/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */

/* lib/kadm5/str_conv.c */

/*

 * Copyright (C) 1995-2015 by the Massachusetts Institute of Technology.

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * * Redistributions of source code must retain the above copyright

 *   notice, this list of conditions and the following disclaimer.

 *

 * * Redistributions in binary form must reproduce the above copyright

 *   notice, this list of conditions and the following disclaimer in

 *   the documentation and/or other materials provided with the

 *   distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS

 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,

 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 */

/* Convert between strings and Kerberos internal data. */

#include "k5-int.h"

#include "admin_internal.h"

#include "adm_proto.h"

#include <ctype.h>

static const char default_tupleseps[]   = ", \t";

static const char default_ksaltseps[]   = ":";

struct flag_table_row {

    const char *spec;           /* Input specifier string */

    krb5_flags flag;            /* Flag */

    int invert;                 /* Whether to invert the sense */

};

static const struct flag_table_row ftbl[] = {

    {"allow_postdated",         KRB5_KDB_DISALLOW_POSTDATED,    1},

    {"postdateable",            KRB5_KDB_DISALLOW_POSTDATED,    1},

    {"disallow_postdated",      KRB5_KDB_DISALLOW_POSTDATED,    0},

    {"allow_forwardable",       KRB5_KDB_DISALLOW_FORWARDABLE,  1},

    {"forwardable",             KRB5_KDB_DISALLOW_FORWARDABLE,  1},

    {"disallow_forwardable",    KRB5_KDB_DISALLOW_FORWARDABLE,  0},

    {"allow_tgs_req",           KRB5_KDB_DISALLOW_TGT_BASED,    1},

    {"tgt_based",               KRB5_KDB_DISALLOW_TGT_BASED,    1},

    {"disallow_tgt_based",      KRB5_KDB_DISALLOW_TGT_BASED,    0},

    {"allow_renewable",         KRB5_KDB_DISALLOW_RENEWABLE,    1},

    {"renewable",               KRB5_KDB_DISALLOW_RENEWABLE,    1},

    {"disallow_renewable",      KRB5_KDB_DISALLOW_RENEWABLE,    0},

    {"allow_proxiable",         KRB5_KDB_DISALLOW_PROXIABLE,    1},

    {"proxiable",               KRB5_KDB_DISALLOW_PROXIABLE,    1},

    {"disallow_proxiable",      KRB5_KDB_DISALLOW_PROXIABLE,    0},

    {"allow_dup_skey",          KRB5_KDB_DISALLOW_DUP_SKEY,     1},

    {"dup_skey",                KRB5_KDB_DISALLOW_DUP_SKEY,     1},

    {"disallow_dup_skey",       KRB5_KDB_DISALLOW_DUP_SKEY,     0},

    {"allow_tickets",           KRB5_KDB_DISALLOW_ALL_TIX,      1},

    {"allow_tix",               KRB5_KDB_DISALLOW_ALL_TIX,      1},

    {"disallow_all_tix",        KRB5_KDB_DISALLOW_ALL_TIX,      0},

    {"preauth",                 KRB5_KDB_REQUIRES_PRE_AUTH,     0},

    {"requires_pre_auth",       KRB5_KDB_REQUIRES_PRE_AUTH,     0},

    {"requires_preauth",        KRB5_KDB_REQUIRES_PRE_AUTH,     0},

    {"hwauth",                  KRB5_KDB_REQUIRES_HW_AUTH,      0},

    {"requires_hw_auth",        KRB5_KDB_REQUIRES_HW_AUTH,      0},

    {"requires_hwauth",         KRB5_KDB_REQUIRES_HW_AUTH,      0},

    {"needchange",              KRB5_KDB_REQUIRES_PWCHANGE,     0},

    {"pwchange",                KRB5_KDB_REQUIRES_PWCHANGE,     0},

    {"requires_pwchange",       KRB5_KDB_REQUIRES_PWCHANGE,     0},

    {"allow_svr",               KRB5_KDB_DISALLOW_SVR,          1},

    {"service",                 KRB5_KDB_DISALLOW_SVR,          1},

    {"disallow_svr",            KRB5_KDB_DISALLOW_SVR,          0},

    {"password_changing_service", KRB5_KDB_PWCHANGE_SERVICE,    0},

    {"pwchange_service",        KRB5_KDB_PWCHANGE_SERVICE,      0},

    {"pwservice",               KRB5_KDB_PWCHANGE_SERVICE,      0},

    {"md5",                     KRB5_KDB_SUPPORT_DESMD5,        0},

    {"support_desmd5",          KRB5_KDB_SUPPORT_DESMD5,        0},

    {"new_princ",               KRB5_KDB_NEW_PRINC,             0},

    {"ok_as_delegate",          KRB5_KDB_OK_AS_DELEGATE,        0},

    {"ok_to_auth_as_delegate",  KRB5_KDB_OK_TO_AUTH_AS_DELEGATE, 0},

    {"no_auth_data_required",   KRB5_KDB_NO_AUTH_DATA_REQUIRED, 0},

    {"lockdown_keys",           KRB5_KDB_LOCKDOWN_KEYS,         0},

};

#define NFTBL (sizeof(ftbl) / sizeof(ftbl[0]))

static const char *outflags[] = {

    "DISALLOW_POSTDATED",       /* 0x00000001 */

    "DISALLOW_FORWARDABLE",     /* 0x00000002 */

    "DISALLOW_TGT_BASED",       /* 0x00000004 */

    "DISALLOW_RENEWABLE",       /* 0x00000008 */

    "DISALLOW_PROXIABLE",       /* 0x00000010 */

    "DISALLOW_DUP_SKEY",        /* 0x00000020 */

    "DISALLOW_ALL_TIX",         /* 0x00000040 */

    "REQUIRES_PRE_AUTH",        /* 0x00000080 */

    "REQUIRES_HW_AUTH",         /* 0x00000100 */

    "REQUIRES_PWCHANGE",        /* 0x00000200 */

    NULL,                       /* 0x00000400 */

    NULL,                       /* 0x00000800 */

    "DISALLOW_SVR",             /* 0x00001000 */

    "PWCHANGE_SERVICE",         /* 0x00002000 */

    "SUPPORT_DESMD5",           /* 0x00004000 */

    "NEW_PRINC",                /* 0x00008000 */

    NULL,                       /* 0x00010000 */

    NULL,                       /* 0x00020000 */

    NULL,                       /* 0x00040000 */

    NULL,                       /* 0x00080000 */

    "OK_AS_DELEGATE",           /* 0x00100000 */

    "OK_TO_AUTH_AS_DELEGATE",   /* 0x00200000 */

    "NO_AUTH_DATA_REQUIRED",    /* 0x00400000 */

    "LOCKDOWN_KEYS",            /* 0x00800000 */

};

#define NOUTFLAGS (sizeof(outflags) / sizeof(outflags[0]))

/*

 * Given s, which is a normalized flagspec with the prefix stripped off, and

 * req_neg indicating whether the flagspec is negated, update the toset and

 * toclear masks.

 */

static krb5_error_code

raw_flagspec_to_mask(const char *s, int req_neg, krb5_flags *toset,

                     krb5_flags *toclear)

{

    int found = 0, invert = 0;

    size_t i;

    krb5_flags flag;

    unsigned long ul;

    for (i = 0; !found && i < NFTBL; i++) {

        if (strcmp(s, ftbl[i].spec) != 0)

            continue;

        /* Found a match */

        found = 1;

        invert = ftbl[i].invert;

        flag = ftbl[i].flag;

    }

    /* Accept hexadecimal numbers. */

    if (!found && strncmp(s, "0x", 2) == 0) {

        /* Assume that krb5_flags are 32 bits long. */

        ul = strtoul(s, NULL, 16) & 0xffffffff;

        flag = (krb5_flags)ul;

        found = 1;

    }

    if (!found)

        return EINVAL;

    if (req_neg)

        invert = !invert;

    if (invert)

        *toclear &= ~flag;

    else

        *toset |= flag;

    return 0;

}

/*

 * Update the toset and toclear flag masks according to flag specifier string

 * spec, which is of the form {+|-}flagname.  toset and toclear can point to

 * the same flag word.

 */

krb5_error_code

krb5_flagspec_to_mask(const char *spec, krb5_flags *toset, krb5_flags *toclear)

{

    int req_neg = 0;

    char *copy, *cp, *s;

    krb5_error_code retval;

    s = copy = strdup(spec);

    if (s == NULL)

        return ENOMEM;

    if (*s == '-') {

        req_neg = 1;

        s++;

    } else if (*s == '+')

        s++;

    for (cp = s; *cp != '\0'; cp++) {

        /* Transform hyphens to underscores.*/

        if (*cp == '-')

            *cp = '_';

        /* Downcase. */

        if (isupper((unsigned char)*cp))

            *cp = tolower((unsigned char)*cp);

    }

    retval = raw_flagspec_to_mask(s, req_neg, toset, toclear);

    free(copy);

    return retval;

}

/*

 * Copy the flag name of flagnum to outstr.  On error, outstr points to a null

 * pointer.

 */

krb5_error_code

krb5_flagnum_to_string(int flagnum, char **outstr)

{

    const char *s = NULL;

    *outstr = NULL;

    if ((unsigned int)flagnum < NOUTFLAGS)

        s = outflags[flagnum];

    if (s == NULL) {

        /* Assume that krb5_flags are 32 bits long. */

        if (asprintf(outstr, "0x%08lx", 1UL << flagnum) == -1)

            *outstr = NULL;

    } else {

        *outstr = strdup(s);

    }

    if (*outstr == NULL)

        return ENOMEM;

    return 0;

}

/*

 * Create a null-terminated array of string representations of flags.  Store a

 * null pointer into outarray if there would be no strings.

 */

krb5_error_code

krb5_flags_to_strings(krb5_int32 flags, char ***outarray)

{

    char **a = NULL, **a_new = NULL, **ap;

    size_t amax = 0, i;

    krb5_error_code retval;

    *outarray = NULL;

    /* Assume that krb5_flags are 32 bits long. */

    for (i = 0; i < 32; i++) {

        if (!(flags & (1UL << i)))

            continue;

        a_new = realloc(a, (amax + 2) * sizeof(*a));

        if (a_new == NULL) {

            retval = ENOMEM;

            goto cleanup;

        }

        a = a_new;

        retval = krb5_flagnum_to_string(i, &a[amax++]);

        a[amax] = NULL;

        if (retval)

            goto cleanup;

    }

    *outarray = a;

    return 0;

cleanup:

    for (ap = a; ap != NULL && *ap != NULL; ap++) {

        free(*ap);

    }

    free(a);

    return retval;

}

/*

 * krb5_keysalt_is_present()    - Determine if a key/salt pair is present

 *                                in a list of key/salt tuples.

 *

 *      Salttype may be negative to indicate a search for only a enctype.

 */

krb5_boolean

krb5_keysalt_is_present(ksaltlist, nksalts, enctype, salttype)

    krb5_key_salt_tuple *ksaltlist;

    krb5_int32          nksalts;

    krb5_enctype        enctype;

    krb5_int32          salttype;

{

    krb5_boolean        foundit;

    int                 i;

    foundit = 0;

    if (ksaltlist) {

        for (i=0; i

            if ((ksaltlist[i].ks_enctype == enctype) &&

                ((ksaltlist[i].ks_salttype == salttype) ||

                 (salttype < 0))) {

                foundit = 1;

                break;

            }

        }

    }

    return(foundit);

}

/* NOTE: This is a destructive parser (writes NULs). */

static krb5_error_code

string_to_keysalt(char *s, const char *ksaltseps,

                  krb5_enctype *etype, krb5_int32 *stype)

{

    char *sp;

    const char *ksseps = (ksaltseps != NULL) ? ksaltseps : default_ksaltseps;

    krb5_error_code ret = 0;

    sp = strpbrk(s, ksseps);

    if (sp != NULL) {

        *sp++ = '\0';

    }

    ret = krb5_string_to_enctype(s, etype);

    if (ret)

        return ret;

    /* Default to normal salt if omitted. */

    *stype = KRB5_KDB_SALTTYPE_NORMAL;

    if (sp == NULL)

        return 0;

    return krb5_string_to_salttype(sp, stype);

}

/*

 * krb5_string_to_keysalts()    - Convert a string representation to a list

 *                                of key/salt tuples.

 */

krb5_error_code

krb5_string_to_keysalts(const char *string, const char *tupleseps,

                        const char *ksaltseps, krb5_boolean dups,

                        krb5_key_salt_tuple **ksaltp, krb5_int32 *nksaltp)

{

    char *copy, *p, *ksp;

    char *tlasts = NULL;

    const char *tseps = (tupleseps != NULL) ? tupleseps : default_tupleseps;

    krb5_int32 nksalts = 0;

    krb5_int32 stype;

    krb5_enctype etype;

    krb5_error_code ret = 0;

    krb5_key_salt_tuple *ksalts = NULL, *ksalts_new = NULL;

    *ksaltp = NULL;

    *nksaltp = 0;

    p = copy = strdup(string);

    if (p == NULL)

        return ENOMEM;

    while ((ksp = strtok_r(p, tseps, &tlasts)) != NULL) {

        /* Pass a null pointer to subsequent calls to strtok_r(). */

        p = NULL;

        /* Discard unrecognized keysalts. */

        if (string_to_keysalt(ksp, ksaltseps, &etype, &stype) != 0)

            continue;

        /* Ignore duplicate keysalts if caller asks. */

        if (!dups && krb5_keysalt_is_present(ksalts, nksalts, etype, stype))

            continue;

        ksalts_new = realloc(ksalts, (nksalts + 1) * sizeof(*ksalts));

        if (ksalts_new == NULL) {

            ret = ENOMEM;

            goto cleanup;

        }

        ksalts = ksalts_new;

        ksalts[nksalts].ks_enctype = etype;

        ksalts[nksalts].ks_salttype = stype;

        nksalts++;

    }

    *ksaltp = ksalts;

    *nksaltp = nksalts;

cleanup:

    if (ret)

        free(ksalts);

    free(copy);

    return ret;

}

/*

 * krb5_keysalt_iterate()       - Do something for each unique key/salt

 *                                combination.

 *

 * If ignoresalt set, then salttype is ignored.

 */

krb5_error_code

krb5_keysalt_iterate(ksaltlist, nksalt, ignoresalt, iterator, arg)

    krb5_key_salt_tuple *ksaltlist;

    krb5_int32          nksalt;

    krb5_boolean        ignoresalt;

    krb5_error_code     (*iterator) (krb5_key_salt_tuple *, krb5_pointer);

    krb5_pointer        arg;

{

    int                 i;

    krb5_error_code     kret;

    krb5_key_salt_tuple scratch;

    kret = 0;

    for (i=0; i

        scratch.ks_enctype = ksaltlist[i].ks_enctype;

        scratch.ks_salttype = (ignoresalt) ? -1 : ksaltlist[i].ks_salttype;

        if (!krb5_keysalt_is_present(ksaltlist,

                                     i,

                                     scratch.ks_enctype,

                                     scratch.ks_salttype)) {

            kret = (*iterator)(&scratch, arg);

            if (kret)

                break;

        }

    }

    return(kret);

}