1 /* $NetBSD: get.c,v 1.5 2023/06/19 21:41:41 christos Exp $ */
2
3 /*
4 * Copyright (c) 1997-2006 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 *
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 #include "kadmin_locl.h"
37 #include "kadmin-commands.h"
38 #include <krb5/parse_units.h>
39 #include <krb5/rtbl.h>
40
41 static struct field_name {
42 const char *fieldname;
43 unsigned int fieldvalue;
44 unsigned int subvalue;
45 uint32_t extra_mask;
46 const char *default_header;
47 const char *def_longheader;
48 unsigned int flags;
49 } field_names[] = {
50 { "principal", KADM5_PRINCIPAL, 0, 0, "Principal", "Principal", 0 },
51 { "princ_expire_time", KADM5_PRINC_EXPIRE_TIME, 0, 0, "Expiration", "Principal expires", 0 },
52 { "pw_expiration", KADM5_PW_EXPIRATION, 0, 0, "PW-exp", "Password expires", 0 },
53 { "last_pwd_change", KADM5_LAST_PWD_CHANGE, 0, 0, "PW-change", "Last password change", 0 },
54 { "max_life", KADM5_MAX_LIFE, 0, 0, "Max life", "Max ticket life", 0 },
55 { "max_rlife", KADM5_MAX_RLIFE, 0, 0, "Max renew", "Max renewable life", 0 },
56 { "mod_time", KADM5_MOD_TIME, 0, 0, "Mod time", "Last modified", 0 },
57 { "mod_name", KADM5_MOD_NAME, 0, 0, "Modifier", "Modifier", 0 },
58 { "attributes", KADM5_ATTRIBUTES, 0, 0, "Attributes", "Attributes", 0 },
59 { "kvno", KADM5_KVNO, 0, 0, "Kvno", "Kvno", RTBL_ALIGN_RIGHT },
60 { "mkvno", KADM5_MKVNO, 0, 0, "Mkvno", "Mkvno", RTBL_ALIGN_RIGHT },
61 { "last_success", KADM5_LAST_SUCCESS, 0, 0, "Last login", "Last successful login", 0 },
62 { "last_failed", KADM5_LAST_FAILED, 0, 0, "Last fail", "Last failed login", 0 },
63 { "fail_auth_count", KADM5_FAIL_AUTH_COUNT, 0, 0, "Fail count", "Failed login count", RTBL_ALIGN_RIGHT },
64 { "policy", KADM5_POLICY, 0, 0, "Policy", "Policy", 0 },
65 { "keytypes", KADM5_KEY_DATA, 0, KADM5_PRINCIPAL | KADM5_KVNO, "Keytypes", "Keytypes", 0 },
66 { "password", KADM5_TL_DATA, KRB5_TL_PASSWORD, KADM5_KEY_DATA, "Password", "Password", 0 },
67 { "pkinit-acl", KADM5_TL_DATA, KRB5_TL_PKINIT_ACL, 0, "PK-INIT ACL", "PK-INIT ACL", 0 },
68 { "aliases", KADM5_TL_DATA, KRB5_TL_ALIASES, 0, "Aliases", "Aliases", 0 },
69 { "hist-kvno-diff-clnt", KADM5_TL_DATA, KRB5_TL_HIST_KVNO_DIFF_CLNT, 0, "Clnt hist keys", "Historic keys allowed for client", 0 },
70 { "hist-kvno-diff-svc", KADM5_TL_DATA, KRB5_TL_HIST_KVNO_DIFF_SVC, 0, "Svc hist keys", "Historic keys allowed for service", 0 },
71 { NULL, 0, 0, 0, NULL, NULL, 0 }
72 };
73
74 struct field_info {
75 struct field_name *ff;
76 char *header;
77 struct field_info *next;
78 };
79
80 struct get_entry_data {
81 void (*format)(struct get_entry_data*, kadm5_principal_ent_t);
82 rtbl_t table;
83 uint32_t mask;
84 uint32_t extra_mask;
85 struct field_info *chead, **ctail;
86 };
87
88 static int
add_column(struct get_entry_data * data,struct field_name * ff,const char * header)89 add_column(struct get_entry_data *data, struct field_name *ff, const char *header)
90 {
91 struct field_info *f = malloc(sizeof(*f));
92 if (f == NULL)
93 return ENOMEM;
94 f->ff = ff;
95 if(header)
96 f->header = strdup(header);
97 else
98 f->header = NULL;
99 f->next = NULL;
100 *data->ctail = f;
101 data->ctail = &f->next;
102 data->mask |= ff->fieldvalue;
103 data->extra_mask |= ff->extra_mask;
104 if(data->table != NULL)
105 rtbl_add_column_by_id(data->table, ff->fieldvalue,
106 header ? header : ff->default_header, ff->flags);
107 return 0;
108 }
109
110 /*
111 * return 0 iff `salt' actually is the same as the current salt in `k'
112 */
113
114 static int
cmp_salt(const krb5_salt * salt,const krb5_key_data * k)115 cmp_salt (const krb5_salt *salt, const krb5_key_data *k)
116 {
117 if (salt->salttype != (size_t)k->key_data_type[1])
118 return 1;
119 if (salt->saltvalue.length != (size_t)k->key_data_length[1])
120 return 1;
121 return memcmp (salt->saltvalue.data, k->key_data_contents[1],
122 salt->saltvalue.length);
123 }
124
125 static void
format_keytype(krb5_key_data * k,krb5_salt * def_salt,char * buf,size_t buf_len)126 format_keytype(krb5_key_data *k, krb5_salt *def_salt, char *buf, size_t buf_len)
127 {
128 krb5_error_code ret;
129 char *s;
130 int aret;
131
132 buf[0] = '\0';
133 ret = krb5_enctype_to_string (context,
134 k->key_data_type[0],
135 &s);
136 if (ret) {
137 aret = asprintf (&s, "unknown(%d)", k->key_data_type[0]);
138 if (aret == -1)
139 return; /* Nothing to do here, we have no way to pass the err */
140 }
141 strlcpy(buf, s, buf_len);
142 free(s);
143
144 strlcat(buf, "(", buf_len);
145
146 ret = krb5_salttype_to_string (context,
147 k->key_data_type[0],
148 k->key_data_type[1],
149 &s);
150 if (ret) {
151 aret = asprintf (&s, "unknown(%d)", k->key_data_type[1]);
152 if (aret == -1)
153 return; /* Again, nothing else to do... */
154 }
155 strlcat(buf, s, buf_len);
156 free(s);
157
158 aret = 0;
159 if (cmp_salt(def_salt, k) == 0)
160 s = strdup("");
161 else if(k->key_data_length[1] == 0)
162 s = strdup("()");
163 else
164 aret = asprintf (&s, "(%.*s)", k->key_data_length[1],
165 (char *)k->key_data_contents[1]);
166 if (aret == -1 || s == NULL)
167 return; /* Again, nothing else we can do... */
168 strlcat(buf, s, buf_len);
169 free(s);
170 aret = asprintf (&s, "[%d]", k->key_data_kvno);
171 if (aret == -1)
172 return;
173 strlcat(buf, ")", buf_len);
174
175 strlcat(buf, s, buf_len);
176 free(s);
177 }
178
179 static void
format_field(kadm5_principal_ent_t princ,unsigned int field,unsigned int subfield,char * buf,size_t buf_len,int condensed)180 format_field(kadm5_principal_ent_t princ, unsigned int field,
181 unsigned int subfield, char *buf, size_t buf_len, int condensed)
182 {
183 switch(field) {
184 case KADM5_PRINCIPAL:
185 if(condensed)
186 krb5_unparse_name_fixed_short(context, princ->principal, buf, buf_len);
187 else
188 krb5_unparse_name_fixed(context, princ->principal, buf, buf_len);
189 break;
190
191 case KADM5_PRINC_EXPIRE_TIME:
192 time_t2str(princ->princ_expire_time, buf, buf_len, !condensed);
193 break;
194
195 case KADM5_PW_EXPIRATION:
196 time_t2str(princ->pw_expiration, buf, buf_len, !condensed);
197 break;
198
199 case KADM5_LAST_PWD_CHANGE:
200 time_t2str(princ->last_pwd_change, buf, buf_len, !condensed);
201 break;
202
203 case KADM5_MAX_LIFE:
204 deltat2str(princ->max_life, buf, buf_len);
205 break;
206
207 case KADM5_MAX_RLIFE:
208 deltat2str(princ->max_renewable_life, buf, buf_len);
209 break;
210
211 case KADM5_MOD_TIME:
212 time_t2str(princ->mod_date, buf, buf_len, !condensed);
213 break;
214
215 case KADM5_MOD_NAME:
216 if (princ->mod_name == NULL)
217 strlcpy(buf, "unknown", buf_len);
218 else if(condensed)
219 krb5_unparse_name_fixed_short(context, princ->mod_name, buf, buf_len);
220 else
221 krb5_unparse_name_fixed(context, princ->mod_name, buf, buf_len);
222 break;
223 case KADM5_ATTRIBUTES:
224 attributes2str (princ->attributes, buf, buf_len);
225 break;
226 case KADM5_KVNO:
227 snprintf(buf, buf_len, "%d", princ->kvno);
228 break;
229 case KADM5_MKVNO:
230 /* XXX libkadm5srv decrypts the keys, so mkvno is always 0. */
231 strlcpy(buf, "unknown", buf_len);
232 break;
233 case KADM5_LAST_SUCCESS:
234 time_t2str(princ->last_success, buf, buf_len, !condensed);
235 break;
236 case KADM5_LAST_FAILED:
237 time_t2str(princ->last_failed, buf, buf_len, !condensed);
238 break;
239 case KADM5_FAIL_AUTH_COUNT:
240 snprintf(buf, buf_len, "%d", princ->fail_auth_count);
241 break;
242 case KADM5_POLICY:
243 if(princ->policy != NULL)
244 strlcpy(buf, princ->policy, buf_len);
245 else
246 strlcpy(buf, "none", buf_len);
247 break;
248 case KADM5_KEY_DATA:{
249 krb5_salt def_salt;
250 int i;
251 char buf2[1024];
252 krb5_get_pw_salt (context, princ->principal, &def_salt);
253
254 *buf = '\0';
255 for (i = 0; i < princ->n_key_data; ++i) {
256 format_keytype(&princ->key_data[i], &def_salt, buf2, sizeof(buf2));
257 if(i > 0)
258 strlcat(buf, ", ", buf_len);
259 strlcat(buf, buf2, buf_len);
260 }
261 krb5_free_salt (context, def_salt);
262 break;
263 }
264 case KADM5_TL_DATA: {
265 krb5_tl_data *tl;
266
267 for (tl = princ->tl_data; tl != NULL; tl = tl->tl_data_next)
268 if ((unsigned)tl->tl_data_type == subfield)
269 break;
270 if (tl == NULL) {
271 strlcpy(buf, "", buf_len);
272 break;
273 }
274
275 switch (subfield) {
276 case KRB5_TL_PASSWORD:
277 snprintf(buf, buf_len, "\"%.*s\"",
278 (int)tl->tl_data_length,
279 (const char *)tl->tl_data_contents);
280 break;
281 case KRB5_TL_PKINIT_ACL: {
282 HDB_Ext_PKINIT_acl acl;
283 size_t size;
284 int ret;
285 size_t i;
286
287 ret = decode_HDB_Ext_PKINIT_acl(tl->tl_data_contents,
288 tl->tl_data_length,
289 &acl,
290 &size);
291 if (ret) {
292 snprintf(buf, buf_len, "failed to decode ACL");
293 break;
294 }
295
296 buf[0] = '\0';
297 for (i = 0; i < acl.len; i++) {
298 strlcat(buf, "subject: ", buf_len);
299 strlcat(buf, acl.val[i].subject, buf_len);
300 if (acl.val[i].issuer) {
301 strlcat(buf, " issuer:", buf_len);
302 strlcat(buf, *acl.val[i].issuer, buf_len);
303 }
304 if (acl.val[i].anchor) {
305 strlcat(buf, " anchor:", buf_len);
306 strlcat(buf, *acl.val[i].anchor, buf_len);
307 }
308 if (i + 1 < acl.len)
309 strlcat(buf, ", ", buf_len);
310 }
311 free_HDB_Ext_PKINIT_acl(&acl);
312 break;
313 }
314 case KRB5_TL_ALIASES: {
315 HDB_Ext_Aliases alias;
316 size_t size;
317 int ret;
318 size_t i;
319
320 ret = decode_HDB_Ext_Aliases(tl->tl_data_contents,
321 tl->tl_data_length,
322 &alias,
323 &size);
324 if (ret) {
325 snprintf(buf, buf_len, "failed to decode alias");
326 break;
327 }
328 buf[0] = '\0';
329 for (i = 0; i < alias.aliases.len; i++) {
330 char *p;
331 ret = krb5_unparse_name(context, &alias.aliases.val[i], &p);
332 if (ret)
333 break;
334 if (i > 0)
335 strlcat(buf, " ", buf_len);
336 strlcat(buf, p, buf_len);
337 free(p);
338 }
339 free_HDB_Ext_Aliases(&alias);
340 break;
341 }
342 default:
343 snprintf(buf, buf_len, "unknown type %d", subfield);
344 break;
345 }
346 break;
347 }
348 default:
349 strlcpy(buf, "<unknown>", buf_len);
350 break;
351 }
352 }
353
354 static void
print_entry_short(struct get_entry_data * data,kadm5_principal_ent_t princ)355 print_entry_short(struct get_entry_data *data, kadm5_principal_ent_t princ)
356 {
357 char buf[1024];
358 struct field_info *f;
359
360 for(f = data->chead; f != NULL; f = f->next) {
361 format_field(princ, f->ff->fieldvalue, f->ff->subvalue, buf, sizeof(buf), 1);
362 rtbl_add_column_entry_by_id(data->table, f->ff->fieldvalue, buf);
363 }
364 }
365
366 static void
print_entry_long(struct get_entry_data * data,kadm5_principal_ent_t princ)367 print_entry_long(struct get_entry_data *data, kadm5_principal_ent_t princ)
368 {
369 char buf[1024];
370 struct field_info *f;
371 int width = 0;
372
373 for(f = data->chead; f != NULL; f = f->next) {
374 int w = strlen(f->header ? f->header : f->ff->def_longheader);
375 if(w > width)
376 width = w;
377 }
378 for(f = data->chead; f != NULL; f = f->next) {
379 format_field(princ, f->ff->fieldvalue, f->ff->subvalue, buf, sizeof(buf), 0);
380 printf("%*s: %s\n", width, f->header ? f->header : f->ff->def_longheader, buf);
381 }
382 printf("\n");
383 }
384
385 static int
do_get_entry(krb5_principal principal,void * data)386 do_get_entry(krb5_principal principal, void *data)
387 {
388 kadm5_principal_ent_rec princ;
389 krb5_error_code ret;
390 struct get_entry_data *e = data;
391
392 memset(&princ, 0, sizeof(princ));
393 ret = kadm5_get_principal(kadm_handle, principal,
394 &princ,
395 e->mask | e->extra_mask);
396 if(ret)
397 return ret;
398 else {
399 (e->format)(e, &princ);
400 kadm5_free_principal_ent(kadm_handle, &princ);
401 }
402 return 0;
403 }
404
405 static void
free_columns(struct get_entry_data * data)406 free_columns(struct get_entry_data *data)
407 {
408 struct field_info *f, *next;
409 for(f = data->chead; f != NULL; f = next) {
410 free(f->header);
411 next = f->next;
412 free(f);
413 }
414 data->chead = NULL;
415 data->ctail = &data->chead;
416 }
417
418 static int
setup_columns(struct get_entry_data * data,const char * column_info)419 setup_columns(struct get_entry_data *data, const char *column_info)
420 {
421 char buf[1024], *q;
422 char *field, *header;
423 struct field_name *f;
424
425 while(strsep_copy(&column_info, ",", buf, sizeof(buf)) != -1) {
426 q = buf;
427 field = strsep(&q, "=");
428 header = strsep(&q, "=");
429 for(f = field_names; f->fieldname != NULL; f++) {
430 if(strcasecmp(field, f->fieldname) == 0) {
431 add_column(data, f, header);
432 break;
433 }
434 }
435 if(f->fieldname == NULL) {
436 krb5_warnx(context, "unknown field name \"%s\"", field);
437 free_columns(data);
438 return -1;
439 }
440 }
441 return 0;
442 }
443
444 static int
do_list_entry(krb5_principal principal,void * data)445 do_list_entry(krb5_principal principal, void *data)
446 {
447 char buf[1024];
448 krb5_error_code ret;
449
450 ret = krb5_unparse_name_fixed_short(context, principal, buf, sizeof(buf));
451 if (ret != 0)
452 return ret;
453 printf("%s\n", buf);
454 return 0;
455 }
456
457 static int
listit(const char * funcname,int argc,char ** argv)458 listit(const char *funcname, int argc, char **argv)
459 {
460 int i;
461 krb5_error_code ret, saved_ret = 0;
462
463 for (i = 0; i < argc; i++) {
464 ret = foreach_principal(argv[i], do_list_entry, funcname, NULL);
465 if (saved_ret == 0 && ret != 0)
466 saved_ret = ret;
467 }
468 return saved_ret != 0;
469 }
470
471 #define DEFAULT_COLUMNS_SHORT "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife"
472 #define DEFAULT_COLUMNS_LONG "principal,princ_expire_time,pw_expiration,last_pwd_change,max_life,max_rlife,kvno,mkvno,last_success,last_failed,fail_auth_count,mod_time,mod_name,attributes,keytypes,pkinit-acl,aliases"
473
474 static int
getit(struct get_options * opt,const char * name,int argc,char ** argv)475 getit(struct get_options *opt, const char *name, int argc, char **argv)
476 {
477 int i;
478 krb5_error_code ret;
479 struct get_entry_data data;
480
481 if(opt->long_flag == -1 && (opt->short_flag == 1 || opt->terse_flag == 1))
482 opt->long_flag = 0;
483 if(opt->short_flag == -1 && (opt->long_flag == 1 || opt->terse_flag == 1))
484 opt->short_flag = 0;
485 if(opt->terse_flag == -1 && (opt->long_flag == 1 || opt->short_flag == 1))
486 opt->terse_flag = 0;
487 if(opt->long_flag == 0 && opt->short_flag == 0 && opt->terse_flag == 0)
488 opt->short_flag = 1;
489
490 if (opt->terse_flag)
491 return listit(name, argc, argv);
492
493 data.table = NULL;
494 data.chead = NULL;
495 data.ctail = &data.chead;
496 data.mask = 0;
497 data.extra_mask = 0;
498
499 if(opt->short_flag) {
500 data.table = rtbl_create();
501 rtbl_set_separator(data.table, " ");
502 data.format = print_entry_short;
503 } else
504 data.format = print_entry_long;
505 if(opt->column_info_string == NULL) {
506 if(opt->long_flag)
507 ret = setup_columns(&data, DEFAULT_COLUMNS_LONG);
508 else
509 ret = setup_columns(&data, DEFAULT_COLUMNS_SHORT);
510 } else
511 ret = setup_columns(&data, opt->column_info_string);
512
513 if(ret != 0) {
514 if(data.table != NULL)
515 rtbl_destroy(data.table);
516 return 0;
517 }
518
519 for(i = 0; i < argc; i++)
520 ret = foreach_principal(argv[i], do_get_entry, name, &data);
521
522 if(data.table != NULL) {
523 rtbl_format(data.table, stdout);
524 rtbl_destroy(data.table);
525 }
526 free_columns(&data);
527 return ret != 0;
528 }
529
530 int
get_entry(struct get_options * opt,int argc,char ** argv)531 get_entry(struct get_options *opt, int argc, char **argv)
532 {
533 return getit(opt, "get", argc, argv);
534 }
535
536 int
list_princs(struct list_options * opt,int argc,char ** argv)537 list_princs(struct list_options *opt, int argc, char **argv)
538 {
539 if(sizeof(struct get_options) != sizeof(struct list_options)) {
540 krb5_warnx(context, "programmer error: sizeof(struct get_options) != sizeof(struct list_options)");
541 return 0;
542 }
543 return getit((struct get_options*)opt, "list", argc, argv);
544 }
545