kvno.c
1 /* 2 * Copyright (C) 1998 by the FundsXpress, INC. 3 * 4 * All rights reserved. 5 * 6 * Export of this software from the United States of America may require 7 * a specific license from the United States Government. It is the 8 * responsibility of any person or organization contemplating export to 9 * obtain such a license before exporting. 10 * 11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 12 * distribute this software and its documentation for any purpose and 13 * without fee is hereby granted, provided that the above copyright 14 * notice appear in all copies and that both that copyright notice and 15 * this permission notice appear in supporting documentation, and that 16 * the name of FundsXpress. not be used in advertising or publicity pertaining 17 * to distribution of the software without specific, written prior 18 * permission. FundsXpress makes no representations about the suitability of 19 * this software for any purpose. It is provided "as is" without express 20 * or implied warranty. 21 * 22 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 23 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 24 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 25 */ 26 27 #include "kuser_locl.h" 28 29 static char *etype_str = NULL; 30 static char *ccache_name = NULL; 31 static char *keytab_name = NULL; 32 static char *sname = NULL; 33 34 static int version_flag = 0; 35 static int help_flag = 0; 36 static int quiet_flag = 0; 37 38 static void do_v5_kvno (int argc, char *argv[], 39 char *ccache_name, char *etype_str, char *keytab_name, 40 char *sname); 41 42 struct getargs args[] = { 43 { "enctype", 'e', arg_string, &etype_str, 44 NP_("Encryption type to use", ""), "enctype" }, 45 { "cache", 'c', arg_string, &ccache_name, 46 NP_("Credentials cache", ""), "cachename" }, 47 { "keytab", 'k', arg_string, &keytab_name, 48 NP_("Keytab to use", ""), "keytabname" }, 49 { "server", 'S', arg_string, &sname, 50 NP_("Server to get ticket for", ""), "principal" }, 51 { "quiet", 'q', arg_flag, &quiet_flag, 52 NP_("Quiet", "") }, 53 { "version", 0, arg_flag, &version_flag }, 54 { "help", 0, arg_flag, &help_flag } 55 }; 56 57 static void 58 usage(int ret) 59 { 60 arg_printusage_i18n (args, sizeof(args)/sizeof(*args), 61 N_("Usage: ", ""), NULL, 62 "principal1 [principal2 ...]", 63 getarg_i18n); 64 exit (ret); 65 } 66 67 int main(int argc, char *argv[]) 68 { 69 int optidx = 0; 70 71 setprogname (argv[0]); 72 73 setlocale(LC_ALL, ""); 74 bindtextdomain ("heimdal_kuser", HEIMDAL_LOCALEDIR); 75 textdomain("heimdal_kuser"); 76 77 if (getarg(args, sizeof(args)/sizeof(args[0]), argc, argv, &optidx)) 78 usage(1); 79 80 if (help_flag) 81 usage (0); 82 83 if (version_flag) { 84 print_version(NULL); 85 exit (0); 86 } 87 88 argc -= optidx; 89 argv += optidx; 90 91 do_v5_kvno(argc, argv, ccache_name, etype_str, keytab_name, sname); 92 93 return 0; 94 } 95 96 static void do_v5_kvno (int count, char *names[], 97 char * ccache_name, char *etype_str, char *keytab_name, 98 char *sname) 99 { 100 krb5_error_code ret; 101 krb5_context context = 0; 102 int i, errors; 103 krb5_enctype etype; 104 krb5_ccache ccache; 105 krb5_principal me; 106 krb5_creds in_creds, *out_creds = NULL; 107 Ticket ticket; 108 size_t len; 109 char *princ = NULL; 110 krb5_keytab keytab = NULL; 111 112 ret = krb5_init_context(&context); 113 if (ret) 114 errx(1, "krb5_init_context failed: %d", ret); 115 116 if (etype_str) { 117 ret = krb5_string_to_enctype(context, etype_str, &etype); 118 if (ret) 119 krb5_err(context, 1, ret, "Failed to convert encryption type %s", etype_str); 120 } else { 121 etype = 0; 122 } 123 124 if (ccache_name) 125 ret = krb5_cc_resolve(context, ccache_name, &ccache); 126 else 127 ret = krb5_cc_default(context, &ccache); 128 if (ret) 129 krb5_err(context, 1, ret, "Failed to open credentials cache %s", 130 (ccache_name) ? ccache_name : "(Default)"); 131 132 if (keytab_name) { 133 ret = krb5_kt_resolve(context, keytab_name, &keytab); 134 if (ret) 135 krb5_err(context, 1, ret, "Can't resolve keytab %s", keytab_name); 136 } 137 138 ret = krb5_cc_get_principal(context, ccache, &me); 139 if (ret) 140 krb5_err(context, 1, ret, "krb5_cc_get_principal"); 141 142 errors = 0; 143 144 for (i = 0; i < count; i++) { 145 memset(&in_creds, 0, sizeof(in_creds)); 146 memset(&ticket, 0, sizeof(ticket)); 147 148 in_creds.client = me; 149 150 if (sname != NULL) { 151 ret = krb5_sname_to_principal(context, names[i], 152 sname, KRB5_NT_SRV_HST, 153 &in_creds.server); 154 } else { 155 ret = krb5_parse_name(context, names[i], &in_creds.server); 156 } 157 if (ret) { 158 if (!quiet_flag) 159 krb5_warn(context, ret, "Couldn't parse principal name %s", names[i]); 160 errors++; 161 continue; 162 } 163 164 ret = krb5_unparse_name(context, in_creds.server, &princ); 165 if (ret) { 166 krb5_warn(context, ret, "Couldn't format parsed principal name for '%s'", 167 names[i]); 168 errors++; 169 goto next; 170 } 171 172 in_creds.session.keytype = etype; 173 174 ret = krb5_get_credentials(context, 0, ccache, &in_creds, &out_creds); 175 176 if (ret) { 177 krb5_warn(context, ret, "Couldn't get credentials for %s", princ); 178 errors++; 179 goto next; 180 } 181 182 ret = decode_Ticket(out_creds->ticket.data, out_creds->ticket.length, 183 &ticket, &len); 184 if (ret) { 185 krb5_err(context, 1, ret, "Can't decode ticket for %s", princ); 186 errors++; 187 goto next; 188 continue; 189 } 190 191 if (keytab) { 192 krb5_keytab_entry kte; 193 krb5_crypto crypto; 194 krb5_data dec_data; 195 EncTicketPart decr_part; 196 197 ret = krb5_kt_get_entry(context, keytab, in_creds.server, 198 (ticket.enc_part.kvno != NULL)? 199 *ticket.enc_part.kvno : 0, 200 ticket.enc_part.etype, 201 &kte); 202 if (ret) { 203 krb5_warn(context, ret, "Can't decrypt ticket for %s", princ); 204 if (!quiet_flag) 205 printf("%s: kvno = %d, keytab entry invalid", princ, 206 (ticket.enc_part.kvno != NULL)? 207 *ticket.enc_part.kvno : 0); 208 errors ++; 209 goto next; 210 } 211 212 ret = krb5_crypto_init(context, &kte.keyblock, 0, &crypto); 213 if (ret) { 214 krb5_warn(context, ret, "krb5_crypto_init"); 215 errors ++; 216 krb5_kt_free_entry(context, &kte); 217 goto next; 218 } 219 220 ret = krb5_decrypt_EncryptedData (context, crypto, KRB5_KU_TICKET, 221 &ticket.enc_part, &dec_data); 222 krb5_crypto_destroy(context, crypto); 223 krb5_kt_free_entry(context, &kte); 224 225 if (ret) { 226 krb5_warn(context, ret, "krb5_decrypt_EncryptedData"); 227 errors ++; 228 goto next; 229 } 230 231 ret = decode_EncTicketPart(dec_data.data, dec_data.length, 232 &decr_part, &len); 233 krb5_data_free(&dec_data); 234 if (ret) { 235 krb5_warn(context, ret, "decode_EncTicketPart"); 236 errors ++; 237 goto next; 238 } 239 240 if (!quiet_flag) 241 printf("%s: kvno = %d, keytab entry valid\n", princ, 242 (ticket.enc_part.kvno != NULL)? 243 *ticket.enc_part.kvno : 0); 244 245 free_EncTicketPart(&decr_part); 246 } else { 247 if (!quiet_flag) 248 printf("%s: kvno = %d\n", princ, 249 (ticket.enc_part.kvno != NULL)? *ticket.enc_part.kvno : 0); 250 } 251 252 next: 253 if (out_creds) { 254 krb5_free_creds(context, out_creds); 255 out_creds = NULL; 256 } 257 258 if (princ) { 259 krb5_free_unparsed_name(context, princ); 260 princ = NULL; 261 } 262 263 krb5_free_principal(context, in_creds.server); 264 265 free_Ticket(&ticket); 266 } 267 268 if (keytab) 269 krb5_kt_close(context, keytab); 270 krb5_free_principal(context, me); 271 krb5_cc_close(context, ccache); 272 krb5_free_context(context); 273 274 if (errors) 275 exit(1); 276 277 exit(0); 278 }