1 /* $NetBSD: get.c,v 1.1.1.2 2014/04/24 12:45:26 pettai Exp $ */ 2 3 /* 4 * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include "ktutil_locl.h" 37 38 __RCSID("NetBSD"); 39 40 static void* 41 open_kadmin_connection(char *principal, 42 const char *realm, 43 char *admin_server, 44 int server_port) 45 { 46 static kadm5_config_params conf; 47 krb5_error_code ret; 48 void *kadm_handle; 49 memset(&conf, 0, sizeof(conf)); 50 51 if(realm) { 52 conf.realm = strdup(realm); 53 if (conf.realm == NULL) { 54 krb5_set_error_message(context, 0, "malloc: out of memory"); 55 return NULL; 56 } 57 conf.mask |= KADM5_CONFIG_REALM; 58 } 59 60 if (admin_server) { 61 conf.admin_server = admin_server; 62 conf.mask |= KADM5_CONFIG_ADMIN_SERVER; 63 } 64 65 if (server_port) { 66 conf.kadmind_port = htons(server_port); 67 conf.mask |= KADM5_CONFIG_KADMIND_PORT; 68 } 69 70 /* should get realm from each principal, instead of doing 71 everything with the same (local) realm */ 72 73 ret = kadm5_init_with_password_ctx(context, 74 principal, 75 NULL, 76 KADM5_ADMIN_SERVICE, 77 &conf, 0, 0, 78 &kadm_handle); 79 free(conf.realm); 80 if(ret) { 81 krb5_warn(context, ret, "kadm5_init_with_password"); 82 return NULL; 83 } 84 return kadm_handle; 85 } 86 87 int 88 kt_get(struct get_options *opt, int argc, char **argv) 89 { 90 krb5_error_code ret = 0; 91 krb5_keytab keytab; 92 void *kadm_handle = NULL; 93 krb5_enctype *etypes = NULL; 94 size_t netypes = 0; 95 size_t i; 96 int a, j; 97 unsigned int failed = 0; 98 99 if((keytab = ktutil_open_keytab()) == NULL) 100 return 1; 101 102 if(opt->realm_string) 103 krb5_set_default_realm(context, opt->realm_string); 104 105 if (opt->enctypes_strings.num_strings != 0) { 106 107 etypes = malloc (opt->enctypes_strings.num_strings * sizeof(*etypes)); 108 if (etypes == NULL) { 109 krb5_warnx(context, "malloc failed"); 110 goto out; 111 } 112 netypes = opt->enctypes_strings.num_strings; 113 for(i = 0; i < netypes; i++) { 114 ret = krb5_string_to_enctype(context, 115 opt->enctypes_strings.strings[i], 116 &etypes[i]); 117 if(ret) { 118 krb5_warnx(context, "unrecognized enctype: %s", 119 opt->enctypes_strings.strings[i]); 120 goto out; 121 } 122 } 123 } 124 125 126 for(a = 0; a < argc; a++){ 127 krb5_principal princ_ent; 128 kadm5_principal_ent_rec princ; 129 int mask = 0; 130 krb5_keyblock *keys; 131 int n_keys; 132 int created = 0; 133 krb5_keytab_entry entry; 134 135 ret = krb5_parse_name(context, argv[a], &princ_ent); 136 if (ret) { 137 krb5_warn(context, ret, "can't parse principal %s", argv[a]); 138 failed++; 139 continue; 140 } 141 memset(&princ, 0, sizeof(princ)); 142 princ.principal = princ_ent; 143 mask |= KADM5_PRINCIPAL; 144 princ.attributes |= KRB5_KDB_DISALLOW_ALL_TIX; 145 mask |= KADM5_ATTRIBUTES; 146 princ.princ_expire_time = 0; 147 mask |= KADM5_PRINC_EXPIRE_TIME; 148 149 if(kadm_handle == NULL) { 150 const char *r; 151 if(opt->realm_string != NULL) 152 r = opt->realm_string; 153 else 154 r = krb5_principal_get_realm(context, princ_ent); 155 kadm_handle = open_kadmin_connection(opt->principal_string, 156 r, 157 opt->admin_server_string, 158 opt->server_port_integer); 159 if(kadm_handle == NULL) 160 break; 161 } 162 163 ret = kadm5_create_principal(kadm_handle, &princ, mask, "x"); 164 if(ret == 0) 165 created = 1; 166 else if(ret != KADM5_DUP) { 167 krb5_warn(context, ret, "kadm5_create_principal(%s)", argv[a]); 168 krb5_free_principal(context, princ_ent); 169 failed++; 170 continue; 171 } 172 ret = kadm5_randkey_principal(kadm_handle, princ_ent, &keys, &n_keys); 173 if (ret) { 174 krb5_warn(context, ret, "kadm5_randkey_principal(%s)", argv[a]); 175 krb5_free_principal(context, princ_ent); 176 failed++; 177 continue; 178 } 179 180 ret = kadm5_get_principal(kadm_handle, princ_ent, &princ, 181 KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES); 182 if (ret) { 183 krb5_warn(context, ret, "kadm5_get_principal(%s)", argv[a]); 184 for (j = 0; j < n_keys; j++) 185 krb5_free_keyblock_contents(context, &keys[j]); 186 krb5_free_principal(context, princ_ent); 187 failed++; 188 continue; 189 } 190 if(!created && (princ.attributes & KRB5_KDB_DISALLOW_ALL_TIX)) 191 krb5_warnx(context, "%s: disallow-all-tix flag set - clearing", argv[a]); 192 princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX); 193 mask = KADM5_ATTRIBUTES; 194 if(created) { 195 princ.kvno = 1; 196 mask |= KADM5_KVNO; 197 } 198 ret = kadm5_modify_principal(kadm_handle, &princ, mask); 199 if (ret) { 200 krb5_warn(context, ret, "kadm5_modify_principal(%s)", argv[a]); 201 for (j = 0; j < n_keys; j++) 202 krb5_free_keyblock_contents(context, &keys[j]); 203 krb5_free_principal(context, princ_ent); 204 failed++; 205 continue; 206 } 207 for(j = 0; j < n_keys; j++) { 208 int do_add = TRUE; 209 210 if (netypes) { 211 size_t k; 212 213 do_add = FALSE; 214 for (k = 0; k < netypes; ++k) 215 if (keys[j].keytype == etypes[k]) { 216 do_add = TRUE; 217 break; 218 } 219 } 220 if (do_add) { 221 entry.principal = princ_ent; 222 entry.vno = princ.kvno; 223 entry.keyblock = keys[j]; 224 entry.timestamp = time (NULL); 225 ret = krb5_kt_add_entry(context, keytab, &entry); 226 if (ret) 227 krb5_warn(context, ret, "krb5_kt_add_entry"); 228 } 229 krb5_free_keyblock_contents(context, &keys[j]); 230 } 231 232 kadm5_free_principal_ent(kadm_handle, &princ); 233 krb5_free_principal(context, princ_ent); 234 } 235 out: 236 free(etypes); 237 if (kadm_handle) 238 kadm5_destroy(kadm_handle); 239 krb5_kt_close(context, keytab); 240 return ret != 0 || failed > 0; 241 } 242