Policy extensions + new policy: allowed ks types

This simply adds KADM5_API_VERSION_4 and various fields to the
policy structures:

 - attributes         (policy-ish principal attributes)
 - max_life           (max ticket life)
 - max_renewable_life (max ticket renewable life)
 - allowed_keysalts   (allowed key/salt types)
 - TL data            (future policy extensions)

Of these only allowed_keysalts is currently implemented.

Some refactoring of TL data handling is also done.

ticket: 7223 (new)

1 files changed, 34 insertions, 6 deletions

diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
index 0b0253a..153b962 100644
--- a/src/lib/kadm5/kadm_rpc_xdr.c
+++ b/src/lib/kadm5/kadm_rpc_xdr.c
@@ -492,17 +492,45 @@ _xdr_kadm5_policy_ent_rec(XDR *xdrs, kadm5_policy_ent_rec *objp, int vers)
 	if (!xdr_long(xdrs, &objp->policy_refcnt)) {
 		return (FALSE);
 	}
-	if (vers == KADM5_API_VERSION_3) {
+	if (xdrs->x_op == XDR_DECODE) {
+		objp->pw_max_fail = 0;
+		objp->pw_failcnt_interval = 0;
+		objp->pw_lockout_duration = 0;
+		objp->attributes = 0;
+		objp->max_life = 0;
+		objp->max_renewable_life = 0;
+		objp->allowed_keysalts = NULL;
+		objp->n_tl_data = 0;
+		objp->tl_data = NULL;
+	}
+	if (vers >= KADM5_API_VERSION_3) {
 		if (!xdr_krb5_kvno(xdrs, &objp->pw_max_fail))
 			return (FALSE);
 		if (!xdr_krb5_deltat(xdrs, &objp->pw_failcnt_interval))
 			return (FALSE);
 		if (!xdr_krb5_deltat(xdrs, &objp->pw_lockout_duration))
 			return (FALSE);
-	} else if (xdrs->x_op == XDR_DECODE) {
-		objp->pw_max_fail = 0;
-		objp->pw_failcnt_interval = 0;
-		objp->pw_lockout_duration = 0;
+	}
+	if (vers >= KADM5_API_VERSION_4) {
+		if (!xdr_krb5_flags(xdrs, &objp->attributes)) {
+			return (FALSE);
+		}
+		if (!xdr_krb5_deltat(xdrs, &objp->max_life)) {
+			return (FALSE);
+		}
+		if (!xdr_krb5_deltat(xdrs, &objp->max_renewable_life)) {
+			return (FALSE);
+		}
+		if (!xdr_nullstring(xdrs, &objp->allowed_keysalts)) {
+			return (FALSE);
+		}
+		if (!xdr_krb5_int16(xdrs, &objp->n_tl_data)) {
+			return (FALSE);
+		}
+		if (!xdr_nulltype(xdrs, (void **) &objp->tl_data,
+				  xdr_krb5_tl_data)) {
+			return FALSE;
+		}
 	}
 	return (TRUE);
 }
@@ -510,7 +538,7 @@ _xdr_kadm5_policy_ent_rec(XDR *xdrs, kadm5_policy_ent_rec *objp, int vers)
 bool_t
 xdr_kadm5_policy_ent_rec(XDR *xdrs, kadm5_policy_ent_rec *objp)
 {
-	return _xdr_kadm5_policy_ent_rec(xdrs, objp, KADM5_API_VERSION_3);
+	return _xdr_kadm5_policy_ent_rec(xdrs, objp, KADM5_API_VERSION_4);
 }
 
 bool_t