/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */

/*

 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.

 */

#include "k5-int.h"

#include <kadm5/admin.h>

#include "admin_internal.h"

#define string_text error_message

/*

 * Function: kadm5_chpass_principal_util

 *

 * Purpose: Wrapper around chpass_principal. We can read new pw, change pw and return useful messages

 *

 * Arguments:

 *

 *      princ          (input) a krb5b_principal structure for the

 *                     principal whose password we should change.

 *

 *      new_password   (input) NULL or a null terminated string with the

 *                     the principal's desired new password.  If new_password

 *                     is NULL then this routine will read a new password.

 *

 *      pw_ret          (output) if non-NULL, points to a static buffer

 *                      containing the new password (if password is prompted

 *                      internally), or to the new_password argument (if

 *                      that is non-NULL).  If the former, then the buffer

 *                      is only valid until the next call to the function,

 *                      and the caller should be sure to zero it when

 *                      it is no longer needed.

 *

 *      msg_ret         (output) a useful message is copied here.

 *

 *      <return value>  exit status of 0 for success, else the com err code

 *                      for the last significant routine called.

 *

 * Requires:

 *

 *      A msg_ret should point to a buffer large enough for the messasge.

 *

 * Effects:

 *

 * Modifies:

 *

 *

 */

kadm5_ret_t _kadm5_chpass_principal_util(void *server_handle,

                                         void *lhandle,

                                         krb5_principal princ,

                                         char *new_pw,

                                         char **ret_pw,

                                         char *msg_ret,

                                         unsigned int msg_len)

{

    int code, code2;

    unsigned int pwsize;

    static char buffer[255];

    char *new_password;

    kadm5_principal_ent_rec princ_ent;

    kadm5_policy_ent_rec policy_ent;

    _KADM5_CHECK_HANDLE(server_handle);

    if (ret_pw)

        *ret_pw = NULL;

    if (new_pw != NULL) {

        new_password = new_pw;

    } else { /* read the password */

        krb5_context context;

        if ((code = (int) kadm5_init_krb5_context(&context)) == 0) {

            pwsize = sizeof(buffer);

            code = krb5_read_password(context, KADM5_PW_FIRST_PROMPT,

                                      KADM5_PW_SECOND_PROMPT,

                                      buffer, &pwsize);

            krb5_free_context(context);

        }

        if (code == 0)

            new_password = buffer;

        else {

#ifdef ZEROPASSWD

            memset(buffer, 0, sizeof(buffer));

#endif

            if (code == KRB5_LIBOS_BADPWDMATCH) {

                strncpy(msg_ret, string_text(CHPASS_UTIL_NEW_PASSWORD_MISMATCH),

                        msg_len - 1);

                msg_ret[msg_len - 1] = '\0';

                return(code);

            } else {

                snprintf(msg_ret, msg_len, "%s %s\n\n%s",

                         error_message(code),

                         string_text(CHPASS_UTIL_WHILE_READING_PASSWORD),

                         string_text(CHPASS_UTIL_PASSWORD_NOT_CHANGED));

                msg_ret[msg_len - 1] = '\0';

                return(code);

            }

        }

        if (pwsize == 0) {

#ifdef ZEROPASSWD

            memset(buffer, 0, sizeof(buffer));

#endif

            strncpy(msg_ret, string_text(CHPASS_UTIL_NO_PASSWORD_READ), msg_len - 1);

            msg_ret[msg_len - 1] = '\0';

            return(KRB5_LIBOS_CANTREADPWD); /* could do better */

        }

    }

    if (ret_pw)

        *ret_pw = new_password;

    code = kadm5_chpass_principal(server_handle, princ, new_password);

#ifdef ZEROPASSWD

    if (!ret_pw)

        memset(buffer, 0, sizeof(buffer)); /* in case we read a new password */

#endif

    if (code == KADM5_OK) {

        strncpy(msg_ret, string_text(CHPASS_UTIL_PASSWORD_CHANGED), msg_len - 1);

        msg_ret[msg_len - 1] = '\0';

        return(0);

    }

    if ((code != KADM5_PASS_Q_TOOSHORT) &&

        (code != KADM5_PASS_REUSE) &&(code != KADM5_PASS_Q_CLASS) &&

        (code != KADM5_PASS_Q_DICT) && (code != KADM5_PASS_TOOSOON)) {

        /* Can't get more info for other errors */

        snprintf(msg_ret, msg_len, "%s\n%s %s\n",

                 string_text(CHPASS_UTIL_PASSWORD_NOT_CHANGED),

                 error_message(code),

                 string_text(CHPASS_UTIL_WHILE_TRYING_TO_CHANGE));

        return(code);

    }

    /* Ok, we have a password quality error. Return a good message */

    if (code == KADM5_PASS_REUSE) {

        strncpy(msg_ret, string_text(CHPASS_UTIL_PASSWORD_REUSE), msg_len - 1);

        msg_ret[msg_len - 1] = '\0';

        return(code);

    }

    if (code == KADM5_PASS_Q_DICT) {

        strncpy(msg_ret, string_text(CHPASS_UTIL_PASSWORD_IN_DICTIONARY),

                msg_len - 1);

        msg_ret[msg_len - 1] = '\0';

        return(code);

    }

    /* Look up policy for the remaining messages */

    code2 = kadm5_get_principal (lhandle, princ, &princ_ent,

                                 KADM5_PRINCIPAL_NORMAL_MASK);

    if (code2 != 0) {

        snprintf(msg_ret, msg_len, "%s %s\n%s %s\n\n%s\n",

                 error_message(code2),

                 string_text(CHPASS_UTIL_GET_PRINC_INFO),

                 error_message(code),

                 string_text(CHPASS_UTIL_WHILE_TRYING_TO_CHANGE),

                 string_text(CHPASS_UTIL_PASSWORD_NOT_CHANGED));

        msg_ret[msg_len - 1] = '\0';

        return(code);

    }

    if ((princ_ent.aux_attributes & KADM5_POLICY) == 0) {

        /* Some module implements its own password policy. */

        snprintf(msg_ret, msg_len, "%s\n\n%s",

                 error_message(code),

                 string_text(CHPASS_UTIL_PASSWORD_NOT_CHANGED));

        msg_ret[msg_len - 1] = '\0';

        (void) kadm5_free_principal_ent(lhandle, &princ_ent);

        return(code);

    }

    code2 = kadm5_get_policy(lhandle, princ_ent.policy,

                             &policy_ent);

    if (code2 != 0) {

        snprintf(msg_ret, msg_len, "%s %s\n%s %s\n\n%s\n ", error_message(code2),

                 string_text(CHPASS_UTIL_GET_POLICY_INFO),

                 error_message(code),

                 string_text(CHPASS_UTIL_WHILE_TRYING_TO_CHANGE),

                 string_text(CHPASS_UTIL_PASSWORD_NOT_CHANGED));

        (void) kadm5_free_principal_ent(lhandle, &princ_ent);

        return(code);

    }

    if (code == KADM5_PASS_Q_TOOSHORT) {

        snprintf(msg_ret, msg_len, string_text(CHPASS_UTIL_PASSWORD_TOO_SHORT),

                 policy_ent.pw_min_length);

        (void) kadm5_free_principal_ent(lhandle, &princ_ent);

        (void) kadm5_free_policy_ent(lhandle, &policy_ent);

        return(code);

    }

/* Can't get more info for other errors */

    if (code == KADM5_PASS_Q_CLASS) {

        snprintf(msg_ret, msg_len, string_text(CHPASS_UTIL_TOO_FEW_CLASSES),

                 policy_ent.pw_min_classes);

        (void) kadm5_free_principal_ent(lhandle, &princ_ent);

        (void) kadm5_free_policy_ent(lhandle, &policy_ent);

        return(code);

    }

    if (code == KADM5_PASS_TOOSOON) {

        time_t until;

        char *time_string, *ptr;

        until = ts_incr(princ_ent.last_pwd_change, policy_ent.pw_min_life);

        time_string = ctime(&until);

        if (time_string == NULL)

            time_string = "(error)";

        else if (*(ptr = &time_string[strlen(time_string)-1]) == '\n')

            *ptr = '\0';

        snprintf(msg_ret, msg_len, string_text(CHPASS_UTIL_PASSWORD_TOO_SOON),

                 time_string);

        (void) kadm5_free_principal_ent(lhandle, &princ_ent);

        (void) kadm5_free_policy_ent(lhandle, &policy_ent);

        return(code);

    }

    /* We should never get here, but just in case ... */

    snprintf(msg_ret, msg_len, "%s\n%s %s\n",

             string_text(CHPASS_UTIL_PASSWORD_NOT_CHANGED),

             error_message(code),

             string_text(CHPASS_UTIL_WHILE_TRYING_TO_CHANGE));

    (void) kadm5_free_principal_ent(lhandle, &princ_ent);

    (void) kadm5_free_policy_ent(lhandle, &policy_ent);

    return(code);

}