From 29559af8f52619d4c1431a891fee4e0c3a8f243d Mon Sep 17 00:00:00 2001 From: Paul Park Date: Tue, 9 May 1995 19:58:24 +0000 Subject: [PATCH] Checkin new administrative client git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@5782 dc483132-0cff-0310-8789-dd5450dbe970 --- src/kadmin/v5client/.Sanitize | 43 + src/kadmin/v5client/.cvsignore | 1 + src/kadmin/v5client/ChangeLog | 4 + src/kadmin/v5client/Makefile.in | 53 ++ src/kadmin/v5client/configure.in | 16 + src/kadmin/v5client/convert.c | 623 +++++++++++++ src/kadmin/v5client/kadmin5.M | 251 +++++ src/kadmin/v5client/kadmin5.c | 1434 +++++++++++++++++++++++++++++ src/kadmin/v5client/kadmin5.h | 97 ++ src/kadmin/v5client/kadmin5_ct.ct | 76 ++ src/kadmin/v5client/network.c | 321 +++++++ src/kadmin/v5client/ss_wrapper.c | 61 ++ 12 files changed, 2980 insertions(+) create mode 100644 src/kadmin/v5client/.Sanitize create mode 100644 src/kadmin/v5client/.cvsignore create mode 100644 src/kadmin/v5client/ChangeLog create mode 100644 src/kadmin/v5client/Makefile.in create mode 100644 src/kadmin/v5client/configure.in create mode 100644 src/kadmin/v5client/convert.c create mode 100644 src/kadmin/v5client/kadmin5.M create mode 100644 src/kadmin/v5client/kadmin5.c create mode 100644 src/kadmin/v5client/kadmin5.h create mode 100644 src/kadmin/v5client/kadmin5_ct.ct create mode 100644 src/kadmin/v5client/network.c create mode 100644 src/kadmin/v5client/ss_wrapper.c diff --git a/src/kadmin/v5client/.Sanitize b/src/kadmin/v5client/.Sanitize new file mode 100644 index 000000000..f85c41009 --- /dev/null +++ b/src/kadmin/v5client/.Sanitize @@ -0,0 +1,43 @@ +# Sanitize.in for Kerberos V5 + +# Each directory to survive it's way into a release will need a file +# like this one called "./.Sanitize". All keyword lines must exist, +# and must exist in the order specified by this file. Each directory +# in the tree will be processed, top down, in the following order. + +# Hash started lines like this one are comments and will be deleted +# before anything else is done. Blank lines will also be squashed +# out. + +# The lines between the "Do-first:" line and the "Things-to-keep:" +# line are executed as a /bin/sh shell script before anything else is +# done in this + +Do-first: + +# All files listed between the "Things-to-keep:" line and the +# "Files-to-sed:" line will be kept. All other files will be removed. +# Directories listed in this section will have their own Sanitize +# called. Directories not listed will be removed in their entirety +# with rm -rf. + +Things-to-keep: + +.cvsignore +ChangeLog +Makefile.in +configure +configure.in +convert.c +kadmin5.M +kadmin5.c +kadmin5.h +kadmin5_ct.ct +network.c +ss_wrapper.c + +Things-to-lose: + +Do-last: + +# End of file. diff --git a/src/kadmin/v5client/.cvsignore b/src/kadmin/v5client/.cvsignore new file mode 100644 index 000000000..e8c05a6b1 --- /dev/null +++ b/src/kadmin/v5client/.cvsignore @@ -0,0 +1 @@ +configure diff --git a/src/kadmin/v5client/ChangeLog b/src/kadmin/v5client/ChangeLog new file mode 100644 index 000000000..bafbabddd --- /dev/null +++ b/src/kadmin/v5client/ChangeLog @@ -0,0 +1,4 @@ + +Tue May 9 15:56:40 EDT 1995 Paul Park (pjpark@mit.edu) + First checkin of new administrative client. + diff --git a/src/kadmin/v5client/Makefile.in b/src/kadmin/v5client/Makefile.in new file mode 100644 index 000000000..08db70970 --- /dev/null +++ b/src/kadmin/v5client/Makefile.in @@ -0,0 +1,53 @@ +CFLAGS = $(CCOPTS) $(DEFS) $(LOCALINCLUDE) +LDFLAGS = -g + +COMERRLIB=$(BUILDTOP)/util/et/libcom_err.a +SSLIB=$(BUILDTOP)/util/ss/libss.a +DBMLIB= +KDBLIB=$(TOPLIBD)/libkdb5.a +DEPKDBLIB=$(TOPLIBD)/libkdb5.a +KADMLIB=$(TOPLIBD)/libkadm.a +DEPKADMLIB=$(TOPLIBD)/libkadm.a + +all:: + +KLIB = $(TOPLIBD)/libkrb5.a $(KRB4_LIB) $(TOPLIBD)/libcrypto.a $(SSLIB) $(COMERRLIB) $(DBMLIB) +DEPKLIB = $(TOPLIBD)/libkrb5.a $(TOPLIBD)/libcrypto.a $(SSLIB) $(COMERRLIB) $(DBMLIB) + + +DEPLIBS = $(DEPKDBLIB) $(DEPKLIB) $(DEPKADMLIB) +LOCAL_LIBRARIES = $(KDBLIB) $(KADMLIB) $(KLIB) +LOCALINCLUDE= + +OBJS= kadmin5.o \ + kadmin5_ct.o \ + network.o \ + convert.o \ + ss_wrapper.o \ + $(LIBOBJS) + +SRCS= $(srcdir)/kadmin5.c \ + $(srcdir)/kadmin5_ct.c \ + $(srcdir)/ss_wrapper.c + +all:: kadmin5 + +kadmin5: kadmin5.o $(DEPLIBS) $(OBJS) + $(CC) $(CFLAGS) -o kadmin5 $(OBJS) $(LOCAL_LIBRARIES) $(LIBS) + +install:: + $(INSTALL_PROGRAM) kadmin5 ${DESTDIR}$(ADMIN_BINDIR)/kadmin5 + $(INSTALL_DATA) $(srcdir)/kadmin5.M ${DESTDIR}$(ADMIN_MANDIR)/kadmin5.8 + +# needed until we run makedepend +kadmin5_ct.c: kadmin5_ct.ct + +kadmin5_ct.o: kadmin5_ct.c + +clean:: + $(RM) kadmin5_ct.c + +depend:: kadmin5_ct.c + +clean:: + $(RM) kadmin5 diff --git a/src/kadmin/v5client/configure.in b/src/kadmin/v5client/configure.in new file mode 100644 index 000000000..d870e2510 --- /dev/null +++ b/src/kadmin/v5client/configure.in @@ -0,0 +1,16 @@ +AC_INIT(kadmin5.c) +WITH_CCOPTS +CONFIG_RULES +AC_SET_BUILDTOP +AC_PROG_INSTALL +AC_PROG_YACC +AC_HAVE_HEADERS(pwd.h) +AC_HAVE_FUNCS(strptime re_comp regcomp getcwd) +AC_CONST +WITH_NETLIB +AC_CHECK_LIB(ndbm,main) +AC_CHECK_LIB(dbm,main) +SS_RULES +KRB_INCLUDE +WITH_KRB5ROOT +V5_AC_OUTPUT_MAKEFILE diff --git a/src/kadmin/v5client/convert.c b/src/kadmin/v5client/convert.c new file mode 100644 index 000000000..dc9dceda1 --- /dev/null +++ b/src/kadmin/v5client/convert.c @@ -0,0 +1,623 @@ +/* + * kadmin/v5client/convert.c + * + * Copyright 1995 by the Massachusetts Institute of Technology. + * All Rights Reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + */ + +/* + * convert.c - Perform various conversions for kadmin5. + */ +#include "k5-int.h" +#include "adm.h" +#include "kadmin5.h" + +/* Size of static buffers for conversions */ +#define BUFFER_SIZE 512 + +/* Forward declarations */ +static krb5_boolean get_integer PROTOTYPE((char *, const char *, void *)); +static krb5_boolean get_datestring PROTOTYPE((char *, const char *, void *)); +static krb5_boolean get_saltstring PROTOTYPE((char *, const char *, void *)); +/* static krb5_boolean get_deltastring PROTOTYPE((char *, const char *, void *)); */ + +/* Local data structure for flag to string and option to flag operations */ +struct flagtable { + krb5_flags f_value; + const char *f_string; + const char *f_option; + krb5_boolean f_sense; +}; + +/* Local data structure for option parsing */ +struct opttable { + krb5_ui_4 o_value; + const char *o_option; + krb5_boolean (*o_dispatch) PROTOTYPE((char *, + const char *, + void *)); + void *o_arg; +}; + +/* + * Static strings. + */ +static const char *dt_output_fmt = "%d %s %d:%d:%d"; +static const char *dt_output_noday_fmt = "%d:%d:%d"; +static const char *dt_output_donly_fmt = "%d %s"; +static const char *dt_day_singular = "day"; +static const char *dt_day_plural = "days"; +static const char *dbflag_bit_fmt = "Bit-%d"; +static const char *salt_norm_name = "Normal"; +static const char *salt_v4_name = "Kerberos V4"; +static const char *salt_norealm_name = "NoRealm"; +static const char *salt_orealm_name = "OnlyRealm"; +static const char *salt_special_name = "Special"; +static const char *salt_ufo_fmt = "Unknown(%d)"; +static const char *salt_norm_spec = "v5"; +static const char *salt_v4_spec = "v4"; +static const char *salt_norealm_spec = "norealm"; +static const char *salt_orealm_spec = "onlyrealm"; +static const char *salt_special_spec = "special"; +static const char *o_not_int_fmt = "%s does not specify an integer value for %s"; +static const char *o_val_req_fmt = "value required for %s"; +static const char *o_not_time_fmt = "%s does not specify a valid time value for %s"; +static const char *o_not_salt_fmt = "%s does not specify a valid salt type for %s"; +static const char *o_opt_ufo_fmt = "%s is unrecognized"; +static const char *help_option_head = "%s: valid options are:\n"; +static const char *help_flag_head = "%s: additional principal flags are:\n"; + +static const char flg_out_pdate[] = "Not Postdateable"; +static const char flg_in_pdate[] = "postdateable"; +static const char flg_out_fwd[] = "Not Forwardable"; +static const char flg_in_fwd[] = "forwardable"; +static const char flg_out_tgs[] = "No TGT-based Requests"; +static const char flg_in_tgs[] = "tgt_req"; +static const char flg_out_renew[] = "Not Renewable"; +static const char flg_in_renew[] = "renewable"; +static const char flg_out_proxy[] = "Not Proxiable"; +static const char flg_in_proxy[] = "proxiable"; +static const char flg_out_dskey[] = "No DUP_SKEY Requests"; +static const char flg_in_dskey[] = "dup_skey"; +static const char flg_out_tix[] = "All Tickets Disallowed"; +static const char flg_in_tix[] = "allow_tickets"; +static const char flg_out_pauth[] = "Preauthorization Required"; +static const char flg_in_pauth[] = "preauth"; +static const char flg_out_hauth[] = "HW Authorization Required"; +static const char flg_in_hauth[] = "hwauth"; +static const char flg_out_pwchg[] = "Password Change Required"; +static const char flg_in_pwchg[] = "pwchange_req"; +static const char flg_out_svr[] = "Server Disallowed"; +static const char flg_in_svr[] = "server"; +static const char flg_out_pwsvc[] = "Password Changing Service"; +static const char flg_in_pwsvc[] = "pwservice"; +static const char flg_out_md5[] = "DES MD5 supported"; +static const char flg_in_md5[] = "md5"; + +static const char opt_kvno[] = "kvno"; +static const char opt_maxlife[] = "maxlife"; +static const char opt_maxrenewlife[] = "maxrenewlife"; +static const char opt_expiration[] = "expiration"; +static const char opt_pwexpiration[] = "pwexpiration"; +static const char opt_randomkey[] = "randomkey"; +static const char opt_salttype[] = "salttype"; + +/* + * Formatting buffers + */ +static char dt_outbuf[BUFFER_SIZE]; +static char abs_outbuf[BUFFER_SIZE]; +static char db_outbuf[BUFFER_SIZE]; +static char salt_outbuf[BUFFER_SIZE]; +static krb5_db_entry opt_dbent; + +/* Flag to string and option to flag table */ +static struct flagtable flagtable[] = { +/* flag output string input option sen */ +{ KRB5_KDB_DISALLOW_POSTDATED, flg_out_pdate, flg_in_pdate, 0 }, +{ KRB5_KDB_DISALLOW_FORWARDABLE, flg_out_fwd, flg_in_fwd, 0 }, +{ KRB5_KDB_DISALLOW_TGT_BASED, flg_out_tgs, flg_in_tgs, 0 }, +{ KRB5_KDB_DISALLOW_RENEWABLE, flg_out_renew, flg_in_renew, 0 }, +{ KRB5_KDB_DISALLOW_PROXIABLE, flg_out_proxy, flg_in_proxy, 0 }, +{ KRB5_KDB_DISALLOW_DUP_SKEY, flg_out_dskey, flg_in_dskey, 0 }, +{ KRB5_KDB_DISALLOW_ALL_TIX, flg_out_tix, flg_in_tix, 0 }, +{ KRB5_KDB_REQUIRES_PRE_AUTH, flg_out_pauth, flg_in_pauth, 1 }, +{ KRB5_KDB_REQUIRES_HW_AUTH, flg_out_hauth, flg_in_hauth, 1 }, +{ KRB5_KDB_REQUIRES_PWCHANGE, flg_out_pwchg, flg_in_pwchg, 1 }, +{ KRB5_KDB_DISALLOW_SVR, flg_out_svr, flg_in_svr, 0 }, +{ KRB5_KDB_PWCHANGE_SERVICE, flg_out_pwsvc, flg_in_pwsvc, 1 }, +{ KRB5_KDB_SUPPORT_DESMD5, flg_out_md5, flg_in_md5, 1 }, +}; + +/* Option string parse table */ +static struct opttable opttable[] = { +/* flag option dispatch routine + argument */ +{ KRB5_ADM_M_KVNO, opt_kvno, get_integer, + (void *) &opt_dbent.kvno }, +{ KRB5_ADM_M_MAXLIFE, opt_maxlife, get_integer, + (void *) &opt_dbent.max_life }, +{ KRB5_ADM_M_MAXRENEWLIFE, opt_maxrenewlife, get_integer, + (void *) &opt_dbent.max_renewable_life }, +{ KRB5_ADM_M_EXPIRATION, opt_expiration, get_datestring, + (void *) &opt_dbent.expiration }, +{ KRB5_ADM_M_PWEXPIRATION, opt_pwexpiration, get_datestring, + (void *) &opt_dbent.pw_expiration }, +{ KRB5_ADM_M_SALTTYPE, opt_salttype, get_saltstring, + (void *) &opt_dbent }, +}; + +/* strptime formats table to recognize absolute dates */ +/* + * Recognize character string times of the format. + * 1) yymmddhhmmss (doesn't work under OSF/1) + * 2) yy.mm.dd.hh.mm.ss + * 3) yymmddhhmm + * 4) hhmmss (relative to today) + * 5) hhmm (relative to today) + * 6) hh:mm:ss (relative to today) + * 7) hh:mm (relative to today) + * 8) locale-dependent short format (mm/dd/yy:hh:mm:ss in usa) + * 9) dd-text_month-yyyy:hh:mm:ss + * 10) dd-text_month-yyyy:hh:mm + */ +static char *absformats[] = +{ + "%y%m%d%H%M%S", /* yymmddhhmmss */ + "%y.%m.%d.%H.%M.%S", /* yy.mm.dd.hh.mm.ss */ + "%y%m%d%H%M", /* yymmddhhmm */ + "%H%M%S", /* hhmmss */ + "%H%M", /* hhmm */ + "%T", /* hh:mm:ss */ + "%R", /* hh:mm */ + "%x:%X", /* locale-dependent short format */ + "%d-%b-%Y:T", /* dd-month-yyyy:hh:mm:ss */ + "%d-%b-%Y:R" /* dd-month-yyyy:hh:mm */ +}; + +#if !HAVE_STRPTIME +/* + * Rudimentary version of strptime for systems which don't have it. + */ +static char * +strptime( char *buf, char *format, struct tm *tm ) +{ + int year, month, day, hour, minute, second; + char *bp; + + /* + * We only understand two formats: + * %y%m%d%H%M%S + * This is fixed length, 12 characters. + * %y.%m.%d.%H.%M.%S + * This is fixed length, 17 characters. + */ + bp = (char *) NULL; + if ((strcmp(format,"%y%m%d%H%M%S") == 0) && + (sscanf(buf, "%02d%02d%02d%02d%02d%02d", + &year, &month, &day, &hour, &minute, &second) == 6)) { + tm->tm_year = year; + tm->tm_mon = month - 1; + tm->tm_mday = day; + tm->tm_hour = hour; + tm->tm_min = minute; + tm->tm_sec = second; + bp = &buf[12]; + } + else { + if ((strcmp(format,"%y.%m.%d.%H.%M.%S") == 0) && + (sscanf(buf, "%02d.%02d.%02d.%02d.%02d.%02d", + &year, &month, &day, &hour, &minute, &second) == 6)) { + tm->tm_year = year; + tm->tm_mon = month - 1; + tm->tm_mday = day; + tm->tm_hour = hour; + tm->tm_min = minute; + tm->tm_sec = second; + bp = &buf[17]; + } + } + return(bp); +} +#endif /* HAVE_STRPTIME */ + +/* + * delta2string() - Convert delta time value to string. + * + * WARNING: the returned output buffer is static. + */ +char * +delta2string(dt) + krb5_deltat dt; +{ + int days, hours, minutes, seconds; + + days = dt / (24*3600); + dt %= 24 * 3600; + hours = dt / 3600; + dt %= 3600; + minutes = dt / 60; + dt %= 60; + seconds = dt; + + if (days) { + if (hours || minutes || seconds) + sprintf(dt_outbuf, dt_output_fmt, days, + ((days > 1) ? dt_day_plural : dt_day_singular), + hours, minutes, seconds); + else + sprintf(dt_outbuf, dt_output_donly_fmt, days, + ((days > 1) ? dt_day_plural : dt_day_singular)); + } + else + sprintf(dt_outbuf, dt_output_noday_fmt, hours, minutes, seconds); + return(dt_outbuf); +} + +/* + * abs2string() - Convert absolute Kerberos time to string. + * + * WARNING: the returned output buffer is static. + */ +char * +abs2string(t) + krb5_timestamp t; +{ + /* + * ctime returns \n\0. + */ + strcpy(abs_outbuf, ctime((time_t *) &t)); + abs_outbuf[strlen(abs_outbuf)-1] = '\0'; + return(abs_outbuf); +} + +/* + * dbflags2string() - Convert database flags to string. + * + * WARNING: the returned output buffer is static. + */ +char * +dbflags2string(f) + krb5_flags f; +{ + int bit; + int i; + krb5_flags mask; + struct flagtable *fent; + + mask = 1; + db_outbuf[0] = '\0'; + for (bit=0; bit<(sizeof(krb5_flags)*8); bit++) { + if (f & mask) { + /* Bit is set, find it in the flag table */ + fent = (struct flagtable *) NULL; + for (i=0; i<(sizeof(flagtable)/sizeof(flagtable[0])); i++) { + if (mask == flagtable[i].f_value) { + fent = &flagtable[i]; + break; + } + } + + /* Either print out table value or unknown bit value. */ + if (fent) + strcat(db_outbuf, fent->f_string); + else + sprintf(&db_outbuf[strlen(db_outbuf)], + dbflag_bit_fmt, bit); + strcat(db_outbuf, ", "); + } + mask <<= 1; + } + /* + * Clean up our trailing comma-space if present. + */ + if (strlen(db_outbuf) > 2) + db_outbuf[strlen(db_outbuf)-2] = '\0'; + return(db_outbuf); +} + +/* + * salt2string() - Convert salt type to string. + * + * WARNING: the returned output buffer is static. + */ +char * +salt2string(stype) + krb5_int32 stype; +{ + switch (stype) { + case KRB5_KDB_SALTTYPE_NORMAL: + strcpy(salt_outbuf, salt_norm_name); + break; + case KRB5_KDB_SALTTYPE_V4: + strcpy(salt_outbuf, salt_v4_name); + break; + case KRB5_KDB_SALTTYPE_NOREALM: + strcpy(salt_outbuf, salt_norealm_name); + break; + case KRB5_KDB_SALTTYPE_ONLYREALM: + strcpy(salt_outbuf, salt_orealm_name); + break; + case KRB5_KDB_SALTTYPE_SPECIAL: + strcpy(salt_outbuf, salt_special_name); + break; + default: + sprintf(salt_outbuf, salt_ufo_fmt, stype); + break; + } + return(salt_outbuf); +} + +/* + * string2salt() - Convert string to salt type. + */ +static krb5_int32 +string2salt(sstring, goodp) + char *sstring; + krb5_boolean *goodp; +{ + if (!strcasecmp(sstring, salt_norm_spec)) { + *goodp = 1; + return(KRB5_KDB_SALTTYPE_NORMAL); + } + else if (!strcasecmp(sstring, salt_v4_spec)) { + *goodp = 1; + return(KRB5_KDB_SALTTYPE_V4); + } + else if (!strcasecmp(sstring, salt_norealm_spec)) { + *goodp = 1; + return(KRB5_KDB_SALTTYPE_NOREALM); + } + else if (!strcasecmp(sstring, salt_orealm_spec)) { + *goodp = 1; + return(KRB5_KDB_SALTTYPE_ONLYREALM); + } + else if (!strcasecmp(sstring, salt_special_spec)) { + *goodp = 1; + return(KRB5_KDB_SALTTYPE_SPECIAL); + } + else { + *goodp = 0; + return(-1); + } +} + +/* + * get_integer() - Test for an option and its integer value. + */ +static krb5_boolean +get_integer(arg, value, optp) + char *arg; + const char *value; + void *optp; +{ + int index; + krb5_boolean good; + krb5_int32 *intp; + + intp = (krb5_int32 *) optp; + good = 0; + /* Match the value */ + if (!strncasecmp(arg, value, strlen(value))) { + /* If we have a match, look for value= */ + index = strlen(value); + if (arg[index] == '=') { + /* Match one integer argument */ + if (sscanf(&arg[index+1], "%d", intp) == 1) + good = 1; + else + com_err(requestname, 0, o_not_int_fmt, &arg[index+1], value); + } + else + com_err(requestname, 0, o_val_req_fmt, value); + } + return(good); +} + +/* + * get_datestring() - Test for an option and its date value + */ +static krb5_boolean +get_datestring(arg, value, optp) + char *arg; + const char *value; + void *optp; +{ + int index; + krb5_timestamp *tp; + krb5_boolean good, found; + char *retval; + int ti; + time_t now; + struct tm *tmp; + struct tm timebuf; + + tp = (krb5_timestamp *) optp; + good = 0; + found = 0; + /* Match the value */ + if (!strncasecmp(arg, value, strlen(value))) { + /* If we have a match, look for value= */ + index = strlen(value); + if (arg[index] == '=') { + /* Prime with current time */ + now = time((time_t *) NULL); + tmp = localtime(&now); + memcpy(&timebuf, tmp, sizeof(struct tm)); + /* Match date argument */ + for (ti=0; ti<(sizeof(absformats)/sizeof(absformats[0])); ti++) { + if (strptime(&arg[index+1], absformats[ti], &timebuf)) { + found = 1; + break; + } + memcpy(&timebuf, tmp, sizeof(struct tm)); + } + if (found) { + *tp = (krb5_timestamp) mktime(&timebuf); + good = 1; + } + else + com_err(requestname, 0, o_not_time_fmt, &arg[index+1], value); + } + else + com_err(requestname, 0, o_val_req_fmt, value); + } + return(good); +} + +/* + * get_saltstring() - Test for an option and its salt type value + */ +static krb5_boolean +get_saltstring(arg, value, optp) + char *arg; + const char *value; + void *optp; +{ + int index; + krb5_db_entry *dbentp; + krb5_boolean good; + char *s1, *s2; + + dbentp = (krb5_db_entry *) optp; + good = 0; + /* Match the value */ + if (!strncasecmp(arg, value, strlen(value))) { + /* If we have a match, look for value= */ + index = strlen(value); + if (arg[index] == '=') { + if (s2 = strchr(&arg[index+1], (int) ',')) { + *s2 = '\0'; + s2++; + } + s1 = &arg[index+1]; + dbentp->salt_type = string2salt(s1, &good); + if (good) { + if (s2) { + dbentp->alt_salt_type = string2salt(s2, &good); + if (!good) + com_err(requestname, 0, o_not_salt_fmt, s2, value); + } + else + dbentp->alt_salt_type = KRB5_KDB_SALTTYPE_NORMAL; + } + else + com_err(requestname, 0, o_not_salt_fmt, s1, value); + } + else + com_err(requestname, 0, o_val_req_fmt, value); + } + + return(good); +} + +/* + * parse_princ_options() - Parse an argument list for values. + * + * NOTE: The formatting buffer is static. + */ +krb5_boolean +parse_princ_options(argc, argv, vmaskp, dbentp) + int argc; + char *argv[]; + krb5_ui_4 *vmaskp; + krb5_db_entry *dbentp; +{ + int i, oindex; + krb5_boolean good; + krb5_boolean found; + + good = 1; + /* Copy in our values */ + memcpy(&opt_dbent, dbentp, sizeof(krb5_db_entry)); + for (i=0; i +Specifies the key version number for the principal. +.TP i +.I maxlife= +Specifies the maximum ticket life for the principal in seconds. +.TP i +.I maxrenewlife= +Specifies the maximum renewable ticket life for the principal in seconds. +.TP i +.I expiration= +Specifies the expiration date and time of the principal. See below for the +format of +.I . +.TP i +.I pwexpiration= +Specifies the expiration date and time of the principal's password. See below for the format of +.I . +.TP i +.I salttype=[v5|v4|norealm|onlyrealm|special] +Indicates the salt type. +.TP i +.I [+/-]postdateable +Specifies that tickets for this principal [are/are not] postdateable. +.TP i +.I [+/-]forwardable +Specifies that tickets for this principal [are/are not] forwardable. +.TP i +.I [+/-]tgt_req +Specifies that TGT-based requests for this principal [are/are not] allowed. +.TP i +.I [+/-]renewable +Specifies that tickets for this principal [are/are not] renewable. +.TP i +.I [+/-]proxiable +Specifies that tickets for this principal [are/are not] proxiable. +.TP i +.I [+/-]dup_skey +Specifies that tickets issued by this service [may/may not] be encrypted +using the session key instead of the private key. +.TP i +.I [+/-]allow_tickets +Specifies that tickets for this principal [are/are not] allowed. +.TP i +.I [+/-]preauth +Specifies that preauthorization [is/is not] required for this principal. +.TP i +.I [+/-]hwauth +Specifies that hardware preauthorization [is/is not] required for this +principal. +.TP i +.I [+/-]pwchange_req +Specifies that a password change [is/is not] required for this principal. +.TP i +.I [+/-]server +Specifies that this principal [is/is not] allowed to be a service. +.TP i +.I [+/-]pwservice +Specifies that this principal [is/is not] the password changing service. +.TP i +.I [+/-]md5 +Specifies that DES MD5 [is/is not] supported for this principal. + +.SH Date Format +The format of +may be one of the following, where +.I yy +is the last two digits of the year; +.I mm +is the month number (with a leading zero if less than 10); +.I dd +is the day number in the month (with a leading zero if less than 10); +.I HH +is the hour number (24-hour clock); +.I MM +is the minute number; and +.I SS +is the second number: +.TP i +.I yy.mm.dd.HH.MM.SS +e.g. 95.09.01.00.00.00 for midnight on September 1, 1995. +.TP i +.I yymmddHHMMSS +e.g. 950901000000 for midnight on September 1, 1995. +.PP +If the +.B strptime(3) +function is available, then the following formats are also supported. +.PP +.TP i +.I yymmddHHMM +e.g. 9509010000 for midnight on September 1, 1995. +.TP i +.I HHMMSS +e.g. 200000 for 8pm tonight. +.TP i +.I HHMM +e.g. 2100 for 9pm tonight. +.TP i +.I HH:MM:SS +e.g. 20:00:00 for 8pm tonight. +.TP i +.I HH:MM +e.g. 21:00 for 9pm tonight. +.TP i +.I locale-dependent short format (mm/dd/yy:HH:MM:SS) in U.S. +.e.g 01/09/95:00:00:00 for midnight on September 1, 1995. +.TP i +.I dd--yyyy:HH:MM:SS +e.g. 01-Sep-1995:00:00:00 for midnight on September 1, 1995. +.TP i +.I dd--yyyy:HH:MM +e.g. 01-Sep-1995:00:00 for midnight on September 1, 1995. +.PP +.SH SEE ALSO +kadmind5(8), kpasswd(1), strptime(3) diff --git a/src/kadmin/v5client/kadmin5.c b/src/kadmin/v5client/kadmin5.c new file mode 100644 index 000000000..0538c9ee0 --- /dev/null +++ b/src/kadmin/v5client/kadmin5.c @@ -0,0 +1,1434 @@ +/* + * kadmin/v5client/kadmin5.c + * + * Copyright 1995 by the Massachusetts Institute of Technology. + * All Rights Reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + */ + +/* + * kadmin5.c - Perform administrative functions using the new + * administrative protocol. + */ +#include "k5-int.h" +#include "com_err.h" +#include "adm.h" +#include "kadmin5.h" +#if HAVE_PWD_H +#include +#endif /* HAVE_PWD_H */ +#if HAVE_RE_COMP || HAVE_REGCOMP +#include +#endif /* HAVE_RE_COMP || HAVE_REGCOMP */ + +/* + * Global storage. + */ +int exit_status = 0; +krb5_context kcontext; +char *programname = (char *) NULL; +char *requestname = (char *) NULL; +krb5_boolean multiple = 0; +char *principal_name = (char *) NULL; +char *password_prompt = (char *) NULL; + +extern krb5_kt_ops krb5_ktf_writable_ops; + +/* + * Own storage + */ +static char *realm_name = (char *) NULL; +#if !HAVE_RE_COMP && !HAVE_REGCOMP +static char *re_string = (char *) NULL; +#endif /* !HAVE_RE_COMP && !HAVE_REGCOMP */ + +/* + * Static strings. + */ +static const char *help_option = "-help"; +static const char *verbose_option = "-verbose"; +static const char *force_option = "-force"; +static const char *kadmin_instance = "kadmin5"; + +static const char *wr_ktab_type = "WRFILE"; + +static const char *gent_opterr_fmt = "- cannot decode protocol"; +static const char *db_print_header = "------------------------------------\n"; +static const char *db_print_1_fmt = "Principal: %s (key version %d)\n"; +static const char *db_print_2_fmt = "Maximum ticket lifetime: %s\n"; +static const char *db_print_2a_fmt = "Maximum renewable lifetime: %s\n"; +static const char *db_print_3_fmt = "Principal expiration: %s\n"; +static const char *db_print_3a_fmt = "Password expiration: %s\n"; +static const char *db_print_4_fmt = "Last password change: %s\n"; +static const char *db_print_5_fmt = "Last successful entry: %s\n"; +static const char *db_print_6_fmt = "Last unsuccessful entry: %s"; +static const char *db_print_6_opt_fmt = " - failed %d times"; +static const char *db_print_7_fmt = "Last modified by: %s (%s)\n\t[master version %d]\n"; +static const char *db_print_8_fmt = "Flags: %s\n"; +static const char *db_print_9_fmt = "Salt: %s"; +static const char *db_print_9a_fmt = ", %s"; +static const char *db_print_trailer = "------------------------------------\n"; + +static const char *db_indef_dt_msg = "indefinite"; +static const char *db_never_msg = "never"; +static const char *db_none_msg = "none"; + +static const char *sprinc_usage_fmt = "usage is %s principal [...]"; +static const char *add_usage_fmt = "usage is %s principal [attributes...]"; +static const char *add_prompt1_fmt = " Enter new password for %s : "; +static const char *add_prompt2_fmt = "Re-enter new password for %s : "; +static const char *add_succ_fmt = "principal %s added"; +static const char *add_protoerr_fmt = "- protocol encode error"; +static const char *add_noconf_fmt = "password not confirmed"; +static const char *add_synerr_fmt = "syntax error"; +static const char *cpw_usage_fmt = "usage is %s principal"; +static const char *cpw_prompt1_fmt = " Enter new password for %s: "; +static const char *cpw_prompt2_fmt = "Re-enter new password for %s: "; +static const char *cpw_succ_fmt = "password changed for %s"; +static const char *cpw_nochange_fmt = "password not changed for %s"; +static const char *dprinc_usage_fmt = "usage is %s [%s] principal [...]"; +static const char *del_conf_fmt = "Enter '%c' to delete principal %s: "; +static const char del_conf_char = 'y'; +static const char *del_princ_fmt = "principal %s deleted."; +static const char *del_noconf_fmt = "not confirmed - principal %s not deleted"; +static const char *xst_ktab_name_fmt = "%s:%s-new-srvtab"; +static const char *xst_k4tab_name_fmt = "%s-new-v4-srvtab"; +static const char *xst_dfl_ktname = "DEFAULT"; +static const char *xst_usage_fmt = "usage is %s instance principal [...]"; +static const char *xst_wr_reg_fmt = "(%s) cannot register writeable keytable"; +static const char *xst_inst2long_fmt = "'%s' is too long for a filename, using '%s' instead"; +static const char *xst_nokeytab_fmt = "cannot open key table %s"; +static const char *xst_nodeskey_fmt = "%s does not have a DES key"; +static const char *xst_adderr_fmt = "cannot add entry %s"; +static const char *xst_success_fmt = "extracted entry %s to key table %s"; +static const char *xst_proto_fmt = "cannot decode service key table entry from protocol"; +static const char *xst_kclose_fmt = "cannot close key table %s"; +static const char *mod_usage_fmt = "usage is %s principal [attributes...]"; +static const char *mod_succ_fmt = "principal %s modified."; +static const char *mod_protoerr_fmt = "protocol encode error"; +static const char *mod_synerr_fmt = "syntax error"; +static const char *rprinc_usage_fmt = "usage is %s [%s] principal principal"; +static const char *ren_conf_fmt = "Enter '%c' to rename principal %s to %s: "; +static const char ren_conf_char = 'y'; +static const char *ren_princ_fmt = "principal %s renamed to %s."; +static const char *ren_noconf_fmt = "not confirmed - principal %s not renamed to %s."; +#if HAVE_RE_COMP || HAVE_REGCOMP +static const char *lprinc_usage_fmt = "usage is %s [%s] "; +#else /* HAVE_RE_COMP || HAVE_REGCOMP */ +static const char *lprinc_usage_fmt = "usage is %s [%s] princpal"; +#endif /* HAVE_RE_COMP || HAVE_REGCOMP */ +static const char *lprinc_all_regexp = ".*"; +static const char *lprinc_regexp_fmt = "%s - regular expression error: %s"; +static const char *lprinc_regsrch_fmt = "%s on %s - RE search error: %s"; +static const char *lprinc_first_msg = "first database entry"; +static const char *cant_get_fmt = "cannot get entry for %s"; +static const char *no_memory_fmt = "cannot get memory"; +static const char *lang_usage_fmt = "usage is %s language"; +static const char *cd_cannot_fmt = "cannot change directory to %s"; +static const char *cd_usage_fmt = "usage is %s directory"; +static const char *pwd_mess_fmt = "Current directory is %s\n"; +static const char *pwd_err_fmt = "cannot get current directory: %s"; +static const char *pwd_usage_fmt = "usage is %s"; +static const char *kadmin_usage_fmt = "usage is %s [-r realm] [-p principal] [-m] [command ...]"; +static const char *kadmin_defrealm_msg = ": cannot get default realm"; +static const char *kadmin_srealm_fmt = ": cannot set realm to \"%s\""; +static const char *kadmin_nopname_msg = ": cannot find a principal name"; +static const char *kadmin_unparse_msg = ": cannot flatten principal name"; +static const char *kadmin_nocomp_msg = ": no components in principal name"; +static const char *kadmin_noprompt_msg = ": cannot make password prompt"; + +static const char *kadmin_pprompt_fmt = "Enter password for %s: "; + +#if !HAVE_RE_COMP && !HAVE_REGCOMP +/* + * re_comp() - Compile a regular expression for subsequent usage by re_exec + * + * This routine is only a shell. Null expressions or expressions matching + * lprinc_all_regexp are taken to match everything, all others are + * interpreted as "string".*. + */ +static char * +re_comp(rstring) + char *rstring; +{ + if (strlen(rstring) && strcmp(rstring, lprinc_all_regexp)) { + re_string = rstring; + } + else { + re_string = (char *) NULL; + } + return((char *) NULL); +} + +/* + * re_exec() - Attempt to match a string to a regular expression previously + * specified to re_comp(). + * + * This routine is only a shell. + */ +static int +re_exec(sstring) + char *sstring; +{ + if (re_string) + return(strncmp(sstring, re_string, strlen(re_string)) ? 0 : 1); + else + return(1); +} +#endif /* !HAVE_RE_COMP && !HAVE_REGCOMP */ + +/* + * kadmin_get_entry() - Get a principal entry. + */ +static krb5_error_code +kadmin_get_entry(pname, validp, dbentp, nextp) + char *pname; + krb5_ui_4 *validp; + krb5_db_entry *dbentp; + char **nextp; +{ + krb5_error_code kret; + krb5_int32 proto_stat; + krb5_int32 ncomps; + krb5_data *complist; + char *pword; + + if (!(kret = net_do_proto(KRB5_ADM_INQ_PRINC_CMD, + pname, + (char *) NULL, + 0, + (krb5_data *) NULL, + &proto_stat, + &ncomps, + &complist))) { + if (proto_stat == KRB5_ADM_SUCCESS) { + *nextp = (char *) malloc((size_t) complist[0].length + 1); + if (*nextp) { + strncpy(*nextp, complist[0].data, (size_t) complist[0].length); + (*nextp)[complist[0].length] = '\0'; + } + if (!(kret = krb5_adm_proto_to_dbent(kcontext, + ncomps-1, + &complist[1], + validp, + dbentp, + &pword))) { + if (pword) + krb5_xfree(pword); + } + else { + com_err(requestname, kret, gent_opterr_fmt); + } + krb5_free_adm_data(kcontext, ncomps, complist); + } + else + kret = EIO; + } + return(kret); +} + +/* + * kadmin_princ_entry() - Print out a database entry. + */ +static void +kadmin_print_entry(name, valid, dbentp) + char *name; + krb5_ui_4 valid; + krb5_db_entry *dbentp; +{ + printf(db_print_header); + printf(db_print_1_fmt, name, + ((valid & KRB5_ADM_M_KVNO) ? dbentp->kvno : -1)); + printf(db_print_2_fmt, + ((valid & KRB5_ADM_M_MAXLIFE) ? + delta2string(dbentp->max_life) : db_indef_dt_msg)); + printf(db_print_2a_fmt, + ((valid & KRB5_ADM_M_MAXRENEWLIFE) ? + delta2string(dbentp->max_renewable_life) : db_indef_dt_msg)); + printf(db_print_3_fmt, + ((valid & KRB5_ADM_M_EXPIRATION) ? + abs2string(dbentp->expiration) : db_never_msg)); + printf(db_print_3a_fmt, + ((valid & KRB5_ADM_M_PWEXPIRATION) ? + abs2string(dbentp->pw_expiration) : db_never_msg)); + printf(db_print_4_fmt, + ((valid & KRB5_ADM_M_LASTPWCHANGE) ? + abs2string(dbentp->last_pwd_change) : db_never_msg)); + printf(db_print_5_fmt, + ((valid & KRB5_ADM_M_LASTSUCCESS) ? + abs2string(dbentp->last_success) : db_never_msg)); + if ((valid & KRB5_ADM_M_FAILCOUNT) && (dbentp->fail_auth_count > 0)) { + printf(db_print_6_fmt, + ((valid & KRB5_ADM_M_LASTFAILED) ? + abs2string(dbentp->last_failed) : db_never_msg)); + printf(db_print_6_opt_fmt, dbentp->fail_auth_count); + printf("\n"); + } + + if (valid & KRB5_ADM_M_MODNAME) { + char *mname; + if (!krb5_unparse_name(kcontext, dbentp->mod_name, &mname)) { + printf(db_print_7_fmt, mname, + ((valid & KRB5_ADM_M_MODDATE) ? + abs2string(dbentp->mod_date) : db_never_msg), + ((valid & KRB5_ADM_M_MKVNO) ? dbentp->mkvno : -1)); + krb5_xfree(mname); + } + } + printf(db_print_8_fmt, + ((valid & KRB5_ADM_M_FLAGS) ? + dbflags2string(dbentp->attributes) : "")); + if (valid & KRB5_ADM_M_SALTTYPE) { + printf(db_print_9_fmt, salt2string(dbentp->salt_type)); + if (dbentp->salt_type != dbentp->alt_salt_type) + printf(db_print_9a_fmt, salt2string(dbentp->alt_salt_type)); + printf("\n"); + } + printf(db_print_trailer); +} + +/* + * Dispatch procedures. + */ + +/* + * kadmin_show_principal() - Show a principal. + */ +void +kadmin_show_principal(argc, argv) + int argc; + char *argv[]; +{ + int i; + krb5_error_code kret; + char *xxx; + krb5_ui_4 valid; + krb5_db_entry *dbentry; + + requestname = argv[0]; + if (argc == 1) { + com_err(argv[0], 0, sprinc_usage_fmt, argv[0]); + return; + } + for (i=1; i= sizeof(keytab_name)) { + com_err(requestname, 0, xst_inst2long_fmt, instance, xst_dfl_ktname); + sprintf(keytab_name, xst_ktab_name_fmt, wr_ktab_type, xst_dfl_ktname); + } + else + sprintf(keytab_name, xst_ktab_name_fmt, wr_ktab_type, instance); + actname = &keytab_name[strlen(wr_ktab_type)+1]; + + if (kret = krb5_kt_resolve(kcontext, keytab_name, &keytab_id)) { + com_err(requestname, kret, xst_nokeytab_fmt, actname); + return; + } + memset((char *) &keytab_entry, 0, sizeof(krb5_keytab_entry)); + for (i=0; i= sizeof(keytab_name)) { + com_err(requestname, 0, xst_inst2long_fmt, instance, xst_dfl_ktname); + sprintf(keytab_name, xst_k4tab_name_fmt, xst_dfl_ktname); + } + else + sprintf(keytab_name, xst_k4tab_name_fmt, instance); + + if ((v4tab = fopen(keytab_name, "w")) == NULL) { + com_err(requestname, errno, xst_nokeytab_fmt, keytab_name); + return; + } + memset((char *) &keytab_entry, 0, sizeof(krb5_keytab_entry)); + for (i=0; i 0) { + if (!strcmp(argv[0], force_option)) { + force = 1; + argc--; + argv++; + } + if (argc != 2) + uerr++; + } + else + uerr++; + if (uerr) { + com_err(requestname, 0, rprinc_usage_fmt, requestname, force_option); + return; + } + + doit = 0; + if (force) { + doit = 1; + } + else { + int c; + printf(ren_conf_fmt, ren_conf_char, argv[0], argv[1]); + if (getchar() == ren_conf_char) + doit = 1; + while (((c = getchar()) != '\n') && (c != EOF)); + } + + if (doit) { + if (!(kret = net_do_proto(KRB5_ADM_REN_PRINC_CMD, + argv[0], + argv[1], + 0, + (krb5_data *) NULL, + &proto_stat, + &ncomps, + &complist))) { + if (proto_stat == KRB5_ADM_SUCCESS) { + com_err(programname, 0, ren_princ_fmt, argv[0], argv[1]); + krb5_free_adm_data(kcontext, ncomps, complist); + } + } + } + else { + com_err(programname, 0, ren_noconf_fmt, argv[0], argv[1]); + } +} + +/* + * kadmin_list() - List principals. + */ +void +kadmin_list(argc, argv) + int argc; + char *argv[]; +{ + krb5_error_code kret; + int error; + int i; + krb5_boolean verbose; + char *re_result; +#if HAVE_REGCOMP + regex_t match_exp; + regmatch_t match_match; + int match_error; + char match_errmsg[BUFSIZ]; + size_t errmsg_size; +#endif /* HAVE_REGCOMP */ +#if HAVE_RE_COMP && !HAVE_REGCOMP + extern char *re_comp(); +#endif /* HAVE_RE_COMP && !HAVE_REGCOMP */ + + requestname = argv[0]; + error = 0; + verbose = 0; +#if HAVE_REGCOMP + if (match_error = regcomp(&match_exp, lprinc_all_regexp, REG_EXTENDED)) { + errmsg_size = regerror(match_error, + &match_exp, + match_errmsg, + sizeof(match_errmsg)); + com_err(requestname, 0, lprinc_regexp_fmt, lprinc_all_regexp, + match_errmsg); + return; + } +#else /* HAVE_REGCOMP */ + re_comp(".*"); /* Accept everything */ +#endif /* HAVE_REGCOMP */ + + for (i=1; i 0) { + krb5_data *dp; + + dp = krb5_princ_component(kcontext, me, 0); + if (user = (char *) malloc((size_t) dp->length + 1)) { + strncpy(user, dp->data, (size_t) dp->length); + user[dp->length] = '\0'; + } + else { + kret = ENOMEM; + } + } + else { + com_err(argv[0], 0, kadmin_nocomp_msg); + exit(1); + } + } + else if (user = getenv("USER")) { + char *xxx; + + xxx = (char *) malloc(strlen(user)+1); + if (xxx) { + strcpy(xxx, user); + kret = 0; + } + user = xxx; + } +#if HAVE_PWD_H + else if (pw = getpwuid(getuid())) { + if (user = (char *) malloc(strlen(pw->pw_name)+1)) { + strcpy(user, pw->pw_name); + kret = 0; + } + else + kret = ENOMEM; + } +#endif /* HAVE_PWD_H */ + + if (user) { + if (principal_name = (char *) malloc(strlen(user)+1+ + strlen(kadmin_instance)+1+ + strlen(realm_name)+1)) { + sprintf(principal_name, "%s/%s@%s", + user, kadmin_instance, realm_name); + free(user); + } + else + kret = ENOMEM; + } + if (kret || !user) { + com_err(argv[0], kret, kadmin_nopname_msg); + exit(1); + } + if (ccache) + krb5_cc_close(kcontext, ccache); + if (me) + krb5_free_principal(kcontext, me); + } + + /* Formulate the password prompt while we're here */ + if (password_prompt = (char *) malloc(strlen(kadmin_pprompt_fmt)+ + strlen(principal_name)+1)) { + sprintf(password_prompt, kadmin_pprompt_fmt, principal_name); + } + else { + com_err(argv[0], ENOMEM, kadmin_noprompt_msg); + exit(1); + } + + /* See if something's left, e.g. a request */ + if (argc > optind) { + size_t n2alloc; + int i; + + n2alloc = 0; + for (i=optind; i 0) { + for (i=0; i +#include + +extern ss_request_table kadmin_cmds; +extern int exit_status; +extern char *kadmin_startup(); + +int main(argc, argv) + int argc; + char *argv[]; +{ + char *request; + krb5_error_code retval; + int sci_idx, code = 0; + + request = kadmin_startup(argc, argv); + sci_idx = ss_create_invocation("kadmin5", "5.0", (char *) NULL, + &kadmin_cmds, &retval); + if (retval) { + ss_perror(sci_idx, retval, "creating invocation"); + exit(1); + } + if (request) { + (void) ss_execute_line(sci_idx, request, &code); + free(request); + if (code != 0) { + ss_perror(sci_idx, code, request); + exit_status++; + } + } else + ss_listen(sci_idx, &retval); + return kadmin_cleanup() ? 1 : exit_status; +} -- 2.26.2