void kdb5_update_princ_encryption(int argc, char *argv[]) { struct update_enc_mkvno data = { 0 }; char *name_pattern = NULL; int force = 0; int optchar; krb5_error_code retval; krb5_actkvno_node *actkvno_list = 0; krb5_db_entry *master_entry; char *mkey_fullname = 0; #ifdef BSD_REGEXPS char *msg; #endif char *regexp = NULL; krb5_keyblock *act_mkey; krb5_keylist_node *master_keylist = krb5_db_mkey_list_alias(util_context); while ((optchar = getopt(argc, argv, "fnv")) != -1) { switch (optchar) { case 'f': force = 1; break; case 'n': data.dry_run = 1; break; case 'v': data.verbose = 1; break; case '?': case ':': default: usage(); } } if (argv[optind] != NULL) { name_pattern = argv[optind]; if (argv[optind+1] != NULL) usage(); } retval = krb5_unparse_name(util_context, master_princ, &mkey_fullname); if (retval) { com_err(progname, retval, _("while formatting master principal name")); exit_status++; goto cleanup; } if (master_keylist == NULL) { com_err(progname, retval, _("master keylist not initialized")); exit_status++; goto cleanup; } /* The glob_to_regexp code only cares if the "realm" parameter is NULL or not; the string data is irrelevant. */ if (name_pattern == NULL) name_pattern = "*"; if (glob_to_regexp(name_pattern, "hi", ®exp) != 0) { com_err(progname, ENOMEM, _("converting glob pattern '%s' to regular expression"), name_pattern); exit_status++; goto cleanup; } if ( #ifdef SOLARIS_REGEXPS ((data.expbuf = compile(regexp, NULL, NULL)) == NULL) #endif #ifdef POSIX_REGEXPS ((regcomp(&data.preg, regexp, REG_NOSUB)) != 0) #endif #ifdef BSD_REGEXPS ((msg = (char *) re_comp(regexp)) != NULL) #endif ) { /* XXX syslog msg or regerr(regerrno) */ com_err(progname, 0, _("error compiling converted regexp '%s'"), regexp); exit_status++; goto cleanup; } retval = krb5_db_get_principal(util_context, master_princ, 0, &master_entry); if (retval != 0) { com_err(progname, retval, _("while getting master key principal %s"), mkey_fullname); exit_status++; goto cleanup; } retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list); if (retval != 0) { com_err(progname, retval, _("while looking up active kvno list")); exit_status++; goto cleanup; } retval = krb5_dbe_find_act_mkey(util_context, actkvno_list, &new_mkvno, &act_mkey); if (retval) { com_err(progname, retval, _("while looking up active master key")); exit_status++; goto cleanup; } new_master_keyblock = *act_mkey; if (!force && !data.dry_run && !are_you_sure(_("Re-encrypt all keys not using master key vno %u?"), new_mkvno)) { printf(_("OK, doing nothing.\n")); exit_status++; goto cleanup; } if (data.verbose) { if (data.dry_run) { printf(_("Principals whose keys WOULD BE re-encrypted to master " "key vno %u:\n"), new_mkvno); } else { printf(_("Principals whose keys are being re-encrypted to master " "key vno %u if necessary:\n"), new_mkvno); } } if (!data.dry_run) { /* Grab a write lock so we don't have to upgrade to a write lock and * reopen the DB while iterating. */ retval = krb5_db_lock(util_context, KRB5_DB_LOCKMODE_EXCLUSIVE); if (retval != 0 && retval != KRB5_PLUGIN_OP_NOTSUPP) { com_err(progname, retval, _("trying to lock database")); exit_status++; } } retval = krb5_db_iterate(util_context, name_pattern, update_princ_encryption_1, &data); /* If exit_status is set, then update_princ_encryption_1 already printed a message. */ if (retval != 0 && exit_status == 0) { com_err(progname, retval, _("trying to process principal database")); exit_status++; } if (!data.dry_run) (void)krb5_db_unlock(util_context); (void) krb5_db_fini(util_context); if (data.dry_run) { printf(_("%u principals processed: %u would be updated, %u already " "current\n"), data.re_match_count, data.updated, data.already_current); } else { printf(_("%u principals processed: %u updated, %u already current\n"), data.re_match_count, data.updated, data.already_current); } cleanup: free(regexp); memset(&new_master_keyblock, 0, sizeof(new_master_keyblock)); krb5_free_unparsed_name(util_context, mkey_fullname); krb5_dbe_free_actkvno_list(util_context, actkvno_list); }
void kdb5_list_mkeys(int argc, char *argv[]) { krb5_error_code retval; char *mkey_fullname = NULL, *output_str = NULL, enctype[BUFSIZ]; krb5_kvno act_kvno; krb5_timestamp act_time; krb5_actkvno_node *actkvno_list = NULL, *cur_actkvno; krb5_db_entry *master_entry; krb5_keylist_node *cur_kb_node; krb5_keyblock *act_mkey; krb5_keylist_node *master_keylist = krb5_db_mkey_list_alias(util_context); if (master_keylist == NULL) { com_err(progname, 0, _("master keylist not initialized")); exit_status++; return; } /* assemble & parse the master key name */ if ((retval = krb5_db_setup_mkey_name(util_context, global_params.mkey_name, global_params.realm, &mkey_fullname, &master_princ))) { com_err(progname, retval, _("while setting up master key name")); exit_status++; return; } retval = krb5_db_get_principal(util_context, master_princ, 0, &master_entry); if (retval != 0) { com_err(progname, retval, _("while getting master key principal %s"), mkey_fullname); exit_status++; goto cleanup_return; } retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list); if (retval != 0) { com_err(progname, retval, _("while looking up active kvno list")); exit_status++; goto cleanup_return; } if (actkvno_list == NULL) { act_kvno = master_entry->key_data[0].key_data_kvno; } else { retval = krb5_dbe_find_act_mkey(util_context, actkvno_list, &act_kvno, &act_mkey); if (retval == KRB5_KDB_NOACTMASTERKEY) { /* Maybe we went through a time warp, and the only keys with activation dates have them set in the future? */ com_err(progname, retval, ""); /* Keep going. */ act_kvno = -1; } else if (retval != 0) { com_err(progname, retval, _("while looking up active master key")); exit_status++; goto cleanup_return; } } printf("Master keys for Principal: %s\n", mkey_fullname); for (cur_kb_node = master_keylist; cur_kb_node != NULL; cur_kb_node = cur_kb_node->next) { if ((retval = krb5_enctype_to_name(cur_kb_node->keyblock.enctype, FALSE, enctype, sizeof(enctype)))) { com_err(progname, retval, _("while getting enctype description")); exit_status++; goto cleanup_return; } if (actkvno_list != NULL) { act_time = -1; /* assume actkvno entry not found */ for (cur_actkvno = actkvno_list; cur_actkvno != NULL; cur_actkvno = cur_actkvno->next) { if (cur_actkvno->act_kvno == cur_kb_node->kvno) { act_time = cur_actkvno->act_time; break; } } } else { /* * mkey princ doesn't have an active knvo list so assume the current * key is active now */ if ((retval = krb5_timeofday(util_context, &act_time))) { com_err(progname, retval, _("while getting current time")); exit_status++; goto cleanup_return; } } if (cur_kb_node->kvno == act_kvno) { /* * indicates kvno is currently active */ retval = asprintf(&output_str, _("KVNO: %d, Enctype: %s, Active on: %s *\n"), cur_kb_node->kvno, enctype, strdate(act_time)); } else { if (act_time != -1) { retval = asprintf(&output_str, _("KVNO: %d, Enctype: %s, Active on: %s\n"), cur_kb_node->kvno, enctype, strdate(act_time)); } else { retval = asprintf(&output_str, _("KVNO: %d, Enctype: %s, No activate time " "set\n"), cur_kb_node->kvno, enctype); } } if (retval == -1) { com_err(progname, ENOMEM, _("asprintf could not allocate enough " "memory to hold output")); exit_status++; goto cleanup_return; } printf("%s", output_str); free(output_str); output_str = NULL; } cleanup_return: /* clean up */ (void) krb5_db_fini(util_context); krb5_free_unparsed_name(util_context, mkey_fullname); free(output_str); krb5_free_principal(util_context, master_princ); krb5_dbe_free_actkvno_list(util_context, actkvno_list); return; }
void kdb5_purge_mkeys(int argc, char *argv[]) { int optchar; krb5_error_code retval; char *mkey_fullname = NULL; krb5_timestamp now; krb5_db_entry *master_entry; krb5_boolean force = FALSE, dry_run = FALSE, verbose = FALSE; struct purge_args args; char buf[5]; unsigned int i, j, k, num_kvnos_inuse, num_kvnos_purged; unsigned int old_key_data_count; krb5_actkvno_node *actkvno_list = NULL, *actkvno_entry, *prev_actkvno_entry; krb5_mkey_aux_node *mkey_aux_list = NULL, *mkey_aux_entry, *prev_mkey_aux_entry; krb5_key_data *old_key_data; /* * Verify that the master key list has been initialized before doing * anything else. */ if (krb5_db_mkey_list_alias(util_context) == NULL) { com_err(progname, KRB5_KDB_DBNOTINITED, _("master keylist not initialized")); exit_status++; return; } memset(&master_princ, 0, sizeof(master_princ)); memset(&args, 0, sizeof(args)); optind = 1; while ((optchar = getopt(argc, argv, "fnv")) != -1) { switch(optchar) { case 'f': force = TRUE; break; case 'n': dry_run = TRUE; /* mkey princ will not be modified */ force = TRUE; /* implied */ break; case 'v': verbose = TRUE; break; case '?': default: usage(); return; } } /* assemble & parse the master key name */ if ((retval = krb5_db_setup_mkey_name(util_context, global_params.mkey_name, global_params.realm, &mkey_fullname, &master_princ))) { com_err(progname, retval, _("while setting up master key name")); exit_status++; return; } retval = krb5_db_get_principal(util_context, master_princ, 0, &master_entry); if (retval != 0) { com_err(progname, retval, _("while getting master key principal %s"), mkey_fullname); exit_status++; goto cleanup_return; } if (!force) { printf(_("Will purge all unused master keys stored in the '%s' " "principal, are you sure?\n"), mkey_fullname); printf(_("(type 'yes' to confirm)? ")); if (fgets(buf, sizeof(buf), stdin) == NULL) { exit_status++; goto cleanup_return; } if (strcmp(buf, "yes\n")) { exit_status++; goto cleanup_return; } printf(_("OK, purging unused master keys from '%s'...\n"), mkey_fullname); } /* save the old keydata */ old_key_data_count = master_entry->n_key_data; if (old_key_data_count == 1) { if (verbose) printf(_("There is only one master key which can not be " "purged.\n")); goto cleanup_return; } old_key_data = master_entry->key_data; args.kvnos = (struct kvnos_in_use *) malloc(sizeof(struct kvnos_in_use) * old_key_data_count); if (args.kvnos == NULL) { retval = ENOMEM; com_err(progname, ENOMEM, _("while allocating args.kvnos")); exit_status++; goto cleanup_return; } memset(args.kvnos, 0, sizeof(struct kvnos_in_use) * old_key_data_count); args.num_kvnos = old_key_data_count; args.kcontext = util_context; /* populate the kvnos array with all the current mkvnos */ for (i = 0; i < old_key_data_count; i++) args.kvnos[i].kvno = master_entry->key_data[i].key_data_kvno; if ((retval = krb5_db_iterate(util_context, NULL, find_mkvnos_in_use, (krb5_pointer) &args))) { com_err(progname, retval, _("while finding master keys in use")); exit_status++; goto cleanup_return; } /* * args.kvnos has been marked with the mkvno's that are currently protecting * princ entries */ if (dry_run) { printf(_("Would purge the following master key(s) from %s:\n"), mkey_fullname); } else { printf(_("Purging the following master key(s) from %s:\n"), mkey_fullname); } /* find # of keys still in use or print out verbose info */ for (i = num_kvnos_inuse = num_kvnos_purged = 0; i < args.num_kvnos; i++) { if (args.kvnos[i].use_count > 0) { num_kvnos_inuse++; } else { /* this key would be deleted */ if (args.kvnos[i].kvno == master_kvno) { com_err(progname, KRB5_KDB_STORED_MKEY_NOTCURRENT, _("master key stash file needs updating, command " "aborting")); exit_status++; goto cleanup_return; } num_kvnos_purged++; printf(_("KVNO: %d\n"), args.kvnos[i].kvno); } } /* didn't find any keys to purge */ if (num_kvnos_inuse == args.num_kvnos) { printf(_("All keys in use, nothing purged.\n")); goto cleanup_return; } if (dry_run) { /* bail before doing anything else */ printf(_("%d key(s) would be purged.\n"), num_kvnos_purged); goto cleanup_return; } retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list); if (retval != 0) { com_err(progname, retval, _("while looking up active kvno list")); exit_status++; goto cleanup_return; } retval = krb5_dbe_lookup_mkey_aux(util_context, master_entry, &mkey_aux_list); if (retval != 0) { com_err(progname, retval, _("while looking up mkey aux data list")); exit_status++; goto cleanup_return; } master_entry->key_data = (krb5_key_data *) malloc(sizeof(krb5_key_data) * num_kvnos_inuse); if (master_entry->key_data == NULL) { retval = ENOMEM; com_err(progname, ENOMEM, _("while allocating key_data")); exit_status++; goto cleanup_return; } memset(master_entry->key_data, 0, sizeof(krb5_key_data) * num_kvnos_inuse); master_entry->n_key_data = num_kvnos_inuse; /* there's only 1 mkey per kvno */ /* * Assuming that the latest mkey will not be purged because it will always * be "in use" so this code will not bother with encrypting keys again. */ for (i = k = 0; i < old_key_data_count; i++) { for (j = 0; j < args.num_kvnos; j++) { if (args.kvnos[j].kvno == (krb5_kvno) old_key_data[i].key_data_kvno) { if (args.kvnos[j].use_count != 0) { master_entry->key_data[k++] = old_key_data[i]; break; } else { /* remove unused mkey */ /* adjust the actkno data */ for (prev_actkvno_entry = actkvno_entry = actkvno_list; actkvno_entry != NULL; actkvno_entry = actkvno_entry->next) { if (actkvno_entry->act_kvno == args.kvnos[j].kvno) { if (actkvno_entry == actkvno_list) { /* remove from head */ actkvno_list = actkvno_entry->next; prev_actkvno_entry = actkvno_list; } else if (actkvno_entry->next == NULL) { /* remove from tail */ prev_actkvno_entry->next = NULL; } else { /* remove in between */ prev_actkvno_entry->next = actkvno_entry->next; } actkvno_entry->next = NULL; krb5_dbe_free_actkvno_list(util_context, actkvno_entry); break; /* deleted entry, no need to loop further */ } else { prev_actkvno_entry = actkvno_entry; } } /* adjust the mkey aux data */ for (prev_mkey_aux_entry = mkey_aux_entry = mkey_aux_list; mkey_aux_entry != NULL; mkey_aux_entry = mkey_aux_entry->next) { if (mkey_aux_entry->mkey_kvno == args.kvnos[j].kvno) { if (mkey_aux_entry == mkey_aux_list) { mkey_aux_list = mkey_aux_entry->next; prev_mkey_aux_entry = mkey_aux_list; } else if (mkey_aux_entry->next == NULL) { prev_mkey_aux_entry->next = NULL; } else { prev_mkey_aux_entry->next = mkey_aux_entry->next; } mkey_aux_entry->next = NULL; krb5_dbe_free_mkey_aux_list(util_context, mkey_aux_entry); break; /* deleted entry, no need to loop further */ } else { prev_mkey_aux_entry = mkey_aux_entry; } } } } } } assert(k == num_kvnos_inuse); if ((retval = krb5_dbe_update_actkvno(util_context, master_entry, actkvno_list))) { com_err(progname, retval, _("while updating actkvno data for master principal entry")); exit_status++; goto cleanup_return; } if ((retval = krb5_dbe_update_mkey_aux(util_context, master_entry, mkey_aux_list))) { com_err(progname, retval, _("while updating mkey_aux data for master principal entry")); exit_status++; return; } if ((retval = krb5_timeofday(util_context, &now))) { com_err(progname, retval, _("while getting current time")); exit_status++; goto cleanup_return; } if ((retval = krb5_dbe_update_mod_princ_data(util_context, master_entry, now, master_princ))) { com_err(progname, retval, _("while updating the master key principal " "modification time")); exit_status++; goto cleanup_return; } master_entry->mask |= KADM5_KEY_DATA; if ((retval = krb5_db_put_principal(util_context, master_entry))) { (void) krb5_db_fini(util_context); com_err(progname, retval, _("while adding master key entry to the database")); exit_status++; goto cleanup_return; } printf(_("%d key(s) purged.\n"), num_kvnos_purged); cleanup_return: /* clean up */ (void) krb5_db_fini(util_context); krb5_free_principal(util_context, master_princ); free(args.kvnos); krb5_free_unparsed_name(util_context, mkey_fullname); krb5_dbe_free_actkvno_list(util_context, actkvno_list); krb5_dbe_free_mkey_aux_list(util_context, mkey_aux_list); return; }
void kdb5_use_mkey(int argc, char *argv[]) { krb5_error_code retval; char *mkey_fullname = NULL; krb5_kvno use_kvno; krb5_timestamp now, start_time; krb5_actkvno_node *actkvno_list = NULL, *new_actkvno = NULL, *prev_actkvno, *cur_actkvno; krb5_db_entry *master_entry; krb5_keylist_node *keylist_node; krb5_boolean inserted = FALSE; krb5_keylist_node *master_keylist = krb5_db_mkey_list_alias(util_context); memset(&master_princ, 0, sizeof(master_princ)); if (argc < 2 || argc > 3) { /* usage calls exit */ usage(); } use_kvno = atoi(argv[1]); if (use_kvno == 0) { com_err(progname, EINVAL, _("0 is an invalid KVNO value")); exit_status++; return; } else { /* verify use_kvno is valid */ for (keylist_node = master_keylist; keylist_node != NULL; keylist_node = keylist_node->next) { if (use_kvno == keylist_node->kvno) break; } if (!keylist_node) { com_err(progname, EINVAL, _("%d is an invalid KVNO value"), use_kvno); exit_status++; return; } } if ((retval = krb5_timeofday(util_context, &now))) { com_err(progname, retval, _("while getting current time")); exit_status++; return; } if (argc == 3) { time_t t = get_date(argv[2]); if (t == -1) { com_err(progname, 0, _("could not parse date-time string '%s'"), argv[2]); exit_status++; return; } else start_time = (krb5_timestamp) t; } else { start_time = now; } /* * Need to: * * 1. get mkey princ * 2. get krb5_actkvno_node list * 3. add use_kvno to actkvno list (sorted in right spot) * 4. update mkey princ's tl data * 5. put mkey princ. */ /* assemble & parse the master key name */ if ((retval = krb5_db_setup_mkey_name(util_context, global_params.mkey_name, global_params.realm, &mkey_fullname, &master_princ))) { com_err(progname, retval, _("while setting up master key name")); exit_status++; goto cleanup_return; } retval = krb5_db_get_principal(util_context, master_princ, 0, &master_entry); if (retval != 0) { com_err(progname, retval, _("while getting master key principal %s"), mkey_fullname); exit_status++; goto cleanup_return; } retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list); if (retval != 0) { com_err(progname, retval, _("while looking up active version of master key")); exit_status++; goto cleanup_return; } /* * If an entry already exists with the same kvno either delete it or if it's * the only entry, just set its active time. */ for (prev_actkvno = NULL, cur_actkvno = actkvno_list; cur_actkvno != NULL; prev_actkvno = cur_actkvno, cur_actkvno = cur_actkvno->next) { if (cur_actkvno->act_kvno == use_kvno) { /* delete it */ if (prev_actkvno) { prev_actkvno->next = cur_actkvno->next; cur_actkvno->next = NULL; krb5_dbe_free_actkvno_list(util_context, cur_actkvno); } else { if (cur_actkvno->next) { /* delete it from front of list */ actkvno_list = cur_actkvno->next; cur_actkvno->next = NULL; krb5_dbe_free_actkvno_list(util_context, cur_actkvno); } else { /* There's only one entry, go ahead and change the time */ cur_actkvno->act_time = start_time; inserted = TRUE; } } break; } } if (!inserted) { /* alloc enough space to hold new and existing key_data */ new_actkvno = (krb5_actkvno_node *) malloc(sizeof(krb5_actkvno_node)); if (new_actkvno == NULL) { com_err(progname, ENOMEM, _("while adding new master key")); exit_status++; goto cleanup_return; } memset(new_actkvno, 0, sizeof(krb5_actkvno_node)); new_actkvno->act_kvno = use_kvno; new_actkvno->act_time = start_time; /* insert new act kvno node */ if (actkvno_list == NULL) { /* new actkvno is the list */ actkvno_list = new_actkvno; } else { for (prev_actkvno = NULL, cur_actkvno = actkvno_list; cur_actkvno != NULL; prev_actkvno = cur_actkvno, cur_actkvno = cur_actkvno->next) { if (new_actkvno->act_time < cur_actkvno->act_time) { if (prev_actkvno) { prev_actkvno->next = new_actkvno; new_actkvno->next = cur_actkvno; } else { new_actkvno->next = actkvno_list; actkvno_list = new_actkvno; } break; } else if (cur_actkvno->next == NULL) { /* end of line, just add new node to end of list */ cur_actkvno->next = new_actkvno; break; } } } } if (actkvno_list->act_time > now) { com_err(progname, EINVAL, _("there must be one master key currently active")); exit_status++; goto cleanup_return; } if ((retval = krb5_dbe_update_actkvno(util_context, master_entry, actkvno_list))) { com_err(progname, retval, _("while updating actkvno data for master principal entry")); exit_status++; goto cleanup_return; } if ((retval = krb5_dbe_update_mod_princ_data(util_context, master_entry, now, master_princ))) { com_err(progname, retval, _("while updating the master key principal " "modification time")); exit_status++; goto cleanup_return; } if ((retval = krb5_db_put_principal(util_context, master_entry))) { (void) krb5_db_fini(util_context); com_err(progname, retval, _("while adding master key entry to the database")); exit_status++; goto cleanup_return; } cleanup_return: /* clean up */ (void) krb5_db_fini(util_context); krb5_free_unparsed_name(util_context, mkey_fullname); krb5_free_principal(util_context, master_princ); krb5_dbe_free_actkvno_list(util_context, actkvno_list); return; }
void kdb5_list_mkeys(int argc, char *argv[]) { krb5_error_code retval; char *output_str = NULL, enctype[BUFSIZ]; krb5_kvno act_kvno; krb5_timestamp act_time; krb5_actkvno_node *actkvno_list = NULL, *cur_actkvno; krb5_db_entry *master_entry = NULL; krb5_keylist_node *cur_kb_node; krb5_keyblock *act_mkey; krb5_keylist_node *master_keylist = krb5_db_mkey_list_alias(util_context); if (master_keylist == NULL) { com_err(progname, 0, _("master keylist not initialized")); exit_status++; return; } retval = krb5_db_get_principal(util_context, master_princ, 0, &master_entry); if (retval != 0) { com_err(progname, retval, _("while getting master key principal %s"), mkey_fullname); exit_status++; goto cleanup_return; } retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list); if (retval != 0) { com_err(progname, retval, _("while looking up active kvno list")); exit_status++; goto cleanup_return; } retval = krb5_dbe_find_act_mkey(util_context, actkvno_list, &act_kvno, &act_mkey); if (retval != 0) { com_err(progname, retval, _("while looking up active master key")); exit_status++; goto cleanup_return; } printf("Master keys for Principal: %s\n", mkey_fullname); for (cur_kb_node = master_keylist; cur_kb_node != NULL; cur_kb_node = cur_kb_node->next) { if ((retval = krb5_enctype_to_name(cur_kb_node->keyblock.enctype, FALSE, enctype, sizeof(enctype)))) { com_err(progname, retval, _("while getting enctype description")); exit_status++; goto cleanup_return; } act_time = -1; /* assume actkvno entry not found */ for (cur_actkvno = actkvno_list; cur_actkvno != NULL; cur_actkvno = cur_actkvno->next) { if (cur_actkvno->act_kvno == cur_kb_node->kvno) { act_time = cur_actkvno->act_time; break; } } if (cur_kb_node->kvno == act_kvno) { /* * indicates kvno is currently active */ retval = asprintf(&output_str, _("KVNO: %d, Enctype: %s, Active on: %s *\n"), cur_kb_node->kvno, enctype, strdate(act_time)); } else { if (act_time != -1) { retval = asprintf(&output_str, _("KVNO: %d, Enctype: %s, Active on: %s\n"), cur_kb_node->kvno, enctype, strdate(act_time)); } else { retval = asprintf(&output_str, _("KVNO: %d, Enctype: %s, No activate time " "set\n"), cur_kb_node->kvno, enctype); } } if (retval == -1) { com_err(progname, ENOMEM, _("asprintf could not allocate enough " "memory to hold output")); exit_status++; goto cleanup_return; } printf("%s", output_str); free(output_str); output_str = NULL; } cleanup_return: /* clean up */ krb5_db_free_principal(util_context, master_entry); free(output_str); krb5_dbe_free_actkvno_list(util_context, actkvno_list); return; }