CVE-2022-2031 s4:kpasswd: Do not accept TGTs as kpasswd tickets
[samba.git] / source4 / kdc / kpasswd-helper.h
1 /*
2    Unix SMB/CIFS implementation.
3
4    Samba kpasswd implementation
5
6    Copyright (c) 2016      Andreas Schneider <asn@samba.org>
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #ifndef _KPASSWD_HELPER_H
23 #define _KPASSWD_HELPER_H
24
25 bool kpasswd_make_error_reply(TALLOC_CTX *mem_ctx,
26                               krb5_error_code error_code,
27                               const char *error_string,
28                               DATA_BLOB *error_data);
29
30 bool kpasswd_make_pwchange_reply(TALLOC_CTX *mem_ctx,
31                                  NTSTATUS status,
32                                  enum samPwdChangeReason reject_reason,
33                                  struct samr_DomInfo1 *dominfo,
34                                  DATA_BLOB *error_blob);
35
36 NTSTATUS kpasswd_samdb_set_password(TALLOC_CTX *mem_ctx,
37                                     struct tevent_context *event_ctx,
38                                     struct loadparm_context *lp_ctx,
39                                     struct auth_session_info *session_info,
40                                     bool is_service_principal,
41                                     const char *target_principal_name,
42                                     DATA_BLOB *password,
43                                     enum samPwdChangeReason *reject_reason,
44                                     struct samr_DomInfo1 **dominfo);
45
46 krb5_error_code kpasswd_check_non_tgt(struct auth_session_info *session_info,
47                                       const char **error_string);
48 #endif /* _KPASSWD_HELPER_H */