kadmin/util.c

   1 /*
   2  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <parse_units.h>
  36
  37 RCSID("$Id$");
  38
  39 /*
  40  * util.c - functions for parsing, unparsing, and editing different
  41  * types of data used in kadmin.
  42  */
  43
  44 static int
  45 get_response(const char *prompt, const char *def, char *buf, size_t len);
  46
  47 /*
  48  * attributes
  49  */
  50
  51 struct units kdb_attrs[] = {
  52     { "allow-digest",           KRB5_KDB_ALLOW_DIGEST },
  53     { "allow-kerberos4",        KRB5_KDB_ALLOW_KERBEROS4 },
  54     { "trusted-for-delegation", KRB5_KDB_TRUSTED_FOR_DELEGATION },
  55     { "ok-as-delegate",         KRB5_KDB_OK_AS_DELEGATE },
  56     { "new-princ",              KRB5_KDB_NEW_PRINC },
  57     { "support-desmd5",         KRB5_KDB_SUPPORT_DESMD5 },
  58     { "pwchange-service",       KRB5_KDB_PWCHANGE_SERVICE },
  59     { "disallow-svr",           KRB5_KDB_DISALLOW_SVR },
  60     { "requires-pw-change",     KRB5_KDB_REQUIRES_PWCHANGE },
  61     { "requires-hw-auth",       KRB5_KDB_REQUIRES_HW_AUTH },
  62     { "requires-pre-auth",      KRB5_KDB_REQUIRES_PRE_AUTH },
  63     { "disallow-all-tix",       KRB5_KDB_DISALLOW_ALL_TIX },
  64     { "disallow-dup-skey",      KRB5_KDB_DISALLOW_DUP_SKEY },
  65     { "disallow-proxiable",     KRB5_KDB_DISALLOW_PROXIABLE },
  66     { "disallow-renewable",     KRB5_KDB_DISALLOW_RENEWABLE },
  67     { "disallow-tgt-based",     KRB5_KDB_DISALLOW_TGT_BASED },
  68     { "disallow-forwardable",   KRB5_KDB_DISALLOW_FORWARDABLE },
  69     { "disallow-postdated",     KRB5_KDB_DISALLOW_POSTDATED },
  70     { NULL }
  71 };
  72
  73 /*
  74  * convert the attributes in `attributes' into a printable string
  75  * in `str, len'
  76  */
  77
  78 void
  79 attributes2str(krb5_flags attributes, char *str, size_t len)
  80 {
  81     unparse_flags (attributes, kdb_attrs, str, len);
  82 }
  83
  84 /*
  85  * convert the string in `str' into attributes in `flags'
  86  * return 0 if parsed ok, else -1.
  87  */
  88
  89 int
  90 str2attributes(const char *str, krb5_flags *flags)
  91 {
  92     int res;
  93
  94     res = parse_flags (str, kdb_attrs, *flags);
  95     if (res < 0)
  96         return res;
  97     else {
  98         *flags = res;
  99         return 0;
 100     }
 101 }
 102
 103 /*
 104  * try to parse the string `resp' into attributes in `attr', also
 105  * setting the `bit' in `mask' if attributes are given and valid.
 106  */
 107
 108 int
 109 parse_attributes (const char *resp, krb5_flags *attr, int *mask, int bit)
 110 {
 111     krb5_flags tmp = *attr;
 112
 113     if (str2attributes(resp, &tmp) == 0) {
 114         *attr = tmp;
 115         if (mask)
 116             *mask |= bit;
 117         return 0;
 118     } else if(*resp == '?') {
 119         print_flags_table (kdb_attrs, stderr);
 120     } else {
 121         fprintf (stderr, "Unable to parse \"%s\"\n", resp);
 122     }
 123     return -1;
 124 }
 125
 126 /*
 127  * allow the user to edit the attributes in `attr', prompting with `prompt'
 128  */
 129
 130 int
 131 edit_attributes (const char *prompt, krb5_flags *attr, int *mask, int bit)
 132 {
 133     char buf[1024], resp[1024];
 134
 135     if (mask && (*mask & bit))
 136         return 0;
 137
 138     attributes2str(*attr, buf, sizeof(buf));
 139     for (;;) {
 140         if(get_response("Attributes", buf, resp, sizeof(resp)) != 0)
 141             return 1;
 142         if (resp[0] == '\0')
 143             break;
 144         if (parse_attributes (resp, attr, mask, bit) == 0)
 145             break;
 146     }
 147     return 0;
 148 }
 149
 150 /*
 151  * time_t
 152  * the special value 0 means ``never''
 153  */
 154
 155 /*
 156  * Convert the time `t' to a string representation in `str' (of max
 157  * size `len').  If include_time also include time, otherwise just
 158  * date.
 159  */
 160
 161 void
 162 time_t2str(time_t t, char *str, size_t len, int include_time)
 163 {
 164     if(t) {
 165         if(include_time)
 166             strftime(str, len, "%Y-%m-%d %H:%M:%S UTC", gmtime(&t));
 167         else
 168             strftime(str, len, "%Y-%m-%d", gmtime(&t));
 169     } else
 170         snprintf(str, len, "never");
 171 }
 172
 173 /*
 174  * Convert the time representation in `str' to a time in `time'.
 175  * Return 0 if succesful, else -1.
 176  */
 177
 178 int
 179 str2time_t (const char *str, time_t *t)
 180 {
 181     const char *p;
 182     struct tm tm, tm2;
 183
 184     memset (&tm, 0, sizeof (tm));
 185     memset (&tm2, 0, sizeof (tm2));
 186
 187     if(strcasecmp(str, "never") == 0) {
 188         *t = 0;
 189         return 0;
 190     }
 191
 192     if(strcasecmp(str, "now") == 0) {
 193         *t = time(NULL);
 194         return 0;
 195     }
 196
 197     p = strptime (str, "%Y-%m-%d", &tm);
 198
 199     if (p == NULL)
 200         return -1;
 201
 202     while(isspace((unsigned char)*p))
 203         p++;
 204
 205     /* XXX this is really a bit optimistic, we should really complain
 206        if there was a problem parsing the time */
 207     if(p[0] != '\0' && strptime (p, "%H:%M:%S", &tm2) != NULL) {
 208         tm.tm_hour = tm2.tm_hour;
 209         tm.tm_min  = tm2.tm_min;
 210         tm.tm_sec  = tm2.tm_sec;
 211     } else {
 212         /* Do it on the end of the day */
 213         tm.tm_hour = 23;
 214         tm.tm_min  = 59;
 215         tm.tm_sec  = 59;
 216     }
 217
 218     *t = tm2time (tm, 0);
 219     return 0;
 220 }
 221
 222 /*
 223  * try to parse the time in `resp' storing it in `value'
 224  */
 225
 226 int
 227 parse_timet (const char *resp, krb5_timestamp *value, int *mask, int bit)
 228 {
 229     time_t tmp;
 230
 231     if (str2time_t(resp, &tmp) == 0) {
 232         *value = tmp;
 233         if(mask)
 234             *mask |= bit;
 235         return 0;
 236     }
 237     if(*resp != '?')
 238         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 239     fprintf (stderr, "Print date on format YYYY-mm-dd [hh:mm:ss]\n");
 240     return -1;
 241 }
 242
 243 /*
 244  * allow the user to edit the time in `value'
 245  */
 246
 247 int
 248 edit_timet (const char *prompt, krb5_timestamp *value, int *mask, int bit)
 249 {
 250     char buf[1024], resp[1024];
 251
 252     if (mask && (*mask & bit))
 253         return 0;
 254
 255     time_t2str (*value, buf, sizeof (buf), 0);
 256
 257     for (;;) {
 258         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 259             return 1;
 260         if (parse_timet (resp, value, mask, bit) == 0)
 261             break;
 262     }
 263     return 0;
 264 }
 265
 266 /*
 267  * deltat
 268  * the special value 0 means ``unlimited''
 269  */
 270
 271 /*
 272  * convert the delta_t value in `t' into a printable form in `str, len'
 273  */
 274
 275 void
 276 deltat2str(unsigned t, char *str, size_t len)
 277 {
 278     if(t == 0 || t == INT_MAX)
 279         snprintf(str, len, "unlimited");
 280     else
 281         unparse_time(t, str, len);
 282 }
 283
 284 /*
 285  * parse the delta value in `str', storing result in `*delta'
 286  * return 0 if ok, else -1
 287  */
 288
 289 int
 290 str2deltat(const char *str, krb5_deltat *delta)
 291 {
 292     int res;
 293
 294     if(strcasecmp(str, "unlimited") == 0) {
 295         *delta = 0;
 296         return 0;
 297     }
 298     res = parse_time(str, "day");
 299     if (res < 0)
 300         return res;
 301     else {
 302         *delta = res;
 303         return 0;
 304     }
 305 }
 306
 307 /*
 308  * try to parse the string in `resp' into a deltad in `value'
 309  * `mask' will get the bit `bit' set if a value was given.
 310  */
 311
 312 int
 313 parse_deltat (const char *resp, krb5_deltat *value, int *mask, int bit)
 314 {
 315     krb5_deltat tmp;
 316
 317     if (str2deltat(resp, &tmp) == 0) {
 318         *value = tmp;
 319         if (mask)
 320             *mask |= bit;
 321         return 0;
 322     } else if(*resp == '?') {
 323         print_time_table (stderr);
 324     } else {
 325         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 326     }
 327     return -1;
 328 }
 329
 330 /*
 331  * allow the user to edit the deltat in `value'
 332  */
 333
 334 int
 335 edit_deltat (const char *prompt, krb5_deltat *value, int *mask, int bit)
 336 {
 337     char buf[1024], resp[1024];
 338
 339     if (mask && (*mask & bit))
 340         return 0;
 341
 342     deltat2str(*value, buf, sizeof(buf));
 343     for (;;) {
 344         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 345             return 1;
 346         if (parse_deltat (resp, value, mask, bit) == 0)
 347             break;
 348     }
 349     return 0;
 350 }
 351
 352 /*
 353  * allow the user to edit `ent'
 354  */
 355
 356 void
 357 set_defaults(kadm5_principal_ent_t ent, int *mask,
 358              kadm5_principal_ent_t default_ent, int default_mask)
 359 {
 360     if (default_ent
 361         && (default_mask & KADM5_MAX_LIFE)
 362         && !(*mask & KADM5_MAX_LIFE))
 363         ent->max_life = default_ent->max_life;
 364
 365     if (default_ent
 366         && (default_mask & KADM5_MAX_RLIFE)
 367         && !(*mask & KADM5_MAX_RLIFE))
 368         ent->max_renewable_life = default_ent->max_renewable_life;
 369
 370     if (default_ent
 371         && (default_mask & KADM5_PRINC_EXPIRE_TIME)
 372         && !(*mask & KADM5_PRINC_EXPIRE_TIME))
 373         ent->princ_expire_time = default_ent->princ_expire_time;
 374
 375     if (default_ent
 376         && (default_mask & KADM5_PW_EXPIRATION)
 377         && !(*mask & KADM5_PW_EXPIRATION))
 378         ent->pw_expiration = default_ent->pw_expiration;
 379
 380     if (default_ent
 381         && (default_mask & KADM5_ATTRIBUTES)
 382         && !(*mask & KADM5_ATTRIBUTES))
 383         ent->attributes = default_ent->attributes & ~KRB5_KDB_DISALLOW_ALL_TIX;
 384 }
 385
 386 int
 387 edit_entry(kadm5_principal_ent_t ent, int *mask,
 388            kadm5_principal_ent_t default_ent, int default_mask)
 389 {
 390
 391     set_defaults(ent, mask, default_ent, default_mask);
 392
 393     if(edit_deltat ("Max ticket life", &ent->max_life, mask,
 394                     KADM5_MAX_LIFE) != 0)
 395         return 1;
 396
 397     if(edit_deltat ("Max renewable life", &ent->max_renewable_life, mask,
 398                     KADM5_MAX_RLIFE) != 0)
 399         return 1;
 400
 401     if(edit_timet ("Principal expiration time", &ent->princ_expire_time, mask,
 402                    KADM5_PRINC_EXPIRE_TIME) != 0)
 403         return 1;
 404
 405     if(edit_timet ("Password expiration time", &ent->pw_expiration, mask,
 406                    KADM5_PW_EXPIRATION) != 0)
 407         return 1;
 408
 409     if(edit_attributes ("Attributes", &ent->attributes, mask,
 410                         KADM5_ATTRIBUTES) != 0)
 411         return 1;
 412
 413     return 0;
 414 }
 415
 416 /*
 417  * Parse the arguments, set the fields in `ent' and the `mask' for the
 418  * entries having been set.
 419  * Return 1 on failure and 0 on success.
 420  */
 421
 422 int
 423 set_entry(krb5_context context,
 424           kadm5_principal_ent_t ent,
 425           int *mask,
 426           const char *max_ticket_life,
 427           const char *max_renewable_life,
 428           const char *expiration,
 429           const char *pw_expiration,
 430           const char *attributes)
 431 {
 432     if (max_ticket_life != NULL) {
 433         if (parse_deltat (max_ticket_life, &ent->max_life,
 434                           mask, KADM5_MAX_LIFE)) {
 435             krb5_warnx (context, "unable to parse `%s'", max_ticket_life);
 436             return 1;
 437         }
 438     }
 439     if (max_renewable_life != NULL) {
 440         if (parse_deltat (max_renewable_life, &ent->max_renewable_life,
 441                           mask, KADM5_MAX_RLIFE)) {
 442             krb5_warnx (context, "unable to parse `%s'", max_renewable_life);
 443             return 1;
 444         }
 445     }
 446
 447     if (expiration) {
 448         if (parse_timet (expiration, &ent->princ_expire_time,
 449                         mask, KADM5_PRINC_EXPIRE_TIME)) {
 450             krb5_warnx (context, "unable to parse `%s'", expiration);
 451             return 1;
 452         }
 453     }
 454     if (pw_expiration) {
 455         if (parse_timet (pw_expiration, &ent->pw_expiration,
 456                          mask, KADM5_PW_EXPIRATION)) {
 457             krb5_warnx (context, "unable to parse `%s'", pw_expiration);
 458             return 1;
 459         }
 460     }
 461     if (attributes != NULL) {
 462         if (parse_attributes (attributes, &ent->attributes,
 463                               mask, KADM5_ATTRIBUTES)) {
 464             krb5_warnx (context, "unable to parse `%s'", attributes);
 465             return 1;
 466         }
 467     }
 468     return 0;
 469 }
 470
 471 /*
 472  * Does `string' contain any globing characters?
 473  */
 474
 475 static int
 476 is_expression(const char *string)
 477 {
 478     const char *p;
 479     int quote = 0;
 480
 481     for(p = string; *p; p++) {
 482         if(quote) {
 483             quote = 0;
 484             continue;
 485         }
 486         if(*p == '\\')
 487             quote++;
 488         else if(strchr("[]*?", *p) != NULL)
 489             return 1;
 490     }
 491     return 0;
 492 }
 493
 494 /*
 495  * Loop over all principals matching exp.  If any of calls to `func'
 496  * failes, the first error is returned when all principals are
 497  * processed.
 498  */
 499 int
 500 foreach_principal(const char *exp_str,
 501                   int (*func)(krb5_principal, void*),
 502                   const char *funcname,
 503                   void *data)
 504 {
 505     char **princs;
 506     int num_princs;
 507     int i;
 508     krb5_error_code saved_ret = 0, ret = 0;
 509     krb5_principal princ_ent;
 510     int is_expr;
 511
 512     /* if this isn't an expression, there is no point in wading
 513        through the whole database looking for matches */
 514     is_expr = is_expression(exp_str);
 515     if(is_expr)
 516         ret = kadm5_get_principals(kadm_handle, exp_str, &princs, &num_princs);
 517     if(!is_expr || ret == KADM5_AUTH_LIST) {
 518         /* we might be able to perform the requested opreration even
 519            if we're not allowed to list principals */
 520         num_princs = 1;
 521         princs = malloc(sizeof(*princs));
 522         if(princs == NULL)
 523             return ENOMEM;
 524         princs[0] = strdup(exp_str);
 525         if(princs[0] == NULL){
 526             free(princs);
 527             return ENOMEM;
 528         }
 529     } else if(ret) {
 530         krb5_warn(context, ret, "kadm5_get_principals");
 531         return ret;
 532     }
 533     for(i = 0; i < num_princs; i++) {
 534         ret = krb5_parse_name(context, princs[i], &princ_ent);
 535         if(ret){
 536             krb5_warn(context, ret, "krb5_parse_name(%s)", princs[i]);
 537             continue;
 538         }
 539         ret = (*func)(princ_ent, data);
 540         if(ret) {
 541             krb5_clear_error_string(context);
 542             krb5_warn(context, ret, "%s %s", funcname, princs[i]);
 543             if (saved_ret == 0)
 544                 saved_ret = ret;
 545         }
 546         krb5_free_principal(context, princ_ent);
 547     }
 548     if (ret == 0 && saved_ret != 0)
 549         ret = saved_ret;
 550     kadm5_free_name_list(kadm_handle, princs, &num_princs);
 551     return ret;
 552 }
 553
 554 /*
 555  * prompt with `prompt' and default value `def', and store the reply
 556  * in `buf, len'
 557  */
 558
 559 #include <setjmp.h>
 560
 561 static jmp_buf jmpbuf;
 562
 563 static void
 564 interrupt(int sig)
 565 {
 566     longjmp(jmpbuf, 1);
 567 }
 568
 569 static int
 570 get_response(const char *prompt, const char *def, char *buf, size_t len)
 571 {
 572     char *p;
 573     void (*osig)(int);
 574
 575     osig = signal(SIGINT, interrupt);
 576     if(setjmp(jmpbuf)) {
 577         signal(SIGINT, osig);
 578         fprintf(stderr, "\n");
 579         return 1;
 580     }
 581
 582     fprintf(stderr, "%s [%s]:", prompt, def);
 583     if(fgets(buf, len, stdin) == NULL) {
 584         int save_errno = errno;
 585         if(ferror(stdin))
 586             krb5_err(context, 1, save_errno, "<stdin>");
 587         signal(SIGINT, osig);
 588         return 1;
 589     }
 590     p = strchr(buf, '\n');
 591     if(p)
 592         *p = '\0';
 593     if(strcmp(buf, "") == 0)
 594         strlcpy(buf, def, len);
 595     signal(SIGINT, osig);
 596     return 0;
 597 }
 598
 599 /*
 600  * return [0, 16) or -1
 601  */
 602
 603 static int
 604 hex2n (char c)
 605 {
 606     static char hexdigits[] = "0123456789abcdef";
 607     const char *p;
 608
 609     p = strchr (hexdigits, tolower((unsigned char)c));
 610     if (p == NULL)
 611         return -1;
 612     else
 613         return p - hexdigits;
 614 }
 615
 616 /*
 617  * convert a key in a readable format into a keyblock.
 618  * return 0 iff succesful, otherwise `err' should point to an error message
 619  */
 620
 621 int
 622 parse_des_key (const char *key_string, krb5_key_data *key_data,
 623                const char **error)
 624 {
 625     const char *p = key_string;
 626     unsigned char bits[8];
 627     int i;
 628
 629     if (strlen (key_string) != 16) {
 630         *error = "bad length, should be 16 for DES key";
 631         return 1;
 632     }
 633     for (i = 0; i < 8; ++i) {
 634         int d1, d2;
 635
 636         d1 = hex2n(p[2 * i]);
 637         d2 = hex2n(p[2 * i + 1]);
 638         if (d1 < 0 || d2 < 0) {
 639             *error = "non-hex character";
 640             return 1;
 641         }
 642         bits[i] = (d1 << 4) | d2;
 643     }
 644     for (i = 0; i < 3; ++i) {
 645         key_data[i].key_data_ver  = 2;
 646         key_data[i].key_data_kvno = 0;
 647         /* key */
 648         key_data[i].key_data_type[0]     = ETYPE_DES_CBC_CRC;
 649         key_data[i].key_data_length[0]   = 8;
 650         key_data[i].key_data_contents[0] = malloc(8);
 651         if (key_data[i].key_data_contents[0] == NULL) {
 652             *error = "malloc";
 653             return ENOMEM;
 654         }
 655         memcpy (key_data[i].key_data_contents[0], bits, 8);
 656         /* salt */
 657         key_data[i].key_data_type[1]     = KRB5_PW_SALT;
 658         key_data[i].key_data_length[1]   = 0;
 659         key_data[i].key_data_contents[1] = NULL;
 660     }
 661     key_data[0].key_data_type[0] = ETYPE_DES_CBC_MD5;
 662     key_data[1].key_data_type[0] = ETYPE_DES_CBC_MD4;
 663     return 0;
 664 }