2 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadmin_locl.h"
35 #include "kadmin-commands.h"
36 #include <parse_units.h>
39 static struct field_name
{
40 const char *fieldname
;
41 unsigned int fieldvalue
;
42 unsigned int subvalue
;
44 const char *default_header
;
45 const char *def_longheader
;
48 { "principal", KADM5_PRINCIPAL
, 0, 0, "Principal", "Principal", 0 },
49 { "princ_expire_time", KADM5_PRINC_EXPIRE_TIME
, 0, 0, "Expiration", "Principal expires", 0 },
50 { "pw_expiration", KADM5_PW_EXPIRATION
, 0, 0, "PW-exp", "Password expires", 0 },
51 { "last_pwd_change", KADM5_LAST_PWD_CHANGE
, 0, 0, "PW-change", "Last password change", 0 },
52 { "max_life", KADM5_MAX_LIFE
, 0, 0, "Max life", "Max ticket life", 0 },
53 { "max_rlife", KADM5_MAX_RLIFE
, 0, 0, "Max renew", "Max renewable life", 0 },
54 { "mod_time", KADM5_MOD_TIME
, 0, 0, "Mod time", "Last modified", 0 },
55 { "mod_name", KADM5_MOD_NAME
, 0, 0, "Modifier", "Modifier", 0 },
56 { "attributes", KADM5_ATTRIBUTES
, 0, 0, "Attributes", "Attributes", 0 },
57 { "kvno", KADM5_KVNO
, 0, 0, "Kvno", "Kvno", RTBL_ALIGN_RIGHT
},
58 { "mkvno", KADM5_MKVNO
, 0, 0, "Mkvno", "Mkvno", RTBL_ALIGN_RIGHT
},
59 { "last_success", KADM5_LAST_SUCCESS
, 0, 0, "Last login", "Last successful login", 0 },
60 { "last_failed", KADM5_LAST_FAILED
, 0, 0, "Last fail", "Last failed login", 0 },
61 { "fail_auth_count", KADM5_FAIL_AUTH_COUNT
, 0, 0, "Fail count", "Failed login count", RTBL_ALIGN_RIGHT
},
62 { "policy", KADM5_POLICY
, 0, 0, "Policy", "Policy", 0 },
63 { "keytypes", KADM5_KEY_DATA
, 0, KADM5_PRINCIPAL
| KADM5_KVNO
, "Keytypes", "Keytypes", 0 },
64 { "password", KADM5_TL_DATA
, KRB5_TL_PASSWORD
, KADM5_KEY_DATA
, "Password", "Password", 0 },
65 { "pkinit-acl", KADM5_TL_DATA
, KRB5_TL_PKINIT_ACL
, 0, "PK-INIT ACL", "PK-INIT ACL", 0 },
66 { "aliases", KADM5_TL_DATA
, KRB5_TL_ALIASES
, 0, "Aliases", "Aliases", 0 },
67 { "hist-kvno-diff-clnt", KADM5_TL_DATA
, KRB5_TL_HIST_KVNO_DIFF_CLNT
, 0, "Clnt hist keys", "Historic keys allowed for client", 0 },
68 { "hist-kvno-diff-svc", KADM5_TL_DATA
, KRB5_TL_HIST_KVNO_DIFF_SVC
, 0, "Svc hist keys", "Historic keys allowed for service", 0 },
69 { NULL
, 0, 0, 0, NULL
, NULL
, 0 }
73 struct field_name
*ff
;
75 struct field_info
*next
;
78 struct get_entry_data
{
79 void (*format
)(struct get_entry_data
*, kadm5_principal_ent_t
);
83 struct field_info
*chead
, **ctail
;
87 add_column(struct get_entry_data
*data
, struct field_name
*ff
, const char *header
)
89 struct field_info
*f
= malloc(sizeof(*f
));
94 f
->header
= strdup(header
);
99 data
->ctail
= &f
->next
;
100 data
->mask
|= ff
->fieldvalue
;
101 data
->extra_mask
|= ff
->extra_mask
;
102 if(data
->table
!= NULL
)
103 rtbl_add_column_by_id(data
->table
, ff
->fieldvalue
,
104 header
? header
: ff
->default_header
, ff
->flags
);
109 * return 0 iff `salt' actually is the same as the current salt in `k'
113 cmp_salt (const krb5_salt
*salt
, const krb5_key_data
*k
)
115 if (salt
->salttype
!= (size_t)k
->key_data_type
[1])
117 if (salt
->saltvalue
.length
!= (size_t)k
->key_data_length
[1])
119 return memcmp (salt
->saltvalue
.data
, k
->key_data_contents
[1],
120 salt
->saltvalue
.length
);
124 format_keytype(krb5_key_data
*k
, krb5_salt
*def_salt
, char *buf
, size_t buf_len
)
131 ret
= krb5_enctype_to_string (context
,
135 aret
= asprintf (&s
, "unknown(%d)", k
->key_data_type
[0]);
137 return; /* Nothing to do here, we have no way to pass the err */
139 strlcpy(buf
, s
, buf_len
);
142 strlcat(buf
, "(", buf_len
);
144 ret
= krb5_salttype_to_string (context
,
149 aret
= asprintf (&s
, "unknown(%d)", k
->key_data_type
[1]);
151 return; /* Again, nothing else to do... */
153 strlcat(buf
, s
, buf_len
);
157 if (cmp_salt(def_salt
, k
) == 0)
159 else if(k
->key_data_length
[1] == 0)
162 aret
= asprintf (&s
, "(%.*s)", k
->key_data_length
[1],
163 (char *)k
->key_data_contents
[1]);
164 if (aret
== -1 || s
== NULL
)
165 return; /* Again, nothing else we can do... */
166 strlcat(buf
, s
, buf_len
);
168 aret
= asprintf (&s
, "[%d]", k
->key_data_kvno
);
171 strlcat(buf
, ")", buf_len
);
173 strlcat(buf
, s
, buf_len
);
178 format_field(kadm5_principal_ent_t princ
, unsigned int field
,
179 unsigned int subfield
, char *buf
, size_t buf_len
, int condensed
)
182 case KADM5_PRINCIPAL
:
184 krb5_unparse_name_fixed_short(context
, princ
->principal
, buf
, buf_len
);
186 krb5_unparse_name_fixed(context
, princ
->principal
, buf
, buf_len
);
189 case KADM5_PRINC_EXPIRE_TIME
:
190 time_t2str(princ
->princ_expire_time
, buf
, buf_len
, !condensed
);
193 case KADM5_PW_EXPIRATION
:
194 time_t2str(princ
->pw_expiration
, buf
, buf_len
, !condensed
);
197 case KADM5_LAST_PWD_CHANGE
:
198 time_t2str(princ
->last_pwd_change
, buf
, buf_len
, !condensed
);
202 deltat2str(princ
->max_life
, buf
, buf_len
);
205 case KADM5_MAX_RLIFE
:
206 deltat2str(princ
->max_renewable_life
, buf
, buf_len
);
210 time_t2str(princ
->mod_date
, buf
, buf_len
, !condensed
);
214 if (princ
->mod_name
== NULL
)
215 strlcpy(buf
, "unknown", buf_len
);
217 krb5_unparse_name_fixed_short(context
, princ
->mod_name
, buf
, buf_len
);
219 krb5_unparse_name_fixed(context
, princ
->mod_name
, buf
, buf_len
);
221 case KADM5_ATTRIBUTES
:
222 attributes2str (princ
->attributes
, buf
, buf_len
);
225 snprintf(buf
, buf_len
, "%d", princ
->kvno
);
228 /* XXX libkadm5srv decrypts the keys, so mkvno is always 0. */
229 strlcpy(buf
, "unknown", buf_len
);
231 case KADM5_LAST_SUCCESS
:
232 time_t2str(princ
->last_success
, buf
, buf_len
, !condensed
);
234 case KADM5_LAST_FAILED
:
235 time_t2str(princ
->last_failed
, buf
, buf_len
, !condensed
);
237 case KADM5_FAIL_AUTH_COUNT
:
238 snprintf(buf
, buf_len
, "%d", princ
->fail_auth_count
);
241 if(princ
->policy
!= NULL
)
242 strlcpy(buf
, princ
->policy
, buf_len
);
244 strlcpy(buf
, "none", buf_len
);
246 case KADM5_KEY_DATA
:{
250 krb5_get_pw_salt (context
, princ
->principal
, &def_salt
);
253 for (i
= 0; i
< princ
->n_key_data
; ++i
) {
254 format_keytype(&princ
->key_data
[i
], &def_salt
, buf2
, sizeof(buf2
));
256 strlcat(buf
, ", ", buf_len
);
257 strlcat(buf
, buf2
, buf_len
);
259 krb5_free_salt (context
, def_salt
);
262 case KADM5_TL_DATA
: {
265 for (tl
= princ
->tl_data
; tl
!= NULL
; tl
= tl
->tl_data_next
)
266 if ((unsigned)tl
->tl_data_type
== subfield
)
269 strlcpy(buf
, "", buf_len
);
274 case KRB5_TL_PASSWORD
:
275 snprintf(buf
, buf_len
, "\"%.*s\"",
276 (int)tl
->tl_data_length
,
277 (const char *)tl
->tl_data_contents
);
279 case KRB5_TL_PKINIT_ACL
: {
280 HDB_Ext_PKINIT_acl acl
;
285 ret
= decode_HDB_Ext_PKINIT_acl(tl
->tl_data_contents
,
290 snprintf(buf
, buf_len
, "failed to decode ACL");
295 for (i
= 0; i
< acl
.len
; i
++) {
296 strlcat(buf
, "subject: ", buf_len
);
297 strlcat(buf
, acl
.val
[i
].subject
, buf_len
);
298 if (acl
.val
[i
].issuer
) {
299 strlcat(buf
, " issuer:", buf_len
);
300 strlcat(buf
, *acl
.val
[i
].issuer
, buf_len
);
302 if (acl
.val
[i
].anchor
) {
303 strlcat(buf
, " anchor:", buf_len
);
304 strlcat(buf
, *acl
.val
[i
].anchor
, buf_len
);
307 strlcat(buf
, ", ", buf_len
);
309 free_HDB_Ext_PKINIT_acl(&acl
);
312 case KRB5_TL_ALIASES
: {
313 HDB_Ext_Aliases alias
;
318 ret
= decode_HDB_Ext_Aliases(tl
->tl_data_contents
,
323 snprintf(buf
, buf_len
, "failed to decode alias");
327 for (i
= 0; i
< alias
.aliases
.len
; i
++) {
329 ret
= krb5_unparse_name(context
, &alias
.aliases
.val
[i
], &p
);
333 strlcat(buf
, " ", buf_len
);
334 strlcat(buf
, p
, buf_len
);
337 free_HDB_Ext_Aliases(&alias
);
341 snprintf(buf
, buf_len
, "unknown type %d", subfield
);
347 strlcpy(buf
, "<unknown>", buf_len
);
353 print_entry_short(struct get_entry_data
*data
, kadm5_principal_ent_t princ
)
356 struct field_info
*f
;
358 for(f
= data
->chead
; f
!= NULL
; f
= f
->next
) {
359 format_field(princ
, f
->ff
->fieldvalue
, f
->ff
->subvalue
, buf
, sizeof(buf
), 1);
360 rtbl_add_column_entry_by_id(data
->table
, f
->ff
->fieldvalue
, buf
);
365 print_entry_long(struct get_entry_data
*data
, kadm5_principal_ent_t princ
)
368 struct field_info
*f
;
371 for(f
= data
->chead
; f
!= NULL
; f
= f
->next
) {
372 int w
= strlen(f
->header
? f
->header
: f
->ff
->def_longheader
);
376 for(f
= data
->chead
; f
!= NULL
; f
= f
->next
) {
377 format_field(princ
, f
->ff
->fieldvalue
, f
->ff
->subvalue
, buf
, sizeof(buf
), 0);
378 printf("%*s: %s\n", width
, f
->header
? f
->header
: f
->ff
->def_longheader
, buf
);
384 do_get_entry(krb5_principal principal
, void *data
)
386 kadm5_principal_ent_rec princ
;
388 struct get_entry_data
*e
= data
;
390 memset(&princ
, 0, sizeof(princ
));
391 ret
= kadm5_get_principal(kadm_handle
, principal
,
393 e
->mask
| e
->extra_mask
);
397 (e
->format
)(e
, &princ
);
398 kadm5_free_principal_ent(kadm_handle
, &princ
);
404 free_columns(struct get_entry_data
*data
)
406 struct field_info
*f
, *next
;
407 for(f
= data
->chead
; f
!= NULL
; f
= next
) {
413 data
->ctail
= &data
->chead
;
417 setup_columns(struct get_entry_data
*data
, const char *column_info
)
420 char *field
, *header
;
421 struct field_name
*f
;
423 while(strsep_copy(&column_info
, ",", buf
, sizeof(buf
)) != -1) {
425 field
= strsep(&q
, "=");
426 header
= strsep(&q
, "=");
427 for(f
= field_names
; f
->fieldname
!= NULL
; f
++) {
428 if(strcasecmp(field
, f
->fieldname
) == 0) {
429 add_column(data
, f
, header
);
433 if(f
->fieldname
== NULL
) {
434 krb5_warnx(context
, "unknown field name \"%s\"", field
);
443 do_list_entry(krb5_principal principal
, void *data
)
448 ret
= krb5_unparse_name_fixed_short(context
, principal
, buf
, sizeof(buf
));
456 listit(const char *funcname
, int argc
, char **argv
)
459 krb5_error_code ret
, saved_ret
= 0;
461 for (i
= 0; i
< argc
; i
++) {
462 ret
= foreach_principal(argv
[i
], do_list_entry
, funcname
, NULL
);
463 if (saved_ret
== 0 && ret
!= 0)
466 return saved_ret
!= 0;
469 #define DEFAULT_COLUMNS_SHORT "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife"
470 #define DEFAULT_COLUMNS_LONG "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife,kvno,mkvno,last_success,last_failed,fail_auth_count,mod_time,mod_name,attributes,keytypes,pkinit-acl,aliases"
473 getit(struct get_options
*opt
, const char *name
, int argc
, char **argv
)
477 struct get_entry_data data
;
479 if(opt
->long_flag
== -1 && (opt
->short_flag
== 1 || opt
->terse_flag
== 1))
481 if(opt
->short_flag
== -1 && (opt
->long_flag
== 1 || opt
->terse_flag
== 1))
483 if(opt
->terse_flag
== -1 && (opt
->long_flag
== 1 || opt
->short_flag
== 1))
485 if(opt
->long_flag
== 0 && opt
->short_flag
== 0 && opt
->terse_flag
== 0)
489 return listit(name
, argc
, argv
);
493 data
.ctail
= &data
.chead
;
497 if(opt
->short_flag
) {
498 data
.table
= rtbl_create();
499 rtbl_set_separator(data
.table
, " ");
500 data
.format
= print_entry_short
;
502 data
.format
= print_entry_long
;
503 if(opt
->column_info_string
== NULL
) {
505 ret
= setup_columns(&data
, DEFAULT_COLUMNS_LONG
);
507 ret
= setup_columns(&data
, DEFAULT_COLUMNS_SHORT
);
509 ret
= setup_columns(&data
, opt
->column_info_string
);
512 if(data
.table
!= NULL
)
513 rtbl_destroy(data
.table
);
517 for(i
= 0; i
< argc
; i
++)
518 ret
= foreach_principal(argv
[i
], do_get_entry
, name
, &data
);
520 if(data
.table
!= NULL
) {
521 rtbl_format(data
.table
, stdout
);
522 rtbl_destroy(data
.table
);
529 get_entry(struct get_options
*opt
, int argc
, char **argv
)
531 return getit(opt
, "get", argc
, argv
);
535 list_princs(struct list_options
*opt
, int argc
, char **argv
)
537 struct get_options get_opt
;
539 if(sizeof(struct get_options
) != sizeof(struct list_options
)) {
540 krb5_warnx(context
, "programmer error: sizeof(struct get_options) != sizeof(struct list_options)");
543 get_opt
.long_flag
= opt
->long_flag
;
544 get_opt
.short_flag
= opt
->short_flag
;
545 get_opt
.terse_flag
= opt
->terse_flag
;
546 get_opt
.column_info_string
= opt
->column_info_string
;
547 return getit(&get_opt
, "list", argc
, argv
);