kuser/klist.c

   1 /*
   2  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kuser_locl.h"
  37 #include "parse_units.h"
  38 #include "heimtools-commands.h"
  39
  40 static char*
  41 printable_time_internal(time_t t, int x)
  42 {
  43     static char s[128];
  44     char *p;
  45
  46     if ((p = ctime(&t)) == NULL)
  47         strlcpy(s, "?", sizeof(s));
  48     else
  49         strlcpy(s, p + 4, sizeof(s));
  50     s[x] = 0;
  51     return s;
  52 }
  53
  54 static char*
  55 printable_time(time_t t)
  56 {
  57     return printable_time_internal(t, 20);
  58 }
  59
  60 static char*
  61 printable_time_long(time_t t)
  62 {
  63     return printable_time_internal(t, 20);
  64 }
  65
  66 #define COL_ISSUED              NP_("  Issued","")
  67 #define COL_EXPIRES             NP_("  Expires", "")
  68 #define COL_FLAGS               NP_("Flags", "")
  69 #define COL_NAME                NP_("  Name", "")
  70 #define COL_PRINCIPAL           NP_("  Principal", "in klist output")
  71 #define COL_PRINCIPAL_KVNO      NP_("  Principal (kvno)", "in klist output")
  72 #define COL_CACHENAME           NP_("  Cache name", "name in klist output")
  73 #define COL_DEFCACHE            NP_("", "")
  74
  75 static void
  76 print_cred(krb5_context context, krb5_creds *cred, rtbl_t ct, int do_flags)
  77 {
  78     char *str;
  79     krb5_error_code ret;
  80     krb5_timestamp sec;
  81
  82     krb5_timeofday (context, &sec);
  83
  84
  85     if(cred->times.starttime)
  86         rtbl_add_column_entry(ct, COL_ISSUED,
  87                               printable_time(cred->times.starttime));
  88     else
  89         rtbl_add_column_entry(ct, COL_ISSUED,
  90                               printable_time(cred->times.authtime));
  91
  92     if(cred->times.endtime > sec)
  93         rtbl_add_column_entry(ct, COL_EXPIRES,
  94                               printable_time(cred->times.endtime));
  95     else
  96         rtbl_add_column_entry(ct, COL_EXPIRES, N_(">>>Expired<<<", ""));
  97     ret = krb5_unparse_name (context, cred->server, &str);
  98     if (ret)
  99         krb5_err(context, 1, ret, "krb5_unparse_name");
 100     rtbl_add_column_entry(ct, COL_PRINCIPAL, str);
 101     if(do_flags) {
 102         char s[16], *sp = s;
 103         if(cred->flags.b.forwardable)
 104             *sp++ = 'F';
 105         if(cred->flags.b.forwarded)
 106             *sp++ = 'f';
 107         if(cred->flags.b.proxiable)
 108             *sp++ = 'P';
 109         if(cred->flags.b.proxy)
 110             *sp++ = 'p';
 111         if(cred->flags.b.may_postdate)
 112             *sp++ = 'D';
 113         if(cred->flags.b.postdated)
 114             *sp++ = 'd';
 115         if(cred->flags.b.renewable)
 116             *sp++ = 'R';
 117         if(cred->flags.b.initial)
 118             *sp++ = 'I';
 119         if(cred->flags.b.invalid)
 120             *sp++ = 'i';
 121         if(cred->flags.b.pre_authent)
 122             *sp++ = 'A';
 123         if(cred->flags.b.hw_authent)
 124             *sp++ = 'H';
 125         *sp = '\0';
 126         rtbl_add_column_entry(ct, COL_FLAGS, s);
 127     }
 128     free(str);
 129 }
 130
 131 static void
 132 print_cred_verbose(krb5_context context, krb5_creds *cred, int do_json)
 133 {
 134     size_t j;
 135     char *str;
 136     krb5_error_code ret;
 137     krb5_timestamp sec;
 138
 139     if (do_json) { /* XXX support more json formating later */
 140         printf("{ \"verbose-supported\" : false }");
 141         return;
 142     }
 143
 144     krb5_timeofday (context, &sec);
 145
 146     ret = krb5_unparse_name(context, cred->server, &str);
 147     if(ret)
 148         exit(1);
 149     printf(N_("Server: %s\n", ""), str);
 150     free (str);
 151
 152     ret = krb5_unparse_name(context, cred->client, &str);
 153     if(ret)
 154         exit(1);
 155     printf(N_("Client: %s\n", ""), str);
 156     free (str);
 157
 158     if (!krb5_is_config_principal(context, cred->client)) {
 159         Ticket t;
 160         size_t len;
 161         char *s;
 162
 163         decode_Ticket(cred->ticket.data, cred->ticket.length, &t, &len);
 164         ret = krb5_enctype_to_string(context, t.enc_part.etype, &s);
 165         printf(N_("Ticket etype: ", ""));
 166         if (ret == 0) {
 167             printf("%s", s);
 168             free(s);
 169         } else {
 170             printf(N_("unknown-enctype(%d)", ""), t.enc_part.etype);
 171         }
 172         if(t.enc_part.kvno)
 173             printf(N_(", kvno %d", ""), *t.enc_part.kvno);
 174         printf("\n");
 175         if(cred->session.keytype != t.enc_part.etype) {
 176             ret = krb5_enctype_to_string(context, cred->session.keytype, &str);
 177             if(ret)
 178                 krb5_warn(context, ret, "session keytype");
 179             else {
 180                 printf(N_("Session key: %s\n", "enctype"), str);
 181                 free(str);
 182             }
 183         }
 184         free_Ticket(&t);
 185         printf(N_("Ticket length: %lu\n", ""),
 186                (unsigned long)cred->ticket.length);
 187     }
 188     printf(N_("Auth time:  %s\n", ""),
 189            printable_time_long(cred->times.authtime));
 190     if(cred->times.authtime != cred->times.starttime)
 191         printf(N_("Start time: %s\n", ""),
 192                printable_time_long(cred->times.starttime));
 193     printf(N_("End time:   %s", ""),
 194            printable_time_long(cred->times.endtime));
 195     if(sec > cred->times.endtime)
 196         printf(N_(" (expired)", ""));
 197     printf("\n");
 198     if(cred->flags.b.renewable)
 199         printf(N_("Renew till: %s\n", ""),
 200                printable_time_long(cred->times.renew_till));
 201     {
 202         char flags[1024];
 203         unparse_flags(TicketFlags2int(cred->flags.b),
 204                       asn1_TicketFlags_units(),
 205                       flags, sizeof(flags));
 206         printf(N_("Ticket flags: %s\n", ""), flags);
 207     }
 208     printf(N_("Addresses: ", ""));
 209     if (cred->addresses.len != 0) {
 210         for(j = 0; j < cred->addresses.len; j++){
 211             char buf[128];
 212             size_t len;
 213             if(j) printf(", ");
 214             ret = krb5_print_address(&cred->addresses.val[j],
 215                                      buf, sizeof(buf), &len);
 216
 217             if(ret == 0)
 218                 printf("%s", buf);
 219         }
 220     } else {
 221         printf(N_("addressless", ""));
 222     }
 223     printf("\n\n");
 224 }
 225
 226 /*
 227  * Print all tickets in `ccache' on stdout, verbosily iff do_verbose.
 228  */
 229
 230 static void
 231 print_tickets (krb5_context context,
 232                krb5_ccache ccache,
 233                krb5_principal principal,
 234                int do_verbose,
 235                int do_flags,
 236                int do_hidden,
 237                int do_json)
 238 {
 239     char *str, *name, *fullname;
 240     krb5_error_code ret;
 241     krb5_cc_cursor cursor;
 242     krb5_creds creds;
 243     krb5_deltat sec;
 244
 245     rtbl_t ct = NULL;
 246
 247     ret = krb5_unparse_name (context, principal, &str);
 248     if (ret)
 249         krb5_err (context, 1, ret, "krb5_unparse_name");
 250
 251     ret = krb5_cc_get_full_name(context, ccache, &fullname);
 252     if (ret)
 253         krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 254
 255     if (!do_json) {
 256         printf ("%17s: %s\n", N_("Credentials cache", ""), fullname);
 257         printf ("%17s: %s\n", N_("Principal", ""), str);
 258
 259         ret = krb5_cc_get_friendly_name(context, ccache, &name);
 260         if (ret == 0) {
 261             if (strcmp(name, str) != 0)
 262                 printf ("%17s: %s\n", N_("Friendly name", ""), name);
 263             free(name);
 264         }
 265         free (str);
 266
 267         if(do_verbose) {
 268             printf ("%17s: %d\n", N_("Cache version", ""),
 269                     krb5_cc_get_version(context, ccache));
 270         } else {
 271             krb5_cc_set_flags(context, ccache, KRB5_TC_NOTICKET);
 272         }
 273
 274         ret = krb5_cc_get_kdc_offset(context, ccache, &sec);
 275
 276         if (ret == 0 && do_verbose && sec != 0) {
 277             char buf[BUFSIZ];
 278             int val;
 279             int sig;
 280
 281             val = (int)sec;
 282             sig = 1;
 283             if (val < 0) {
 284                 sig = -1;
 285                 val = -val;
 286             }
 287
 288             unparse_time (val, buf, sizeof(buf));
 289
 290             printf ("%17s: %s%s\n", N_("KDC time offset", ""),
 291                     sig == -1 ? "-" : "", buf);
 292         }
 293         printf("\n");
 294     } else {
 295         printf ("{ \"cache\" : \"%s\", \"principal\" : \"%s\", ", fullname, str);
 296     }
 297
 298     ret = krb5_cc_start_seq_get (context, ccache, &cursor);
 299     if (ret)
 300         krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
 301
 302     if(!do_verbose) {
 303         ct = rtbl_create();
 304         rtbl_add_column(ct, COL_ISSUED, 0);
 305         rtbl_add_column(ct, COL_EXPIRES, 0);
 306         if(do_flags)
 307             rtbl_add_column(ct, COL_FLAGS, 0);
 308         rtbl_add_column(ct, COL_PRINCIPAL, 0);
 309         rtbl_set_separator(ct, "  ");
 310         if (do_json) {
 311             rtbl_set_flags(ct, RTBL_JSON);
 312             printf("\"tickets\" : ");
 313         }
 314     }
 315     if (do_verbose && do_json)
 316         printf("\"tickets\" : [");
 317     while ((ret = krb5_cc_next_cred (context,
 318                                      ccache,
 319                                      &cursor,
 320                                      &creds)) == 0) {
 321         if (!do_hidden && krb5_is_config_principal(context, creds.server)) {
 322             ;
 323         }else if(do_verbose){
 324             print_cred_verbose(context, &creds, do_json);
 325         }else{
 326             print_cred(context, &creds, ct, do_flags);
 327         }
 328         krb5_free_cred_contents (context, &creds);
 329     }
 330     if(ret != KRB5_CC_END)
 331         krb5_err(context, 1, ret, "krb5_cc_get_next");
 332     ret = krb5_cc_end_seq_get (context, ccache, &cursor);
 333     if (ret)
 334         krb5_err (context, 1, ret, "krb5_cc_end_seq_get");
 335     if(!do_verbose) {
 336         rtbl_format(ct, stdout);
 337         rtbl_destroy(ct);
 338     }
 339     if (do_json) {
 340         if (do_verbose)
 341             printf("]");
 342         printf("}");
 343     }
 344 }
 345
 346 /*
 347  * Check if there's a tgt for the realm of `principal' and ccache and
 348  * if so return 0, else 1
 349  */
 350
 351 static int
 352 check_expiration(krb5_context context,
 353                  krb5_ccache ccache,
 354                  time_t *expiration)
 355 {
 356     krb5_error_code ret;
 357     time_t t;
 358
 359     ret = krb5_cc_get_lifetime(context, ccache, &t);
 360     if (ret || t == 0)
 361         return 1;
 362
 363     *expiration = time(NULL) + t;
 364
 365     return 0;
 366 }
 367
 368 /*
 369  * Print a list of all AFS tokens
 370  */
 371
 372 #ifndef NO_AFS
 373
 374 static void
 375 display_tokens(int do_verbose)
 376 {
 377     uint32_t i;
 378     unsigned char t[4096];
 379     struct ViceIoctl parms;
 380
 381     parms.in = (void *)&i;
 382     parms.in_size = sizeof(i);
 383     parms.out = (void *)t;
 384     parms.out_size = sizeof(t);
 385
 386     for (i = 0;; i++) {
 387         int32_t size_secret_tok, size_public_tok;
 388         unsigned char *cell;
 389         struct ClearToken ct;
 390         unsigned char *r = t;
 391         struct timeval tv;
 392         char buf1[20], buf2[20];
 393
 394         if(k_pioctl(NULL, VIOCGETTOK, &parms, 0) < 0) {
 395             if(errno == EDOM)
 396                 break;
 397             continue;
 398         }
 399         if(parms.out_size > sizeof(t))
 400             continue;
 401         if(parms.out_size < sizeof(size_secret_tok))
 402             continue;
 403         t[min(parms.out_size,sizeof(t)-1)] = 0;
 404         memcpy(&size_secret_tok, r, sizeof(size_secret_tok));
 405         /* dont bother about the secret token */
 406         r += size_secret_tok + sizeof(size_secret_tok);
 407         if (parms.out_size < (r - t) + sizeof(size_public_tok))
 408             continue;
 409         memcpy(&size_public_tok, r, sizeof(size_public_tok));
 410         r += sizeof(size_public_tok);
 411         if (parms.out_size < (r - t) + size_public_tok + sizeof(int32_t))
 412             continue;
 413         memcpy(&ct, r, size_public_tok);
 414         r += size_public_tok;
 415         /* there is a int32_t with length of cellname, but we dont read it */
 416         r += sizeof(int32_t);
 417         cell = r;
 418
 419         gettimeofday (&tv, NULL);
 420         strlcpy (buf1, printable_time(ct.BeginTimestamp),
 421                  sizeof(buf1));
 422         if (do_verbose || tv.tv_sec < ct.EndTimestamp)
 423             strlcpy (buf2, printable_time(ct.EndTimestamp),
 424                      sizeof(buf2));
 425         else
 426             strlcpy (buf2, N_(">>> Expired <<<", ""), sizeof(buf2));
 427
 428         printf("%s  %s  ", buf1, buf2);
 429
 430         if ((ct.EndTimestamp - ct.BeginTimestamp) & 1)
 431             printf(N_("User's (AFS ID %d) tokens for %s", ""), ct.ViceId, cell);
 432         else
 433             printf(N_("Tokens for %s", ""), cell);
 434         if (do_verbose)
 435             printf(" (%d)", ct.AuthHandle);
 436         putchar('\n');
 437     }
 438 }
 439 #endif
 440
 441 /*
 442  * display the ccache in `cred_cache'
 443  */
 444
 445 static int
 446 display_v5_ccache (krb5_context context, krb5_ccache ccache,
 447                    int do_test, int do_verbose,
 448                    int do_flags, int do_hidden,
 449                    int do_json)
 450 {
 451     krb5_error_code ret;
 452     krb5_principal principal;
 453     int exit_status = 0;
 454
 455
 456     ret = krb5_cc_get_principal (context, ccache, &principal);
 457     if (ret) {
 458         if (do_json) {
 459             printf("{}");
 460             return 0;
 461         }
 462         if(ret == ENOENT) {
 463             if (!do_test)
 464                 krb5_warnx(context, N_("No ticket file: %s", ""),
 465                            krb5_cc_get_name(context, ccache));
 466             return 1;
 467         } else
 468             krb5_err (context, 1, ret, "krb5_cc_get_principal");
 469     }
 470     if (do_test)
 471         exit_status = check_expiration(context, ccache, NULL);
 472     else
 473         print_tickets (context, ccache, principal, do_verbose,
 474                        do_flags, do_hidden, do_json);
 475
 476     ret = krb5_cc_close (context, ccache);
 477     if (ret)
 478         krb5_err (context, 1, ret, "krb5_cc_close");
 479
 480     krb5_free_principal (context, principal);
 481
 482     return exit_status;
 483 }
 484
 485 /*
 486  *
 487  */
 488
 489 static int
 490 list_caches(krb5_context context, struct klist_options *opt)
 491 {
 492     krb5_cccol_cursor cursor;
 493     const char *cdef_name;
 494     char *def_name;
 495     krb5_error_code ret;
 496     krb5_ccache id;
 497     rtbl_t ct;
 498
 499     cdef_name = krb5_cc_default_name(context);
 500     if (cdef_name == NULL)
 501         krb5_errx(context, 1, "krb5_cc_default_name");
 502     def_name = strdup(cdef_name);
 503
 504     ret = krb5_cccol_cursor_new(context, &cursor);
 505     if (ret == KRB5_CC_NOSUPP)
 506         return 0;
 507     else if (ret)
 508         krb5_err (context, 1, ret, "krb5_cc_cache_get_first");
 509
 510     ct = rtbl_create();
 511     rtbl_add_column(ct, COL_DEFCACHE, 0);
 512     rtbl_add_column(ct, COL_NAME, 0);
 513     rtbl_add_column(ct, COL_CACHENAME, 0);
 514     rtbl_add_column(ct, COL_EXPIRES, 0);
 515     rtbl_add_column(ct, COL_DEFCACHE, 0);
 516     rtbl_set_prefix(ct, "   ");
 517     rtbl_set_column_prefix(ct, COL_DEFCACHE, "");
 518     rtbl_set_column_prefix(ct, COL_NAME, " ");
 519     if (opt->json_flag)
 520         rtbl_set_flags(ct, RTBL_JSON);
 521
 522     while (krb5_cccol_cursor_next(context, cursor, &id) == 0) {
 523         int expired = 0;
 524         char *name;
 525         time_t t;
 526
 527         expired = check_expiration(context, id, &t);
 528
 529         ret = krb5_cc_get_friendly_name(context, id, &name);
 530         if (ret == 0) {
 531             const char *str;
 532             char *fname;
 533
 534             rtbl_add_column_entry(ct, COL_NAME, name);
 535             free(name);
 536
 537             if (expired)
 538                 str = N_(">>> Expired <<<", "");
 539             else
 540                 str = printable_time(t);
 541             rtbl_add_column_entry(ct, COL_EXPIRES, str);
 542
 543             ret = krb5_cc_get_full_name(context, id, &fname);
 544             if (ret)
 545                 krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 546
 547             rtbl_add_column_entry(ct, COL_CACHENAME, fname);
 548             if (opt->json_flag)
 549                 ;
 550             else if (strcmp(fname, def_name) == 0)
 551                 rtbl_add_column_entry(ct, COL_DEFCACHE, "*");
 552             else
 553                 rtbl_add_column_entry(ct, COL_DEFCACHE, "");
 554
 555             krb5_xfree(fname);
 556         }
 557         krb5_cc_close(context, id);
 558     }
 559
 560     krb5_cccol_cursor_free(context, &cursor);
 561
 562     free(def_name);
 563     rtbl_format(ct, stdout);
 564     rtbl_destroy(ct);
 565
 566     if (opt->json_flag)
 567         printf("\n");
 568
 569     return 0;
 570 }
 571
 572 /*
 573  *
 574  */
 575
 576 int
 577 klist(struct klist_options *opt, int argc, char **argv)
 578 {
 579     krb5_error_code ret;
 580     int exit_status = 0;
 581
 582     int do_verbose =
 583         opt->verbose_flag ||
 584         opt->a_flag ||
 585         opt->n_flag;
 586     int do_test =
 587         opt->test_flag ||
 588         opt->s_flag;
 589
 590     if(opt->version_flag) {
 591         print_version(NULL);
 592         exit(0);
 593     }
 594
 595     if (opt->list_all_flag) {
 596         exit_status = list_caches(heimtools_context, opt);
 597         return exit_status;
 598     }
 599
 600     if (opt->v5_flag) {
 601         krb5_ccache id;
 602
 603         if (opt->all_content_flag) {
 604             krb5_cc_cache_cursor cursor;
 605             int first = 1;
 606
 607             ret = krb5_cc_cache_get_first(heimtools_context, NULL, &cursor);
 608             if (ret)
 609                 krb5_err(heimtools_context, 1, ret, "krb5_cc_cache_get_first");
 610
 611             if (opt->json_flag)
 612                 printf("[");
 613             while (krb5_cc_cache_next(heimtools_context, cursor, &id) == 0) {
 614                 if (opt->json_flag && !first)
 615                     printf(",");
 616
 617                 exit_status |= display_v5_ccache(heimtools_context, id, do_test,
 618                                                  do_verbose, opt->flags_flag,
 619                                                  opt->hidden_flag, opt->json_flag);
 620                 if (!opt->json_flag)
 621                     printf("\n\n");
 622
 623                 first = 0;
 624             }
 625             krb5_cc_cache_end_seq_get(heimtools_context, cursor);
 626             if (opt->json_flag)
 627                 printf("]");
 628         } else {
 629             if(opt->cache_string) {
 630                 ret = krb5_cc_resolve(heimtools_context, opt->cache_string, &id);
 631                 if (ret)
 632                     krb5_err(heimtools_context, 1, ret, "%s", opt->cache_string);
 633             } else {
 634                 ret = krb5_cc_default(heimtools_context, &id);
 635                 if (ret)
 636                     krb5_err(heimtools_context, 1, ret, "krb5_cc_resolve");
 637             }
 638             exit_status = display_v5_ccache(heimtools_context, id, do_test,
 639                                             do_verbose, opt->flags_flag,
 640                                             opt->hidden_flag, opt->json_flag);
 641         }
 642     }
 643
 644     if (!do_test) {
 645 #ifndef NO_AFS
 646         if (opt->tokens_flag && k_hasafs()) {
 647             if (opt->v5_flag)
 648                 printf("\n");
 649             display_tokens(opt->verbose_flag);
 650         }
 651 #endif
 652     }
 653
 654     return exit_status;
 655 }