kuser/klist.c

   1 /*
   2  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kuser_locl.h"
  37 #include "parse_units.h"
  38 #include "heimtools-commands.h"
  39
  40 static char*
  41 printable_time_internal(time_t t, int x)
  42 {
  43     static char s[128];
  44     char *p;
  45
  46     if ((p = ctime(&t)) == NULL)
  47         strlcpy(s, "?", sizeof(s));
  48     else
  49         strlcpy(s, p + 4, sizeof(s));
  50     s[x] = 0;
  51     return s;
  52 }
  53
  54 static char*
  55 printable_time(time_t t)
  56 {
  57     return printable_time_internal(t, 20);
  58 }
  59
  60 static char*
  61 printable_time_long(time_t t)
  62 {
  63     return printable_time_internal(t, 20);
  64 }
  65
  66 #define COL_ISSUED              NP_("  Issued","")
  67 #define COL_EXPIRES             NP_("  Expires", "")
  68 #define COL_FLAGS               NP_("Flags", "")
  69 #define COL_NAME                NP_("  Name", "")
  70 #define COL_PRINCIPAL           NP_("  Principal", "in klist output")
  71 #define COL_PRINCIPAL_KVNO      NP_("  Principal (kvno)", "in klist output")
  72 #define COL_CACHENAME           NP_("  Cache name", "name in klist output")
  73 #define COL_DEFCACHE            NP_("", "")
  74
  75 static void
  76 print_cred(krb5_context context, krb5_creds *cred, rtbl_t ct, int do_flags)
  77 {
  78     char *str;
  79     krb5_error_code ret;
  80     krb5_timestamp sec;
  81
  82     krb5_timeofday (context, &sec);
  83
  84
  85     if(cred->times.starttime)
  86         rtbl_add_column_entry(ct, COL_ISSUED,
  87                               printable_time(cred->times.starttime));
  88     else
  89         rtbl_add_column_entry(ct, COL_ISSUED,
  90                               printable_time(cred->times.authtime));
  91
  92     if(cred->times.endtime > sec)
  93         rtbl_add_column_entry(ct, COL_EXPIRES,
  94                               printable_time(cred->times.endtime));
  95     else
  96         rtbl_add_column_entry(ct, COL_EXPIRES, N_(">>>Expired<<<", ""));
  97     ret = krb5_unparse_name (context, cred->server, &str);
  98     if (ret)
  99         krb5_err(context, 1, ret, "krb5_unparse_name");
 100     rtbl_add_column_entry(ct, COL_PRINCIPAL, str);
 101     if(do_flags) {
 102         char s[16], *sp = s;
 103         if(cred->flags.b.forwardable)
 104             *sp++ = 'F';
 105         if(cred->flags.b.forwarded)
 106             *sp++ = 'f';
 107         if(cred->flags.b.proxiable)
 108             *sp++ = 'P';
 109         if(cred->flags.b.proxy)
 110             *sp++ = 'p';
 111         if(cred->flags.b.may_postdate)
 112             *sp++ = 'D';
 113         if(cred->flags.b.postdated)
 114             *sp++ = 'd';
 115         if(cred->flags.b.renewable)
 116             *sp++ = 'R';
 117         if(cred->flags.b.initial)
 118             *sp++ = 'I';
 119         if(cred->flags.b.invalid)
 120             *sp++ = 'i';
 121         if(cred->flags.b.pre_authent)
 122             *sp++ = 'A';
 123         if(cred->flags.b.hw_authent)
 124             *sp++ = 'H';
 125         *sp = '\0';
 126         rtbl_add_column_entry(ct, COL_FLAGS, s);
 127     }
 128     free(str);
 129 }
 130
 131 static void
 132 print_cred_verbose(krb5_context context, krb5_creds *cred, int do_json)
 133 {
 134     size_t j;
 135     char *str;
 136     krb5_error_code ret;
 137     krb5_timestamp sec;
 138
 139     if (do_json) { /* XXX support more json formating later */
 140         printf("{ \"verbose-supported\" : false }");
 141         return;
 142     }
 143
 144     krb5_timeofday (context, &sec);
 145
 146     ret = krb5_unparse_name(context, cred->server, &str);
 147     if(ret)
 148         exit(1);
 149     printf(N_("Server: %s\n", ""), str);
 150     free (str);
 151
 152     ret = krb5_unparse_name(context, cred->client, &str);
 153     if(ret)
 154         exit(1);
 155     printf(N_("Client: %s\n", ""), str);
 156     free (str);
 157
 158     if (!krb5_is_config_principal(context, cred->client)) {
 159         Ticket t;
 160         size_t len;
 161         char *s;
 162
 163         decode_Ticket(cred->ticket.data, cred->ticket.length, &t, &len);
 164         ret = krb5_enctype_to_string(context, t.enc_part.etype, &s);
 165         printf(N_("Ticket etype: ", ""));
 166         if (ret == 0) {
 167             printf("%s", s);
 168             free(s);
 169         } else {
 170             printf(N_("unknown-enctype(%d)", ""), t.enc_part.etype);
 171         }
 172         if(t.enc_part.kvno)
 173             printf(N_(", kvno %d", ""), *t.enc_part.kvno);
 174         printf("\n");
 175         if(cred->session.keytype != t.enc_part.etype) {
 176             ret = krb5_enctype_to_string(context, cred->session.keytype, &str);
 177             if(ret)
 178                 krb5_warn(context, ret, "session keytype");
 179             else {
 180                 printf(N_("Session key: %s\n", "enctype"), str);
 181                 free(str);
 182             }
 183         }
 184         free_Ticket(&t);
 185         printf(N_("Ticket length: %lu\n", ""),
 186                (unsigned long)cred->ticket.length);
 187     }
 188     printf(N_("Auth time:  %s\n", ""),
 189            printable_time_long(cred->times.authtime));
 190     if(cred->times.authtime != cred->times.starttime)
 191         printf(N_("Start time: %s\n", ""),
 192                printable_time_long(cred->times.starttime));
 193     printf(N_("End time:   %s", ""),
 194            printable_time_long(cred->times.endtime));
 195     if(sec > cred->times.endtime)
 196         printf(N_(" (expired)", ""));
 197     printf("\n");
 198     if(cred->flags.b.renewable)
 199         printf(N_("Renew till: %s\n", ""),
 200                printable_time_long(cred->times.renew_till));
 201     {
 202         char flags[1024];
 203         unparse_flags(TicketFlags2int(cred->flags.b),
 204                       asn1_TicketFlags_units(),
 205                       flags, sizeof(flags));
 206         printf(N_("Ticket flags: %s\n", ""), flags);
 207     }
 208     printf(N_("Addresses: ", ""));
 209     if (cred->addresses.len != 0) {
 210         for(j = 0; j < cred->addresses.len; j++){
 211             char buf[128];
 212             size_t len;
 213             if(j) printf(", ");
 214             ret = krb5_print_address(&cred->addresses.val[j],
 215                                      buf, sizeof(buf), &len);
 216
 217             if(ret == 0)
 218                 printf("%s", buf);
 219         }
 220     } else {
 221         printf(N_("addressless", ""));
 222     }
 223     printf("\n\n");
 224 }
 225
 226 /*
 227  * Print all tickets in `ccache' on stdout, verbosely if do_verbose.
 228  */
 229
 230 static void
 231 print_tickets (krb5_context context,
 232                krb5_ccache ccache,
 233                krb5_principal principal,
 234                int do_verbose,
 235                int do_flags,
 236                int do_hidden,
 237                int do_json)
 238 {
 239     char *str, *name, *fullname;
 240     krb5_error_code ret;
 241     krb5_cc_cursor cursor;
 242     krb5_creds creds;
 243     krb5_deltat sec;
 244
 245     rtbl_t ct = NULL;
 246
 247     ret = krb5_unparse_name (context, principal, &str);
 248     if (ret)
 249         krb5_err (context, 1, ret, "krb5_unparse_name");
 250
 251     ret = krb5_cc_get_full_name(context, ccache, &fullname);
 252     if (ret)
 253         krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 254
 255     if (!do_json) {
 256         printf ("%17s: %s\n", N_("Credentials cache", ""), fullname);
 257         printf ("%17s: %s\n", N_("Principal", ""), str);
 258
 259         ret = krb5_cc_get_friendly_name(context, ccache, &name);
 260         if (ret == 0) {
 261             if (strcmp(name, str) != 0)
 262                 printf ("%17s: %s\n", N_("Friendly name", ""), name);
 263             free(name);
 264         }
 265
 266         if(do_verbose) {
 267             printf ("%17s: %d\n", N_("Cache version", ""),
 268                     krb5_cc_get_version(context, ccache));
 269         } else {
 270             krb5_cc_set_flags(context, ccache, KRB5_TC_NOTICKET);
 271         }
 272
 273         ret = krb5_cc_get_kdc_offset(context, ccache, &sec);
 274
 275         if (ret == 0 && do_verbose && sec != 0) {
 276             char buf[BUFSIZ];
 277             int val;
 278             int sig;
 279
 280             val = (int)sec;
 281             sig = 1;
 282             if (val < 0) {
 283                 sig = -1;
 284                 val = -val;
 285             }
 286
 287             unparse_time (val, buf, sizeof(buf));
 288
 289             printf ("%17s: %s%s\n", N_("KDC time offset", ""),
 290                     sig == -1 ? "-" : "", buf);
 291         }
 292         printf("\n");
 293     } else {
 294         printf ("{ \"cache\" : \"%s\", \"principal\" : \"%s\", ", fullname, str);
 295     }
 296     free(str);
 297
 298     ret = krb5_cc_start_seq_get (context, ccache, &cursor);
 299     if (ret)
 300         krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
 301
 302     if(!do_verbose) {
 303         ct = rtbl_create();
 304         rtbl_add_column(ct, COL_ISSUED, 0);
 305         rtbl_add_column(ct, COL_EXPIRES, 0);
 306         if(do_flags)
 307             rtbl_add_column(ct, COL_FLAGS, 0);
 308         rtbl_add_column(ct, COL_PRINCIPAL, 0);
 309         rtbl_set_separator(ct, "  ");
 310         if (do_json) {
 311             rtbl_set_flags(ct, RTBL_JSON);
 312             printf("\"tickets\" : ");
 313         }
 314     }
 315     if (do_verbose && do_json)
 316         printf("\"tickets\" : [");
 317     while ((ret = krb5_cc_next_cred (context,
 318                                      ccache,
 319                                      &cursor,
 320                                      &creds)) == 0) {
 321         if (!do_hidden && krb5_is_config_principal(context, creds.server)) {
 322             ;
 323         }else if(do_verbose){
 324             print_cred_verbose(context, &creds, do_json);
 325         }else{
 326             print_cred(context, &creds, ct, do_flags);
 327         }
 328         krb5_free_cred_contents (context, &creds);
 329     }
 330     if(ret != KRB5_CC_END)
 331         krb5_err(context, 1, ret, "krb5_cc_get_next");
 332     ret = krb5_cc_end_seq_get (context, ccache, &cursor);
 333     if (ret)
 334         krb5_err (context, 1, ret, "krb5_cc_end_seq_get");
 335     if(!do_verbose) {
 336         rtbl_format(ct, stdout);
 337         rtbl_destroy(ct);
 338     }
 339     if (do_json) {
 340         if (do_verbose)
 341             printf("]");
 342         printf("}");
 343     }
 344 }
 345
 346 /*
 347  * Check if there's a tgt for the realm of `principal' and ccache and
 348  * if so return 0, else 1
 349  */
 350
 351 static int
 352 check_expiration(krb5_context context,
 353                  krb5_ccache ccache,
 354                  time_t *expiration)
 355 {
 356     krb5_error_code ret;
 357     time_t t;
 358
 359     ret = krb5_cc_get_lifetime(context, ccache, &t);
 360     if (ret || t == 0)
 361         return 1;
 362
 363     if (expiration)
 364         *expiration = time(NULL) + t;
 365
 366     return 0;
 367 }
 368
 369 /*
 370  * Print a list of all AFS tokens
 371  */
 372
 373 #ifndef NO_AFS
 374
 375 static void
 376 display_tokens(int do_verbose)
 377 {
 378     uint32_t i;
 379     unsigned char t[4096];
 380     struct ViceIoctl parms;
 381
 382     parms.in = (void *)&i;
 383     parms.in_size = sizeof(i);
 384     parms.out = (void *)t;
 385     parms.out_size = sizeof(t);
 386
 387     for (i = 0;; i++) {
 388         int32_t size_secret_tok, size_public_tok;
 389         unsigned char *cell;
 390         struct ClearToken ct;
 391         unsigned char *r = t;
 392         struct timeval tv;
 393         char buf1[20], buf2[20];
 394
 395         if(k_pioctl(NULL, VIOCGETTOK, &parms, 0) < 0) {
 396             if(errno == EDOM)
 397                 break;
 398             continue;
 399         }
 400         if(parms.out_size > sizeof(t))
 401             continue;
 402         if(parms.out_size < sizeof(size_secret_tok))
 403             continue;
 404         t[min(parms.out_size,sizeof(t)-1)] = 0;
 405         memcpy(&size_secret_tok, r, sizeof(size_secret_tok));
 406         /* dont bother about the secret token */
 407         r += size_secret_tok + sizeof(size_secret_tok);
 408         if (parms.out_size < (r - t) + sizeof(size_public_tok))
 409             continue;
 410         memcpy(&size_public_tok, r, sizeof(size_public_tok));
 411         r += sizeof(size_public_tok);
 412         if (parms.out_size < (r - t) + size_public_tok + sizeof(int32_t))
 413             continue;
 414         memcpy(&ct, r, size_public_tok);
 415         r += size_public_tok;
 416         /* there is a int32_t with length of cellname, but we dont read it */
 417         r += sizeof(int32_t);
 418         cell = r;
 419
 420         gettimeofday (&tv, NULL);
 421         strlcpy (buf1, printable_time(ct.BeginTimestamp),
 422                  sizeof(buf1));
 423         if (do_verbose || tv.tv_sec < ct.EndTimestamp)
 424             strlcpy (buf2, printable_time(ct.EndTimestamp),
 425                      sizeof(buf2));
 426         else
 427             strlcpy (buf2, N_(">>> Expired <<<", ""), sizeof(buf2));
 428
 429         printf("%s  %s  ", buf1, buf2);
 430
 431         if ((ct.EndTimestamp - ct.BeginTimestamp) & 1)
 432             printf(N_("User's (AFS ID %d) tokens for %s", ""), ct.ViceId, cell);
 433         else
 434             printf(N_("Tokens for %s", ""), cell);
 435         if (do_verbose)
 436             printf(" (%d)", ct.AuthHandle);
 437         putchar('\n');
 438     }
 439 }
 440 #endif
 441
 442 /*
 443  * display the ccache in `cred_cache'
 444  */
 445
 446 static int
 447 display_v5_ccache (krb5_context context, krb5_ccache ccache,
 448                    int do_test, int do_verbose,
 449                    int do_flags, int do_hidden,
 450                    int do_json)
 451 {
 452     krb5_error_code ret;
 453     krb5_principal principal;
 454     int exit_status = 0;
 455
 456
 457     ret = krb5_cc_get_principal (context, ccache, &principal);
 458     if (ret) {
 459         if (do_json) {
 460             printf("{}");
 461             return 0;
 462         }
 463         if(ret == ENOENT) {
 464             if (!do_test)
 465                 krb5_warnx(context, N_("No ticket file: %s", ""),
 466                            krb5_cc_get_name(context, ccache));
 467             return 1;
 468         } else
 469             krb5_err (context, 1, ret, "krb5_cc_get_principal");
 470     }
 471     if (do_test)
 472         exit_status = check_expiration(context, ccache, NULL);
 473     else
 474         print_tickets (context, ccache, principal, do_verbose,
 475                        do_flags, do_hidden, do_json);
 476
 477     ret = krb5_cc_close (context, ccache);
 478     if (ret)
 479         krb5_err (context, 1, ret, "krb5_cc_close");
 480
 481     krb5_free_principal (context, principal);
 482
 483     return exit_status;
 484 }
 485
 486 /*
 487  *
 488  */
 489
 490 static int
 491 list_caches(krb5_context context, struct klist_options *opt)
 492 {
 493     krb5_cccol_cursor cursor;
 494     const char *cdef_name;
 495     char *def_name;
 496     krb5_error_code ret;
 497     krb5_ccache id;
 498     rtbl_t ct;
 499
 500     cdef_name = krb5_cc_default_name(context);
 501     if (cdef_name == NULL)
 502         krb5_errx(context, 1, "krb5_cc_default_name");
 503     def_name = strdup(cdef_name);
 504
 505     ret = krb5_cccol_cursor_new(context, &cursor);
 506     if (ret == KRB5_CC_NOSUPP) {
 507         free(def_name);
 508         return 0;
 509     }
 510     else if (ret)
 511         krb5_err (context, 1, ret, "krb5_cc_cache_get_first");
 512
 513     ct = rtbl_create();
 514     rtbl_add_column(ct, COL_DEFCACHE, 0);
 515     rtbl_add_column(ct, COL_NAME, 0);
 516     rtbl_add_column(ct, COL_CACHENAME, 0);
 517     rtbl_add_column(ct, COL_EXPIRES, 0);
 518     rtbl_add_column(ct, COL_DEFCACHE, 0);
 519     rtbl_set_prefix(ct, "   ");
 520     rtbl_set_column_prefix(ct, COL_DEFCACHE, "");
 521     rtbl_set_column_prefix(ct, COL_NAME, " ");
 522     if (opt->json_flag)
 523         rtbl_set_flags(ct, RTBL_JSON);
 524
 525     while (krb5_cccol_cursor_next(context, cursor, &id) == 0) {
 526         int expired = 0;
 527         char *name;
 528         time_t t;
 529
 530         expired = check_expiration(context, id, &t);
 531
 532         ret = krb5_cc_get_friendly_name(context, id, &name);
 533         if (ret == 0) {
 534             const char *str;
 535             char *fname;
 536
 537             rtbl_add_column_entry(ct, COL_NAME, name);
 538             free(name);
 539
 540             if (expired)
 541                 str = N_(">>> Expired <<<", "");
 542             else
 543                 str = printable_time(t);
 544             rtbl_add_column_entry(ct, COL_EXPIRES, str);
 545
 546             ret = krb5_cc_get_full_name(context, id, &fname);
 547             if (ret)
 548                 krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 549
 550             rtbl_add_column_entry(ct, COL_CACHENAME, fname);
 551             if (opt->json_flag)
 552                 ;
 553             else if (strcmp(fname, def_name) == 0)
 554                 rtbl_add_column_entry(ct, COL_DEFCACHE, "*");
 555             else
 556                 rtbl_add_column_entry(ct, COL_DEFCACHE, "");
 557
 558             krb5_xfree(fname);
 559         }
 560         krb5_cc_close(context, id);
 561     }
 562
 563     krb5_cccol_cursor_free(context, &cursor);
 564
 565     free(def_name);
 566     rtbl_format(ct, stdout);
 567     rtbl_destroy(ct);
 568
 569     if (opt->json_flag)
 570         printf("\n");
 571
 572     return 0;
 573 }
 574
 575 /*
 576  *
 577  */
 578
 579 int
 580 klist(struct klist_options *opt, int argc, char **argv)
 581 {
 582     krb5_error_code ret;
 583     int exit_status = 0;
 584
 585     int do_verbose =
 586         opt->verbose_flag ||
 587         opt->a_flag ||
 588         opt->n_flag;
 589     int do_test =
 590         opt->test_flag ||
 591         opt->s_flag;
 592
 593     if(opt->version_flag) {
 594         print_version(NULL);
 595         exit(0);
 596     }
 597
 598     if (opt->list_all_flag) {
 599         exit_status = list_caches(heimtools_context, opt);
 600         return exit_status;
 601     }
 602
 603     if (opt->v5_flag) {
 604         krb5_ccache id;
 605
 606         if (opt->all_content_flag) {
 607             krb5_cc_cache_cursor cursor;
 608             int first = 1;
 609
 610             ret = krb5_cc_cache_get_first(heimtools_context, NULL, &cursor);
 611             if (ret)
 612                 krb5_err(heimtools_context, 1, ret, "krb5_cc_cache_get_first");
 613
 614             if (opt->json_flag)
 615                 printf("[");
 616             while (krb5_cc_cache_next(heimtools_context, cursor, &id) == 0) {
 617                 if (opt->json_flag && !first)
 618                     printf(",");
 619
 620                 exit_status |= display_v5_ccache(heimtools_context, id, do_test,
 621                                                  do_verbose, opt->flags_flag,
 622                                                  opt->hidden_flag, opt->json_flag);
 623                 if (!opt->json_flag)
 624                     printf("\n\n");
 625
 626                 first = 0;
 627             }
 628             krb5_cc_cache_end_seq_get(heimtools_context, cursor);
 629             if (opt->json_flag)
 630                 printf("]");
 631         } else {
 632             if(opt->cache_string) {
 633                 ret = krb5_cc_resolve(heimtools_context, opt->cache_string, &id);
 634                 if (ret)
 635                     krb5_err(heimtools_context, 1, ret, "%s", opt->cache_string);
 636             } else {
 637                 ret = krb5_cc_default(heimtools_context, &id);
 638                 if (ret)
 639                     krb5_err(heimtools_context, 1, ret, "krb5_cc_resolve");
 640             }
 641             exit_status = display_v5_ccache(heimtools_context, id, do_test,
 642                                             do_verbose, opt->flags_flag,
 643                                             opt->hidden_flag, opt->json_flag);
 644         }
 645     }
 646
 647     if (!do_test) {
 648 #ifndef NO_AFS
 649         if (opt->tokens_flag && k_hasafs()) {
 650             if (opt->v5_flag)
 651                 printf("\n");
 652             display_tokens(opt->verbose_flag);
 653         }
 654 #endif
 655     }
 656
 657     return exit_status;
 658 }