Merge branch 'debian' into squeeze

[kerberos/krb5-strength.git] / plugin / internal.h

diff --git a/plugin/internal.h b/plugin/internal.h
index 7eebf67ae42cf2f3c54498f6ea4c923b77c02b34..a32832192c1eec8908c8111de505b2de40b20c4f 100644 (file)
--- a/plugin/internal.h
+++ b/plugin/internal.h
@@ -4,7 +4,7 @@
  * Developed by Derrick Brashear and Ken Hornstein of Sine Nomine Associates,
  *     on behalf of Stanford University
  * Extensive modifications by Russ Allbery <eagle@eyrie.org>
- * Copyright 2006, 2007, 2009, 2012, 2013
+ * Copyright 2006, 2007, 2009, 2012, 2013, 2014
  *     The Board of Trustees of the Leland Stanford Junior University
  *
  * See LICENSE for licensing terms.
@@ -20,6 +20,9 @@
 #ifdef HAVE_CDB_H
 # include <cdb.h>
 #endif
+#ifdef HAVE_SQLITE3_H
+# include <sqlite3.h>
+#endif
 #include <stddef.h>
 
 #ifdef HAVE_KRB5_PWQUAL_PLUGIN_H
@@ -32,6 +35,7 @@ typedef struct krb5_pwqual_moddata_st *krb5_pwqual_moddata;
 #define ERROR_ASCII    "password contains non-ASCII or control characters"
 #define ERROR_DICT     "password found in list of common passwords"
 #define ERROR_LETTER   "password is only letters and spaces"
+#define ERROR_MINDIFF  "password does not contain enough unique characters"
 #define ERROR_SHORT    "password is too short"
 #define ERROR_USERNAME "password based on username or principal"
 
@@ -65,6 +69,7 @@ struct vector {
  * checking for at least the MIT plugin.
  */
 struct krb5_pwqual_moddata_st {
+    long minimum_different;     /* Minimum number of different characters */
     long minimum_length;        /* Minimum password length */
     bool ascii;                 /* Whether to require printable ASCII */
     bool nonletter;             /* Whether to require a non-letter */
@@ -75,6 +80,11 @@ struct krb5_pwqual_moddata_st {
 #ifdef HAVE_CDB_H
     struct cdb cdb;             /* Open CDB dictionary data */
 #endif
+#ifdef HAVE_SQLITE3_H
+    sqlite3 *sqlite;            /* Open SQLite database handle */
+    sqlite3_stmt *prefix_query; /* Query using the password prefix */
+    sqlite3_stmt *suffix_query; /* Query using the reversed password suffix */
+#endif
 };
 
 BEGIN_DECLS
@@ -103,7 +113,7 @@ void strength_close(krb5_context, krb5_pwqual_moddata);
  *
  * If not built with CDB support, provide some stubs for check and close.
  * init is always a real function, which reports an error if CDB is
- * requested.
+ * requested and not available.
  */
 krb5_error_code strength_init_cdb(krb5_context, krb5_pwqual_moddata);
 #ifdef HAVE_CDB
@@ -125,6 +135,25 @@ krb5_error_code strength_init_cracklib(krb5_context, krb5_pwqual_moddata,
 krb5_error_code strength_check_cracklib(krb5_context, krb5_pwqual_moddata,
                                         const char *password);
 
+/*
+ * SQLite handling.  strength_init_sqlite gets the database configuration and
+ * sets up the SQLite internal data, strength_check_sqlite checks a password,
+ * and strength_close_sqlite handles freeing resources.
+ *
+ * If not built with SQLite support, provide some stubs for check and close.
+ * init is always a real function, which reports an error if SQLite is
+ * requested and not available.
+ */
+krb5_error_code strength_init_sqlite(krb5_context, krb5_pwqual_moddata);
+#ifdef HAVE_SQLITE
+krb5_error_code strength_check_sqlite(krb5_context, krb5_pwqual_moddata,
+                                      const char *password);
+void strength_close_sqlite(krb5_context, krb5_pwqual_moddata);
+#else
+# define strength_check_sqlite(c, d, p) 0
+# define strength_close_sqlite(c, d)    /* empty */
+#endif
+
 /* Check whether the password statisfies character class requirements. */
 krb5_error_code strength_check_classes(krb5_context, krb5_pwqual_moddata,
                                        const char *password);