1*1c9681d1Schristos /* $NetBSD: get.c,v 1.2 2017/01/28 21:31:44 christos Exp $ */
2f59d82ffSelric
3f59d82ffSelric /*
4f59d82ffSelric * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
5f59d82ffSelric * (Royal Institute of Technology, Stockholm, Sweden).
6f59d82ffSelric * All rights reserved.
7f59d82ffSelric *
8f59d82ffSelric * Redistribution and use in source and binary forms, with or without
9f59d82ffSelric * modification, are permitted provided that the following conditions
10f59d82ffSelric * are met:
11f59d82ffSelric *
12f59d82ffSelric * 1. Redistributions of source code must retain the above copyright
13f59d82ffSelric * notice, this list of conditions and the following disclaimer.
14f59d82ffSelric *
15f59d82ffSelric * 2. Redistributions in binary form must reproduce the above copyright
16f59d82ffSelric * notice, this list of conditions and the following disclaimer in the
17f59d82ffSelric * documentation and/or other materials provided with the distribution.
18f59d82ffSelric *
19f59d82ffSelric * 3. Neither the name of the Institute nor the names of its contributors
20f59d82ffSelric * may be used to endorse or promote products derived from this software
21f59d82ffSelric * without specific prior written permission.
22f59d82ffSelric *
23f59d82ffSelric * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24f59d82ffSelric * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25f59d82ffSelric * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26f59d82ffSelric * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27f59d82ffSelric * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28f59d82ffSelric * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29f59d82ffSelric * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30f59d82ffSelric * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31f59d82ffSelric * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32f59d82ffSelric * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33f59d82ffSelric * SUCH DAMAGE.
34f59d82ffSelric */
35f59d82ffSelric
36f59d82ffSelric #include "ktutil_locl.h"
37f59d82ffSelric
38*1c9681d1Schristos __RCSID("$NetBSD: get.c,v 1.2 2017/01/28 21:31:44 christos Exp $");
39f59d82ffSelric
40f59d82ffSelric static void*
open_kadmin_connection(char * principal,const char * realm,char * admin_server,int server_port)41f59d82ffSelric open_kadmin_connection(char *principal,
42f59d82ffSelric const char *realm,
43f59d82ffSelric char *admin_server,
44f59d82ffSelric int server_port)
45f59d82ffSelric {
46f59d82ffSelric static kadm5_config_params conf;
47f59d82ffSelric krb5_error_code ret;
48f59d82ffSelric void *kadm_handle;
49f59d82ffSelric memset(&conf, 0, sizeof(conf));
50f59d82ffSelric
51f59d82ffSelric if(realm) {
52f59d82ffSelric conf.realm = strdup(realm);
53f59d82ffSelric if (conf.realm == NULL) {
54f59d82ffSelric krb5_set_error_message(context, 0, "malloc: out of memory");
55f59d82ffSelric return NULL;
56f59d82ffSelric }
57f59d82ffSelric conf.mask |= KADM5_CONFIG_REALM;
58f59d82ffSelric }
59f59d82ffSelric
60f59d82ffSelric if (admin_server) {
61f59d82ffSelric conf.admin_server = admin_server;
62f59d82ffSelric conf.mask |= KADM5_CONFIG_ADMIN_SERVER;
63f59d82ffSelric }
64f59d82ffSelric
65f59d82ffSelric if (server_port) {
66f59d82ffSelric conf.kadmind_port = htons(server_port);
67f59d82ffSelric conf.mask |= KADM5_CONFIG_KADMIND_PORT;
68f59d82ffSelric }
69f59d82ffSelric
70f59d82ffSelric /* should get realm from each principal, instead of doing
71f59d82ffSelric everything with the same (local) realm */
72f59d82ffSelric
73f59d82ffSelric ret = kadm5_init_with_password_ctx(context,
74f59d82ffSelric principal,
75f59d82ffSelric NULL,
76f59d82ffSelric KADM5_ADMIN_SERVICE,
77f59d82ffSelric &conf, 0, 0,
78f59d82ffSelric &kadm_handle);
79f59d82ffSelric free(conf.realm);
80f59d82ffSelric if(ret) {
81f59d82ffSelric krb5_warn(context, ret, "kadm5_init_with_password");
82f59d82ffSelric return NULL;
83f59d82ffSelric }
84f59d82ffSelric return kadm_handle;
85f59d82ffSelric }
86f59d82ffSelric
87f59d82ffSelric int
kt_get(struct get_options * opt,int argc,char ** argv)88f59d82ffSelric kt_get(struct get_options *opt, int argc, char **argv)
89f59d82ffSelric {
90f59d82ffSelric krb5_error_code ret = 0;
91f59d82ffSelric krb5_keytab keytab;
92f59d82ffSelric void *kadm_handle = NULL;
93f59d82ffSelric krb5_enctype *etypes = NULL;
94f59d82ffSelric size_t netypes = 0;
95603f2576Spettai size_t i;
96603f2576Spettai int a, j;
97f59d82ffSelric unsigned int failed = 0;
98f59d82ffSelric
99f59d82ffSelric if((keytab = ktutil_open_keytab()) == NULL)
100f59d82ffSelric return 1;
101f59d82ffSelric
102f59d82ffSelric if(opt->realm_string)
103f59d82ffSelric krb5_set_default_realm(context, opt->realm_string);
104f59d82ffSelric
105f59d82ffSelric if (opt->enctypes_strings.num_strings != 0) {
106f59d82ffSelric
107f59d82ffSelric etypes = malloc (opt->enctypes_strings.num_strings * sizeof(*etypes));
108f59d82ffSelric if (etypes == NULL) {
109f59d82ffSelric krb5_warnx(context, "malloc failed");
110f59d82ffSelric goto out;
111f59d82ffSelric }
112f59d82ffSelric netypes = opt->enctypes_strings.num_strings;
113f59d82ffSelric for(i = 0; i < netypes; i++) {
114f59d82ffSelric ret = krb5_string_to_enctype(context,
115f59d82ffSelric opt->enctypes_strings.strings[i],
116f59d82ffSelric &etypes[i]);
117f59d82ffSelric if(ret) {
118f59d82ffSelric krb5_warnx(context, "unrecognized enctype: %s",
119f59d82ffSelric opt->enctypes_strings.strings[i]);
120f59d82ffSelric goto out;
121f59d82ffSelric }
122f59d82ffSelric }
123f59d82ffSelric }
124f59d82ffSelric
125f59d82ffSelric
126603f2576Spettai for(a = 0; a < argc; a++){
127f59d82ffSelric krb5_principal princ_ent;
128f59d82ffSelric kadm5_principal_ent_rec princ;
129f59d82ffSelric int mask = 0;
130f59d82ffSelric krb5_keyblock *keys;
131f59d82ffSelric int n_keys;
132f59d82ffSelric int created = 0;
133f59d82ffSelric krb5_keytab_entry entry;
134f59d82ffSelric
135603f2576Spettai ret = krb5_parse_name(context, argv[a], &princ_ent);
136f59d82ffSelric if (ret) {
137603f2576Spettai krb5_warn(context, ret, "can't parse principal %s", argv[a]);
138f59d82ffSelric failed++;
139f59d82ffSelric continue;
140f59d82ffSelric }
141f59d82ffSelric memset(&princ, 0, sizeof(princ));
142f59d82ffSelric princ.principal = princ_ent;
143f59d82ffSelric mask |= KADM5_PRINCIPAL;
144f59d82ffSelric princ.attributes |= KRB5_KDB_DISALLOW_ALL_TIX;
145f59d82ffSelric mask |= KADM5_ATTRIBUTES;
146f59d82ffSelric princ.princ_expire_time = 0;
147f59d82ffSelric mask |= KADM5_PRINC_EXPIRE_TIME;
148f59d82ffSelric
149f59d82ffSelric if(kadm_handle == NULL) {
150f59d82ffSelric const char *r;
151f59d82ffSelric if(opt->realm_string != NULL)
152f59d82ffSelric r = opt->realm_string;
153f59d82ffSelric else
154f59d82ffSelric r = krb5_principal_get_realm(context, princ_ent);
155f59d82ffSelric kadm_handle = open_kadmin_connection(opt->principal_string,
156f59d82ffSelric r,
157f59d82ffSelric opt->admin_server_string,
158f59d82ffSelric opt->server_port_integer);
159f59d82ffSelric if(kadm_handle == NULL)
160f59d82ffSelric break;
161f59d82ffSelric }
162f59d82ffSelric
163f59d82ffSelric ret = kadm5_create_principal(kadm_handle, &princ, mask, "x");
164f59d82ffSelric if(ret == 0)
165f59d82ffSelric created = 1;
166f59d82ffSelric else if(ret != KADM5_DUP) {
167603f2576Spettai krb5_warn(context, ret, "kadm5_create_principal(%s)", argv[a]);
168f59d82ffSelric krb5_free_principal(context, princ_ent);
169f59d82ffSelric failed++;
170f59d82ffSelric continue;
171f59d82ffSelric }
172f59d82ffSelric ret = kadm5_randkey_principal(kadm_handle, princ_ent, &keys, &n_keys);
173f59d82ffSelric if (ret) {
174603f2576Spettai krb5_warn(context, ret, "kadm5_randkey_principal(%s)", argv[a]);
175f59d82ffSelric krb5_free_principal(context, princ_ent);
176f59d82ffSelric failed++;
177f59d82ffSelric continue;
178f59d82ffSelric }
179f59d82ffSelric
180f59d82ffSelric ret = kadm5_get_principal(kadm_handle, princ_ent, &princ,
181f59d82ffSelric KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES);
182f59d82ffSelric if (ret) {
183603f2576Spettai krb5_warn(context, ret, "kadm5_get_principal(%s)", argv[a]);
184f59d82ffSelric for (j = 0; j < n_keys; j++)
185f59d82ffSelric krb5_free_keyblock_contents(context, &keys[j]);
186f59d82ffSelric krb5_free_principal(context, princ_ent);
187f59d82ffSelric failed++;
188f59d82ffSelric continue;
189f59d82ffSelric }
190f59d82ffSelric if(!created && (princ.attributes & KRB5_KDB_DISALLOW_ALL_TIX))
191603f2576Spettai krb5_warnx(context, "%s: disallow-all-tix flag set - clearing", argv[a]);
192f59d82ffSelric princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX);
193f59d82ffSelric mask = KADM5_ATTRIBUTES;
194f59d82ffSelric if(created) {
195f59d82ffSelric princ.kvno = 1;
196f59d82ffSelric mask |= KADM5_KVNO;
197f59d82ffSelric }
198f59d82ffSelric ret = kadm5_modify_principal(kadm_handle, &princ, mask);
199f59d82ffSelric if (ret) {
200603f2576Spettai krb5_warn(context, ret, "kadm5_modify_principal(%s)", argv[a]);
201f59d82ffSelric for (j = 0; j < n_keys; j++)
202f59d82ffSelric krb5_free_keyblock_contents(context, &keys[j]);
203f59d82ffSelric krb5_free_principal(context, princ_ent);
204f59d82ffSelric failed++;
205f59d82ffSelric continue;
206f59d82ffSelric }
207f59d82ffSelric for(j = 0; j < n_keys; j++) {
208f59d82ffSelric int do_add = TRUE;
209f59d82ffSelric
210f59d82ffSelric if (netypes) {
211603f2576Spettai size_t k;
212f59d82ffSelric
213f59d82ffSelric do_add = FALSE;
214f59d82ffSelric for (k = 0; k < netypes; ++k)
215f59d82ffSelric if (keys[j].keytype == etypes[k]) {
216f59d82ffSelric do_add = TRUE;
217f59d82ffSelric break;
218f59d82ffSelric }
219f59d82ffSelric }
220f59d82ffSelric if (do_add) {
221f59d82ffSelric entry.principal = princ_ent;
222f59d82ffSelric entry.vno = princ.kvno;
223f59d82ffSelric entry.keyblock = keys[j];
224f59d82ffSelric entry.timestamp = time (NULL);
225f59d82ffSelric ret = krb5_kt_add_entry(context, keytab, &entry);
226f59d82ffSelric if (ret)
227f59d82ffSelric krb5_warn(context, ret, "krb5_kt_add_entry");
228f59d82ffSelric }
229f59d82ffSelric krb5_free_keyblock_contents(context, &keys[j]);
230f59d82ffSelric }
231f59d82ffSelric
232f59d82ffSelric kadm5_free_principal_ent(kadm_handle, &princ);
233f59d82ffSelric krb5_free_principal(context, princ_ent);
234f59d82ffSelric }
235f59d82ffSelric out:
236f59d82ffSelric free(etypes);
237f59d82ffSelric if (kadm_handle)
238f59d82ffSelric kadm5_destroy(kadm_handle);
239f59d82ffSelric krb5_kt_close(context, keytab);
240f59d82ffSelric return ret != 0 || failed > 0;
241f59d82ffSelric }
242