#
# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# Copyright (c) 2018, Joyent, Inc.

PROG= kadmin kadmin.local
SHFILES= k5srvutil
CLOBBERFILES= $(SHFILES)

KRB5SBINSHFILES= $(SHFILES:%=$(KRB5SBIN)/%)

COMMON_OBJS   = kadmin.o kadmin_ct.o ss_wrapper.o getdate.o keytab.o
RMT_OBJS= $(COMMON_OBJS) kadmin_rmt.o
# Hammerhead: keytab_loc.o compiled with -D_KADMIN_LOCAL_ to exclude
# kadm5_randkey_principal_old (only in libkadm5clnt, not libkadm5srv)
LOC_OBJS= kadmin.o kadmin_ct.o ss_wrapper.o getdate.o keytab_loc.o kadmin_loc.o
OBJS	= $(COMMON_OBJS) $(RMT_OBJS) $(LOC_OBJS)

include ../../../Makefile.cmd
include $(SRC)/lib/gss_mechs/mech_krb5/Makefile.mech_krb5

POFILE = generic.po
POFILES = kadmin.po k5srvutil.po

DEFS = -DHAVE_LIBSOCKET=1 -DHAVE_LIBNSL=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_TIMEB_H=1 \
	-DHAVE_ALLOCA_H=1 -DHAVE_FTIME=1 -DHAVE_TIMEZONE

CPPFLAGS += -I$(SRC)/uts/common/gssapi/include/ \
		-I$(SRC)/uts/common/gssapi/mechs/krb5/include \
		-I$(SRC)/uts/common/gssapi/include \
		-I$(SRC)/cmd/krb5/iprop \
		-I$(SRC)/lib/krb5 \
		-I$(SRC)/lib/gss_mechs/mech_krb5/include $(DEFS)

CERRWARN += -Wno-implicit-function-declaration
CERRWARN += -Wno-unused-function
CERRWARN += -Wno-parentheses
CERRWARN += -Wno-unused-variable

# because of labels from yacc
getdate.o : CERRWARN += -Wno-unused-label

SMATCH=off

SHAREDLIBS = -lmech_krb5 -lss
# Hammerhead: GNU ld needs rpath-link for transitive deps (libdyn, libkdb) via libkadm5srv
LDFLAGS += -Wl,-rpath-link,$(ROOT)/usr/lib/krb5

CLLIBS = $(LDLIBS) $(KRUNPATH) $(KERBRUNPATH) \
	-L$(ROOT_KLIBDIR) -L$(KRB5LIB) $(SHAREDLIBS) -lkadm5clnt

SRVLIBS = $(LDLIBS) $(KRUNPATH) $(KERBRUNPATH) \
	-L$(ROOT_KLIBDIR) -L$(KRB5LIB) $(SHAREDLIBS) -lkadm5srv

kadmin.local:	DEFS += -D_KADMIN_LOCAL_

.KEEP_STATE:

all: $(PROG) $(SHFILES)

kadmin:	$(RMT_OBJS)
	$(LINK.c) $(RMT_OBJS) -o $@ $(CLLIBS)
	$(POST_PROCESS)

keytab_loc.o: keytab.c
	$(COMPILE.c) -D_KADMIN_LOCAL_ -o $@ $<
	$(POST_PROCESS_O)

kadmin.local:	$(LOC_OBJS)
	$(LINK.c) $(LOC_OBJS) -o $@ $(SRVLIBS)
	$(POST_PROCESS)

$(SHFILES): $(SHFILES).sh
	$(RM) $(SHFILES)
	$(CP) $(SHFILES).sh $(SHFILES)

install: $(KRB5SBINPROG) $(KRB5SBINSHFILES)

clean:
	$(RM) $(OBJS)

include ../../../Makefile.targ

$(POFILE): $(DERIVED_FILES) .WAIT $(POFILES)
	$(RM) $@
	$(CAT) $(POFILES) > $@

kadmin.po: FRC
	$(RM) messages.po
	$(XGETTEXT) $(XGETFLAGS) `$(GREP) -l gettext *.[ch]`
	$(SED) "/^domain/d" messages.po > $@
	$(RM) messages.po

FRC:
/*
 * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
 *
 *	Openvision retains the copyright to derivative works of
 *	this source code.  Do *NOT* create a derivative of this
 *	source code before consulting with your legal department.
 *	Do *NOT* integrate *ANY* of this source code into another
 *	product before consulting with your legal department.
 *
 *	For further information, read the top-level Openvision
 *	copyright which is contained in the top-level MIT Kerberos
 *	copyright.
 *
 * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
 *
 */


%{
/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
**  Originally written by Steven M. Bellovin <smb@research.att.com> while
**  at the University of North Carolina at Chapel Hill.  Later tweaked by
**  a couple of people on Usenet.  Completely overhauled by Rich $alz
**  <rsalz@bbn.com> and Jim Berets <jberets@bbn.com> in August, 1990;
**  send any email to Rich.
**
**  This grammar has nine shift/reduce conflicts.
**
**  This code is in the public domain and has no copyright.
*/
/* SUPPRESS 287 on yaccpar_sccsid *//* Unusd static variable */
/* SUPPRESS 288 on yyerrlab *//* Label unused */

#ifdef HAVE_CONFIG_H
#if defined (emacs) || defined (CONFIG_BROKETS)
#include <config.h>
#else
#include "config.h"
#endif
#endif
#include <string.h>

/* Since the code of getdate.y is not included in the Emacs executable
   itself, there is no need to #define static in this file.  Even if
   the code were included in the Emacs executable, it probably
   wouldn't do any harm to #undef it here; this will only cause
   problems if we try to write to a static variable, which I don't
   think this code needs to do.  */
#ifdef emacs
#undef static
#endif

/* The following block of alloca-related preprocessor directives is here
   solely to allow compilation by non GNU-C compilers of the C parser
   produced from this file by old versions of bison.  Newer versions of
   bison include a block similar to this one in bison.simple.  */

#ifdef __GNUC__
#undef alloca
#define alloca __builtin_alloca
#else
#ifdef HAVE_ALLOCA_H
#include <alloca.h>
#else
#ifdef _AIX /* for Bison */
 #pragma alloca
#else
void *alloca ();
#endif
#endif
#endif

#include <stdio.h>
#include <ctype.h>

#if defined(HAVE_STDLIB_H)
#include <stdlib.h>
#endif

/* The code at the top of get_date which figures out the offset of the
   current time zone checks various CPP symbols to see if special
   tricks are need, but defaults to using the gettimeofday system call.
   Include <sys/time.h> if that will be used.  */

#if	defined(vms)

#include <types.h>
#include <time.h>

#else

#include <sys/types.h>

#ifdef TIME_WITH_SYS_TIME
#include <sys/time.h>
#include <time.h>
#else
#ifdef HAVE_SYS_TIME_H
#include <sys/time.h>
#else
#include <time.h>
#endif
#endif

#ifdef timezone
#undef timezone /* needed for sgi */
#endif

/*
** We use the obsolete `struct my_timeb' as part of our interface!
** Since the system doesn't have it, we define it here;
** our callers must do likewise.
*/
struct my_timeb {
    time_t		time;		/* Seconds since the epoch	*/
    unsigned short	millitm;	/* Field not used		*/
    short		timezone;	/* Minutes west of GMT		*/
    short		dstflag;	/* Field not used		*/
};
#endif	/* defined(vms) */

#if defined (STDC_HEADERS) || defined (USG)
#include <string.h>
#endif

/* Some old versions of bison generate parsers that use bcopy.
   That loses on systems that don't provide the function, so we have
   to redefine it here.  */
#ifndef bcopy
#define bcopy(from, to, len) memcpy ((to), (from), (len))
#endif

/*
 * The following is a hack so that it is easy to internationalize
 * statically declared strings. We define a wrapper function here that
 * will be a replacement for gettext. We the make gettext a macro that
 * just returns its argument, which now can be used with statically defined
 * strings. The conquence of this is that GETTEXT must be used to translate
 * a string at runtime and gettext must be used around string literals so
 * that xgettext command can extract them to a portable object database file.
 *
 * Thus to translate a string literal that is an argument to a function foo
 * the following will have to be performed:
 *
 *              foo(GETTEXT(gettext("This is a test")));
 *
 * The inner gettext call is for xgettext command to extract the string.
 * The C preprossesor will reduce the above to:
 *
 *              foo(GETTEXT(("This ia a test"));
 */

#include <libintl.h>

static char *
GETTEXT(const char *msgid)
{
	return (gettext(msgid));
}

#define	gettext(s) (s)


extern struct tm	*gmtime();
extern struct tm	*localtime();

#define yyparse getdate_yyparse
#define yylex getdate_yylex
#define yyerror getdate_yyerror

static int getdate_yylex (void);
static int getdate_yyerror (char *);


#define EPOCH		1970
#define EPOCH_END	2099  /* Solaris 64 bit can support this at this point */
#define HOUR(x)		((time_t)(x) * 60)
#define SECSPERDAY	(24L * 60L * 60L)


/*
**  An entry in the lexical lookup table.
*/
typedef struct _TABLE {
    char	*name;
    int		type;
    time_t	value;
} TABLE;


/*
**  Daylight-savings mode:  on, off, or not yet known.
*/
typedef enum _DSTMODE {
    DSTon, DSToff, DSTmaybe
} DSTMODE;

/*
**  Meridian:  am, pm, or 24-hour style.
*/
typedef enum _MERIDIAN {
    MERam, MERpm, MER24
} MERIDIAN;


/*
**  Global variables.  We could get rid of most of these by using a good
**  union as the yacc stack.  (This routine was originally written before
**  yacc had the %union construct.)  Maybe someday; right now we only use
**  the %union very rarely.
*/
static char	*yyInput;
static DSTMODE	yyDSTmode;
static time_t	yyDayOrdinal;
static time_t	yyDayNumber;
static int	yyHaveDate;
static int	yyHaveDay;
static int	yyHaveRel;
static int	yyHaveTime;
static int	yyHaveZone;
static time_t	yyTimezone;
static time_t	yyDay;
static time_t	yyHour;
static time_t	yyMinutes;
static time_t	yyMonth;
static time_t	yySeconds;
static time_t	yyYear;
static MERIDIAN	yyMeridian;
static time_t	yyRelMonth;
static time_t	yyRelSeconds;

%}

%union {
    time_t		Number;
    enum _MERIDIAN	Meridian;
}

%token	tAGO tDAY tDAYZONE tID tMERIDIAN tMINUTE_UNIT tMONTH tMONTH_UNIT
%token	tSEC_UNIT tSNUMBER tUNUMBER tZONE tDST tNEVER

%type	<Number>	tDAY tDAYZONE tMINUTE_UNIT tMONTH tMONTH_UNIT
%type	<Number>	tSEC_UNIT tSNUMBER tUNUMBER tZONE
%type	<Meridian>	tMERIDIAN o_merid

%%

spec	: /* NULL */
	| spec item
        | tNEVER {
	    yyYear = 1970;
	    yyMonth = 1;
	    yyDay = 1;
	    yyHour = yyMinutes = yySeconds = 0;
	    yyDSTmode = DSToff;
	    yyTimezone = 0; /* gmt */
	    yyHaveDate++;
        }
	;

item	: time {
	    yyHaveTime++;
	}
	| zone {
	    yyHaveZone++;
	}
	| date {
	    yyHaveDate++;
	}
	| day {
	    yyHaveDay++;
	}
	| rel {
	    yyHaveRel++;
	}
	;

time	: tUNUMBER tMERIDIAN {
	    yyHour = $1;
	    yyMinutes = 0;
	    yySeconds = 0;
	    yyMeridian = $2;
	}
	| tUNUMBER ':' tUNUMBER o_merid {
	    yyHour = $1;
	    yyMinutes = $3;
	    yySeconds = 0;
	    yyMeridian = $4;
	}
	| tUNUMBER ':' tUNUMBER tSNUMBER {
	    yyHour = $1;
	    yyMinutes = $3;
	    yyMeridian = MER24;
	    yyDSTmode = DSToff;
	    yyTimezone = - ($4 % 100 + ($4 / 100) * 60);
	}
	| tUNUMBER ':' tUNUMBER ':' tUNUMBER o_merid {
	    yyHour = $1;
	    yyMinutes = $3;
	    yySeconds = $5;
	    yyMeridian = $6;
	}
	| tUNUMBER ':' tUNUMBER ':' tUNUMBER tSNUMBER {
	    yyHour = $1;
	    yyMinutes = $3;
	    yySeconds = $5;
	    yyMeridian = MER24;
	    yyDSTmode = DSToff;
	    yyTimezone = - ($6 % 100 + ($6 / 100) * 60);
	}
	;

zone	: tZONE {
	    yyTimezone = $1;
	    yyDSTmode = DSToff;
	}
	| tDAYZONE {
	    yyTimezone = $1;
	    yyDSTmode = DSTon;
	}
	|
	  tZONE tDST {
	    yyTimezone = $1;
	    yyDSTmode = DSTon;
	}
	;

day	: tDAY {
	    yyDayOrdinal = 1;
	    yyDayNumber = $1;
	}
	| tDAY ',' {
	    yyDayOrdinal = 1;
	    yyDayNumber = $1;
	}
	| tUNUMBER tDAY {
	    yyDayOrdinal = $1;
	    yyDayNumber = $2;
	}
	;

date	: tUNUMBER '/' tUNUMBER {
	    yyMonth = $1;
	    yyDay = $3;
	}
	| tUNUMBER '/' tUNUMBER '/' tUNUMBER {
	    yyMonth = $1;
	    yyDay = $3;
	    yyYear = $5;
	}
	| tUNUMBER tSNUMBER tSNUMBER {
	    /* ISO 8601 format.  yyyy-mm-dd.  */
	    yyYear = $1;
	    yyMonth = -$2;
	    yyDay = -$3;
	}
	| tUNUMBER tMONTH tSNUMBER {
	    /* e.g. 17-JUN-1992.  */
	    yyDay = $1;
	    yyMonth = $2;
	    yyYear = -$3;
	}
	| tMONTH tUNUMBER {
	    yyMonth = $1;
	    yyDay = $2;
	}
	| tMONTH tUNUMBER ',' tUNUMBER {
	    yyMonth = $1;
	    yyDay = $2;
	    yyYear = $4;
	}
	| tUNUMBER tMONTH {
	    yyMonth = $2;
	    yyDay = $1;
	}
	| tUNUMBER tMONTH tUNUMBER {
	    yyMonth = $2;
	    yyDay = $1;
	    yyYear = $3;
	}
	;

rel	: relunit tAGO {
	    yyRelSeconds = -yyRelSeconds;
	    yyRelMonth = -yyRelMonth;
	}
	| relunit
	;

relunit	: tUNUMBER tMINUTE_UNIT {
	    yyRelSeconds += $1 * $2 * 60L;
	}
	| tSNUMBER tMINUTE_UNIT {
	    yyRelSeconds += $1 * $2 * 60L;
	}
	| tMINUTE_UNIT {
	    yyRelSeconds += $1 * 60L;
	}
	| tSNUMBER tSEC_UNIT {
	    yyRelSeconds += $1;
	}
	| tUNUMBER tSEC_UNIT {
	    yyRelSeconds += $1;
	}
	| tSEC_UNIT {
	    yyRelSeconds++;
	}
	| tSNUMBER tMONTH_UNIT {
	    yyRelMonth += $1 * $2;
	}
	| tUNUMBER tMONTH_UNIT {
	    yyRelMonth += $1 * $2;
	}
	| tMONTH_UNIT {
	    yyRelMonth += $1;
	}
	;

o_merid	: /* NULL */ {
	    $$ = MER24;
	}
	| tMERIDIAN {
	    $$ = $1;
	}
	;

%%

/* Month and day table. */
static TABLE const MonthDayTable[] = {
	{ gettext("january"),	tMONTH,  1 },
	{ gettext("february"),	tMONTH,  2 },
	{ gettext("march"),	tMONTH,  3 },
	{ gettext("april"),	tMONTH,  4 },
	{ gettext("may"),	tMONTH,  5 },
	{ gettext("june"),	tMONTH,  6 },
	{ gettext("july"),	tMONTH,  7 },
	{ gettext("august"),	tMONTH,  8 },
	{ gettext("september"),	tMONTH,  9 },
	{ gettext("sept"),	tMONTH,  9 },
	{ gettext("october"),	tMONTH, 10 },
	{ gettext("november"),	tMONTH, 11 },
	{ gettext("december"),	tMONTH, 12 },
	{ gettext("sunday"),	tDAY, 0 },
	{ gettext("monday"),	tDAY, 1 },
	{ gettext("tuesday"),	tDAY, 2 },
	{ gettext("tues"),	tDAY, 2 },
	{ gettext("wednesday"),	tDAY, 3 },
	{ gettext("wednes"),	tDAY, 3 },
	{ gettext("thursday"),	tDAY, 4 },
	{ gettext("thur"),	tDAY, 4 },
	{ gettext("thurs"),	tDAY, 4 },
	{ gettext("friday"),	tDAY, 5 },
	{ gettext("saturday"),	tDAY, 6 },
	{ NULL }
};

/* Time units table. */
static TABLE const UnitsTable[] = {
	{ gettext("year"),		tMONTH_UNIT,	12 },
	{ gettext("month"),		tMONTH_UNIT,	1 },
	{ gettext("fortnight"),	tMINUTE_UNIT,	14 * 24 * 60 },
	{ gettext("week"),		tMINUTE_UNIT,	7 * 24 * 60 },
	{ gettext("day"),		tMINUTE_UNIT,	1 * 24 * 60 },
	{ gettext("hour"),		tMINUTE_UNIT,	60 },
	{ gettext("minute"),	tMINUTE_UNIT,	1 },
	{ gettext("min"),		tMINUTE_UNIT,	1 },
	{ gettext("second"),	tSEC_UNIT,	1 },
	{ gettext("sec"),		tSEC_UNIT,	1 },
	{ NULL }
};

/* Assorted relative-time words. */
static TABLE const OtherTable[] = {
	{ gettext("tomorrow"),	tMINUTE_UNIT,	1 * 24 * 60 },
	{ gettext("yesterday"),	tMINUTE_UNIT,	-1 * 24 * 60 },
	{ gettext("today"),	tMINUTE_UNIT,	0 },
	{ gettext("now"),	tMINUTE_UNIT,	0 },
	{ gettext("last"),	tUNUMBER,	-1 },
	{ gettext("this"),	tMINUTE_UNIT,	0 },
	{ gettext("next"),	tUNUMBER,	2 },
	{ gettext("first"),	tUNUMBER,	1 },
	/*  { gettext("second"),	tUNUMBER,	2 }, */
	{ gettext("third"),	tUNUMBER,	3 },
	{ gettext("fourth"),	tUNUMBER,	4 },
	{ gettext("fifth"),	tUNUMBER,	5 },
	{ gettext("sixth"),	tUNUMBER,	6 },
	{ gettext("seventh"),	tUNUMBER,	7 },
	{ gettext("eighth"),	tUNUMBER,	8 },
	{ gettext("ninth"),	tUNUMBER,	9 },
	{ gettext("tenth"),	tUNUMBER,	10 },
	{ gettext("eleventh"),	tUNUMBER,	11 },
	{ gettext("twelfth"),	tUNUMBER,	12 },
	{ gettext("ago"),	tAGO,		1 },
	{ gettext("never"),	tNEVER,		0 },
	{ NULL }
};

/* The timezone table. */
/* Some of these are commented out because a time_t can't store a float. */
static TABLE const TimezoneTable[] = {
	{ gettext("gmt"),	tZONE,     HOUR( 0) },	/* Greenwich Mean */
	{ gettext("ut"),	tZONE,     HOUR( 0) },	/* Universal (Coordinated) */
	{ gettext("utc"),	tZONE,     HOUR( 0) },
	{ gettext("wet"),	tZONE,     HOUR( 0) },	/* Western European */
	{ gettext("bst"),	tDAYZONE,  HOUR( 0) },	/* British Summer */
	{ gettext("wat"),	tZONE,     HOUR( 1) },	/* West Africa */
	{ gettext("at"),	tZONE,     HOUR( 2) },	/* Azores */
#if	0
    /* For completeness.  BST is also British Summer, and GST is
     * also Guam Standard. */
    { gettext("bst"),	tZONE,     HOUR( 3) },	/* Brazil Standard */
    { gettext("gst"),	tZONE,     HOUR( 3) },	/* Greenland Standard */
#endif
#if 0
	{ gettext("nft"),	tZONE,     HOUR(3.5) },	/* Newfoundland */
	{ gettext("nst"),	tZONE,     HOUR(3.5) },	/* Newfoundland Standard */
	{ gettext("ndt"),	tDAYZONE,  HOUR(3.5) },	/* Newfoundland Daylight */
#endif
	{ gettext("ast"),	tZONE,     HOUR( 4) },	/* Atlantic Standard */
	{ gettext("adt"),	tDAYZONE,  HOUR( 4) },	/* Atlantic Daylight */
	{ gettext("est"),	tZONE,     HOUR( 5) },	/* Eastern Standard */
	{ gettext("edt"),	tDAYZONE,  HOUR( 5) },	/* Eastern Daylight */
	{ gettext("cst"),	tZONE,     HOUR( 6) },	/* Central Standard */
	{ gettext("cdt"),	tDAYZONE,  HOUR( 6) },	/* Central Daylight */
	{ gettext("mst"),	tZONE,     HOUR( 7) },	/* Mountain Standard */
	{ gettext("mdt"),	tDAYZONE,  HOUR( 7) },	/* Mountain Daylight */
	{ gettext("pst"),	tZONE,     HOUR( 8) },	/* Pacific Standard */
	{ gettext("pdt"),	tDAYZONE,  HOUR( 8) },	/* Pacific Daylight */
	{ gettext("yst"),	tZONE,     HOUR( 9) },	/* Yukon Standard */
	{ gettext("ydt"),	tDAYZONE,  HOUR( 9) },	/* Yukon Daylight */
	{ gettext("hst"),	tZONE,     HOUR(10) },	/* Hawaii Standard */
	{ gettext("hdt"),	tDAYZONE,  HOUR(10) },	/* Hawaii Daylight */
	{ gettext("cat"),	tZONE,     HOUR(10) },	/* Central Alaska */
	{ gettext("ahst"),	tZONE,     HOUR(10) },	/* Alaska-Hawaii Standard */
	{ gettext("nt"),	tZONE,     HOUR(11) },	/* Nome */
	{ gettext("idlw"),	tZONE,     HOUR(12) },	/* International Date Line West */
	{ gettext("cet"),	tZONE,     -HOUR(1) },	/* Central European */
	{ gettext("met"),	tZONE,     -HOUR(1) },	/* Middle European */
	{ gettext("mewt"),	tZONE,     -HOUR(1) },	/* Middle European Winter */
	{ gettext("mest"),	tDAYZONE,  -HOUR(1) },	/* Middle European Summer */
	{ gettext("swt"),	tZONE,     -HOUR(1) },	/* Swedish Winter */
	{ gettext("sst"),	tDAYZONE,  -HOUR(1) },	/* Swedish Summer */
	{ gettext("fwt"),	tZONE,     -HOUR(1) },	/* French Winter */
	{ gettext("fst"),	tDAYZONE,  -HOUR(1) },	/* French Summer */
	{ gettext("eet"),	tZONE,     -HOUR(2) },	/* Eastern Europe, USSR Zone 1 */
	{ gettext("bt"),	tZONE,     -HOUR(3) },	/* Baghdad, USSR Zone 2 */
#if 0
	{ gettext("it"),	tZONE,     -HOUR(3.5) },/* Iran */
#endif
	{ gettext("zp4"),	tZONE,     -HOUR(4) },	/* USSR Zone 3 */
	{ gettext("zp5"),	tZONE,     -HOUR(5) },	/* USSR Zone 4 */
#if 0
	{ gettext("ist"),	tZONE,     -HOUR(5.5) },/* Indian Standard */
#endif
	{ gettext("zp6"),	tZONE,     -HOUR(6) },	/* USSR Zone 5 */
#if	0
    /* For completeness.  NST is also Newfoundland Stanard, and SST is
     * also Swedish Summer. */
    { gettext("nst"),	tZONE,     -HOUR(6.5) },/* North Sumatra */
    { gettext("sst"),	tZONE,     -HOUR(7) },	/* South Sumatra, USSR Zone 6 */
#endif	/* 0 */
	{ gettext("wast"),	tZONE,     -HOUR(7) },	/* West Australian Standard */
	{ gettext("wadt"),	tDAYZONE,  -HOUR(7) },	/* West Australian Daylight */
#if 0
	{ gettext("jt"),	tZONE,     -HOUR(7.5) },/* Java (3pm in Cronusland!) */
#endif
	{ gettext("cct"),	tZONE,     -HOUR(8) },	/* China Coast, USSR Zone 7 */
	{ gettext("jst"),	tZONE,     -HOUR(9) },	/* Japan Standard, USSR Zone 8 */
	{ gettext("kst"),	tZONE,     -HOUR(9) },	/* Korean Standard */
#if 0
	{ gettext("cast"),	tZONE,     -HOUR(9.5) },/* Central Australian Standard */
	{ gettext("cadt"),	tDAYZONE,  -HOUR(9.5) },/* Central Australian Daylight */
#endif
	{ gettext("east"),	tZONE,     -HOUR(10) },	/* Eastern Australian Standard */
	{ gettext("eadt"),	tDAYZONE,  -HOUR(10) },	/* Eastern Australian Daylight */
	{ gettext("gst"),	tZONE,     -HOUR(10) },	/* Guam Standard, USSR Zone 9 */
	{ gettext("kdt"),	tZONE,     -HOUR(10) },	/* Korean Daylight */
	{ gettext("nzt"),	tZONE,     -HOUR(12) },	/* New Zealand */
	{ gettext("nzst"),	tZONE,     -HOUR(12) },	/* New Zealand Standard */
	{ gettext("nzdt"),	tDAYZONE,  -HOUR(12) },	/* New Zealand Daylight */
	{ gettext("idle"),	tZONE,     -HOUR(12) },	/* International Date Line East */
	{  NULL  }
};

/* ARGSUSED */
static int
yyerror(s)
    char	*s;
{
  return 0;
}


static time_t
ToSeconds(Hours, Minutes, Seconds, Meridian)
    time_t	Hours;
    time_t	Minutes;
    time_t	Seconds;
    MERIDIAN	Meridian;
{
    if (Minutes < 0 || Minutes > 59 || Seconds < 0 || Seconds > 59)
	return -1;
    switch (Meridian) {
    case MER24:
	if (Hours < 0 || Hours > 23)
	    return -1;
	return (Hours * 60L + Minutes) * 60L + Seconds;
    case MERam:
	if (Hours < 1 || Hours > 12)
	    return -1;
	return (Hours * 60L + Minutes) * 60L + Seconds;
    case MERpm:
	if (Hours < 1 || Hours > 12)
	    return -1;
	return ((Hours + 12) * 60L + Minutes) * 60L + Seconds;
    default:
	abort ();
    }
    /* NOTREACHED */
}

/*
 * From hh:mm:ss [am|pm] mm/dd/yy [tz], compute and return the number
 * of seconds since 00:00:00 1/1/70 GMT.
 */
static time_t
Convert(Month, Day, Year, Hours, Minutes, Seconds, Meridian, DSTmode)
    time_t	Month;
    time_t	Day;
    time_t	Year;
    time_t	Hours;
    time_t	Minutes;
    time_t	Seconds;
    MERIDIAN	Meridian;
    DSTMODE	DSTmode;
{
    static int DaysInMonth[12] = {
	31, 0, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
    };
    time_t	tod;
    time_t	Julian;
    int		i;

    if (Year < 0)
	Year = -Year;
    if (Year < 1900)
	Year += 1900;
    DaysInMonth[1] = Year % 4 == 0 && (Year % 100 != 0 || Year % 400 == 0)
		    ? 29 : 28;
    if (Year < EPOCH
	|| Year > EPOCH_END
	|| Month < 1 || Month > 12
	/* Lint fluff:  "conversion from long may lose accuracy" */
	|| Day < 1 || Day > DaysInMonth[(int)--Month])
	 return -1;

    for (Julian = Day - 1, i = 0; i < Month; i++)
	Julian += DaysInMonth[i];
    for (i = EPOCH; i < Year; i++)
	 Julian += 365 + ((i % 4 == 0) && ((Year % 100 != 0) ||
					   (Year % 400 == 0)));
    Julian *= SECSPERDAY;
    Julian += yyTimezone * 60L;
    if ((tod = ToSeconds(Hours, Minutes, Seconds, Meridian)) < 0)
	return -1;
    Julian += tod;
    if (DSTmode == DSTon
     || (DSTmode == DSTmaybe && localtime(&Julian)->tm_isdst))
	Julian -= 60 * 60;
    return Julian;
}


static time_t
DSTcorrect(Start, Future)
    time_t	Start;
    time_t	Future;
{
    time_t	StartDay;
    time_t	FutureDay;

    StartDay = (localtime(&Start)->tm_hour + 1) % 24;
    FutureDay = (localtime(&Future)->tm_hour + 1) % 24;
    return (Future - Start) + (StartDay - FutureDay) * 60L * 60L;
}


static time_t
RelativeDate(Start, DayOrdinal, DayNumber)
    time_t	Start;
    time_t	DayOrdinal;
    time_t	DayNumber;
{
    struct tm	*tm;
    time_t	now;

    now = Start;
    tm = localtime(&now);
    now += SECSPERDAY * ((DayNumber - tm->tm_wday + 7) % 7);
    now += 7 * SECSPERDAY * (DayOrdinal <= 0 ? DayOrdinal : DayOrdinal - 1);
    return DSTcorrect(Start, now);
}


static time_t
RelativeMonth(Start, RelMonth)
    time_t	Start;
    time_t	RelMonth;
{
    struct tm	*tm;
    time_t	Month;
    time_t	Year;
    time_t	ret;

    if (RelMonth == 0)
	return 0;
    tm = localtime(&Start);
    Month = 12 * tm->tm_year + tm->tm_mon + RelMonth;
    Year = Month / 12;
    Month = Month % 12 + 1;
    ret = Convert(Month, (time_t)tm->tm_mday, Year,
		  (time_t)tm->tm_hour, (time_t)tm->tm_min, (time_t)tm->tm_sec,
		  MER24, DSTmaybe);
    if (ret == -1)
      return ret;
    return DSTcorrect(Start, ret);
}


static int
LookupWord(buff)
    char		*buff;
{
    register char	*p;
    register char	*q;
    register const TABLE	*tp;
    int			i;
    int			abbrev;

    /* Make it lowercase. */
    for (p = buff; *p; p++)
	if (isupper((int) *p))
	    *p = tolower((int) *p);

    if (strcmp(buff, gettext("am")) == 0 || strcmp(buff, gettext("a.m.")) == 0) {
	yylval.Meridian = MERam;
	return tMERIDIAN;
    }
    if (strcmp(buff, gettext("pm")) == 0 ||
	    strcmp(buff, gettext("p.m.")) == 0) {
	yylval.Meridian = MERpm;
	return tMERIDIAN;
    }

    /* See if we have an abbreviation for a month. */
    if (strlen(buff) == 3)
	abbrev = 1;
    else if (strlen(buff) == 4 && buff[3] == '.') {
	abbrev = 1;
	buff[3] = '\0';
    }
    else
	abbrev = 0;

    for (tp = MonthDayTable; tp->name; tp++) {
	if (abbrev) {
	    if (strncmp(buff, GETTEXT(tp->name), 3) == 0) {
		yylval.Number = tp->value;
		return tp->type;
	    }
	}
	else if (strcmp(buff, GETTEXT(tp->name)) == 0) {
	    yylval.Number = tp->value;
	    return tp->type;
	}
    }

    for (tp = TimezoneTable; tp->name; tp++)
	if (strcmp(buff, GETTEXT(tp->name)) == 0) {
	    yylval.Number = tp->value;
	    return tp->type;
	}

    if (strcmp(buff, gettext("dst")) == 0)
	return tDST;

    for (tp = UnitsTable; tp->name; tp++)
	if (strcmp(buff, GETTEXT(tp->name)) == 0) {
	    yylval.Number = tp->value;
	    return tp->type;
	}

    /* Strip off any plural and try the units table again. */
    i = strlen(buff) - 1;
    if (buff[i] == 's') {
	buff[i] = '\0';
	for (tp = UnitsTable; tp->name; tp++)
	    if (strcmp(buff, GETTEXT(tp->name)) == 0) {
		yylval.Number = tp->value;
		return tp->type;
	    }
	buff[i] = 's';		/* Put back for "this" in OtherTable. */
    }

    for (tp = OtherTable; tp->name; tp++)
	if (strcmp(buff, GETTEXT(tp->name)) == 0) {
	    yylval.Number = tp->value;
	    return tp->type;
	}

    /* Drop out any periods and try the timezone table again. */
    for (i = 0, p = q = buff; *q; q++)
	if (*q != '.')
	    *p++ = *q;
	else
	    i++;
    *p = '\0';
    if (i)
	for (tp = TimezoneTable; tp->name; tp++)
	    if (strcmp(buff, GETTEXT(tp->name)) == 0) {
		yylval.Number = tp->value;
		return tp->type;
	    }

    return tID;
}


static int
yylex()
{
    register char	c;
    register char	*p;
    char		buff[20];
    int			Count;
    int			sign;

    for ( ; ; ) {
	while (isspace((int) *yyInput))
	    yyInput++;

	c = *yyInput;
	if (isdigit((int) c) || c == '-' || c == '+') {
	    if (c == '-' || c == '+') {
		sign = c == '-' ? -1 : 1;
		if (!isdigit((int) (*++yyInput)))
		    /* skip the '-' sign */
		    continue;
	    }
	    else
		sign = 0;
	    for (yylval.Number = 0; isdigit((int) (c = *yyInput++)); )
		yylval.Number = 10 * yylval.Number + c - '0';
	    yyInput--;
	    if (sign < 0)
		yylval.Number = -yylval.Number;
	    return sign ? tSNUMBER : tUNUMBER;
	}
	if (isalpha((int) c)) {
	    for (p = buff; isalpha((int) (c = *yyInput++)) || c == '.'; )
		if (p < &buff[sizeof buff - 1])
		    *p++ = c;
	    *p = '\0';
	    yyInput--;
	    return LookupWord(buff);
	}
	if (c != '(')
	    return *yyInput++;
	Count = 0;
	do {
	    c = *yyInput++;
	    if (c == '\0')
		return c;
	    if (c == '(')
		Count++;
	    else if (c == ')')
		Count--;
	} while (Count > 0);
    }
}


#define TM_YEAR_ORIGIN 1900

/* Yield A - B, measured in seconds.  */
static time_t
difftm(a, b)
     struct tm *a, *b;
{
  int ay = a->tm_year + (TM_YEAR_ORIGIN - 1);
  int by = b->tm_year + (TM_YEAR_ORIGIN - 1);
  return
    (
     (
      (
       /* difference in day of year */
       a->tm_yday - b->tm_yday
       /* + intervening leap days */
       +  ((ay >> 2) - (by >> 2))
       -  (ay/100 - by/100)
       +  ((ay/100 >> 2) - (by/100 >> 2))
       /* + difference in years * 365 */
       +  (time_t)(ay-by) * 365
       )*24 + (a->tm_hour - b->tm_hour)
      )*60 + (a->tm_min - b->tm_min)
     )*60 + (a->tm_sec - b->tm_sec);
}

/* For get_date extern declaration compatibility check... yuck.  */
#include <krb5.h>
#include "kadmin.h"

time_t
get_date(p)
    char		*p;
{
    struct my_timeb	*now = NULL;
    struct tm		*tm, gmt;
    struct my_timeb	ftz;
    time_t		Start;
    time_t		tod;
    time_t		delta;

    yyInput = p;
    if (now == NULL) {
        now = &ftz;

	ftz.time = time((time_t *) 0);

	if (! (tm = gmtime (&ftz.time)))
	    return -1;
	gmt = *tm;	/* Make a copy, in case localtime modifies *tm.  */
	ftz.timezone = difftm (&gmt, localtime (&ftz.time)) / 60;
    }

    tm = localtime(&now->time);
    yyYear = tm->tm_year;
    yyMonth = tm->tm_mon + 1;
    yyDay = tm->tm_mday;
    yyTimezone = now->timezone;
    yyDSTmode = DSTmaybe;
    yyHour = 0;
    yyMinutes = 0;
    yySeconds = 0;
    yyMeridian = MER24;
    yyRelSeconds = 0;
    yyRelMonth = 0;
    yyHaveDate = 0;
    yyHaveDay = 0;
    yyHaveRel = 0;
    yyHaveTime = 0;
    yyHaveZone = 0;

    /*
     * When yyparse returns, zero or more of yyHave{Time,Zone,Date,Day,Rel}
     * will have been incremented.  The value is number of items of
     * that type that were found; for all but Rel, more than one is
     * illegal.
     *
     * For each yyHave indicator, the following values are set:
     *
     * yyHaveTime:
     *	yyHour, yyMinutes, yySeconds: hh:mm:ss specified, initialized
     *				      to zeros above
     *	yyMeridian: MERam, MERpm, or MER24
     *	yyTimeZone: time zone specified in minutes
     *  yyDSTmode: DSToff if yyTimeZone is set, otherwise unchanged
     *		   (initialized above to DSTmaybe)
     *
     * yyHaveZone:
     *  yyTimezone: as above
     *  yyDSTmode: DSToff if a non-DST zone is specified, otherwise DSTon
     *	XXX don't understand interaction with yyHaveTime zone info
     *
     * yyHaveDay:
     *	yyDayNumber: 0-6 for Sunday-Saturday
     *  yyDayOrdinal: val specified with day ("second monday",
     *		      Ordinal=2), otherwise 1
     *
     * yyHaveDate:
     *	yyMonth, yyDay, yyYear: mm/dd/yy specified, initialized to
     *				today above
     *
     * yyHaveRel:
     *	yyRelSeconds: seconds specified with MINUTE_UNITs ("3 hours") or
     *		      SEC_UNITs ("30 seconds")
     *  yyRelMonth: months specified with MONTH_UNITs ("3 months", "1
     *		     year")
     *
     * The code following yyparse turns these values into a single
     * date stamp.
     */
    if (yyparse()
     || yyHaveTime > 1 || yyHaveZone > 1 || yyHaveDate > 1 || yyHaveDay > 1)
	return -1;

    /*
     * If an absolute time specified, set Start to the equivalent Unix
     * timestamp.  Otherwise, set Start to now, and if we do not have
     * a relatime time (ie: only yyHaveZone), decrement Start to the
     * beginning of today.
     *
     * By having yyHaveDay in the "absolute" list, "next Monday" means
     * midnight next Monday.  Otherwise, "next Monday" would mean the
     * time right now, next Monday.  It's not clear to me why the
     * current behavior is preferred.
     */
    if (yyHaveDate || yyHaveTime || yyHaveDay) {
	Start = Convert(yyMonth, yyDay, yyYear, yyHour, yyMinutes, yySeconds,
		    yyMeridian, yyDSTmode);
	if (Start < 0)
	    return -1;
    }
    else {
	Start = now->time;
	if (!yyHaveRel)
	    Start -= ((tm->tm_hour * 60L + tm->tm_min) * 60L) + tm->tm_sec;
    }

    /*
     * Add in the relative time specified.  RelativeMonth adds in the
     * months, accounting for the fact that the actual length of "3
     * months" depends on where you start counting.
     *
     * XXX By having this separate from the previous block, we are
     * allowing dates like "10:00am 3 months", which means 3 months
     * from 10:00am today, or even "1/1/99 two days" which means two
     * days after 1/1/99.
     *
     * XXX Shouldn't this only be done if yyHaveRel, just for
     * thoroughness?
     */
    Start += yyRelSeconds;
    delta = RelativeMonth(Start, yyRelMonth);
    if (delta == (time_t) -1)
      return -1;
    Start += delta;

    /*
     * Now, if you specified a day of week and counter, add it in.  By
     * disallowing Date but allowing Time, you can say "5pm next
     * monday".
     *
     * XXX The yyHaveDay && !yyHaveDate restriction should be enforced
     * above and be able to cause failure.
     */
    if (yyHaveDay && !yyHaveDate) {
	tod = RelativeDate(Start, yyDayOrdinal, yyDayNumber);
	Start += tod;
    }

    /* Have to do *something* with a legitimate -1 so it's distinguishable
     * from the error return value.  (Alternately could set errno on error.) */
    return Start == -1 ? 0 : Start;
}


#if	defined(TEST)

/* ARGSUSED */
main(ac, av)
    int		ac;
    char	*av[];
{
    char	buff[128];
    time_t	d;

    (void)printf(gettext("Enter date, or blank line to exit.\n\t> "));
    (void)fflush(stdout);
    while (gets(buff) && buff[0]) {
	d = get_date(buff, (struct my_timeb *)NULL);
	if (d == -1)
	    (void)printf(
				gettext("Bad format - couldn't convert.\n"));
	else
	    (void)printf("%s", ctime(&d));
	(void)printf("\t> ");
	(void)fflush(stdout);
    }
    exit(0);
    /* NOTREACHED */
}
#endif	/* defined(TEST) */
#!/bin/sh
#
#
# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#

TEXTDOMAIN=SUNW_OST_OSCMD
export TEXTDOMAIN

# list_princs keytab
# returns a list of principals in the keytab
# sorted and uniquified
list_princs() {
    klist -k $keytab | tail +4 | awk '{print $2}' | sort | uniq
}

set_command() {
    if [ x$command != x ] ; then
	cmd_error `gettext  "Only one command can be specified"`
	usage
	exit 1
    fi
    command=$1
}

#interactive_prompt prompt princ
# If in interactive mode  return true if the principal  should be acted on
# otherwise return true all the time
#
# SUNW14resync: If in interactive mode the default is now to return false
#               i.e. if in interactive mode unless the user types "Yes" or
#               "yes" false will be returned.
#
interactive_prompt() {
    if [ $interactive = 0 ] ; then
	return 0
    fi
    PROMPT=`gettext  "%s for %s? [yes no] "`
    Y1=`gettext  "yes"`
    Y2=`gettext  "Yes"`
    printf "$PROMPT" "$1" "$2"
    read ans
    case $ans in
    ${Y1}|${Y2})
	return 0
	;;
    esac
    return 1
    }

cmd_error() {
    echo $@ 2>&1
    }

usage() {
    USAGE=`gettext "Usage: $0 [-i] [-f file] list|change|delete|delold"`
    echo $USAGE
}



change_key() {
    princs=`list_princs `
    for princ in $princs; do
	ACTION=`gettext  "Change key"`
	if interactive_prompt "$ACTION" $princ; then
	    kadmin -k -t $keytab -p $princ -q "ktadd -k $keytab $princ"
	fi
    done
    }

delete_old_keys() {
    princs=`list_princs `
    for princ in $princs; do
	ACTION=`gettext  "Delete old keys"`
	if interactive_prompt "$ACTION" $princ; then
	    kadmin -k -t $keytab -p $princ -q "ktrem -k $keytab $princ old"
	fi
    done
    }

delete_keys() {
    interactive=1
    princs=`list_princs `
    for princ in $princs; do
	ACTION=`gettext  "Delete all keys"`
	if interactive_prompt "$ACTION" $princ; then
	    kadmin -p $princ -k -t $keytab -q "ktrem -k $keytab $princ all"
	fi
    done
    }


keytab=/etc/krb5/krb5.keytab
interactive=0

CHANGE=`gettext  "change"`
DELOLD=`gettext  "delold"`
DELETE=`gettext  "delete"`
LIST=`gettext  "list"`

while [ $# -gt 0 ] ; do
    opt=$1
    shift
        case $opt in
	"-f")
	keytab=$1
	shift
	;;
	"-i")
	interactive=1
	;;
	${CHANGE}|${DELOLD}|${DELETE}|${LIST})
	set_command $opt
	;;
	*)
	ILLEGAL=`gettext  "Illegal option: "`
	cmd_error $ILLEGAL $opt
	usage
	exit 1
	;;
	esac
done


case $command in
    $CHANGE)
    change_key
    ;;
    $DELOLD)
    delete_old_keys
    ;;
    $DELETE)
    delete_keys
    ;;
    $LIST)
    klist -k $keytab
    ;;
    *)
        usage
	;;
    esac
/*
 * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Copyright 1994 by the Massachusetts Institute of Technology.
 * All Rights Reserved.
 *
 * Export of this software from the United States of America may
 *   require a specific license from the United States Government.
 *   It is the responsibility of any person or organization contemplating
 *   export to obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  Furthermore if you modify this software you must label
 * your software as modified software and not distribute it in such a
 * fashion that it might be confused with the original M.I.T. software.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 * kadmin.c: base functions for a kadmin command line interface using
 * the OVSecure library
 */

#include <kadm5/admin.h>
#include <krb5/adm_proto.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <math.h>
#include <unistd.h>
#include <pwd.h>
/* #include <sys/timeb.h> */
#include <time.h>
#include "kadmin.h"
#include <libintl.h>
#include <krb5.h>

/*
 * Solaris:  the following are needed for paging
 */
#include <signal.h>
#include <sys/wait.h>

/* command name when called "locally" (i.e. non-networked client ) */
#define KADMIN_LOCAL_NAME "kadmin.local"

/* functions defined in remote/local specific files */
extern void usage(const char *);

/* special struct to convert flag names for principals
   to actual krb5_flags for a principal */
struct pflag {
    char *flagname;		/* name of flag as typed to CLI */
    int flaglen;		/* length of string (not counting -,+) */
    krb5_flags theflag;		/* actual principal flag to set/clear */
    int set;			/* 0 means clear, 1 means set (on '-') */
};

static struct pflag flags[] = {
{"allow_postdated",	15,	KRB5_KDB_DISALLOW_POSTDATED,	1},
{"allow_forwardable",	17,	KRB5_KDB_DISALLOW_FORWARDABLE,	1},
{"allow_tgs_req",	13,	KRB5_KDB_DISALLOW_TGT_BASED,	1},
{"allow_renewable",	15,	KRB5_KDB_DISALLOW_RENEWABLE,	1},
{"allow_proxiable",	15,	KRB5_KDB_DISALLOW_PROXIABLE,	1},
{"allow_dup_skey",	14,	KRB5_KDB_DISALLOW_DUP_SKEY,	1},
{"allow_tix",		9,	KRB5_KDB_DISALLOW_ALL_TIX,	1},
{"requires_preauth",	16,	KRB5_KDB_REQUIRES_PRE_AUTH,	0},
{"requires_hwauth",	15,	KRB5_KDB_REQUIRES_HW_AUTH,	0},
{"needchange", 10,	KRB5_KDB_REQUIRES_PWCHANGE,	0},
{"allow_svr", 9,	KRB5_KDB_DISALLOW_SVR, 1},
{"password_changing_service",	25,	KRB5_KDB_PWCHANGE_SERVICE,	0 },
{"support_desmd5",	14,	KRB5_KDB_SUPPORT_DESMD5,	0 }
};

static char *prflags[] = {
    "DISALLOW_POSTDATED",	/* 0x00000001 */
    "DISALLOW_FORWARDABLE",	/* 0x00000002 */
    "DISALLOW_TGT_BASED",	/* 0x00000004 */
    "DISALLOW_RENEWABLE",	/* 0x00000008 */
    "DISALLOW_PROXIABLE",	/* 0x00000010 */
    "DISALLOW_DUP_SKEY",	/* 0x00000020 */
    "DISALLOW_ALL_TIX",		/* 0x00000040 */
    "REQUIRES_PRE_AUTH",	/* 0x00000080 */
    "REQUIRES_HW_AUTH",		/* 0x00000100 */
    "REQUIRES_PWCHANGE",	/* 0x00000200 */
    "UNKNOWN_0x00000400",	/* 0x00000400 */
    "UNKNOWN_0x00000800",	/* 0x00000800 */
    "DISALLOW_SVR",		/* 0x00001000 */
    "PWCHANGE_SERVICE",		/* 0x00002000 */
    "SUPPORT_DESMD5",		/* 0x00004000 */
    "NEW_PRINC",		/* 0x00008000 */
};

char *getenv();
int exit_status = 0;
char *def_realm = NULL;
char *whoami = NULL;

void *handle = NULL;
krb5_context context;
char *ccache_name = NULL;

int locked = 0;
static char *strdur(duration)
    time_t duration;
{
    static char out[50];
    int neg, days, hours, minutes, seconds;

    if (duration < 0) {
	duration *= -1;
	neg = 1;
    } else
	neg = 0;
    days = duration / (24 * 3600);
    duration %= 24 * 3600;
    hours = duration / 3600;
    duration %= 3600;
    minutes = duration / 60;
    duration %= 60;
    seconds = duration;
    snprintf(out, sizeof (out), "%s%d %s %02d:%02d:%02d", neg ? "-" : "",
	    days, days == 1 ? gettext("day") : gettext("days"),
	    hours, minutes, seconds);
    return out;
}

static char *strdate(when)
    krb5_timestamp when;
{
    struct tm *tm;
    static char out[40];

    time_t lcltim = when;
    tm = localtime(&lcltim);
    strftime(out, sizeof(out), gettext("%a %b %d %H:%M:%S %Z %Y"), tm);
    return out;
}

/* this is a wrapper to go around krb5_parse_principal so we can set
   the default realm up properly */
static krb5_error_code
kadmin_parse_name(name, principal)
    char *name;
    krb5_principal *principal;
{
    char *cp, *fullname;
    krb5_error_code retval;

    if (name == NULL)
	return (EINVAL);

    /* assumes def_realm is initialized! */
    fullname = (char *)malloc(strlen(name) + 1 + strlen(def_realm) + 1);
    if (fullname == NULL)
	return ENOMEM;
    strcpy(fullname, name);
    cp = strchr(fullname, '@');
    while (cp) {
	if (cp - fullname && *(cp - 1) != '\\')
	    break;
	else
	    cp = strchr(cp + 1, '@');
    }
    if (cp == NULL) {
	strcat(fullname, "@");
	strcat(fullname, def_realm);
    }
    retval = krb5_parse_name(context, fullname, principal);
    free(fullname);
    return retval;
}

static void extended_com_err_fn (const char *myprog, errcode_t code,
				 const char *fmt, va_list args)
{
    if (code) {
	const char *emsg;
	emsg = krb5_get_error_message (context, code);
	fprintf (stderr, "%s: %s ", myprog, emsg);
	krb5_free_error_message (context, emsg);
    } else {
	fprintf (stderr, "%s: ", myprog);
    }
    vfprintf (stderr, fmt, args);
    fprintf (stderr, "\n");
}
char *kadmin_startup(argc, argv)
    int argc;
    char *argv[];
{
    extern char *optarg;
    char *princstr = NULL, *keytab_name = NULL, *query = NULL;
    char *password = NULL;
    char *luser, *canon, *cp;
    int optchar, freeprinc = 0, use_keytab = 0;
    struct passwd *pw;
    kadm5_ret_t retval;
    krb5_ccache cc;
    krb5_principal princ;
    kadm5_config_params params;
    char **db_args = NULL;
    int db_args_size = 0;
    char *db_name = NULL;
    char *svcname = NULL;

    memset((char *) &params, 0, sizeof(params));

    if (strcmp (whoami, "kadmin.local") == 0)
	set_com_err_hook(extended_com_err_fn);

    retval = kadm5_init_krb5_context(&context);
    if (retval) {
	com_err(whoami, retval, gettext("while initializing krb5 library"));
	exit(1);
    }

    while ((optchar = getopt(argc, argv, "x:r:p:kq:w:d:s:mc:t:e:ON")) != EOF) {
	switch (optchar) {
	case 'x':
	    db_args_size++;
	    {
		char **temp = realloc(db_args, sizeof(char*) * (db_args_size+1));
		if (temp == NULL) {
		    fprintf(stderr, gettext("%s: Cannot initialize. Not enough memory\n"),
			    argv[0]);
		    exit(1);
		}

		db_args = temp;
	    }
	    db_args[db_args_size-1] = optarg;
	    db_args[db_args_size]   = NULL;
	    break;

	case 'r':
	    def_realm = optarg;
	    break;
	case 'p':
	    princstr = optarg;
	    break;
	case 'c':
	    ccache_name = optarg;
	    break;
	case 'k':
	    use_keytab++;
	    break;
	case 't':
	    keytab_name = optarg;
	    break;
	case 'w':
	    password = optarg;
	    break;
	case 'q':
	    query = optarg;
	    break;
	case 'd':
	    /* now db_name is not a seperate argument. It has to be passed as part of the db_args */
	    if (!db_name) {
		db_name = malloc(strlen(optarg) + sizeof("dbname="));
	    } else {
		db_name = realloc(db_name, strlen(optarg) + sizeof("dbname="));
	    }

	    strcpy(db_name, "dbname=");
	    strcat(db_name, optarg);

	    db_args_size++;
	    {
		char **temp = realloc(db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */
		if (temp == NULL) {
		    fprintf(stderr,
			    gettext("%s: Cannot initialize. Not enough memory\n"),
			    argv[0]);
		    exit(1);
		}

		db_args = temp;
	    }
	    db_args[db_args_size-1] = db_name;
	    db_args[db_args_size]   = NULL;
	    break;
	case 's':
	    params.admin_server = optarg;
	    params.mask |= KADM5_CONFIG_ADMIN_SERVER;
	    break;
	case 'm':
	    params.mkey_from_kbd = 1;
	    params.mask |= KADM5_CONFIG_MKEY_FROM_KBD;
	    break;
	case 'e':
	    retval = krb5_string_to_keysalts(optarg,
					     ", \t",
					     ":.-",
					     0,
					     &params.keysalts,
					     &params.num_keysalts);
	    if (retval) {
		 com_err(whoami, retval,
			gettext("while parsing keysalts %s"), optarg);
		 exit(1);
	    }
	    params.mask |= KADM5_CONFIG_ENCTYPES;
	    break;
	case 'O':	/* Undocumented option for testing only */
		svcname = KADM5_ADMIN_SERVICE_P;
	    break;
	default:
	    usage(whoami);
	}
    }
    if ((ccache_name && use_keytab) ||
	(keytab_name && !use_keytab))
	 usage(whoami);

    if (def_realm == NULL && krb5_get_default_realm(context, &def_realm)) {
	if (freeprinc)
	    free(princstr);
	fprintf(stderr,
		gettext("%s: unable to get default realm\n"), whoami);
	exit(1);
    }

    params.mask |= KADM5_CONFIG_REALM;
    params.realm = def_realm;

    if (svcname == NULL) {
	if (kadm5_get_adm_host_srv_name(context,
			       def_realm, &svcname)) {
		fprintf(stderr,
			gettext("%s: unable to get host based "
				"service name for realm %s\n"),
			whoami, def_realm);
		if (freeprinc)
			free(princstr);
		exit(1);
	}
    }

    /*
     * Set cc to an open credentials cache, either specified by the -c
     * argument or the default.
     */
    if (ccache_name == NULL) {
	 if ((retval = krb5_cc_default(context, &cc))) {
	      com_err(whoami, retval,
				gettext("while opening default "
					"credentials cache"));
	      exit(1);
	 }
    } else {
	 if ((retval = krb5_cc_resolve(context, ccache_name, &cc))) {
	      com_err(whoami, retval,
			gettext("while opening credentials cache %s"),
			ccache_name);
	      exit(1);
	 }
    }

    /*
     * If no principal name is specified: If a ccache was specified
     * and its primary principal name can be read, it is used, else if
     * a keytab was specified, the principal name is host/hostname,
     * otherwise append "/admin" to the primary name of the default
     * ccache, $USER, or pw_name.
     *
     * Gee, 100+ lines to figure out the client principal name.  This
     * should be compressed...
     */

    if (princstr == NULL) {
	if (ccache_name != NULL &&
	    !krb5_cc_get_principal(context, cc, &princ)) {
	     if ((retval = krb5_unparse_name(context, princ, &princstr))) {
		  com_err(whoami, retval,
			gettext("while canonicalizing principal name"));
		  krb5_free_principal(context, princ);
		  exit(1);
	     }
	     krb5_free_principal(context, princ);
	     freeprinc++;
	} else if (use_keytab != 0) {
	    if ((retval = krb5_sname_to_principal(context, NULL,
						  "host",
						  KRB5_NT_SRV_HST,
						  &princ))) {
		com_err(whoami, retval,
			gettext("creating host service principal"));
		exit(1);
	    }
	    if ((retval = krb5_unparse_name(context, princ, &princstr))) {
		com_err(whoami, retval,
			gettext("while canonicalizing principal name"));
		krb5_free_principal(context, princ);
		exit(1);
	    }
	    krb5_free_principal(context, princ);
	    freeprinc++;
	} else if (!krb5_cc_get_principal(context, cc, &princ)) {
	    char *realm = NULL;
	    if (krb5_unparse_name(context, princ, &canon)) {
		fprintf(stderr,
			gettext("%s: unable to canonicalize "
				"principal\n"), whoami);
		krb5_free_principal(context, princ);
		exit(1);
	    }
	    /* strip out realm of principal if it's there */
	    realm = strchr(canon, '@');
	    while (realm) {
		if (realm - canon && *(realm - 1) != '\\')
		    break;
		else
		    realm = strchr(realm+1, '@');
	    }
	    if (realm)
		*realm++ = '\0';
	    cp = strchr(canon, '/');
	    while (cp) {
		if (cp - canon && *(cp - 1) != '\\')
		    break;
		else
		    cp = strchr(cp+1, '/');
	    }
	    if (cp != NULL)
		*cp = '\0';
	    princstr = (char*)malloc(strlen(canon) + 6 /* "/admin" */ +
				     (realm ? 1 + strlen(realm) : 0) + 1);
	    if (princstr == NULL) {
		fprintf(stderr,
			gettext("%s: out of memory\n"),
			whoami);
		exit(1);
	    }
	    strcpy(princstr, canon);
	    strcat(princstr, "/admin");
	    if (realm) {
		strcat(princstr, "@");
		strcat(princstr, realm);
	    }
	    free(canon);
	    krb5_free_principal(context, princ);
	    freeprinc++;
	} else if ((luser = getenv("USER"))) {
	    princstr = (char *) malloc(strlen(luser) + 7 /* "/admin@" */
				       + strlen(def_realm) + 1);
	    if (princstr == NULL) {
		fprintf(stderr,
			gettext("%s: out of memory\n"),
			whoami);
		exit(1);
	    }
	    strcpy(princstr, luser);
	    strcat(princstr, "/admin");
	    strcat(princstr, "@");
	    strcat(princstr, def_realm);
	    freeprinc++;
	} else if ((pw = getpwuid(getuid()))) {
	    princstr = (char *) malloc(strlen(pw->pw_name) + 7 /* "/admin@" */
				       + strlen(def_realm) + 1);
	    if (princstr == NULL) {
		fprintf(stderr,
			gettext("%s: out of memory\n"),
			whoami);
		exit(1);
	    }
	    strcpy(princstr, pw->pw_name);
	    strcat(princstr, "/admin@");
	    strcat(princstr, def_realm);
	    freeprinc++;
	} else {
	    fprintf(stderr,
			gettext("%s: unable to figure out "
				"a principal name\n"),
		    whoami);
	    exit(1);
	}
    }

    retval = krb5_klog_init(context, "admin_server", whoami, 0);
    if (retval) {
	com_err(whoami, retval, "while setting up logging");
	exit(1);
    }

    /*
     * Initialize the kadm5 connection.  If we were given a ccache,
     * use it.  Otherwise, use/prompt for the password.
     */

    /* Solaris Kerberos:
     * Send warnings to stderr
     */
    if (ccache_name) {
	fprintf(stderr, gettext("Authenticating as principal %s with existing credentials.\n"),
	       princstr);
	retval = kadm5_init_with_creds(princstr, cc,
				       svcname,
				       &params,
				       KADM5_STRUCT_VERSION,
				       KADM5_API_VERSION_2,
				       db_args,
				       &handle);
    } else if (use_keytab) {
	if (keytab_name)
	    fprintf(stderr, gettext("Authenticating as principal %s with keytab %s.\n"),
		   princstr, keytab_name);
	else
	    fprintf(stderr, gettext("Authenticating as principal %s with default keytab.\n"),
		   princstr);
	retval = kadm5_init_with_skey(princstr, keytab_name,
				      svcname,
				      &params,
				      KADM5_STRUCT_VERSION,
				      KADM5_API_VERSION_2,
				      db_args,
				      &handle);
    } else {
	 fprintf(stderr, gettext("Authenticating as principal %s with password.\n"),
	       princstr);
	retval = kadm5_init_with_password(princstr, password,
					  svcname,
					  &params,
					  KADM5_STRUCT_VERSION,
					  KADM5_API_VERSION_2,
					  db_args,
					  &handle);
    }
    if (retval) {
	    if (retval == KADM5_RPC_ERROR_CANTENCODEARGS ||
		retval == KADM5_RPC_ERROR_CANTDECODEARGS) {
		    com_err(whoami, KADM5_RPC_ERROR,
			gettext("while initializing %s interface"), whoami);

		    /* privacy-enabled mech probably not installed/configed */
		    com_err(whoami, retval, gettext("."), whoami);
	    } else {
		    com_err(whoami, retval,
			gettext("while initializing %s interface"), whoami);
	if (retval == KADM5_BAD_CLIENT_PARAMS ||
	    retval == KADM5_BAD_SERVER_PARAMS)
		usage(whoami);
	}
	exit(1);
    }
    if (freeprinc)
	free(princstr);

    if (db_name)
	free(db_name), db_name=NULL;

    if (db_args)
	free(db_args), db_args=NULL;

    if ((retval = krb5_cc_close(context, cc))) {
	 com_err(whoami, retval, gettext("while closing ccache %s"),
		 ccache_name);
	 exit(1);
    }

    /* register the WRFILE keytab type and set it as the default */
    {
#define DEFAULT_KEYTAB "WRFILE:/etc/krb5/krb5.keytab"
	/* XXX krb5_defkeyname is an internal library global and
	   should go away */
	extern char *krb5_defkeyname;
	krb5_defkeyname = DEFAULT_KEYTAB;
    }

    if ((retval = kadm5_init_iprop(handle)) != 0) {
	com_err(whoami, retval, gettext("while mapping update log"));
	exit(1);
    }

    /* Solaris kerberos: fix memory leak */
    if (svcname)
	free(svcname);

    return query;
}

int quit()
{
    kadm5_ret_t retval;

    if (locked) {
	retval = kadm5_unlock(handle);
	if (retval) {
	    com_err("quit", retval, gettext("while unlocking locked database"));
	    return 1;
	}
	locked = 0;
    }

     kadm5_destroy(handle);
     if (ccache_name != NULL) {
	  fprintf(stderr,
			gettext("\n\a\a\aAdministration credentials "
				"NOT DESTROYED.\n"));
     }

     /* insert more random cleanup here */
     krb5_klog_close(context);
     krb5_free_context(context);
     context = NULL;
     return 0;
}

void kadmin_lock(argc, argv)
    int argc;
    char *argv[];
{
    kadm5_ret_t retval;

    if (locked)
	return;
    retval = kadm5_lock(handle);
    if (retval) {
	com_err("lock", retval, "");
	return;
    }
    locked = 1;
}

void kadmin_unlock(argc, argv)
    int argc;
    char *argv[];
{
    kadm5_ret_t retval;

    if (!locked)
	return;
    retval = kadm5_unlock(handle);
    if (retval) {
	com_err("unlock", retval, "");
	return;
    }
    locked = 0;
}

void kadmin_delprinc(argc, argv)
    int argc;
    char *argv[];
{
    kadm5_ret_t retval;
    krb5_principal princ;
    char *canon;
    char reply[32];

    if (! (argc == 2 ||
	   (argc == 3 && !strcmp("-force", argv[1])))) {
	fprintf(stderr, "%s: delete_principal [-force] %s\n",
			gettext("usage"), gettext("principal"));
	return;
    }
    retval = kadmin_parse_name(argv[argc - 1], &princ);
    if (retval) {
	com_err("delete_principal", retval,
			gettext("while parsing principal name"));
	return;
    }
    retval = krb5_unparse_name(context, princ, &canon);
    if (retval) {
	com_err("delete_principal", retval,
			gettext("while canonicalizing principal"));
	krb5_free_principal(context, princ);
	return;
    }
    if (argc == 2) {
	printf(gettext("Are you sure you want to delete "
			    "the principal \"%s\"? (yes/no): "), canon);
	fgets(reply, sizeof (reply), stdin);
		if (strncmp(gettext("yes\n"), reply, sizeof (reply)) &&
			strncmp(gettext("y\n"), reply, sizeof (reply)) &&
			strncmp(gettext("Y\n"), reply, sizeof (reply))) {
			fprintf(stderr,
				gettext("Principal \"%s\" not deleted\n"),
				canon);
	    free(canon);
	    krb5_free_principal(context, princ);
	    return;
	}
    }
    retval = kadm5_delete_principal(handle, princ);
    krb5_free_principal(context, princ);
    if (retval) {
	com_err("delete_principal", retval,
			gettext("while deleting principal \"%s\""), canon);
	free(canon);
	return;
    }
    printf(gettext("Principal \"%s\" deleted.\n"), canon);
	printf(gettext("Make sure that you have removed this principal "
			"from all ACLs before reusing.\n"));
    free(canon);
    return;
}

void kadmin_cpw(argc, argv)
    int argc;
    char *argv[];
{
    kadm5_ret_t retval;
    static char newpw[1024];
    static char prompt1[1024], prompt2[1024];
    char *canon;
    char *pwarg = NULL;
    int n_ks_tuple = 0, randkey = 0;
    krb5_boolean keepold = FALSE;
    krb5_key_salt_tuple *ks_tuple = NULL;
    krb5_principal princ;
    char **db_args = NULL;
    int db_args_size = 0;
    int local_kadmin = 0;

    local_kadmin = (strcmp(whoami, KADMIN_LOCAL_NAME) == 0);

    if (argc < 2) {
	goto usage;
    }
    for (argv++, argc--; argc > 1; argc--, argv++) {
	if (!strcmp("-x", *argv)) {
	    argc--;
	    if (argc < 1) {
		fprintf(stderr, gettext("change_password: missing db argument\n"));
		goto usage;
	    }
	    db_args_size++;
	    {
		char **temp = realloc(db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */
		if (temp == NULL) {
		    fprintf(stderr, gettext("change_password: Not enough memory\n"));
		    free(db_args), db_args = NULL;
		    exit(1);
		}

		db_args = temp;
	    }
	    db_args[db_args_size-1] = *++argv;
	    db_args[db_args_size]   = NULL;
	    continue;
	}
	if (!strcmp("-pw", *argv)) {
	    argc--;
	    if (argc < 1) {
		fprintf(stderr, "change_password: %s",
			gettext("missing password arg\n"));
		goto usage;
	    }
	    pwarg = *++argv;
	    continue;
	}
	if (!strcmp("-randkey", *argv)) {
	    randkey++;
	    continue;
	}
	if (!strcmp("-keepold", *argv)) {
	    keepold = TRUE;
	    continue;
	}
	if (!strcmp("-e", *argv)) {
	    argc--;
	    if (argc < 1) {
		fprintf(stderr, "change_password: %s",
			gettext("missing keysaltlist arg\n"));
		goto usage;
	    }
	    retval = krb5_string_to_keysalts(*++argv, ", \t", ":.-", 0,
					     &ks_tuple, &n_ks_tuple);
	    if (retval) {
		com_err("change_password", retval,
			gettext("while parsing keysalts %s"), *argv);
		return;
	    }
	    continue;
	}
	goto usage;
    }
    if (*argv == NULL) {
	com_err("change_password", 0, "missing principal name");
	goto usage;
    }
    retval = kadmin_parse_name(*argv, &princ);
    if (retval) {
	com_err("change_password", retval,
		gettext("while parsing principal name"));
	if (ks_tuple != NULL)
	    free(ks_tuple);
	if (db_args) free(db_args);
	goto usage;
    }
    retval = krb5_unparse_name(context, princ, &canon);
    if (retval) {
		com_err("change_password", retval,
			gettext("while canonicalizing principal"));
	krb5_free_principal(context, princ);
	if (ks_tuple != NULL)
	    free(ks_tuple);
	if (db_args) free(db_args);
	return;
    }
    if (pwarg != NULL) {
	if (keepold || ks_tuple != NULL) {
	    retval = kadm5_chpass_principal_3(handle, princ, keepold,
					      n_ks_tuple, ks_tuple, pwarg);
	    if (ks_tuple != NULL)
		free(ks_tuple);
	} else {
	    retval = kadm5_chpass_principal(handle, princ, pwarg);
	}
	krb5_free_principal(context, princ);
	if (retval) {
	    com_err("change_password", retval,
				gettext("while changing password for \"%s\"."),
				canon);
	    free(canon);
	    if (db_args) free(db_args);
	    return;
	}
		printf(gettext("Password for \"%s\" changed.\n"), canon);
	free(canon);
	if (db_args) free(db_args);
	return;
    } else if (randkey) {
	if (keepold || ks_tuple != NULL || local_kadmin) {
	    retval = kadm5_randkey_principal_3(handle, princ, keepold,
					       n_ks_tuple, ks_tuple,
					       NULL, NULL);
	    if (ks_tuple != NULL)
		free(ks_tuple);
	} else {
	    retval = kadm5_randkey_principal(handle, princ, NULL, NULL);
	}
	krb5_free_principal(context, princ);
	if (retval) {
	    com_err("change_password", retval,
				gettext("while randomizing key for \"%s\"."),
				canon);
	    free(canon);
	    if (db_args) free(db_args);
	    return;
	}
	printf(gettext("Key for \"%s\" randomized.\n"), canon);
	free(canon);
	if (db_args) free(db_args);
	return;
    } else if (argc == 1) {
	unsigned int i = sizeof (newpw) - 1;

		snprintf(prompt1, sizeof (prompt1),
			gettext("Enter password for principal \"%.900s\""),
			*argv);
		snprintf(prompt2, sizeof (prompt2),
			gettext("Re-enter password for principal \"%.900s\""),
			*argv);
	retval = krb5_read_password(context, prompt1, prompt2,
				    newpw, &i);
	if (retval) {
	    com_err("change_password", retval,
				gettext("while reading password for \"%s\"."),
				canon);
	    free(canon);
	    if (ks_tuple != NULL)
		free(ks_tuple);
	    krb5_free_principal(context, princ);
	    if (db_args) free(db_args);
	    return;
	}
	if (keepold || ks_tuple != NULL) {
	    retval = kadm5_chpass_principal_3(handle, princ, keepold,
					      n_ks_tuple, ks_tuple,
					      newpw);
	    if (ks_tuple != NULL)
		free(ks_tuple);
	} else {
	    retval = kadm5_chpass_principal(handle, princ, newpw);
	}
	krb5_free_principal(context, princ);
	memset(newpw, 0, sizeof (newpw));
	if (retval) {
	    com_err("change_password", retval,
				gettext("while changing password for \"%s\"."),
				canon);
	    free(canon);
	    if (db_args) free(db_args);
	    return;
	}
		printf(gettext("Password for \"%s\" changed.\n"), canon);
	free(canon);
	if (db_args) free(db_args);
	return;
    } else {
	free(canon);
	krb5_free_principal(context, princ);
    usage:
	if (ks_tuple != NULL)
	    free(ks_tuple);
		fprintf(stderr, "%s: change_password [-randkey] [-keepold] "
			"[-e keysaltlist] [-pw password] %s\n",
			gettext("usage"), gettext("principal"));
	return;
    }
}

static void
kadmin_free_tl_data(kadm5_principal_ent_t princ)
{
    krb5_tl_data *tl_data = princ->tl_data;
    int n_tl_data         = princ->n_tl_data;
    int i;

    princ->n_tl_data = 0;
    princ->tl_data   = NULL;

    for (i = 0; tl_data && (i < n_tl_data); i++) {
	krb5_tl_data *next = tl_data->tl_data_next;
	if (tl_data->tl_data_contents)
	    free(tl_data->tl_data_contents);
	free(tl_data);
	tl_data = next;
    }
}

#define KRB5_TL_DB_ARGS 0x7fff
static int
kadmin_parse_princ_args(argc, argv, oprinc, mask, pass, randkey,
			ks_tuple, n_ks_tuple, caller)
    int argc;
    char *argv[];
    kadm5_principal_ent_t oprinc;
    long *mask;
    char **pass;
    int *randkey;
    krb5_key_salt_tuple **ks_tuple;
    int *n_ks_tuple;
    char *caller;
{
    int i, j, attrib_set;
    time_t date;
    time_t now;
    krb5_error_code retval;
    krb5_tl_data *tl_data, *tail = NULL;

    *mask = 0;
    *pass = NULL;
    *n_ks_tuple = 0;
    *ks_tuple = NULL;
    time(&now);
    *randkey = 0;
    for (i = 1; i < argc - 1; i++) {
	attrib_set = 0;
	if (strlen(argv[i]) == 2 &&
	    !strcmp("-x",argv[i])) {
	    if (++i > argc - 2)
		return -1;

	    tl_data = malloc(sizeof(krb5_tl_data));
	    if (tl_data == NULL) {
		fprintf(stderr, gettext("Not enough memory\n"));
		return ENOMEM;
	    }

	    memset(tl_data, 0, sizeof(krb5_tl_data));
	    tl_data->tl_data_type = KRB5_TL_DB_ARGS;
	    tl_data->tl_data_length  = strlen(argv[i])+1;
	    tl_data->tl_data_contents = (unsigned char*)strdup(argv[i]);

	    if (tail) {
		tail->tl_data_next = tl_data;
	    } else {
		oprinc->tl_data = tl_data;
	    }
	    tail = tl_data;
	    oprinc->n_tl_data++;

	    if (tl_data->tl_data_contents == NULL) {
		fprintf(stderr, gettext("Not enough memory\n"));
		return ENOMEM;
	    }
	    *mask |= KADM5_TL_DATA;
	    continue;
	}
	if (strlen(argv[i]) == 7 &&
	    !strcmp("-expire", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		date = get_date(argv[i]);
 		if (date == (time_t)-1) {
		     fprintf(stderr,
						gettext("Invalid date "
							"specification "
							"\"%s\".\n"),
			     argv[i]);
		     return -1;
 		}
		oprinc->princ_expire_time = date;
		*mask |= KADM5_PRINC_EXPIRE_TIME;
		continue;
	    }
	}
	if (strlen(argv[i]) == 9 &&
	    !strcmp("-pwexpire", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		date = get_date(argv[i]);
 		if (date == (time_t)-1) {
		     fprintf(stderr,
						gettext("Invalid date "
							"specification "
							"\"%s\".\n"),
			     argv[i]);
		     return -1;
 		}
		oprinc->pw_expiration = date;
		*mask |= KADM5_PW_EXPIRATION;
		continue;
	    }
	}
	if (strlen(argv[i]) == 8 &&
	    !strcmp("-maxlife", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		date = get_date(argv[i]);
 		if (date == (time_t)-1) {
					fprintf(stderr,
						gettext("Invalid date "
							"specification "
							"\"%s\".\n"),
			     argv[i]);
		     return -1;
 		}
		oprinc->max_life = date - now;
		*mask |= KADM5_MAX_LIFE;
		continue;
	    }
	}
	if (strlen(argv[i]) == 13 &&
	    !strcmp("-maxrenewlife", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		date = get_date(argv[i]);
 		if (date == (time_t)-1) {
					fprintf(stderr,
						gettext("Invalid date "
							"specification "
							"\"%s\".\n"),
			     argv[i]);
		     return -1;
 		}
		oprinc->max_renewable_life = date - now;
		*mask |= KADM5_MAX_RLIFE;
		continue;
	    }
	}
	if (strlen(argv[i]) == 5 &&
	    !strcmp("-kvno", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		oprinc->kvno = atoi(argv[i]);
		*mask |= KADM5_KVNO;
		continue;
	    }
	}
	if (strlen(argv[i]) == 7 &&
	    !strcmp("-policy", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		oprinc->policy = argv[i];
		*mask |= KADM5_POLICY;
		continue;
	    }
	}
	if (strlen(argv[i]) == 12 &&
	    !strcmp("-clearpolicy", argv[i])) {
	    oprinc->policy = NULL;
	    *mask |= KADM5_POLICY_CLR;
	    continue;
	}
	if (strlen(argv[i]) == 3 &&
	    !strcmp("-pw", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		*pass = argv[i];
		continue;
	    }
	}
	if (strlen(argv[i]) == 8 &&
	    !strcmp("-randkey", argv[i])) {
	    ++*randkey;
	    continue;
	}
	if (!strcmp("-e", argv[i])) {
	    if (++i > argc - 2)
		return -1;
	    else {
		retval = krb5_string_to_keysalts(argv[i], ", \t", ":.-", 0,
						 ks_tuple, n_ks_tuple);
		if (retval) {
		    com_err(caller, retval,
			    gettext("while parsing keysalts %s"), argv[i]);
		    return -1;
		}
	    }
	    continue;
	}
	for (j = 0; j < sizeof (flags) / sizeof (struct pflag); j++) {
	    if (strlen(argv[i]) == flags[j].flaglen + 1 &&
		!strcmp(flags[j].flagname,
			&argv[i][1] /* strip off leading + or - */)) {
		if ((flags[j].set && argv[i][0] == '-') ||
		    (!flags[j].set && argv[i][0] == '+')) {
		    oprinc->attributes |= flags[j].theflag;
		    *mask |= KADM5_ATTRIBUTES;
		    attrib_set++;
		    break;
		} else if ((flags[j].set && argv[i][0] == '+') ||
			   (!flags[j].set && argv[i][0] == '-')) {
		    oprinc->attributes &= ~flags[j].theflag;
		    *mask |= KADM5_ATTRIBUTES;
		    attrib_set++;
		    break;
		} else {
		    return -1;
		}
	    }
	}
	if (!attrib_set)
	    return -1;		/* nothing was parsed */
    }
    if (i != argc - 1) {
	return -1;
    }
    retval = kadmin_parse_name(argv[i], &oprinc->principal);
    if (retval) {
	com_err(caller, retval, gettext("while parsing principal"));
	return -1;
    }
    return 0;
}

static void
kadmin_addprinc_usage(func)
    char *func;
{
	fprintf(stderr, "%s: %s %s\n", gettext("usage"), func,
		gettext("[options] principal"));
	fprintf(stderr, gettext("\toptions are:\n"));
	fprintf(stderr, "\t\t[-expire expdate] [-pwexpire pwexpdate] "
		"[-maxlife maxtixlife]\n\t\t[-kvno kvno] [-policy policy] "
		"[-randkey] [-pw password]\n\t\t[-maxrenewlife maxrenewlife] "
		"[-e keysaltlist] [{+|-}attribute]\n");
	fprintf(stderr, gettext("\tattributes are:\n"));
     fprintf(stderr, "%s%s%s",
		"\t\tallow_postdated allow_forwardable allow_tgs_req "
		"allow_renewable\n",
		"\t\tallow_proxiable allow_dup_skey allow_tix "
		"requires_preauth\n",
		"\t\trequires_hwauth needchange allow_svr "
		"password_changing_service\n");
}

static void
kadmin_modprinc_usage(func)
    char *func;
{
	fprintf(stderr, "%s: %s %s\n", gettext("usage"), func,
		gettext("[options] principal"));
	fprintf(stderr, gettext("\toptions are:\n"));
	fprintf(stderr, "\t\t[-expire expdate] [-pwexpire pwexpdate] "
		"[-maxlife maxtixlife]\n\t\t[-kvno kvno] [-policy policy] "
		"[-clearpolicy]\n\t\t[-maxrenewlife maxrenewlife] "
		"[{+|-}attribute]\n");
	fprintf(stderr, gettext("\tattributes are:\n"));
     fprintf(stderr, "%s%s%s",
		"\t\tallow_postdated allow_forwardable allow_tgs_req "
		"allow_renewable\n",
		"\t\tallow_proxiable allow_dup_skey allow_tix "
		"requires_preauth\n",
		"\t\trequires_hwauth needchange allow_svr "
		"password_changing_service\n");
}

void kadmin_addprinc(argc, argv)
    int argc;
    char *argv[];
{
    kadm5_principal_ent_rec princ, dprinc;
    kadm5_policy_ent_rec defpol;
    long mask;
    int randkey = 0, i;
    int n_ks_tuple;
    krb5_key_salt_tuple *ks_tuple;
    char *pass, *canon;
    krb5_error_code retval;
    static char newpw[1024], dummybuf[256];
    static char prompt1[1024], prompt2[1024];
    int local_kadmin = 0;

    local_kadmin = (strcmp(whoami, KADMIN_LOCAL_NAME) == 0);

    if (dummybuf[0] == 0) {
	for (i = 0; i < 256; i++)
	    dummybuf[i] = (i+1) % 256;
    }

    /* Zero all fields in request structure */
    memset(&princ, 0, sizeof(princ));
    memset(&dprinc, 0, sizeof(dprinc));

    princ.attributes = dprinc.attributes = 0;
    if (kadmin_parse_princ_args(argc, argv,
				&princ, &mask, &pass, &randkey,
				&ks_tuple, &n_ks_tuple,
				"add_principal")) {
	kadmin_addprinc_usage("add_principal");
	kadmin_free_tl_data(&princ); /* need to free ks_tuple also??? */
	return;
    }

    retval = krb5_unparse_name(context, princ.principal, &canon);
    if (retval) {
	com_err("add_principal",
		retval, gettext("while canonicalizing principal"));
	krb5_free_principal(context, princ.principal);
	if (ks_tuple != NULL)
	    free(ks_tuple);
	kadmin_free_tl_data(&princ);
	return;
    }

    /*
     * If -policy was not specified, and -clearpolicy was not
     * specified, and the policy "default" exists, assign it.  If
     * -clearpolicy was specified, then KADM5_POLICY_CLR should be
     * unset, since it is never valid for kadm5_create_principal.
     */
    if ((! (mask & KADM5_POLICY)) &&
	(! (mask & KADM5_POLICY_CLR))) {
	if (! kadm5_get_policy(handle, "default", &defpol)) {
	    fprintf(stderr,
		    gettext("NOTICE: no policy specified for %s; assigning \"default\"\n"),
		    canon);
	    princ.policy = "default";
	    mask |= KADM5_POLICY;
	    (void) kadm5_free_policy_ent(handle, &defpol);
	} else
	    fprintf(stderr,
		    gettext("WARNING: no policy specified for %s; defaulting to no policy\n"),
		    canon);
    }
    mask &= ~KADM5_POLICY_CLR;

    /*
     * Set 'notix' for randkey principals and also for principals which have
     * specified flag options on the cmdline. This is because we want to apply
     * generic flag settings from 'default_principal_flags' first (during
     * principal creation), followed by a kadm5_modify_principal() which
     * correctly applies the cli flag options. So, we do *not* want any tix
     * issued in the interim.
     */
    if (randkey || (mask & KADM5_ATTRIBUTES))
	princ.attributes |= KRB5_KDB_DISALLOW_ALL_TIX;

    if (randkey) {
	mask |= KADM5_ATTRIBUTES;
	pass = dummybuf;
    } else if (pass == NULL) {
	unsigned int sz = sizeof (newpw) - 1;
	snprintf(prompt1, sizeof (prompt1),
		gettext("Enter password for principal \"%.900s\""),
		canon);
	snprintf(prompt2, sizeof (prompt1),
		gettext("Re-enter password for principal \"%.900s\""),
		canon);
	retval = krb5_read_password(context, prompt1, prompt2,
				    newpw, &sz);
	if (retval) {
	    com_err("add_principal", retval,
		gettext("while reading password for \"%s\"."), canon);
	    free(canon);
	    krb5_free_principal(context, princ.principal);
	    kadmin_free_tl_data(&princ);
	    return;
	}
	pass = newpw;
    }
    mask |= KADM5_PRINCIPAL;

    /*
     * If the client being used is local, always use the new
     * API so we get the full set of enctype support.
     */
    if (ks_tuple != NULL || local_kadmin) {
	retval = kadm5_create_principal_3(handle, &princ, mask,
					  n_ks_tuple, ks_tuple, pass);
    } else {
	retval = kadm5_create_principal(handle, &princ, mask, pass);
    }
    if (retval) {
	com_err("add_principal", retval,
		gettext("while creating \"%s\"."), canon);
	krb5_free_principal(context, princ.principal);
	free(canon);
	if (ks_tuple != NULL)
	    free(ks_tuple);
	kadmin_free_tl_data(&princ);
	return;
    }
    if (randkey) {		/* more special stuff for -randkey */
	if (ks_tuple != NULL || local_kadmin) {
	    retval = kadm5_randkey_principal_3(handle, princ.principal,
					       FALSE,
					       n_ks_tuple, ks_tuple,
					       NULL, NULL);
	} else {
	    retval = kadm5_randkey_principal(handle, princ.principal,
					     NULL, NULL);
	}
	if (retval) {
	    com_err("add_principal", retval,
		gettext("while randomizing key for \"%s\"."), canon);
	    krb5_free_principal(context, princ.principal);
	    free(canon);
	    if (ks_tuple != NULL)
		free(ks_tuple);
	    kadmin_free_tl_data(&princ);
	    return;
	}
    }

    /*
     * We now retrieve the intersection set of the generic flag settings and
     * the ones specified on the cli & re-parse the princ args, just to make
     * sure we account for conflicts between 'default_principal_flags' and
     * the cmdline flag args. While we are here, also clear 'notix'.
     */
    if (randkey || (mask & KADM5_ATTRIBUTES)) {
	retval = kadm5_get_principal(handle, princ.principal, &dprinc,
			KADM5_PRINCIPAL_NORMAL_MASK);
        if (retval == 0) {
	    if (dprinc.attributes != 0)
		princ.attributes = dprinc.attributes;
	} else {
	    com_err("add_principal", retval,
		gettext("while doing a get_principal on \"%s\"."), canon);
	    printf(gettext("\nWarning: Principal \"%s\" could have incomplete "
		"flag settings, as a result of a failed get_principal.\n"
		"Check the 'default_principal_flags' setting in kdc.conf(5).\n"
		"If there is a mismatch, use modprinc in kadmin(8) to rectify "
		"the same.\n\n"), canon);
	}

	/*
	 * Solaris Kerberos: We unset KRB5_KDB_DISALLOW_ALL_TIX before
	 * kadmin_parse_princ_args is called, because -allow_tix may
	 * have been an argument.  We still have to unset here because
	 * kadmin_parse_princ_args will not reset the attribute unless
	 * it is was explicity defined.
	 */
	princ.attributes &= ~KRB5_KDB_DISALLOW_ALL_TIX;
	(void) kadmin_parse_princ_args(argc, argv, &princ, &mask, &pass,
			&randkey, &ks_tuple, &n_ks_tuple, "add_principal");
	mask = KADM5_ATTRIBUTES;
	retval = kadm5_modify_principal(handle, &princ, mask);
	if (retval) {
	    com_err("add_principal", retval,
		gettext("while doing a modify_principal to restore flag "
			"settings for \"%s\"."), canon);
	    krb5_free_principal(context, princ.principal);
	    free(canon);
	    if (ks_tuple != NULL)
		free(ks_tuple);
	    kadmin_free_tl_data(&princ);
	    return;
	}
    }
    krb5_free_principal(context, princ.principal);
	printf(gettext("Principal \"%s\" created.\n"), canon);
    if (ks_tuple != NULL)
	free(ks_tuple);
    free(canon);
    kadmin_free_tl_data(&princ);

}

void kadmin_modprinc(argc, argv)
    int argc;
    char *argv[];
{
    kadm5_principal_ent_rec princ, oldprinc;
    krb5_principal kprinc;
    long mask;
    krb5_error_code retval;
    char *pass, *canon;
    int randkey = 0;
    int n_ks_tuple = 0;
    krb5_key_salt_tuple *ks_tuple;

    if (argc < 2) {
	kadmin_modprinc_usage("modify_principal");
	return;
    }

    memset(&oldprinc, 0, sizeof(oldprinc));
    memset(&princ, 0, sizeof(princ));

    retval = kadmin_parse_name(argv[argc - 1], &kprinc);
    if (retval) {
	com_err("modify_principal", retval,
			gettext("while parsing principal"));
	return;
    }
    retval = krb5_unparse_name(context, kprinc, &canon);
    if (retval) {
	com_err("modify_principal", retval,
			gettext("while canonicalizing principal"));
	krb5_free_principal(context, kprinc);
	return;
    }
    retval = kadm5_get_principal(handle, kprinc, &oldprinc,
				 KADM5_PRINCIPAL_NORMAL_MASK);
    krb5_free_principal(context, kprinc);
    if (retval) {
	com_err("modify_principal", retval,
			gettext("while getting \"%s\"."), canon);
	free(canon);
	return;
    }
    princ.attributes = oldprinc.attributes;
    kadm5_free_principal_ent(handle, &oldprinc);
    retval = kadmin_parse_princ_args(argc, argv,
				     &princ, &mask,
				     &pass, &randkey,
				     &ks_tuple, &n_ks_tuple,
				     "modify_principal");
    if (ks_tuple != NULL) {
	free(ks_tuple);
	kadmin_modprinc_usage("modify_principal");
	free(canon);
	kadmin_free_tl_data(&princ);
	return;
    }
    if (retval) {
	kadmin_modprinc_usage("modify_principal");
	free(canon);
	kadmin_free_tl_data(&princ);
	return;
    }
    if (randkey) {
		fprintf(stderr, "modify_principal: -randkey %s ",
			gettext("not allowed\n"));
	krb5_free_principal(context, princ.principal);
	free(canon);
	kadmin_free_tl_data(&princ);
	return;
    }
    if (pass) {
	fprintf(stderr,
		"modify_principal: -pw %s change_password\n",
		gettext("not allowed; use"));
	krb5_free_principal(context, princ.principal);
	free(canon);
	kadmin_free_tl_data(&princ);
	return;
    }
    retval = kadm5_modify_principal(handle, &princ, mask);
    krb5_free_principal(context, princ.principal);
    if (retval) {
	com_err("modify_principal", retval,
			gettext("while modifying \"%s\"."), canon);
	free(canon);
	kadmin_free_tl_data(&princ);
	return;
    }
	printf(gettext("Principal \"%s\" modified.\n"), canon);
    kadmin_free_tl_data(&princ);
    free(canon);
}

void kadmin_getprinc(argc, argv)
    int argc;
    char *argv[];
{
    kadm5_principal_ent_rec dprinc;
    krb5_principal princ;
    krb5_error_code retval;
    char *canon, *modcanon;
    int i;

    if (! (argc == 2 ||
	   (argc == 3 && !strcmp("-terse", argv[1])))) {
		fprintf(stderr, "%s: get_principal [-terse] %s\n",
			gettext("usage"), gettext("principal"));
	return;
    }


    memset(&dprinc, 0, sizeof(dprinc));
    memset(&princ, 0, sizeof(princ));

    retval = kadmin_parse_name(argv[argc - 1], &princ);
    if (retval) {
	com_err("get_principal", retval,
			gettext("while parsing principal"));
	return;
    }
    retval = krb5_unparse_name(context, princ, &canon);
    if (retval) {
	com_err("get_principal", retval,
			gettext("while canonicalizing principal"));
	krb5_free_principal(context, princ);
	return;
    }
    retval = kadm5_get_principal(handle, princ, &dprinc,
				 KADM5_PRINCIPAL_NORMAL_MASK | KADM5_KEY_DATA);
    krb5_free_principal(context, princ);
    if (retval) {
	com_err("get_principal", retval,
			gettext("while retrieving \"%s\"."), canon);
	free(canon);
	return;
    }
    retval = krb5_unparse_name(context, dprinc.mod_name, &modcanon);
    if (retval) {
	com_err("get_principal", retval,
			gettext("while unparsing modname"));
	kadm5_free_principal_ent(handle, &dprinc);
	free(canon);
	return;
    }
    if (argc == 2) {
		printf(gettext("Principal: %s\n"), canon);
		printf(gettext("Expiration date: %s\n"),
		    dprinc.princ_expire_time ?
		    strdate(dprinc.princ_expire_time) :
		    gettext("[never]"));
		printf(gettext("Last password change: %s\n"),
		    dprinc.last_pwd_change ?
		    strdate(dprinc.last_pwd_change) :
		    gettext("[never]"));
		printf(gettext("Password expiration date: %s\n"),
	       dprinc.pw_expiration ?
		    strdate(dprinc.pw_expiration) : gettext("[none]"));
		printf(gettext("Maximum ticket life: %s\n"),
		    strdur(dprinc.max_life));
		printf(gettext("Maximum renewable life: %s\n"),
		    strdur(dprinc.max_renewable_life));
		printf(gettext("Last modified: %s (%s)\n"),
		    strdate(dprinc.mod_date), modcanon);
		printf(gettext("Last successful authentication: %s\n"),
	       dprinc.last_success ? strdate(dprinc.last_success) :
		    gettext("[never]"));
		printf(gettext("Last failed authentication: %s\n"),
	       dprinc.last_failed ? strdate(dprinc.last_failed) :
		    gettext("[never]"));
		printf(gettext("Failed password attempts: %d\n"),
	       dprinc.fail_auth_count);
		printf(gettext("Number of keys: %d\n"), dprinc.n_key_data);
	for (i = 0; i < dprinc.n_key_data; i++) {
	    krb5_key_data *key_data = &dprinc.key_data[i];
	    char enctype[BUFSIZ], salttype[BUFSIZ];

	    if (krb5_enctype_to_string(key_data->key_data_type[0],
				       enctype, sizeof(enctype)))
		snprintf(enctype, sizeof (enctype), gettext("<Encryption type 0x%x>"),
			key_data->key_data_type[0]);
	    printf("Key: vno %d, %s, ", key_data->key_data_kvno, enctype);
	    if (key_data->key_data_ver > 1) {
		if (krb5_salttype_to_string(key_data->key_data_type[1],
					    salttype, sizeof(salttype)))
		    snprintf(salttype, sizeof(salttype), gettext("<Salt type 0x%x>"),
			    key_data->key_data_type[1]);
		printf("%s\n", salttype);
	    } else
		printf(gettext("no salt\n"));
	}

	printf(gettext("Attributes:"));
	for (i = 0; i < sizeof (prflags) / sizeof (char *); i++) {
	    if (dprinc.attributes & (krb5_flags) 1 << i)
		printf(" %s", prflags[i]);
	}
	printf("\n");
		printf(gettext("Policy: %s\n"),
		    dprinc.policy ? dprinc.policy : gettext("[none]"));
    } else {
	printf("\"%s\"\t%d\t%d\t%d\t%d\t\"%s\"\t%d\t%d\t%d\t%d\t\"%s\""
	       "\t%d\t%d\t%d\t%d\t%d",
	       canon, dprinc.princ_expire_time, dprinc.last_pwd_change,
	       dprinc.pw_expiration, dprinc.max_life, modcanon,
	       dprinc.mod_date, dprinc.attributes, dprinc.kvno,
	       dprinc.mkvno, dprinc.policy ? dprinc.policy : gettext("[none]"),
	       dprinc.max_renewable_life, dprinc.last_success,
	       dprinc.last_failed, dprinc.fail_auth_count,
	       dprinc.n_key_data);
	for (i = 0; i < dprinc.n_key_data; i++)
	    printf("\t%d\t%d\t%d\t%d",
		   dprinc.key_data[i].key_data_ver,
		   dprinc.key_data[i].key_data_kvno,
		   dprinc.key_data[i].key_data_type[0],
		   dprinc.key_data[i].key_data_type[1]);
	printf("\n");
    }
    free(modcanon);
    kadm5_free_principal_ent(handle, &dprinc);
    free(canon);
}

void kadmin_getprincs(argc, argv)
    int argc;
    char *argv[];
{
    krb5_error_code retval;
    char *expr, **names;
    int i, count;

	FILE *output;
	int fd;
	struct sigaction nsig, osig;
	sigset_t nmask, omask;
	int waitb;

    expr = NULL;
    if (! (argc == 1 || (argc == 2 && (expr = argv[1])))) {
		fprintf(stderr, "%s: get_principals %s\n",
			gettext("usage"), gettext("[expression]"));
	return;
    }
    retval = kadm5_get_principals(handle, expr, &names, &count);
    if (retval) {
	com_err("get_principals", retval,
			gettext("while retrieving list."));
	return;
    }

	/*
	 * Solaris:  the following code is used for paging
	 */

	sigemptyset(&nmask);
	sigaddset(&nmask, SIGINT);
	sigprocmask(SIG_BLOCK, &nmask, &omask);

	nsig.sa_handler = SIG_IGN;
	sigemptyset(&nsig.sa_mask);
	nsig.sa_flags = 0;
	sigaction(SIGINT, &nsig, &osig);

	fd = ss_pager_create();
	output = fdopen(fd, "w");

	sigprocmask(SIG_SETMASK, &omask, (sigset_t *)0);

    for (i = 0; i < count; i++)
	 fprintf(output, "%s\n", names[i]);

	fclose(output);

	wait(&waitb);

	/* Solaris Kerberos:
	 * Restore the original handler for SIGINT
	 */
	if (sigaction(SIGINT, &osig, (struct sigaction *)0) == -1) {
		perror("sigaction");
	}

    kadm5_free_name_list(handle, names, count);
}

static int
kadmin_parse_policy_args(argc, argv, policy, mask, caller)
    int argc;
    char *argv[];
    kadm5_policy_ent_t policy;
    long *mask;
    char *caller;
{
    int i;
    time_t now;
    time_t date;

    time(&now);
    *mask = 0;
    for (i = 1; i < argc - 1; i++) {
	if (strlen(argv[i]) == 8 &&
	    !strcmp(argv[i], "-maxlife")) {
	    if (++i > argc -2)
		return -1;
	    else {
		date = get_date(argv[i]);
		if (date == (time_t)-1) {
		    fprintf(stderr, gettext("Invalid date specification \"%s\".\n"),
			    argv[i]);
		    return -1;
		}
		policy->pw_max_life = date - now;
		*mask |= KADM5_PW_MAX_LIFE;
		continue;
	    }
	} else if (strlen(argv[i]) == 8 &&
		   !strcmp(argv[i], "-minlife")) {
	    if (++i > argc - 2)
		return -1;
	    else {
		date = get_date(argv[i]);
		if (date == (time_t)-1) {
		    fprintf(stderr, gettext("Invalid date specification \"%s\".\n"),
			    argv[i]);
		    return -1;
		}
		policy->pw_min_life = date - now;
		*mask |= KADM5_PW_MIN_LIFE;
		continue;
	    }
	} else if (strlen(argv[i]) == 10 &&
		   !strcmp(argv[i], "-minlength")) {
	    if (++i > argc - 2)
		return -1;
	    else {
		policy->pw_min_length = atoi(argv[i]);
		*mask |= KADM5_PW_MIN_LENGTH;
		continue;
	    }
	} else if (strlen(argv[i]) == 11 &&
		   !strcmp(argv[i], "-minclasses")) {
	    if (++i > argc - 2)
		return -1;
	    else {
		policy->pw_min_classes = atoi(argv[i]);
		*mask |= KADM5_PW_MIN_CLASSES;
		continue;
	    }
	} else if (strlen(argv[i]) == 8 &&
		   !strcmp(argv[i], "-history")) {
	    if (++i > argc - 2)
		return -1;
	    else {
		policy->pw_history_num = atoi(argv[i]);
		*mask |= KADM5_PW_HISTORY_NUM;
		continue;
	    }
	} else
	    return -1;
    }
    if (i != argc -1) {
	fprintf(stderr, gettext("%s: parser lost count!\n"), caller);
	return -1;
    } else
	return 0;
}

static void
kadmin_addmodpol_usage(func)
    char *func;
{
	fprintf(stderr, "%s: %s %s\n", gettext("usage"), func,
		gettext("[options] policy"));
	fprintf(stderr, gettext("\toptions are:\n"));
	fprintf(stderr, "\t\t[-maxlife time] [-minlife time] "
		"[-minlength length]\n\t\t[-minclasses number] "
		"[-history number]\n");
}

void kadmin_addpol(argc, argv)
    int argc;
    char *argv[];
{
    krb5_error_code retval;
    long mask;
    kadm5_policy_ent_rec policy;

    memset(&policy, 0, sizeof(policy));
    if (kadmin_parse_policy_args(argc, argv, &policy, &mask, "add_policy")) {
	kadmin_addmodpol_usage("add_policy");
	return;
    } else {
	policy.policy = argv[argc - 1];
	mask |= KADM5_POLICY;
	retval = kadm5_create_policy(handle, &policy, mask);
	if (retval) {
			com_err("add_policy", retval,
				gettext("while creating policy \"%s\"."),
		    policy.policy);
	    return;
	}
    }
    return;
}

void kadmin_modpol(argc, argv)
    int argc;
    char *argv[];
{
    krb5_error_code retval;
    long mask;
    kadm5_policy_ent_rec policy;

    memset(&policy, 0, sizeof(policy));
    if (kadmin_parse_policy_args(argc, argv, &policy, &mask,
				 "modify_policy")) {
	kadmin_addmodpol_usage("modify_policy");
	return;
    } else {
	policy.policy = argv[argc - 1];
	retval = kadm5_modify_policy(handle, &policy, mask);
	if (retval) {
	    com_err("modify_policy", retval, gettext("while modifying policy \"%s\"."),
		    policy.policy);
	    return;
	}
    }
    return;
}

void kadmin_delpol(argc, argv)
    int argc;
    char *argv[];
{
    krb5_error_code retval;
    char reply[32];

    if (! (argc == 2 ||
	   (argc == 3 && !strcmp("-force", argv[1])))) {
	fprintf(stderr, "%s: delete_policy [-force] %s\n",
			gettext("usage"), gettext("policy"));
	return;
    }
    if (argc == 2) {
		printf(gettext("Are you sure you want to delete the policy "
			    "\"%s\"? (yes/no): "), argv[1]);
	fgets(reply, sizeof (reply), stdin);
		if (strncmp(gettext("yes\n"), reply, sizeof (reply)) &&
			strncmp(gettext("y\n"), reply, sizeof (reply)) &&
			strncmp(gettext("Y\n"), reply, sizeof (reply))
			) {
			fprintf(stderr,
				gettext("Policy \"%s\" not deleted.\n"),
				argv[1]);
	    return;
	}
    }
    retval = kadm5_delete_policy(handle, argv[argc - 1]);
    if (retval) {
		com_err("delete_policy:", retval,
			gettext("while deleting policy \"%s\""),
		argv[argc - 1]);
	return;
    }
    return;
}

void kadmin_getpol(argc, argv)
    int argc;
    char *argv[];
{
    krb5_error_code retval;
    kadm5_policy_ent_rec policy;

    if (! (argc == 2 ||
	   (argc == 3 && !strcmp("-terse", argv[1])))) {
		fprintf(stderr, "%s: get_policy [-terse] %s\n",
			gettext("usage"), gettext("policy"));
	return;
    }
    retval = kadm5_get_policy(handle, argv[argc - 1], &policy);
    if (retval) {
		com_err("get_policy", retval,
			gettext("while retrieving policy \"%s\"."),
		argv[argc - 1]);
	return;
    }
    if (argc == 2) {
		printf(gettext("Policy: %s\n"), policy.policy);
		printf(gettext("Maximum password life: %ld\n"),
		    policy.pw_max_life);
		printf(gettext("Minimum password life: %ld\n"),
		    policy.pw_min_life);
		printf(gettext("Minimum password length: %ld\n"),
		    policy.pw_min_length);
		printf(gettext("Minimum number of password "
			    "character classes: %ld\n"),
	       policy.pw_min_classes);
		printf(gettext("Number of old keys kept: %ld\n"),
		    policy.pw_history_num);
		printf(gettext("Reference count: %ld\n"), policy.policy_refcnt);
    } else {
	printf("\"%s\"\t%ld\t%ld\t%ld\t%ld\t%ld\t%ld\n",
	       policy.policy, policy.pw_max_life, policy.pw_min_life,
	       policy.pw_min_length, policy.pw_min_classes,
	       policy.pw_history_num, policy.policy_refcnt);
    }
    kadm5_free_policy_ent(handle, &policy);
    return;
}

void kadmin_getpols(argc, argv)
    int argc;
    char *argv[];
{
    krb5_error_code retval;
    char *expr, **names;
    int i, count;

    /* Solaris Kerberos:
     * Use a pager for listing policies (similar to listing princs)
     */
    FILE *output = NULL;
    int fd;
    struct sigaction nsig, osig;
    sigset_t nmask, omask;
    int waitb;

    expr = NULL;
    if (! (argc == 1 || (argc == 2 && (expr = argv[1])))) {
	fprintf(stderr, "%s: get_policies %s\n",
			gettext("usage"), gettext("[expression]\n"));
	return;
    }
    retval = kadm5_get_policies(handle, expr, &names, &count);
    if (retval) {
	com_err("get_policies", retval,
			gettext("while retrieving list."));
	return;
    }

    if (sigemptyset(&nmask) == -1) {
        perror("sigemptyset");
        kadm5_free_name_list(handle, names, count);
        return;
    }

    if (sigaddset(&nmask, SIGINT) == -1) {
        perror("sigaddset");
        kadm5_free_name_list(handle, names, count);
        return;
    }

    if (sigemptyset(&nsig.sa_mask) == -1) {
        perror("sigemptyset");
        kadm5_free_name_list(handle, names, count);
        return;
    }

    if (sigprocmask(SIG_BLOCK, &nmask, &omask) == -1) {
        perror("sigprocmask");
        kadm5_free_name_list(handle, names, count);
        return;
    }

    nsig.sa_handler = SIG_IGN;
    nsig.sa_flags = 0;
    if (sigaction(SIGINT, &nsig, &osig) == -1) {
        perror("sigaction");
        if (sigprocmask(SIG_SETMASK, &omask, (sigset_t *)0) == -1) {
            perror("sigprocmask");
        }
        kadm5_free_name_list(handle, names, count);
        return;
    }

    fd = ss_pager_create();
    if (fd == -1) {
        fprintf(stderr, "%s: failed to create pager\n", whoami);
        if (sigprocmask(SIG_SETMASK, &omask, (sigset_t *)0) == -1) {
            perror("sigprocmask");
        }

        if (sigaction(SIGINT, &osig, (struct sigaction *)0) == -1) {
            perror("sigaction");
        }

        kadm5_free_name_list(handle, names, count);
        return;
    }

    output = fdopen(fd, "w");
    if (output == NULL) {
        perror("fdopen");
    }

    if (sigprocmask(SIG_SETMASK, &omask, (sigset_t *)0) == -1) {
        perror("sigprocmask");
    }

    if (output != NULL) {
        for (i = 0; i < count; i++)
        fprintf(output, "%s\n", names[i]);
    }

    if (output != NULL && fclose(output) != 0) {
        perror("fclose");
    }

    if (wait(&waitb) == -1) {
        perror("wait");
    }

    if (sigaction(SIGINT, &osig, (struct sigaction *)0) == -1) {
        perror("sigaction");
    }
    kadm5_free_name_list(handle, names, count);
}
/*
 * kadmin/cli/kadmin.h
 *
 * Copyright 2001 by the Massachusetts Institute of Technology.
 * All Rights Reserved.
 *
 * Export of this software from the United States of America may
 *   require a specific license from the United States Government.
 *   It is the responsibility of any person or organization contemplating
 *   export to obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  Furthermore if you modify this software you must label
 * your software as modified software and not distribute it in such a
 * fashion that it might be confused with the original M.I.T. software.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 *
 * Prototypes for kadmin functions called from SS library.
 */

#ifndef __KADMIN_H__
#define __KADMIN_H__

/* It would be nice if ss produced a header file we could reference */
extern char *kadmin_startup(int argc, char *argv[]);
extern int quit (void);
extern void kadmin_lock(int argc, char *argv[]);
extern void kadmin_unlock(int argc, char *argv[]);
extern void kadmin_delprinc(int argc, char *argv[]);
extern void kadmin_cpw(int argc, char *argv[]);
extern void kadmin_addprinc(int argc, char *argv[]);
extern void kadmin_modprinc(int argc, char *argv[]);
extern void kadmin_getprinc(int argc, char *argv[]);
extern void kadmin_getprincs(int argc, char *argv[]);
extern void kadmin_addpol(int argc, char *argv[]);
extern void kadmin_modpol(int argc, char *argv[]);
extern void kadmin_delpol(int argc, char *argv[]);
extern void kadmin_getpol(int argc, char *argv[]);
extern void kadmin_getpols(int argc, char *argv[]);
extern void kadmin_getprivs(int argc, char *argv[]);
extern void kadmin_keytab_add(int argc, char *argv[]);
extern void kadmin_keytab_remove(int argc, char *argv[]);

#ifdef TIME_WITH_SYS_TIME
#include <sys/time.h>
#include <time.h>
#else
#ifdef HAVE_SYS_TIME_H
#include <sys/time.h>
#else
#include <time.h>
#endif
#endif

extern time_t get_date(char *);

/* Yucky global variables */
extern krb5_context context;
extern char *krb5_defkeyname;
extern char *whoami;
extern void *handle;

#endif /* __KADMIN_H__ */

/*
 * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
 *
 *	Openvision retains the copyright to derivative works of
 *	this source code.  Do *NOT* create a derivative of this
 *	source code before consulting with your legal department.
 *	Do *NOT* integrate *ANY* of this source code into another
 *	product before consulting with your legal department.
 *
 *	For further information, read the top-level Openvision
 *	copyright which is contained in the top-level MIT Kerberos
 *	copyright.
 *
 * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
 *
 */



/* kadmin_ct.c - automatically generated from kadmin_ct.ct */
/* Above no longer appears to be true */

/*
 * I18n hack. We sill define gettext(s) to be s here. That way the info_strings
 * will be extracted to the .po file.
 */

#define	gettext(s) s

#include <ss/ss.h>

#ifndef __STDC__
#define const
#endif

static char const * const ssu00001[] = {
"add_principal",
    "addprinc",
    "ank",
    (char const *)0
};
extern void kadmin_addprinc __SS_PROTO;
static char const * const ssu00002[] = {
"delete_principal",
    "delprinc",
    (char const *)0
};
extern void kadmin_delprinc __SS_PROTO;
static char const * const ssu00003[] = {
"modify_principal",
    "modprinc",
    (char const *)0
};
extern void kadmin_modprinc __SS_PROTO;
static char const * const ssu00004[] = {
"change_password",
    "cpw",
    (char const *)0
};
extern void kadmin_cpw __SS_PROTO;
static char const * const ssu00005[] = {
"get_principal",
    "getprinc",
    (char const *)0
};
extern void kadmin_getprinc __SS_PROTO;
static char const * const ssu00006[] = {
"list_principals",
    "listprincs",
    "get_principals",
    "getprincs",
    (char const *)0
};
extern void kadmin_getprincs __SS_PROTO;
static char const * const ssu00007[] = {
"add_policy",
    "addpol",
    (char const *)0
};
extern void kadmin_addpol __SS_PROTO;
static char const * const ssu00008[] = {
"modify_policy",
    "modpol",
    (char const *)0
};
extern void kadmin_modpol __SS_PROTO;
static char const * const ssu00009[] = {
"delete_policy",
    "delpol",
    (char const *)0
};
extern void kadmin_delpol __SS_PROTO;
static char const * const ssu00010[] = {
"get_policy",
    "getpol",
    (char const *)0
};
extern void kadmin_getpol __SS_PROTO;
static char const * const ssu00011[] = {
"list_policies",
    "listpols",
    "get_policies",
    "getpols",
    (char const *)0
};
extern void kadmin_getpols __SS_PROTO;
static char const * const ssu00012[] = {
"get_privs",
    "getprivs",
    (char const *)0
};
extern void kadmin_getprivs __SS_PROTO;
static char const * const ssu00013[] = {
"ktadd",
    "xst",
    (char const *)0
};
extern void kadmin_keytab_add __SS_PROTO;
static char const * const ssu00014[] = {
"ktremove",
    "ktrem",
    (char const *)0
};
extern void kadmin_keytab_remove __SS_PROTO;

static char const * const ssu00015[] = {
"lock",
    (char const *)0
};
extern void kadmin_lock __SS_PROTO;
static char const * const ssu00016[] = {
"unlock",
    (char const *)0
};
extern void kadmin_unlock __SS_PROTO;

static char const * const ssu00017[] = {
"list_requests",
    "lr",
    "?",
    (char const *)0
};

extern void ss_list_requests __SS_PROTO;
static char const * const ssu00018[] = {
"quit",
    "exit",
    "q",
    (char const *)0
};
extern void ss_quit __SS_PROTO;
static ss_request_entry ssu00019[] = {
    { ssu00001,
      kadmin_addprinc,
      gettext("Add principal"),
      0 },
    { ssu00002,
      kadmin_delprinc,
      gettext("Delete principal"),
      0 },
    { ssu00003,
      kadmin_modprinc,
      gettext("Modify principal"),
      0 },
    { ssu00004,
      kadmin_cpw,
      gettext("Change password"),
      0 },
    { ssu00005,
      kadmin_getprinc,
      gettext("Get principal"),
      0 },
    { ssu00006,
      kadmin_getprincs,
      gettext("List principals"),
      0 },
    { ssu00007,
      kadmin_addpol,
      gettext("Add policy"),
      0 },
    { ssu00008,
      kadmin_modpol,
      gettext("Modify policy"),
      0 },
    { ssu00009,
      kadmin_delpol,
      gettext("Delete policy"),
      0 },
    { ssu00010,
      kadmin_getpol,
      gettext("Get policy"),
      0 },
    { ssu00011,
      kadmin_getpols,
      gettext("List policies"),
      0 },
    { ssu00012,
      kadmin_getprivs,
      gettext("Get privileges"),
      0 },
    { ssu00013,
      kadmin_keytab_add,
      gettext("Add entry(s) to a keytab"),
      0 },
    { ssu00014,
      kadmin_keytab_remove,
      gettext("Remove entry(s) from a keytab"),
      0 },
    { ssu00015,
      kadmin_lock,
      gettext("Lock database exclusively (use with extreme caution!)"),
      0 },
    { ssu00016,
      kadmin_unlock,
      gettext("Release exclusive database lock"),
      0 },
    { ssu00017,
      ss_list_requests,
      gettext("List available requests."),
      0 },
    { ssu00018,
      ss_quit,
      gettext("Exit program."),
      0 },
    { 0, 0, 0, 0 }
};

ss_request_table kadmin_cmds = { 2, ssu00019 };

#undef gettext
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Contains kadmin.local specific code.
 */

#include <stdio.h>
#include <stdlib.h>
#include <libintl.h>
#include <db.h>
#include <krb5.h>


void
usage(char *whoami)
{
	fprintf(stderr,
	    "%s: %s [-r realm] [-p principal] [-q query] "
	    "[-d dbname] [-e \"enc:salt ...\"] [-m] [-D]\n",
	    gettext("Usage"), whoami);
	exit(1);
}


/*
 * Debugging function
 * Turns on low level debugging in db module
 * Requires that db library be compiled with -DDEBUG_DB flag
 */
/* ARGSUSED */
void
debugEnable(int displayMsgs)
{

#if DEBUG_DB
	debugDisplayDB(displayMsgs);
#endif

#if DEBUG
	/* Solaris Kerberos: not supported */
	/* debugDisplaySS(displayMsgs); */
#endif

}

void
kadmin_getprivs(argc, argv)
int argc;
char *argv[];
{
    static char *privs[] = {"GET", "ADD", "MODIFY", "DELETE", "LIST",
			    "CHANGEPW"};
	krb5_error_code retval;
	int i;
	long plist;

/*  for kadmin.local return all privilages  */

	printf(gettext("current privileges:"));
	for (i = 0; i < sizeof (privs) / 4; i++) {
		printf(" %s", gettext(privs[i]));
	}
	printf("\n");
}
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


/*
 * Contains remote client specific code.
 */

#include <stdio.h>
#include <stdlib.h>
#include <libintl.h>
#include <k5-int.h>
#include <krb5.h>

extern void *handle;

void
usage(char *whoami)
{
	fprintf(stderr,
	    "%s: %s [-r realm] [-p principal] [-q query] "
	    "[-s admin_server[:port]] [[-c ccache]|[-k [-t keytab]]"
	    "|[-w password]]\n",
	    gettext("Usage"), whoami);
	exit(1);
}


/*
 * Debugging function - for remote admin client
 */
/* ARGSUSED */
void
debugEnable(int displayMsgs)
{

#ifdef DEBUG
	/* Solaris Kerberos: not supported */
	/* debugDisplaySS(displayMsgs); */
#endif
}

void
kadmin_getprivs(argc, argv)
    int argc;
    char *argv[];
{
    static char *privs[] = {"GET", "ADD", "MODIFY", "DELETE", "LIST", "CHANGE"};
    krb5_error_code retval;
    int i;
    long plist;

    if (argc != 1) {
	fprintf(stderr, "%s: get_privs\n", gettext("usage"));
	return;
    }
    retval = kadm5_get_privs(handle, &plist);
    if (retval) {
	com_err("get_privs", retval,
		    gettext("while retrieving privileges"));
	return;
    }
    printf(gettext("current privileges:"));
    for (i = 0; i < sizeof (privs) / sizeof (char *); i++) {
	if (plist & 1 << i)
	    printf(" %s", gettext(privs[i]));
    }
    printf("\n");
}
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


/*
 * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
 *
 * $Id: keytab.c,v 1.28 2004/05/31 12:39:16 epeisach Exp $
 * $Source: /cvs/krbdev/krb5/src/kadmin/cli/keytab.c,v $
 */

/*
 * Copyright (C) 1998 by the FundsXpress, INC.
 *
 * All rights reserved.
 *
 * Export of this software from the United States of America may require
 * a specific license from the United States Government.  It is the
 * responsibility of any person or organization contemplating export to
 * obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of FundsXpress. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  FundsXpress makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#if !defined(lint) && !defined(__CODECENTER__)
static char *rcsid = "$Header: /cvs/krbdev/krb5/src/kadmin/cli/keytab.c,v 1.28 2004/05/31 12:39:16 epeisach Exp $";
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <libintl.h>

#include <kadm5/admin.h>
#include <krb5/adm_proto.h>
#include "kadmin.h"
#include <krb5.h>

static int add_principal(void *lhandle, char *keytab_str, krb5_keytab keytab,
			 krb5_boolean keepold,
			 int n_ks_tuple, krb5_key_salt_tuple *ks_tuple,
			 char *princ_str);
static int remove_principal(char *keytab_str, krb5_keytab keytab, char
			    *princ_str, char *kvno_str);
static char *etype_string(krb5_enctype enctype);
static char *etype_istring(krb5_enctype enctype);

static int quiet;

static void add_usage()
{
     fprintf(stderr, "%s: %s\n", gettext("Usage"),
	"ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] "
	"[principal | -glob princ-exp] [...]\n");
}

static void rem_usage()
{
	fprintf(stderr, "%s: %s\n",
	    gettext("Usage"),
	    "ktremove [-k[eytab] keytab] [-q] principal "
	    "[kvno|\"all\"|\"old\"]\n");
}

static int process_keytab(krb5_context my_context, char **keytab_str,
		   krb5_keytab *keytab)
{
     int code;
     char buf[BUFSIZ];

     if (*keytab_str == NULL) {
	if (code = krb5_kt_default(my_context, keytab)) {
		com_err(whoami, code, gettext("while opening default keytab"));
		return 1;
	}
	if (code = krb5_kt_get_name(my_context, *keytab, buf, BUFSIZ)) {
		com_err(whoami, code, gettext("while retrieving keytab name"));
		return 1;
	}
	if (!(*keytab_str = strdup(buf))) {
		com_err(whoami, ENOMEM, gettext("while creating keytab name"));
		return 1;
	}
     } else {
	  if (strchr(*keytab_str, ':') != NULL) {
	       *keytab_str = strdup(*keytab_str);
	       if (*keytab_str == NULL) {
				com_err(whoami, ENOMEM,
				    gettext("while creating keytab name"));
		    return 1;
	       }
	  } else {
	       char *tmp = *keytab_str;

	       *keytab_str = (char *)
		    malloc(strlen("WRFILE:")+strlen(tmp)+1);
	       if (*keytab_str == NULL) {
				com_err(whoami, ENOMEM,
				    gettext("while creating keytab name"));
		    return 1;
	       }
	       sprintf(*keytab_str, "WRFILE:%s", tmp);
	  }

	  code = krb5_kt_resolve(my_context, *keytab_str, keytab);
	  if (code != 0) {
			com_err(whoami, code,
			    gettext("while resolving keytab %s"), *keytab_str);
	       free(keytab_str);
	       return 1;
	  }
     }

     return 0;
}


void kadmin_keytab_add(int argc, char **argv)
{
     krb5_keytab keytab = 0;
     char *keytab_str = NULL, **princs;
     int code, num, i;
     krb5_error_code retval;
     int n_ks_tuple = 0;
     krb5_boolean keepold = FALSE;
     krb5_key_salt_tuple *ks_tuple = NULL;

     argc--; argv++;
     quiet = 0;
     while (argc) {
	  if (strncmp(*argv, "-k", 2) == 0) {
	       argc--; argv++;
	       if (!argc || keytab_str) {
		    add_usage();
		    return;
	       }
	       keytab_str = *argv;
	  } else if (strcmp(*argv, "-q") == 0) {
	       quiet++;
	  } else if (strcmp(*argv, "-e") == 0) {
	       argc--;
	       if (argc < 1) {
		    add_usage();
		    return;
	       }
	       retval = krb5_string_to_keysalts(*++argv, ", \t", ":.-", 0,
						&ks_tuple, &n_ks_tuple);
	       if (retval) {
		    com_err("ktadd", retval,
			    gettext("while parsing keysalts %s"),
			    *argv);

		    return;
	       }
	  } else
	       break;
	  argc--; argv++;
     }

     if (argc == 0) {
	  add_usage();
	  return;
     }

     if (process_keytab(context, &keytab_str, &keytab))
	  return;

     while (*argv) {
	  if (strcmp(*argv, "-glob") == 0) {
	       if (*++argv == NULL) {
		    add_usage();
		    break;
	       }

	       code = kadm5_get_principals(handle, *argv, &princs, &num);
	       if (code) {
				com_err(whoami, code,
					gettext("while expanding expression "
						"\"%s\"."),
			    *argv);
		    argv++;
		    continue;
	       }

	       for (i = 0; i < num; i++)
		    (void) add_principal(handle, keytab_str, keytab,
					 keepold, n_ks_tuple, ks_tuple,
					 princs[i]);
	       kadm5_free_name_list(handle, princs, num);
	  } else
	       (void) add_principal(handle, keytab_str, keytab,
				    keepold, n_ks_tuple, ks_tuple,
				    *argv);
	  argv++;
     }

     code = krb5_kt_close(context, keytab);
     if (code != 0)
		com_err(whoami, code, gettext("while closing keytab"));

     free(keytab_str);
}

void kadmin_keytab_remove(int argc, char **argv)
{
     krb5_keytab keytab = 0;
     char *keytab_str = NULL;
     int code;

     argc--; argv++;
     quiet = 0;
     while (argc) {
	  if (strncmp(*argv, "-k", 2) == 0) {
	       argc--; argv++;
	       if (!argc || keytab_str) {
		    rem_usage();
		    return;
	       }
	       keytab_str = *argv;
	  } else if (strcmp(*argv, "-q") == 0) {
	       quiet++;
	  } else
	       break;
	  argc--; argv++;
     }

     if (argc != 1 && argc != 2) {
	  rem_usage();
	  return;
     }
     if (process_keytab(context, &keytab_str, &keytab))
	  return;

     (void) remove_principal(keytab_str, keytab, argv[0], argv[1]);

     code = krb5_kt_close(context, keytab);
     if (code != 0)
		com_err(whoami, code, gettext("while closing keytab"));

     free(keytab_str);
}

static
int add_principal(void *lhandle, char *keytab_str, krb5_keytab keytab,
		  krb5_boolean keepold, int n_ks_tuple,
		  krb5_key_salt_tuple *ks_tuple,
		  char *princ_str)
{
     kadm5_principal_ent_rec princ_rec;
     krb5_principal princ;
     krb5_keytab_entry new_entry;
     krb5_keyblock *keys;
     int code, nkeys, i;
     int nktypes = 0;
     krb5_key_salt_tuple *permitted_etypes = NULL;

     (void) memset((char *)&princ_rec, 0, sizeof(princ_rec));

     princ = NULL;
     keys = NULL;
     nkeys = 0;

     code = krb5_parse_name(context, princ_str, &princ);
     if (code != 0) {
		com_err(whoami, code,
		    gettext("while parsing -add principal name %s"),
		  princ_str);
	  goto cleanup;
     }

     if (ks_tuple == NULL) {
	krb5_enctype *ptr, *ktypes = NULL;

	code = krb5_get_permitted_enctypes(context, &ktypes);
	if (!code && ktypes && *ktypes) {
		krb5_int32 salttype;
		/*
		 * Count the results.  This is stupid, the API above
		 * should have included an output param to indicate
	 	 * the size of the list that is returned.
		 */
		for (ptr = ktypes; *ptr; ptr++) nktypes++;

		/* Allocate a new key-salt tuple set */
		permitted_etypes = (krb5_key_salt_tuple *)malloc (
			sizeof (krb5_key_salt_tuple) * nktypes);
		if (permitted_etypes == NULL) {
			free(ktypes);
			return (ENOMEM);
		}

		/*
		 * Because the keysalt parameter doesn't matter for
		 * keys stored in the keytab, use the default "normal"
		 * salt for all keys
		 */
		(void) krb5_string_to_salttype("normal", &salttype);
		for (i = 0; i < nktypes; i++) {
			permitted_etypes[i].ks_enctype = ktypes[i];
			permitted_etypes[i].ks_salttype = salttype;
		}
		free(ktypes);
	} else {
		if (ktypes)
			free(ktypes);
		goto cleanup;
	}
     } else {
	permitted_etypes = ks_tuple;
	nktypes = n_ks_tuple;
     }

	 code = kadm5_randkey_principal_3(lhandle, princ,
					  keepold, nktypes, permitted_etypes,
					  &keys, &nkeys);

#ifndef _KADMIN_LOCAL_
	/* this block is not needed in the kadmin.local client */

	/*
	 * If the above call failed, we may be talking to an older
	 * admin server, so try the older API.
	 */
	if (code == KADM5_RPC_ERROR) {
		code = kadm5_randkey_principal_old(handle, princ, &keys, &nkeys);
	}
#endif /* !KADMIN_LOCAL */
     if (code != 0) {
	  if (code == KADM5_UNK_PRINC) {
			fprintf(stderr,
			    gettext("%s: Principal %s does not exist.\n"),
		       whoami, princ_str);
	/* Solaris Kerberos: Better error messages */
	  } else if (code == KRB5_BAD_ENCTYPE) {
			int i, et;
			fprintf(stderr, gettext("%s: Error from the remote system: "
			    "%s while changing %s's key\n"), whoami,
			    error_message(code), princ_str);
			if (nktypes) {
				et = permitted_etypes[0].ks_enctype;
				fprintf(stderr, gettext("%s: Encryption types "
				    "requested: %s (%d)"), whoami,
				    etype_istring(et), et);

				for (i = 1; i < nktypes; i++) {
					et = permitted_etypes[i].ks_enctype;
					fprintf(stderr, ", %s (%d)",
					    etype_istring(et), et);
				}
				fprintf(stderr, "\n");
			}
	  } else {
			com_err(whoami, code,
				gettext("while changing %s's key"),
				princ_str);
	  }
	  goto cleanup;
     }

     code = kadm5_get_principal(lhandle, princ, &princ_rec,
				KADM5_PRINCIPAL_NORMAL_MASK);
     if (code != 0) {
		com_err(whoami, code, gettext("while retrieving principal"));
	  goto cleanup;
     }

     for (i = 0; i < nkeys; i++) {
	  memset((char *) &new_entry, 0, sizeof(new_entry));
	  new_entry.principal = princ;
	  new_entry.key = keys[i];
	  new_entry.vno = princ_rec.kvno;

	  code = krb5_kt_add_entry(context, keytab, &new_entry);
	  if (code != 0) {
			com_err(whoami, code,
				gettext("while adding key to keytab"));
	       (void) kadm5_free_principal_ent(lhandle, &princ_rec);
	       goto cleanup;
	  }

	  if (!quiet)
			printf(gettext("Entry for principal %s with kvno %d, "
				"encryption type %s added to keytab %s.\n"),
		      princ_str, princ_rec.kvno,
		      etype_string(keys[i].enctype), keytab_str);
     }

     code = kadm5_free_principal_ent(lhandle, &princ_rec);
     if (code != 0) {
		com_err(whoami, code, gettext("while freeing principal entry"));
	  goto cleanup;
     }

cleanup:
     if (nkeys) {
	  for (i = 0; i < nkeys; i++)
	       krb5_free_keyblock_contents(context, &keys[i]);
	  free(keys);
     }
     if (princ)
	  krb5_free_principal(context, princ);

     if (permitted_etypes != NULL && ks_tuple == NULL)
	free(permitted_etypes);

     return code;
}

int remove_principal(char *keytab_str, krb5_keytab keytab, char
		     *princ_str, char *kvno_str)
{
     krb5_principal princ;
     krb5_keytab_entry entry;
     krb5_kt_cursor cursor;
     enum { UNDEF, SPEC, HIGH, ALL, OLD } mode;
     int code, did_something;
     krb5_kvno kvno;

     code = krb5_parse_name(context, princ_str, &princ);
     if (code != 0) {
		com_err(whoami, code,
			gettext("while parsing principal name %s"),
		  princ_str);
	  return code;
     }

     mode = UNDEF;
     if (kvno_str == NULL) {
	  mode = HIGH;
	  kvno = 0;
     } else if (strcmp(kvno_str, "all") == 0) {
	  mode = ALL;
	  kvno = 0;
     } else if (strcmp(kvno_str, "old") == 0) {
	  mode = OLD;
	  kvno = 0;
     } else {
	  mode = SPEC;
	  kvno = atoi(kvno_str);
     }

     /* kvno is set to specified value for SPEC, 0 otherwise */
     code = krb5_kt_get_entry(context, keytab, princ, kvno, 0, &entry);
     if (code != 0) {
	  if (code == ENOENT) {
			fprintf(stderr,
				gettext("%s: Keytab %s does not exist.\n"),
		       whoami, keytab_str);
	  } else if (code == KRB5_KT_NOTFOUND) {
	       if (mode != SPEC)
				fprintf(stderr,
					gettext("%s: No entry for principal "
						"%s exists in keytab %s\n"),
			    whoami, princ_str, keytab_str);
	       else
				fprintf(stderr,
					gettext("%s: No entry for principal "
						"%s with kvno %d exists in "
						"keytab %s.\n"),
					whoami, princ_str, kvno, keytab_str);
	  } else {
			com_err(whoami, code,
				gettext("while retrieving highest "
					"kvno from keytab"));
	  }
	  return code;
     }

     /* set kvno to spec'ed value for SPEC, highest kvno otherwise */
     kvno = entry.vno;
     krb5_kt_free_entry(context, &entry);

     code = krb5_kt_start_seq_get(context, keytab, &cursor);
     if (code != 0) {
		com_err(whoami, code, gettext("while starting keytab scan"));
	  return code;
     }

     did_something = 0;
     while ((code = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0) {
	  if (krb5_principal_compare(context, princ, entry.principal) &&
	      ((mode == ALL) ||
	       (mode == SPEC && entry.vno == kvno) ||
	       (mode == OLD && entry.vno != kvno) ||
	       (mode == HIGH && entry.vno == kvno))) {

	       /*
		* Ack!  What a kludge... the scanning functions lock
		* the keytab so entries cannot be removed while they
		* are operating.
		*/
	       code = krb5_kt_end_seq_get(context, keytab, &cursor);
	       if (code != 0) {
				com_err(whoami, code,
					gettext("while temporarily "
						"ending keytab scan"));
		    return code;
	       }
	       code = krb5_kt_remove_entry(context, keytab, &entry);
	       if (code != 0) {
				com_err(whoami, code,
					gettext("while deleting entry "
						"from keytab"));
		    return code;
	       }
	       code = krb5_kt_start_seq_get(context, keytab, &cursor);
	       if (code != 0) {
				com_err(whoami, code,
				    gettext("while restarting keytab scan"));
		    return code;
	       }

	       did_something++;
	       if (!quiet)
				printf(gettext("Entry for principal "
					    "%s with kvno %d "
					    "removed from keytab %s.\n"),
			   princ_str, entry.vno, keytab_str);
	  }
	  krb5_kt_free_entry(context, &entry);
     }
     if (code && code != KRB5_KT_END) {
		com_err(whoami, code, gettext("while scanning keytab"));
	  return code;
     }
     if ((code = krb5_kt_end_seq_get(context, keytab, &cursor))) {
		com_err(whoami, code, gettext("while ending keytab scan"));
	  return code;
     }

     /*
      * If !did_someting then mode must be OLD or we would have
      * already returned with an error.  But check it anyway just to
      * prevent unexpected error messages...
      */
     if (!did_something && mode == OLD) {
		fprintf(stderr,
		    gettext("%s: There is only one entry for principal "
			"%s in keytab %s\n"),
		    whoami, princ_str, keytab_str);
	  return 1;
     }

     return 0;
}

/*
 * etype_string(enctype): return a string representation of the
 * encryption type.  XXX copied from klist.c; this should be a
 * library function, or perhaps just #defines
 */
static char *etype_string(enctype)
    krb5_enctype enctype;
{
    static char buf[100];
    krb5_error_code ret;

    if ((ret = krb5_enctype_to_string(enctype, buf, sizeof(buf))))
	sprintf(buf, "etype %d", enctype);

    return buf;
}

/* Solaris Kerberos */
static char *etype_istring(krb5_enctype enctype) {
    static char buf[100];
    krb5_error_code ret;

    if ((ret = krb5_enctype_to_istring(enctype, buf, sizeof(buf))))
	sprintf(buf, "unknown", enctype);

    return (buf);
}

/*
 * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
 *
 *	Openvision retains the copyright to derivative works of
 *	this source code.  Do *NOT* create a derivative of this
 *	source code before consulting with your legal department.
 *	Do *NOT* integrate *ANY* of this source code into another
 *	product before consulting with your legal department.
 *
 *	For further information, read the top-level Openvision
 *	copyright which is contained in the top-level MIT Kerberos
 *	copyright.
 *
 * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
 *
 */


/*
 * Copyright 1994 by the Massachusetts Institute of Technology.
 * All Rights Reserved.
 *
 * Export of this software from the United States of America may
 *   require a specific license from the United States Government.
 *   It is the responsibility of any person or organization contemplating
 *   export to obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  Furthermore if you modify this software you must label
 * your software as modified software and not distribute it in such a
 * fashion that it might be confused with the original M.I.T. software.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 *
 * ss wrapper for kadmin
 */

#include <krb5.h>
#include <ss/ss.h>
#include <stdio.h>
#include <string.h>
#include <libintl.h>
#include <locale.h>
#include "kadmin.h"

extern ss_request_table kadmin_cmds;
extern int exit_status;
extern char *whoami;

int main(argc, argv)
    int argc;
    char *argv[];
{
    char *request;
    krb5_error_code retval;
    int sci_idx, code = 0;

    whoami = ((whoami = strrchr(argv[0], '/')) ? whoami+1 : argv[0]);

	(void) setlocale(LC_ALL, "");

#if !defined(TEXT_DOMAIN)  /* Should be defined by cc -D */
#define	TEXT_DOMAIN	"SYS_TEST"	/* Use this only if it weren't */
#endif

	(void) textdomain(TEXT_DOMAIN);

    request = kadmin_startup(argc, argv);
    sci_idx = ss_create_invocation(whoami, "5.0", (char *) NULL,
				   &kadmin_cmds, &retval);
    if (retval) {
	ss_perror(sci_idx, retval, gettext("creating invocation"));
	exit(1);
    }

	(void) setlocale(LC_ALL, "");
	(void) textdomain(TEXT_DOMAIN);

    if (request) {
	    code = ss_execute_line(sci_idx, request);
	    if (code != 0) {
		    ss_perror(sci_idx, code, request);
		    exit_status++;
	    }
    } else
            retval = ss_listen(sci_idx);
    return quit() ? 1 : exit_status;
}