5_kdc_req *request,
+ krb5_db_entry *client, krb5_db_entry *server,
+ krb5_timestamp authtime, krb5_error_code error_code)
+{
+ krb5_error_code status;
+ kdb_vftabl *v;
+
+ status = get_vftabl(kcontext, &v);
+ if (status)
+ return status;
+ if (v->audit_as_req == NULL)
+ return KRB5_PLUGIN_OP_NOTSUPP;
+ return v->audit_as_req(kcontext, request, client, server, authtime,
+ error_code);
+}
+
krb5_error_code
krb5_db_invoke(krb5_context kcontext,
unsigned int method,
krb5_db_inited
krb5_db_alloc
krb5_db_free
+krb5_db_audit_as_req
krb5_db_check_policy_as
krb5_db_check_policy_tgs
krb5_db_check_transited_realms
krb5_data *e_data),
(kcontext, request, client, server, kdc_time, status, e_data));
+WRAP_K (krb5_db2_audit_as_req,
+ (krb5_context kcontext, krb5_kdc_req *request, krb5_db_entry *client,
+ krb5_db_entry *server, krb5_timestamp authtime,
+ krb5_error_code error_code),
+ (kcontext, request, client, server, authtime, error_code));
+
WRAP_K (krb5_db2_invoke,
(krb5_context kcontext,
unsigned int method,
0, 0, 0, 0,
/* check_policy_as */ wrap_krb5_db2_check_policy_as,
0,
+ /* audit_as_req */ wrap_krb5_db2_audit_as_req,
/* invoke */ wrap_krb5_db2_invoke
};
*status = "LOCKED_OUT";
return retval;
}
+
+krb5_error_code
+krb5_db2_audit_as_req(krb5_context kcontext, krb5_kdc_req *request,
+ krb5_db_entry *client, krb5_db_entry *server,
+ krb5_timestamp authtime, krb5_error_code error_code)
+{
+ return krb5_db2_lockout_audit(kcontext, client, authtime, error_code);
+}
krb5_timestamp kdc_time, const char **status,
krb5_data *e_data);
+krb5_error_code
+krb5_db2_audit_as_req(krb5_context kcontext, krb5_kdc_req *request,
+ krb5_db_entry *client, krb5_db_entry *server,
+ krb5_timestamp authtime, krb5_error_code error_code);
+
/* methods */
krb5_error_code
krb5_db2_invoke(krb5_context context,
#include <errno.h>
#include "kdb_db2.h"
-static krb5_error_code
-krb5_db2_audit_as(krb5_context context,
- unsigned int method,
- const krb5_data *request,
- krb5_data *response)
-{
- const kdb_audit_as_req *req;
- krb5_error_code code;
-
- req = (const kdb_audit_as_req *)request->data;
-
- code = krb5_db2_lockout_audit(context, req->client,
- req->authtime, req->error_code);
-
- return code;
-}
-
krb5_error_code
krb5_db2_invoke(krb5_context context,
unsigned int method,
const krb5_data *req,
krb5_data *rep)
{
- krb5_error_code code = KRB5_PLUGIN_OP_NOTSUPP;
-
- switch (method) {
- case KRB5_KDB_METHOD_AUDIT_AS:
- code = krb5_db2_audit_as(context, method, req, rep);
- break;
- default:
- break;
- }
-
- return code;
+ return KRB5_PLUGIN_OP_NOTSUPP;
}
/* check_transited_realms */ NULL,
/* check_policy_as */ krb5_ldap_check_policy_as,
/* check_policy_tgs */ NULL,
+ /* audit_as_req */ krb5_ldap_audit_as_req,
/* invoke */ krb5_ldap_invoke,
};
#include <errno.h>
#include "kdb_ldap.h"
-static krb5_error_code
-krb5_ldap_audit_as(krb5_context context,
- unsigned int method,
- const krb5_data *request,
- krb5_data *response)
-{
- const kdb_audit_as_req *req;
- krb5_error_code code;
-
- req = (const kdb_audit_as_req *)request->data;
-
- code = krb5_ldap_lockout_audit(context, req->client,
- req->authtime, req->error_code);
-
- return code;
-}
-
static krb5_error_code
krb5_ldap_check_allowed_to_delegate(krb5_context context,
unsigned int method,
krb5_error_code code = KRB5_PLUGIN_OP_NOTSUPP;
switch (method) {
- case KRB5_KDB_METHOD_AUDIT_AS:
- code = krb5_ldap_audit_as(context, method, req, rep);
- break;
case KRB5_KDB_METHOD_CHECK_ALLOWED_TO_DELEGATE:
code = krb5_ldap_check_allowed_to_delegate(context, method, req, rep);
break;
*status = "LOCKED_OUT";
return retval;
}
+
+krb5_error_code
+krb5_ldap_audit_as_req(krb5_context kcontext, krb5_kdc_req *request,
+ krb5_db_entry *client, krb5_db_entry *server,
+ krb5_timestamp authtime, krb5_error_code error_code)
+{
+ return krb5_ldap_lockout_audit(kcontext, client, authtime, error_code);
+}
krb5_timestamp kdc_time, const char **status,
krb5_data *e_data);
+krb5_error_code
+krb5_ldap_audit_as_req(krb5_context kcontext, krb5_kdc_req *request,
+ krb5_db_entry *client, krb5_db_entry *server,
+ krb5_timestamp authtime, krb5_error_code error_code);
+
/* DAL functions */
krb5_ldap_set_mkey_list
krb5_ldap_get_mkey_list
krb5_ldap_check_policy_as
+krb5_ldap_audit_as_req
krb5_ldap_invoke