get.c revision 1.1.1.2
1 /* $NetBSD: get.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2006 Kungliga Tekniska Hgskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include "kadmin_locl.h" 37 #include "kadmin-commands.h" 38 #include <krb5/parse_units.h> 39 #include <krb5/rtbl.h> 40 41 static struct field_name { 42 const char *fieldname; 43 unsigned int fieldvalue; 44 unsigned int subvalue; 45 uint32_t extra_mask; 46 const char *default_header; 47 const char *def_longheader; 48 unsigned int flags; 49 } field_names[] = { 50 { "principal", KADM5_PRINCIPAL, 0, 0, "Principal", "Principal", 0 }, 51 { "princ_expire_time", KADM5_PRINC_EXPIRE_TIME, 0, 0, "Expiration", "Principal expires", 0 }, 52 { "pw_expiration", KADM5_PW_EXPIRATION, 0, 0, "PW-exp", "Password expires", 0 }, 53 { "last_pwd_change", KADM5_LAST_PWD_CHANGE, 0, 0, "PW-change", "Last password change", 0 }, 54 { "max_life", KADM5_MAX_LIFE, 0, 0, "Max life", "Max ticket life", 0 }, 55 { "max_rlife", KADM5_MAX_RLIFE, 0, 0, "Max renew", "Max renewable life", 0 }, 56 { "mod_time", KADM5_MOD_TIME, 0, 0, "Mod time", "Last modified", 0 }, 57 { "mod_name", KADM5_MOD_NAME, 0, 0, "Modifier", "Modifier", 0 }, 58 { "attributes", KADM5_ATTRIBUTES, 0, 0, "Attributes", "Attributes", 0 }, 59 { "kvno", KADM5_KVNO, 0, 0, "Kvno", "Kvno", RTBL_ALIGN_RIGHT }, 60 { "mkvno", KADM5_MKVNO, 0, 0, "Mkvno", "Mkvno", RTBL_ALIGN_RIGHT }, 61 { "last_success", KADM5_LAST_SUCCESS, 0, 0, "Last login", "Last successful login", 0 }, 62 { "last_failed", KADM5_LAST_FAILED, 0, 0, "Last fail", "Last failed login", 0 }, 63 { "fail_auth_count", KADM5_FAIL_AUTH_COUNT, 0, 0, "Fail count", "Failed login count", RTBL_ALIGN_RIGHT }, 64 { "policy", KADM5_POLICY, 0, 0, "Policy", "Policy", 0 }, 65 { "keytypes", KADM5_KEY_DATA, 0, KADM5_PRINCIPAL, "Keytypes", "Keytypes", 0 }, 66 { "password", KADM5_TL_DATA, KRB5_TL_PASSWORD, KADM5_KEY_DATA, "Password", "Password", 0 }, 67 { "pkinit-acl", KADM5_TL_DATA, KRB5_TL_PKINIT_ACL, 0, "PK-INIT ACL", "PK-INIT ACL", 0 }, 68 { "aliases", KADM5_TL_DATA, KRB5_TL_ALIASES, 0, "Aliases", "Aliases", 0 }, 69 { NULL } 70 }; 71 72 struct field_info { 73 struct field_name *ff; 74 char *header; 75 struct field_info *next; 76 }; 77 78 struct get_entry_data { 79 void (*format)(struct get_entry_data*, kadm5_principal_ent_t); 80 rtbl_t table; 81 uint32_t mask; 82 uint32_t extra_mask; 83 struct field_info *chead, **ctail; 84 }; 85 86 static int 87 add_column(struct get_entry_data *data, struct field_name *ff, const char *header) 88 { 89 struct field_info *f = malloc(sizeof(*f)); 90 if (f == NULL) 91 return ENOMEM; 92 f->ff = ff; 93 if(header) 94 f->header = strdup(header); 95 else 96 f->header = NULL; 97 f->next = NULL; 98 *data->ctail = f; 99 data->ctail = &f->next; 100 data->mask |= ff->fieldvalue; 101 data->extra_mask |= ff->extra_mask; 102 if(data->table != NULL) 103 rtbl_add_column_by_id(data->table, ff->fieldvalue, 104 header ? header : ff->default_header, ff->flags); 105 return 0; 106 } 107 108 /* 109 * return 0 iff `salt' actually is the same as the current salt in `k' 110 */ 111 112 static int 113 cmp_salt (const krb5_salt *salt, const krb5_key_data *k) 114 { 115 if (salt->salttype != (size_t)k->key_data_type[1]) 116 return 1; 117 if (salt->saltvalue.length != (size_t)k->key_data_length[1]) 118 return 1; 119 return memcmp (salt->saltvalue.data, k->key_data_contents[1], 120 salt->saltvalue.length); 121 } 122 123 static void 124 format_keytype(krb5_key_data *k, krb5_salt *def_salt, char *buf, size_t buf_len) 125 { 126 krb5_error_code ret; 127 char *s; 128 129 ret = krb5_enctype_to_string (context, 130 k->key_data_type[0], 131 &s); 132 if (ret) 133 asprintf (&s, "unknown(%d)", k->key_data_type[0]); 134 strlcpy(buf, s, buf_len); 135 free(s); 136 137 strlcat(buf, "(", buf_len); 138 139 ret = krb5_salttype_to_string (context, 140 k->key_data_type[0], 141 k->key_data_type[1], 142 &s); 143 if (ret) 144 asprintf (&s, "unknown(%d)", k->key_data_type[1]); 145 strlcat(buf, s, buf_len); 146 free(s); 147 148 if (cmp_salt(def_salt, k) == 0) 149 s = strdup(""); 150 else if(k->key_data_length[1] == 0) 151 s = strdup("()"); 152 else 153 asprintf (&s, "(%.*s)", k->key_data_length[1], 154 (char *)k->key_data_contents[1]); 155 strlcat(buf, s, buf_len); 156 free(s); 157 158 strlcat(buf, ")", buf_len); 159 } 160 161 static void 162 format_field(kadm5_principal_ent_t princ, unsigned int field, 163 unsigned int subfield, char *buf, size_t buf_len, int condensed) 164 { 165 switch(field) { 166 case KADM5_PRINCIPAL: 167 if(condensed) 168 krb5_unparse_name_fixed_short(context, princ->principal, buf, buf_len); 169 else 170 krb5_unparse_name_fixed(context, princ->principal, buf, buf_len); 171 break; 172 173 case KADM5_PRINC_EXPIRE_TIME: 174 time_t2str(princ->princ_expire_time, buf, buf_len, !condensed); 175 break; 176 177 case KADM5_PW_EXPIRATION: 178 time_t2str(princ->pw_expiration, buf, buf_len, !condensed); 179 break; 180 181 case KADM5_LAST_PWD_CHANGE: 182 time_t2str(princ->last_pwd_change, buf, buf_len, !condensed); 183 break; 184 185 case KADM5_MAX_LIFE: 186 deltat2str(princ->max_life, buf, buf_len); 187 break; 188 189 case KADM5_MAX_RLIFE: 190 deltat2str(princ->max_renewable_life, buf, buf_len); 191 break; 192 193 case KADM5_MOD_TIME: 194 time_t2str(princ->mod_date, buf, buf_len, !condensed); 195 break; 196 197 case KADM5_MOD_NAME: 198 if (princ->mod_name == NULL) 199 strlcpy(buf, "unknown", buf_len); 200 else if(condensed) 201 krb5_unparse_name_fixed_short(context, princ->mod_name, buf, buf_len); 202 else 203 krb5_unparse_name_fixed(context, princ->mod_name, buf, buf_len); 204 break; 205 case KADM5_ATTRIBUTES: 206 attributes2str (princ->attributes, buf, buf_len); 207 break; 208 case KADM5_KVNO: 209 snprintf(buf, buf_len, "%d", princ->kvno); 210 break; 211 case KADM5_MKVNO: 212 /* XXX libkadm5srv decrypts the keys, so mkvno is always 0. */ 213 strlcpy(buf, "unknown", buf_len); 214 break; 215 case KADM5_LAST_SUCCESS: 216 time_t2str(princ->last_success, buf, buf_len, !condensed); 217 break; 218 case KADM5_LAST_FAILED: 219 time_t2str(princ->last_failed, buf, buf_len, !condensed); 220 break; 221 case KADM5_FAIL_AUTH_COUNT: 222 snprintf(buf, buf_len, "%d", princ->fail_auth_count); 223 break; 224 case KADM5_POLICY: 225 if(princ->policy != NULL) 226 strlcpy(buf, princ->policy, buf_len); 227 else 228 strlcpy(buf, "none", buf_len); 229 break; 230 case KADM5_KEY_DATA:{ 231 krb5_salt def_salt; 232 int i; 233 char buf2[1024]; 234 krb5_get_pw_salt (context, princ->principal, &def_salt); 235 236 *buf = '\0'; 237 for (i = 0; i < princ->n_key_data; ++i) { 238 format_keytype(&princ->key_data[i], &def_salt, buf2, sizeof(buf2)); 239 if(i > 0) 240 strlcat(buf, ", ", buf_len); 241 strlcat(buf, buf2, buf_len); 242 } 243 krb5_free_salt (context, def_salt); 244 break; 245 } 246 case KADM5_TL_DATA: { 247 krb5_tl_data *tl; 248 249 for (tl = princ->tl_data; tl != NULL; tl = tl->tl_data_next) 250 if ((unsigned)tl->tl_data_type == subfield) 251 break; 252 if (tl == NULL) { 253 strlcpy(buf, "", buf_len); 254 break; 255 } 256 257 switch (subfield) { 258 case KRB5_TL_PASSWORD: 259 snprintf(buf, buf_len, "\"%.*s\"", 260 (int)tl->tl_data_length, 261 (const char *)tl->tl_data_contents); 262 break; 263 case KRB5_TL_PKINIT_ACL: { 264 HDB_Ext_PKINIT_acl acl; 265 size_t size; 266 int ret; 267 size_t i; 268 269 ret = decode_HDB_Ext_PKINIT_acl(tl->tl_data_contents, 270 tl->tl_data_length, 271 &acl, 272 &size); 273 if (ret) { 274 snprintf(buf, buf_len, "failed to decode ACL"); 275 break; 276 } 277 278 buf[0] = '\0'; 279 for (i = 0; i < acl.len; i++) { 280 strlcat(buf, "subject: ", buf_len); 281 strlcat(buf, acl.val[i].subject, buf_len); 282 if (acl.val[i].issuer) { 283 strlcat(buf, " issuer:", buf_len); 284 strlcat(buf, *acl.val[i].issuer, buf_len); 285 } 286 if (acl.val[i].anchor) { 287 strlcat(buf, " anchor:", buf_len); 288 strlcat(buf, *acl.val[i].anchor, buf_len); 289 } 290 if (i + 1 < acl.len) 291 strlcat(buf, ", ", buf_len); 292 } 293 free_HDB_Ext_PKINIT_acl(&acl); 294 break; 295 } 296 case KRB5_TL_ALIASES: { 297 HDB_Ext_Aliases alias; 298 size_t size; 299 int ret; 300 size_t i; 301 302 ret = decode_HDB_Ext_Aliases(tl->tl_data_contents, 303 tl->tl_data_length, 304 &alias, 305 &size); 306 if (ret) { 307 snprintf(buf, buf_len, "failed to decode alias"); 308 break; 309 } 310 buf[0] = '\0'; 311 for (i = 0; i < alias.aliases.len; i++) { 312 char *p; 313 ret = krb5_unparse_name(context, &alias.aliases.val[i], &p); 314 if (ret) 315 break; 316 if (i > 0) 317 strlcat(buf, " ", buf_len); 318 strlcat(buf, p, buf_len); 319 free(p); 320 } 321 free_HDB_Ext_Aliases(&alias); 322 break; 323 } 324 default: 325 snprintf(buf, buf_len, "unknown type %d", subfield); 326 break; 327 } 328 break; 329 } 330 default: 331 strlcpy(buf, "<unknown>", buf_len); 332 break; 333 } 334 } 335 336 static void 337 print_entry_short(struct get_entry_data *data, kadm5_principal_ent_t princ) 338 { 339 char buf[1024]; 340 struct field_info *f; 341 342 for(f = data->chead; f != NULL; f = f->next) { 343 format_field(princ, f->ff->fieldvalue, f->ff->subvalue, buf, sizeof(buf), 1); 344 rtbl_add_column_entry_by_id(data->table, f->ff->fieldvalue, buf); 345 } 346 } 347 348 static void 349 print_entry_long(struct get_entry_data *data, kadm5_principal_ent_t princ) 350 { 351 char buf[1024]; 352 struct field_info *f; 353 int width = 0; 354 355 for(f = data->chead; f != NULL; f = f->next) { 356 int w = strlen(f->header ? f->header : f->ff->def_longheader); 357 if(w > width) 358 width = w; 359 } 360 for(f = data->chead; f != NULL; f = f->next) { 361 format_field(princ, f->ff->fieldvalue, f->ff->subvalue, buf, sizeof(buf), 0); 362 printf("%*s: %s\n", width, f->header ? f->header : f->ff->def_longheader, buf); 363 } 364 printf("\n"); 365 } 366 367 static int 368 do_get_entry(krb5_principal principal, void *data) 369 { 370 kadm5_principal_ent_rec princ; 371 krb5_error_code ret; 372 struct get_entry_data *e = data; 373 374 memset(&princ, 0, sizeof(princ)); 375 ret = kadm5_get_principal(kadm_handle, principal, 376 &princ, 377 e->mask | e->extra_mask); 378 if(ret) 379 return ret; 380 else { 381 (e->format)(e, &princ); 382 kadm5_free_principal_ent(kadm_handle, &princ); 383 } 384 return 0; 385 } 386 387 static void 388 free_columns(struct get_entry_data *data) 389 { 390 struct field_info *f, *next; 391 for(f = data->chead; f != NULL; f = next) { 392 free(f->header); 393 next = f->next; 394 free(f); 395 } 396 data->chead = NULL; 397 data->ctail = &data->chead; 398 } 399 400 static int 401 setup_columns(struct get_entry_data *data, const char *column_info) 402 { 403 char buf[1024], *q; 404 char *field, *header; 405 struct field_name *f; 406 407 while(strsep_copy(&column_info, ",", buf, sizeof(buf)) != -1) { 408 q = buf; 409 field = strsep(&q, "="); 410 header = strsep(&q, "="); 411 for(f = field_names; f->fieldname != NULL; f++) { 412 if(strcasecmp(field, f->fieldname) == 0) { 413 add_column(data, f, header); 414 break; 415 } 416 } 417 if(f->fieldname == NULL) { 418 krb5_warnx(context, "unknown field name \"%s\"", field); 419 free_columns(data); 420 return -1; 421 } 422 } 423 return 0; 424 } 425 426 static int 427 do_list_entry(krb5_principal principal, void *data) 428 { 429 char buf[1024]; 430 krb5_error_code ret; 431 432 ret = krb5_unparse_name_fixed_short(context, principal, buf, sizeof(buf)); 433 if (ret != 0) 434 return ret; 435 printf("%s\n", buf); 436 return 0; 437 } 438 439 static int 440 listit(const char *funcname, int argc, char **argv) 441 { 442 int i; 443 krb5_error_code ret, saved_ret = 0; 444 445 for (i = 0; i < argc; i++) { 446 ret = foreach_principal(argv[i], do_list_entry, funcname, NULL); 447 if (saved_ret == 0 && ret != 0) 448 saved_ret = ret; 449 } 450 return saved_ret != 0; 451 } 452 453 #define DEFAULT_COLUMNS_SHORT "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife" 454 #define DEFAULT_COLUMNS_LONG "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife,kvno,mkvno,last_success,last_failed,fail_auth_count,mod_time,mod_name,attributes,keytypes,pkinit-acl,aliases" 455 456 static int 457 getit(struct get_options *opt, const char *name, int argc, char **argv) 458 { 459 int i; 460 krb5_error_code ret; 461 struct get_entry_data data; 462 463 if(opt->long_flag == -1 && (opt->short_flag == 1 || opt->terse_flag == 1)) 464 opt->long_flag = 0; 465 if(opt->short_flag == -1 && (opt->long_flag == 1 || opt->terse_flag == 1)) 466 opt->short_flag = 0; 467 if(opt->terse_flag == -1 && (opt->long_flag == 1 || opt->short_flag == 1)) 468 opt->terse_flag = 0; 469 if(opt->long_flag == 0 && opt->short_flag == 0 && opt->terse_flag == 0) 470 opt->short_flag = 1; 471 472 if (opt->terse_flag) 473 return listit(name, argc, argv); 474 475 data.table = NULL; 476 data.chead = NULL; 477 data.ctail = &data.chead; 478 data.mask = 0; 479 data.extra_mask = 0; 480 481 if(opt->short_flag) { 482 data.table = rtbl_create(); 483 rtbl_set_separator(data.table, " "); 484 data.format = print_entry_short; 485 } else 486 data.format = print_entry_long; 487 if(opt->column_info_string == NULL) { 488 if(opt->long_flag) 489 ret = setup_columns(&data, DEFAULT_COLUMNS_LONG); 490 else 491 ret = setup_columns(&data, DEFAULT_COLUMNS_SHORT); 492 } else 493 ret = setup_columns(&data, opt->column_info_string); 494 495 if(ret != 0) { 496 if(data.table != NULL) 497 rtbl_destroy(data.table); 498 return 0; 499 } 500 501 for(i = 0; i < argc; i++) 502 ret = foreach_principal(argv[i], do_get_entry, name, &data); 503 504 if(data.table != NULL) { 505 rtbl_format(data.table, stdout); 506 rtbl_destroy(data.table); 507 } 508 free_columns(&data); 509 return ret != 0; 510 } 511 512 int 513 get_entry(struct get_options *opt, int argc, char **argv) 514 { 515 return getit(opt, "get", argc, argv); 516 } 517 518 int 519 list_princs(struct list_options *opt, int argc, char **argv) 520 { 521 if(sizeof(struct get_options) != sizeof(struct list_options)) { 522 krb5_warnx(context, "programmer error: sizeof(struct get_options) != sizeof(struct list_options)"); 523 return 0; 524 } 525 return getit((struct get_options*)opt, "list", argc, argv); 526 } 527
Indexes created Sun Mar 01 05:31:48 UTC 2026