2 * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kadmin_locl.h"
35 #include <parse_units.h>
38 * util.c - functions for parsing, unparsing, and editing different
39 * types of data used in kadmin.
43 get_response(const char *prompt
, const char *def
, char *buf
, size_t len
);
49 struct units kdb_attrs
[] = {
50 { "disallow-client", KRB5_KDB_DISALLOW_CLIENT
},
51 { "virtual", KRB5_KDB_VIRTUAL
},
52 { "virtual-keys", KRB5_KDB_VIRTUAL_KEYS
},
53 { "materialize", KRB5_KDB_MATERIALIZE
},
54 { "allow-digest", KRB5_KDB_ALLOW_DIGEST
},
55 { "allow-kerberos4", KRB5_KDB_ALLOW_KERBEROS4
},
56 { "trusted-for-delegation", KRB5_KDB_TRUSTED_FOR_DELEGATION
},
57 { "ok-as-delegate", KRB5_KDB_OK_AS_DELEGATE
},
58 { "new-princ", KRB5_KDB_NEW_PRINC
},
59 { "support-desmd5", KRB5_KDB_SUPPORT_DESMD5
},
60 { "pwchange-service", KRB5_KDB_PWCHANGE_SERVICE
},
61 { "disallow-svr", KRB5_KDB_DISALLOW_SVR
},
62 { "requires-pw-change", KRB5_KDB_REQUIRES_PWCHANGE
},
63 { "requires-hw-auth", KRB5_KDB_REQUIRES_HW_AUTH
},
64 { "requires-pre-auth", KRB5_KDB_REQUIRES_PRE_AUTH
},
65 { "disallow-all-tix", KRB5_KDB_DISALLOW_ALL_TIX
},
66 { "disallow-dup-skey", KRB5_KDB_DISALLOW_DUP_SKEY
},
67 { "disallow-proxiable", KRB5_KDB_DISALLOW_PROXIABLE
},
68 { "disallow-renewable", KRB5_KDB_DISALLOW_RENEWABLE
},
69 { "disallow-tgt-based", KRB5_KDB_DISALLOW_TGT_BASED
},
70 { "disallow-forwardable", KRB5_KDB_DISALLOW_FORWARDABLE
},
71 { "disallow-postdated", KRB5_KDB_DISALLOW_POSTDATED
},
72 { "no-auth-data-reqd", KRB5_KDB_NO_AUTH_DATA_REQUIRED
},
77 * convert the attributes in `attributes' into a printable string
82 attributes2str(krb5_flags attributes
, char *str
, size_t len
)
84 unparse_flags (attributes
, kdb_attrs
, str
, len
);
88 * convert the string in `str' into attributes in `flags'
89 * return 0 if parsed ok, else -1.
93 str2attributes(const char *str
, krb5_flags
*flags
)
97 res
= parse_flags (str
, kdb_attrs
, *flags
);
107 * try to parse the string `resp' into attributes in `attr', also
108 * setting the `bit' in `mask' if attributes are given and valid.
112 parse_attributes (const char *resp
, krb5_flags
*attr
, int *mask
, int bit
)
114 krb5_flags tmp
= *attr
;
116 if (str2attributes(resp
, &tmp
) == 0) {
121 } else if(*resp
== '?') {
122 print_flags_table (kdb_attrs
, stderr
);
124 fprintf (stderr
, "Unable to parse \"%s\"\n", resp
);
130 * allow the user to edit the attributes in `attr', prompting with `prompt'
134 edit_attributes (const char *prompt
, krb5_flags
*attr
, int *mask
, int bit
)
136 char buf
[1024], resp
[1024];
138 if (mask
&& (*mask
& bit
))
141 attributes2str(*attr
, buf
, sizeof(buf
));
143 if(get_response("Attributes", buf
, resp
, sizeof(resp
)) != 0)
147 if (parse_attributes (resp
, attr
, mask
, bit
) == 0)
154 * try to parse the string `resp' into policy in `attr', also
155 * setting the `bit' in `mask' if attributes are given and valid.
158 #define VALID_POLICY_NAME_CHARS \
159 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_"
162 parse_policy (const char *resp
, char **policy
, int *mask
, int bit
)
164 if (strspn(resp
, VALID_POLICY_NAME_CHARS
) == strlen(resp
) &&
167 *policy
= strdup(resp
);
168 if (*policy
== NULL
) {
169 fprintf (stderr
, "Out of memory");
175 } else if(*resp
== '?') {
176 print_flags_table (kdb_attrs
, stderr
);
178 fprintf (stderr
, "Unable to parse \"%s\"\n", resp
);
184 * allow the user to edit the attributes in `attr', prompting with `prompt'
188 edit_policy (const char *prompt
, char **policy
, int *mask
, int bit
)
190 char buf
[1024], resp
[1024];
192 if (mask
&& (*mask
& bit
))
196 strlcpy(buf
, "default", sizeof (buf
));
198 if(get_response("Policy", buf
, resp
, sizeof(resp
)) != 0)
202 if (parse_policy (resp
, policy
, mask
, bit
) == 0)
210 * the special value 0 means ``never''
214 * Convert the time `t' to a string representation in `str' (of max
215 * size `len'). If include_time also include time, otherwise just
220 time_t2str(time_t t
, char *str
, size_t len
, int include_time
)
224 strftime(str
, len
, "%Y-%m-%d %H:%M:%S UTC", gmtime(&t
));
226 strftime(str
, len
, "%Y-%m-%d", gmtime(&t
));
228 snprintf(str
, len
, "never");
232 * Convert the time representation in `str' to a time in `time'.
233 * Return 0 if succesful, else -1.
237 str2time_t (const char *str
, time_t *t
)
242 memset (&tm
, 0, sizeof (tm
));
243 memset (&tm2
, 0, sizeof (tm2
));
245 while(isspace((unsigned char)*str
))
250 *t
= parse_time(str
, "month");
258 *t
= parse_time(str
, "month");
261 *t
= time(NULL
) - *t
;
265 if(strcasecmp(str
, "never") == 0) {
270 if(strcasecmp(str
, "now") == 0) {
275 p
= strptime (str
, "%Y-%m-%d", &tm
);
280 while(isspace((unsigned char)*p
))
283 /* XXX this is really a bit optimistic, we should really complain
284 if there was a problem parsing the time */
285 if(p
[0] != '\0' && strptime (p
, "%H:%M:%S", &tm2
) != NULL
) {
286 tm
.tm_hour
= tm2
.tm_hour
;
287 tm
.tm_min
= tm2
.tm_min
;
288 tm
.tm_sec
= tm2
.tm_sec
;
290 /* Do it on the end of the day */
296 *t
= tm2time (tm
, 0);
301 * try to parse the time in `resp' storing it in `value'
305 parse_timet (const char *resp
, krb5_timestamp
*value
, int *mask
, int bit
)
309 if (str2time_t(resp
, &tmp
) == 0) {
316 fprintf (stderr
, "Unable to parse time \"%s\"\n", resp
);
317 fprintf (stderr
, "Print date on format YYYY-mm-dd [hh:mm:ss]\n");
322 * allow the user to edit the time in `value'
326 edit_timet (const char *prompt
, krb5_timestamp
*value
, int *mask
, int bit
)
328 char buf
[1024], resp
[1024];
330 if (mask
&& (*mask
& bit
))
333 time_t2str (*value
, buf
, sizeof (buf
), 0);
336 if(get_response(prompt
, buf
, resp
, sizeof(resp
)) != 0)
338 if (parse_timet (resp
, value
, mask
, bit
) == 0)
346 * the special value 0 means ``unlimited''
350 * convert the delta_t value in `t' into a printable form in `str, len'
354 deltat2str(unsigned t
, char *str
, size_t len
)
356 if(t
== 0 || t
== INT_MAX
)
357 snprintf(str
, len
, "unlimited");
359 unparse_time(t
, str
, len
);
363 * parse the delta value in `str', storing result in `*delta'
364 * return 0 if ok, else -1
368 str2deltat(const char *str
, krb5_deltat
*delta
)
372 if(strcasecmp(str
, "unlimited") == 0) {
376 res
= parse_time(str
, "day");
386 * try to parse the string in `resp' into a deltad in `value'
387 * `mask' will get the bit `bit' set if a value was given.
391 parse_deltat (const char *resp
, krb5_deltat
*value
, int *mask
, int bit
)
395 if (str2deltat(resp
, &tmp
) == 0) {
400 } else if(*resp
== '?') {
401 print_time_table (stderr
);
403 fprintf (stderr
, "Unable to parse time \"%s\"\n", resp
);
409 * allow the user to edit the deltat in `value'
413 edit_deltat (const char *prompt
, krb5_deltat
*value
, int *mask
, int bit
)
415 char buf
[1024], resp
[1024];
417 if (mask
&& (*mask
& bit
))
420 deltat2str(*value
, buf
, sizeof(buf
));
422 if(get_response(prompt
, buf
, resp
, sizeof(resp
)) != 0)
424 if (parse_deltat (resp
, value
, mask
, bit
) == 0)
431 * allow the user to edit `ent'
435 set_defaults(kadm5_principal_ent_t ent
, int *mask
,
436 kadm5_principal_ent_t default_ent
, int default_mask
)
439 && (default_mask
& KADM5_MAX_LIFE
)
440 && !(*mask
& KADM5_MAX_LIFE
))
441 ent
->max_life
= default_ent
->max_life
;
444 && (default_mask
& KADM5_MAX_RLIFE
)
445 && !(*mask
& KADM5_MAX_RLIFE
))
446 ent
->max_renewable_life
= default_ent
->max_renewable_life
;
449 && (default_mask
& KADM5_PRINC_EXPIRE_TIME
)
450 && !(*mask
& KADM5_PRINC_EXPIRE_TIME
))
451 ent
->princ_expire_time
= default_ent
->princ_expire_time
;
454 && (default_mask
& KADM5_PW_EXPIRATION
)
455 && !(*mask
& KADM5_PW_EXPIRATION
))
456 ent
->pw_expiration
= default_ent
->pw_expiration
;
459 && (default_mask
& KADM5_ATTRIBUTES
)
460 && !(*mask
& KADM5_ATTRIBUTES
))
461 ent
->attributes
= default_ent
->attributes
& ~KRB5_KDB_DISALLOW_ALL_TIX
;
464 && (default_mask
& KADM5_POLICY
)
465 && !(*mask
& KADM5_POLICY
)) {
466 ent
->policy
= strdup(default_ent
->policy
);
467 if (ent
->policy
== NULL
)
473 edit_entry(kadm5_principal_ent_t ent
, int *mask
,
474 kadm5_principal_ent_t default_ent
, int default_mask
)
477 set_defaults(ent
, mask
, default_ent
, default_mask
);
479 if(edit_deltat ("Max ticket life", &ent
->max_life
, mask
,
480 KADM5_MAX_LIFE
) != 0)
483 if(edit_deltat ("Max renewable life", &ent
->max_renewable_life
, mask
,
484 KADM5_MAX_RLIFE
) != 0)
487 if(edit_timet ("Principal expiration time", &ent
->princ_expire_time
, mask
,
488 KADM5_PRINC_EXPIRE_TIME
) != 0)
491 if(edit_timet ("Password expiration time", &ent
->pw_expiration
, mask
,
492 KADM5_PW_EXPIRATION
) != 0)
495 if(edit_attributes ("Attributes", &ent
->attributes
, mask
,
496 KADM5_ATTRIBUTES
) != 0)
499 if(edit_policy ("Policy", &ent
->policy
, mask
,
507 * Parse the arguments, set the fields in `ent' and the `mask' for the
508 * entries having been set.
509 * Return 1 on failure and 0 on success.
513 set_entry(krb5_context contextp
,
514 kadm5_principal_ent_t ent
,
516 const char *max_ticket_life
,
517 const char *max_renewable_life
,
518 const char *expiration
,
519 const char *pw_expiration
,
520 const char *attributes
,
523 if (max_ticket_life
!= NULL
) {
524 if (parse_deltat (max_ticket_life
, &ent
->max_life
,
525 mask
, KADM5_MAX_LIFE
)) {
526 krb5_warnx (contextp
, "unable to parse `%s'", max_ticket_life
);
530 if (max_renewable_life
!= NULL
) {
531 if (parse_deltat (max_renewable_life
, &ent
->max_renewable_life
,
532 mask
, KADM5_MAX_RLIFE
)) {
533 krb5_warnx (contextp
, "unable to parse `%s'", max_renewable_life
);
539 if (parse_timet (expiration
, &ent
->princ_expire_time
,
540 mask
, KADM5_PRINC_EXPIRE_TIME
)) {
541 krb5_warnx (contextp
, "unable to parse `%s'", expiration
);
546 if (parse_timet (pw_expiration
, &ent
->pw_expiration
,
547 mask
, KADM5_PW_EXPIRATION
)) {
548 krb5_warnx (contextp
, "unable to parse `%s'", pw_expiration
);
552 if (attributes
!= NULL
) {
553 if (parse_attributes (attributes
, &ent
->attributes
,
554 mask
, KADM5_ATTRIBUTES
)) {
555 krb5_warnx (contextp
, "unable to parse `%s'", attributes
);
559 if (policy
!= NULL
) {
560 if (parse_policy (policy
, &ent
->policy
,
561 mask
, KADM5_POLICY
)) {
562 krb5_warnx (contextp
, "unable to parse `%s'", attributes
);
570 * Does `string' contain any globing characters?
574 is_expression(const char *string
)
579 for(p
= string
; *p
; p
++) {
586 else if(strchr("[]*?", *p
) != NULL
)
593 * Loop over all principals matching exp. If any of calls to `func'
594 * failes, the first error is returned when all principals are
598 foreach_principal(const char *exp_str
,
599 int (*func
)(krb5_principal
, void*),
600 const char *funcname
,
603 char **princs
= NULL
;
606 krb5_error_code saved_ret
= 0, ret
= 0;
607 krb5_principal princ_ent
;
610 /* if this isn't an expression, there is no point in wading
611 through the whole database looking for matches */
612 is_expr
= is_expression(exp_str
);
614 ret
= kadm5_get_principals(kadm_handle
, exp_str
, &princs
, &num_princs
);
615 if(!is_expr
|| ret
== KADM5_AUTH_LIST
) {
616 /* we might be able to perform the requested opreration even
617 if we're not allowed to list principals */
619 princs
= malloc(sizeof(*princs
));
622 princs
[0] = strdup(exp_str
);
623 if(princs
[0] == NULL
){
628 krb5_warn(context
, ret
, "kadm5_get_principals");
631 for(i
= 0; i
< num_princs
; i
++) {
632 ret
= krb5_parse_name(context
, princs
[i
], &princ_ent
);
634 krb5_warn(context
, ret
, "krb5_parse_name(%s)", princs
[i
]);
637 ret
= (*func
)(princ_ent
, data
);
639 krb5_warn(context
, ret
, "%s %s", funcname
, princs
[i
]);
640 krb5_clear_error_message(context
);
644 krb5_free_principal(context
, princ_ent
);
646 if (ret
== 0 && saved_ret
!= 0)
648 kadm5_free_name_list(kadm_handle
, princs
, &num_princs
);
653 * prompt with `prompt' and default value `def', and store the reply
659 static jmp_buf jmpbuf
;
668 get_response(const char *prompt
, const char *def
, char *buf
, size_t len
)
673 osig
= signal(SIGINT
, interrupt
);
675 signal(SIGINT
, osig
);
676 fprintf(stderr
, "\n");
680 fprintf(stderr
, "%s [%s]:", prompt
, def
);
681 if(fgets(buf
, len
, stdin
) == NULL
) {
682 int save_errno
= errno
;
684 krb5_err(context
, 1, save_errno
, "<stdin>");
685 signal(SIGINT
, osig
);
688 p
= strchr(buf
, '\n');
691 if(strcmp(buf
, "") == 0)
692 strlcpy(buf
, def
, len
);
693 signal(SIGINT
, osig
);
698 * return [0, 16) or -1
704 static char hexdigits
[] = "0123456789abcdef";
707 p
= strchr (hexdigits
, tolower((unsigned char)c
));
711 return p
- hexdigits
;
715 * convert a key in a readable format into a keyblock.
716 * return 0 iff succesful, otherwise `err' should point to an error message
720 parse_des_key (const char *key_string
, krb5_key_data
*key_data
,
723 const char *p
= key_string
;
724 unsigned char bits
[8];
727 if (strlen (key_string
) != 16) {
728 *error
= "bad length, should be 16 for DES key";
731 for (i
= 0; i
< 8; ++i
) {
734 d1
= hex2n(p
[2 * i
]);
735 d2
= hex2n(p
[2 * i
+ 1]);
736 if (d1
< 0 || d2
< 0) {
737 *error
= "non-hex character";
740 bits
[i
] = (d1
<< 4) | d2
;
742 for (i
= 0; i
< 3; ++i
) {
743 key_data
[i
].key_data_ver
= 2;
744 key_data
[i
].key_data_kvno
= 0;
746 key_data
[i
].key_data_type
[0] = ETYPE_DES_CBC_CRC
;
747 key_data
[i
].key_data_length
[0] = 8;
748 key_data
[i
].key_data_contents
[0] = malloc(8);
749 if (key_data
[i
].key_data_contents
[0] == NULL
) {
753 memcpy (key_data
[i
].key_data_contents
[0], bits
, 8);
755 key_data
[i
].key_data_type
[1] = KRB5_PW_SALT
;
756 key_data
[i
].key_data_length
[1] = 0;
757 key_data
[i
].key_data_contents
[1] = NULL
;
759 key_data
[0].key_data_type
[0] = ETYPE_DES_CBC_MD5
;
760 key_data
[1].key_data_type
[0] = ETYPE_DES_CBC_MD4
;