kadmin selective prune of historic key for principal

kadmin/Makefile.am

@@ -26,6 +26,7 @@ dist_kadmin_SOURCES =				\
 	kadmin.c				\
 	load.c					\
 	mod.c					\
+	prune.c					\
 	rename.c				\
 	stash.c					\
 	util.c					\

kadmin/NTMakefile

@@ -59,6 +59,7 @@ KADMIN_OBJS=			    \
 	$(OBJ)\kadmin.obj	    \
 	$(OBJ)\load.obj		    \
 	$(OBJ)\mod.obj		    \
+	$(OBJ)\prune.obj	    \
 	$(OBJ)\rename.obj	    \
 	$(OBJ)\stash.obj	    \
 	$(OBJ)\util.obj		    \

kadmin/kadmin-commands.in

@@ -415,6 +415,19 @@ command = {
 	max_args = "1"
 	help = "Modifies some attributes of the specified principal."
 }
+command = {
+	name = "prune"
+	argument = "principal"
+	option = {
+		long = "kvno"
+		type = "integer"
+		help = "key version number"
+		default = "0"
+	}
+	min_args = "1"
+	max_args = "1"
+	help = "Delete keys from history by max-ticket-life or kvno."
+}
 command = {
 	name = "privileges"
 	name = "privs"

kadmin/kadmin.1

@@ -142,6 +142,19 @@ service belonging to the principal is known to not handle certain
 enctypes.
 .Ed
 .Pp
+.Nm prune
+.Ar principal [kvno]
+.Bd -ragged -offset indent
+Deletes the named principal's keys of the given kvno.  If a kvno is
+not given then this deletes all the named principals keys that are
+too old to be needed for decrypting tickets issued using those keys
+(i.e., any such tickets are necessarily expired).  The determination
+of "too old" is made using the max-ticket-life attribute of the
+principal; though in practice that max ticket life is also constrained
+by the max-ticket-life of the client principals and the krbtgt
+principals, those are not consulted here.
+.Ed
+.Pp
 .Nm ext_keytab
 .Oo Fl k Ar string \*(Ba Xo
 .Fl Fl keytab= Ns Ar string

kadmin/prune.c

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2018 Cesnet z.s.p.o.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "kadmin_locl.h"
+#include "kadmin-commands.h"
+
+int
+prune(struct prune_options *opt, int argc, char **argv)
+{
+    krb5_error_code ret = 0;
+    krb5_principal princ_ent = NULL;
+
+    if (argc == 0) {
+        krb5_warnx(context, "prune: missing principal name argument");
+        return 0;
+    }
+    if (argc > 1) {
+        krb5_warnx(context, "prune: too many arguments");
+        return 0;
+    }
+
+    ret = krb5_parse_name(context, argv[0], &princ_ent);
+    if (ret) {
+        krb5_warn(context, ret, "krb5_parse_name %s", argv[0]);
+        goto out2;
+    }
+
+    ret = kadm5_prune_principal(kadm_handle, princ_ent, opt->kvno_integer);
+    if (ret)
+        krb5_warn(context, ret, "kadm5_prune_principal");
+
+out2:
+    return ret != 0;
+}

kadmin/server.c

@@ -43,7 +43,7 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 		 krb5_data *in, krb5_data *out)
 {
     kadm5_ret_t ret;
-    int32_t cmd, mask, tmp;
+    int32_t cmd, mask, kvno, tmp;
     kadm5_server_context *contextp = kadm_handlep;
     char client[128], name[128], name2[128];
     const char *op = "";
@@ -249,6 +249,36 @@ kadmind_dispatch(void *kadm_handlep, krb5_boolean initial,
 	krb5_store_int32(sp, ret);
 	break;
     }
+    case kadm_prune:{
+        op = "PRUNE";
+        ret = krb5_ret_principal(sp, &princ);
+        if (ret)
+            goto fail;
+        ret = krb5_ret_int32(sp, &kvno);
+        if (ret == HEIM_ERR_EOF) {
+            kvno = 0;
+        } else if (ret) {
+            krb5_free_principal(contextp->context, princ);
+            goto fail;
+        }
+        krb5_unparse_name_fixed(contextp->context, princ, name, sizeof(name));
+        krb5_warnx(contextp->context, "%s: %s %s", client, op, name);
+        ret = _kadm5_acl_check_permission(contextp, KADM5_PRIV_CPW, princ);
+        if (ret) {
+            krb5_free_principal(contextp->context, princ);
+            goto fail;
+        }
+        ret = kadm5_prune_principal(kadm_handlep, princ, kvno);
+        krb5_free_principal(contextp->context, princ);
+        krb5_storage_free(sp);
+        sp = krb5_storage_emem();
+        if (sp == NULL) {
+            ret = ENOMEM;
+            goto fail;
+        }
+        krb5_store_int32(sp, ret);
+        break;
+    }
     case kadm_rename:{
 	op = "RENAME";
 	ret = krb5_ret_principal(sp, &princ);