crypto/external/bsd/heimdal/dist/kadmin/get.c

   1 /*      $NetBSD: get.c,v 1.3 2014/04/24 13:45:33 pettai Exp $   */
   2
   3 /*
   4  * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
   5  * (Royal Institute of Technology, Stockholm, Sweden).
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kadmin_locl.h"
  37 #include "kadmin-commands.h"
  38 #include <krb5/parse_units.h>
  39 #include <krb5/rtbl.h>
  40
  41 static struct field_name {
  42     const char *fieldname;
  43     unsigned int fieldvalue;
  44     unsigned int subvalue;
  45     uint32_t extra_mask;
  46     const char *default_header;
  47     const char *def_longheader;
  48     unsigned int flags;
  49 } field_names[] = {
  50     { "principal", KADM5_PRINCIPAL, 0, 0, "Principal", "Principal", 0 },
  51     { "princ_expire_time", KADM5_PRINC_EXPIRE_TIME, 0, 0, "Expiration", "Principal expires", 0 },
  52     { "pw_expiration", KADM5_PW_EXPIRATION, 0, 0, "PW-exp", "Password expires", 0 },
  53     { "last_pwd_change", KADM5_LAST_PWD_CHANGE, 0, 0, "PW-change", "Last password change", 0 },
  54     { "max_life", KADM5_MAX_LIFE, 0, 0, "Max life", "Max ticket life", 0 },
  55     { "max_rlife", KADM5_MAX_RLIFE, 0, 0, "Max renew", "Max renewable life", 0 },
  56     { "mod_time", KADM5_MOD_TIME, 0, 0, "Mod time", "Last modified", 0 },
  57     { "mod_name", KADM5_MOD_NAME, 0, 0, "Modifier", "Modifier", 0 },
  58     { "attributes", KADM5_ATTRIBUTES, 0, 0, "Attributes", "Attributes", 0 },
  59     { "kvno", KADM5_KVNO, 0, 0, "Kvno", "Kvno", RTBL_ALIGN_RIGHT  },
  60     { "mkvno", KADM5_MKVNO, 0, 0, "Mkvno", "Mkvno", RTBL_ALIGN_RIGHT },
  61     { "last_success", KADM5_LAST_SUCCESS, 0, 0, "Last login", "Last successful login", 0 },
  62     { "last_failed", KADM5_LAST_FAILED, 0, 0, "Last fail", "Last failed login", 0 },
  63     { "fail_auth_count", KADM5_FAIL_AUTH_COUNT, 0, 0, "Fail count", "Failed login count", RTBL_ALIGN_RIGHT },
  64     { "policy", KADM5_POLICY, 0, 0, "Policy", "Policy", 0 },
  65     { "keytypes", KADM5_KEY_DATA, 0, KADM5_PRINCIPAL, "Keytypes", "Keytypes", 0 },
  66     { "password", KADM5_TL_DATA, KRB5_TL_PASSWORD, KADM5_KEY_DATA, "Password", "Password", 0 },
  67     { "pkinit-acl", KADM5_TL_DATA, KRB5_TL_PKINIT_ACL, 0, "PK-INIT ACL", "PK-INIT ACL", 0 },
  68     { "aliases", KADM5_TL_DATA, KRB5_TL_ALIASES, 0, "Aliases", "Aliases", 0 },
  69     { .fieldname = NULL }
  70 };
  71
  72 struct field_info {
  73     struct field_name *ff;
  74     char *header;
  75     struct field_info *next;
  76 };
  77
  78 struct get_entry_data {
  79     void (*format)(struct get_entry_data*, kadm5_principal_ent_t);
  80     rtbl_t table;
  81     uint32_t mask;
  82     uint32_t extra_mask;
  83     struct field_info *chead, **ctail;
  84 };
  85
  86 static int
  87 add_column(struct get_entry_data *data, struct field_name *ff, const char *header)
  88 {
  89     struct field_info *f = malloc(sizeof(*f));
  90     if (f == NULL)
  91         return ENOMEM;
  92     f->ff = ff;
  93     if(header)
  94         f->header = strdup(header);
  95     else
  96         f->header = NULL;
  97     f->next = NULL;
  98     *data->ctail = f;
  99     data->ctail = &f->next;
 100     data->mask |= ff->fieldvalue;
 101     data->extra_mask |= ff->extra_mask;
 102     if(data->table != NULL)
 103         rtbl_add_column_by_id(data->table, ff->fieldvalue,
 104                               header ? header : ff->default_header, ff->flags);
 105     return 0;
 106 }
 107
 108 /*
 109  * return 0 iff `salt' actually is the same as the current salt in `k'
 110  */
 111
 112 static int
 113 cmp_salt (const krb5_salt *salt, const krb5_key_data *k)
 114 {
 115     if (salt->salttype != (size_t)k->key_data_type[1])
 116         return 1;
 117     if (salt->saltvalue.length != (size_t)k->key_data_length[1])
 118         return 1;
 119     return memcmp (salt->saltvalue.data, k->key_data_contents[1],
 120                    salt->saltvalue.length);
 121 }
 122
 123 static void
 124 format_keytype(krb5_key_data *k, krb5_salt *def_salt, char *buf, size_t buf_len)
 125 {
 126     krb5_error_code ret;
 127     char *s;
 128
 129     ret = krb5_enctype_to_string (context,
 130                                   k->key_data_type[0],
 131                                   &s);
 132     if (ret)
 133         asprintf (&s, "unknown(%d)", k->key_data_type[0]);
 134     strlcpy(buf, s, buf_len);
 135     free(s);
 136
 137     strlcat(buf, "(", buf_len);
 138
 139     ret = krb5_salttype_to_string (context,
 140                                    k->key_data_type[0],
 141                                    k->key_data_type[1],
 142                                    &s);
 143     if (ret)
 144         asprintf (&s, "unknown(%d)", k->key_data_type[1]);
 145     strlcat(buf, s, buf_len);
 146     free(s);
 147
 148     if (cmp_salt(def_salt, k) == 0)
 149         s = strdup("");
 150     else if(k->key_data_length[1] == 0)
 151         s = strdup("()");
 152     else
 153         asprintf (&s, "(%.*s)", k->key_data_length[1],
 154                   (char *)k->key_data_contents[1]);
 155     strlcat(buf, s, buf_len);
 156     free(s);
 157
 158     strlcat(buf, ")", buf_len);
 159 }
 160
 161 static void
 162 format_field(kadm5_principal_ent_t princ, unsigned int field,
 163              unsigned int subfield, char *buf, size_t buf_len, int condensed)
 164 {
 165     switch(field) {
 166     case KADM5_PRINCIPAL:
 167         if(condensed)
 168             krb5_unparse_name_fixed_short(context, princ->principal, buf, buf_len);
 169         else
 170             krb5_unparse_name_fixed(context, princ->principal, buf, buf_len);
 171         break;
 172
 173     case KADM5_PRINC_EXPIRE_TIME:
 174         time_t2str(princ->princ_expire_time, buf, buf_len, !condensed);
 175         break;
 176
 177     case KADM5_PW_EXPIRATION:
 178         time_t2str(princ->pw_expiration, buf, buf_len, !condensed);
 179         break;
 180
 181     case KADM5_LAST_PWD_CHANGE:
 182         time_t2str(princ->last_pwd_change, buf, buf_len, !condensed);
 183         break;
 184
 185     case KADM5_MAX_LIFE:
 186         deltat2str(princ->max_life, buf, buf_len);
 187         break;
 188
 189     case KADM5_MAX_RLIFE:
 190         deltat2str(princ->max_renewable_life, buf, buf_len);
 191         break;
 192
 193     case KADM5_MOD_TIME:
 194         time_t2str(princ->mod_date, buf, buf_len, !condensed);
 195         break;
 196
 197     case KADM5_MOD_NAME:
 198         if (princ->mod_name == NULL)
 199             strlcpy(buf, "unknown", buf_len);
 200         else if(condensed)
 201             krb5_unparse_name_fixed_short(context, princ->mod_name, buf, buf_len);
 202         else
 203             krb5_unparse_name_fixed(context, princ->mod_name, buf, buf_len);
 204         break;
 205     case KADM5_ATTRIBUTES:
 206         attributes2str (princ->attributes, buf, buf_len);
 207         break;
 208     case KADM5_KVNO:
 209         snprintf(buf, buf_len, "%d", princ->kvno);
 210         break;
 211     case KADM5_MKVNO:
 212         /* XXX libkadm5srv decrypts the keys, so mkvno is always 0. */
 213         strlcpy(buf, "unknown", buf_len);
 214         break;
 215     case KADM5_LAST_SUCCESS:
 216         time_t2str(princ->last_success, buf, buf_len, !condensed);
 217         break;
 218     case KADM5_LAST_FAILED:
 219         time_t2str(princ->last_failed, buf, buf_len, !condensed);
 220         break;
 221     case KADM5_FAIL_AUTH_COUNT:
 222         snprintf(buf, buf_len, "%d", princ->fail_auth_count);
 223         break;
 224     case KADM5_POLICY:
 225         if(princ->policy != NULL)
 226             strlcpy(buf, princ->policy, buf_len);
 227         else
 228             strlcpy(buf, "none", buf_len);
 229         break;
 230     case KADM5_KEY_DATA:{
 231         krb5_salt def_salt;
 232         int i;
 233         char buf2[1024];
 234         krb5_get_pw_salt (context, princ->principal, &def_salt);
 235
 236         *buf = '\0';
 237         for (i = 0; i < princ->n_key_data; ++i) {
 238             format_keytype(&princ->key_data[i], &def_salt, buf2, sizeof(buf2));
 239             if(i > 0)
 240                 strlcat(buf, ", ", buf_len);
 241             strlcat(buf, buf2, buf_len);
 242         }
 243         krb5_free_salt (context, def_salt);
 244         break;
 245     }
 246     case KADM5_TL_DATA: {
 247         krb5_tl_data *tl;
 248
 249         for (tl = princ->tl_data; tl != NULL; tl = tl->tl_data_next)
 250             if ((unsigned)tl->tl_data_type == subfield)
 251                 break;
 252         if (tl == NULL) {
 253             strlcpy(buf, "", buf_len);
 254             break;
 255         }
 256
 257         switch (subfield) {
 258         case KRB5_TL_PASSWORD:
 259             snprintf(buf, buf_len, "\"%.*s\"",
 260                      (int)tl->tl_data_length,
 261                      (const char *)tl->tl_data_contents);
 262             break;
 263         case KRB5_TL_PKINIT_ACL: {
 264             HDB_Ext_PKINIT_acl acl;
 265             size_t size;
 266             int ret;
 267             size_t i;
 268
 269             ret = decode_HDB_Ext_PKINIT_acl(tl->tl_data_contents,
 270                                             tl->tl_data_length,
 271                                             &acl,
 272                                             &size);
 273             if (ret) {
 274                 snprintf(buf, buf_len, "failed to decode ACL");
 275                 break;
 276             }
 277
 278             buf[0] = '\0';
 279             for (i = 0; i < acl.len; i++) {
 280                 strlcat(buf, "subject: ", buf_len);
 281                 strlcat(buf, acl.val[i].subject, buf_len);
 282                 if (acl.val[i].issuer) {
 283                     strlcat(buf, " issuer:", buf_len);
 284                     strlcat(buf, *acl.val[i].issuer, buf_len);
 285                 }
 286                 if (acl.val[i].anchor) {
 287                     strlcat(buf, " anchor:", buf_len);
 288                     strlcat(buf, *acl.val[i].anchor, buf_len);
 289                 }
 290                 if (i + 1 < acl.len)
 291                     strlcat(buf, ", ", buf_len);
 292             }
 293             free_HDB_Ext_PKINIT_acl(&acl);
 294             break;
 295         }
 296         case KRB5_TL_ALIASES: {
 297             HDB_Ext_Aliases alias;
 298             size_t size;
 299             int ret;
 300             size_t i;
 301
 302             ret = decode_HDB_Ext_Aliases(tl->tl_data_contents,
 303                                          tl->tl_data_length,
 304                                          &alias,
 305                                          &size);
 306             if (ret) {
 307                 snprintf(buf, buf_len, "failed to decode alias");
 308                 break;
 309             }
 310             buf[0] = '\0';
 311             for (i = 0; i < alias.aliases.len; i++) {
 312                 char *p;
 313                 ret = krb5_unparse_name(context, &alias.aliases.val[i], &p);
 314                 if (ret)
 315                     break;
 316                 if (i > 0)
 317                     strlcat(buf, " ", buf_len);
 318                 strlcat(buf, p, buf_len);
 319                 free(p);
 320             }
 321             free_HDB_Ext_Aliases(&alias);
 322             break;
 323         }
 324         default:
 325             snprintf(buf, buf_len, "unknown type %d", subfield);
 326             break;
 327         }
 328         break;
 329     }
 330     default:
 331         strlcpy(buf, "<unknown>", buf_len);
 332         break;
 333     }
 334 }
 335
 336 static void
 337 print_entry_short(struct get_entry_data *data, kadm5_principal_ent_t princ)
 338 {
 339     char buf[1024];
 340     struct field_info *f;
 341
 342     for(f = data->chead; f != NULL; f = f->next) {
 343         format_field(princ, f->ff->fieldvalue, f->ff->subvalue, buf, sizeof(buf), 1);
 344         rtbl_add_column_entry_by_id(data->table, f->ff->fieldvalue, buf);
 345     }
 346 }
 347
 348 static void
 349 print_entry_long(struct get_entry_data *data, kadm5_principal_ent_t princ)
 350 {
 351     char buf[1024];
 352     struct field_info *f;
 353     int width = 0;
 354
 355     for(f = data->chead; f != NULL; f = f->next) {
 356         int w = strlen(f->header ? f->header : f->ff->def_longheader);
 357         if(w > width)
 358             width = w;
 359     }
 360     for(f = data->chead; f != NULL; f = f->next) {
 361         format_field(princ, f->ff->fieldvalue, f->ff->subvalue, buf, sizeof(buf), 0);
 362         printf("%*s: %s\n", width, f->header ? f->header : f->ff->def_longheader, buf);
 363     }
 364     printf("\n");
 365 }
 366
 367 static int
 368 do_get_entry(krb5_principal principal, void *data)
 369 {
 370     kadm5_principal_ent_rec princ;
 371     krb5_error_code ret;
 372     struct get_entry_data *e = data;
 373
 374     memset(&princ, 0, sizeof(princ));
 375     ret = kadm5_get_principal(kadm_handle, principal,
 376                               &princ,
 377                               e->mask | e->extra_mask);
 378     if(ret)
 379         return ret;
 380     else {
 381         (e->format)(e, &princ);
 382         kadm5_free_principal_ent(kadm_handle, &princ);
 383     }
 384     return 0;
 385 }
 386
 387 static void
 388 free_columns(struct get_entry_data *data)
 389 {
 390     struct field_info *f, *next;
 391     for(f = data->chead; f != NULL; f = next) {
 392         free(f->header);
 393         next = f->next;
 394         free(f);
 395     }
 396     data->chead = NULL;
 397     data->ctail = &data->chead;
 398 }
 399
 400 static int
 401 setup_columns(struct get_entry_data *data, const char *column_info)
 402 {
 403     char buf[1024], *q;
 404     char *field, *header;
 405     struct field_name *f;
 406
 407     while(strsep_copy(&column_info, ",", buf, sizeof(buf)) != -1) {
 408         q = buf;
 409         field = strsep(&q, "=");
 410         header = strsep(&q, "=");
 411         for(f = field_names; f->fieldname != NULL; f++) {
 412             if(strcasecmp(field, f->fieldname) == 0) {
 413                 add_column(data, f, header);
 414                 break;
 415             }
 416         }
 417         if(f->fieldname == NULL) {
 418             krb5_warnx(context, "unknown field name \"%s\"", field);
 419             free_columns(data);
 420             return -1;
 421         }
 422     }
 423     return 0;
 424 }
 425
 426 static int
 427 do_list_entry(krb5_principal principal, void *data)
 428 {
 429     char buf[1024];
 430     krb5_error_code ret;
 431
 432     ret = krb5_unparse_name_fixed_short(context, principal, buf, sizeof(buf));
 433     if (ret != 0)
 434         return ret;
 435     printf("%s\n", buf);
 436     return 0;
 437 }
 438
 439 static int
 440 listit(const char *funcname, int argc, char **argv)
 441 {
 442     int i;
 443     krb5_error_code ret, saved_ret = 0;
 444
 445     for (i = 0; i < argc; i++) {
 446         ret = foreach_principal(argv[i], do_list_entry, funcname, NULL);
 447         if (saved_ret == 0 && ret != 0)
 448             saved_ret = ret;
 449     }
 450     return saved_ret != 0;
 451 }
 452
 453 #define DEFAULT_COLUMNS_SHORT "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife"
 454 #define DEFAULT_COLUMNS_LONG "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife,kvno,mkvno,last_success,last_failed,fail_auth_count,mod_time,mod_name,attributes,keytypes,pkinit-acl,aliases"
 455
 456 static int
 457 getit(struct get_options *opt, const char *name, int argc, char **argv)
 458 {
 459     int i;
 460     krb5_error_code ret;
 461     struct get_entry_data data;
 462
 463     if(opt->long_flag == -1 && (opt->short_flag == 1 || opt->terse_flag == 1))
 464         opt->long_flag = 0;
 465     if(opt->short_flag == -1 && (opt->long_flag == 1 || opt->terse_flag == 1))
 466         opt->short_flag = 0;
 467     if(opt->terse_flag == -1 && (opt->long_flag == 1 || opt->short_flag == 1))
 468         opt->terse_flag = 0;
 469     if(opt->long_flag == 0 && opt->short_flag == 0 && opt->terse_flag == 0)
 470         opt->short_flag = 1;
 471
 472     if (opt->terse_flag)
 473         return listit(name, argc, argv);
 474
 475     data.table = NULL;
 476     data.chead = NULL;
 477     data.ctail = &data.chead;
 478     data.mask = 0;
 479     data.extra_mask = 0;
 480
 481     if(opt->short_flag) {
 482         data.table = rtbl_create();
 483         rtbl_set_separator(data.table, "  ");
 484         data.format = print_entry_short;
 485     } else
 486         data.format = print_entry_long;
 487     if(opt->column_info_string == NULL) {
 488         if(opt->long_flag)
 489             ret = setup_columns(&data, DEFAULT_COLUMNS_LONG);
 490         else
 491             ret = setup_columns(&data, DEFAULT_COLUMNS_SHORT);
 492     } else
 493         ret = setup_columns(&data, opt->column_info_string);
 494
 495     if(ret != 0) {
 496         if(data.table != NULL)
 497             rtbl_destroy(data.table);
 498         return 0;
 499     }
 500
 501     for(i = 0; i < argc; i++)
 502         ret = foreach_principal(argv[i], do_get_entry, name, &data);
 503
 504     if(data.table != NULL) {
 505         rtbl_format(data.table, stdout);
 506         rtbl_destroy(data.table);
 507     }
 508     free_columns(&data);
 509     return ret != 0;
 510 }
 511
 512 int
 513 get_entry(struct get_options *opt, int argc, char **argv)
 514 {
 515     return getit(opt, "get", argc, argv);
 516 }
 517
 518 int
 519 list_princs(struct list_options *opt, int argc, char **argv)
 520 {
 521     if(sizeof(struct get_options) != sizeof(struct list_options)) {
 522         krb5_warnx(context, "programmer error: sizeof(struct get_options) != sizeof(struct list_options)");
 523         return 0;
 524     }
 525     return getit((struct get_options*)opt, "list", argc, argv);
 526 }