2 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadmin_locl.h"
35 #include "kadmin-commands.h"
36 #include <parse_units.h>
39 static struct field_name
{
40 const char *fieldname
;
41 unsigned int fieldvalue
;
42 unsigned int subvalue
;
44 const char *default_header
;
45 const char *def_longheader
;
48 { "principal", KADM5_PRINCIPAL
, 0, 0, "Principal", "Principal", 0 },
49 { "princ_expire_time", KADM5_PRINC_EXPIRE_TIME
, 0, 0, "Expiration", "Principal expires", 0 },
50 { "pw_expiration", KADM5_PW_EXPIRATION
, 0, 0, "PW-exp", "Password expires", 0 },
51 { "last_pwd_change", KADM5_LAST_PWD_CHANGE
, 0, 0, "PW-change", "Last password change", 0 },
52 { "max_life", KADM5_MAX_LIFE
, 0, 0, "Max life", "Max ticket life", 0 },
53 { "max_rlife", KADM5_MAX_RLIFE
, 0, 0, "Max renew", "Max renewable life", 0 },
54 { "mod_time", KADM5_MOD_TIME
, 0, 0, "Mod time", "Last modified", 0 },
55 { "mod_name", KADM5_MOD_NAME
, 0, 0, "Modifier", "Modifier", 0 },
56 { "attributes", KADM5_ATTRIBUTES
, 0, 0, "Attributes", "Attributes", 0 },
57 { "kvno", KADM5_KVNO
, 0, 0, "Kvno", "Kvno", RTBL_ALIGN_RIGHT
},
58 { "mkvno", KADM5_MKVNO
, 0, 0, "Mkvno", "Mkvno", RTBL_ALIGN_RIGHT
},
59 { "last_success", KADM5_LAST_SUCCESS
, 0, 0, "Last login", "Last successful login", 0 },
60 { "last_failed", KADM5_LAST_FAILED
, 0, 0, "Last fail", "Last failed login", 0 },
61 { "fail_auth_count", KADM5_FAIL_AUTH_COUNT
, 0, 0, "Fail count", "Failed login count", RTBL_ALIGN_RIGHT
},
62 { "policy", KADM5_POLICY
, 0, 0, "Policy", "Policy", 0 },
63 { "keytypes", KADM5_KEY_DATA
, 0, KADM5_PRINCIPAL
, "Keytypes", "Keytypes", 0 },
64 { "password", KADM5_TL_DATA
, KRB5_TL_PASSWORD
, KADM5_KEY_DATA
, "Password", "Password", 0 },
65 { "pkinit-acl", KADM5_TL_DATA
, KRB5_TL_PKINIT_ACL
, 0, "PK-INIT ACL", "PK-INIT ACL", 0 },
66 { "aliases", KADM5_TL_DATA
, KRB5_TL_ALIASES
, 0, "Aliases", "Aliases", 0 },
71 struct field_name
*ff
;
73 struct field_info
*next
;
76 struct get_entry_data
{
77 void (*format
)(struct get_entry_data
*, kadm5_principal_ent_t
);
81 struct field_info
*chead
, **ctail
;
85 add_column(struct get_entry_data
*data
, struct field_name
*ff
, const char *header
)
87 struct field_info
*f
= malloc(sizeof(*f
));
92 f
->header
= strdup(header
);
97 data
->ctail
= &f
->next
;
98 data
->mask
|= ff
->fieldvalue
;
99 data
->extra_mask
|= ff
->extra_mask
;
100 if(data
->table
!= NULL
)
101 rtbl_add_column_by_id(data
->table
, ff
->fieldvalue
,
102 header
? header
: ff
->default_header
, ff
->flags
);
107 * return 0 iff `salt' actually is the same as the current salt in `k'
111 cmp_salt (const krb5_salt
*salt
, const krb5_key_data
*k
)
113 if (salt
->salttype
!= k
->key_data_type
[1])
115 if (salt
->saltvalue
.length
!= k
->key_data_length
[1])
117 return memcmp (salt
->saltvalue
.data
, k
->key_data_contents
[1],
118 salt
->saltvalue
.length
);
122 format_keytype(krb5_key_data
*k
, krb5_salt
*def_salt
, char *buf
, size_t buf_len
)
127 ret
= krb5_enctype_to_string (context
,
131 asprintf (&s
, "unknown(%d)", k
->key_data_type
[0]);
132 strlcpy(buf
, s
, buf_len
);
135 strlcat(buf
, "(", buf_len
);
137 ret
= krb5_salttype_to_string (context
,
142 asprintf (&s
, "unknown(%d)", k
->key_data_type
[1]);
143 strlcat(buf
, s
, buf_len
);
146 if (cmp_salt(def_salt
, k
) == 0)
148 else if(k
->key_data_length
[1] == 0)
151 asprintf (&s
, "(%.*s)", k
->key_data_length
[1],
152 (char *)k
->key_data_contents
[1]);
153 strlcat(buf
, s
, buf_len
);
156 strlcat(buf
, ")", buf_len
);
160 format_field(kadm5_principal_ent_t princ
, unsigned int field
,
161 unsigned int subfield
, char *buf
, size_t buf_len
, int condensed
)
164 case KADM5_PRINCIPAL
:
166 krb5_unparse_name_fixed_short(context
, princ
->principal
, buf
, buf_len
);
168 krb5_unparse_name_fixed(context
, princ
->principal
, buf
, buf_len
);
171 case KADM5_PRINC_EXPIRE_TIME
:
172 time_t2str(princ
->princ_expire_time
, buf
, buf_len
, !condensed
);
175 case KADM5_PW_EXPIRATION
:
176 time_t2str(princ
->pw_expiration
, buf
, buf_len
, !condensed
);
179 case KADM5_LAST_PWD_CHANGE
:
180 time_t2str(princ
->last_pwd_change
, buf
, buf_len
, !condensed
);
184 deltat2str(princ
->max_life
, buf
, buf_len
);
187 case KADM5_MAX_RLIFE
:
188 deltat2str(princ
->max_renewable_life
, buf
, buf_len
);
192 time_t2str(princ
->mod_date
, buf
, buf_len
, !condensed
);
196 if (princ
->mod_name
== NULL
)
197 strlcpy(buf
, "unknown", buf_len
);
199 krb5_unparse_name_fixed_short(context
, princ
->mod_name
, buf
, buf_len
);
201 krb5_unparse_name_fixed(context
, princ
->mod_name
, buf
, buf_len
);
203 case KADM5_ATTRIBUTES
:
204 attributes2str (princ
->attributes
, buf
, buf_len
);
207 snprintf(buf
, buf_len
, "%d", princ
->kvno
);
210 /* XXX libkadm5srv decrypts the keys, so mkvno is always 0. */
211 strlcpy(buf
, "unknown", buf_len
);
213 case KADM5_LAST_SUCCESS
:
214 time_t2str(princ
->last_success
, buf
, buf_len
, !condensed
);
216 case KADM5_LAST_FAILED
:
217 time_t2str(princ
->last_failed
, buf
, buf_len
, !condensed
);
219 case KADM5_FAIL_AUTH_COUNT
:
220 snprintf(buf
, buf_len
, "%d", princ
->fail_auth_count
);
223 if(princ
->policy
!= NULL
)
224 strlcpy(buf
, princ
->policy
, buf_len
);
226 strlcpy(buf
, "none", buf_len
);
228 case KADM5_KEY_DATA
:{
232 krb5_get_pw_salt (context
, princ
->principal
, &def_salt
);
235 for (i
= 0; i
< princ
->n_key_data
; ++i
) {
236 format_keytype(&princ
->key_data
[i
], &def_salt
, buf2
, sizeof(buf2
));
238 strlcat(buf
, ", ", buf_len
);
239 strlcat(buf
, buf2
, buf_len
);
241 krb5_free_salt (context
, def_salt
);
244 case KADM5_TL_DATA
: {
247 for (tl
= princ
->tl_data
; tl
!= NULL
; tl
= tl
->tl_data_next
)
248 if (tl
->tl_data_type
== subfield
)
251 strlcpy(buf
, "", buf_len
);
256 case KRB5_TL_PASSWORD
:
257 snprintf(buf
, buf_len
, "\"%.*s\"",
258 (int)tl
->tl_data_length
,
259 (const char *)tl
->tl_data_contents
);
261 case KRB5_TL_PKINIT_ACL
: {
262 HDB_Ext_PKINIT_acl acl
;
266 ret
= decode_HDB_Ext_PKINIT_acl(tl
->tl_data_contents
,
271 snprintf(buf
, buf_len
, "failed to decode ACL");
276 for (i
= 0; i
< acl
.len
; i
++) {
277 strlcat(buf
, "subject: ", buf_len
);
278 strlcat(buf
, acl
.val
[i
].subject
, buf_len
);
279 if (acl
.val
[i
].issuer
) {
280 strlcat(buf
, " issuer:", buf_len
);
281 strlcat(buf
, *acl
.val
[i
].issuer
, buf_len
);
283 if (acl
.val
[i
].anchor
) {
284 strlcat(buf
, " anchor:", buf_len
);
285 strlcat(buf
, *acl
.val
[i
].anchor
, buf_len
);
288 strlcat(buf
, ", ", buf_len
);
290 free_HDB_Ext_PKINIT_acl(&acl
);
293 case KRB5_TL_ALIASES
: {
294 HDB_Ext_Aliases alias
;
298 ret
= decode_HDB_Ext_Aliases(tl
->tl_data_contents
,
303 snprintf(buf
, buf_len
, "failed to decode alias");
307 for (i
= 0; i
< alias
.aliases
.len
; i
++) {
309 ret
= krb5_unparse_name(context
, &alias
.aliases
.val
[i
], &p
);
313 strlcat(buf
, " ", buf_len
);
314 strlcat(buf
, p
, buf_len
);
317 free_HDB_Ext_Aliases(&alias
);
321 snprintf(buf
, buf_len
, "unknown type %d", subfield
);
327 strlcpy(buf
, "<unknown>", buf_len
);
333 print_entry_short(struct get_entry_data
*data
, kadm5_principal_ent_t princ
)
336 struct field_info
*f
;
338 for(f
= data
->chead
; f
!= NULL
; f
= f
->next
) {
339 format_field(princ
, f
->ff
->fieldvalue
, f
->ff
->subvalue
, buf
, sizeof(buf
), 1);
340 rtbl_add_column_entry_by_id(data
->table
, f
->ff
->fieldvalue
, buf
);
345 print_entry_long(struct get_entry_data
*data
, kadm5_principal_ent_t princ
)
348 struct field_info
*f
;
351 for(f
= data
->chead
; f
!= NULL
; f
= f
->next
) {
352 int w
= strlen(f
->header
? f
->header
: f
->ff
->def_longheader
);
356 for(f
= data
->chead
; f
!= NULL
; f
= f
->next
) {
357 format_field(princ
, f
->ff
->fieldvalue
, f
->ff
->subvalue
, buf
, sizeof(buf
), 0);
358 printf("%*s: %s\n", width
, f
->header
? f
->header
: f
->ff
->def_longheader
, buf
);
364 do_get_entry(krb5_principal principal
, void *data
)
366 kadm5_principal_ent_rec princ
;
368 struct get_entry_data
*e
= data
;
370 memset(&princ
, 0, sizeof(princ
));
371 ret
= kadm5_get_principal(kadm_handle
, principal
,
373 e
->mask
| e
->extra_mask
);
377 (e
->format
)(e
, &princ
);
378 kadm5_free_principal_ent(kadm_handle
, &princ
);
384 free_columns(struct get_entry_data
*data
)
386 struct field_info
*f
, *next
;
387 for(f
= data
->chead
; f
!= NULL
; f
= next
) {
393 data
->ctail
= &data
->chead
;
397 setup_columns(struct get_entry_data
*data
, const char *column_info
)
400 char *field
, *header
;
401 struct field_name
*f
;
403 while(strsep_copy(&column_info
, ",", buf
, sizeof(buf
)) != -1) {
405 field
= strsep(&q
, "=");
406 header
= strsep(&q
, "=");
407 for(f
= field_names
; f
->fieldname
!= NULL
; f
++) {
408 if(strcasecmp(field
, f
->fieldname
) == 0) {
409 add_column(data
, f
, header
);
413 if(f
->fieldname
== NULL
) {
414 krb5_warnx(context
, "unknown field name \"%s\"", field
);
423 do_list_entry(krb5_principal principal
, void *data
)
428 ret
= krb5_unparse_name_fixed_short(context
, principal
, buf
, sizeof(buf
));
436 listit(const char *funcname
, int argc
, char **argv
)
439 krb5_error_code ret
, saved_ret
= 0;
441 for (i
= 0; i
< argc
; i
++) {
442 ret
= foreach_principal(argv
[i
], do_list_entry
, funcname
, NULL
);
443 if (saved_ret
== 0 && ret
!= 0)
446 return saved_ret
!= 0;
449 #define DEFAULT_COLUMNS_SHORT "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife"
450 #define DEFAULT_COLUMNS_LONG "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife,kvno,mkvno,last_success,last_failed,fail_auth_count,mod_time,mod_name,attributes,keytypes,pkinit-acl,aliases"
453 getit(struct get_options
*opt
, const char *name
, int argc
, char **argv
)
457 struct get_entry_data data
;
459 if(opt
->long_flag
== -1 && (opt
->short_flag
== 1 || opt
->terse_flag
== 1))
461 if(opt
->short_flag
== -1 && (opt
->long_flag
== 1 || opt
->terse_flag
== 1))
463 if(opt
->terse_flag
== -1 && (opt
->long_flag
== 1 || opt
->short_flag
== 1))
465 if(opt
->long_flag
== 0 && opt
->short_flag
== 0 && opt
->terse_flag
== 0)
469 return listit(name
, argc
, argv
);
473 data
.ctail
= &data
.chead
;
477 if(opt
->short_flag
) {
478 data
.table
= rtbl_create();
479 rtbl_set_separator(data
.table
, " ");
480 data
.format
= print_entry_short
;
482 data
.format
= print_entry_long
;
483 if(opt
->column_info_string
== NULL
) {
485 ret
= setup_columns(&data
, DEFAULT_COLUMNS_LONG
);
487 ret
= setup_columns(&data
, DEFAULT_COLUMNS_SHORT
);
489 ret
= setup_columns(&data
, opt
->column_info_string
);
492 if(data
.table
!= NULL
)
493 rtbl_destroy(data
.table
);
497 for(i
= 0; i
< argc
; i
++)
498 ret
= foreach_principal(argv
[i
], do_get_entry
, "get", &data
);
500 if(data
.table
!= NULL
) {
501 rtbl_format(data
.table
, stdout
);
502 rtbl_destroy(data
.table
);
509 get_entry(struct get_options
*opt
, int argc
, char **argv
)
511 return getit(opt
, "get", argc
, argv
);
515 list_princs(struct list_options
*opt
, int argc
, char **argv
)
517 if(sizeof(struct get_options
) != sizeof(struct list_options
)) {
518 krb5_warnx(context
, "programmer error: sizeof(struct get_options) != sizeof(struct list_options)");
521 return getit((struct get_options
*)opt
, "list", argc
, argv
);