1 /* $NetBSD: mod.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $ */
4 * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #include "kadmin_locl.h"
37 #include "kadmin-commands.h"
40 add_tl(kadm5_principal_ent_rec
*princ
, int type
, krb5_data
*data
)
42 krb5_tl_data
*tl
, **ptl
;
44 tl
= ecalloc(1, sizeof(*tl
));
45 tl
->tl_data_next
= NULL
;
46 tl
->tl_data_type
= KRB5_TL_EXTENSION
;
47 tl
->tl_data_length
= data
->length
;
48 tl
->tl_data_contents
= data
->data
;
51 ptl
= &princ
->tl_data
;
53 ptl
= &(*ptl
)->tl_data_next
;
60 add_constrained_delegation(krb5_context contextp
,
61 kadm5_principal_ent_rec
*princ
,
62 struct getarg_strings
*strings
)
69 memset(&ext
, 0, sizeof(ext
));
70 ext
.mandatory
= FALSE
;
71 ext
.data
.element
= choice_HDB_extension_data_allowed_to_delegate_to
;
73 if (strings
->num_strings
== 1 && strings
->strings
[0][0] == '\0') {
74 ext
.data
.u
.allowed_to_delegate_to
.val
= NULL
;
75 ext
.data
.u
.allowed_to_delegate_to
.len
= 0;
80 ext
.data
.u
.allowed_to_delegate_to
.val
=
81 calloc(strings
->num_strings
,
82 sizeof(ext
.data
.u
.allowed_to_delegate_to
.val
[0]));
83 ext
.data
.u
.allowed_to_delegate_to
.len
= strings
->num_strings
;
85 for (i
= 0; i
< strings
->num_strings
; i
++) {
86 ret
= krb5_parse_name(contextp
, strings
->strings
[i
], &p
);
89 ret
= copy_Principal(p
, &ext
.data
.u
.allowed_to_delegate_to
.val
[i
]);
92 krb5_free_principal(contextp
, p
);
96 ASN1_MALLOC_ENCODE(HDB_extension
, buf
.data
, buf
.length
,
98 free_HDB_extension(&ext
);
101 if (buf
.length
!= size
)
104 add_tl(princ
, KRB5_TL_EXTENSION
, &buf
);
108 add_aliases(krb5_context contextp
, kadm5_principal_ent_rec
*princ
,
109 struct getarg_strings
*strings
)
118 memset(&ext
, 0, sizeof(ext
));
119 ext
.mandatory
= FALSE
;
120 ext
.data
.element
= choice_HDB_extension_data_aliases
;
121 ext
.data
.u
.aliases
.case_insensitive
= 0;
123 if (strings
->num_strings
== 1 && strings
->strings
[0][0] == '\0') {
124 ext
.data
.u
.aliases
.aliases
.val
= NULL
;
125 ext
.data
.u
.aliases
.aliases
.len
= 0;
127 ext
.data
.u
.aliases
.aliases
.val
=
128 calloc(strings
->num_strings
,
129 sizeof(ext
.data
.u
.aliases
.aliases
.val
[0]));
130 ext
.data
.u
.aliases
.aliases
.len
= strings
->num_strings
;
132 for (i
= 0; i
< strings
->num_strings
; i
++) {
133 ret
= krb5_parse_name(contextp
, strings
->strings
[i
], &p
);
134 ret
= copy_Principal(p
, &ext
.data
.u
.aliases
.aliases
.val
[i
]);
135 krb5_free_principal(contextp
, p
);
139 ASN1_MALLOC_ENCODE(HDB_extension
, buf
.data
, buf
.length
,
141 free_HDB_extension(&ext
);
144 if (buf
.length
!= size
)
147 add_tl(princ
, KRB5_TL_EXTENSION
, &buf
);
151 add_pkinit_acl(krb5_context contextp
, kadm5_principal_ent_rec
*princ
,
152 struct getarg_strings
*strings
)
160 memset(&ext
, 0, sizeof(ext
));
161 ext
.mandatory
= FALSE
;
162 ext
.data
.element
= choice_HDB_extension_data_pkinit_acl
;
163 ext
.data
.u
.aliases
.case_insensitive
= 0;
165 if (strings
->num_strings
== 1 && strings
->strings
[0][0] == '\0') {
166 ext
.data
.u
.pkinit_acl
.val
= NULL
;
167 ext
.data
.u
.pkinit_acl
.len
= 0;
169 ext
.data
.u
.pkinit_acl
.val
=
170 calloc(strings
->num_strings
,
171 sizeof(ext
.data
.u
.pkinit_acl
.val
[0]));
172 ext
.data
.u
.pkinit_acl
.len
= strings
->num_strings
;
174 for (i
= 0; i
< strings
->num_strings
; i
++) {
175 ext
.data
.u
.pkinit_acl
.val
[i
].subject
= estrdup(strings
->strings
[i
]);
179 ASN1_MALLOC_ENCODE(HDB_extension
, buf
.data
, buf
.length
,
181 free_HDB_extension(&ext
);
184 if (buf
.length
!= size
)
187 add_tl(princ
, KRB5_TL_EXTENSION
, &buf
);
191 do_mod_entry(krb5_principal principal
, void *data
)
194 kadm5_principal_ent_rec princ
;
196 struct modify_options
*e
= data
;
198 memset (&princ
, 0, sizeof(princ
));
199 ret
= kadm5_get_principal(kadm_handle
, principal
, &princ
,
200 KADM5_PRINCIPAL
| KADM5_ATTRIBUTES
|
201 KADM5_MAX_LIFE
| KADM5_MAX_RLIFE
|
202 KADM5_PRINC_EXPIRE_TIME
|
203 KADM5_PW_EXPIRATION
);
207 if(e
->max_ticket_life_string
||
208 e
->max_renewable_life_string
||
209 e
->expiration_time_string
||
210 e
->pw_expiration_time_string
||
211 e
->attributes_string
||
212 e
->kvno_integer
!= -1 ||
213 e
->constrained_delegation_strings
.num_strings
||
214 e
->alias_strings
.num_strings
||
215 e
->pkinit_acl_strings
.num_strings
) {
216 ret
= set_entry(context
, &princ
, &mask
,
217 e
->max_ticket_life_string
,
218 e
->max_renewable_life_string
,
219 e
->expiration_time_string
,
220 e
->pw_expiration_time_string
,
221 e
->attributes_string
);
222 if(e
->kvno_integer
!= -1) {
223 princ
.kvno
= e
->kvno_integer
;
226 if (e
->constrained_delegation_strings
.num_strings
) {
227 add_constrained_delegation(context
, &princ
,
228 &e
->constrained_delegation_strings
);
229 mask
|= KADM5_TL_DATA
;
231 if (e
->alias_strings
.num_strings
) {
232 add_aliases(context
, &princ
, &e
->alias_strings
);
233 mask
|= KADM5_TL_DATA
;
235 if (e
->pkinit_acl_strings
.num_strings
) {
236 add_pkinit_acl(context
, &princ
, &e
->pkinit_acl_strings
);
237 mask
|= KADM5_TL_DATA
;
241 ret
= edit_entry(&princ
, &mask
, NULL
, 0);
243 ret
= kadm5_modify_principal(kadm_handle
, &princ
, mask
);
245 krb5_warn(context
, ret
, "kadm5_modify_principal");
248 kadm5_free_principal_ent(kadm_handle
, &princ
);
253 mod_entry(struct modify_options
*opt
, int argc
, char **argv
)
255 krb5_error_code ret
= 0;
258 for(i
= 0; i
< argc
; i
++) {
259 ret
= foreach_principal(argv
[i
], do_mod_entry
, "mod", opt
);