int
dump(struct dump_options *opt, int argc, char **argv)
{
krb5_error_code ret;
FILE *f;
struct hdb_print_entry_arg parg;
HDB *db = NULL;
if (!local_flag) {
krb5_warnx(context, "dump is only available in local (-l) mode");
return 0;
}
db = _kadm5_s_get_db(kadm_handle);
if (argc == 0)
f = stdout;
else
f = fopen(argv[0], "w");
if (f == NULL) {
krb5_warn(context, errno, "open: %s", argv[0]);
goto out;
}
ret = db->hdb_open(context, db, O_RDONLY, 0600);
if (ret) {
krb5_warn(context, ret, "hdb_open");
goto out;
}
if (!opt->format_string || strcmp(opt->format_string, "Heimdal") == 0) {
parg.fmt = HDB_DUMP_HEIMDAL;
} else if (opt->format_string && strcmp(opt->format_string, "MIT") == 0) {
parg.fmt = HDB_DUMP_MIT;
fprintf(f, "kdb5_util load_dump version 5\n"); /* 5||6, either way */
} else {
krb5_errx(context, 1, "Supported dump formats: Heimdal and MIT");
}
parg.out = f;
hdb_foreach(context, db, opt->decrypt_flag ? HDB_F_DECRYPT : 0,
hdb_print_entry, &parg);
db->hdb_close(context, db);
out:
if(f && f != stdout)
fclose(f);
return 0;
}
int
dump(struct dump_options *opt, int argc, char **argv)
{
krb5_error_code ret;
FILE *f;
HDB *db = NULL;
if(!local_flag) {
krb5_warnx(context, "dump is only available in local (-l) mode");
return 0;
}
db = _kadm5_s_get_db(kadm_handle);
if(argc == 0)
f = stdout;
else
f = fopen(argv[0], "w");
if(f == NULL) {
krb5_warn(context, errno, "open: %s", argv[0]);
goto out;
}
ret = db->hdb_open(context, db, O_RDONLY, 0600);
if(ret) {
krb5_warn(context, ret, "hdb_open");
goto out;
}
hdb_foreach(context, db, opt->decrypt_flag ? HDB_F_DECRYPT : 0,
hdb_print_entry, f);
db->hdb_close(context, db);
out:
if(f && f != stdout)
fclose(f);
return 0;
}
int
init(struct init_options *opt, int argc, char **argv)
{
kadm5_ret_t ret;
int i;
HDB *db;
krb5_deltat max_life = 0, max_rlife = 0;
if (!local_flag) {
krb5_warnx(context, "init is only available in local (-l) mode");
return 0;
}
if (opt->realm_max_ticket_life_string) {
if (str2deltat (opt->realm_max_ticket_life_string, &max_life) != 0) {
krb5_warnx (context, "unable to parse \"%s\"",
opt->realm_max_ticket_life_string);
return 0;
}
}
if (opt->realm_max_renewable_life_string) {
if (str2deltat (opt->realm_max_renewable_life_string, &max_rlife) != 0) {
krb5_warnx (context, "unable to parse \"%s\"",
opt->realm_max_renewable_life_string);
return 0;
}
}
db = _kadm5_s_get_db(kadm_handle);
ret = db->hdb_open(context, db, O_RDWR | O_CREAT, 0600);
if(ret){
krb5_warn(context, ret, "hdb_open");
return 0;
}
db->hdb_close(context, db);
for(i = 0; i < argc; i++){
krb5_principal princ;
const char *realm = argv[i];
if (opt->realm_max_ticket_life_string == NULL) {
max_life = 0;
if(edit_deltat ("Realm max ticket life", &max_life, NULL, 0)) {
return 0;
}
}
if (opt->realm_max_renewable_life_string == NULL) {
max_rlife = 0;
if(edit_deltat("Realm max renewable ticket life", &max_rlife,
NULL, 0)) {
return 0;
}
}
/* Create `krbtgt/REALM' */
ret = krb5_make_principal(context, &princ, realm,
KRB5_TGS_NAME, realm, NULL);
if(ret)
return 0;
create_random_entry(princ, max_life, max_rlife, 0);
krb5_free_principal(context, princ);
if (opt->bare_flag)
continue;
/* Create `kadmin/changepw' */
krb5_make_principal(context, &princ, realm,
"kadmin", "changepw", NULL);
/*
* The Windows XP (at least) password changing protocol
* request the `kadmin/changepw' ticket with `renewable_ok,
* renewable, forwardable' and so fails if we disallow
* forwardable here.
*/
create_random_entry(princ, 5*60, 5*60,
KRB5_KDB_DISALLOW_TGT_BASED|
KRB5_KDB_PWCHANGE_SERVICE|
KRB5_KDB_DISALLOW_POSTDATED|
KRB5_KDB_DISALLOW_RENEWABLE|
KRB5_KDB_DISALLOW_PROXIABLE|
KRB5_KDB_REQUIRES_PRE_AUTH);
krb5_free_principal(context, princ);
/* Create `kadmin/admin' */
krb5_make_principal(context, &princ, realm,
"kadmin", "admin", NULL);
create_random_entry(princ, 60*60, 60*60, KRB5_KDB_REQUIRES_PRE_AUTH);
krb5_free_principal(context, princ);
/* Create `changepw/kerberos' (for v4 compat) */
krb5_make_principal(context, &princ, realm,
"changepw", "kerberos", NULL);
create_random_entry(princ, 60*60, 60*60,
KRB5_KDB_DISALLOW_TGT_BASED|
KRB5_KDB_PWCHANGE_SERVICE);
krb5_free_principal(context, princ);
/* Create `kadmin/hprop' for database propagation */
krb5_make_principal(context, &princ, realm,
"kadmin", "hprop", NULL);
create_random_entry(princ, 60*60, 60*60,
KRB5_KDB_REQUIRES_PRE_AUTH|
KRB5_KDB_DISALLOW_TGT_BASED);
krb5_free_principal(context, princ);
/* Create `WELLKNOWN/ANONYMOUS' for anonymous as-req */
krb5_make_principal(context, &princ, realm,
KRB5_WELLKNOWN_NAME, KRB5_ANON_NAME, NULL);
create_random_entry(princ, 60*60, 60*60,
KRB5_KDB_REQUIRES_PRE_AUTH);
krb5_free_principal(context, princ);
/* Create `default' */
{
kadm5_principal_ent_rec ent;
int mask = 0;
memset (&ent, 0, sizeof(ent));
mask |= KADM5_PRINCIPAL;
krb5_make_principal(context, &ent.principal, realm,
"default", NULL);
mask |= KADM5_MAX_LIFE;
ent.max_life = 24 * 60 * 60;
mask |= KADM5_MAX_RLIFE;
ent.max_renewable_life = 7 * ent.max_life;
ent.attributes = KRB5_KDB_DISALLOW_ALL_TIX;
mask |= KADM5_ATTRIBUTES;
ret = kadm5_create_principal(kadm_handle, &ent, mask, "");
if (ret)
krb5_err (context, 1, ret, "kadm5_create_principal");
krb5_free_principal(context, ent.principal);
}
}
return 0;
}
static int
doit(const char *filename, int mergep)
{
krb5_error_code ret;
FILE *f;
char s[8192]; /* XXX should fix this properly */
char *p;
int line;
int flags = O_RDWR;
struct entry e;
hdb_entry_ex ent;
HDB *db = _kadm5_s_get_db(kadm_handle);
f = fopen(filename, "r");
if(f == NULL){
krb5_warn(context, errno, "fopen(%s)", filename);
return 1;
}
ret = kadm5_log_truncate (kadm_handle);
if (ret) {
fclose (f);
krb5_warn(context, ret, "kadm5_log_truncate");
return 1;
}
if(!mergep)
flags |= O_CREAT | O_TRUNC;
ret = db->hdb_open(context, db, flags, 0600);
if(ret){
krb5_warn(context, ret, "hdb_open");
fclose(f);
return 1;
}
line = 0;
ret = 0;
while(fgets(s, sizeof(s), f) != NULL) {
ret = 0;
line++;
p = s;
while (isspace((unsigned char)*p))
p++;
e.principal = p;
for(p = s; *p; p++){
if(*p == '\\')
p++;
else if(isspace((unsigned char)*p)) {
*p = 0;
break;
}
}
p = skip_next(p);
e.key = p;
p = skip_next(p);
e.created = p;
p = skip_next(p);
e.modified = p;
p = skip_next(p);
e.valid_start = p;
p = skip_next(p);
e.valid_end = p;
p = skip_next(p);
e.pw_end = p;
p = skip_next(p);
e.max_life = p;
p = skip_next(p);
e.max_renew = p;
p = skip_next(p);
e.flags = p;
p = skip_next(p);
e.generation = p;
p = skip_next(p);
e.extensions = p;
p = skip_next(p);
memset(&ent, 0, sizeof(ent));
ret = krb5_parse_name(context, e.principal, &ent.entry.principal);
if(ret) {
fprintf(stderr, "%s:%d:%s (%s)\n",
filename,
line,
krb5_get_err_text(context, ret),
e.principal);
continue;
}
if (parse_keys(&ent.entry, e.key)) {
fprintf (stderr, "%s:%d:error parsing keys (%s)\n",
filename, line, e.key);
hdb_free_entry (context, &ent);
continue;
}
if (parse_event(&ent.entry.created_by, e.created) == -1) {
fprintf (stderr, "%s:%d:error parsing created event (%s)\n",
filename, line, e.created);
hdb_free_entry (context, &ent);
continue;
}
if (parse_event_alloc (&ent.entry.modified_by, e.modified) == -1) {
fprintf (stderr, "%s:%d:error parsing event (%s)\n",
filename, line, e.modified);
hdb_free_entry (context, &ent);
continue;
}
if (parse_time_string_alloc (&ent.entry.valid_start, e.valid_start) == -1) {
fprintf (stderr, "%s:%d:error parsing time (%s)\n",
filename, line, e.valid_start);
hdb_free_entry (context, &ent);
continue;
}
if (parse_time_string_alloc (&ent.entry.valid_end, e.valid_end) == -1) {
fprintf (stderr, "%s:%d:error parsing time (%s)\n",
filename, line, e.valid_end);
hdb_free_entry (context, &ent);
continue;
}
if (parse_time_string_alloc (&ent.entry.pw_end, e.pw_end) == -1) {
fprintf (stderr, "%s:%d:error parsing time (%s)\n",
filename, line, e.pw_end);
hdb_free_entry (context, &ent);
continue;
}
if (parse_integer_alloc (&ent.entry.max_life, e.max_life) == -1) {
fprintf (stderr, "%s:%d:error parsing lifetime (%s)\n",
filename, line, e.max_life);
hdb_free_entry (context, &ent);
continue;
}
if (parse_integer_alloc (&ent.entry.max_renew, e.max_renew) == -1) {
fprintf (stderr, "%s:%d:error parsing lifetime (%s)\n",
filename, line, e.max_renew);
hdb_free_entry (context, &ent);
continue;
}
if (parse_hdbflags2int (&ent.entry.flags, e.flags) != 1) {
fprintf (stderr, "%s:%d:error parsing flags (%s)\n",
filename, line, e.flags);
hdb_free_entry (context, &ent);
continue;
}
if(parse_generation(e.generation, &ent.entry.generation) == -1) {
fprintf (stderr, "%s:%d:error parsing generation (%s)\n",
filename, line, e.generation);
hdb_free_entry (context, &ent);
continue;
}
if(parse_extensions(e.extensions, &ent.entry.extensions) == -1) {
fprintf (stderr, "%s:%d:error parsing extension (%s)\n",
filename, line, e.extensions);
hdb_free_entry (context, &ent);
continue;
}
ret = db->hdb_store(context, db, HDB_F_REPLACE, &ent);
hdb_free_entry (context, &ent);
if (ret) {
krb5_warn(context, ret, "db_store");
break;
}
}
db->hdb_close(context, db);
fclose(f);
return ret != 0;
}
int
dump(struct dump_options *opt, int argc, char **argv)
{
krb5_error_code (*func)(krb5_context, HDB *, hdb_entry_ex *, void *);
krb5_error_code ret;
void *arg;
const char *format = "heimdal";
FILE *f = NULL;
if (opt->format_string)
format = opt->format_string;
if (strcasecmp(format, "heimdal") == 0) {
func = hdb_print_entry;
if (argc == 0) {
arg = stdout;
} else {
arg = f = fopen(argv[0], "w");
if (f == NULL) {
krb5_warn(context, errno, "failed to open %s", argv[0]);
return 0;
}
}
#ifdef __APPLE__
} else if (strcasecmp(format, "od") == 0) {
func = od_dump_entry;
if (argc == 0)
arg = rk_UNCONST(".");
else
arg = argv[0];
#endif
} else {
krb5_warnx(context, "unknown dump format: %s", format);
return 0;
}
if (opt->mit_dump_file_string) {
ret = hdb_mit_dump(context, opt->mit_dump_file_string,
func, arg);
if (ret)
krb5_warn(context, ret, "hdb_mit_dump");
} else {
HDB *db = NULL;
if (!local_flag) {
krb5_warnx(context, "od-dump is only available in local (-l) mode");
return 0;
}
db = _kadm5_s_get_db(kadm_handle);
ret = db->hdb_open(context, db, O_RDONLY, 0600);
if (ret) {
krb5_warn(context, ret, "hdb_open");
goto out;
}
ret = hdb_foreach(context, db, opt->decrypt_flag ? HDB_F_DECRYPT : 0,
func, arg);
if (ret)
krb5_warn(context, ret, "hdb_foreach");
db->hdb_close(context, db);
}
if (f)
fclose(f);
out:
return ret != 0;
}
static int
doit(const char *filename, int mergep)
{
krb5_error_code ret = 0;
FILE *f;
char s[8192]; /* XXX should fix this properly */
char *p;
int line;
int flags = O_RDWR;
struct entry e;
hdb_entry_ex ent;
HDB *db = _kadm5_s_get_db(kadm_handle);
f = fopen(filename, "r");
if(f == NULL){
krb5_warn(context, errno, "fopen(%s)", filename);
return 1;
}
/*
* We don't have a version number in the dump, so we don't know which iprop
* log entries to keep, if any. We throw the log away.
*
* We could merge the ipropd-master/slave dump/load here as an option, in
* which case we would first load the dump.
*
* If we're merging, first recover unconfirmed records in the existing log.
*/
if (mergep)
ret = kadm5_log_init(kadm_handle);
if (ret == 0)
ret = kadm5_log_reinit(kadm_handle, 0);
if (ret) {
fclose (f);
krb5_warn(context, ret, "kadm5_log_reinit");
return 1;
}
if(!mergep)
flags |= O_CREAT | O_TRUNC;
ret = db->hdb_open(context, db, flags, 0600);
if(ret){
krb5_warn(context, ret, "hdb_open");
fclose(f);
return 1;
}
line = 0;
ret = 0;
while(fgets(s, sizeof(s), f) != NULL) {
line++;
p = s;
while (isspace((unsigned char)*p))
p++;
e.principal = p;
for(p = s; *p; p++){
if(*p == '\\')
p++;
else if(isspace((unsigned char)*p)) {
*p = 0;
break;
}
}
p = skip_next(p);
e.key = p;
p = skip_next(p);
e.created = p;
p = skip_next(p);
e.modified = p;
p = skip_next(p);
e.valid_start = p;
p = skip_next(p);
e.valid_end = p;
p = skip_next(p);
e.pw_end = p;
p = skip_next(p);
e.max_life = p;
p = skip_next(p);
e.max_renew = p;
p = skip_next(p);
e.flags = p;
p = skip_next(p);
e.generation = p;
p = skip_next(p);
e.extensions = p;
skip_next(p);
memset(&ent, 0, sizeof(ent));
ret = krb5_parse_name(context, e.principal, &ent.entry.principal);
if(ret) {
const char *msg = krb5_get_error_message(context, ret);
fprintf(stderr, "%s:%d:%s (%s)\n",
filename, line, msg, e.principal);
krb5_free_error_message(context, msg);
continue;
}
if (parse_keys(&ent.entry, e.key)) {
fprintf (stderr, "%s:%d:error parsing keys (%s)\n",
filename, line, e.key);
hdb_free_entry (context, &ent);
continue;
}
if (parse_event(&ent.entry.created_by, e.created) == -1) {
fprintf (stderr, "%s:%d:error parsing created event (%s)\n",
filename, line, e.created);
hdb_free_entry (context, &ent);
continue;
}
if (parse_event_alloc (&ent.entry.modified_by, e.modified) == -1) {
fprintf (stderr, "%s:%d:error parsing event (%s)\n",
filename, line, e.modified);
hdb_free_entry (context, &ent);
continue;
}
if (parse_time_string_alloc (&ent.entry.valid_start, e.valid_start) == -1) {
fprintf (stderr, "%s:%d:error parsing time (%s)\n",
filename, line, e.valid_start);
hdb_free_entry (context, &ent);
continue;
}
if (parse_time_string_alloc (&ent.entry.valid_end, e.valid_end) == -1) {
fprintf (stderr, "%s:%d:error parsing time (%s)\n",
filename, line, e.valid_end);
hdb_free_entry (context, &ent);
continue;
}
if (parse_time_string_alloc (&ent.entry.pw_end, e.pw_end) == -1) {
fprintf (stderr, "%s:%d:error parsing time (%s)\n",
filename, line, e.pw_end);
hdb_free_entry (context, &ent);
continue;
}
if (parse_integer_alloc (&ent.entry.max_life, e.max_life) == -1) {
fprintf (stderr, "%s:%d:error parsing lifetime (%s)\n",
filename, line, e.max_life);
hdb_free_entry (context, &ent);
continue;
}
if (parse_integer_alloc (&ent.entry.max_renew, e.max_renew) == -1) {
fprintf (stderr, "%s:%d:error parsing lifetime (%s)\n",
filename, line, e.max_renew);
hdb_free_entry (context, &ent);
continue;
}
if (parse_hdbflags2int (&ent.entry.flags, e.flags) != 1) {
fprintf (stderr, "%s:%d:error parsing flags (%s)\n",
filename, line, e.flags);
hdb_free_entry (context, &ent);
continue;
}
if(parse_generation(e.generation, &ent.entry.generation) == -1) {
fprintf (stderr, "%s:%d:error parsing generation (%s)\n",
filename, line, e.generation);
hdb_free_entry (context, &ent);
continue;
}
if(parse_extensions(e.extensions, &ent.entry.extensions) == -1) {
fprintf (stderr, "%s:%d:error parsing extension (%s)\n",
filename, line, e.extensions);
hdb_free_entry (context, &ent);
continue;
}
ret = db->hdb_store(context, db, HDB_F_REPLACE, &ent);
hdb_free_entry (context, &ent);
if (ret) {
krb5_warn(context, ret, "db_store");
break;
}
}
(void) kadm5_log_end(kadm_handle);
db->hdb_close(context, db);
fclose(f);
return ret != 0;
}