曾与蒿藜同雨露,한때 잡초와 쑥과 함께 비와 이슬을 나누던 곳이 이제는 소나무와 삼나무와 함께 서리와 눈을 견뎌내고 있다.终随松柏到冰霜.かつては雑草やヨモギと共に雨や露を分かち合っていたが、今では松やヒノキと共に霜や雪に耐えている。曾与蒿藜同雨露,Once sharing rain and dew with weeds and wormwood, now enduring frost and snow with pines and cypresses.终随松柏到冰霜.曾与蒿藜同雨露한때 잡초와 쑥과 함께 비와 이슬을 나누던 곳이 이제는 소나무와 삼나무와 함께 서리와 눈을 견뎌내고 있다.,终随松柏到冰霜.譖セ荳手珍阯懷酔髮ィ髴イ�檎サ磯囂譚セ譟丞芦蜀ー髴�曾与蒿藜同雨露,鏇句笌钂胯棞鍚岄洦闇诧紝缁堥殢鏉炬煆鍒板啺闇�终随松柏到冰霜.曾与蒿藜同雨露,한때 잡초와 쑥과 함께 비와 이슬을 나누던 곳이 이제는 소나무와 삼나무와 함께 서리와 눈을 견뎌내고 있다.终随松柏到冰霜.曾与蒿藜同雨露,终随松柏到冰霜.
/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/* include/krb5/kdcpolicy_plugin.h - KDC policy plugin interface */
/*
* Copyright (C) 2017 by Red Hat, Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/*
* Declarations for kdcpolicy plugin module implementors.
*
* The kdcpolicy pluggable interface currently has only one supported major
* version, which is 1. Major version 1 has a current minor version number of
* 1.
*
* kdcpolicy plugin modules should define a function named
* kdcpolicy_<modulename>_initvt, matching the signature:
*
* krb5_error_code
* kdcpolicy_modname_initvt(krb5_context context, int maj_ver, int min_ver,
* krb5_plugin_vtable vtable);
*
* The initvt function should:
*
* - Check that the supplied maj_ver number is supported by the module, or
* return KRB5_PLUGIN_VER_NOTSUPP if it is not.
*
* - Cast the vtable pointer as appropriate for maj_ver:
* maj_ver == 1: Cast to krb5_kdcpolicy_vtable
*
* - Initialize the methods of the vtable, stopping as appropriate for the
* supplied min_ver. Optional methods may be left uninitialized.
*
* Memory for the vtable is allocated by the caller, not by the module.
*/
#ifndef KRB5_POLICY_PLUGIN_H
#define KRB5_POLICY_PLUGIN_H
#include <krb5/krb5.h>
/* Abstract module datatype. */
typedef struct krb5_kdcpolicy_moddata_st *krb5_kdcpolicy_moddata;
/* A module can optionally include kdb.h to inspect principal entries when
* authorizing requests. */
struct _krb5_db_entry_new;
/*
* Optional: Initialize module data. Return 0 on success,
* KRB5_PLUGIN_NO_HANDLE if the module is inoperable (due to configuration, for
* example), and any other error code to abort KDC startup. Optionally set
* *data_out to a module data object to be passed to future calls.
*/
typedef krb5_error_code
(*krb5_kdcpolicy_init_fn)(krb5_context context,
krb5_kdcpolicy_moddata *data_out);
/* Optional: Clean up module data. */
typedef krb5_error_code
(*krb5_kdcpolicy_fini_fn)(krb5_context context,
krb5_kdcpolicy_moddata moddata);
/*
* Optional: return an error code and set status to an appropriate string
* literal to deny an AS request; otherwise return 0. lifetime_out, if set,
* restricts the ticket lifetime. renew_lifetime_out, if set, restricts the
* ticket renewable lifetime.
*/
typedef krb5_error_code
(*krb5_kdcpolicy_check_as_fn)(krb5_context context,
krb5_kdcpolicy_moddata moddata,
const krb5_kdc_req *request,
const struct _krb5_db_entry_new *client,
const struct _krb5_db_entry_new *server,
const char *const *auth_indicators,
const char **status, krb5_deltat *lifetime_out,
krb5_deltat *renew_lifetime_out);
/*
* Optional: return an error code and set status to an appropriate string
* literal to deny a TGS request; otherwise return 0. lifetime_out, if set,
* restricts the ticket lifetime. renew_lifetime_out, if set, restricts the
* ticket renewable lifetime.
*/
typedef krb5_error_code
(*krb5_kdcpolicy_check_tgs_fn)(krb5_context context,
krb5_kdcpolicy_moddata moddata,
const krb5_kdc_req *request,
const struct _krb5_db_entry_new *server,
const krb5_ticket *ticket,
const char *const *auth_indicators,
const char **status, krb5_deltat *lifetime_out,
krb5_deltat *renew_lifetime_out);
typedef struct krb5_kdcpolicy_vtable_st {
const char *name;
krb5_kdcpolicy_init_fn init;
krb5_kdcpolicy_fini_fn fini;
krb5_kdcpolicy_check_as_fn check_as;
krb5_kdcpolicy_check_tgs_fn check_tgs;
} *krb5_kdcpolicy_vtable;
#endif /* KRB5_POLICY_PLUGIN_H */