2 * Copyright (c) 2000 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 can have any number of princ stanzas.
40 format is as follows (only \n indicates newlines)
41 princ\t%d\t (%d is KRB5_KDB_V1_BASE_LENGTH, always 38)
42 %d\t (strlen of principal e.g. shadow/foo@ANDREW.CMU.EDU)
43 %d\t (number of tl_data)
44 %d\t (number of key data, e.g. how many keys for this user)
45 %d\t (extra data length)
48 %d\t (max lifetime, seconds)
49 %d\t (max renewable life, seconds)
50 %d\t (expiration, seconds since epoch or 2145830400 for never)
51 %d\t (password expiration, seconds, 0 for never)
52 %d\t (last successful auth, seconds since epoch)
53 %d\t (last failed auth, per above)
54 %d\t (failed auth count)
55 foreach tl_data 0 to number of tl_data - 1 as above
56 %d\t%d\t (data type, data length)
57 foreach tl_data 0 to length-1
58 %02x (tl data contents[element n])
59 except if tl_data length is 0
62 foreach key 0 to number of keys - 1 as above
63 %d\t%d\t (key data version, kvno)
64 foreach version 0 to key data version - 1 (a key or a salt)
65 %d\t%d\t(data type for this key, data length for this key)
66 foreach key data length 0 to length-1
67 %02x (key data contents[element n])
68 except if key_data length is 0
71 foreach extra data length 0 to length - 1
72 %02x (extra data part)
80 hex_to_octet_string(const char *ptr
, krb5_data
*data
)
84 for(i
= 0; i
< data
->length
; i
++) {
85 if(sscanf(ptr
+ 2 * i
, "%02x", &v
) != 1)
87 ((unsigned char*)data
->data
)[i
] = v
;
98 } while(q
&& *q
== '\0');
103 getdata(char **p
, unsigned char *buf
, size_t len
)
107 char *q
= nexttoken(p
);
109 while(*q
&& i
< len
) {
110 if(sscanf(q
, "%02x", &v
) != 1)
122 char *q
= nexttoken(p
);
123 sscanf(q
, "%d", &val
);
127 #include <kadm5/admin.h>
130 attr_to_flags(unsigned attr
, HDBFlags
*flags
)
132 flags
->postdate
= !(attr
& KRB5_KDB_DISALLOW_POSTDATED
);
133 flags
->forwardable
= !(attr
& KRB5_KDB_DISALLOW_FORWARDABLE
);
134 flags
->initial
= !!(attr
& KRB5_KDB_DISALLOW_TGT_BASED
);
135 flags
->renewable
= !(attr
& KRB5_KDB_DISALLOW_RENEWABLE
);
136 flags
->proxiable
= !(attr
& KRB5_KDB_DISALLOW_PROXIABLE
);
138 flags
->invalid
= !!(attr
& KRB5_KDB_DISALLOW_ALL_TIX
);
139 flags
->require_preauth
= !!(attr
& KRB5_KDB_REQUIRES_PRE_AUTH
);
140 flags
->require_hwauth
= !!(attr
& KRB5_KDB_REQUIRES_HW_AUTH
);
141 flags
->server
= !(attr
& KRB5_KDB_DISALLOW_SVR
);
142 flags
->change_pw
= !!(attr
& KRB5_KDB_PWCHANGE_SERVICE
);
143 flags
->client
= 1; /* XXX */
146 #define KRB5_KDB_SALTTYPE_NORMAL 0
147 #define KRB5_KDB_SALTTYPE_V4 1
148 #define KRB5_KDB_SALTTYPE_NOREALM 2
149 #define KRB5_KDB_SALTTYPE_ONLYREALM 3
150 #define KRB5_KDB_SALTTYPE_SPECIAL 4
151 #define KRB5_KDB_SALTTYPE_AFS3 5
153 static krb5_error_code
154 fix_salt(krb5_context context
, hdb_entry
*ent
, int key_num
)
157 Salt
*salt
= ent
->keys
.val
[key_num
].salt
;
159 switch((int)salt
->type
) {
160 case KRB5_KDB_SALTTYPE_NORMAL
:
161 salt
->type
= KRB5_PADATA_PW_SALT
;
163 case KRB5_KDB_SALTTYPE_V4
:
164 krb5_data_free(&salt
->salt
);
165 salt
->type
= KRB5_PADATA_PW_SALT
;
167 case KRB5_KDB_SALTTYPE_NOREALM
:
174 for (i
= 0; i
< ent
->principal
->name
.name_string
.len
; ++i
)
175 len
+= strlen(ent
->principal
->name
.name_string
.val
[i
]);
176 ret
= krb5_data_alloc (&salt
->salt
, len
);
180 for (i
= 0; i
< ent
->principal
->name
.name_string
.len
; ++i
) {
182 ent
->principal
->name
.name_string
.val
[i
],
183 strlen(ent
->principal
->name
.name_string
.val
[i
]));
184 p
+= strlen(ent
->principal
->name
.name_string
.val
[i
]);
187 salt
->type
= KRB5_PADATA_PW_SALT
;
190 case KRB5_KDB_SALTTYPE_ONLYREALM
:
191 krb5_data_free(&salt
->salt
);
192 ret
= krb5_data_copy(&salt
->salt
,
193 ent
->principal
->realm
,
194 strlen(ent
->principal
->realm
));
197 salt
->type
= KRB5_PADATA_PW_SALT
;
199 case KRB5_KDB_SALTTYPE_SPECIAL
:
200 salt
->type
= KRB5_PADATA_PW_SALT
;
202 case KRB5_KDB_SALTTYPE_AFS3
:
203 krb5_data_free(&salt
->salt
);
204 ret
= krb5_data_copy(&salt
->salt
,
205 ent
->principal
->realm
,
206 strlen(ent
->principal
->realm
));
209 salt
->type
= KRB5_PADATA_AFS3_SALT
;
218 mit_prop_dump(void *arg
, const char *file
)
224 struct hdb_entry_ex ent
;
226 struct prop_data
*pd
= arg
;
228 f
= fopen(file
, "r");
232 while(fgets(line
, sizeof(line
), f
)) {
245 memset(&ent
, 0, sizeof(ent
));
248 if(strcmp(q
, "kdb5_util") == 0) {
250 q
= nexttoken(&p
); /* load_dump */
251 if(strcmp(q
, "load_dump"))
252 errx(1, "line %d: unknown version", lineno
);
253 q
= nexttoken(&p
); /* load_dump */
254 if(strcmp(q
, "version"))
255 errx(1, "line %d: unknown version", lineno
);
256 q
= nexttoken(&p
); /* x.0 */
257 if(sscanf(q
, "%d", &major
) != 1)
258 errx(1, "line %d: unknown version", lineno
);
259 if(major
!= 4 && major
!= 5 && major
!= 6)
260 errx(1, "unknown dump file format, got %d, expected 4-6",
263 } else if(strcmp(q
, "policy") == 0) {
265 } else if(strcmp(q
, "princ") != 0) {
266 warnx("line %d: not a principal", lineno
);
271 warnx("line %d: bad base length %d != 38", lineno
, tmp
);
274 nexttoken(&p
); /* length of principal */
275 num_tl_data
= getint(&p
); /* number of tl-data */
276 num_key_data
= getint(&p
); /* number of key-data */
277 getint(&p
); /* length of extra data */
278 q
= nexttoken(&p
); /* principal name */
279 krb5_parse_name(pd
->context
, q
, &ent
.entry
.principal
);
280 attributes
= getint(&p
); /* attributes */
281 attr_to_flags(attributes
, &ent
.entry
.flags
);
282 tmp
= getint(&p
); /* max life */
284 ALLOC(ent
.entry
.max_life
);
285 *ent
.entry
.max_life
= tmp
;
287 tmp
= getint(&p
); /* max renewable life */
289 ALLOC(ent
.entry
.max_renew
);
290 *ent
.entry
.max_renew
= tmp
;
292 tmp
= getint(&p
); /* expiration */
293 if(tmp
!= 0 && tmp
!= 2145830400) {
294 ALLOC(ent
.entry
.valid_end
);
295 *ent
.entry
.valid_end
= tmp
;
297 tmp
= getint(&p
); /* pw expiration */
299 ALLOC(ent
.entry
.pw_end
);
300 *ent
.entry
.pw_end
= tmp
;
302 nexttoken(&p
); /* last auth */
303 nexttoken(&p
); /* last failed auth */
304 nexttoken(&p
); /* fail auth count */
305 for(i
= 0; i
< num_tl_data
; i
++) {
307 int tl_type
, tl_length
;
309 krb5_principal princ
;
311 tl_type
= getint(&p
); /* data type */
312 tl_length
= getint(&p
); /* data length */
314 #define mit_KRB5_TL_LAST_PWD_CHANGE 1
315 #define mit_KRB5_TL_MOD_PRINC 2
317 case mit_KRB5_TL_LAST_PWD_CHANGE
:
318 buf
= malloc(tl_length
);
320 errx(ENOMEM
, "malloc");
321 getdata(&p
, buf
, tl_length
); /* data itself */
322 val
= buf
[0] | (buf
[1] << 8) | (buf
[2] << 16) | (buf
[3] << 24);
324 ALLOC(ent
.entry
.extensions
);
325 ALLOC_SEQ(ent
.entry
.extensions
, 1);
326 ent
.entry
.extensions
->val
[0].mandatory
= 0;
327 ent
.entry
.extensions
->val
[0].data
.element
328 = choice_HDB_extension_data_last_pw_change
;
329 ent
.entry
.extensions
->val
[0].data
.u
.last_pw_change
= val
;
331 case mit_KRB5_TL_MOD_PRINC
:
332 buf
= malloc(tl_length
);
334 errx(ENOMEM
, "malloc");
335 getdata(&p
, buf
, tl_length
); /* data itself */
336 val
= buf
[0] | (buf
[1] << 8) | (buf
[2] << 16) | (buf
[3] << 24);
337 ret
= krb5_parse_name(pd
->context
, (char *)buf
+ 4, &princ
);
339 krb5_err(pd
->context
, 1, ret
,
340 "parse_name: %s", (char *)buf
+ 4);
342 ALLOC(ent
.entry
.modified_by
);
343 ent
.entry
.modified_by
->time
= val
;
344 ent
.entry
.modified_by
->principal
= princ
;
351 ALLOC_SEQ(&ent
.entry
.keys
, num_key_data
);
352 for(i
= 0; i
< num_key_data
; i
++) {
354 key_versions
= getint(&p
); /* key data version */
355 ent
.entry
.kvno
= getint(&p
); /* XXX kvno */
357 ALLOC(ent
.entry
.keys
.val
[i
].mkvno
);
358 *ent
.entry
.keys
.val
[i
].mkvno
= 1;
360 /* key version 0 -- actual key */
361 ent
.entry
.keys
.val
[i
].key
.keytype
= getint(&p
); /* key type */
362 tmp
= getint(&p
); /* key length */
363 /* the first two bytes of the key is the key length --
365 krb5_data_alloc(&ent
.entry
.keys
.val
[i
].key
.keyvalue
, tmp
- 2);
366 q
= nexttoken(&p
); /* key itself */
367 hex_to_octet_string(q
+ 4, &ent
.entry
.keys
.val
[i
].key
.keyvalue
);
369 if(key_versions
> 1) {
370 /* key version 1 -- optional salt */
371 ALLOC(ent
.entry
.keys
.val
[i
].salt
);
372 ent
.entry
.keys
.val
[i
].salt
->type
= getint(&p
); /* salt type */
373 tmp
= getint(&p
); /* salt length */
375 krb5_data_alloc(&ent
.entry
.keys
.val
[i
].salt
->salt
, tmp
- 2);
376 q
= nexttoken(&p
); /* salt itself */
377 hex_to_octet_string(q
+ 4,
378 &ent
.entry
.keys
.val
[i
].salt
->salt
);
380 ent
.entry
.keys
.val
[i
].salt
->salt
.length
= 0;
381 ent
.entry
.keys
.val
[i
].salt
->salt
.data
= NULL
;
382 getint(&p
); /* -1, if no data. */
384 fix_salt(pd
->context
, &ent
.entry
, i
);
387 nexttoken(&p
); /* extra data */
388 v5_prop(pd
->context
, NULL
, &ent
, arg
);