--- /dev/null
+# Sanitize.in for Kerberos V5
+
+# Each directory to survive it's way into a release will need a file
+# like this one called "./.Sanitize". All keyword lines must exist,
+# and must exist in the order specified by this file. Each directory
+# in the tree will be processed, top down, in the following order.
+
+# Hash started lines like this one are comments and will be deleted
+# before anything else is done. Blank lines will also be squashed
+# out.
+
+# The lines between the "Do-first:" line and the "Things-to-keep:"
+# line are executed as a /bin/sh shell script before anything else is
+# done in this
+
+Do-first:
+
+# All files listed between the "Things-to-keep:" line and the
+# "Files-to-sed:" line will be kept. All other files will be removed.
+# Directories listed in this section will have their own Sanitize
+# called. Directories not listed will be removed in their entirety
+# with rm -rf.
+
+Things-to-keep:
+
+.cvsignore
+ChangeLog
+Makefile.in
+adm_conn.c
+adm_kw_dec.c
+adm_kw_enc.c
+adm_kt_dec.c
+adm_kt_enc.c
+adm_rw.c
+alt_prof.c
+configure.in
+configure
+keysalt.c
+krb5strings.M
+logger.c
+str_conv.c
+t_dbentry.c
+t_ktentry.c
+
+Things-to-lose:
+
+Do-last:
+
+# End of file.
--- /dev/null
+Thu Jun 13 22:12:21 1996 Tom Yu <tlyu@voltage-multiplier.mit.edu>
+
+ * configure.in: remove ref to ET_RULES
+
+Mon Jun 10 21:42:26 1996 Theodore Ts'o <tytso@rsts-11.mit.edu>
+
+ * adm_conn.c:
+ * adm_kw_dec.c:
+ * adm_kw_enc.c: Change use of _WINDOWS to _MSDOS, and add check
+ for _WIN32
+
+Tue May 21 20:51:06 1996 Sam Hartman <hartmans@mit.edu>
+
+ * Makefile.in (check-unix): Use KRB5_RUN_FLAGS
+
+Sun May 12 00:46:57 1996 Marc Horowitz <marc@mit.edu>
+
+ * alt_prof.c (krb5_read_realm_params): added "acl_file" variable
+ for the admin server.
+
+Wed Mar 13 17:37:00 1996 Ken Raeburn <raeburn@cygnus.com>
+
+ * configure.in: Use AC_HEADER_STDARG.
+
+Sun Dec 10 11:02:56 1995 Ezra Peisach <epeisach@kangaroo.mit.edu>
+
+ * str_conv.c (krb5_input_flag_to_string): Add new routine.
+
+Wed Nov 8 02:46:54 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * alt_prof.c (krb5_free_realm_params): Free the realm_kdc_ports
+ element of the structure.
+
+Fri Oct 6 00:30:16 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * Makefile.in: Remove ##DOS!include of config/windows.in.
+ config/windows.in is now included by wconfig.
+
+ * logger.c (klog_vsyslog): Make the logs less verbose, by omitting
+ the hostname, pid, etc. information.
+
+Thu Oct 5 19:46:40 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * alt_prof.c (krb5_read_realm_params): Remove the profile
+ relation, since it's really a bad idea. Removed the
+ "port" and "secondary_port" relations, and replaced them
+ with the "kdc_port" relation, which takes a list of ports.
+
+Mon Oct 2 15:08:53 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * logger.c (krb5_klog_init): If the log file can't be opened,
+ print an intelligent error message.
+
+Thu Oct 5 12:06:35 1995 Ezra Peisach <epeisach@kangaroo.mit.edu>
+
+ * alt_prof.c (krb5_read_realm_params): If secure flag is set in
+ context, do not allow for environment variables to specify
+ configuration files.
+
+Tue Sep 26 02:31:38 1995 Mark Eichin <eichin@cygnus.com>
+
+ * adm_conn.c (kadm_get_creds): zero out creds->server after
+ freeing it to protect later attempts.
+
+Fri Sep 29 17:06:18 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * logger.c: #ifdef the entire file so it's not built under Windows.
+
+Tue Sep 27 12:00:00 1995 <jrivlin@fusion.com>
+
+ * adm_kw_dec.c (krb5_adm_proto_to_dbent): Routine removed for
+ Windows and Mac to match with the prototype.
+
+ * adm_kw_dec.c (krb5_adm_dbent_to_proto): Routine removed for
+ Windows and Mac to match with the prototype.
+
+Tue Sep 26 16:24:00 1995 <tytso@rsts-11.mit.edu>
+
+ * alt_prof.c (krb5_read_realm_params): On an error, initialize the
+ returned rparams pointer to NULL.
+
+Mon Sep 25 16:54:18 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * Makefile.in: Removed "foo:: foo-$(WHAT)" lines from the
+ Makefile.
+
+Fri Sep 22 12:00:00 1995 James Mattly <mattly@fusion.com>
+
+ * adm_conn.c: for sockets changed close to closesocket, sockets on
+ macintosh arn't files.
+
+Fri Sep 22 15:44:02 1995 Mark Eichin <eichin@cygnus.com>
+
+ * logger.c (klog_com_err_proc): pass whoami in failure messages
+ for error log failures to match format string.
+
+Wed Sep 13 10:45:25 1995 Keith Vetter (keithv@fusion.com)
+
+ * keysalt.c: 16/32 bit integer mismatch.
+ * str_conv.c: sftime_format_table is conditional upon HAVE_STRFTIME,
+ cast some constants to long so that math wouldn't overflow,
+ 16/32 bit integer size mismatch.
+
+Wed Sep 13 18:17:30 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * alt_prof.c (krb5_read_realm_params): Fix memory leak. Free the
+ default realm when we're done. Remove the "profile"
+ parameter from the kdc.conf file. This is bad idea,
+ architecturally.
+
+Tue Sep 12 13:18:42 1995 Ezra Peisach <epeisach@kangaroo.mit.edu>
+
+ * adm_conn.c: For Macintosh hardwire cache name. Various casting
+ fixes.
+
+Thu Sep 7 17:50:15 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * adm_conn.c (kadm_get_creds): Use KRB5_ADM_SERVICE_INSTANCE for
+ the instance name, instead of KRB5_ADM_SERVICE_NAME.
+
+Wed Sep 06 14:20:57 1995 Chris Provenzano (proven@mit.edu)
+
+ * adm_kt_dec.c, adm_kt_enc.c, alt_prof.c, keysalt.c, str_conv.c :
+ s/keytype/enctype/g, s/KEYTYPE/ENCTYPE/g
+
+Tue Sep 05 22:10:34 1995 Chris Provenzano (proven@mit.edu)
+
+ * adm_kt_dec.c, adm_kt_enc.c, alt_prof.c, str_conv.c:
+ Remove krb5_enctype references, and replace
+ with krb5_keytype where appropriate
+
+Tue Aug 29 15:31:50 EDT 1995 Paul Park (pjpark@mit.edu)
+ * .Sanitize, krb5strings.M - Add new manpage describing string syntax
+ for common datatypes handled by str_conv.c.
+
+Thu Aug 24 18:53:32 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * .Sanitize: Update file list
+
+Mon Aug 21 17:07:56 EDT 1995 Paul Park (pjpark@mit.edu)
+ * str_conv.c - Add krb5_timestamp_to_sfstring(). This converts time
+ to a short string, potentially filled. Use strftime() for
+ krb5_timestamp_to_string() if present so that locale-dependent
+ time format is used.
+
+
+Tue Aug 8 17:35:10 EDT 1995 Paul Park (pjpark@mit.edu)
+ * str_conv.c - Fix Purify complaint.
+
+
+Mon Aug 7 17:38:45 EDT 1995 Paul Park (pjpark@mit.edu)
+ * keysalt.c(krb5_string_to_keysalt) - Don't do the silly whitespace
+ filling logic. If the string has imbedded whitespace, then
+ it's just tough rocks. Save replaced string separators and
+ terminators so that they string looks the same coming out as
+ going in.
+
+
+Fri Aug 4 16:21:50 EDT 1995 Paul Park (pjpark@mit.edu)
+ * Makefile.in, .Sanitize, keysalt.c - Add keysalt.c modules.
+
+
+Thu Aug 3 11:51:14 EDT 1995 Paul Park (pjpark@mit.edu)
+ * alt_prof.c - Actually pass back the parsed string value in krb5_aprof_
+ get_deltat().
+
+
+Mon Jul 31 15:52:40 EDT 1995 Paul Park (pjpark@mit.edu)
+ * adm_kw_{enc,dec}.c - Add support for new kadmin protocol.
+ * alt_prof.c - Remove string conversion routine, use the ones in str_
+ conv.c. Convert krb5_read_realm_params() to use these string
+ conversion routines so that the KDC profile is more textual
+ as opposed to being numeric.
+ * str_conv.c - String conversion routines.
+ * Makefile.in, configure.in - Add support for str_conv.c
+ * t_dbentry.c - Test new kadmin protocol.
+
+Mon Jul 17 15:16:26 EDT 1995 Paul Park (pjpark@mit.edu)
+ * alt_prof.c - Add krb5_{read,free}_realm_params() to read in per-
+ realm KDC data and to free the allocated structure.
+
+Mon Jul 10 17:59:23 1995 Ezra Peisach <epeisach@kangaroo.mit.edu>
+
+ * adm_kt_dec.c, adm_kt_enc.c, adm_kw_dec.c, adm_kw_enc.c,
+ alt_prof.c, logger.c: Include adm_proto.h for prototypes.
+
+Fri Jul 7 16:23:57 EDT 1995 Paul Park (pjpark@mit.edu)
+ * Makefile.in - Remove LDFLAGS, it's set by configure. Find com_err
+ library in TOPLIBD now.
+
+Thu Jul 6 17:34:22 1995 Tom Yu <tlyu@lothlorien.MIT.EDU>
+
+ * adm_conn.c (kadm_get_creds): Pass kcontext to os_localaddr.
+
+Tue Jun 27 15:50:31 EDT 1995 Paul Park (pjpark@mit.edu)
+ * alt_prof.c - Change filename and hierarchy lists to be const char.
+
+
+Thu Jun 22 11:56:15 EDT 1995 Paul Park (pjpark@mit.edu)
+ * alt_prof.c - New jacket routines for handling profiles. This includes
+ the ability to parse certain string values to appropriate types
+ (e.g. delta time or 32-bit integer).
+ * Makefile.in - Add alt_prof.c
+
+
+Thu Jun 15 18:03:40 EDT 1995 Paul Park (pjpark@mit.edu)
+ * Makefile.in - Remove explicit copying of archive library to library
+ directory.
+ * configure.in - Create symlink for archive when we build it.
+
+Wed Jun 14 14:36:13 1995 Sam Hartman <hartmans@tardis.MIT.EDU>
+
+ * t_dbentry.c (main): option should be an int so that comparisons
+ against EOF work when char unsigned.
+
+Tue Jun 13 14:37:25 1995 Sam Hartman <hartmans@tardis.MIT.EDU>
+
+ * logger.c: Don't check to make sure unix is defined for
+ DEVICE_OPEN et al. Currently, there are no special cases where
+ special handling is required; if they are, then they should be
+ checked for, and the generic case taken if no special case fits.
+ The previous behavior broke under AIX.
+
+
+Sun Jun 11 09:24:06 1995 Ezra Peisach <epeisach@kangaroo.mit.edu>
+
+ * Makefile.in (clean-unix): Remove $(UNIX_OBJS)
+
+Sat Jun 10 23:05:23 1995 Tom Yu (tlyu@dragons-lair)
+
+ * adm_conn.c, adm_rw.c: krb5_auth_context redefinitions
+
+Fri Jun 9 19:26:44 1995 <tytso@rsx-11.mit.edu>
+
+ * configure.in: Remove standardized set of autoconf macros, which
+ are now handled by CONFIG_RULES.
+
+Thu Jun 8 23:32:28 1995 Theodore Y. Ts'o <tytso@dcl>
+
+ * Makefile.in: $($(WHAT)_OBJS) is not accepted by all Makes! We
+ assume for now that libkadm.a rule is only used by Unix,
+ which should be a valid assumption, and build handle
+ $(UNIX_OBJS) there.
+
+Thu Jun 8 14:32:33 EDT 1995 Paul Park (pjpark@mit.edu)
+ * logger.c - New module to provide profile-controlled logging. This
+ can optionally take over control of com_err(3) output to also
+ direct this output to where the profile specifies. Also
+ includes a syslog(3) compatible interface which also follows
+ the profile's direction.
+ * Makefile.in, configure.in - update for logger.c
+
+
+Mon Jun 5 14:15:37 EDT 1995 Paul Park (pjpark@mit.edu)
+ * adm_conn.c - Rework kadm_get_ccache() and kadm_get_creds() so that
+ we can specify differing credentials caches and the lifetime
+ of obtained tickets if not using an existing ccache. This
+ changes the calling sequence of krb5_adm_connect(), adding
+ two arguments: a ccache name and a (delta) lifetime. Default
+ ccache name changes formats to tkt_kadm_<pid> and default
+ lifetime is 10 minutes.
+
+Fri Jun 2 17:56:03 1995 Keith Vetter (keithv@fusion.com)
+
+ * adm_conn.c: used SOCKET_ERRNO instead of errno and
+ added prototypes for the local functions.
+ * adm_rw.c: added prototypes for the local functions so that
+ ints get promoted to longs correctly on the PC.
+
+Wed May 31 08:10:13 1995 Ezra Peisach <epeisach@kangaroo.mit.edu>
+
+ * Makefile.in (DB_OBJS): Change DBOBJS to DB_OBJS to match rest of
+ Makefile.in
+
+Tue May 30 17:36:47 1995 Keith Vetter (keithv@fusion.com)
+
+ * adm_rw.c: removed INTERFACE from two routines.
+
+Tue May 30 10:35:07 1995 Keith Vetter (keithv@fusion.com)
+
+ * adm_conn.c: used Windows specific way of creating a temp file.
+ * Makefile.in: PC doesn't need to compile adm_kw_*.c files.
+
+Thu May 25 17:49:06 1995 Keith Vetter (keithv@fusion.com)
+
+ First pass to make the code compile cleanly on the PC.
+ * Makefile.in: made to work on the PC.
+ * adm_conn.c: used atoi instead of sscanf since it can't be
+ used in a windows DLL. Why not? Ask Microsoft.
+ * adm_kt_e.c, adm_kw_e.c, adm_rw.c: made the explicit the
+ cast to a char when pulling out bytes from an int.
+ * adm_kw_d.c: size_t != off_t on the PC. Fixed the equation.
+ * adm_rw.c: two parameters were declared as int but prototyped
+ as krb5_int32.
+
+Tue May 16 13:58:30 EDT 1995 Paul Park (pjpark@mit.edu)
+ * configure.in - Check for srand48, srand and srandom along with
+ network libraries.
+ * t_ktentry.c, t_dbentry.c - Use available random number generator
+ and also make sure memory is freed so we don't
+ chew up memory in tester.
+
+
+Tue May 16 13:19:04 EDT 1995 Paul Park (pjpark@mit.edu)
+ * t_dbentry.c - Change isset to is_a_set to keep Ultrix happy. Also
+ correctly calculate the length of the standard pwd.
+ so that we don't overwrite the end of the malloc()ed
+ string.
+ * t_ktentry.c - Remove isset logic, no differentiation for keytabs.
+
+
+Tue May 16 10:35:54 EDT 1995 Paul Park (pjpark@mit.edu)
+ * t_dbentry.c, t_ktentry.c - new test modules for encode/decode
+ functions. These convert to and from krb5_db_entry and
+ krb5_keytab_entry and verify contents.
+ * adm_kt_enc.c - Fix bug encoding integer values.
+
+
+Tue May 9 15:21:49 EDT 1995 Paul Park (pjpark@mit.edu)
+ * adm_conn.c - use profile information to locate the admin_server.
+ Also, return the correct value from krb5_adm_connect
+ instead of always returning zero.
+ * adm_{kw,kt}_{enc,dec}.c - New modules to [en/de]code administrative
+ protocol keyword=value pairs and keytab entries.
+
+
+Fri Apr 28 09:47:29 EDT 1995 Paul Park (pjpark@mit.edu)
+
+ Create a new library consisting of functions which communicate with
+ the administrative server here. These modules replace the originals
+ which used to be in libkrb5.
+
+ adm_rw.c - Remove ntohl/htonl in favor of byte blasting.
+
--- /dev/null
+CFLAGS = $(CCOPTS) $(DEFS)
+
+##DOSBUILDTOP = ..\..
+##DOSLIBNAME=kadm.lib
+RUN_SETUP=@KRB5_RUN_ENV@
+BASE_OBJS= adm_conn.$(OBJEXT) \
+ adm_kt_dec.$(OBJEXT) \
+ adm_kt_enc.$(OBJEXT) \
+ adm_rw.$(OBJEXT) \
+ alt_prof.$(OBJEXT) \
+ str_conv.$(OBJEXT) \
+ keysalt.$(OBJEXT)
+
+UNIX_OBJS = logger.$(OBJEXT)
+
+DB_OBJS= adm_kw_dec.$(OBJEXT) \
+ adm_kw_enc.$(OBJEXT)
+
+OBJS= $(BASE_OBJS) $(DB_OBJS)
+
+SRCS= $(srcdir)/adm_conn.c \
+ $(srcdir)/adm_kt_dec.c \
+ $(srcdir)/adm_kt_enc.c \
+ $(srcdir)/adm_rw.c \
+ $(srcdir)/adm_kw_dec.c \
+ $(srcdir)/adm_kw_enc.c \
+ $(srcdir)/logger.c \
+ $(srcdir)/alt_prof.c \
+ $(srcdir)/str_conv.c \
+ $(srcdir)/keysalt.c
+
+all:: $(BASE_OBJS)
+
+all-unix:: $(DB_OBJS) $(UNIX_OBJS)
+all-unix:: libkadm.a
+all-mac:: $(DB_OBJS)
+all-windows::
+
+libkadm.a: $(OBJS) $(UNIX_OBJS)
+ $(RM) $@
+ $(ARADD) $@ $(OBJS) $(UNIX_OBJS)
+ $(RANLIB) $@
+
+install:: libkadm.a
+ $(INSTALL_DATA) libkadm.a $(DESTDIR)$(KRB5_LIBDIR)/libkadm.a
+ $(RANLIB) $(DESTDIR)$(KRB5_LIBDIR)/libkadm.a
+
+clean-unix::
+ $(RM) libkadm.$(LIBEXT) $(UNIX_OBJS)
+clean-mac::
+ $(RM) libkadm.$(LIBEXT)
+clean-windows::
+ $(RM) kadm.lib kadm.bak
+
+#
+# t_dbentry
+#
+T_DBENTRY_OBJS = t_dbentry.$(OBJEXT) \
+ $(TOPLIBD)/libkadm.a $(TOPLIBD)/libkdb5.a \
+ $(TOPLIBD)/libkrb5.a $(TOPLIBD)/libcrypto.a \
+ $(TOPLIBD)/libcom_err.a
+
+t_dbentry: $(T_DBENTRY_OBJS)
+ $(LD) -o t_dbentry $(T_DBENTRY_OBJS) $(LIBS)
+
+#
+# t_ktentry
+#
+T_KTENTRY_OBJS = t_ktentry.$(OBJEXT) \
+ $(TOPLIBD)/libkadm.a $(TOPLIBD)/libkrb5.a \
+ $(TOPLIBD)/libcrypto.a $(TOPLIBD)/libcom_err.a
+
+t_ktentry: $(T_KTENTRY_OBJS)
+ $(LD) -o t_ktentry $(T_KTENTRY_OBJS) $(LIBS)
+
+TEST_PROGS = t_dbentry t_ktentry
+
+check-unix:: $(TEST_PROGS)
+ $(RUN_SETUP) ./t_dbentry -r 100
+ $(RUN_SETUP) ./t_ktentry -r 100
+
+check-mac::
+
+check-windows::
+
+clean-unix::
+ $(RM) t_dbentry$(EXEEXT) t_dbentry.$(OBJEXT)
+ $(RM) t_ktentry$(EXEEXT) t_ktentry.$(OBJEXT)
+clean-mac::
+ $(RM) t_dbentry$(EXEEXT) t_dbentry.$(OBJEXT)
+ $(RM) t_ktentry$(EXEEXT) t_ktentry.$(OBJEXT)
+
--- /dev/null
+/*
+ * lib/kadm/adm_conn.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+/*
+ * Routines to contact an administrative protocol server.
+ */
+#define NEED_SOCKETS
+#define NEED_LOWLEVEL_IO
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+#if HAVE_PWD_H
+#include <pwd.h>
+#endif /* HAVE_PWD_H */
+
+/* Default ticket life is 10 minutes */
+#define KADM_DEFAULT_LIFETIME (10*60)
+
+/*
+ * Strings
+ */
+static char *kadm_cache_name_fmt = "FILE:/tmp/tkt_kadm_%d";
+
+/*
+ * Prototypes for local functions
+ */
+static krb5_error_code kadm_get_ccache
+ PROTOTYPE((krb5_context,
+ char *,
+ char *,
+ krb5_ccache *,
+ krb5_principal *));
+static krb5_error_code kadm_get_creds
+ PROTOTYPE((krb5_context,
+ krb5_ccache ,
+ krb5_principal,
+ krb5_creds *,
+ char *,
+ char *,
+ krb5_timestamp));
+static krb5_error_code kadm_contact_server
+ PROTOTYPE((krb5_context,
+ krb5_data *,
+ int *,
+ krb5_address **,
+ krb5_address **));
+static krb5_error_code kadm_get_auth
+ PROTOTYPE((krb5_context,
+ krb5_auth_context *,
+ krb5_address *,
+ krb5_address *));
+\f
+/*
+ * kadm_get_ccache() - Initialze a credentials cache.
+ *
+ * Cleanup after success by calling krb5_cc_destroy() and krb5_free_principal()
+ * Allocates new ccache and client.
+ */
+static krb5_error_code
+kadm_get_ccache(kcontext, user, ccname, ccache, client)
+ krb5_context kcontext;
+ char *user;
+ char *ccname;
+ krb5_ccache *ccache;
+ krb5_principal *client;
+{
+ krb5_error_code kret;
+ char *name;
+ int did_malloc = 0;
+ char new_cache[MAXPATHLEN];
+ krb5_principal tprinc;
+
+ /* Initialize. */
+ *client = (krb5_principal) NULL;
+ tprinc = (krb5_principal) NULL;
+
+ /*
+ * If a name specified, then use that one, else get it from our
+ * current uid.
+ */
+ if (user) {
+ name = user;
+ }
+ else {
+#if HAVE_PWD_H
+ struct passwd *pw;
+
+ pw = getpwuid(getuid());
+ if (pw) {
+ name = (char *) malloc(strlen(pw->pw_name)+1);
+ did_malloc = 1;
+ strcpy(name, pw->pw_name);
+ }
+ else {
+ kret = errno;
+ goto cleanup;
+ }
+#else /* HAVE_PWD_H */
+ kret = ENOENT;
+ goto cleanup;
+#endif /* HAVE_PWD_H */
+ }
+
+ /* Parse the name and form our principal */
+ if (kret = krb5_parse_name(kcontext, name, client))
+ goto cleanup;
+
+ if (!ccname) {
+#if defined(_MSDOS) || defined(_WIN32)
+ strcpy (new_cache, "FILE:");
+ GetTempFileName (0, "tkt", 0, new_cache+5);
+#else
+#ifdef _MACINTOSH
+ (void) sprintf(new_cache, "STDIO:admcc");
+#else
+ (void) sprintf(new_cache, kadm_cache_name_fmt, getpid());
+#endif /* _MACINTOSH */
+#endif /* _MSDOS || _WIN32 */
+ }
+ else
+ sprintf(new_cache, "FILE:%s", ccname);
+
+ /*
+ * We only need to resolve the credentials cache if one hasn't
+ * been supplied to us.
+ */
+ if (!(*ccache) && (kret = krb5_cc_resolve(kcontext, new_cache, ccache)))
+ goto cleanup;
+
+ /* XXX assumes a file ccache */
+ if ((kret = krb5_cc_get_principal(kcontext, *ccache, &tprinc)) ==
+ KRB5_FCC_NOFILE)
+ kret = krb5_cc_initialize(kcontext, *ccache, *client);
+
+
+ cleanup:
+ if (did_malloc)
+ free(name);
+
+ if (tprinc)
+ krb5_free_principal(kcontext, tprinc);
+
+ if (kret) {
+ if (*client)
+ krb5_free_principal(kcontext, *client);
+ }
+
+ return(kret);
+}
+\f
+/*
+ * kadm_get_creds() - Get initial credentials.
+ *
+ * Cleanup after success by calling krb5_free_principal().
+ * Allocates new principal for creds->server.
+ */
+static krb5_error_code
+kadm_get_creds(kcontext, ccache, client, creds, prompt, oldpw, tlife)
+ krb5_context kcontext;
+ krb5_ccache ccache;
+ krb5_principal client;
+ krb5_creds *creds;
+ char *prompt;
+ char *oldpw;
+ krb5_timestamp tlife;
+{
+ char *client_name;
+ krb5_error_code kret;
+ krb5_address **my_addresses;
+ int old_pwsize;
+ krb5_creds tcreds;
+
+ /* Initialize */
+ my_addresses = (krb5_address **) NULL;
+ client_name = (char *) NULL;
+
+ /* Get the string form for our principal */
+ if (kret = krb5_unparse_name(kcontext, client, &client_name))
+ return(kret);
+
+ if (kret = krb5_os_localaddr(kcontext, &my_addresses))
+ goto cleanup;
+
+ creds->client = client;
+ /*
+ * Build server principal name:
+ * "changepw" is service
+ * realm name is instance
+ * realm name is realm name
+ */
+ if (kret = krb5_build_principal_ext(kcontext,
+ &creds->server,
+ client->realm.length,
+ client->realm.data,
+ strlen(KRB5_ADM_SERVICE_INSTANCE),
+ KRB5_ADM_SERVICE_INSTANCE,
+ client->realm.length,
+ client->realm.data,
+ 0))
+ goto cleanup;
+
+ /* Attempt to retrieve an appropriate entry from the credentials cache. */
+ if ((kret = krb5_cc_retrieve_cred(kcontext,
+ ccache,
+ KRB5_TC_MATCH_SRV_NAMEONLY,
+ creds,
+ &tcreds))
+ == KRB5_CC_NOTFOUND) {
+ krb5_timestamp jetzt;
+
+ if (prompt != (char *) NULL) {
+ /* Read the password */
+ old_pwsize = KRB5_ADM_MAX_PASSWORD_LEN;
+ if (kret = krb5_read_password(kcontext,
+ prompt,
+ (char *) NULL,
+ oldpw,
+ &old_pwsize))
+ goto cleanup;
+ }
+ if (kret = krb5_timeofday(kcontext, &jetzt))
+ goto cleanup;
+ if (tlife > 0)
+ creds->times.endtime = jetzt + tlife;
+ else
+ creds->times.endtime = jetzt + KADM_DEFAULT_LIFETIME;
+
+ /* Get our initial ticket */
+ kret = krb5_get_in_tkt_with_password(kcontext,
+ 0,
+ my_addresses,
+ NULL,
+ NULL,
+ oldpw,
+ ccache,
+ creds,
+ 0);
+ }
+ else {
+ krb5_principal sclient, sserver;
+
+ if (!kret) {
+ /*
+ * We found the credentials cache entry - copy it out.
+ *
+ * We'd like to just blast tcreds on top of creds, but we cannot.
+ * other logic uses the client data, and rather than going and
+ * chasing all that logic down, might as well pretend that we just
+ * filled in all the other muck.
+ */
+ sclient = creds->client;
+ sserver = creds->server;
+ memcpy((char *) creds, (char *) &tcreds, sizeof(tcreds));
+ if (creds->client)
+ krb5_free_principal(kcontext, creds->client);
+ if (creds->server)
+ krb5_free_principal(kcontext, creds->server);
+ creds->client = sclient;
+ creds->server = sserver;
+ }
+ }
+
+ cleanup:
+ if (kret) {
+ if (creds->server) {
+ krb5_free_principal(kcontext, creds->server);
+ creds->server = 0;
+ }
+ }
+ if (my_addresses)
+ krb5_free_addresses(kcontext, my_addresses);
+ if (client_name)
+ krb5_xfree(client_name);
+ return(kret);
+}
+\f
+/*
+ * kadm_contact_server() - Establish a connection to the server.
+ *
+ * Cleanup after success by calling close() and free().
+ * Opens/connects socket *sockp. Allocates address storage for local/remote.
+ */
+static krb5_error_code
+kadm_contact_server(kcontext, realmp, sockp, local, remote)
+ krb5_context kcontext;
+ krb5_data *realmp;
+ int *sockp;
+ krb5_address **local;
+ krb5_address **remote;
+{
+ struct hostent *remote_host;
+ struct servent *service;
+ char **hostlist;
+ int i, count;
+
+ krb5_error_code kret;
+
+ struct sockaddr_in in_local;
+ struct sockaddr_in in_remote;
+ int addr_len;
+
+ const char *realm_admin_names[4];
+ char *realm_name;
+ krb5_boolean found;
+
+ /* Initialize */
+ hostlist = (char **) NULL;
+ *sockp = -1;
+ realm_name = (char *) NULL;
+
+ /*
+ * XXX - only know ADDRTYPE_INET.
+ */
+#ifdef KRB5_USE_INET
+ *local = (krb5_address *) malloc(sizeof(krb5_address));
+ *remote = (krb5_address *) malloc(sizeof(krb5_address));
+ realm_name = (char *) malloc((size_t) realmp->length + 1);
+ if ((*local == (krb5_address *) NULL) ||
+ (*remote == (krb5_address *) NULL) ||
+ (realm_name == (char *) NULL)) {
+ kret = ENOMEM;
+ goto cleanup;
+ }
+ (*local)->addrtype = (*remote)->addrtype = ADDRTYPE_INET;
+ (*local)->length = (*remote)->length = sizeof(struct in_addr);
+ (*local)->contents = (krb5_octet *) malloc(sizeof(struct in_addr));
+ (*remote)->contents = (krb5_octet *) malloc(sizeof(struct in_addr));
+ if (((*local)->contents == NULL) || ((*remote)->contents == NULL)) {
+ kret = ENOMEM;
+ goto cleanup;
+ }
+
+ /*
+ * First attempt to find addresses from our config file, if we cannot
+ * find an entry, then try getservbyname().
+ */
+ found = 0;
+#ifndef OLD_CONFIG_FILES
+ strncpy(realm_name, realmp->data, (size_t) realmp->length);
+ realm_name[realmp->length] = '\0';
+ realm_admin_names[0] = "realms";
+ realm_admin_names[1] = realm_name;
+ realm_admin_names[2] = "admin_server";
+ realm_admin_names[3] = (char *) NULL;
+ if (!(kret = profile_get_values(kcontext->profile,
+ realm_admin_names,
+ &hostlist))) {
+ int hi;
+ char *cport;
+ char *cp;
+ krb5_int32 pport;
+
+ for (hi = 0; hostlist[hi]; hi++) {
+ /*
+ * This knows a little too much about the format of profile
+ * entries. Shouldn't it just be some sort of tuple?
+ *
+ * The form is assumed to be:
+ * admin_server = <hostname>[:<portname>[<whitespace>]]
+ */
+ cport = (char *) NULL;
+ pport = (u_short) KRB5_ADM_DEFAULT_PORT;
+ cp = strchr(hostlist[hi], ' ');
+ if (cp)
+ *cp = '\0';
+ cp = strchr(hostlist[hi], '\t');
+ if (cp)
+ *cp = '\0';
+ cport = strchr(hostlist[hi], ':');
+ if (cport) {
+ *cport = '\0';
+ cport++;
+
+ pport = atoi (cport);
+ if (pport == 0) {
+ kret = KRB5_CONFIG_BADFORMAT;
+ goto cleanup;
+ }
+ }
+
+ /*
+ * Now that we have a host name, get the host entry.
+ */
+ remote_host = gethostbyname(hostlist[hi]);
+ if (remote_host == (struct hostent *) NULL) {
+ kret = KRB5_CONFIG_BADFORMAT;
+ goto cleanup;
+ }
+
+ /*
+ * Fill in our address values.
+ */
+ in_remote.sin_family = remote_host->h_addrtype;
+ (void) memcpy((char *) &in_remote.sin_addr,
+ (char *) remote_host->h_addr,
+ sizeof(in_remote.sin_addr));
+ in_remote.sin_port = htons((u_short) pport);
+
+ /* Open a tcp socket */
+ *sockp = (int) socket(PF_INET, SOCK_STREAM, 0);
+ if (*sockp < 0) {
+ kret = SOCKET_ERRNO;
+ goto cleanup;
+ }
+ else kret = 0;
+
+ /* Attempt to connect to the remote address. */
+ if (connect(*sockp,
+ (struct sockaddr *) &in_remote,
+ sizeof(in_remote)) < 0) {
+ /* Failed, go to next address */
+ kret = SOCKET_ERRNO;
+ closesocket((SOCKET)*sockp);
+ *sockp = -1;
+ continue;
+ }
+
+ /* Find out local address */
+ addr_len = sizeof(in_local);
+ if (getsockname((SOCKET) *sockp,
+ (struct sockaddr *) &in_local,
+ &addr_len) < 0) {
+ /* Couldn't get our local address? */
+ kret = SOCKET_ERRNO;
+ goto cleanup;
+ }
+ else {
+ /* Connection established. */
+ memcpy((char *) (*remote)->contents,
+ (char *) &in_remote.sin_addr,
+ sizeof(struct in_addr));
+ memcpy((char *) (*local)->contents,
+ (char *) &in_local.sin_addr,
+ sizeof(struct in_addr));
+ found = 1;
+ break;
+ }
+ }
+ if (!found) {
+ krb5_xfree(hostlist);
+ hostlist = (char **) NULL;
+ }
+ }
+#endif /* OLD_CONFIG_FILES */
+ if (!found) {
+ /*
+ * Use the old way of finding our administrative server.
+ *
+ * This consists of looking up an entry in /etc/services and if
+ * we don't find it, then we are just out of luck. Then, we use
+ * that port number along with the address of the kdc.
+ */
+ if ((service = getservbyname(KRB5_ADM_SERVICE_NAME, "tcp")) == NULL) {
+ kret = ENOENT;
+ goto cleanup;
+ }
+ in_remote.sin_port = service->s_port;
+
+ if (kret = krb5_get_krbhst(kcontext, realmp, &hostlist))
+ goto cleanup;
+
+ /* Now count the number of hosts in the realm */
+ count = 0;
+ for (i=0; hostlist[i]; i++)
+ count++;
+ if (count == 0) {
+ kret = ENOENT; /* something better? */
+ goto cleanup;
+ }
+
+ /* Now find an available host */
+ for (i=0; hostlist[i]; i++) {
+ remote_host = gethostbyname(hostlist[i]);
+ if (remote_host != (struct hostent *) NULL) {
+ in_remote.sin_family = remote_host->h_addrtype;
+ (void) memcpy((char *) &in_remote.sin_addr,
+ (char *) remote_host->h_addr,
+ sizeof(in_remote.sin_addr));
+
+ /* Open a tcp socket */
+ *sockp = (int) socket(PF_INET, SOCK_STREAM, 0);
+ if (*sockp < 0) {
+ kret = SOCKET_ERRNO;
+ goto cleanup;
+ }
+ else kret = 0;
+
+ if (connect(*sockp,
+ (struct sockaddr *) &in_remote,
+ sizeof(in_remote)) < 0) {
+ kret = SOCKET_ERRNO;
+ closesocket((SOCKET)*sockp);
+ *sockp = -1;
+ continue;
+ }
+
+ /* Find out local address */
+ addr_len = sizeof(in_local);
+ if (getsockname((SOCKET)*sockp,
+ (struct sockaddr *) &in_local,
+ &addr_len) < 0) {
+ kret = SOCKET_ERRNO;
+ goto cleanup;
+ }
+ else {
+ memcpy((char *) (*remote)->contents,
+ (char *) &in_remote.sin_addr,
+ sizeof(struct in_addr));
+
+ memcpy((char *) (*local)->contents,
+ (char *) &in_local.sin_addr,
+ sizeof(struct in_addr));
+ found = 1;
+ break;
+ }
+ }
+ }
+ if (!found)
+ kret = KRB5_SERVICE_UNKNOWN;
+ }
+#else /* KRB5_USE_INET */
+ kret = ENOENT;
+#endif /* KRB5_USE_INET */
+
+ cleanup:
+ if (kret) {
+ if (*sockp >= 0)
+ closesocket((SOCKET)*sockp);
+ if (*local && (*local)->contents)
+ free((*local)->contents);
+ if (*remote && (*remote)->contents)
+ free((*remote)->contents);
+ if (*local) {
+ memset((char *) (*local), 0, sizeof(krb5_address));
+ free(*local);
+ *local = (krb5_address *) NULL;
+ }
+ if (*remote) {
+ memset((char *) (*remote), 0, sizeof(krb5_address));
+ free(*remote);
+ *remote = (krb5_address *) NULL;
+ }
+ }
+ if (realm_name)
+ free(realm_name);
+ if (hostlist)
+ krb5_xfree(hostlist);
+ return(kret);
+}
+\f
+/*
+ * kadm_get_auth() - Get authorization context.
+ *
+ * Cleanup after success by calling krb5_xfree().
+ * New krb5_auth_context allocated in *ctxp
+ */
+static krb5_error_code
+kadm_get_auth(kcontext, ctxp, local, remote)
+ krb5_context kcontext;
+ krb5_auth_context *ctxp;
+ krb5_address *local;
+ krb5_address *remote;
+{
+ krb5_auth_con_init(kcontext, ctxp);
+ krb5_auth_con_setflags(kcontext, *ctxp,
+ KRB5_AUTH_CONTEXT_RET_SEQUENCE|
+ KRB5_AUTH_CONTEXT_DO_SEQUENCE);
+ krb5_auth_con_setaddrs(kcontext, *ctxp, local, remote);
+ return(0);
+}
+\f
+/*
+ * krb5_adm_connect() - Establish the connection to the service.
+ *
+ * If *ccachep is not null, then that ccache is used to establish the identity
+ * of the caller. (Argument list is ugly, I know)
+ *
+ * Errors are not reported by this routine.
+ * Cleanup after successful invocation must:
+ * destroy/close ccache.
+ * free auth_context
+ * close socket.
+ */
+krb5_error_code INTERFACE
+krb5_adm_connect(kcontext, user, prompt, opassword, sockp, ctxp,
+ ccachep, ccname, tlife)
+ krb5_context kcontext; /* Context handle (In ) */
+ char *user; /* User specified (In ) */
+ char *prompt; /* Old password prompt (In ) */
+ char *opassword; /* Old Password (I/O) */
+ int *sockp; /* Socket for conn. (Out) */
+ krb5_auth_context *ctxp; /* Auth context (Out) */
+ krb5_ccache *ccachep; /* Credentials cache (I/O) */
+ char *ccname; /* Cred cache name (In ) */
+ krb5_timestamp tlife; /* Ticket lifetime (In ) */
+{
+ krb5_error_code kret;
+ krb5_principal client;
+ krb5_creds creds;
+ krb5_data server_realm;
+ krb5_data request_data, suppl_data;
+ krb5_data response_data;
+ krb5_address *local_addr;
+ krb5_address *remote_addr;
+ krb5_boolean ccache_supplied;
+
+ char *server;
+
+ /* Initialize */
+ memset((char *) &creds, 0, sizeof(krb5_creds));
+ server = (char *) NULL;
+ *sockp = -1;
+ local_addr = remote_addr = (krb5_address *) NULL;
+ client = (krb5_principal) NULL;
+ *ctxp = (krb5_auth_context) NULL;
+ ccache_supplied = (*ccachep != (krb5_ccache) NULL);
+
+ /*
+ * Find the appropriate credentials cache and set up our identity.
+ */
+ if (kret = kadm_get_ccache(kcontext, user, ccname, ccachep, &client))
+ goto cleanup;
+
+ /*
+ * Get initial credentials.
+ */
+ if (kret = kadm_get_creds(kcontext,
+ *ccachep,
+ client,
+ &creds,
+ prompt,
+ opassword,
+ tlife))
+ goto cleanup;
+
+ /*
+ * Establish connection to server.
+ */
+ if ((server_realm.data = (char *) malloc(client->realm.length+1)) ==
+ (char *) NULL)
+ goto cleanup;
+
+ server_realm.length = client->realm.length;
+ memcpy(server_realm.data, client->realm.data, server_realm.length);
+ server_realm.data[server_realm.length] = '\0';
+ if (kret = kadm_contact_server(kcontext,
+ &server_realm,
+ sockp,
+ &local_addr,
+ &remote_addr))
+ goto cleanup;
+
+ /*
+ * Obtain our authorization context
+ */
+ if (kret = kadm_get_auth(kcontext, ctxp, local_addr, remote_addr))
+ goto cleanup;
+
+ /*
+ * Format, then send the KRB_AP_REQ
+ */
+ suppl_data.data = NULL;
+ suppl_data.length = 0;
+ if (kret = krb5_mk_req_extended(kcontext,
+ ctxp,
+ AP_OPTS_MUTUAL_REQUIRED,
+ &suppl_data,
+ &creds,
+ &request_data))
+ goto cleanup;
+
+ if (kret = krb5_write_message(kcontext, sockp, &request_data))
+ goto cleanup;
+
+ /*
+ * Now read back the response.
+ */
+ if (kret = krb5_read_message(kcontext, sockp, &response_data)) {
+ goto cleanup;
+ }
+ else {
+ krb5_ap_rep_enc_part *reply = NULL;
+
+ kret = krb5_rd_rep(kcontext, *ctxp, &response_data, &reply);
+ if (reply)
+ krb5_free_ap_rep_enc_part(kcontext, reply);
+ }
+ cleanup:
+ if (server)
+ free(server);
+ if (kret) {
+ if (*ctxp) {
+ krb5_xfree(*ctxp);
+ *ctxp = (krb5_auth_context) NULL;
+ }
+ if (*sockp >= 0) {
+ closesocket((SOCKET)*sockp);
+ *sockp = -1;
+ }
+ if (local_addr && local_addr->contents)
+ free(local_addr->contents);
+ if (remote_addr && remote_addr->contents)
+ free(remote_addr->contents);
+ if (local_addr)
+ free(local_addr);
+ if (remote_addr)
+ free(remote_addr);
+ if (creds.server)
+ krb5_free_principal(kcontext, creds.server);
+ if (client)
+ krb5_free_principal(kcontext, client);
+ if (*ccachep && !ccache_supplied) {
+ krb5_cc_destroy(kcontext, *ccachep);
+ *ccachep = (krb5_ccache) NULL;
+ }
+ }
+ return(kret);
+
+}
+\f
+/*
+ * krb5_adm_disconnect() - Disconnect from the administrative service.
+ *
+ * If ccache is supplied, then it is destroyed. Otherwise, the ccache is
+ * the caller's responsibility to close.
+ */
+void INTERFACE
+krb5_adm_disconnect(kcontext, socketp, auth_context, ccache)
+ krb5_context kcontext;
+ int *socketp;
+ krb5_auth_context auth_context;
+ krb5_ccache ccache;
+{
+ if (ccache)
+ krb5_cc_destroy(kcontext, ccache);
+ if (auth_context)
+ krb5_xfree(auth_context);
+ if (*socketp >= 0)
+ closesocket((SOCKET)*socketp);
+}
+
--- /dev/null
+/*
+ * lib/kadm/adm_kt_dec.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * adm_kt_dec.c - Decode keytab entry according to protocol.
+ */
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+\f
+/*
+ * krb5_adm_proto_to_ktent() - Convert a list of reply components to
+ * a keytab entry according to procotol.
+ *
+ * Successful callers of this routine should free ktentp->principal
+ * and ktentp->key.contents.
+ */
+krb5_error_code
+krb5_adm_proto_to_ktent(kcontext, ncomp, complist, ktentp)
+ krb5_context kcontext;
+ krb5_int32 ncomp;
+ krb5_data *complist;
+ krb5_keytab_entry *ktentp;
+{
+ krb5_error_code kret;
+ char *v;
+
+ /*
+ * Clear out the keytab entry.
+ */
+ memset((char *) ktentp, 0, sizeof(krb5_keytab_entry));
+
+ /*
+ * Figure out how many components we have. We expect KRB5_ADM_KT_NCOMPS
+ * components.
+ */
+ if (ncomp != KRB5_ADM_KT_NCOMPS)
+ return(EINVAL);
+
+ /* Parse the supplied principal name */
+ if (kret = krb5_parse_name(kcontext,
+ complist[KRB5_ADM_KT_PRINCIPAL].data,
+ &ktentp->principal))
+ goto done;
+
+ /* Parse the supplied timestamp */
+ if (complist[KRB5_ADM_KT_TIMESTAMP].length < sizeof(krb5_timestamp)) {
+ kret = EINVAL;
+ goto done;
+ }
+ v = complist[KRB5_ADM_KT_TIMESTAMP].data;
+ ktentp->timestamp = (krb5_timestamp)
+ (((krb5_int32) ((unsigned char) v[0]) << 24) +
+ ((krb5_int32) ((unsigned char) v[1]) << 16) +
+ ((krb5_int32) ((unsigned char) v[2]) << 8) +
+ ((krb5_int32) ((unsigned char) v[3])));
+
+ /* Parse the supplied vno */
+ if (complist[KRB5_ADM_KT_VNO].length < sizeof(krb5_kvno)) {
+ kret = EINVAL;
+ goto done;
+ }
+ v = complist[KRB5_ADM_KT_VNO].data;
+ ktentp->vno = (krb5_kvno)
+ (((krb5_int32) ((unsigned char) v[0]) << 24) +
+ ((krb5_int32) ((unsigned char) v[1]) << 16) +
+ ((krb5_int32) ((unsigned char) v[2]) << 8) +
+ ((krb5_int32) ((unsigned char) v[3])));
+
+ /* Parse the supplied key_enctype */
+ if (complist[KRB5_ADM_KT_KEY_ENCTYPE].length < sizeof(krb5_enctype)) {
+ kret = EINVAL;
+ goto done;
+ }
+ v = complist[KRB5_ADM_KT_KEY_ENCTYPE].data;
+ ktentp->key.enctype = (krb5_enctype)
+ (((krb5_int32) ((unsigned char) v[0]) << 24) +
+ ((krb5_int32) ((unsigned char) v[1]) << 16) +
+ ((krb5_int32) ((unsigned char) v[2]) << 8) +
+ ((krb5_int32) ((unsigned char) v[3])));
+
+ /* Finally, shuck the key contents */
+ if (ktentp->key.contents = (krb5_octet *)
+ malloc((size_t) complist[KRB5_ADM_KT_KEY_KEY].length)) {
+ ktentp->key.length = complist[KRB5_ADM_KT_KEY_KEY].length;
+ memcpy(ktentp->key.contents,
+ complist[KRB5_ADM_KT_KEY_KEY].data,
+ (size_t) ktentp->key.length);
+ kret = 0;
+ }
+ else
+ kret = ENOMEM;
+
+ done:
+ if (kret) {
+ if (ktentp->principal)
+ krb5_free_principal(kcontext, ktentp->principal);
+ if (ktentp->key.contents) {
+ memset((char *) ktentp->key.contents, 0,
+ (size_t) ktentp->key.length);
+ krb5_xfree(ktentp->key.contents);
+ }
+ memset((char *) ktentp, 0, sizeof(krb5_keytab_entry));
+ }
+ return(kret);
+}
--- /dev/null
+/*
+ * lib/kadm/adm_kt_enc.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * adm_kt_enc.c - Encode keytab entry according to protocol.
+ */
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+\f
+/*
+ * krb5_adm_ktent_to_proto() - Convert a keytab entry into an external
+ * list of reply components.
+ *
+ * Successful callers must free the storage for complistp and complistp->data
+ * either manually or by using krb5_free_adm_data().
+ */
+krb5_error_code
+krb5_adm_ktent_to_proto(kcontext, ktentp, ncompp, complistp)
+ krb5_context kcontext;
+ krb5_keytab_entry *ktentp;
+ krb5_int32 *ncompp;
+ krb5_data **complistp;
+{
+ krb5_error_code kret;
+ krb5_data *clist;
+ krb5_int32 nents;
+
+ kret = ENOMEM;
+ nents = 0;
+ if (clist = (krb5_data *) malloc((size_t) KRB5_ADM_KT_NCOMPS *
+ sizeof(krb5_data))) {
+ memset((char *) clist, 0, ((size_t) KRB5_ADM_KT_NCOMPS *
+ sizeof(krb5_data)));
+ /*
+ * Fill in the principal field.
+ */
+ if (kret = krb5_unparse_name(kcontext,
+ ktentp->principal,
+ &clist[KRB5_ADM_KT_PRINCIPAL].data))
+ goto done;
+ clist[KRB5_ADM_KT_PRINCIPAL].length =
+ strlen(clist[KRB5_ADM_KT_PRINCIPAL].data);
+ nents++;
+
+ /*
+ * Fill in timestamp.
+ */
+ if (kret = krb5_timeofday(kcontext, &ktentp->timestamp))
+ goto done;
+ if (clist[KRB5_ADM_KT_TIMESTAMP].data =
+ (char *) malloc(sizeof(krb5_ui_4))) {
+ clist[KRB5_ADM_KT_TIMESTAMP].length = sizeof(krb5_ui_4);
+ clist[KRB5_ADM_KT_TIMESTAMP].data[0] =
+ (char) ((ktentp->timestamp >> 24) & 0xff);
+ clist[KRB5_ADM_KT_TIMESTAMP].data[1] =
+ (char) ((ktentp->timestamp >> 16) & 0xff);
+ clist[KRB5_ADM_KT_TIMESTAMP].data[2] =
+ (char) ((ktentp->timestamp >> 8) & 0xff);
+ clist[KRB5_ADM_KT_TIMESTAMP].data[3] =
+ (char) (ktentp->timestamp & 0xff);
+ nents++;
+ }
+ else {
+ kret = ENOMEM;
+ goto done;
+ }
+
+ /*
+ * Fill in vno.
+ */
+ if (clist[KRB5_ADM_KT_VNO].data =
+ (char *) malloc(sizeof(krb5_ui_4))) {
+ clist[KRB5_ADM_KT_VNO].length = sizeof(krb5_ui_4);
+ clist[KRB5_ADM_KT_VNO].data[0] = (ktentp->vno >> 24) & 0xff;
+ clist[KRB5_ADM_KT_VNO].data[1] = (ktentp->vno >> 16) & 0xff;
+ clist[KRB5_ADM_KT_VNO].data[2] = (ktentp->vno >> 8) & 0xff;
+ clist[KRB5_ADM_KT_VNO].data[3] = ktentp->vno & 0xff;
+ nents++;
+ }
+ else {
+ kret = ENOMEM;
+ goto done;
+ }
+
+ /*
+ * Fill in key_enctype.
+ */
+ if (clist[KRB5_ADM_KT_KEY_ENCTYPE].data =
+ (char *) malloc(sizeof(krb5_ui_4))) {
+ clist[KRB5_ADM_KT_KEY_ENCTYPE].length = sizeof(krb5_ui_4);
+ clist[KRB5_ADM_KT_KEY_ENCTYPE].data[0] =
+ (ktentp->key.enctype >> 24) & 0xff;
+ clist[KRB5_ADM_KT_KEY_ENCTYPE].data[1] =
+ (ktentp->key.enctype >> 16) & 0xff;
+ clist[KRB5_ADM_KT_KEY_ENCTYPE].data[2] =
+ (ktentp->key.enctype >> 8) & 0xff;
+ clist[KRB5_ADM_KT_KEY_ENCTYPE].data[3] =
+ ktentp->key.enctype & 0xff;
+ nents++;
+ }
+ else {
+ kret = ENOMEM;
+ goto done;
+ }
+
+ /*
+ * Fill in key_key.
+ */
+ if (clist[KRB5_ADM_KT_KEY_KEY].data =
+ (char *) malloc((size_t) ktentp->key.length)) {
+ memcpy(clist[KRB5_ADM_KT_KEY_KEY].data,
+ ktentp->key.contents,
+ (size_t) ktentp->key.length);
+ clist[KRB5_ADM_KT_KEY_KEY].length = ktentp->key.length;
+ nents++;
+ kret = 0;
+ }
+ else
+ kret = ENOMEM;
+ }
+ done:
+ if (kret) {
+ if (clist) {
+ int i;
+ for (i=0; i<KRB5_ADM_KT_NCOMPS; i++) {
+ if (clist[i].data) {
+ memset(clist[i].data, 0, (size_t) clist[i].length);
+ krb5_xfree(clist[i].data);
+ }
+ }
+ krb5_xfree(clist);
+ }
+ clist = (krb5_data *) NULL;
+ nents = 0;
+ }
+ *complistp = clist;
+ *ncompp = nents;
+ return(kret);
+}
--- /dev/null
+/*
+ * lib/kadm/adm_kw_dec.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * adm_kw_dec.c - routines to decode keyword-value pairs.
+ */
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+#define char2int(c) ((c) - '0')
+\f
+/*
+ * keyword_value() - Find index of keyword value if keyword is present.
+ *
+ * If a value is required, then the index of the keyword value is returned,
+ * otherwise the index of the first character past the end of the keyword
+ * string is returned.
+ */
+static off_t
+keyword_value(dataentp, keyword, value_req)
+ krb5_data *dataentp;
+ char *keyword;
+ krb5_boolean value_req;
+{
+ off_t len_req;
+
+ len_req = strlen(keyword);
+ if (value_req)
+ len_req++;
+ if ((dataentp->length >= len_req) &&
+ (!strncmp(dataentp->data, keyword, strlen(keyword))) &&
+ (!value_req || (dataentp->data[strlen(keyword)] == '=')))
+ return(len_req);
+ else
+ return(-1);
+}
+\f
+/*
+ * decode_kw_string() - Decode a keyword=<string> pair and return the
+ * string value if the pair is present.
+ *
+ * Note: successful callers must free the string storage.
+ */
+static krb5_error_code
+decode_kw_string(dataentp, keyword, stringp)
+ krb5_data *dataentp;
+ char *keyword;
+ char **stringp;
+{
+ krb5_error_code kret;
+ off_t valueoff;
+ size_t len2copy;
+
+ kret = ENOENT;
+ if ((valueoff = keyword_value(dataentp, keyword, 1)) >= 0) {
+ kret = ENOMEM;
+ len2copy = (size_t) ((off_t) dataentp->length - valueoff);
+ *stringp = (char *) malloc(len2copy+1);
+ if (*stringp) {
+ strncpy(*stringp, &dataentp->data[valueoff], len2copy);
+ (*stringp)[len2copy] = '\0';
+ kret = 0;
+ }
+ }
+ return(kret);
+}
+\f
+/*
+ * decode_kw_integer() - Decode a keyword=<integer> pair and return the value
+ * if the pair is present.
+ */
+static krb5_error_code
+decode_kw_integer(dataentp, keyword, uintp)
+ krb5_data *dataentp;
+ char *keyword;
+ krb5_ui_4 *uintp;
+{
+ krb5_error_code kret;
+ off_t voff;
+ size_t len2copy;
+
+ kret = ENOENT;
+ if ((voff = keyword_value(dataentp, keyword, 1)) >= 0) {
+ kret = EINVAL;
+ len2copy = (size_t) ((off_t) dataentp->length - voff);
+ if (len2copy == sizeof(krb5_ui_4)) {
+ *uintp = (((krb5_int32) ((unsigned char) dataentp->data[voff])
+ << 24) +
+ ((krb5_int32) ((unsigned char) dataentp->data[voff+1])
+ << 16) +
+ ((krb5_int32) ((unsigned char) dataentp->data[voff+2])
+ << 8) +
+ ((krb5_int32) ((unsigned char) dataentp->data[voff+3])));
+ kret = 0;
+ }
+ }
+ return(kret);
+}
+\f
+/*
+ * decode_kw_gentime() - Decode a keyword=<general-time> pair and return the
+ * time result if the pair is present.
+ *
+ * XXX - this knows too much about how Kerberos time is encoded.
+ */
+static krb5_error_code
+decode_kw_gentime(dataentp, keyword, gtimep)
+ krb5_data *dataentp;
+ char *keyword;
+ krb5_timestamp *gtimep;
+{
+ krb5_error_code kret;
+ char *timestring;
+ struct tm tval;
+ time_t temp_time;
+
+ memset((char *) &tval, 0, sizeof(tval));
+ timestring = (char *) NULL;
+ if (!(kret = decode_kw_string(dataentp, keyword, ×tring))) {
+ kret = EINVAL;
+ if ((strlen(timestring) == 15) &&
+ (timestring[14] == 'Z')) {
+ tval.tm_year = 1000*char2int(timestring[0]) +
+ 100*char2int(timestring[1]) +
+ 10*char2int(timestring[2]) +
+ char2int(timestring[3]) - 1900;
+ tval.tm_mon = 10*char2int(timestring[4]) +
+ char2int(timestring[5]) - 1;
+ tval.tm_mday = 10*char2int(timestring[6]) +
+ char2int(timestring[7]);
+ tval.tm_hour = 10*char2int(timestring[8]) +
+ char2int(timestring[9]);
+ tval.tm_min = 10*char2int(timestring[10]) +
+ char2int(timestring[11]);
+ tval.tm_sec = 10*char2int(timestring[12]) +
+ char2int(timestring[13]);
+ tval.tm_isdst = -1;
+ temp_time = gmt_mktime(&tval);
+ if (temp_time >= 0) {
+ kret = 0;
+ *gtimep = (krb5_timestamp) temp_time;
+ }
+ }
+ free(timestring);
+ }
+ return(kret);
+}
+\f
+/*
+ * decode_kw_tagged() - Decode a keyword=<taglist>...<data> list and return
+ * the values of the tags and the data if the list is
+ * present.
+ */
+static krb5_error_code
+decode_kw_tagged(dataentp, keyword, ntags, taglist, lenp, datap)
+ krb5_data *dataentp;
+ char *keyword;
+ krb5_int32 ntags;
+ krb5_int32 *taglist;
+ size_t *lenp;
+ krb5_octet **datap;
+{
+ krb5_error_code kret;
+ off_t valueoff;
+ size_t len2copy;
+ unsigned char *cp, *ep;
+ int i;
+
+ kret = ENOENT;
+ if ((valueoff = keyword_value(dataentp, keyword, 1)) >= 0) {
+ /*
+ * Blast through the tags.
+ */
+ kret = 0;
+ cp = (unsigned char *) &dataentp->data[valueoff];
+ ep = (unsigned char *) &dataentp->data[dataentp->length];
+ for (i=0; i<ntags; i++) {
+ if (&cp[sizeof(krb5_int32)] > ep) {
+ kret = EINVAL;
+ break;
+ }
+ taglist[i] = (((krb5_int32) ((unsigned char) cp[0]) << 24) +
+ ((krb5_int32) ((unsigned char) cp[1]) << 16) +
+ ((krb5_int32) ((unsigned char) cp[2]) << 8) +
+ ((krb5_int32) ((unsigned char) cp[3])));
+ cp += sizeof(krb5_int32);
+ }
+ if (!kret) {
+ /*
+ * If we were successful, copy out the remaining bytes for value.
+ */
+ len2copy = (size_t) (ep - cp);
+ if (len2copy &&
+ (*datap = (krb5_octet *) malloc(len2copy+1))) {
+ memcpy(*datap, cp, len2copy);
+ (*datap)[len2copy] = '\0';
+ }
+ if (len2copy && !*datap)
+ kret = ENOMEM;
+ else
+ *lenp = len2copy;
+ }
+ }
+ return(kret);
+}
+\f
+#if !defined(_MSDOS) && !defined(_WIN32) && !defined(_MACINTOSH)
+/*
+ * krb5_adm_proto_to_dbent() - Convert external attribute list into a
+ * database entry.
+ *
+ * Scan through the keyword=value pairs in "data" until either the end of
+ * the list (as determined from "nent") is reached, or an error occurs.
+ * Return a mask of attributes which are set in "validp", the actual
+ * attribute values in "dbentp" and "pwordp" if a password is specified.
+ *
+ * Successful callers must allocate the storage for "validp", "dbentp" and
+ * must free the storage allocated for "pwordp" if a password is specified
+ * and free the storage allocated for "validp->mod_name" if a modifier name
+ * is specified.
+ */
+krb5_error_code
+krb5_adm_proto_to_dbent(kcontext, nent, data, validp, dbentp, pwordp)
+ krb5_context kcontext; /* Kerberos context */ /* In */
+ krb5_int32 nent; /* Number of components */ /* In */
+ krb5_data *data; /* Component list */ /* In */
+ krb5_ui_4 *validp; /* Valid bitmask */ /* Out */
+ krb5_db_entry *dbentp; /* Database entry */ /* Out */
+ char **pwordp; /* Password string */ /* Out */
+{
+ int i;
+ krb5_error_code retval;
+ krb5_ui_4 parsed_mask;
+ krb5_int32 taglist[4];
+ size_t data_length;
+ krb5_octet *tagged_data;
+ struct key_tag_correlator {
+ krb5_int32 key_tag;
+ int key_data_index;
+ } *correlators, *correlation;
+ int ncorrelations;
+
+ /* Initialize */
+ retval = 0;
+ parsed_mask = 0;
+ *pwordp = (char *) NULL;
+ correlators = (struct key_tag_correlator *) NULL;
+ ncorrelations = 0;
+
+ /* Loop through all the specified keyword=value pairs. */
+ for (i=0; i<nent; i++) {
+ /* Check for password */
+ if (!(retval = decode_kw_string(&data[i],
+ KRB5_ADM_KW_PASSWORD,
+ pwordp))) {
+ parsed_mask |= KRB5_ADM_M_PASSWORD;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for maximum lifetime */
+ if (!(retval = decode_kw_integer(&data[i],
+ KRB5_ADM_KW_MAXLIFE,
+ (krb5_ui_4 *) &dbentp->max_life))) {
+ parsed_mask |= KRB5_ADM_M_MAXLIFE;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for maximum renewable lifetime */
+ if (!(retval = decode_kw_integer(&data[i],
+ KRB5_ADM_KW_MAXRENEWLIFE,
+ (krb5_ui_4 *)
+ &dbentp->max_renewable_life))) {
+ parsed_mask |= KRB5_ADM_M_MAXRENEWLIFE;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for principal expiration */
+ if (!(retval = decode_kw_gentime(&data[i],
+ KRB5_ADM_KW_EXPIRATION,
+ &dbentp->expiration))) {
+ parsed_mask |= KRB5_ADM_M_EXPIRATION;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for password expiration */
+ if (!(retval = decode_kw_gentime(&data[i],
+ KRB5_ADM_KW_PWEXPIRATION,
+ &dbentp->pw_expiration))) {
+ parsed_mask |= KRB5_ADM_M_PWEXPIRATION;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* random key - value optional */
+ if (keyword_value(&data[i],
+ KRB5_ADM_KW_RANDOMKEY,
+ 0) >= 0) {
+ krb5_ui_4 value;
+
+ if (retval = decode_kw_integer(&data[i],
+ KRB5_ADM_KW_RANDOMKEY,
+ &value)) {
+ value = 1;
+ retval = 0;
+ }
+ if (value)
+ parsed_mask |= KRB5_ADM_M_RANDOMKEY;
+ else
+ parsed_mask &= ~KRB5_ADM_M_RANDOMKEY;
+ continue;
+ }
+
+ /* Check for flags */
+ if (!(retval = decode_kw_integer(&data[i],
+ KRB5_ADM_KW_FLAGS,
+ (krb5_ui_4 *) &dbentp->attributes))) {
+ parsed_mask |= KRB5_ADM_M_FLAGS;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for last successful password entry */
+ if (!(retval = decode_kw_gentime(&data[i],
+ KRB5_ADM_KW_LASTSUCCESS,
+ &dbentp->last_success))) {
+ parsed_mask |= KRB5_ADM_M_LASTSUCCESS;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for last failed entry */
+ if (!(retval = decode_kw_gentime(&data[i],
+ KRB5_ADM_KW_LASTFAILED,
+ &dbentp->last_failed))) {
+ parsed_mask |= KRB5_ADM_M_LASTFAILED;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for failure count */
+ if (!(retval = decode_kw_integer(&data[i],
+ KRB5_ADM_KW_FAILCOUNT,
+ (krb5_ui_4 *)
+ &dbentp->fail_auth_count))) {
+ parsed_mask |= KRB5_ADM_M_FAILCOUNT;
+ continue;
+ }
+ else {
+ if (retval != ENOENT)
+ break;
+ }
+
+ /* Check for auxiliary data */
+ if (!(retval = decode_kw_tagged(&data[i],
+ KRB5_ADM_KW_AUXDATA,
+ 1,
+ taglist,
+ &data_length,
+ &tagged_data))) {
+ krb5_tl_data **fixupp;
+ krb5_tl_data *tl_data, *new_tl;
+
+ /*
+ * We've got a tagged data value here. We've got to do a little
+ * work to put it in the right place. First, find the right place.
+ */
+ fixupp = &dbentp->tl_data;
+ for (tl_data = dbentp->tl_data;
+ tl_data;
+ tl_data = tl_data->tl_data_next)
+ fixupp = &tl_data->tl_data_next;
+
+ /* Get memory */
+ if (new_tl = (krb5_tl_data *) malloc(sizeof(krb5_tl_data))) {
+ /* Fill in the supplied values */
+ new_tl->tl_data_type = (krb5_int16) taglist[0];
+ new_tl->tl_data_length = (krb5_int16) data_length;
+ new_tl->tl_data_contents = tagged_data;
+
+ /* Link in the right place */
+ new_tl->tl_data_next= *fixupp;
+ *fixupp = new_tl;
+
+ /* Update counters and flags */
+ dbentp->n_tl_data++;
+ parsed_mask |= KRB5_ADM_M_AUXDATA;
+ }
+ else {
+ retval = ENOMEM;
+ break;
+ }
+ continue;
+ }
+ else {
+ if ((retval != ENOENT) && (retval != EINVAL))
+ break;
+ }
+
+ /* Check for key data */
+ if (!(retval = decode_kw_tagged(&data[i],
+ KRB5_ADM_KW_KEYDATA,
+ 3,
+ taglist,
+ &data_length,
+ &tagged_data))) {
+ krb5_boolean corr_found;
+ int cindex, kindex;
+ krb5_key_data *kdata;
+
+ /*
+ * See if we already have a correlation betwen our key-tag and
+ * an index into the key table.
+ */
+ corr_found = 0;
+ for (cindex = 0; cindex < ncorrelations; cindex++) {
+ if (correlators[cindex].key_tag == taglist[0]) {
+ correlation = &correlators[cindex];
+ corr_found = 1;
+ break;
+ }
+ }
+
+ /* If not, then we had better make one up */
+ if (!corr_found) {
+ /* Get a new list */
+ if (correlation = (struct key_tag_correlator *)
+ malloc((ncorrelations+1)*
+ sizeof(struct key_tag_correlator))) {
+ /* Save the contents of the old one. */
+ if (ncorrelations) {
+ memcpy(correlation, correlators,
+ ncorrelations*
+ sizeof(struct key_tag_correlator));
+ /* Free the old one */
+ free(correlators);
+ }
+ /* Point us at the new relation */
+ correlators = correlation;
+ correlation = &correlators[ncorrelations];
+ ncorrelations++;
+ correlation->key_tag = taglist[0];
+ /* Make a new key data entry */
+ if (kdata = (krb5_key_data *)
+ malloc((dbentp->n_key_data+1)*sizeof(krb5_key_data))) {
+ /* Copy the old list */
+ if (dbentp->n_key_data) {
+ memcpy(kdata, dbentp->key_data,
+ dbentp->n_key_data*sizeof(krb5_key_data));
+ free(dbentp->key_data);
+ }
+ dbentp->key_data = kdata;
+ correlation->key_data_index = dbentp->n_key_data;
+ memset(&kdata[dbentp->n_key_data], 0,
+ sizeof(krb5_key_data));
+ kdata[dbentp->n_key_data].key_data_ver = 1;
+ dbentp->n_key_data++;
+ corr_found = 1;
+ }
+ else
+ retval = ENOMEM;
+ }
+ else
+ retval = ENOMEM;
+ }
+
+ /* Check to see if we either found a correlation or made one */
+ if (corr_found) {
+ /* Special case for key version number */
+ if (taglist[1] == -1) {
+ dbentp->key_data[correlation->key_data_index].
+ key_data_kvno = taglist[2];
+ }
+ else {
+ dbentp->key_data[correlation->key_data_index].
+ key_data_type[taglist[1]] = taglist[2];
+ dbentp->key_data[correlation->key_data_index].
+ key_data_length[taglist[1]] = (krb5_int16) data_length;
+ dbentp->key_data[correlation->key_data_index].
+ key_data_contents[taglist[1]] = tagged_data;
+ }
+ parsed_mask |= KRB5_ADM_M_KEYDATA;
+ }
+ else
+ break;
+ continue;
+ }
+ else {
+ if ((retval != ENOENT) && (retval != EINVAL))
+ break;
+ }
+
+ /* Check for extra data */
+ if (!(retval = decode_kw_tagged(&data[i],
+ KRB5_ADM_KW_EXTRADATA,
+ 0,
+ taglist,
+ &data_length,
+ &dbentp->e_data))) {
+ dbentp->e_length = (krb5_int16) data_length;
+ parsed_mask |= KRB5_ADM_M_EXTRADATA;
+ continue;
+ }
+ else {
+ if ((retval != ENOENT) && (retval != EINVAL))
+ break;
+ }
+
+ /* If we fall through here, we've got something unrecognized */
+ if (retval) {
+ retval = EINVAL;
+ break;
+ }
+ }
+
+ if (retval) {
+ if (*pwordp) {
+ memset(*pwordp, 0, strlen(*pwordp));
+ free(*pwordp);
+ *pwordp = (char *) NULL;
+ }
+ parsed_mask = 0;
+ }
+ if (correlators)
+ free(correlators);
+ *validp |= parsed_mask;
+ return(retval);
+}
+#endif
--- /dev/null
+/*
+ * lib/kadm/adm_kw_enc.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * adm_kw_enc.c - routines to encode principal attributes in keyword-value
+ * pairs.
+ */
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+\f
+/*
+ * format_kw_string() - Format a keyword=<string> pair.
+ *
+ * Work routine for other string-based formatters also.
+ */
+static krb5_error_code
+format_kw_string(datap, kwordp, valp)
+ krb5_data *datap;
+ char *kwordp;
+ char *valp;
+{
+ krb5_error_code retval;
+ char fbuffer[BUFSIZ];
+
+ retval = ENOMEM;
+ sprintf(fbuffer,"%s=%s", kwordp, valp);
+ datap->data = (char *) malloc(strlen(fbuffer)+1);
+ if (datap->data) {
+ datap->length = strlen(fbuffer);
+ strcpy(datap->data, fbuffer);
+ retval = 0;
+ }
+ return(retval);
+}
+\f
+/*
+ * format_kw_integer() - Format a keyword=<integer> pair.
+ */
+static krb5_error_code
+format_kw_integer(datap, kwordp, val)
+ krb5_data *datap;
+ char *kwordp;
+ krb5_ui_4 val;
+{
+ krb5_error_code retval;
+ char fbuffer[BUFSIZ];
+
+ retval = ENOMEM;
+ sprintf(fbuffer,"%s=", kwordp);
+ datap->data = (char *) malloc(strlen(fbuffer)+sizeof(krb5_ui_4));
+ if (datap->data) {
+ datap->length = strlen(fbuffer);
+ strcpy(datap->data, fbuffer);
+ datap->data[datap->length] = (unsigned char) ((val >> 24) & 0xff);
+ datap->data[datap->length+1] = (unsigned char) ((val >> 16) & 0xff);
+ datap->data[datap->length+2] = (unsigned char) ((val >> 8) & 0xff);
+ datap->data[datap->length+3] = (unsigned char) (val & 0xff);
+ datap->length += sizeof(krb5_ui_4);
+ retval = 0;
+ }
+ return(retval);
+}
+\f
+/*
+ * format_kw_gentime() - Format a keyword=<general-time> pair.
+ *
+ * XXX - should this routine know so much about how generaltime is encoded?
+ */
+static krb5_error_code
+format_kw_gentime(datap, kwordp, timep)
+ krb5_data *datap;
+ char *kwordp;
+ krb5_timestamp *timep;
+{
+ krb5_error_code retval;
+ char fbuffer[BUFSIZ];
+ time_t tval;
+ struct tm *time_gmt;
+
+ retval = EINVAL;
+ tval = (time_t) *timep;
+ time_gmt = gmtime(&tval);
+ if (time_gmt) {
+ sprintf(fbuffer,"%04d%02d%02d%02d%02d%02dZ",
+ time_gmt->tm_year+1900,
+ time_gmt->tm_mon+1,
+ time_gmt->tm_mday,
+ time_gmt->tm_hour,
+ time_gmt->tm_min,
+ time_gmt->tm_sec);
+ retval = format_kw_string(datap, kwordp, fbuffer);
+ }
+ return(retval);
+}
+\f
+/*
+ * format_kw_tagged() - Format a <tagged>=<taglist>...<value> list.
+ */
+static krb5_error_code
+format_kw_tagged(datap, kwordp, ntags, taglist, vallen, val)
+ krb5_data *datap;
+ char *kwordp;
+ const int ntags;
+ krb5_int32 *taglist;
+ krb5_int32 vallen;
+ krb5_octet *val;
+{
+ krb5_error_code retval;
+ unsigned char *cp;
+ int i;
+
+ /* Calculate the size required:
+ * strlen(kwordp) + 1 for "kword"=
+ * 4 * ntags for tags
+ * vallen for value;
+ */
+ datap->data = (char *) malloc(strlen(kwordp)+
+ 1+
+ (ntags*sizeof(krb5_int32))+
+ vallen+1);
+ if (datap->data) {
+ datap->length = strlen(kwordp)+1+(ntags*sizeof(krb5_int32))+vallen;
+ cp = (unsigned char *) datap->data;
+ cp[datap->length] = '\0';
+ sprintf((char *) cp, "%s=", kwordp);
+ cp += strlen((char *) cp);
+ for (i=0; i<ntags; i++) {
+ cp[0] = (unsigned char) ((taglist[i] >> 24) & 0xff);
+ cp[1] = (unsigned char) ((taglist[i] >> 16) & 0xff);
+ cp[2] = (unsigned char) ((taglist[i] >> 8) & 0xff);
+ cp[3] = (unsigned char) (taglist[i] & 0xff);
+ cp += sizeof(krb5_int32);
+ }
+ if (val && vallen)
+ memcpy(cp, val, vallen);
+ retval = 0;
+ }
+ return(retval);
+}
+\f
+#if !defined(_MSDOS) && !defined(_WIN32) && !defined(_MACINTOSH)
+/*
+ * krb5_adm_dbent_to_proto() - Convert database a database entry into
+ * an external attribute list.
+ *
+ * "valid" controls the generation of "datap" and "nentp". For each
+ * corresponding bit in "valid" a keyword-value pair is generated from
+ * values in "dbentp" or "password" and put into "datap". The number of
+ * generated pairs is returned in "nentp". Additionally, the KRB5_ADM_M_SET
+ * and KRB5_ADM_M_GET bits control whether we are generating attribute lists
+ * for a "set" operation or a "get" operation. One of these bits must be
+ * specified.
+ *
+ * Successful callers must free the storage for datap and datap->data
+ * either manually or using krb5_free_adm_data().
+ */
+krb5_error_code
+krb5_adm_dbent_to_proto(kcontext, valid, dbentp, password, nentp, datap)
+ krb5_context kcontext; /* Kerberos context */ /* In */
+ krb5_ui_4 valid; /* Valid bitmask */ /* In */
+ krb5_db_entry *dbentp; /* Database entry */ /* In */
+ char *password; /* New password for set */ /* In */
+ krb5_int32 *nentp; /* Number of components */ /* Out */
+ krb5_data **datap; /* Output list */ /* Out */
+{
+ krb5_error_code kret;
+ krb5_data *outlist;
+ size_t n2alloc;
+ int outindex;
+ krb5_boolean is_set;
+ krb5_ui_4 tmp;
+ krb5_int32 taglist[4];
+ krb5_tl_data *tl_data;
+ int keyind, attrind;
+
+ kret = 0;
+ /* First check out whether this is a set or get and the mask */
+ is_set = ((valid & KRB5_ADM_M_SET) == KRB5_ADM_M_SET);
+ if ((is_set && ((valid & ~KRB5_ADM_M_SET_VALID) != 0)) ||
+ (!is_set && ((valid & ~KRB5_ADM_M_GET_VALID) != 0)) ||
+ (!is_set && ((valid & KRB5_ADM_M_GET) == 0)))
+ return(EINVAL);
+
+ /*
+ * Compute the number of elements to allocate. First count set bits.
+ */
+ n2alloc = 0;
+ for (tmp = valid & ~(KRB5_ADM_M_SET|KRB5_ADM_M_GET);
+ tmp;
+ tmp >>= 1) {
+ if (tmp & 1)
+ n2alloc++;
+ }
+ if (valid & KRB5_ADM_M_AUXDATA)
+ n2alloc += (dbentp->n_tl_data - 1);
+ /*
+ * NOTE: If the number of per-key attributes increases, you must increase
+ * the 3 below. The 3 represents 1 for key version, 1 for key type and
+ * one for salt type.
+ */
+ if (valid & KRB5_ADM_M_KEYDATA)
+ n2alloc += ((dbentp->n_key_data*3)-1);
+
+ n2alloc *= sizeof(krb5_data);
+ outindex = 0;
+ outlist = (krb5_data *) malloc(n2alloc);
+ if (outlist) {
+ /* Clear out the output data list */
+ memset((char *) outlist, 0, n2alloc);
+
+ /* Handle password only for set request */
+ if (is_set &&
+ ((valid & KRB5_ADM_M_PASSWORD) != 0) &&
+ password) {
+ if (kret = format_kw_string(&outlist[outindex],
+ KRB5_ADM_KW_PASSWORD,
+ password))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle maximum ticket lifetime */
+ if ((valid & KRB5_ADM_M_MAXLIFE) != 0) {
+ if (kret = format_kw_integer(&outlist[outindex],
+ KRB5_ADM_KW_MAXLIFE,
+ (krb5_ui_4) dbentp->max_life))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle maximum renewable ticket lifetime */
+ if ((valid & KRB5_ADM_M_MAXRENEWLIFE) != 0) {
+ if (kret =
+ format_kw_integer(&outlist[outindex],
+ KRB5_ADM_KW_MAXRENEWLIFE,
+ (krb5_ui_4) dbentp->max_renewable_life))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle principal expiration */
+ if ((valid & KRB5_ADM_M_EXPIRATION) != 0) {
+ if (kret = format_kw_gentime(&outlist[outindex],
+ KRB5_ADM_KW_EXPIRATION,
+ &dbentp->expiration))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle password expiration */
+ if ((valid & KRB5_ADM_M_PWEXPIRATION) != 0) {
+ if (kret = format_kw_gentime(&outlist[outindex],
+ KRB5_ADM_KW_PWEXPIRATION,
+ &dbentp->pw_expiration))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Random key */
+ if ((valid & KRB5_ADM_M_RANDOMKEY) != 0) {
+ if (kret = format_kw_integer(&outlist[outindex],
+ KRB5_ADM_KW_RANDOMKEY,
+ 1))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle flags */
+ if ((valid & KRB5_ADM_M_FLAGS) != 0) {
+ if (kret = format_kw_integer(&outlist[outindex],
+ KRB5_ADM_KW_FLAGS,
+ (krb5_ui_4) dbentp->attributes))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle last successful password entry */
+ if (!is_set &&
+ ((valid & KRB5_ADM_M_LASTSUCCESS) != 0)) {
+ if (kret = format_kw_gentime(&outlist[outindex],
+ KRB5_ADM_KW_LASTSUCCESS,
+ &dbentp->last_success))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle last failed password attempt */
+ if (!is_set &&
+ ((valid & KRB5_ADM_M_LASTFAILED) != 0)) {
+ if (kret = format_kw_gentime(&outlist[outindex],
+ KRB5_ADM_KW_LASTFAILED,
+ &dbentp->last_failed))
+ goto choke;
+ else
+ outindex++;
+ }
+ /* Handle number of failed password attempts */
+ if (!is_set &&
+ ((valid & KRB5_ADM_M_FAILCOUNT) != 0)) {
+ if (kret = format_kw_integer(&outlist[outindex],
+ KRB5_ADM_KW_FAILCOUNT,
+ (krb5_ui_4) dbentp->fail_auth_count))
+ goto choke;
+ else
+ outindex++;
+ }
+
+ /* Handle the auxiliary data */
+ if ((valid & KRB5_ADM_M_AUXDATA) != 0) {
+ for (tl_data = dbentp->tl_data; tl_data; tl_data =
+ tl_data->tl_data_next) {
+ taglist[0] = (krb5_int32) tl_data->tl_data_type;
+ if (kret = format_kw_tagged(&outlist[outindex],
+ KRB5_ADM_KW_AUXDATA,
+ 1,
+ taglist,
+ (krb5_int32) tl_data->
+ tl_data_length,
+ tl_data->tl_data_contents))
+ goto choke;
+ else
+ outindex++;
+ }
+ }
+
+ /* Handle the key data */
+ if (!is_set &&
+ ((valid & KRB5_ADM_M_KEYDATA) != 0)) {
+ for (keyind = 0; keyind < dbentp->n_key_data; keyind++) {
+ /*
+ * First handle kvno
+ */
+ taglist[0] = (krb5_int32) keyind;
+ taglist[1] = (krb5_int32) -1;
+ taglist[2] = (krb5_int32) dbentp->key_data[keyind].
+ key_data_kvno;
+ if (kret = format_kw_tagged(&outlist[outindex],
+ KRB5_ADM_KW_KEYDATA,
+ 3,
+ taglist,
+ 0,
+ (krb5_octet *) NULL))
+ goto choke;
+ else
+ outindex++;
+
+ /*
+ * Then each attribute as supported.
+ */
+ for (attrind = 0;
+ attrind < KRB5_KDB_V1_KEY_DATA_ARRAY;
+ attrind++) {
+ taglist[1] = (krb5_int32) attrind;
+ taglist[2] = (krb5_int32) dbentp->key_data[keyind].
+ key_data_type[attrind];
+ if (kret = format_kw_tagged(&outlist[outindex],
+ KRB5_ADM_KW_KEYDATA,
+ 3,
+ taglist,
+ (krb5_int32) dbentp->
+ key_data[keyind].
+ key_data_length[attrind],
+ dbentp->key_data[keyind].
+ key_data_contents[attrind])
+ )
+ goto choke;
+ else
+ outindex++;
+ }
+ }
+ }
+
+ /* Finally, handle the extra data */
+ if ((valid & KRB5_ADM_M_EXTRADATA) != 0) {
+ if (kret = format_kw_tagged(&outlist[outindex],
+ KRB5_ADM_KW_EXTRADATA,
+ 0,
+ (krb5_int32 *) NULL,
+ (krb5_int32) dbentp->e_length,
+ dbentp->e_data))
+ goto choke;
+ else
+ outindex++;
+ }
+ }
+ else {
+ if (n2alloc)
+ kret = ENOMEM;
+ }
+ choke:
+ if (kret) {
+ if (outlist) {
+ int i;
+ for (i=0; i<outindex; i++) {
+ if (outlist[i].data) {
+ memset(outlist[i].data, 0, (size_t) outlist[i].length);
+ free(outlist[i].data);
+ }
+ }
+ free(outlist);
+ }
+ outlist = (krb5_data *) NULL;
+ outindex = 0;
+ }
+ *datap = outlist;
+ *nentp = outindex;
+ return(kret);
+}
+#endif
+
--- /dev/null
+/*
+ * lib/kadm/adm_rw.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * Routines to engage in the administrative (password changing) protocol.
+ */
+#define NEED_SOCKETS
+#include "k5-int.h"
+#include "adm_proto.h"
+
+/*
+ * Local prototypes (needed or else the PC will pass fail).
+ */
+static void kadm_copyin_int32 PROTOTYPE((char *, krb5_int32 *));
+static void kadm_copyout_int32 PROTOTYPE((krb5_int32, char *));
+
+/*
+ * Routines to [de]serialize integers.
+ *
+ * kadm_copyin_int32 - Move a 32-bit integer fron network byte order to
+ * host byte order.
+ * kadm_copyout_int32 - Move a 32-bit integer from host byte order to
+ * network byte order.
+ */
+static void
+kadm_copyin_int32(cp, ip)
+ char *cp;
+ krb5_int32 *ip;
+{
+ *ip = (((krb5_int32) ((unsigned char) cp[0]) << 24) +
+ ((krb5_int32) ((unsigned char) cp[1]) << 16) +
+ ((krb5_int32) ((unsigned char) cp[2]) << 8) +
+ ((krb5_int32) ((unsigned char) cp[3])));
+}
+
+static void
+kadm_copyout_int32(outint, cp)
+ krb5_int32 outint;
+ char *cp;
+{
+ cp[0] = (char) ((outint >> 24) & 0xff);
+ cp[1] = (char) ((outint >> 16) & 0xff);
+ cp[2] = (char) ((outint >> 8) & 0xff);
+ cp[3] = (char) (outint & 0xff);
+}
+\f
+/*
+ * krb5_free_adm_data() - Free data blocks allocated by read_adm... routines.
+ */
+void INTERFACE
+krb5_free_adm_data(kcontext, ncomp, datap)
+ krb5_context kcontext;
+ krb5_int32 ncomp;
+ krb5_data *datap;
+{
+ int i;
+
+ if (datap) {
+ for (i=0; i<ncomp; i++)
+ if (datap[i].data && (datap[i].length > 0))
+ krb5_xfree(datap[i].data);
+
+ krb5_xfree(datap);
+ }
+}
+\f
+/*
+ * krb5_send_adm_cmd() - Send an administrative command.
+ *
+ * Send a list of data in a KRB_PRIV message. Data takes the format:
+ * nargs (4 octets in network order)
+ * arg size 1 (4 octets in network order)
+ * arg data 1 ("arg size 1" octets)
+ * .
+ * .
+ * .
+ */
+krb5_error_code INTERFACE
+krb5_send_adm_cmd(kcontext, sock, ctx, nargs, arglist)
+ krb5_context kcontext; /* Context handle (In ) */
+ krb5_pointer sock; /* Socket to write to (In ) */
+ krb5_auth_context ctx; /* Auth context (In ) */
+ krb5_int32 nargs; /* Number of arguments (In ) */
+ krb5_data *arglist; /* Components to write (In ) */
+{
+ int writebufsize;
+ int i;
+ char *writebuf;
+ krb5_error_code ret;
+ krb5_int32 ac_flags;
+
+ /*
+ * First check that our auth context has the right flags in it.
+ */
+ if (ret = krb5_auth_con_getflags(kcontext, ctx, &ac_flags))
+ return(ret);
+
+ if ((ac_flags & (KRB5_AUTH_CONTEXT_RET_SEQUENCE|
+ KRB5_AUTH_CONTEXT_DO_SEQUENCE)) !=
+ (KRB5_AUTH_CONTEXT_RET_SEQUENCE|KRB5_AUTH_CONTEXT_DO_SEQUENCE)) {
+ /* XXX - need a better error */
+ return(KRB5KRB_AP_ERR_MSG_TYPE);
+ }
+
+ ret = 0;
+ /* Calculate write buffer size */
+ writebufsize = sizeof(krb5_int32);
+ for (i=0; i<nargs; i++) {
+ writebufsize += sizeof(krb5_int32); /* for argument size */
+ writebufsize += arglist[i].length; /* for actual arg */
+ }
+
+ if (writebuf = (char *) malloc(writebufsize)) {
+ char *curr;
+ krb5_data write_data, out_data;
+ krb5_replay_data replay_data;
+
+ /* Serialize into write buffer - first number of arguments */
+ curr = writebuf;
+ kadm_copyout_int32(nargs, curr);
+ curr += sizeof(krb5_int32);
+
+ /* Then the arguments */
+ for (i=0; i<nargs; i++) {
+ kadm_copyout_int32(arglist[i].length, curr);
+ curr += sizeof(krb5_int32);
+ memcpy(curr, arglist[i].data, arglist[i].length);
+ curr += arglist[i].length;
+ }
+
+ /* Set up the message */
+ write_data.length = writebufsize;
+ write_data.data = writebuf;
+
+ /* Generate the message */
+ if (!(ret = krb5_mk_priv(kcontext,
+ ctx,
+ &write_data,
+ &out_data,
+ &replay_data))) {
+ /* Write the message */
+ if (ret = krb5_write_message(kcontext, sock, &out_data))
+ goto cleanup;
+ krb5_xfree(out_data.data);
+ }
+
+ cleanup:
+ /* Paranoia */
+ memset(writebuf, 0, writebufsize);
+ free(writebuf);
+ }
+ else {
+ /* error */
+ ret = ENOMEM;
+ }
+ return(ret);
+}
+\f
+/*
+ * krb5_send_adm_reply() - Send an administrative reply.
+ *
+ * Send a reply in a KRB_PRIV message. Data takes the format:
+ * status (4 octets in network order)
+ * ncomps (4 octets in network order)
+ * comp size 1 (4 octets in network order)
+ * comp data 1 ("comp size 1" octets)
+ * .
+ * .
+ * .
+ */
+krb5_error_code
+krb5_send_adm_reply(kcontext, sock, ctx, cmd_stat, ncomps, complist)
+ krb5_context kcontext; /* Context handle (In ) */
+ krb5_pointer sock; /* Socket to write to (In ) */
+ krb5_auth_context ctx; /* Auth context (In ) */
+ krb5_int32 cmd_stat; /* Command status (In ) */
+ krb5_int32 ncomps; /* Number of arguments (In ) */
+ krb5_data *complist; /* Components to write (In ) */
+{
+ int writebufsize;
+ int i;
+ char *writebuf;
+ krb5_error_code ret;
+ krb5_int32 ac_flags;
+
+ /*
+ * First check that our auth context has the right flags in it.
+ */
+ if (ret = krb5_auth_con_getflags(kcontext, ctx, &ac_flags))
+ return(ret);
+
+ if ((ac_flags & (KRB5_AUTH_CONTEXT_RET_SEQUENCE|
+ KRB5_AUTH_CONTEXT_DO_SEQUENCE)) !=
+ (KRB5_AUTH_CONTEXT_RET_SEQUENCE|KRB5_AUTH_CONTEXT_DO_SEQUENCE)) {
+ /* XXX - need a better error */
+ return(KRB5KRB_AP_ERR_MSG_TYPE);
+ }
+
+ ret = 0;
+ /* Calculate write buffer size */
+ writebufsize = 2 * sizeof(krb5_int32);
+ for (i=0; i<ncomps; i++) {
+ writebufsize += sizeof(krb5_int32); /* for argument size */
+ writebufsize += complist[i].length; /* for actual arg */
+ }
+
+ if (writebuf = (char *) malloc(writebufsize)) {
+ char *curr;
+ krb5_data write_data, out_data;
+ krb5_replay_data replay_data;
+
+ /* Serialize into write buffer - first command status */
+ curr = writebuf;
+ kadm_copyout_int32(cmd_stat, curr);
+ curr += sizeof(krb5_int32);
+
+ /* Now number of reply components */
+ kadm_copyout_int32(ncomps, curr);
+ curr += sizeof(krb5_int32);
+
+ /* Then the arguments */
+ for (i=0; i<ncomps; i++) {
+ kadm_copyout_int32(complist[i].length, curr);
+ curr += sizeof(krb5_int32);
+ memcpy(curr, complist[i].data, complist[i].length);
+ curr += complist[i].length;
+ }
+
+ /* Set up the message */
+ write_data.length = writebufsize;
+ write_data.data = writebuf;
+
+ /* Generate the message */
+ if (!(ret = krb5_mk_priv(kcontext,
+ ctx,
+ &write_data,
+ &out_data,
+ &replay_data))) {
+ /* Write the message */
+ if (ret = krb5_write_message(kcontext, sock, &out_data))
+ goto cleanup;
+ krb5_xfree(out_data.data);
+ }
+
+ cleanup:
+ /* Paranoia */
+ memset(writebuf, 0, writebufsize);
+ free(writebuf);
+ }
+ else {
+ /* error */
+ ret = ENOMEM;
+ }
+ return(ret);
+}
+\f
+/*
+ * krb5_read_adm_cmd() - Read an administrative protocol command.
+ *
+ * Read an administrative command from the socket. Expect data in the
+ * same format as send_adm_cmd shoots them out in.
+ *
+ * It is the caller's responsibility to free the memory allocated for
+ * the read in argument list.
+ */
+krb5_error_code
+krb5_read_adm_cmd(kcontext, sock, ctx, nargs, arglist)
+ krb5_context kcontext; /* Context handle (In ) */
+ krb5_pointer sock; /* Socket to read from (In ) */
+ krb5_auth_context ctx; /* Auth context (In ) */
+ krb5_int32 *nargs; /* Number of arguments (Out) */
+ krb5_data **arglist; /* List of arguments (Out) */
+{
+ krb5_data read_data;
+ krb5_error_code ret;
+ krb5_data msg_data;
+ krb5_replay_data replay_data;
+ krb5_int32 ac_flags;
+ krb5_int32 len32;
+
+ /*
+ * First check that our auth context has the right flags in it.
+ */
+ if (ret = krb5_auth_con_getflags(kcontext, ctx, &ac_flags))
+ return(ret);
+
+ if ((ac_flags & (KRB5_AUTH_CONTEXT_RET_SEQUENCE|
+ KRB5_AUTH_CONTEXT_DO_SEQUENCE)) !=
+ (KRB5_AUTH_CONTEXT_RET_SEQUENCE|KRB5_AUTH_CONTEXT_DO_SEQUENCE)) {
+ /* XXX - need a better error */
+ return(KRB5KRB_AP_ERR_MSG_TYPE);
+ }
+
+ if (!(ret = krb5_read_message(kcontext, sock, &read_data))) {
+ if (!(ret = krb5_rd_priv(kcontext,
+ ctx,
+ &read_data,
+ &msg_data,
+ &replay_data))) {
+ char *curr;
+ int replyok;
+ int i;
+
+ replyok = 0;
+ /* We'd better have at least one reply component */
+ if (msg_data.length >= sizeof(krb5_int32)) {
+ curr = msg_data.data;
+ kadm_copyin_int32(curr, nargs);
+ curr += sizeof(krb5_int32);
+
+ /* Are there any components to copy? */
+ if (*nargs > 0) {
+
+ /* Get the memory for the list */
+ if (*arglist = (krb5_data *)
+ malloc((size_t) (*nargs) * sizeof(krb5_data))) {
+ krb5_data *xarglist;
+
+ xarglist = *arglist;
+ memset((char *) (xarglist), 0,
+ (size_t) (*nargs) * sizeof(krb5_data));
+
+ replyok = 1;
+ /* Copy out each list entry */
+ for (i=0; i<*nargs; i++) {
+
+ /* First get the length of the reply component */
+ if (curr + sizeof(krb5_int32) - msg_data.data <=
+ msg_data.length) {
+
+ kadm_copyin_int32(curr, &len32);
+ xarglist[i].length = (int) len32;
+ curr += sizeof(krb5_int32);
+
+ /* Then get the memory for the actual data */
+ if ((curr + xarglist[i].length -
+ msg_data.data <= msg_data.length) &&
+ (xarglist[i].data = (char *)
+ malloc(xarglist[i].length+1))) {
+
+ /* Then copy it out */
+ memcpy(xarglist[i].data,
+ curr,
+ xarglist[i].length);
+ curr += xarglist[i].length;
+
+ /* Null terminate for convenience */
+ xarglist[i].data[xarglist[i].length]
+ = '\0';
+ }
+ else {
+ /* Not enough remaining data. */
+ replyok = 0;
+ break;
+ }
+ }
+ else {
+ /* Not enough remaining data */
+ replyok = 0;
+ break;
+ }
+ }
+ if (!replyok)
+ krb5_free_adm_data(kcontext, *nargs, *arglist);
+ }
+ }
+ else {
+ if (*nargs == 0) {
+ *arglist = (krb5_data *) NULL;
+ replyok = 1;
+ }
+ }
+ }
+ if (!replyok) {
+ ret = KRB5KRB_AP_ERR_MSG_TYPE; /* syntax error */
+ }
+ memset(msg_data.data, 0, msg_data.length);
+ krb5_xfree(msg_data.data);
+ }
+ krb5_xfree(read_data.data);
+ }
+ return(ret);
+}
+\f
+/*
+ * krb5_read_adm_reply() - Read an administrative protocol response.
+ *
+ * Expect to read them out in the same format as send_adm_reply shoots them
+ * in.
+ *
+ * It is the caller's responsibility to free the memory allocated for
+ * the read in component list.
+ */
+krb5_error_code INTERFACE
+krb5_read_adm_reply(kcontext, sock, ctx, cmd_stat, ncomps, complist)
+ krb5_context kcontext; /* Context handle (In ) */
+ krb5_pointer sock; /* Socket to read from (In ) */
+ krb5_auth_context ctx; /* Auth context (In ) */
+ krb5_int32 *cmd_stat; /* Command status (Out) */
+ krb5_int32 *ncomps; /* # of reply components(Out) */
+ krb5_data **complist; /* List of components (Out) */
+{
+ krb5_data read_data;
+ krb5_error_code ret;
+ krb5_data msg_data;
+ krb5_replay_data replay_data;
+ krb5_int32 ac_flags;
+ krb5_int32 len32;
+
+ /*
+ * First check that our auth context has the right flags in it.
+ */
+ if (ret = krb5_auth_con_getflags(kcontext, ctx, &ac_flags))
+ return(ret);
+
+ if ((ac_flags & (KRB5_AUTH_CONTEXT_RET_SEQUENCE|
+ KRB5_AUTH_CONTEXT_DO_SEQUENCE)) !=
+ (KRB5_AUTH_CONTEXT_RET_SEQUENCE|KRB5_AUTH_CONTEXT_DO_SEQUENCE)) {
+ /* XXX - need a better error */
+ return(KRB5KRB_AP_ERR_MSG_TYPE);
+ }
+
+ if (!(ret = krb5_read_message(kcontext, sock, &read_data))) {
+ if (!(ret = krb5_rd_priv(kcontext,
+ ctx,
+ &read_data,
+ &msg_data,
+ &replay_data))) {
+ char *curr;
+ int replyok;
+ int i;
+
+ replyok = 0;
+ /* We'd better have at least two reply components */
+ if (msg_data.length >= (2*sizeof(krb5_int32))) {
+ curr = msg_data.data;
+ kadm_copyin_int32(curr, cmd_stat);
+ curr += sizeof(krb5_int32);
+ kadm_copyin_int32(curr, ncomps);
+ curr += sizeof(krb5_int32);
+
+ /* Are there any components to copy? */
+ if (*ncomps > 0) {
+
+ /* Get the memory for the list */
+ if (*complist = (krb5_data *)
+ malloc((size_t) ((*ncomps) * sizeof(krb5_data)))) {
+ krb5_data *xcomplist;
+
+ xcomplist = *complist;
+ memset((char *) (xcomplist), 0,
+ (size_t) ((*ncomps) * sizeof(krb5_data)));
+
+ replyok = 1;
+ /* Copy out each list entry */
+ for (i=0; i<*ncomps; i++) {
+
+ /* First get the length of the reply component */
+ if (curr + sizeof(krb5_int32) - msg_data.data <=
+ msg_data.length) {
+ kadm_copyin_int32(curr, &len32);
+ xcomplist[i].length = (int) len32;
+ curr += sizeof(krb5_int32);
+
+ /* Then get the memory for the actual data */
+ if ((curr + xcomplist[i].length -
+ msg_data.data <= msg_data.length) &&
+ (xcomplist[i].data = (char *)
+ malloc(xcomplist[i].length+1))) {
+
+ /* Then copy it out */
+ memcpy(xcomplist[i].data,
+ curr,
+ xcomplist[i].length);
+ curr += xcomplist[i].length;
+
+ /* Null terminate for convenience */
+ xcomplist[i].data[xcomplist[i].length]
+ = '\0';
+ }
+ else {
+ /* Not enough remaining data. */
+ replyok = 0;
+ break;
+ }
+ }
+ else {
+ /* Not enough remaining data */
+ replyok = 0;
+ break;
+ }
+ }
+ if (!replyok)
+ krb5_free_adm_data(kcontext, *ncomps, *complist);
+ }
+ }
+ else {
+ if (*ncomps == 0) {
+ *complist = (krb5_data *) NULL;
+ replyok = 1;
+ }
+ }
+ }
+ if (!replyok) {
+ ret = KRB5KRB_AP_ERR_MSG_TYPE; /* syntax error */
+ }
+ memset(msg_data.data, 0, msg_data.length);
+ krb5_xfree(msg_data.data);
+ }
+ krb5_xfree(read_data.data);
+ }
+ return(ret);
+}
--- /dev/null
+/*
+ * lib/kadm/alt_prof.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * alt_prof.c - Implement alternate profile file handling.
+ */
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+#include <stdio.h>
+#include <ctype.h>
+
+/*
+ * krb5_aprof_init() - Initialize alternate profile context.
+ *
+ * Parameters:
+ * fname - default file name of the profile.
+ * envname - environment variable name which can override fname.
+ * acontextp - Pointer to opaque context for alternate profile.
+ *
+ * Returns:
+ * error codes from profile_init()
+ */
+krb5_error_code
+krb5_aprof_init(fname, envname, acontextp)
+ char *fname;
+ char *envname;
+ krb5_pointer *acontextp;
+{
+ krb5_error_code kret;
+ const char *namelist[2];
+ profile_t profile;
+
+ namelist[1] = (char *) NULL;
+ profile = (profile_t) NULL;
+ if (envname) {
+ if ((namelist[0] = getenv(envname))) {
+ if (!(kret = profile_init(namelist, &profile))) {
+ *acontextp = (krb5_pointer) profile;
+ return(0);
+ }
+ }
+ }
+ namelist[0] = fname;
+ profile = (profile_t) NULL;
+ if (!(kret = profile_init(namelist, &profile))) {
+ *acontextp = (krb5_pointer) profile;
+ return(0);
+ }
+ return(kret);
+}
+
+/*
+ * krb5_aprof_getvals() - Get values from alternate profile.
+ *
+ * Parameters:
+ * acontext - opaque context for alternate profile.
+ * hierarchy - hierarchy of value to retrieve.
+ * retdata - Returned data values.
+ *
+ * Returns:
+ * error codes from profile_get_values()
+ */
+krb5_error_code
+krb5_aprof_getvals(acontext, hierarchy, retdata)
+ krb5_pointer acontext;
+ const char **hierarchy;
+ char ***retdata;
+{
+ return(profile_get_values((profile_t) acontext,
+ hierarchy,
+ retdata));
+}
+
+/*
+ * krb5_aprof_get_deltat() - Get a delta time value from the alternate
+ * profile.
+ *
+ * Parameters:
+ * acontext - opaque context for alternate profile.
+ * hierarchy - hierarchy of value to retrieve.
+ * uselast - if true, use last value, otherwise use
+ * first value found.
+ * deltatp - returned delta time value.
+ *
+ * Returns:
+ * error codes from profile_get_values()
+ * error codes from krb5_string_to_deltat()
+ */
+krb5_error_code
+krb5_aprof_get_deltat(acontext, hierarchy, uselast, deltatp)
+ krb5_pointer acontext;
+ const char **hierarchy;
+ krb5_boolean uselast;
+ krb5_deltat *deltatp;
+{
+ krb5_error_code kret;
+ char **values;
+ char *valp;
+ int index;
+
+ if (!(kret = krb5_aprof_getvals(acontext, hierarchy, &values))) {
+ index = 0;
+ if (uselast) {
+ for (index=0; values[index]; index++);
+ index--;
+ }
+ valp = values[index];
+ kret = krb5_string_to_deltat(valp, deltatp);
+
+ /* Free the string storage */
+ for (index=0; values[index]; index++)
+ krb5_xfree(values[index]);
+ krb5_xfree(values);
+ }
+ return(kret);
+}
+
+/*
+ * krb5_aprof_get_string() - Get a string value from the alternate
+ * profile.
+ *
+ * Parameters:
+ * acontext - opaque context for alternate profile.
+ * hierarchy - hierarchy of value to retrieve.
+ * uselast - if true, use last value, otherwise use
+ * first value found.
+ * stringp - returned string value.
+ *
+ * Returns:
+ * error codes from profile_get_values()
+ */
+krb5_error_code
+krb5_aprof_get_string(acontext, hierarchy, uselast, stringp)
+ krb5_pointer acontext;
+ const char **hierarchy;
+ krb5_boolean uselast;
+ char **stringp;
+{
+ krb5_error_code kret;
+ char **values;
+ int index, i;
+
+ if (!(kret = krb5_aprof_getvals(acontext, hierarchy, &values))) {
+ index = 0;
+ if (uselast) {
+ for (index=0; values[index]; index++);
+ index--;
+ }
+
+ *stringp = values[index];
+
+ /* Free the string storage */
+ for (i=0; values[i]; i++)
+ if (i != index)
+ krb5_xfree(values[i]);
+ krb5_xfree(values);
+ }
+ return(kret);
+}
+
+/*
+ * krb5_aprof_get_int32() - Get a 32-bit integer value from the alternate
+ * profile.
+ *
+ * Parameters:
+ * acontext - opaque context for alternate profile.
+ * hierarchy - hierarchy of value to retrieve.
+ * uselast - if true, use last value, otherwise use
+ * first value found.
+ * intp - returned 32-bit integer value.
+ *
+ * Returns:
+ * error codes from profile_get_values()
+ * EINVAL - value is not an integer
+ */
+krb5_error_code
+krb5_aprof_get_int32(acontext, hierarchy, uselast, intp)
+ krb5_pointer acontext;
+ const char **hierarchy;
+ krb5_boolean uselast;
+ krb5_int32 *intp;
+{
+ krb5_error_code kret;
+ char **values;
+ int index;
+
+ if (!(kret = krb5_aprof_getvals(acontext, hierarchy, &values))) {
+ index = 0;
+ if (uselast) {
+ for (index=0; values[index]; index++);
+ index--;
+ }
+
+ if (sscanf(values[index], "%d", intp) != 1)
+ kret = EINVAL;
+
+ /* Free the string storage */
+ for (index=0; values[index]; index++)
+ krb5_xfree(values[index]);
+ krb5_xfree(values);
+ }
+ return(kret);
+}
+
+/*
+ * krb5_aprof_finish() - Finish alternate profile context.
+ *
+ * Parameter:
+ * acontext - opaque context for alternate profile.
+ *
+ * Returns:
+ * 0 on success, something else on failure.
+ */
+krb5_error_code
+krb5_aprof_finish(acontext)
+ krb5_pointer acontext;
+{
+ profile_release(acontext);
+ return(0);
+}
+
+/*
+ * krb5_read_realm_params() - Read per-realm parameters from KDC
+ * alternate profile.
+ */
+krb5_error_code
+krb5_read_realm_params(kcontext, realm, kdcprofile, kdcenv, rparamp)
+ krb5_context kcontext;
+ char *realm;
+ char *kdcprofile;
+ char *kdcenv;
+ krb5_realm_params **rparamp;
+{
+ char *filename;
+ char *envname;
+ char *lrealm;
+ krb5_pointer aprofile = 0;
+ krb5_realm_params *rparams;
+ const char *hierarchy[4];
+ char *svalue;
+ krb5_int32 ivalue;
+ krb5_deltat dtvalue;
+
+ krb5_error_code kret;
+
+ filename = (kdcprofile) ? kdcprofile : DEFAULT_KDC_PROFILE;
+ envname = (kdcenv) ? kdcenv : KDC_PROFILE_ENV;
+
+ if (kcontext->profile_secure == TRUE) envname = 0;
+
+ rparams = (krb5_realm_params *) NULL;
+ if (realm)
+ lrealm = strdup(realm);
+ else {
+ kret = krb5_get_default_realm(kcontext, &lrealm);
+ if (kret)
+ goto cleanup;
+ }
+
+ kret = krb5_aprof_init(filename, envname, &aprofile);
+ if (kret)
+ goto cleanup;
+
+ rparams = (krb5_realm_params *) malloc(sizeof(krb5_realm_params));
+ if (rparams == 0) {
+ kret = ENOMEM;
+ goto cleanup;
+ }
+
+ /* Initialize realm parameters */
+ memset((char *) rparams, 0, sizeof(krb5_realm_params));
+
+ /* Get the value for the database */
+ hierarchy[0] = "realms";
+ hierarchy[1] = lrealm;
+ hierarchy[2] = "database_name";
+ hierarchy[3] = (char *) NULL;
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue))
+ rparams->realm_dbname = svalue;
+
+ /* Get the value for the KDC port list */
+ hierarchy[2] = "kdc_ports";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue))
+ rparams->realm_kdc_ports = svalue;
+
+ /* Get the name of the acl file */
+ hierarchy[2] = "acl_file";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue))
+ rparams->realm_acl_file = svalue;
+
+ /* Get the value for the kadmind port */
+ hierarchy[2] = "kadmind_port";
+ if (!krb5_aprof_get_int32(aprofile, hierarchy, TRUE, &ivalue)) {
+ rparams->realm_kadmind_port = ivalue;
+ rparams->realm_kadmind_port_valid = 1;
+ }
+
+ /* Get the value for the master key name */
+ hierarchy[2] = "master_key_name";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue))
+ rparams->realm_mkey_name = svalue;
+
+ /* Get the value for the master key type */
+ hierarchy[2] = "master_key_type";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) {
+ if (!krb5_string_to_enctype(svalue, &rparams->realm_enctype))
+ rparams->realm_enctype_valid = 1;
+ krb5_xfree(svalue);
+ }
+
+ /* Get the value for the stashfile */
+ hierarchy[2] = "key_stash_file";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue))
+ rparams->realm_stash_file = svalue;
+
+ /* Get the value for maximum ticket lifetime. */
+ hierarchy[2] = "max_life";
+ if (!krb5_aprof_get_deltat(aprofile, hierarchy, TRUE, &dtvalue)) {
+ rparams->realm_max_life = dtvalue;
+ rparams->realm_max_life_valid = 1;
+ }
+
+ /* Get the value for maximum renewable ticket lifetime. */
+ hierarchy[2] = "max_renewable_life";
+ if (!krb5_aprof_get_deltat(aprofile, hierarchy, TRUE, &dtvalue)) {
+ rparams->realm_max_rlife = dtvalue;
+ rparams->realm_max_rlife_valid = 1;
+ }
+
+ /* Get the value for the default principal expiration */
+ hierarchy[2] = "default_principal_expiration";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) {
+ if (!krb5_string_to_timestamp(svalue,
+ &rparams->realm_expiration))
+ rparams->realm_expiration_valid = 1;
+ krb5_xfree(svalue);
+ }
+
+ /* Get the value for the default principal flags */
+ hierarchy[2] = "default_principal_flags";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) {
+ char *sp, *ep, *tp;
+
+ sp = svalue;
+ rparams->realm_flags = 0;
+ while (sp) {
+ if ((ep = strchr(sp, (int) ',')) ||
+ (ep = strchr(sp, (int) ' ')) ||
+ (ep = strchr(sp, (int) '\t'))) {
+ /* Fill in trailing whitespace of sp */
+ tp = ep - 1;
+ while (isspace(*tp) && (tp < sp)) {
+ *tp = '\0';
+ tp--;
+ }
+ *ep = '\0';
+ ep++;
+ /* Skip over trailing whitespace of ep */
+ while (isspace(*ep) && (*ep)) ep++;
+ }
+ /* Convert this flag */
+ if (krb5_string_to_flags(sp,
+ "+",
+ "-",
+ &rparams->realm_flags))
+ break;
+ sp = ep;
+ }
+ if (!sp)
+ rparams->realm_flags_valid = 1;
+ krb5_xfree(svalue);
+ }
+
+ /* Get the value for the supported enctype/salttype matrix */
+ hierarchy[2] = "supported_enctypes";
+ if (!krb5_aprof_get_string(aprofile, hierarchy, TRUE, &svalue)) {
+ krb5_string_to_keysalts(svalue,
+ ", \t", /* Tuple separators */
+ ":.-", /* Key/salt separators */
+ 0, /* No duplicates */
+ &rparams->realm_keysalts,
+ &rparams->realm_num_keysalts);
+ krb5_xfree(svalue);
+ }
+
+cleanup:
+ if (aprofile)
+ krb5_aprof_finish(aprofile);
+ if (lrealm)
+ free(lrealm);
+ if (kret) {
+ if (rparams)
+ krb5_free_realm_params(kcontext, rparams);
+ rparams = 0;
+ }
+ *rparamp = rparams;
+ return(kret);
+}
+
+/*
+ * krb5_free_realm_params() - Free data allocated by above.
+ */
+krb5_error_code
+krb5_free_realm_params(kcontext, rparams)
+ krb5_context kcontext;
+ krb5_realm_params *rparams;
+{
+ if (rparams) {
+ if (rparams->realm_profile)
+ krb5_xfree(rparams->realm_profile);
+ if (rparams->realm_dbname)
+ krb5_xfree(rparams->realm_dbname);
+ if (rparams->realm_mkey_name)
+ krb5_xfree(rparams->realm_mkey_name);
+ if (rparams->realm_stash_file)
+ krb5_xfree(rparams->realm_stash_file);
+ if (rparams->realm_keysalts)
+ krb5_xfree(rparams->realm_keysalts);
+ if (rparams->realm_kdc_ports)
+ krb5_xfree(rparams->realm_kdc_ports);
+ krb5_xfree(rparams);
+ }
+ return(0);
+}
+
--- /dev/null
+AC_INIT(configure.in)
+CONFIG_RULES
+AC_PROG_ARCHIVE
+AC_PROG_ARCHIVE_ADD
+AC_PROG_RANLIB
+AC_PROG_INSTALL
+AC_HEADER_STDARG
+AC_HAVE_HEADERS(pwd.h syslog.h)
+AC_HAVE_FUNCS(srand48 srand srandom syslog openlog closelog)
+AC_FUNC_CHECK(vsprintf,AC_DEFINE(HAVE_VSPRINTF))
+AC_PROG_AWK
+KRB5_RUN_FLAGS
+LinkFileDir(../libkadm.a, libkadm.a, ./kadm)
+AppendRule([all-unix:: ../libkadm.a])
+AppendRule([all:: all-$(WHAT)])
+V5_AC_OUTPUT_MAKEFILE
--- /dev/null
+/*
+ * lib/kadm/keysalt.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * keysalt.c - Routines to handle key/salt tuples.
+ */
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+static const char default_tupleseps[] = ", \t";
+static const char default_ksaltseps[] = ":.";
+
+/*
+ * krb5_keysalt_is_present() - Determine if a key/salt pair is present
+ * in a list of key/salt tuples.
+ *
+ * Salttype may be negative to indicate a search for only a enctype.
+ */
+krb5_boolean
+krb5_keysalt_is_present(ksaltlist, nksalts, enctype, salttype)
+ krb5_key_salt_tuple *ksaltlist;
+ krb5_int32 nksalts;
+ krb5_enctype enctype;
+ krb5_int32 salttype;
+{
+ krb5_boolean foundit;
+ int i;
+
+ foundit = 0;
+ if (ksaltlist) {
+ for (i=0; i<nksalts; i++) {
+ if ((ksaltlist[i].ks_enctype == enctype) &&
+ ((ksaltlist[i].ks_salttype == salttype) ||
+ (salttype < 0))) {
+ foundit = 1;
+ break;
+ }
+ }
+ }
+ return(foundit);
+}
+
+/*
+ * krb5_keysalt_iterate() - Do something for each unique key/salt
+ * combination.
+ *
+ * If ignoresalt set, then salttype is ignored.
+ */
+krb5_error_code
+krb5_keysalt_iterate(ksaltlist, nksalt, ignoresalt, iterator, arg)
+ krb5_key_salt_tuple *ksaltlist;
+ krb5_int32 nksalt;
+ krb5_boolean ignoresalt;
+ krb5_error_code (*iterator) KRB5_NPROTOTYPE((krb5_key_salt_tuple *,
+ krb5_pointer));
+ krb5_pointer arg;
+{
+ int i;
+ krb5_error_code kret;
+ krb5_key_salt_tuple scratch;
+
+ kret = 0;
+ for (i=0; i<nksalt; i++) {
+ scratch.ks_enctype = ksaltlist[i].ks_enctype;
+ scratch.ks_salttype = (ignoresalt) ? -1 : ksaltlist[i].ks_salttype;
+ if (!krb5_keysalt_is_present(ksaltlist,
+ i,
+ scratch.ks_enctype,
+ scratch.ks_salttype)) {
+ if (kret = (*iterator)(&scratch, arg))
+ break;
+ }
+ }
+ return(kret);
+}
+
+/*
+ * krb5_string_to_keysalts() - Convert a string representation to a list
+ * of key/salt tuples.
+ */
+krb5_error_code
+krb5_string_to_keysalts(string, tupleseps, ksaltseps, dups, ksaltp, nksaltp)
+ char *string;
+ const char *tupleseps;
+ const char *ksaltseps;
+ krb5_boolean dups;
+ krb5_key_salt_tuple **ksaltp;
+ krb5_int32 *nksaltp;
+{
+ krb5_error_code kret;
+ char *kp, *sp, *ep;
+ char sepchar, trailchar;
+ krb5_enctype ktype;
+ krb5_int32 stype;
+ krb5_key_salt_tuple *savep;
+ const char *tseplist;
+ const char *ksseplist;
+ const char *septmp;
+ size_t len;
+
+ kret = 0;
+ kp = string;
+ tseplist = (tupleseps) ? tupleseps : default_tupleseps;
+ ksseplist = (ksaltseps) ? ksaltseps : default_ksaltseps;
+ while (kp) {
+ /* Attempt to find a separator */
+ ep = (char *) NULL;
+ if (*tseplist) {
+ septmp = tseplist;
+ for (ep = strchr(kp, (int) *septmp);
+ *(++septmp) && !ep;
+ ep = strchr(kp, (int) *septmp));
+ }
+
+ if (ep) {
+ trailchar = *ep;
+ *ep = '\0';
+ ep++;
+ }
+ /*
+ * kp points to something (hopefully) of the form:
+ * <enctype><ksseplist><salttype>
+ * or
+ * <enctype>
+ */
+ sp = (char *) NULL;
+ /* Attempt to find a separator */
+ septmp = ksseplist;
+ for (sp = strchr(kp, (int) *septmp);
+ *(++septmp) && !sp;
+ ep = strchr(kp, (int) *septmp));
+
+ if (sp) {
+ /* Separate enctype from salttype */
+ sepchar = *sp;
+ *sp = '\0';
+ sp++;
+ }
+ else
+ stype = -1;
+
+ /*
+ * Attempt to parse enctype and salttype. If we parse well
+ * then make sure that it specifies a unique key/salt combo
+ */
+ if (!krb5_string_to_enctype(kp, &ktype) &&
+ (!sp || !krb5_string_to_salttype(sp, &stype)) &&
+ (dups ||
+ !krb5_keysalt_is_present(*ksaltp, *nksaltp, ktype, stype))) {
+
+ /* Squirrel away old keysalt array */
+ savep = *ksaltp;
+ len = (size_t) *nksaltp;
+
+ /* Get new keysalt array */
+ if (*ksaltp = (krb5_key_salt_tuple *)
+ malloc((len + 1) * sizeof(krb5_key_salt_tuple))) {
+
+ /* Copy old keysalt if appropriate */
+ if (savep) {
+ memcpy(*ksaltp, savep,
+ len * sizeof(krb5_key_salt_tuple));
+ krb5_xfree(savep);
+ }
+
+ /* Save our values */
+ (*ksaltp)[(*nksaltp)].ks_enctype = ktype;
+ (*ksaltp)[(*nksaltp)].ks_salttype = stype;
+ (*nksaltp)++;
+ }
+ else {
+ *ksaltp = savep;
+ break;
+ }
+ }
+ if (sp)
+ sp[-1] = sepchar;
+ if (ep)
+ ep[-1] = trailchar;
+ kp = ep;
+ }
+ return(kret);
+}
+
+
--- /dev/null
+.\" lib/kadm/krb5strings.M
+.\" Copyright 1995 by the Massachusetts Institute of Technology.
+.\"
+.\" Export of this software from the United States of America may
+.\" require a specific license from the United States Government.
+.\" It is the responsibility of any person or organization contemplating
+.\" export to obtain such a license before exporting.
+.\"
+.\" WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+.\" distribute this software and its documentation for any purpose and
+.\" without fee is hereby granted, provided that the above copyright
+.\" notice appear in all copies and that both that copyright notice and
+.\" this permission notice appear in supporting documentation, and that
+.\" the name of M.I.T. not be used in advertising or publicity pertaining
+.\" to distribution of the software without specific, written prior
+.\" permission. M.I.T. makes no representations about the suitability of
+.\" this software for any purpose. It is provided "as is" without express
+.\" or implied warranty.
+.\"
+.\"
+.TH KRB5STRINGS 3 "Kerberos Version 5.0" "MIT Project Athena"
+.SH NAME
+krb5strings \- String representations of Kerberos V5 internal data.
+.SH KEY TYPES
+The following strings specify valid key types for use by Kerberos V5.
+.TP 2i
+.I null
+Specifies KEYTYPE_NULL.
+.TP 2i
+.I des
+Specifies KEYTYPE_DES.
+
+.SH SALT TYPES
+The following strings specify valid salt types for use by Kerberos V5.
+.TP 2i
+.I normal
+Specifies KRB5_KDB_SALTTYPE_NORMAL.
+.TP 2i
+.I v4
+Specifies KRB5_KDB_SALTTYPE_V4.
+.TP 2i
+.I norealm
+Specifies KRB5_KDB_SALTTYPE_NOREALM.
+.TP 2i
+.I onlyrealm
+Specifies KRB5_KDB_SALTTYPE_ONLYREALM.
+.TP 2i
+.I afs3
+Specifies KRB5_KDB_SALTTYPE_AFS3.
+.TP 2i
+.I special
+Specifies KRB5_KDB_SALTTYPE_SPECIAL.
+
+.SH ENCRYPTION TYPES
+The following strings specify valid encryption types for use by Kerberos V5.
+.TP 2i
+.I null
+Specifies ETYPE_NULL.
+.TP 2i
+.I des-cbc-crc
+Specifies ETYPE_DES_CBC_CRC.
+.TP 2i
+.I des-cbc-md4
+Specifies ETYPE_DES_CBC_MD4.
+.TP 2i
+.I des-cbc-md5
+Specifies ETYPE_DES_CBC_MD5.
+.TP 2i
+.I raw-des-cbc
+Specifies ETYPE_RAW_DES_CBC.
+
+.SH CHECKSUM TYPES
+The following strings specify valid checksum types for use by Kerberos V5.
+.TP 2i
+.I crc32
+Specifies CKSUMTYPE_CRC32.
+.TP 2i
+.I md4
+Specifies CKSUMTYPE_RSA_MD4.
+.TP 2i
+.I md4-des
+Specifies CKSUMTYPE_RSA_MD4_DES.
+.TP 2i
+.I des-cbc
+Specifies CKSUMTYPE_DESCBC.
+.TP 2i
+.I md5
+Specifies CKSUMTYPE_RSA_MD5.
+.TP 2i
+.I md5-des
+Specifies CKSUMTYPE_RSA_MD5_DES.
+
+.SH PRINCIPAL FLAGS
+The following strings specify particular principal attributes for use by
+Kerberos V5.
+.TP 2i
+.I postdateable
+In the negative sense, specifies KRB5_KDB_DISALLOW_POSTDATED.
+.TP 2i
+.I forwardable
+In the negative sense, specifies KRB5_KDB_DISALLOW_FORWARDABLE.
+.TP 2i
+.I tgt-based
+In the negative sense, specifies KRB5_KDB_DISALLOW_TGT_BASED.
+.TP 2i
+.I renewable
+In the negative sense, specifies KRB5_KDB_DISALLOW_RENEWABLE.
+.TP 2i
+.I proxiable
+In the negative sense, specifies KRB5_KDB_DISALLOW_PROXIABLE.
+.TP 2i
+.I dup-skey
+In the negative sense, specifies KRB5_KDB_DISALLOW_DUP_SKEY.
+.TP 2i
+.I allow-tickets
+In the negative sense, specifies KRB5_KDB_DISALLOW_ALL_TIX.
+.TP 2i
+.I preauth
+Specifies KRB5_KDB_REQUIRES_PRE_AUTH.
+.TP 2i
+.I hwauth
+Specifies KRB5_KDB_REQUIRES_HW_AUTH.
+.TP 2i
+.I pwchange
+Specifies KRB5_KDB_REQUIRES_PWCHANGE.
+.TP 2i
+.I service
+In the negative sense, specifies KRB5_KDB_DISALLOW_SVR.
+.TP 2i
+.I pwservice
+Specifies KRB5_KDB_PWCHANGE_SERVICE.
+.TP 2i
+.I md5
+Specifies KRB5_KDB_SUPPORT_DESMD5.
+
+.SH ABSOLUTE TIME
+The following formats specify valid absolute time strings for use by Kerberos
+V5. In the description the following abbreviations are used:
+.in +1i
+.B yy
+denotes the last two digits of the year.
+
+.B mm
+denotes the two digits representing the month (01 = January, 12 = December).
+
+.B dd
+denotes the two digits representing the day of the month.
+
+.B HH
+denotes the two digits representing the hour of the day (24-hour format).
+
+.B MM
+denotes the two digits representing the minute of the hour.
+
+.B SS
+denotes the two digits representing the second of the minute.
+.in -1i
+
+.TP 2i
+.I yymmddHHMMSS
+e.g. 951225093023 specifies 9:30:23 a.m. on 25 December 1995.
+.TP 2i
+.I yy.mm.dd.HH.MM.SS
+e.g. 95.12.25.09.30.23 specifies 9:30:23 a.m. on 25 December 1995.
+.TP 2i
+.I yymmddHHMM
+e.g. 9512250930 specifies 9:30 a.m. on 25 December 1995.
+.TP 2i
+.I HHMMSS
+e.g. 123056 specifies 12:30:56 p.m. today.
+.TP 2i
+.I HHMM
+e.g. 2130 specifies 9:30 p.m. today.
+.TP 2i
+.I HH:MM:SS
+e.g. 12:30:56 specifies 12:30:56 p.m. today.
+.TP 2i
+.I HH:MM
+e.g. 21:30 specifies 9:30 p.m. today.
+.PP
+The following formats are recognized if the target operating system supports
+the
+.B strptime(3)
+function. See the
+.B strptime(3)
+manual page for a description of the format fields:
+.TP 2i
+.I %x:%X
+Specifies the locale-dependent short date format concatenated by a colon with
+the locale-dependent short time format.
+.TP 2i
+.I %d-%b-%Y:%T
+e.g. 10-January-1995:16:42:23 in U.S. locales.
+.TP 2i
+.I %d-%b-%Y:%R
+e.g. 10-January-1995:16:42 in U.S. locales.
+
+.SH DELTA TIME
+The following formats specify valid delta time strings for use by Kerberos
+V5. In the description the following abbreviations are used:
+.in +1i
+.B d
+denotes a number of days.
+
+.B h[h]
+denotes one or two digits representing a number of hours.
+
+.B m[m]
+denotes one or two digits representing a number of minutes.
+
+.B s[s]
+denotes one or two digits representing a number of seconds.
+.in -1i
+.TP 2i
+.I d-hh:mm:ss
+e.g. 7-04:30:01 specifies seven days, four hours 30 minutes and one second.
+.TP 2i
+.I ddhhmmss
+e.g. 7d4h30m1s specifies seven days, four hours 30 minutes and one second.
+.TP 2i
+.I h:mm:ss
+e.g. 6:23:16 specifies six hours, 23 minutes and 16 seconds.
+.TP 2i
+.I hhmmss
+e.g. 6h23m16s specifies six hours 23 minutes and 16 seconds.
+.TP 2i
+.I h:mm
+e.g. 2:30 specifies two hours and 30 minutes.
+.TP 2i
+.I hhmm
+e.g. 2h30m specifies two hours and 30 minutes.
+.TP 2i
+.I dd
+e.g. 2d specifies two days.
+.TP 2i
+.I hh
+e.g. 4h specifies four hours.
+.TP 2i
+.I mm
+e.g. 30m specifies 30 minutes.
+.TP 2i
+.I ss
+e.g. 3600s specifies 3600 seconds.
+
+.SH SEE ALSO
+kdc.conf(5), krb5kdc(8), kdb5_edit(8), kadmin5(8), strptime(3)
+
+
+
+
--- /dev/null
+/*
+ * lib/kadm/logger.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+#if !defined(_MSDOS)
+
+/*
+ * logger.c - Handle logging functions for those who want it.
+ */
+#include "k5-int.h"
+#include "adm_proto.h"
+#include "com_err.h"
+#include <stdio.h>
+#if HAVE_SYSLOG_H
+#include <syslog.h>
+#endif /* HAVE_SYSLOG_H */
+#if HAVE_STDARG_H
+#include <stdarg.h>
+#else /* HAVE_STDARG_H */
+#include <varargs.h>
+#endif /* HAVE_STDARG_H */
+
+#define KRB5_KLOG_MAX_ERRMSG_SIZE 1024
+#ifndef MAXHOSTNAMELEN
+#define MAXHOSTNAMELEN 256
+#endif /* MAXHOSTNAMELEN */
+
+/* This is to assure that we have at least one match in the syslog stuff */
+#ifndef LOG_AUTH
+#define LOG_AUTH 0
+#endif /* LOG_AUTH */
+#ifndef LOG_ERR
+#define LOG_ERR 0
+#endif /* LOG_ERR */
+
+static const char lspec_parse_err_1[] = "%s: cannot parse <%s>\n";
+static const char lspec_parse_err_2[] = "%s: warning - logging entry syntax error\n";
+static const char log_file_err[] = "%s: error writing to %s\n";
+static const char log_device_err[] = "%s: error writing to %s device\n";
+static const char log_ufo_string[] = "???";
+static const char log_emerg_string[] = "EMERGENCY";
+static const char log_alert_string[] = "ALERT";
+static const char log_crit_string[] = "CRITICAL";
+static const char log_err_string[] = "Error";
+static const char log_warning_string[] = "Warning";
+static const char log_notice_string[] = "Notice";
+static const char log_info_string[] = "info";
+static const char log_debug_string[] = "debug";
+\f
+/*
+ * Output logging.
+ *
+ * Output logging is now controlled by the configuration file. We can specify
+ * the following syntaxes under the [logging]->entity specification.
+ * FILE<opentype><pathname>
+ * SYSLOG[=<severity>[:<facility>]]
+ * STDERR
+ * CONSOLE
+ * DEVICE=<device-spec>
+ *
+ * Where:
+ * <opentype> is ":" for open/append, "=" for open/create.
+ * <pathname> is a valid path name.
+ * <severity> is one of: (default = ERR)
+ * EMERG
+ * ALERT
+ * CRIT
+ * ERR
+ * WARNING
+ * NOTICE
+ * INFO
+ * DEBUG
+ * <facility> is one of: (default = AUTH)
+ * KERN
+ * USER
+ * MAIL
+ * DAEMON
+ * AUTH
+ * LPR
+ * NEWS
+ * UUCP
+ * CRON
+ * LOCAL0..LOCAL7
+ * <device-spec> is a valid device specification.
+ */
+struct log_entry {
+ enum log_type { K_LOG_FILE,
+ K_LOG_SYSLOG,
+ K_LOG_STDERR,
+ K_LOG_CONSOLE,
+ K_LOG_DEVICE,
+ K_LOG_NONE } log_type;
+ krb5_pointer log_2free;
+ union log_union {
+ struct log_file {
+ FILE *lf_filep;
+ char *lf_fname;
+ } log_file;
+ struct log_syslog {
+ int ls_facility;
+ int ls_severity;
+ } log_syslog;
+ struct log_device {
+ FILE *ld_filep;
+ char *ld_devname;
+ } log_device;
+ } log_union;
+};
+#define lfu_filep log_union.log_file.lf_filep
+#define lfu_fname log_union.log_file.lf_fname
+#define lsu_facility log_union.log_syslog.ls_facility
+#define lsu_severity log_union.log_syslog.ls_severity
+#define ldu_filep log_union.log_device.ld_filep
+#define ldu_devname log_union.log_device.ld_devname
+
+struct log_control {
+ struct log_entry *log_entries;
+ int log_nentries;
+ char *log_whoami;
+ char *log_hostname;
+ krb5_boolean log_opened;
+};
+
+static struct log_control log_control = {
+ (struct log_entry *) NULL,
+ 0,
+ (char *) NULL,
+ (char *) NULL,
+ 0
+};
+static struct log_entry def_log_entry;
+
+/*
+ * These macros define any special processing that needs to happen for
+ * devices. For unix, of course, this is hardly anything.
+ */
+#define DEVICE_OPEN(d, m) fopen(d, m)
+#define CONSOLE_OPEN(m) fopen("/dev/console", m)
+#define DEVICE_PRINT(f, m) ((fprintf(f, m) >= 0) ? \
+ (fprintf(f, "\r\n"), fflush(f), 0) : \
+ -1)
+#define DEVICE_CLOSE(d) fclose(d)
+
+\f
+/*
+ * klog_com_err_proc() - Handle com_err(3) messages as specified by the
+ * profile.
+ */
+static void
+klog_com_err_proc(whoami, code, format, ap)
+ const char *whoami;
+ long code;
+ const char *format;
+ va_list ap;
+{
+ char outbuf[KRB5_KLOG_MAX_ERRMSG_SIZE];
+ int lindex;
+ char *actual_format;
+#if HAVE_SYSLOG
+ int log_pri = -1;
+#endif /* HAVE_SYSLOG */
+ char *cp;
+ char *syslogp;
+
+ /* Make the header */
+ sprintf(outbuf, "%s: ", whoami);
+ /*
+ * Squirrel away address after header for syslog since syslog makes
+ * a header
+ */
+ syslogp = &outbuf[strlen(outbuf)];
+
+ /* If reporting an error message, separate it. */
+ if (code) {
+ strcat(outbuf, error_message(code));
+ strcat(outbuf, " - ");
+ }
+ cp = &outbuf[strlen(outbuf)];
+
+ actual_format = (char *) format;
+#if HAVE_SYSLOG
+ /*
+ * This is an unpleasant hack. If the first character is less than
+ * 8, then we assume that it is a priority.
+ *
+ * Since it is not guaranteed that there is a direct mapping between
+ * syslog priorities (e.g. Ultrix and old BSD), we resort to this
+ * intermediate representation.
+ */
+ if ((((unsigned char) *format) > 0) && (((unsigned char) *format) <= 8)) {
+ actual_format = (char *) (format + 1);
+ switch ((unsigned char) *format) {
+#ifdef LOG_EMERG
+ case 1:
+ log_pri = LOG_EMERG;
+ break;
+#endif /* LOG_EMERG */
+#ifdef LOG_ALERT
+ case 2:
+ log_pri = LOG_ALERT;
+ break;
+#endif /* LOG_ALERT */
+#ifdef LOG_CRIT
+ case 3:
+ log_pri = LOG_CRIT;
+ break;
+#endif /* LOG_CRIT */
+ default:
+ case 4:
+ log_pri = LOG_ERR;
+ break;
+#ifdef LOG_WARNING
+ case 5:
+ log_pri = LOG_WARNING;
+ break;
+#endif /* LOG_WARNING */
+#ifdef LOG_NOTICE
+ case 6:
+ log_pri = LOG_NOTICE;
+ break;
+#endif /* LOG_NOTICE */
+#ifdef LOG_INFO
+ case 7:
+ log_pri = LOG_INFO;
+ break;
+#endif /* LOG_INFO */
+#ifdef LOG_DEBUG
+ case 8:
+ log_pri = LOG_DEBUG;
+ break;
+#endif /* LOG_DEBUG */
+ }
+ }
+#endif /* HAVE_SYSLOG */
+
+ /* Now format the actual message */
+#if HAVE_VSPRINTF
+ vsprintf(cp, actual_format, ap);
+#else /* HAVE_VSPRINTF */
+ sprintf(cp, actual_format, ((int *) ap)[0], ((int *) ap)[1],
+ ((int *) ap)[2], ((int *) ap)[3],
+ ((int *) ap)[4], ((int *) ap)[5]);
+#endif /* HAVE_VSPRINTF */
+
+ /*
+ * Now that we have the message formatted, perform the output to each
+ * logging specification.
+ */
+ for (lindex = 0; lindex < log_control.log_nentries; lindex++) {
+ switch (log_control.log_entries[lindex].log_type) {
+ case K_LOG_FILE:
+ case K_LOG_STDERR:
+ /*
+ * Files/standard error.
+ */
+ if (fprintf(log_control.log_entries[lindex].lfu_filep,
+ outbuf) < 0) {
+ /* Attempt to report error */
+ fprintf(stderr, log_file_err, whoami,
+ log_control.log_entries[lindex].lfu_fname);
+ }
+ else {
+ fprintf(log_control.log_entries[lindex].lfu_filep, "\n");
+ fflush(log_control.log_entries[lindex].lfu_filep);
+ }
+ break;
+ case K_LOG_CONSOLE:
+ case K_LOG_DEVICE:
+ /*
+ * Devices (may need special handling)
+ */
+ if (DEVICE_PRINT(log_control.log_entries[lindex].ldu_filep,
+ outbuf) < 0) {
+ /* Attempt to report error */
+ fprintf(stderr, log_device_err, whoami,
+ log_control.log_entries[lindex].ldu_devname);
+ }
+ break;
+#if HAVE_SYSLOG
+ case K_LOG_SYSLOG:
+ /*
+ * System log.
+ */
+ /*
+ * If we have specified a priority through our hackery, then
+ * use it, otherwise use the default.
+ */
+ if (log_pri >= 0)
+ log_pri |= log_control.log_entries[lindex].lsu_facility;
+ else
+ log_pri = log_control.log_entries[lindex].lsu_facility |
+ log_control.log_entries[lindex].lsu_severity;
+
+ /* Log the message with our header trimmed off */
+ syslog(log_pri, syslogp);
+ break;
+#endif /* HAVE_SYSLOG */
+ default:
+ break;
+ }
+ }
+}
+\f
+/*
+ * krb5_klog_init() - Initialize logging.
+ *
+ * This routine parses the syntax described above to specify destinations for
+ * com_err(3) or krb5_klog_syslog() messages generated by the caller.
+ *
+ * Parameters:
+ * kcontext - Kerberos context.
+ * ename - Entity name as it is to appear in the profile.
+ * whoami - Entity name as it is to appear in error output.
+ * do_com_err - Take over com_err(3) processing.
+ *
+ * Implicit inputs:
+ * stderr - This is where STDERR output goes.
+ *
+ * Implicit outputs:
+ * log_nentries - Number of log entries, both valid and invalid.
+ * log_control - List of entries (log_nentries long) which contains
+ * data for klog_com_err_proc() to use to determine
+ * where/how to send output.
+ */
+krb5_error_code
+krb5_klog_init(kcontext, ename, whoami, do_com_err)
+ krb5_context kcontext;
+ char *ename;
+ char *whoami;
+ krb5_boolean do_com_err;
+{
+ const char *logging_profent[3];
+ const char *logging_defent[3];
+ char **logging_specs;
+ int i, ngood;
+ char *cp, *cp2;
+ char savec;
+ int error;
+ int do_openlog, log_facility;
+ FILE *f;
+
+ /* Initialize */
+ do_openlog = 0;
+ log_facility = 0;
+
+ /*
+ * Look up [logging]-><ename> in the profile. If that doesn't
+ * succeed, then look for [logging]->default.
+ */
+ logging_profent[0] = "logging";
+ logging_profent[1] = ename;
+ logging_profent[2] = (char *) NULL;
+ logging_defent[0] = "logging";
+ logging_defent[1] = "default";
+ logging_defent[2] = (char *) NULL;
+ logging_specs = (char **) NULL;
+ ngood = 0;
+ log_control.log_nentries = 0;
+ if (!profile_get_values(kcontext->profile,
+ logging_profent,
+ &logging_specs) ||
+ !profile_get_values(kcontext->profile,
+ logging_defent,
+ &logging_specs)) {
+ /*
+ * We have a match, so we first count the number of elements
+ */
+ for (log_control.log_nentries = 0;
+ logging_specs[log_control.log_nentries];
+ log_control.log_nentries++);
+
+ /*
+ * Now allocate our structure.
+ */
+ log_control.log_entries = (struct log_entry *)
+ malloc(log_control.log_nentries * sizeof(struct log_entry));
+ if (log_control.log_entries) {
+ /*
+ * Scan through the list.
+ */
+ for (i=0; i<log_control.log_nentries; i++) {
+ log_control.log_entries[i].log_type = K_LOG_NONE;
+ log_control.log_entries[i].log_2free = logging_specs[i];
+ /*
+ * The format is:
+ * <whitespace><data><whitespace>
+ * so, trim off the leading and trailing whitespace here.
+ */
+ for (cp = logging_specs[i]; isspace(*cp); cp++);
+ for (cp2 = &logging_specs[i][strlen(logging_specs[i])-1];
+ isspace(*cp2); cp2--);
+ cp2++;
+ *cp2 = '\0';
+ /*
+ * Is this a file?
+ */
+ if (!strncasecmp(cp, "FILE", 4)) {
+ /*
+ * Check for append/overwrite, then open the file.
+ */
+ if (cp[4] == ':' || cp[4] == '=') {
+ f = fopen(&cp[5], (cp[4] == ':') ? "a+" : "w");
+ if (f) {
+ log_control.log_entries[i].lfu_filep = f;
+ log_control.log_entries[i].log_type = K_LOG_FILE;
+ log_control.log_entries[i].lfu_fname = &cp[5];
+ } else {
+ fprintf(stderr,"Couldn't open log file %s: %s\n",
+ &cp[5], error_message(errno));
+ continue;
+ }
+ }
+ }
+#if HAVE_SYSLOG
+ /*
+ * Is this a syslog?
+ */
+ else if (!strncasecmp(cp, "SYSLOG", 6)) {
+ error = 0;
+ log_control.log_entries[i].lsu_facility = LOG_AUTH;
+ log_control.log_entries[i].lsu_severity = LOG_ERR;
+ /*
+ * Is there a severify specified?
+ */
+ if (cp[6] == ':') {
+ /*
+ * Find the end of the severity.
+ */
+ if (cp2 = strchr(&cp[7], ':')) {
+ savec = *cp2;
+ *cp2 = '\0';
+ cp2++;
+ }
+
+ /*
+ * Match a severity.
+ */
+ if (!strcasecmp(&cp[7], "ERR")) {
+ log_control.log_entries[i].lsu_severity = LOG_ERR;
+ }
+#ifdef LOG_EMERG
+ else if (!strcasecmp(&cp[7], "EMERG")) {
+ log_control.log_entries[i].lsu_severity =
+ LOG_EMERG;
+ }
+#endif /* LOG_EMERG */
+#ifdef LOG_ALERT
+ else if (!strcasecmp(&cp[7], "ALERT")) {
+ log_control.log_entries[i].lsu_severity =
+ LOG_ALERT;
+ }
+#endif /* LOG_ALERT */
+#ifdef LOG_CRIT
+ else if (!strcasecmp(&cp[7], "CRIT")) {
+ log_control.log_entries[i].lsu_severity = LOG_CRIT;
+ }
+#endif /* LOG_CRIT */
+#ifdef LOG_WARNING
+ else if (!strcasecmp(&cp[7], "WARNING")) {
+ log_control.log_entries[i].lsu_severity =
+ LOG_WARNING;
+ }
+#endif /* LOG_WARNING */
+#ifdef LOG_NOTICE
+ else if (!strcasecmp(&cp[7], "NOTICE")) {
+ log_control.log_entries[i].lsu_severity =
+ LOG_NOTICE;
+ }
+#endif /* LOG_NOTICE */
+#ifdef LOG_INFO
+ else if (!strcasecmp(&cp[7], "INFO")) {
+ log_control.log_entries[i].lsu_severity = LOG_INFO;
+ }
+#endif /* LOG_INFO */
+#ifdef LOG_DEBUG
+ else if (!strcasecmp(&cp[7], "DEBUG")) {
+ log_control.log_entries[i].lsu_severity =
+ LOG_DEBUG;
+ }
+#endif /* LOG_DEBUG */
+ else
+ error = 1;
+
+ /*
+ * If there is a facility present, then parse that.
+ */
+ if (cp2) {
+ if (!strcasecmp(cp2, "AUTH")) {
+ log_control.log_entries[i].lsu_facility = LOG_AUTH;
+ }
+#ifdef LOG_KERN
+ else if (!strcasecmp(cp2, "KERN")) {
+ log_control.log_entries[i].lsu_facility = LOG_KERN;
+ }
+#endif /* LOG_KERN */
+#ifdef LOG_USER
+ else if (!strcasecmp(cp2, "USER")) {
+ log_control.log_entries[i].lsu_facility = LOG_USER;
+ }
+#endif /* LOG_USER */
+#ifdef LOG_MAIL
+ else if (!strcasecmp(cp2, "MAIL")) {
+ log_control.log_entries[i].lsu_facility = LOG_MAIL;
+ }
+#endif /* LOG_MAIL */
+#ifdef LOG_DAEMON
+ else if (!strcasecmp(cp2, "DAEMON")) {
+ log_control.log_entries[i].lsu_facility = LOG_DAEMON;
+ }
+#endif /* LOG_DAEMON */
+#ifdef LOG_LPR
+ else if (!strcasecmp(cp2, "LPR")) {
+ log_control.log_entries[i].lsu_facility = LOG_LPR;
+ }
+#endif /* LOG_LPR */
+#ifdef LOG_NEWS
+ else if (!strcasecmp(cp2, "NEWS")) {
+ log_control.log_entries[i].lsu_facility = LOG_NEWS;
+ }
+#endif /* LOG_NEWS */
+#ifdef LOG_UUCP
+ else if (!strcasecmp(cp2, "UUCP")) {
+ log_control.log_entries[i].lsu_facility = LOG_UUCP;
+ }
+#endif /* LOG_UUCP */
+#ifdef LOG_CRON
+ else if (!strcasecmp(cp2, "CRON")) {
+ log_control.log_entries[i].lsu_facility = LOG_CRON;
+ }
+#endif /* LOG_CRON */
+#ifdef LOG_LOCAL0
+ else if (!strcasecmp(cp2, "LOCAL0")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL0;
+ }
+#endif /* LOG_LOCAL0 */
+#ifdef LOG_LOCAL1
+ else if (!strcasecmp(cp2, "LOCAL1")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL1;
+ }
+#endif /* LOG_LOCAL1 */
+#ifdef LOG_LOCAL2
+ else if (!strcasecmp(cp2, "LOCAL2")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL2;
+ }
+#endif /* LOG_LOCAL2 */
+#ifdef LOG_LOCAL3
+ else if (!strcasecmp(cp2, "LOCAL3")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL3;
+ }
+#endif /* LOG_LOCAL3 */
+#ifdef LOG_LOCAL4
+ else if (!strcasecmp(cp2, "LOCAL4")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL4;
+ }
+#endif /* LOG_LOCAL4 */
+#ifdef LOG_LOCAL5
+ else if (!strcasecmp(cp2, "LOCAL5")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL5;
+ }
+#endif /* LOG_LOCAL5 */
+#ifdef LOG_LOCAL6
+ else if (!strcasecmp(cp2, "LOCAL6")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL6;
+ }
+#endif /* LOG_LOCAL6 */
+#ifdef LOG_LOCAL7
+ else if (!strcasecmp(cp2, "LOCAL7")) {
+ log_control.log_entries[i].lsu_facility = LOG_LOCAL7;
+ }
+#endif /* LOG_LOCAL7 */
+ cp2--;
+ *cp2 = savec;
+ }
+ }
+ if (!error) {
+ log_control.log_entries[i].log_type = K_LOG_SYSLOG;
+ do_openlog = 1;
+ log_facility = log_control.log_entries[i].lsu_facility;
+ }
+ }
+#endif /* HAVE_SYSLOG */
+ /*
+ * Is this a standard error specification?
+ */
+ else if (!strcasecmp(cp, "STDERR")) {
+ if (log_control.log_entries[i].lfu_filep =
+ fdopen(fileno(stderr), "a+")) {
+ log_control.log_entries[i].log_type = K_LOG_STDERR;
+ log_control.log_entries[i].lfu_fname =
+ "standard error";
+ }
+ }
+ /*
+ * Is this a specification of the console?
+ */
+ else if (!strcasecmp(cp, "CONSOLE")) {
+ if (log_control.log_entries[i].ldu_filep =
+ CONSOLE_OPEN("a+")) {
+ log_control.log_entries[i].log_type = K_LOG_CONSOLE;
+ log_control.log_entries[i].ldu_devname = "console";
+ }
+ }
+ /*
+ * Is this a specification of a device?
+ */
+ else if (!strncasecmp(cp, "DEVICE", 6)) {
+ /*
+ * We handle devices very similarly to files.
+ */
+ if (cp[6] == '=') {
+ if (log_control.log_entries[i].ldu_filep =
+ DEVICE_OPEN(&cp[7], "w")) {
+ log_control.log_entries[i].log_type = K_LOG_DEVICE;
+ log_control.log_entries[i].ldu_devname = &cp[7];
+ }
+ }
+ }
+ /*
+ * See if we successfully parsed this specification.
+ */
+ if (log_control.log_entries[i].log_type == K_LOG_NONE) {
+ fprintf(stderr, lspec_parse_err_1, whoami, cp);
+ fprintf(stderr, lspec_parse_err_2, whoami);
+ }
+ else
+ ngood++;
+ }
+ }
+ /*
+ * If we didn't find anything, then free our lists.
+ */
+ if (ngood == 0) {
+ for (i=0; i<log_control.log_nentries; i++)
+ free(logging_specs[i]);
+ }
+ free(logging_specs);
+ }
+ /*
+ * If we didn't find anything, go for the default which is to log to
+ * the system log.
+ */
+ if (ngood == 0) {
+ if (log_control.log_entries)
+ free(log_control.log_entries);
+ log_control.log_entries = &def_log_entry;
+ log_control.log_entries->log_type = K_LOG_SYSLOG;
+ log_control.log_entries->log_2free = (krb5_pointer) NULL;
+ log_control.log_entries->lsu_facility = LOG_AUTH;
+ log_control.log_entries->lsu_severity = LOG_ERR;
+ log_control.log_nentries = 1;
+ }
+ if (log_control.log_nentries) {
+ if (log_control.log_whoami = (char *) malloc(strlen(whoami)+1))
+ strcpy(log_control.log_whoami, whoami);
+ if (log_control.log_hostname = (char *) malloc(MAXHOSTNAMELEN))
+ gethostname(log_control.log_hostname, MAXHOSTNAMELEN);
+#if HAVE_OPENLOG
+ if (do_openlog) {
+ openlog(whoami, LOG_NDELAY|LOG_PID, log_facility);
+ log_control.log_opened = 1;
+ }
+#endif /* HAVE_OPENLOG */
+ if (do_com_err)
+ (void) set_com_err_hook(klog_com_err_proc);
+ }
+ return((log_control.log_nentries) ? 0 : ENOENT);
+}
+
+/*
+ * krb5_klog_close() - Close the logging context and free all data.
+ */
+void
+krb5_klog_close(kcontext)
+ krb5_context kcontext;
+{
+ int lindex;
+ (void) reset_com_err_hook();
+ for (lindex = 0; lindex < log_control.log_nentries; lindex++) {
+ switch (log_control.log_entries[lindex].log_type) {
+ case K_LOG_FILE:
+ case K_LOG_STDERR:
+ /*
+ * Files/standard error.
+ */
+ fclose(log_control.log_entries[lindex].lfu_filep);
+ break;
+ case K_LOG_CONSOLE:
+ case K_LOG_DEVICE:
+ /*
+ * Devices (may need special handling)
+ */
+ DEVICE_CLOSE(log_control.log_entries[lindex].ldu_filep);
+ break;
+#if HAVE_SYSLOG
+ case K_LOG_SYSLOG:
+ /*
+ * System log.
+ */
+ break;
+#endif /* HAVE_SYSLOG */
+ default:
+ break;
+ }
+ if (log_control.log_entries[lindex].log_2free)
+ free(log_control.log_entries[lindex].log_2free);
+ }
+ if (log_control.log_entries != &def_log_entry)
+ free(log_control.log_entries);
+ log_control.log_entries = (struct log_entry *) NULL;
+ log_control.log_nentries = 0;
+ if (log_control.log_whoami)
+ free(log_control.log_whoami);
+ log_control.log_whoami = (char *) NULL;
+ if (log_control.log_hostname)
+ free(log_control.log_hostname);
+ log_control.log_hostname = (char *) NULL;
+#if HAVE_CLOSELOG
+ if (log_control.log_opened)
+ closelog();
+#endif /* HAVE_CLOSELOG */
+}
+
+/*
+ * severity2string() - Convert a severity to a string.
+ */
+static char *
+severity2string(severity)
+ int severity;
+{
+ int s;
+ const char *ss;
+
+ s = severity & LOG_PRIMASK;
+ ss = log_ufo_string;
+ switch (s) {
+#ifdef LOG_EMERG
+ case LOG_EMERG:
+ ss = log_emerg_string;
+ break;
+#endif /* LOG_EMERG */
+#ifdef LOG_ALERT
+ case LOG_ALERT:
+ ss = log_alert_string;
+ break;
+#endif /* LOG_ALERT */
+#ifdef LOG_CRIT
+ case LOG_CRIT:
+ ss = log_crit_string;
+ break;
+#endif /* LOG_CRIT */
+ case LOG_ERR:
+ ss = log_err_string;
+ break;
+#ifdef LOG_WARNING
+ case LOG_WARNING:
+ ss = log_warning_string;
+ break;
+#endif /* LOG_WARNING */
+#ifdef LOG_NOTICE
+ case LOG_NOTICE:
+ ss = log_notice_string;
+ break;
+#endif /* LOG_NOTICE */
+#ifdef LOG_INFO
+ case LOG_INFO:
+ ss = log_info_string;
+ break;
+#endif /* LOG_INFO */
+#ifdef LOG_DEBUG
+ case LOG_DEBUG:
+ ss = log_debug_string;
+ break;
+#endif /* LOG_DEBUG */
+ }
+ return((char *) ss);
+}
+
+/*
+ * krb5_klog_syslog() - Simulate the calling sequence of syslog(3), while
+ * also performing the logging redirection as specified
+ * by krb5_klog_init().
+ */
+static int
+klog_vsyslog(priority, format, arglist)
+ int priority;
+ const char *format;
+ va_list arglist;
+{
+ char outbuf[KRB5_KLOG_MAX_ERRMSG_SIZE];
+ int lindex;
+ char *syslogp;
+ char *cp;
+ time_t now;
+#if HAVE_STRFTIME
+ size_t soff;
+#endif /* HAVE_STRFTIME */
+
+ /*
+ * Format a syslog-esque message of the format:
+ *
+ * (verbose form)
+ * <date> <hostname> <id>[<pid>](<priority>): <message>
+ *
+ * (short form)
+ * <date> <message>
+ */
+ cp = outbuf;
+ (void) time(&now);
+#if HAVE_STRFTIME
+ /*
+ * Format the date: mon dd hh:mm:ss
+ */
+ soff = strftime(outbuf, sizeof(outbuf), "%b %d %H:%M:%S", localtime(&now));
+ if (soff > 0)
+ cp += soff;
+ else
+ return(-1);
+#else /* HAVE_STRFTIME */
+ /*
+ * Format the date:
+ * We ASSUME here that the output of ctime is of the format:
+ * dow mon dd hh:mm:ss tzs yyyy\n
+ * 012345678901234567890123456789
+ */
+ strncpy(outbuf, ctime(&now) + 4, 15);
+ cp += 15;
+#endif /* HAVE_STRFTIME */
+#ifdef VERBOSE_LOGS
+ sprintf(cp, " %s %s[%d](%s): ",
+ log_control.log_hostname, log_control.log_whoami, getpid(),
+ severity2string(priority));
+#else
+ sprintf(cp, " ");
+#endif
+ syslogp = &outbuf[strlen(outbuf)];
+
+ /* Now format the actual message */
+#if HAVE_VSPRINTF
+ vsprintf(syslogp, format, arglist);
+#else /* HAVE_VSPRINTF */
+ sprintf(syslogp, format, ((int *) arglist)[0], ((int *) arglist)[1],
+ ((int *) arglist)[2], ((int *) arglist)[3],
+ ((int *) arglist)[4], ((int *) arglist)[5]);
+#endif /* HAVE_VSPRINTF */
+
+ /*
+ * Now that we have the message formatted, perform the output to each
+ * logging specification.
+ */
+ for (lindex = 0; lindex < log_control.log_nentries; lindex++) {
+ switch (log_control.log_entries[lindex].log_type) {
+ case K_LOG_FILE:
+ case K_LOG_STDERR:
+ /*
+ * Files/standard error.
+ */
+ if (fprintf(log_control.log_entries[lindex].lfu_filep,
+ outbuf) < 0) {
+ /* Attempt to report error */
+ fprintf(stderr, log_file_err,
+ log_control.log_entries[lindex].lfu_fname);
+ }
+ else {
+ fprintf(log_control.log_entries[lindex].lfu_filep, "\n");
+ fflush(log_control.log_entries[lindex].lfu_filep);
+ }
+ break;
+ case K_LOG_CONSOLE:
+ case K_LOG_DEVICE:
+ /*
+ * Devices (may need special handling)
+ */
+ if (DEVICE_PRINT(log_control.log_entries[lindex].ldu_filep,
+ outbuf) < 0) {
+ /* Attempt to report error */
+ fprintf(stderr, log_device_err,
+ log_control.log_entries[lindex].ldu_devname);
+ }
+ break;
+#if HAVE_SYSLOG
+ case K_LOG_SYSLOG:
+ /*
+ * System log.
+ */
+
+ /* Log the message with our header trimmed off */
+ syslog(priority, syslogp);
+ break;
+#endif /* HAVE_SYSLOG */
+ default:
+ break;
+ }
+ }
+ return(0);
+}
+
+#if HAVE_STDARG_H
+int
+krb5_klog_syslog(int priority, const char *format, ...)
+#else /* HAVE_STDARG_H */
+int
+krb5_klog_syslog(priority, format, va_alist)
+ int priority;
+ const char *format;
+ va_dcl
+#endif /* HAVE_STDARG_H */
+{
+ int retval;
+ va_list pvar;
+
+#if HAVE_STDARG_H
+ va_start(pvar, format);
+#else /* HAVE_STDARG_H */
+ va_start(pvar);
+#endif /* HAVE_STDARG_H */
+ retval = klog_vsyslog(priority, format, pvar);
+ va_end(pvar);
+ return(retval);
+}
+#endif /* !defined(_MSDOS) */
--- /dev/null
+/*
+ * lib/kadm/str_conv.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * str_conv.c - Convert between strings and Kerberos internal data.
+ */
+
+/*
+ * Table of contents:
+ *
+ * String decoding:
+ * ----------------
+ * krb5_string_to_flags() - Convert string to krb5_flags.
+ *
+ * String encoding:
+ * ----------------
+ * krb5_flags_to_string() - Convert krb5_flags to string.
+ */
+
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+/*
+ * Local data structures.
+ */
+struct flags_lookup_entry {
+ krb5_flags fl_flags; /* Flag */
+ krb5_boolean fl_sense; /* Sense of the flag */
+ const char * fl_specifier; /* How to recognize it */
+ const char * fl_output; /* How to spit it out */
+};
+
+/*
+ * Local strings
+ */
+
+/* Keytype strings */
+/* Flags strings */
+static const char flags_pdate_in[] = "postdateable";
+static const char flags_fwd_in[] = "forwardable";
+static const char flags_tgtbased_in[] = "tgt-based";
+static const char flags_renew_in[] = "renewable";
+static const char flags_proxy_in[] = "proxiable";
+static const char flags_dup_skey_in[] = "dup-skey";
+static const char flags_tickets_in[] = "allow-tickets";
+static const char flags_preauth_in[] = "preauth";
+static const char flags_hwauth_in[] = "hwauth";
+static const char flags_pwchange_in[] = "pwchange";
+static const char flags_service_in[] = "service";
+static const char flags_pwsvc_in[] = "pwservice";
+static const char flags_md5_in[] = "md5";
+static const char flags_pdate_out[] = "Not Postdateable";
+static const char flags_fwd_out[] = "Not Forwardable";
+static const char flags_tgtbased_out[] = "No TGT-based requests";
+static const char flags_renew_out[] = "Not renewable";
+static const char flags_proxy_out[] = "Not proxiable";
+static const char flags_dup_skey_out[] = "No DUP_SKEY requests";
+static const char flags_tickets_out[] = "All Tickets Disallowed";
+static const char flags_preauth_out[] = "Preauthorization required";
+static const char flags_hwauth_out[] = "HW Authorization required";
+static const char flags_pwchange_out[] = "Password Change required";
+static const char flags_service_out[] = "Service Disabled";
+static const char flags_pwsvc_out[] = "Password Changing Service";
+static const char flags_md5_out[] = "RSA-MD5 supported";
+static const char flags_default_neg[] = "-";
+static const char flags_default_sep[] = " ";
+
+/*
+ * Lookup tables.
+ */
+
+static const struct flags_lookup_entry flags_table[] = {
+/* flag sense input specifier output string */
+/*----------------------------- ------- ------------------ ------------------*/
+{ KRB5_KDB_DISALLOW_POSTDATED, 0, flags_pdate_in, flags_pdate_out },
+{ KRB5_KDB_DISALLOW_FORWARDABLE,0, flags_fwd_in, flags_fwd_out },
+{ KRB5_KDB_DISALLOW_TGT_BASED, 0, flags_tgtbased_in, flags_tgtbased_out},
+{ KRB5_KDB_DISALLOW_RENEWABLE, 0, flags_renew_in, flags_renew_out },
+{ KRB5_KDB_DISALLOW_PROXIABLE, 0, flags_proxy_in, flags_proxy_out },
+{ KRB5_KDB_DISALLOW_DUP_SKEY, 0, flags_dup_skey_in, flags_dup_skey_out},
+{ KRB5_KDB_DISALLOW_ALL_TIX, 0, flags_tickets_in, flags_tickets_out },
+{ KRB5_KDB_REQUIRES_PRE_AUTH, 1, flags_preauth_in, flags_preauth_out },
+{ KRB5_KDB_REQUIRES_HW_AUTH, 1, flags_hwauth_in, flags_hwauth_out },
+{ KRB5_KDB_REQUIRES_PWCHANGE, 1, flags_pwchange_in, flags_pwchange_out},
+{ KRB5_KDB_DISALLOW_SVR, 0, flags_service_in, flags_service_out },
+{ KRB5_KDB_PWCHANGE_SERVICE, 1, flags_pwsvc_in, flags_pwsvc_out },
+{ KRB5_KDB_SUPPORT_DESMD5, 1, flags_md5_in, flags_md5_out }
+};
+static const int flags_table_nents = sizeof(flags_table)/
+ sizeof(flags_table[0]);
+
+\f
+krb5_error_code
+krb5_string_to_flags(string, positive, negative, flagsp)
+ char * string;
+ const char * positive;
+ const char * negative;
+ krb5_flags * flagsp;
+{
+ int i;
+ int found;
+ const char *neg;
+ size_t nsize, psize;
+ int cpos;
+ int sense;
+
+ found = 0;
+ /* We need to have a way to negate it. */
+ neg = (negative) ? negative : flags_default_neg;
+ nsize = strlen(neg);
+ psize = (positive) ? strlen(positive) : 0;
+
+ cpos = 0;
+ sense = 1;
+ /* First check for positive or negative sense */
+ if (!strncasecmp(neg, string, nsize)) {
+ sense = 0;
+ cpos += (int) nsize;
+ }
+ else if (psize && !strncasecmp(positive, string, psize)) {
+ cpos += (int) psize;
+ }
+
+ for (i=0; i<flags_table_nents; i++) {
+ if (!strcasecmp(&string[cpos], flags_table[i].fl_specifier)) {
+ found = 1;
+ if (sense == (int) flags_table[i].fl_sense)
+ *flagsp |= flags_table[i].fl_flags;
+ else
+ *flagsp &= ~flags_table[i].fl_flags;
+
+ break;
+ }
+ }
+ return((found) ? 0 : EINVAL);
+}
+
+krb5_error_code
+krb5_flags_to_string(flags, sep, buffer, buflen)
+ krb5_flags flags;
+ const char * sep;
+ char * buffer;
+ size_t buflen;
+{
+ int i;
+ krb5_flags pflags;
+ const char *sepstring;
+ char *op;
+ int initial;
+ krb5_error_code retval;
+
+ retval = 0;
+ op = buffer;
+ pflags = 0;
+ initial = 1;
+ sepstring = (sep) ? sep : flags_default_sep;
+ /* Blast through the table matching all we can */
+ for (i=0; i<flags_table_nents; i++) {
+ if (flags & flags_table[i].fl_flags) {
+ /* Found a match, see if it'll fit into the output buffer */
+ if ((op+strlen(flags_table[i].fl_output)+strlen(sepstring)) <
+ (buffer + buflen)) {
+ if (!initial) {
+ strcpy(op, sep);
+ op += strlen(sep);
+ }
+ initial = 0;
+ strcpy(op, flags_table[i].fl_output);
+ op += strlen(flags_table[i].fl_output);
+ }
+ else {
+ retval = ENOMEM;
+ break;
+ }
+ /* Keep track of what we matched */
+ pflags |= flags_table[i].fl_flags;
+ }
+ }
+ if (!retval) {
+ /* See if there's any leftovers */
+ if (flags & ~pflags)
+ retval = EINVAL;
+ else if (initial)
+ *buffer = '\0';
+ }
+ return(retval);
+}
+
+krb5_error_code
+krb5_input_flag_to_string(flag, buffer, buflen)
+ int flag;
+ char * buffer;
+ size_t buflen;
+{
+ if(flag < 0 || flag >= flags_table_nents) return ENOENT; /* End of list */
+ if(strlen(flags_table[flag].fl_specifier) > buflen) return ENOMEM;
+ strcpy(buffer, flags_table[flag].fl_specifier);
+ return 0;
+}
--- /dev/null
+/*
+ * lib/kadm/t_dbentry.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * t_dbentry.c - Test function of krb5_adm_{proto_to_dbent,dbent_to_proto}.
+ */
+
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+#if HAVE_SRAND48
+#define SRAND srand48
+#define RAND lrand48
+#define RAND_TYPE long
+#endif /* HAVE_SRAND48 */
+
+#if !defined(RAND_TYPE) && defined(HAVE_SRAND)
+#define SRAND srand
+#define RAND rand
+#define RAND_TYPE int
+#endif /* !defined(RAND_TYPE) && defined(HAVE_SRAND) */
+
+#if !defined(RAND_TYPE) && defined(HAVE_SRANDOM)
+#define SRAND srandom
+#define RAND random
+#define RAND_TYPE long
+#endif /* !defined(RAND_TYPE) && defined(HAVE_SRANDOM) */
+
+#if !defined(RAND_TYPE)
+There is no random number generator.
+#endif /* !defined(RAND_TYPE) */
+
+/*
+ * Generate a random event that has an a/b chance of succeeding
+ */
+#define RANDOM_EVENT(a,b) ((RAND() % b) < a)
+/* Define probabilities of generating each attribute type */
+#define PASSWORD_EVENT RANDOM_EVENT(3,5)
+#define KVNO_EVENT RANDOM_EVENT(2,5)
+#define MAXLIFE_EVENT RANDOM_EVENT(1,4)
+#define MAXRENEWLIFE_EVENT RANDOM_EVENT(1,4)
+#define EXPIRATION_EVENT RANDOM_EVENT(1,3)
+#define PWEXPIRATION_EVENT RANDOM_EVENT(1,3)
+#define RANDOMKEY_EVENT RANDOM_EVENT(1,8)
+#define FLAGS_EVENT RANDOM_EVENT(9,10)
+#define SALT_EVENT RANDOM_EVENT(7,16)
+#define MKVNO_EVENT RANDOM_EVENT(2,5)
+#define LASTPWCHANGE_EVENT RANDOM_EVENT(2,5)
+#define LASTSUCCESS_EVENT RANDOM_EVENT(2,5)
+#define LASTFAILED_EVENT RANDOM_EVENT(2,5)
+#define FAILCOUNT_EVENT RANDOM_EVENT(2,5)
+#define MODNAME_EVENT RANDOM_EVENT(2,5)
+#define MODDATE_EVENT RANDOM_EVENT(2,5)
+#define EXTRA_EVENT RANDOM_EVENT(1,5)
+#define SET_EVENT RANDOM_EVENT(1,4)
+
+/*
+ * Convert a time value to a string for output messages.
+ */
+static char *
+time2string(ts)
+ krb5_timestamp ts;
+{
+ static char buf[1024];
+
+ strcpy(buf, ctime((time_t *) &ts));
+ /* Remove trailing \n */
+ buf[strlen(buf)-1] = '\0';
+ return(buf);
+}
+
+static krb5_boolean
+aux_data_inequal(in, out)
+ krb5_db_entry *in, *out;
+{
+ krb5_tl_data *intl, *outtl;
+ krb5_boolean found;
+
+ if (in->n_tl_data != out->n_tl_data)
+ return(1);
+ found = 1;
+ for (intl = in->tl_data; intl; intl = intl->tl_data_next) {
+ found = 0;
+ for (outtl = out->tl_data; outtl; outtl = outtl->tl_data_next) {
+ if ((intl->tl_data_type == outtl->tl_data_type) &&
+ (intl->tl_data_length == outtl->tl_data_length) &&
+ !memcmp(intl->tl_data_contents,
+ outtl->tl_data_contents,
+ intl->tl_data_length)) {
+ outtl->tl_data_length = -outtl->tl_data_length;
+ found = 1;
+ }
+ }
+ if (!found)
+ break;
+ }
+ for (outtl = out->tl_data; outtl; outtl = outtl->tl_data_next) {
+ if (outtl->tl_data_length < 0)
+ outtl->tl_data_length = -outtl->tl_data_length;
+ }
+ return(!found);
+}
+
+static void
+print_auxdata(entp)
+ krb5_db_entry *entp;
+{
+ krb5_tl_data *tl;
+ int i;
+
+ for (tl = entp->tl_data; tl; tl = tl->tl_data_next) {
+ printf("tl_data(%d)[len=%d] ", tl->tl_data_type, tl->tl_data_length);
+ for (i=0; i<tl->tl_data_length; i++)
+ printf("%02x ", tl->tl_data_contents[i]);
+ printf("\n");
+ }
+}
+
+static krb5_boolean
+key_data_inequal(in, out)
+ krb5_db_entry *in, *out;
+{
+ krb5_boolean found;
+ int i, j;
+
+ if (in->n_key_data != out->n_key_data)
+ return(1);
+ found = 1;
+ for (i=0; i<in->n_key_data; i++) {
+ found = 0;
+ for (j=0; j<out->n_key_data; j++) {
+ if ((in->key_data[i].key_data_kvno ==
+ out->key_data[j].key_data_kvno) &&
+ (in->key_data[i].key_data_type[0] ==
+ out->key_data[j].key_data_type[0]) &&
+ (in->key_data[i].key_data_type[1] ==
+ out->key_data[j].key_data_type[1]) &&
+ (in->key_data[i].key_data_length[0] ==
+ out->key_data[j].key_data_length[0]) &&
+ (in->key_data[i].key_data_length[1] ==
+ out->key_data[j].key_data_length[1]) &&
+ !memcmp(in->key_data[i].key_data_contents[0],
+ out->key_data[j].key_data_contents[0],
+ in->key_data[i].key_data_length[0]) &&
+ (!in->key_data[i].key_data_length[1] ||
+ !memcmp(in->key_data[i].key_data_contents[1],
+ out->key_data[j].key_data_contents[1],
+ in->key_data[i].key_data_length[1]))) {
+ out->key_data[j].key_data_length[0] =
+ -out->key_data[j].key_data_length[0];
+ found = 1;
+ }
+ }
+ if (!found)
+ break;
+ }
+ for (j=0; j<out->n_key_data; j++) {
+ if (out->key_data[j].key_data_length[0] < 0)
+ out->key_data[j].key_data_length[0] =
+ -out->key_data[j].key_data_length[0];
+ }
+ return(!found);
+}
+
+static void
+print_keydata(entp)
+ krb5_db_entry *entp;
+{
+ int i, j;
+
+ for (j=0; j<entp->n_key_data; j++) {
+ printf("key(vno=%d):key(type=%d)[contents= ",
+ entp->key_data[j].key_data_kvno,
+ entp->key_data[j].key_data_type[0]);
+ for (i=0; i<entp->key_data[j].key_data_length[0]; i++)
+ printf("%02x ", entp->key_data[j].key_data_contents[0][i]);
+ printf("] salt(type=%d)", entp->key_data[j].key_data_type[1]);
+ if (entp->key_data[j].key_data_length[1]) {
+ printf("[contents= ");
+ for (i=0; i<entp->key_data[j].key_data_length[1]; i++)
+ printf("%02x ", entp->key_data[j].key_data_contents[1][i]);
+ printf("]");
+ }
+ printf("\n");
+ }
+}
+
+static krb5_boolean
+extra_data_inequal(in, out)
+ krb5_db_entry *in, *out;
+{
+ if (in->e_length != out->e_length)
+ return(1);
+ if (in->e_length && memcmp(in->e_data, out->e_data, (size_t) in->e_length))
+ return(1);
+ return(0);
+}
+
+static void
+print_extradata(entp)
+ krb5_db_entry *entp;
+{
+ int i;
+
+ printf("extra:");
+ for (i=0; i<entp->e_length; i++)
+ printf("%02x ", entp->e_data[i]);
+ printf("\n");
+}
+
+/*
+ * Generate a database entry, either randomly, or using well known values.
+ */
+static void
+gen_dbent(kcontext, dbentp, isrand, validp, pwdp, expectp)
+ krb5_context kcontext;
+ krb5_db_entry *dbentp;
+ krb5_boolean isrand;
+ krb5_ui_4 *validp;
+ char **pwdp;
+ krb5_boolean *expectp;
+{
+ time_t now;
+ krb5_boolean is_set;
+ size_t pwlen;
+ int i;
+ static char *defpass = "testpassword";
+ static char *defprinc = "testprinc/instance@realm";
+
+ now = time((time_t *) NULL);
+ is_set = ((*validp & KRB5_ADM_M_SET) != 0);
+
+ /* Do password on set */
+ if (isrand) {
+ if (PASSWORD_EVENT) {
+ pwlen = 9 + (RAND() % 56);
+ *pwdp = (char *) malloc(pwlen);
+ for (i=0; i<pwlen-1; i++) {
+ (*pwdp)[i] = RAND() % 128;
+ while (!isalnum((int) (*pwdp)[i]))
+ (*pwdp)[i] = RAND() % 128;
+ }
+ (*pwdp)[pwlen-1] = '\0';
+ *validp |= KRB5_ADM_M_PASSWORD;
+ }
+ }
+ else {
+ if (is_set) {
+ *pwdp = (char *) malloc(strlen(defpass)+1);
+ strcpy(*pwdp, defpass);
+ *validp |= KRB5_ADM_M_PASSWORD;
+ }
+ }
+
+ /* Do maxlife */
+ if (isrand) {
+ if (MAXLIFE_EVENT) {
+ dbentp->max_life = RAND();
+ *validp |= KRB5_ADM_M_MAXLIFE;
+ }
+ }
+ else {
+ dbentp->max_life = KRB5_KDB_MAX_LIFE;
+ *validp |= KRB5_ADM_M_MAXLIFE;
+ }
+
+ /* Do maxrenewlife */
+ if (isrand) {
+ if (MAXRENEWLIFE_EVENT) {
+ dbentp->max_renewable_life = RAND();
+ *validp |= KRB5_ADM_M_MAXRENEWLIFE;
+ }
+ }
+ else {
+ dbentp->max_renewable_life = KRB5_KDB_MAX_RLIFE;
+ *validp |= KRB5_ADM_M_MAXRENEWLIFE;
+ }
+
+ /* Do expiration */
+ if (isrand) {
+ if (EXPIRATION_EVENT) {
+ dbentp->expiration = RAND();
+ *validp |= KRB5_ADM_M_EXPIRATION;
+ }
+ }
+ else {
+ dbentp->expiration = KRB5_KDB_EXPIRATION;
+ *validp |= KRB5_ADM_M_EXPIRATION;
+ }
+
+ /* Do pw_expiration */
+ if (isrand) {
+ if (PWEXPIRATION_EVENT) {
+ dbentp->pw_expiration = RAND();
+ *validp |= KRB5_ADM_M_PWEXPIRATION;
+ }
+ }
+ else {
+ dbentp->pw_expiration = (krb5_timestamp) now + 3600;
+ *validp |= KRB5_ADM_M_PWEXPIRATION;
+ }
+
+ /* Do randomkey - 1/8 probability of doing randomkey */
+ if (isrand && (RANDOMKEY_EVENT)) {
+ *validp |= KRB5_ADM_M_RANDOMKEY;
+ }
+
+ /* Do flags */
+ if (isrand) {
+ if (FLAGS_EVENT) {
+ dbentp->attributes = RAND();
+ *validp |= KRB5_ADM_M_FLAGS;
+ }
+ }
+ else {
+ dbentp->attributes = KRB5_KDB_DEF_FLAGS;
+ *validp |= KRB5_ADM_M_FLAGS;
+ }
+
+ /* Do lastsuccess */
+ if (isrand) {
+ if (LASTSUCCESS_EVENT) {
+ dbentp->last_success = RAND();
+ *validp |= KRB5_ADM_M_LASTSUCCESS;
+ }
+ }
+ else {
+ if (!is_set) {
+ dbentp->last_success = (krb5_timestamp) now - 3600;
+ *validp |= KRB5_ADM_M_LASTSUCCESS;
+ }
+ }
+
+ /* Do lastfailed */
+ if (isrand) {
+ if (LASTFAILED_EVENT) {
+ dbentp->last_failed = RAND();
+ *validp |= KRB5_ADM_M_LASTFAILED;
+ }
+ }
+ else {
+ if (!is_set) {
+ dbentp->last_failed = (krb5_timestamp) now - 3600;
+ *validp |= KRB5_ADM_M_LASTFAILED;
+ }
+ }
+
+ /* Do failcount */
+ if (isrand) {
+ if (FAILCOUNT_EVENT) {
+ dbentp->fail_auth_count = RAND();
+ *validp |= KRB5_ADM_M_FAILCOUNT;
+ }
+ }
+ else {
+ if (!is_set) {
+ dbentp->fail_auth_count = 0;
+ *validp |= KRB5_ADM_M_FAILCOUNT;
+ }
+ }
+
+ /*
+ * Generate auxiliary data.
+ */
+ if (isrand) {
+ krb5_octet *lpw_change;
+ krb5_tl_data *tldata;
+ krb5_timestamp lpw;
+ krb5_tl_mod_princ mprinc;
+ int didone;
+
+ didone = 0;
+ if (LASTPWCHANGE_EVENT) {
+ if ((tldata = (krb5_tl_data *) malloc(sizeof(krb5_tl_data))) &&
+ (lpw_change = (krb5_octet *) malloc(sizeof(krb5_timestamp)))) {
+ lpw = (krb5_timestamp) RAND();
+ lpw_change[0] = (unsigned char) ((lpw >> 24) & 0xff);
+ lpw_change[1] = (unsigned char) ((lpw >> 16) & 0xff);
+ lpw_change[2] = (unsigned char) ((lpw >> 8) & 0xff);
+ lpw_change[3] = (unsigned char) (lpw & 0xff);
+ tldata->tl_data_next = (krb5_tl_data *) NULL;
+ tldata->tl_data_type = KRB5_TL_LAST_PWD_CHANGE;
+ tldata->tl_data_length = sizeof(krb5_timestamp);
+ tldata->tl_data_contents = lpw_change;
+ dbentp->n_tl_data = 1;
+ dbentp->tl_data = tldata;
+ didone++;
+ }
+ }
+ if (MODNAME_EVENT || MODDATE_EVENT) {
+ mprinc.mod_date = (krb5_timestamp) RAND();
+ if (!krb5_parse_name(kcontext, defprinc, &mprinc.mod_princ)) {
+ if (!krb5_dbe_encode_mod_princ_data(kcontext, &mprinc, dbentp))
+ didone++;
+ }
+ }
+ if (didone)
+ *validp |= KRB5_ADM_M_AUXDATA;
+ }
+ else {
+ krb5_octet *lpw_change;
+ krb5_tl_data *tldata;
+ krb5_timestamp lpw;
+ krb5_tl_mod_princ mprinc;
+
+ if ((tldata = (krb5_tl_data *) malloc(sizeof(krb5_tl_data))) &&
+ (lpw_change = (krb5_octet *) malloc(sizeof(krb5_timestamp)))) {
+ lpw = (krb5_timestamp) now - 3600;
+ lpw_change[0] = (unsigned char) ((lpw >> 24) & 0xff);
+ lpw_change[1] = (unsigned char) ((lpw >> 16) & 0xff);
+ lpw_change[2] = (unsigned char) ((lpw >> 8) & 0xff);
+ lpw_change[3] = (unsigned char) (lpw & 0xff);
+ tldata->tl_data_next = (krb5_tl_data *) NULL;
+ tldata->tl_data_type = KRB5_TL_LAST_PWD_CHANGE;
+ tldata->tl_data_length = sizeof(krb5_timestamp);
+ tldata->tl_data_contents = lpw_change;
+ dbentp->n_tl_data = 1;
+ dbentp->tl_data = tldata;
+ }
+ mprinc.mod_date = (krb5_timestamp) now;
+ if (!krb5_parse_name(kcontext, defprinc, &mprinc.mod_princ))
+ krb5_dbe_encode_mod_princ_data(kcontext, &mprinc, dbentp);
+ *validp |= KRB5_ADM_M_AUXDATA;
+ }
+
+ /* Make key data */
+ if (isrand) {
+ int i, j, kl, sl;
+
+ if (!is_set) {
+ for (i=0; i<(1+(RAND()%8)); i++) {
+ if (!krb5_dbe_create_key_data(kcontext, dbentp)) {
+ dbentp->key_data[i].key_data_kvno = RAND() % 32768;
+ dbentp->key_data[i].key_data_type[0] = RAND() % 32768;
+ dbentp->key_data[i].key_data_type[1] = RAND() % 32768;
+ kl = dbentp->key_data[i].key_data_length[0] =
+ 8 + (RAND() % 128);
+ sl = dbentp->key_data[i].key_data_length[1] =
+ 0 + (RAND() % 128);
+ if (dbentp->key_data[i].key_data_contents[0] =
+ (krb5_octet *) malloc(kl)) {
+ for (j=0; j<kl; j++) {
+ dbentp->key_data[i].key_data_contents[0][j] =
+ RAND() % 256;
+ }
+ }
+ if (dbentp->key_data[i].key_data_contents[1] =
+ (krb5_octet *) malloc(sl)) {
+ for (j=0; j<sl; j++) {
+ dbentp->key_data[i].key_data_contents[1][j] =
+ RAND() % 256;
+ }
+ }
+ *validp |= KRB5_ADM_M_KEYDATA;
+ }
+ }
+ }
+ }
+ else {
+ if (!is_set) {
+ if (!krb5_dbe_create_key_data(kcontext, dbentp)) {
+ int i;
+
+ dbentp->key_data[0].key_data_kvno = 1;
+ dbentp->key_data[0].key_data_type[0] = 1;
+ dbentp->key_data[0].key_data_type[1] = 0;
+ dbentp->key_data[0].key_data_length[0] = 24;
+ dbentp->key_data[0].key_data_length[1] = 0;
+ if (dbentp->key_data[0].key_data_contents[0] =
+ (krb5_octet *) malloc(24)) {
+ for (i=0; i<24; i++)
+ dbentp->key_data[0].key_data_contents[0][i] = RAND() % 256;
+ }
+ dbentp->key_data[0].key_data_contents[1] = (krb5_octet *) NULL;
+ *validp |= KRB5_ADM_M_KEYDATA;
+ }
+ }
+ }
+
+ /* Make extra data */
+ if (isrand && EXTRA_EVENT) {
+ dbentp->e_length = 8 + (RAND() % 504);
+ if (dbentp->e_data = (krb5_octet *)
+ malloc((size_t) dbentp->e_length)) {
+ int j;
+ for (j=0; j<dbentp->e_length; j++) {
+ dbentp->e_data[j] = RAND() % 256;
+ }
+ *validp |= KRB5_ADM_M_EXTRADATA;
+ }
+ else
+ dbentp->e_length = 0;
+ }
+
+ if (is_set) {
+ /* Only 25% may fail at most */
+ if (isrand && ((RAND() % 100) < 75)) {
+ *validp &= KRB5_ADM_M_SET_VALID;
+ }
+#ifdef notdef
+ if ((*validp & KRB5_ADM_M_PASSWORD) != 0)
+ *validp &= ~KRB5_ADM_M_RANDOMKEY;
+#endif /* notdef */
+ *expectp = ((*validp & ~KRB5_ADM_M_SET_VALID) != 0) ? 1 : 0;
+ }
+ else {
+ /* Only 25% may fail at most */
+ if (isrand && ((RAND() % 100) < 75))
+ *validp &= KRB5_ADM_M_GET_VALID;
+ *expectp = ((*validp & ~KRB5_ADM_M_GET_VALID) != 0) ? 1 : 0;
+ }
+}
+
+/*
+ * Compare two entries.
+ */
+static krb5_boolean
+compare_entries(kcontext, ivalid, ientp, ipwd, ovalid, oentp, opwd)
+ krb5_context kcontext;
+ krb5_ui_4 ivalid;
+ krb5_db_entry *ientp;
+ char *ipwd;
+ krb5_ui_4 ovalid;
+ krb5_db_entry *oentp;
+ char *opwd;
+{
+ /* Handle/compare password */
+ if (((ivalid & KRB5_ADM_M_PASSWORD) != 0) &&
+ (((ovalid & KRB5_ADM_M_PASSWORD) == 0) ||
+ strcmp(ipwd, opwd)))
+ return(0);
+
+ /* Handle/compare maxlife */
+ if (((ivalid & KRB5_ADM_M_MAXLIFE) != 0) &&
+ (((ovalid & KRB5_ADM_M_MAXLIFE) == 0) ||
+ (ientp->max_life != oentp->max_life)))
+ return(0);
+
+ /* Handle/compare maxrenewlife */
+ if (((ivalid & KRB5_ADM_M_MAXRENEWLIFE) != 0) &&
+ (((ovalid & KRB5_ADM_M_MAXRENEWLIFE) == 0) ||
+ (ientp->max_renewable_life != oentp->max_renewable_life)))
+ return(0);
+
+ /* Handle/compare expiration */
+ if (((ivalid & KRB5_ADM_M_EXPIRATION) != 0) &&
+ (((ovalid & KRB5_ADM_M_EXPIRATION) == 0) ||
+ (ientp->expiration != oentp->expiration)))
+ return(0);
+
+ /* Handle/compare pwexpiration */
+ if (((ivalid & KRB5_ADM_M_PWEXPIRATION) != 0) &&
+ (((ovalid & KRB5_ADM_M_PWEXPIRATION) == 0) ||
+ (ientp->pw_expiration != oentp->pw_expiration)))
+ return(0);
+
+#ifdef notdef
+ /* Handle/compare random key */
+ if (((ivalid & KRB5_ADM_M_RANDOMKEY) != 0) &&
+ ((ovalid & KRB5_ADM_M_PASSWORD) != 0))
+ return(0);
+#endif /* notdef */
+
+ /* Handle/compare flags */
+ if (((ivalid & KRB5_ADM_M_FLAGS) != 0) &&
+ (((ovalid & KRB5_ADM_M_FLAGS) == 0) ||
+ (ientp->attributes != oentp->attributes)))
+ return(0);
+
+ /* Handle/compare lastsuccess */
+ if (((ivalid & KRB5_ADM_M_LASTSUCCESS) != 0) &&
+ (((ovalid & KRB5_ADM_M_LASTSUCCESS) == 0) ||
+ (ientp->last_success != oentp->last_success)))
+ return(0);
+
+ /* Handle/compare lastfailed */
+ if (((ivalid & KRB5_ADM_M_LASTFAILED) != 0) &&
+ (((ovalid & KRB5_ADM_M_LASTFAILED) == 0) ||
+ (ientp->last_failed != oentp->last_failed)))
+ return(0);
+
+ /* Handle/compare failcount */
+ if (((ivalid & KRB5_ADM_M_FAILCOUNT) != 0) &&
+ (((ovalid & KRB5_ADM_M_FAILCOUNT) == 0) ||
+ (ientp->fail_auth_count != oentp->fail_auth_count)))
+ return(0);
+
+ /* Handle/compare auxiliary data */
+ if (((ivalid & KRB5_ADM_M_AUXDATA) != 0) &&
+ (((ovalid & KRB5_ADM_M_AUXDATA) == 0) ||
+ aux_data_inequal(ientp, oentp)))
+ return(0);
+
+ /* Handle/compare key data */
+ if (((ivalid & KRB5_ADM_M_KEYDATA) != 0) &&
+ (((ovalid & KRB5_ADM_M_KEYDATA) == 0) ||
+ key_data_inequal(ientp, oentp)))
+ return(0);
+
+ /* Handle/compare extra data */
+ if (((ivalid & KRB5_ADM_M_EXTRADATA) != 0) &&
+ (((ovalid & KRB5_ADM_M_EXTRADATA) == 0) ||
+ extra_data_inequal(ientp, oentp)))
+ return(0);
+
+ return(1);
+}
+
+/*
+ * Print out an entry.
+ */
+static void
+print_dbent(kcontext, ivalid, ientp, ipwd)
+ krb5_context kcontext;
+ krb5_ui_4 ivalid;
+ krb5_db_entry *ientp;
+ char *ipwd;
+{
+ printf("Valid mask:\t%08x\n", ivalid);
+
+ /* Print password */
+ if ((ivalid & KRB5_ADM_M_PASSWORD) != 0)
+ printf("Password:\t%s\n", ipwd);
+
+ /* Print maxlife */
+ if ((ivalid & KRB5_ADM_M_MAXLIFE) != 0)
+ printf("max_life:\t%8d\t%08x\n", ientp->max_life, ientp->max_life);
+
+ /* Print maxrenewlife */
+ if ((ivalid & KRB5_ADM_M_MAXRENEWLIFE) != 0)
+ printf("max_rlife:\t%8d\t%08x\n", ientp->max_renewable_life,
+ ientp->max_renewable_life);
+
+ /* Print expiration */
+ if ((ivalid & KRB5_ADM_M_EXPIRATION) != 0)
+ printf("expires:\t%8d\t%08x\t%s\n", ientp->expiration,
+ ientp->expiration, time2string(ientp->expiration));
+
+ /* Print pwexpiration */
+ if ((ivalid & KRB5_ADM_M_PWEXPIRATION) != 0)
+ printf("pw expires:\t%8d\t%08x\t%s\n", ientp->pw_expiration,
+ ientp->pw_expiration, time2string(ientp->pw_expiration));
+
+ /* Print random key */
+ if ((ivalid & KRB5_ADM_M_RANDOMKEY) != 0)
+ printf("random key\n");
+
+ /* Print flags */
+ if ((ivalid & KRB5_ADM_M_FLAGS) != 0)
+ printf("flags:\t\t%8d\t%08x\n", ientp->attributes, ientp->attributes);
+
+ /* Print lastsuccess */
+ if ((ivalid & KRB5_ADM_M_LASTSUCCESS) != 0)
+ printf("lastsucc:\t%8d\t%08x\t%s\n", ientp->last_success,
+ ientp->last_success, time2string(ientp->last_success));
+
+ /* Print lastfailed */
+ if ((ivalid & KRB5_ADM_M_LASTFAILED) != 0)
+ printf("lastfail:\t%8d\t%08x\t%s\n", ientp->last_failed,
+ ientp->last_failed, time2string(ientp->last_failed));
+
+ /* Print failcount */
+ if ((ivalid & KRB5_ADM_M_FAILCOUNT) != 0)
+ printf("failcount:\t%8d\t%08x\n", ientp->fail_auth_count,
+ ientp->fail_auth_count);
+
+ /* Print auxiliary data */
+ if ((ivalid & KRB5_ADM_M_AUXDATA) != 0)
+ print_auxdata(ientp);
+
+ /* Print key data */
+ if ((ivalid & KRB5_ADM_M_KEYDATA) != 0)
+ print_keydata(ientp);
+
+ /* Print extra data */
+ if ((ivalid & KRB5_ADM_M_EXTRADATA) != 0)
+ print_extradata(ientp);
+}
+
+/*
+ * Do a test case.
+ *
+ * Strategy: Generate the desired database entry type, then convert it using
+ * krb5_adm_dbent_to_proto, then convert it back to a database entry
+ * using krb5_adm_proto_to_dbent. Then verify the match.
+ */
+static krb5_int32
+do_test(pname, verbose, isrand, is_a_set, title, passno)
+ char *pname;
+ krb5_boolean verbose;
+ krb5_boolean isrand;
+ krb5_boolean is_a_set;
+ char *title;
+ krb5_int32 passno;
+{
+ krb5_context kcontext;
+ krb5_db_entry *in_dbent;
+ krb5_db_entry *out_dbent;
+ krb5_error_code kret;
+ krb5_int32 ncomps;
+ krb5_data *complist;
+ krb5_ui_4 in_validmask;
+ krb5_ui_4 out_validmask;
+ char *in_password;
+ char *out_password;
+ krb5_boolean should_fail;
+
+ if (verbose) {
+ printf("* Begin %s", title);
+ if (isrand)
+ printf(" pass %d", passno);
+ printf("\n");
+ }
+
+ kret = 0;
+ krb5_init_context(&kcontext);
+ krb5_init_ets(kcontext);
+ in_dbent = (krb5_db_entry *) malloc(sizeof(krb5_db_entry));
+ out_dbent = (krb5_db_entry *) malloc(sizeof(krb5_db_entry));
+ if (in_dbent && out_dbent) {
+ /* Initialize our data */
+ memset((char *) in_dbent, 0, sizeof(krb5_db_entry));
+ memset((char *) out_dbent, 0, sizeof(krb5_db_entry));
+ in_password = out_password = (char *) NULL;
+ out_validmask = 0;
+ ncomps = 0;
+ complist = (krb5_data *) NULL;
+ should_fail = 0;
+ if (!isrand) {
+ if (is_a_set)
+ in_validmask = KRB5_ADM_M_SET;
+ else
+ in_validmask = KRB5_ADM_M_GET;
+ }
+ else {
+ if (SET_EVENT)
+ in_validmask = KRB5_ADM_M_SET;
+ else
+ in_validmask = KRB5_ADM_M_GET;
+ }
+
+ /* Generate the database entry. */
+ gen_dbent(kcontext,
+ in_dbent, isrand, &in_validmask, &in_password, &should_fail);
+
+ /* Convert it to the o-t-w protocol */
+ if (!(kret = krb5_adm_dbent_to_proto(kcontext,
+ in_validmask,
+ in_dbent,
+ in_password,
+ &ncomps,
+ &complist))) {
+ /* If this should fail, then we've got a problem here */
+ if (!should_fail) {
+
+ /* Otherwise, convert it back to a database entry */
+ if (!(kret = krb5_adm_proto_to_dbent(kcontext,
+ ncomps,
+ complist,
+ &out_validmask,
+ out_dbent,
+ &out_password))) {
+ /* Compare the entries */
+ if (compare_entries(kcontext,
+ in_validmask,
+ in_dbent,
+ in_password,
+ out_validmask,
+ out_dbent,
+ out_password)) {
+ /* Success */
+ if (verbose) {
+ printf("Successful translation");
+ printf(" during %s", title);
+ if (isrand)
+ printf(" pass %d", passno);
+ printf(" of:\n");
+ print_dbent(kcontext,
+ in_validmask, in_dbent, in_password);
+ }
+ }
+ else {
+ /* Failed */
+ fprintf(stderr, "%s: comparison mismatch", pname);
+ fprintf(stderr, " during %s", title);
+ if (isrand)
+ fprintf(stderr, " pass %d", passno);
+ fprintf(stderr, "\n");
+ if (verbose) {
+ printf("Input entry is as follows:\n");
+ print_dbent(kcontext,
+ in_validmask, in_dbent, in_password);
+ printf("Output entry is as follows:\n");
+ print_dbent(kcontext,
+ out_validmask,
+ out_dbent,
+ out_password);
+ }
+ kret = KRB5KRB_ERR_GENERIC;
+ }
+ if (out_password)
+ krb5_xfree(out_password);
+ }
+ else {
+ /* Conversion to database entry failed */
+ fprintf(stderr, "%s: protocol decode failed with %d",
+ pname, kret);
+ fprintf(stderr, " during %s", title);
+ if (isrand)
+ fprintf(stderr, " pass %d", passno);
+ fprintf(stderr, "\n");
+ }
+ }
+ else {
+ /* Should have failed */
+ fprintf(stderr, "%s: protocol encode unexpectedly succeeded",
+ pname);
+ kret = KRB5KRB_ERR_GENERIC;
+ fprintf(stderr, " during %s", title);
+ if (isrand)
+ fprintf(stderr, " pass %d", passno);
+ fprintf(stderr, "\n");
+ }
+ krb5_free_adm_data(kcontext, ncomps, complist);
+ }
+ else {
+ /* Convert to protocol failed */
+ if (!should_fail) {
+ /* Unexpected failure */
+ fprintf(stderr, "%s: protocol encode failed with %d",
+ pname, kret);
+ fprintf(stderr, " during %s", title);
+ if (isrand)
+ fprintf(stderr, " pass %d", passno);
+ fprintf(stderr, "\n");
+ }
+ else {
+ /* Success */
+ if (verbose)
+ printf("- Expected failure OK\n");
+ kret = 0;
+ }
+ }
+ /* Cleanup */
+ if (in_password)
+ free(in_password);
+ if (in_dbent->tl_data) {
+ krb5_tl_data *xxx, *xxx1;
+
+ for (xxx=in_dbent->tl_data; xxx; ) {
+ xxx1 = xxx;
+ xxx = xxx->tl_data_next;
+ free(xxx1);
+ }
+ }
+ free(in_dbent);
+ if (out_dbent->tl_data) {
+ krb5_tl_data *xxx, *xxx1;
+
+ for (xxx=out_dbent->tl_data; xxx; ) {
+ xxx1 = xxx;
+ xxx = xxx->tl_data_next;
+ free(xxx1);
+ }
+ }
+ free(out_dbent);
+ }
+ else {
+ fprintf(stderr, "%s: no memory\n", pname);
+ kret = ENOMEM;
+ }
+
+ krb5_free_context(kcontext);
+ if (verbose) {
+ printf("* End %s ", title);
+ if (isrand)
+ printf(" pass %d ", passno);
+ printf("%s", (kret) ? "FAILURE" : "SUCCESS");
+ if (kret)
+ printf("%d - %s", kret, error_message(kret));
+ printf("\n");
+ }
+ return((kret) ? 1 : 0);
+}
+
+/*
+ * usage is: t_dbentry [-r <nnn>] [-v]
+ */
+int
+main(argc, argv)
+ int argc;
+ char *argv[];
+{
+ krb5_boolean verbose;
+ krb5_int32 randompasses;
+ krb5_int32 error;
+ int option;
+ extern char *optarg;
+ char *programname;
+ int i;
+ time_t now;
+
+ randompasses = 0;
+ verbose = 0;
+ error = 0;
+ programname = argv[0];
+
+ now = time((time_t *) NULL);
+ SRAND((RAND_TYPE) now);
+ while ((option = getopt(argc, argv, "r:v")) != EOF) {
+ switch (option) {
+ case 'r':
+ if (sscanf(optarg, "%d", &randompasses) != 1) {
+ fprintf(stderr, "%s: %s is not a number\n", argv[0], optarg);
+ error++;
+ }
+ break;
+ case 'v':
+ verbose = 1;
+ break;
+ default:
+ fprintf(stderr, "%s: usage is %s [-r number] [-v]\n",
+ argv[0], argv[0]);
+ error++;
+ break;
+ }
+ }
+ if (error)
+ return(error);
+
+ error += do_test(programname, verbose, 0, 1, "Standard set test", 0);
+ error += do_test(programname, verbose, 0, 0, "Standard get test", 0);
+ for (i=0; i<randompasses; i++)
+ error += do_test(programname, verbose, 1, 0, "Random test", i+1);
+ if (verbose) {
+ if (error)
+ printf("%s: %d errors in %d tests (%5.2f%%)\n", argv[0], error,
+ randompasses+2,
+ (float) (error*100) / (float) (randompasses+2));
+ }
+ return(error);
+}
+
--- /dev/null
+/*
+ * lib/kadm/t_ktentry.c
+ *
+ * Copyright 1995 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ */
+
+/*
+ * t_ktentry.c - Test function of krb5_adm_{proto_to_ktent,ktent_to_proto}.
+ */
+
+#include "k5-int.h"
+#include "adm.h"
+#include "adm_proto.h"
+
+#if HAVE_SRAND48
+#define SRAND srand48
+#define RAND lrand48
+#define RAND_TYPE long
+#endif /* HAVE_SRAND48 */
+
+#if !defined(RAND_TYPE) && defined(HAVE_SRAND)
+#define SRAND srand
+#define RAND rand
+#define RAND_TYPE int
+#endif /* !defined(RAND_TYPE) && defined(HAVE_SRAND) */
+
+#if !defined(RAND_TYPE) && defined(HAVE_SRANDOM)
+#define SRAND srandom
+#define RAND random
+#define RAND_TYPE long
+#endif /* !defined(RAND_TYPE) && defined(HAVE_SRANDOM) */
+
+#if !defined(RAND_TYPE)
+There is no random number generator.
+#endif /* !defined(RAND_TYPE) */
+
+/*
+ * Generate a principal name.
+ */
+static char *
+gen_princname(isrand)
+ krb5_boolean isrand;
+{
+ static char *defprinc = "testprinc/instance@realm";
+ char *pptr;
+
+ if (isrand) {
+ int i, j;
+ int ncomps;
+ size_t compsize[9];
+ char * complist[9];
+ size_t totsize;
+
+ for (i=0; i<9; i++) {
+ compsize[i] = 0;
+ complist[i] = (char *) NULL;
+ }
+ ncomps = 2 + (RAND() % 7);
+ totsize = 0;
+ for (i=0; i<ncomps; i++) {
+ compsize[i] = 1 + (RAND() % 32);
+ complist[i] = (char *) malloc(compsize[i]+1);
+ if (complist[i]) {
+ for (j=0; j<compsize[i]; j++) {
+ (complist[i])[j] = RAND() % 128;
+ while (!isalnum((int) (complist[i])[j]))
+ (complist[i])[j] = RAND() % 128;
+ }
+ (complist[i])[compsize[i]] = '\0';
+ totsize += (compsize[i] + 1);
+ }
+ else
+ break;
+ }
+ pptr = (char *) malloc(totsize+1);
+ if (pptr) {
+ pptr[0] = '\0';
+ for (i=1; i<ncomps; i++) {
+ if (complist[i]) {
+ strcat(pptr, complist[i]);
+ strcat(pptr, "/");
+ free(complist[i]);
+ }
+ else
+ break;
+ }
+ pptr[strlen(pptr)-1] = '\0';
+ strcat(pptr, "@");
+ strcat(pptr, complist[0]);
+ free(complist[0]);
+ }
+ }
+ else {
+ pptr = (char *) malloc(strlen(defprinc)+1);
+ if (pptr)
+ strcpy(pptr, defprinc);
+ }
+ return(pptr);
+}
+
+static void
+gen_key(ktentp, isrand)
+ krb5_keytab_entry *ktentp;
+ krb5_boolean isrand;
+{
+ static unsigned char defkey[8] = { 0x01, 0xfe, 0xab, 0xc3,
+ 0x23, 0x16, 0x84, 0x23 };
+
+ if (isrand) {
+ size_t keylen;
+ int i;
+
+ keylen = 4 + (RAND() % 64);
+ ktentp->key.contents = (krb5_octet *) malloc(keylen);
+ if (ktentp->key.contents) {
+ ktentp->key.length = keylen;
+ for (i=0; i<keylen; i++)
+ ktentp->key.contents[i] = RAND() & 255;
+ }
+ }
+ else {
+ ktentp->key.contents = (krb5_octet *) malloc(sizeof(defkey));
+ if (ktentp->key.contents) {
+ ktentp->key.length = 8;
+ memcpy(ktentp->key.contents, defkey, sizeof(defkey));
+ }
+ }
+}
+
+/*
+ * Generate a keytab entry.
+ */
+static void
+gen_ktent(kcontext, ktentp, isrand)
+ krb5_context kcontext;
+ krb5_keytab_entry *ktentp;
+ krb5_boolean isrand;
+{
+ char *princname;
+
+ princname = gen_princname(isrand);
+ if (princname && !krb5_parse_name(kcontext,
+ princname,
+ &ktentp->principal)
+ ) {
+ ktentp->vno = (isrand) ? RAND() : 1;
+ gen_key(ktentp, isrand);
+ free(princname);
+ }
+}
+
+/*
+ * Compare two entries.
+ */
+static krb5_boolean
+compare_entries(kcontext, ientp, oentp)
+ krb5_context kcontext;
+ krb5_keytab_entry *ientp;
+ krb5_keytab_entry *oentp;
+{
+ if (ientp->vno != oentp->vno)
+ return(0);
+
+ if ((ientp->key.length != oentp->key.length) ||
+ memcmp(ientp->key.contents, oentp->key.contents, ientp->key.length))
+ return(0);
+
+ if (!krb5_principal_compare(kcontext, ientp->principal, oentp->principal))
+ return(0);
+ return(1);
+}
+
+/*
+ * Print out an entry.
+ */
+static void
+print_ktent(kcontext, ientp)
+ krb5_context kcontext;
+ krb5_keytab_entry *ientp;
+{
+ char *princname;
+ int i;
+
+ if (!krb5_unparse_name(kcontext, ientp->principal, &princname)) {
+ printf("Principal: %s (version %d[%x])\n", princname, ientp->vno);
+ printf("Key:");
+ for (i=0; i<ientp->key.length; i++)
+ printf(" %02x", ientp->key.contents[i]);
+ printf("\n");
+ krb5_xfree(princname);
+ }
+}
+
+/*
+ * Do a test case.
+ *
+ * Strategy: Generate the desired keytab entry type, then convert it using
+ * krb5_adm_ktent_to_proto, then convert it back to a keytab entry
+ * using krb5_adm_proto_to_ktent. Then verify the match.
+ */
+static krb5_int32
+do_test(pname, verbose, isrand, title, passno)
+ char *pname;
+ krb5_boolean verbose;
+ krb5_boolean isrand;
+ char *title;
+ krb5_int32 passno;
+{
+ krb5_context kcontext;
+ krb5_keytab_entry *in_ktent;
+ krb5_keytab_entry *out_ktent;
+ krb5_error_code kret;
+ krb5_int32 ncomps;
+ krb5_data *complist;
+
+ if (verbose) {
+ printf("* Begin %s", title);
+ if (isrand)
+ printf(" pass %d", passno);
+ printf("\n");
+ }
+
+ kret = 0;
+ krb5_init_context(&kcontext);
+ krb5_init_ets(kcontext);
+ in_ktent = (krb5_keytab_entry *) malloc(sizeof(krb5_keytab_entry));
+ out_ktent = (krb5_keytab_entry *) malloc(sizeof(krb5_keytab_entry));
+ if (in_ktent && out_ktent) {
+ /* Initialize our data */
+ memset((char *) in_ktent, 0, sizeof(krb5_keytab_entry));
+ memset((char *) out_ktent, 0, sizeof(krb5_keytab_entry));
+ ncomps = 0;
+ complist = (krb5_data *) NULL;
+
+ /* Generate the keytab entry. */
+ gen_ktent(kcontext, in_ktent, isrand);
+
+ /* Convert it to the o-t-w protocol */
+ if (!(kret = krb5_adm_ktent_to_proto(kcontext,
+ in_ktent,
+ &ncomps,
+ &complist))) {
+ /* Otherwise, convert it back to a keytab entry */
+ if (!(kret = krb5_adm_proto_to_ktent(kcontext,
+ ncomps,
+ complist,
+ out_ktent))) {
+ /* Compare the entries */
+ if (compare_entries(kcontext,
+ in_ktent,
+ out_ktent)) {
+ /* Success */
+ if (verbose) {
+ printf("Successful translation");
+ printf(" during %s", title);
+ if (isrand)
+ printf(" pass %d", passno);
+ printf(" of:\n");
+ print_ktent(kcontext, in_ktent);
+ }
+ }
+ else {
+ /* Failed */
+ fprintf(stderr, "%s: comparison mismatch", pname);
+ fprintf(stderr, " during %s", title);
+ if (isrand)
+ fprintf(stderr, " pass %d", passno);
+ fprintf(stderr, "\n");
+ if (verbose) {
+ printf("Input entry is as follows:\n");
+ print_ktent(kcontext, in_ktent);
+ printf("Output entry is as follows:\n");
+ print_ktent(kcontext, out_ktent);
+ }
+ kret = KRB5KRB_ERR_GENERIC;
+ }
+ }
+ else {
+ /* Conversion to keytab entry failed */
+ fprintf(stderr, "%s: protocol decode failed with %d",
+ pname, kret);
+ fprintf(stderr, " during %s", title);
+ if (isrand)
+ fprintf(stderr, " pass %d", passno);
+ fprintf(stderr, "\n");
+ }
+ krb5_free_adm_data(kcontext, ncomps, complist);
+ }
+ else {
+ /* Convert to protocol failed */
+ fprintf(stderr, "%s: protocol encode failed with %d",
+ pname, kret);
+ fprintf(stderr, " during %s", title);
+ if (isrand)
+ fprintf(stderr, " pass %d", passno);
+ fprintf(stderr, "\n");
+ }
+ /* Cleanup */
+ if (in_ktent->principal)
+ krb5_free_principal(kcontext, in_ktent->principal);
+ if (in_ktent->key.contents)
+ free(in_ktent->key.contents);
+ free(in_ktent);
+ if (out_ktent->principal)
+ krb5_free_principal(kcontext, out_ktent->principal);
+ if (out_ktent->key.contents)
+ free(out_ktent->key.contents);
+ free(out_ktent);
+ }
+ else {
+ fprintf(stderr, "%s: no memory\n", pname);
+ kret = ENOMEM;
+ }
+
+ krb5_free_context(kcontext);
+ if (verbose) {
+ printf("* End %s ", title);
+ if (isrand)
+ printf(" pass %d ", passno);
+ printf("%s", (kret) ? "FAILURE" : "SUCCESS");
+ if (kret)
+ printf("%d - %s", kret, error_message(kret));
+ printf("\n");
+ }
+ return((kret) ? 1 : 0);
+}
+
+/*
+ * usage is: t_ktentry [-r <nnn>] [-v]
+ */
+int
+main(argc, argv)
+ int argc;
+ char *argv[];
+{
+ krb5_boolean verbose;
+ krb5_int32 randompasses;
+ krb5_int32 error;
+ int option;
+ extern char *optarg;
+ char *programname;
+ int i;
+ time_t now;
+
+ randompasses = 0;
+ verbose = 0;
+ error = 0;
+ programname = argv[0];
+
+ now = time((time_t *) NULL);
+ SRAND((RAND_TYPE) now);
+ while ((option = getopt(argc, argv, "r:v")) != EOF) {
+ switch (option) {
+ case 'r':
+ if (sscanf(optarg, "%d", &randompasses) != 1) {
+ fprintf(stderr, "%s: %s is not a number\n", argv[0], optarg);
+ error++;
+ }
+ break;
+ case 'v':
+ verbose = 1;
+ break;
+ default:
+ fprintf(stderr, "%s: usage is %s [-r number] [-v]\n",
+ argv[0], argv[0]);
+ error++;
+ break;
+ }
+ }
+ if (error)
+ return(error);
+
+ error += do_test(programname, verbose, 0, "Standard test", 0);
+ for (i=0; i<randompasses; i++)
+ error += do_test(programname, verbose, 1, 0, "Random test", i+1);
+ if (verbose) {
+ if (error)
+ printf("%s: %d errors in %d tests (%5.2f%%)\n", argv[0], error,
+ randompasses+2,
+ (float) (error*100) / (float) (randompasses+2));
+ }
+ return(error);
+}
+
projects / krb5.git / commitdiff