crypto/dist/heimdal/kadmin/util.c

   1 /*
   2  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadmin_locl.h"
  35 #include <parse_units.h>
  36
  37 __RCSID("$Heimdal: util.c 21745 2007-07-31 16:11:25Z lha $"
  38         "$NetBSD$");
  39
  40 /*
  41  * util.c - functions for parsing, unparsing, and editing different
  42  * types of data used in kadmin.
  43  */
  44
  45 static int
  46 get_response(const char *prompt, const char *def, char *buf, size_t len);
  47
  48 /*
  49  * attributes
  50  */
  51
  52 struct units kdb_attrs[] = {
  53     { "allow-digest",           KRB5_KDB_ALLOW_DIGEST },
  54     { "allow-kerberos4",        KRB5_KDB_ALLOW_KERBEROS4 },
  55     { "trusted-for-delegation", KRB5_KDB_TRUSTED_FOR_DELEGATION },
  56     { "ok-as-delegate",         KRB5_KDB_OK_AS_DELEGATE },
  57     { "new-princ",              KRB5_KDB_NEW_PRINC },
  58     { "support-desmd5",         KRB5_KDB_SUPPORT_DESMD5 },
  59     { "pwchange-service",       KRB5_KDB_PWCHANGE_SERVICE },
  60     { "disallow-svr",           KRB5_KDB_DISALLOW_SVR },
  61     { "requires-pw-change",     KRB5_KDB_REQUIRES_PWCHANGE },
  62     { "requires-hw-auth",       KRB5_KDB_REQUIRES_HW_AUTH },
  63     { "requires-pre-auth",      KRB5_KDB_REQUIRES_PRE_AUTH },
  64     { "disallow-all-tix",       KRB5_KDB_DISALLOW_ALL_TIX },
  65     { "disallow-dup-skey",      KRB5_KDB_DISALLOW_DUP_SKEY },
  66     { "disallow-proxiable",     KRB5_KDB_DISALLOW_PROXIABLE },
  67     { "disallow-renewable",     KRB5_KDB_DISALLOW_RENEWABLE },
  68     { "disallow-tgt-based",     KRB5_KDB_DISALLOW_TGT_BASED },
  69     { "disallow-forwardable",   KRB5_KDB_DISALLOW_FORWARDABLE },
  70     { "disallow-postdated",     KRB5_KDB_DISALLOW_POSTDATED },
  71     { NULL }
  72 };
  73
  74 /*
  75  * convert the attributes in `attributes' into a printable string
  76  * in `str, len'
  77  */
  78
  79 void
  80 attributes2str(krb5_flags attributes, char *str, size_t len)
  81 {
  82     unparse_flags (attributes, kdb_attrs, str, len);
  83 }
  84
  85 /*
  86  * convert the string in `str' into attributes in `flags'
  87  * return 0 if parsed ok, else -1.
  88  */
  89
  90 int
  91 str2attributes(const char *str, krb5_flags *flags)
  92 {
  93     int res;
  94
  95     res = parse_flags (str, kdb_attrs, *flags);
  96     if (res < 0)
  97         return res;
  98     else {
  99         *flags = res;
 100         return 0;
 101     }
 102 }
 103
 104 /*
 105  * try to parse the string `resp' into attributes in `attr', also
 106  * setting the `bit' in `mask' if attributes are given and valid.
 107  */
 108
 109 int
 110 parse_attributes (const char *resp, krb5_flags *attr, int *mask, int bit)
 111 {
 112     krb5_flags tmp = *attr;
 113
 114     if (str2attributes(resp, &tmp) == 0) {
 115         *attr = tmp;
 116         if (mask)
 117             *mask |= bit;
 118         return 0;
 119     } else if(*resp == '?') {
 120         print_flags_table (kdb_attrs, stderr);
 121     } else {
 122         fprintf (stderr, "Unable to parse \"%s\"\n", resp);
 123     }
 124     return -1;
 125 }
 126
 127 /*
 128  * allow the user to edit the attributes in `attr', prompting with `prompt'
 129  */
 130
 131 int
 132 edit_attributes (const char *prompt, krb5_flags *attr, int *mask, int bit)
 133 {
 134     char buf[1024], resp[1024];
 135
 136     if (mask && (*mask & bit))
 137         return 0;
 138
 139     attributes2str(*attr, buf, sizeof(buf));
 140     for (;;) {
 141         if(get_response("Attributes", buf, resp, sizeof(resp)) != 0)
 142             return 1;
 143         if (resp[0] == '\0')
 144             break;
 145         if (parse_attributes (resp, attr, mask, bit) == 0)
 146             break;
 147     }
 148     return 0;
 149 }
 150
 151 /*
 152  * time_t
 153  * the special value 0 means ``never''
 154  */
 155
 156 /*
 157  * Convert the time `t' to a string representation in `str' (of max
 158  * size `len').  If include_time also include time, otherwise just
 159  * date.
 160  */
 161
 162 void
 163 time_t2str(time_t t, char *str, size_t len, int include_time)
 164 {
 165     if(t) {
 166         if(include_time)
 167             strftime(str, len, "%Y-%m-%d %H:%M:%S UTC", gmtime(&t));
 168         else
 169             strftime(str, len, "%Y-%m-%d", gmtime(&t));
 170     } else
 171         snprintf(str, len, "never");
 172 }
 173
 174 /*
 175  * Convert the time representation in `str' to a time in `time'.
 176  * Return 0 if succesful, else -1.
 177  */
 178
 179 int
 180 str2time_t (const char *str, time_t *t)
 181 {
 182     const char *p;
 183     struct tm tm, tm2;
 184
 185     memset (&tm, 0, sizeof (tm));
 186     memset (&tm2, 0, sizeof (tm2));
 187
 188     if(strcasecmp(str, "never") == 0) {
 189         *t = 0;
 190         return 0;
 191     }
 192
 193     if(strcasecmp(str, "now") == 0) {
 194         *t = time(NULL);
 195         return 0;
 196     }
 197
 198     p = strptime (str, "%Y-%m-%d", &tm);
 199
 200     if (p == NULL)
 201         return -1;
 202
 203     while(isspace((unsigned char)*p))
 204         p++;
 205
 206     /* XXX this is really a bit optimistic, we should really complain
 207        if there was a problem parsing the time */
 208     if(p[0] != '\0' && strptime (p, "%H:%M:%S", &tm2) != NULL) {
 209         tm.tm_hour = tm2.tm_hour;
 210         tm.tm_min  = tm2.tm_min;
 211         tm.tm_sec  = tm2.tm_sec;
 212     } else {
 213         /* Do it on the end of the day */
 214         tm.tm_hour = 23;
 215         tm.tm_min  = 59;
 216         tm.tm_sec  = 59;
 217     }
 218
 219     *t = tm2time (tm, 0);
 220     return 0;
 221 }
 222
 223 /*
 224  * try to parse the time in `resp' storing it in `value'
 225  */
 226
 227 int
 228 parse_timet (const char *resp, krb5_timestamp *value, int *mask, int bit)
 229 {
 230     time_t tmp;
 231
 232     if (str2time_t(resp, &tmp) == 0) {
 233         *value = tmp;
 234         if(mask)
 235             *mask |= bit;
 236         return 0;
 237     }
 238     if(*resp != '?')
 239         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 240     fprintf (stderr, "Print date on format YYYY-mm-dd [hh:mm:ss]\n");
 241     return -1;
 242 }
 243
 244 /*
 245  * allow the user to edit the time in `value'
 246  */
 247
 248 int
 249 edit_timet (const char *prompt, krb5_timestamp *value, int *mask, int bit)
 250 {
 251     char buf[1024], resp[1024];
 252
 253     if (mask && (*mask & bit))
 254         return 0;
 255
 256     time_t2str (*value, buf, sizeof (buf), 0);
 257
 258     for (;;) {
 259         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 260             return 1;
 261         if (parse_timet (resp, value, mask, bit) == 0)
 262             break;
 263     }
 264     return 0;
 265 }
 266
 267 /*
 268  * deltat
 269  * the special value 0 means ``unlimited''
 270  */
 271
 272 /*
 273  * convert the delta_t value in `t' into a printable form in `str, len'
 274  */
 275
 276 void
 277 deltat2str(unsigned t, char *str, size_t len)
 278 {
 279     if(t == 0 || t == INT_MAX)
 280         snprintf(str, len, "unlimited");
 281     else
 282         unparse_time(t, str, len);
 283 }
 284
 285 /*
 286  * parse the delta value in `str', storing result in `*delta'
 287  * return 0 if ok, else -1
 288  */
 289
 290 int
 291 str2deltat(const char *str, krb5_deltat *delta)
 292 {
 293     int res;
 294
 295     if(strcasecmp(str, "unlimited") == 0) {
 296         *delta = 0;
 297         return 0;
 298     }
 299     res = parse_time(str, "day");
 300     if (res < 0)
 301         return res;
 302     else {
 303         *delta = res;
 304         return 0;
 305     }
 306 }
 307
 308 /*
 309  * try to parse the string in `resp' into a deltad in `value'
 310  * `mask' will get the bit `bit' set if a value was given.
 311  */
 312
 313 int
 314 parse_deltat (const char *resp, krb5_deltat *value, int *mask, int bit)
 315 {
 316     krb5_deltat tmp;
 317
 318     if (str2deltat(resp, &tmp) == 0) {
 319         *value = tmp;
 320         if (mask)
 321             *mask |= bit;
 322         return 0;
 323     } else if(*resp == '?') {
 324         print_time_table (stderr);
 325     } else {
 326         fprintf (stderr, "Unable to parse time \"%s\"\n", resp);
 327     }
 328     return -1;
 329 }
 330
 331 /*
 332  * allow the user to edit the deltat in `value'
 333  */
 334
 335 int
 336 edit_deltat (const char *prompt, krb5_deltat *value, int *mask, int bit)
 337 {
 338     char buf[1024], resp[1024];
 339
 340     if (mask && (*mask & bit))
 341         return 0;
 342
 343     deltat2str(*value, buf, sizeof(buf));
 344     for (;;) {
 345         if(get_response(prompt, buf, resp, sizeof(resp)) != 0)
 346             return 1;
 347         if (parse_deltat (resp, value, mask, bit) == 0)
 348             break;
 349     }
 350     return 0;
 351 }
 352
 353 /*
 354  * allow the user to edit `ent'
 355  */
 356
 357 void
 358 set_defaults(kadm5_principal_ent_t ent, int *mask,
 359              kadm5_principal_ent_t default_ent, int default_mask)
 360 {
 361     if (default_ent
 362         && (default_mask & KADM5_MAX_LIFE)
 363         && !(*mask & KADM5_MAX_LIFE))
 364         ent->max_life = default_ent->max_life;
 365
 366     if (default_ent
 367         && (default_mask & KADM5_MAX_RLIFE)
 368         && !(*mask & KADM5_MAX_RLIFE))
 369         ent->max_renewable_life = default_ent->max_renewable_life;
 370
 371     if (default_ent
 372         && (default_mask & KADM5_PRINC_EXPIRE_TIME)
 373         && !(*mask & KADM5_PRINC_EXPIRE_TIME))
 374         ent->princ_expire_time = default_ent->princ_expire_time;
 375
 376     if (default_ent
 377         && (default_mask & KADM5_PW_EXPIRATION)
 378         && !(*mask & KADM5_PW_EXPIRATION))
 379         ent->pw_expiration = default_ent->pw_expiration;
 380
 381     if (default_ent
 382         && (default_mask & KADM5_ATTRIBUTES)
 383         && !(*mask & KADM5_ATTRIBUTES))
 384         ent->attributes = default_ent->attributes & ~KRB5_KDB_DISALLOW_ALL_TIX;
 385 }
 386
 387 int
 388 edit_entry(kadm5_principal_ent_t ent, int *mask,
 389            kadm5_principal_ent_t default_ent, int default_mask)
 390 {
 391
 392     set_defaults(ent, mask, default_ent, default_mask);
 393
 394     if(edit_deltat ("Max ticket life", &ent->max_life, mask,
 395                     KADM5_MAX_LIFE) != 0)
 396         return 1;
 397
 398     if(edit_deltat ("Max renewable life", &ent->max_renewable_life, mask,
 399                     KADM5_MAX_RLIFE) != 0)
 400         return 1;
 401
 402     if(edit_timet ("Principal expiration time", &ent->princ_expire_time, mask,
 403                    KADM5_PRINC_EXPIRE_TIME) != 0)
 404         return 1;
 405
 406     if(edit_timet ("Password expiration time", &ent->pw_expiration, mask,
 407                    KADM5_PW_EXPIRATION) != 0)
 408         return 1;
 409
 410     if(edit_attributes ("Attributes", &ent->attributes, mask,
 411                         KADM5_ATTRIBUTES) != 0)
 412         return 1;
 413
 414     return 0;
 415 }
 416
 417 /*
 418  * Parse the arguments, set the fields in `ent' and the `mask' for the
 419  * entries having been set.
 420  * Return 1 on failure and 0 on success.
 421  */
 422
 423 int
 424 set_entry(krb5_context context,
 425           kadm5_principal_ent_t ent,
 426           int *mask,
 427           const char *max_ticket_life,
 428           const char *max_renewable_life,
 429           const char *expiration,
 430           const char *pw_expiration,
 431           const char *attributes)
 432 {
 433     if (max_ticket_life != NULL) {
 434         if (parse_deltat (max_ticket_life, &ent->max_life,
 435                           mask, KADM5_MAX_LIFE)) {
 436             krb5_warnx (context, "unable to parse `%s'", max_ticket_life);
 437             return 1;
 438         }
 439     }
 440     if (max_renewable_life != NULL) {
 441         if (parse_deltat (max_renewable_life, &ent->max_renewable_life,
 442                           mask, KADM5_MAX_RLIFE)) {
 443             krb5_warnx (context, "unable to parse `%s'", max_renewable_life);
 444             return 1;
 445         }
 446     }
 447
 448     if (expiration) {
 449         if (parse_timet (expiration, &ent->princ_expire_time,
 450                         mask, KADM5_PRINC_EXPIRE_TIME)) {
 451             krb5_warnx (context, "unable to parse `%s'", expiration);
 452             return 1;
 453         }
 454     }
 455     if (pw_expiration) {
 456         if (parse_timet (pw_expiration, &ent->pw_expiration,
 457                          mask, KADM5_PW_EXPIRATION)) {
 458             krb5_warnx (context, "unable to parse `%s'", pw_expiration);
 459             return 1;
 460         }
 461     }
 462     if (attributes != NULL) {
 463         if (parse_attributes (attributes, &ent->attributes,
 464                               mask, KADM5_ATTRIBUTES)) {
 465             krb5_warnx (context, "unable to parse `%s'", attributes);
 466             return 1;
 467         }
 468     }
 469     return 0;
 470 }
 471
 472 /*
 473  * Does `string' contain any globing characters?
 474  */
 475
 476 static int
 477 is_expression(const char *string)
 478 {
 479     const char *p;
 480     int quote = 0;
 481
 482     for(p = string; *p; p++) {
 483         if(quote) {
 484             quote = 0;
 485             continue;
 486         }
 487         if(*p == '\\')
 488             quote++;
 489         else if(strchr("[]*?", *p) != NULL)
 490             return 1;
 491     }
 492     return 0;
 493 }
 494
 495 /*
 496  * Loop over all principals matching exp.  If any of calls to `func'
 497  * failes, the first error is returned when all principals are
 498  * processed.
 499  */
 500 int
 501 foreach_principal(const char *exp_str,
 502                   int (*func)(krb5_principal, void*),
 503                   const char *funcname,
 504                   void *data)
 505 {
 506     char **princs;
 507     int num_princs;
 508     int i;
 509     krb5_error_code saved_ret = 0, ret = 0;
 510     krb5_principal princ_ent;
 511     int is_expr;
 512
 513     /* if this isn't an expression, there is no point in wading
 514        through the whole database looking for matches */
 515     is_expr = is_expression(exp_str);
 516     if(is_expr)
 517         ret = kadm5_get_principals(kadm_handle, exp_str, &princs, &num_princs);
 518     if(!is_expr || ret == KADM5_AUTH_LIST) {
 519         /* we might be able to perform the requested opreration even
 520            if we're not allowed to list principals */
 521         num_princs = 1;
 522         princs = malloc(sizeof(*princs));
 523         if(princs == NULL)
 524             return ENOMEM;
 525         princs[0] = strdup(exp_str);
 526         if(princs[0] == NULL){
 527             free(princs);
 528             return ENOMEM;
 529         }
 530     } else if(ret) {
 531         krb5_warn(context, ret, "kadm5_get_principals");
 532         return ret;
 533     }
 534     for(i = 0; i < num_princs; i++) {
 535         ret = krb5_parse_name(context, princs[i], &princ_ent);
 536         if(ret){
 537             krb5_warn(context, ret, "krb5_parse_name(%s)", princs[i]);
 538             continue;
 539         }
 540         ret = (*func)(princ_ent, data);
 541         if(ret) {
 542             krb5_clear_error_string(context);
 543             krb5_warn(context, ret, "%s %s", funcname, princs[i]);
 544             if (saved_ret == 0)
 545                 saved_ret = ret;
 546         }
 547         krb5_free_principal(context, princ_ent);
 548     }
 549     if (ret == 0 && saved_ret != 0)
 550         ret = saved_ret;
 551     kadm5_free_name_list(kadm_handle, princs, &num_princs);
 552     return ret;
 553 }
 554
 555 /*
 556  * prompt with `prompt' and default value `def', and store the reply
 557  * in `buf, len'
 558  */
 559
 560 #include <setjmp.h>
 561
 562 static jmp_buf jmpbuf;
 563
 564 static void
 565 interrupt(int sig)
 566 {
 567     longjmp(jmpbuf, 1);
 568 }
 569
 570 static int
 571 get_response(const char *prompt, const char *def, char *buf, size_t len)
 572 {
 573     char *p;
 574     void (*osig)(int);
 575
 576     osig = signal(SIGINT, interrupt);
 577     if(setjmp(jmpbuf)) {
 578         signal(SIGINT, osig);
 579         fprintf(stderr, "\n");
 580         return 1;
 581     }
 582
 583     fprintf(stderr, "%s [%s]:", prompt, def);
 584     if(fgets(buf, len, stdin) == NULL) {
 585         int save_errno = errno;
 586         if(ferror(stdin))
 587             krb5_err(context, 1, save_errno, "<stdin>");
 588         signal(SIGINT, osig);
 589         return 1;
 590     }
 591     p = strchr(buf, '\n');
 592     if(p)
 593         *p = '\0';
 594     if(strcmp(buf, "") == 0)
 595         strlcpy(buf, def, len);
 596     signal(SIGINT, osig);
 597     return 0;
 598 }
 599
 600 /*
 601  * return [0, 16) or -1
 602  */
 603
 604 static int
 605 hex2n (char c)
 606 {
 607     static char hexdigits[] = "0123456789abcdef";
 608     const char *p;
 609
 610     p = strchr (hexdigits, tolower((unsigned char)c));
 611     if (p == NULL)
 612         return -1;
 613     else
 614         return p - hexdigits;
 615 }
 616
 617 /*
 618  * convert a key in a readable format into a keyblock.
 619  * return 0 iff succesful, otherwise `err' should point to an error message
 620  */
 621
 622 int
 623 parse_des_key (const char *key_string, krb5_key_data *key_data,
 624                const char **error)
 625 {
 626     const char *p = key_string;
 627     unsigned char bits[8];
 628     int i;
 629
 630     if (strlen (key_string) != 16) {
 631         *error = "bad length, should be 16 for DES key";
 632         return 1;
 633     }
 634     for (i = 0; i < 8; ++i) {
 635         int d1, d2;
 636
 637         d1 = hex2n(p[2 * i]);
 638         d2 = hex2n(p[2 * i + 1]);
 639         if (d1 < 0 || d2 < 0) {
 640             *error = "non-hex character";
 641             return 1;
 642         }
 643         bits[i] = (d1 << 4) | d2;
 644     }
 645     for (i = 0; i < 3; ++i) {
 646         key_data[i].key_data_ver  = 2;
 647         key_data[i].key_data_kvno = 0;
 648         /* key */
 649         key_data[i].key_data_type[0]     = ETYPE_DES_CBC_CRC;
 650         key_data[i].key_data_length[0]   = 8;
 651         key_data[i].key_data_contents[0] = malloc(8);
 652         if (key_data[i].key_data_contents[0] == NULL) {
 653             *error = "malloc";
 654             return ENOMEM;
 655         }
 656         memcpy (key_data[i].key_data_contents[0], bits, 8);
 657         /* salt */
 658         key_data[i].key_data_type[1]     = KRB5_PW_SALT;
 659         key_data[i].key_data_length[1]   = 0;
 660         key_data[i].key_data_contents[1] = NULL;
 661     }
 662     key_data[0].key_data_type[0] = ETYPE_DES_CBC_MD5;
 663     key_data[1].key_data_type[0] = ETYPE_DES_CBC_MD4;
 664     return 0;
 665 }