/* * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #pragma ident "%Z%%M% %I% %E% SMI" /* * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING * * Openvision retains the copyright to derivative works of * this source code. Do *NOT* create a derivative of this * source code before consulting with your legal department. * Do *NOT* integrate *ANY* of this source code into another * product before consulting with your legal department. * * For further information, read the top-level Openvision * copyright which is contained in the top-level MIT Kerberos * copyright. * * WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING * */ /* * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved */ /* * Copyright (C) 1998 by the FundsXpress, INC. * * All rights reserved. * * Export of this software from the United States of America may require * a specific license from the United States Government. It is the * responsibility of any person or organization contemplating export to * obtain such a license before exporting. * * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and * distribute this software and its documentation for any purpose and * without fee is hereby granted, provided that the above copyright * notice appear in all copies and that both that copyright notice and * this permission notice appear in supporting documentation, and that * the name of FundsXpress. not be used in advertising or publicity pertaining * to distribution of the software without specific, written prior * permission. FundsXpress makes no representations about the suitability of * this software for any purpose. It is provided "as is" without express * or implied warranty. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ /* * SUNWresync121 XXX * Beware future resyncers, this file is much diff from MIT (1.0...) */ #include #include #include #include #include #ifdef _AIX #include #endif #include #include #include #include #include /* inet_ntoa */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "misc.h" #ifndef FD_SETSIZE #define FD_SETSIZE 256 #endif #ifndef MAX #define MAX(a, b) (((a) > (b)) ? (a) : (b)) #endif #if defined(NEED_DAEMON_PROTO) extern int daemon(int, int); #endif static int signal_request_exit = 0; static int schpw; kadm5_config_params chgpw_params; void kadm_svc_run(void); void setup_signal_handlers(iprop_role iproprole); void sig_exit(int); void sig_pipe(int); krb5_error_code log_kt_error(char*, char*); #ifdef POSIX_SIGNALS static struct sigaction s_action; #endif /* POSIX_SIGNALS */ #define TIMEOUT 15 typedef struct _auth_gssapi_name { char *name; gss_OID type; } auth_gssapi_name; gss_name_t gss_changepw_name = NULL, gss_oldchangepw_name = NULL; void *global_server_handle; /* * This is a kludge, but the server needs these constants to be * compatible with old clients. They are defined in , * but only if USE_KADM5_API_VERSION == 1. */ #define OVSEC_KADM_ADMIN_SERVICE_P "ovsec_adm@admin" #define OVSEC_KADM_CHANGEPW_SERVICE_P "ovsec_adm@changepw" /* * This enables us to set the keytab that gss_acquire_cred uses, but * it also restricts us to linking against the Kv5 GSS-API library. * Since this is *k*admind, that shouldn't be a problem. */ extern char *krb5_overridekeyname; extern void krb5_iprop_prog_1(); extern kadm5_ret_t kiprop_get_adm_host_srv_name( krb5_context, const char *, char **); static krb5_context context; /* XXX yuck. the signal handlers need this */ static krb5_context hctx; in_port_t l_port = 0; /* global local port num, for BSM audits */ int nofork = 0; /* global; don't fork (debug mode) */ /* * Function: usage * * Purpose: print out the server usage message * * Arguments: * Requires: * Effects: * Modifies: */ static void usage() { fprintf(stderr, gettext("Usage: kadmind [-x db_args]* [-r realm] [-m] [-d] " "[-p port-number]\n")); exit(1); } /* * Function: display_status * * Purpose: displays GSS-API messages * * Arguments: * * msg a string to be displayed with the message * maj_stat the GSS-API major status code * min_stat the GSS-API minor status code * * Effects: * * The GSS-API messages associated with maj_stat and min_stat are * displayed on stderr, each preceeded by "GSS-API error : " and * followed by a newline. */ static void display_status_1(char *, OM_uint32, int); static void display_status(msg, maj_stat, min_stat) char *msg; OM_uint32 maj_stat; OM_uint32 min_stat; { display_status_1(msg, maj_stat, GSS_C_GSS_CODE); display_status_1(msg, min_stat, GSS_C_MECH_CODE); } static void display_status_1(m, code, type) char *m; OM_uint32 code; int type; { OM_uint32 maj_stat, min_stat; gss_buffer_desc msg; OM_uint32 msg_ctx; msg_ctx = 0; while (1) { maj_stat = gss_display_status(&min_stat, code, type, GSS_C_NULL_OID, &msg_ctx, &msg); fprintf(stderr, "GSS-API error %s: %s\n", m, (char *)msg.value); (void) gss_release_buffer(&min_stat, &msg); if (!msg_ctx) break; } } /* * Solaris Kerberos: the following prototypes are needed because these are * private interfaces that do not have prototypes in any .h */ extern struct hostent *res_getipnodebyaddr(const void *, size_t, int, int *); extern void res_freehostent(struct hostent *); static void freedomnames(char **npp) { char **tpp; if (npp) { tpp = npp; while (*tpp++) { free(*(tpp-1)); } free(npp); } } /* * Construct a list of uniq FQDNs of all the net interfaces (except * krb5.conf master dups) and return it in arg 'dnames'. * * On successful return (0), caller must call freedomnames() * to free memory. */ static int getdomnames(krb5_context ctx, char *realm, char ***dnames) { krb5_address **addresses = NULL; krb5_address *a = NULL; struct hostent *hp = NULL; int ret, i, result=0, error; char **npp = NULL, **tpp=NULL; int dup=0, n = 0; char *cfhost = NULL; /* krb5 conf file master hostname */ if (ret = kadm5_get_master(ctx, realm, &cfhost)) { return (ret); } ret = krb5_os_localaddr(ctx, &addresses); if (ret != 0) { if (nofork) (void) fprintf(stderr, "kadmind: get localaddrs failed: %s", error_message(ret)); result = ret; goto err; } for (i=0; addresses[i]; i++) { a = addresses[i]; hp = res_getipnodebyaddr(a->contents, a->length, a->addrtype == ADDRTYPE_INET ? AF_INET : AF_INET6, &error); if (hp != NULL) { /* skip master host in krb5.conf */ if (strcasecmp(cfhost, hp->h_name) == 0) { res_freehostent(hp); hp = NULL; continue; } dup = 0; tpp = npp; /* skip if hostname already exists in list */ while (tpp && *tpp++) { if (strcasecmp(*(tpp-1), hp->h_name) == 0) { dup++; break; } } if (dup) { res_freehostent(hp); hp = NULL; continue; } npp = realloc(npp, sizeof(char *) * (n + 2)); if (!npp) { result = ENOMEM; goto err; } npp[n] = strdup(hp->h_name); if (!npp[n]) { result = ENOMEM; goto err; } npp[n+1] = NULL; n++; res_freehostent(hp); hp = NULL; result = 0; } } #ifdef DEBUG printf("getdomnames: n=%d, i=%d, npp=%p\n", n, i, npp); tpp = npp; while (tpp && *tpp++) { printf("tpp=%s\n", *(tpp-1)); } #endif goto out; err: if (npp) { freedomnames(npp); npp = NULL; } if (hp) { res_freehostent(hp); hp = NULL; } out: if (cfhost) { free (cfhost); cfhost = NULL; } if (addresses) { krb5_free_addresses(ctx, addresses); addresses = NULL; } if (result == 0) *dnames = npp; return (result); } /* * Set the rpcsec_gss svc names for all net interfaces. */ static void set_svc_domnames(char *svcname, char **dnames, u_int program, u_int version) { bool_t ret; char **tpp = dnames; if (!tpp) return; while (*tpp++) { /* MAX_NAME_LEN from rpc/rpcsec_gss.h */ char name[MAXHOSTNAMELEN+MAX_NAME_LEN+2] = {0}; (void) snprintf(name, sizeof(name), "%s@%s", svcname, *(tpp-1)); ret = rpc_gss_set_svc_name(name, "kerberos_v5", 0, program, version); if (nofork && ret) (void) fprintf(stderr, "rpc_gss_set_svc_name success: %s\n", name); } } int main(int argc, char *argv[]) { SVCXPRT *transp; extern char *optarg; extern int optind, opterr; int ret, rlen, oldnames = 0; OM_uint32 OMret, major_status, minor_status; char *whoami; FILE *acl_file; gss_buffer_desc in_buf; struct servent *srv; struct sockaddr_in addr; struct sockaddr_in *sin; int s; int optchar; struct netconfig *nconf; void *handlep; int fd; struct t_info tinfo; struct t_bind tbindstr, *tres; struct t_optmgmt req, resp; struct opthdr *opt; char reqbuf[128]; struct rlimit rl; char *kiprop_name = NULL; /* IProp svc name */ kdb_log_context *log_ctx; kadm5_server_handle_t handle; krb5_context ctx; kadm5_config_params params; char **db_args = NULL; int db_args_size = 0; auth_gssapi_name names[6]; gss_buffer_desc gssbuf; gss_OID nt_krb5_name_oid; char **dnames = NULL; int retdn; int iprop_supported; /* This is OID value the Krb5_Name NameType */ gssbuf.value = "{1 2 840 113554 1 2 2 1}"; gssbuf.length = strlen(gssbuf.value); major_status = gss_str_to_oid(&minor_status, &gssbuf, &nt_krb5_name_oid); if (major_status != GSS_S_COMPLETE) { fprintf(stderr, gettext("Couldn't create KRB5 Name NameType OID\n")); display_status("str_to_oid", major_status, minor_status); exit(1); } names[0].name = names[1].name = names[2].name = names[3].name = names[4].name = names[5].name =NULL; names[0].type = names[1].type = names[2].type = names[3].type = names[4].type = names[5].type = (gss_OID) nt_krb5_name_oid; whoami = (strrchr(argv[0], '/') ? strrchr(argv[0], '/') + 1 : argv[0]); (void) setlocale(LC_ALL, ""); #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ #endif (void) textdomain(TEXT_DOMAIN); nofork = 0; memset((char *) ¶ms, 0, sizeof (params)); while ((optchar = getopt(argc, argv, "r:mdp:x:")) != EOF) { switch (optchar) { case 'r': if (!optarg) usage(); params.realm = optarg; params.mask |= KADM5_CONFIG_REALM; break; case 'm': params.mkey_from_kbd = 1; params.mask |= KADM5_CONFIG_MKEY_FROM_KBD; break; case 'd': nofork = 1; break; case 'p': if (!optarg) usage(); params.kadmind_port = atoi(optarg); params.mask |= KADM5_CONFIG_KADMIND_PORT; break; case 'x': if (!optarg) usage(); db_args_size++; { char **temp = realloc( db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */ if( temp == NULL ) { fprintf(stderr, gettext("%s: cannot initialize. Not enough memory\n"), whoami); exit(1); } db_args = temp; } db_args[db_args_size-1] = optarg; db_args[db_args_size] = NULL; break; case '?': default: usage(); } } if (getrlimit(RLIMIT_NOFILE, &rl) == 0) { rl.rlim_cur = rl.rlim_max = MAX(rl.rlim_max, FD_SETSIZE); (void) setrlimit(RLIMIT_NOFILE, &rl); (void) enable_extended_FILE_stdio(-1, -1); } if (ret = krb5_init_context(&context)) { fprintf(stderr, gettext("%s: %s while initializing context, aborting\n"), whoami, error_message(ret)); exit(1); } krb5_klog_init(context, "admin_server", whoami, 1); /* SUNW14resync */ #if 0 krb5_klog_syslog(LOG_INFO, "Seeding random number generator"); ret = krb5_c_random_os_entropy(context, 1, NULL); if(ret) { krb5_klog_syslog(LOG_ERR, "Error getting random seed: %s, aborting", error_message(ret)); exit(1); } #endif /* * When using the Horowitz/IETF protocol for * password changing, the default port is 464 * (officially recognized by IANA) * * DEFAULT_KPASSWD_PORT -> 464 */ chgpw_params.kpasswd_port = DEFAULT_KPASSWD_PORT; chgpw_params.mask |= KADM5_CONFIG_KPASSWD_PORT; chgpw_params.kpasswd_protocol = KRB5_CHGPWD_CHANGEPW_V2; chgpw_params.mask |= KADM5_CONFIG_KPASSWD_PROTOCOL; if (ret = kadm5_get_config_params(context, NULL, NULL, &chgpw_params, &chgpw_params)) { krb5_klog_syslog(LOG_ERR, gettext("%s: %s while initializing," " aborting"), whoami, error_message(ret)); fprintf(stderr, gettext("%s: %s while initializing, aborting\n"), whoami, error_message(ret)); krb5_klog_close(context); exit(1); } /* * We now setup the socket and bind() to port 464, so that * kadmind can now listen to and process change-pwd requests * from non-Solaris Kerberos V5 clients such as Microsoft, * MIT, AIX, HP etc */ if ((schpw = socket(AF_INET, SOCK_DGRAM, 0)) < 0) { krb5_klog_syslog(LOG_ERR, gettext( "cannot create simple " "chpw socket: %s"), error_message(errno)); fprintf(stderr, gettext("Cannot create simple chpw " "socket: %s"), error_message(errno)); krb5_klog_close(context); exit(1); } memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = INADDR_ANY; addr.sin_port = htons(chgpw_params.kpasswd_port); if (bind(schpw, (struct sockaddr *)&addr, sizeof(addr)) < 0) { char portbuf[32]; int oerrno = errno; fprintf(stderr, gettext("%s: Cannot bind socket.\n"), whoami); fprintf(stderr, gettext("bind: %s\n"), error_message(oerrno)); errno = oerrno; (void) snprintf(portbuf, sizeof (portbuf), "%d", ntohs(addr.sin_port)); krb5_klog_syslog(LOG_ERR, gettext("cannot bind simple " "chpw socket: %s"), error_message(oerrno)); if(oerrno == EADDRINUSE) { char *w = strrchr(whoami, '/'); if (w) { w++; } else { w = whoami; } fprintf(stderr, gettext( "This probably means that another %s process\n" "is already running, or that another program\n" "is using the server port (number %d).\n" "If another %s is already running, you should\n" "kill it before restarting the server.\n"), w, ntohs(addr.sin_port), w); } krb5_klog_close(context); exit(1); } if (ret = kadm5_get_config_params(context, NULL, NULL, ¶ms, ¶ms)) { krb5_klog_syslog(LOG_ERR, gettext("%s: %s while initializing," " aborting"), whoami, error_message(ret)); fprintf(stderr, gettext("%s: %s while initializing, aborting\n"), whoami, error_message(ret)); krb5_klog_close(context); exit(1); } #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_ACL_FILE) if ((params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) { krb5_klog_syslog(LOG_ERR, gettext("%s: Missing required configuration values " "while initializing, aborting"), whoami, (params.mask & REQUIRED_PARAMS) ^ REQUIRED_PARAMS); fprintf(stderr, gettext("%s: Missing required configuration values " "(%lx) while initializing, aborting\n"), whoami, (params.mask & REQUIRED_PARAMS) ^ REQUIRED_PARAMS); krb5_klog_close(context); exit(1); } memset((char *) &addr, 0, sizeof (struct sockaddr_in)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = INADDR_ANY; l_port = addr.sin_port = htons(params.kadmind_port); sin = &addr; if ((handlep = setnetconfig()) == (void *) NULL) { (void) krb5_klog_syslog(LOG_ERR, gettext("cannot get any transport information")); krb5_klog_close(context); exit(1); } while (nconf = getnetconfig(handlep)) { if ((nconf->nc_semantics == NC_TPI_COTS_ORD) && (strcmp(nconf->nc_protofmly, NC_INET) == 0) && (strcmp(nconf->nc_proto, NC_TCP) == 0)) break; } if (nconf == (struct netconfig *) NULL) { (void) endnetconfig(handlep); krb5_klog_close(context); exit(1); } fd = t_open(nconf->nc_device, O_RDWR, &tinfo); if (fd == -1) { krb5_klog_syslog(LOG_ERR, gettext("unable to open connection for ADMIN server")); krb5_klog_close(context); exit(1); } /* LINTED */ opt = (struct opthdr *) reqbuf; opt->level = SOL_SOCKET; opt->name = SO_REUSEADDR; opt->len = sizeof (int); /* * The option value is "1". This will allow the server to restart * whilst the previous process is cleaning up after itself in a * FIN_WAIT_2 or TIME_WAIT state. If another process is started * outside of smf(5) then bind will fail anyway, which is what we want. */ reqbuf[sizeof (struct opthdr)] = 1; req.flags = T_NEGOTIATE; req.opt.len = sizeof (struct opthdr) + opt->len; req.opt.buf = (char *) opt; resp.flags = 0; resp.opt.buf = reqbuf; resp.opt.maxlen = sizeof (reqbuf); if (t_optmgmt(fd, &req, &resp) < 0 || resp.flags != T_SUCCESS) { t_error("t_optmgmt"); exit(1); } /* Transform addr to netbuf */ tres = (struct t_bind *) t_alloc(fd, T_BIND, T_ADDR); if (tres == NULL) { (void) t_close(fd); (void) krb5_klog_syslog(LOG_ERR, gettext("cannot allocate netbuf")); krb5_klog_close(context); exit(1); } tbindstr.qlen = 8; tbindstr.addr.buf = (char *) sin; tbindstr.addr.len = tbindstr.addr.maxlen = __rpc_get_a_size(tinfo.addr); sin = (struct sockaddr_in *) tbindstr.addr.buf; /* SUNWresync121 XXX (void) memset(&addr, 0, sizeof(addr)); */ if (t_bind(fd, &tbindstr, tres) < 0) { int oerrno = errno; fprintf(stderr, gettext("%s: Cannot bind socket.\n"), whoami); fprintf(stderr, gettext("bind: %s\n"), error_message(oerrno)); errno = oerrno; krb5_klog_syslog(LOG_ERR, gettext("Cannot bind socket: %s"), error_message(errno)); if (oerrno == EADDRINUSE) { char *w = strrchr(whoami, '/'); if (w) { w++; } else { w = whoami; } fprintf(stderr, gettext( "This probably means that another %s " "process is already\n" "running, or that another program is using " "the server port (number %d)\n" "after being assigned it by the RPC " "portmap deamon. If another\n" "%s is already running, you should kill " "it before\n" "restarting the server. If, on the other hand, " "another program is\n" "using the server port, you should kill it " "before running\n" "%s, and ensure that the conflict does " "not occur in the\n" "future by making sure that %s is started " "on reboot\n" "before portmap.\n"), w, ntohs(addr.sin_port), w, w, w); krb5_klog_syslog(LOG_ERR, gettext("Check for already-running %s or for " "another process using port %d"), w, htons(addr.sin_port)); } krb5_klog_close(context); exit(1); } transp = svc_tli_create(fd, nconf, NULL, 0, 0); (void) t_free((char *) tres, T_BIND); if (transp == NULL) { fprintf(stderr, gettext("%s: Cannot create RPC service.\n"), whoami); krb5_klog_syslog(LOG_ERR, gettext("Cannot create RPC service: %m")); krb5_klog_close(context); exit(1); } if (!svc_register(transp, KADM, KADMVERS, kadm_1, 0)) { fprintf(stderr, gettext("%s: Cannot register RPC service.\n"), whoami); krb5_klog_syslog(LOG_ERR, gettext("Cannot register RPC service, failing.")); krb5_klog_close(context); exit(1); } /* * XXX krb5_defkeyname is an internal library global and should go * away */ krb5_overridekeyname = params.admin_keytab; /* Solaris Kerberos: * The only service principals which matter here are * -> names[0].name (kadmin/) * -> names[1].name (changepw/) * KADM5_ADMIN_SERVICE_P, KADM5_CHANGEPW_SERVICE_P, * OVSEC_KADM_ADMIN_SERVICE_P, OVSEC_KADM_CHANGEPW_SERVICE_P * are all legacy service princs and calls to rpc_gss_set_svc_name() * using these principals will always fail as they are not host * based principals. */ (void) kadm5_get_adm_host_srv_name(context, params.realm, &names[0].name); (void) kadm5_get_cpw_host_srv_name(context, params.realm, &names[1].name); names[2].name = KADM5_ADMIN_SERVICE_P; names[3].name = KADM5_CHANGEPW_SERVICE_P; names[4].name = OVSEC_KADM_ADMIN_SERVICE_P; names[5].name = OVSEC_KADM_CHANGEPW_SERVICE_P; if (names[0].name == NULL || names[1].name == NULL || names[2].name == NULL || names[3].name == NULL || names[4].name == NULL || names[5].name == NULL) { krb5_klog_syslog(LOG_ERR, gettext("Cannot initialize GSS-API authentication, " "failing.")); fprintf(stderr, gettext("%s: Cannot initialize " "GSS-API authentication.\n"), whoami); krb5_klog_close(context); exit(1); } /* * Try to acquire creds for the old OV services as well as the new * names, but if that fails just fall back on the new names. */ if (rpc_gss_set_svc_name(names[5].name, "kerberos_v5", 0, KADM, KADMVERS) && rpc_gss_set_svc_name(names[4].name, "kerberos_v5", 0, KADM, KADMVERS)) oldnames++; if (rpc_gss_set_svc_name(names[3].name, "kerberos_v5", 0, KADM, KADMVERS)) oldnames++; if (rpc_gss_set_svc_name(names[2].name, "kerberos_v5", 0, KADM, KADMVERS)) oldnames++; /* If rpc_gss_set_svc_name() fails for either kadmin/ or * for changepw/ then try to determine if this is caused * by a missing keytab file or entry. If so, log it and continue. */ if (rpc_gss_set_svc_name(names[0].name, "kerberos_v5", 0, KADM, KADMVERS)) oldnames++; else log_kt_error(names[0].name, whoami); if (rpc_gss_set_svc_name(names[1].name, "kerberos_v5", 0, KADM, KADMVERS)) oldnames++; else log_kt_error(names[1].name, whoami); retdn = getdomnames(context, params.realm, &dnames); if (retdn == 0 && dnames) { /* * Multi-homed KDCs sometimes may need to set svc names * for multiple net interfaces so we set them for * all interfaces just in case. */ set_svc_domnames(KADM5_ADMIN_HOST_SERVICE, dnames, KADM, KADMVERS); set_svc_domnames(KADM5_CHANGEPW_HOST_SERVICE, dnames, KADM, KADMVERS); } /* if set_names succeeded, this will too */ in_buf.value = names[1].name; in_buf.length = strlen(names[1].name) + 1; (void) gss_import_name(&OMret, &in_buf, (gss_OID) nt_krb5_name_oid, &gss_changepw_name); if (oldnames) { in_buf.value = names[3].name; in_buf.length = strlen(names[3].name) + 1; (void) gss_import_name(&OMret, &in_buf, (gss_OID) nt_krb5_name_oid, &gss_oldchangepw_name); } if (ret = kadm5int_acl_init(context, 0, params.acl_file)) { krb5_klog_syslog(LOG_ERR, gettext("Cannot initialize acl file: %s"), error_message(ret)); fprintf(stderr, gettext("%s: Cannot initialize acl file: %s\n"), whoami, error_message(ret)); krb5_klog_close(context); exit(1); } if ((ret = kadm5_init("kadmind", NULL, NULL, ¶ms, KADM5_STRUCT_VERSION, KADM5_API_VERSION_2, db_args, &global_server_handle)) != KADM5_OK) { krb5_klog_syslog(LOG_ERR, gettext("%s while initializing, aborting"), error_message(ret)); fprintf(stderr, gettext("%s: %s while initializing, aborting\n"), whoami, error_message(ret)); krb5_klog_close(context); exit(1); } if (!nofork && (ret = daemon(0, 0))) { ret = errno; krb5_klog_syslog(LOG_ERR, gettext("Cannot detach from tty: %s"), error_message(ret)); fprintf(stderr, gettext("%s: Cannot detach from tty: %s\n"), whoami, error_message(ret)); krb5_klog_close(context); exit(1); } if( db_args ) { free(db_args), db_args=NULL; } handle = global_server_handle; ctx = handle->context; if (params.iprop_enabled == TRUE) { if (ret = krb5_db_supports_iprop(ctx, &iprop_supported)) { fprintf(stderr, gettext("%s: %s while trying to determine if KDB " "plugin supports iprop\n"), whoami, error_message(ret)); krb5_klog_syslog(LOG_ERR, gettext("%s while trying to determine if KDB " "plugin supports iprop"), error_message(ret)); krb5_klog_close(ctx); exit(1); } if (!iprop_supported) { fprintf(stderr, gettext("%s: Warning, current KDB " "plugin does not support iprop, continuing " "with iprop disabled\n"), whoami); krb5_klog_syslog(LOG_WARNING, gettext("%s Warning, current KDB " "plugin does not support iprop, continuing " "with iprop disabled")); krb5_klog_close(ctx); ulog_set_role(ctx, IPROP_NULL); } else ulog_set_role(ctx, IPROP_MASTER); } else ulog_set_role(ctx, IPROP_NULL); log_ctx = ctx->kdblog_context; if (log_ctx && (log_ctx->iproprole == IPROP_MASTER)) { /* * IProp is enabled, so let's map in the update log * and setup the service. */ if (ret = ulog_map(ctx, ¶ms, FKADMIND)) { fprintf(stderr, gettext("%s: %s while mapping update log " "(`%s.ulog')\n"), whoami, error_message(ret), params.dbname); krb5_klog_syslog(LOG_ERR, gettext("%s while mapping update log " "(`%s.ulog')"), error_message(ret), params.dbname); krb5_klog_close(ctx); exit(1); } if (nofork) fprintf(stderr, "%s: create IPROP svc (PROG=%d, VERS=%d)\n", whoami, KRB5_IPROP_PROG, KRB5_IPROP_VERS); if (!svc_create(krb5_iprop_prog_1, KRB5_IPROP_PROG, KRB5_IPROP_VERS, "circuit_v")) { fprintf(stderr, gettext("%s: Cannot create IProp RPC service (PROG=%d, VERS=%d)\n"), whoami, KRB5_IPROP_PROG, KRB5_IPROP_VERS); krb5_klog_syslog(LOG_ERR, gettext("Cannot create IProp RPC service (PROG=%d, VERS=%d), failing."), KRB5_IPROP_PROG, KRB5_IPROP_VERS); krb5_klog_close(ctx); exit(1); } if (ret = kiprop_get_adm_host_srv_name(ctx, params.realm, &kiprop_name)) { krb5_klog_syslog(LOG_ERR, gettext("%s while getting IProp svc name, failing"), error_message(ret)); fprintf(stderr, gettext("%s: %s while getting IProp svc name, failing\n"), whoami, error_message(ret)); krb5_klog_close(ctx); exit(1); } if (!rpc_gss_set_svc_name(kiprop_name, "kerberos_v5", 0, KRB5_IPROP_PROG, KRB5_IPROP_VERS)) { rpc_gss_error_t err; (void) rpc_gss_get_error(&err); /* Try to determine if the error was caused by a missing keytab or * missing keytab entries (and log it). */ log_kt_error(kiprop_name, whoami); krb5_klog_syslog(LOG_ERR, gettext("Unable to set RPCSEC_GSS service name (`%s'), failing."), kiprop_name ? kiprop_name : ""); fprintf(stderr, gettext("%s: Unable to set RPCSEC_GSS service name (`%s'), failing.\n"), whoami, kiprop_name ? kiprop_name : ""); if (nofork) { fprintf(stderr, "%s: set svc name (rpcsec err=%d, sys err=%d)\n", whoami, err.rpc_gss_error, err.system_error); } exit(1); } free(kiprop_name); if (retdn == 0 && dnames) { set_svc_domnames(KADM5_KIPROP_HOST_SERVICE, dnames, KRB5_IPROP_PROG, KRB5_IPROP_VERS); } } else { if (!oldnames) { /* rpc_gss_set_svc_name failed for both kadmin/ and * changepw/. */ krb5_klog_syslog(LOG_ERR, gettext("Unable to set RPCSEC_GSS service names " "('%s, %s')"), names[0].name, names[1].name); fprintf(stderr, gettext("%s: Unable to set RPCSEC_GSS service names " "('%s, %s')\n"), whoami, names[0].name, names[1].name); krb5_klog_close(context); exit(1); } } if (dnames) freedomnames(dnames); setup_signal_handlers(log_ctx->iproprole); krb5_klog_syslog(LOG_INFO, gettext("starting")); if (nofork) fprintf(stderr, "%s: starting...\n", whoami); /* * We now call our own customized async event processing * function kadm_svc_run(), as opposed to svc_run() earlier, * since this enables kadmind to also listen-to/process * non-RPCSEC_GSS based change-pwd requests apart from the * regular, RPCSEC_GSS kpasswd requests from Solaris Krb5 clients. */ kadm_svc_run(); krb5_klog_syslog(LOG_INFO, gettext("finished, exiting")); kadm5_destroy(global_server_handle); t_close(fd); krb5_klog_close(context); exit(0); } /* * Function: kadm_svc_run * * Purpose: modified version of sunrpc svc_run. * which closes the database every TIMEOUT seconds. * * Arguments: * Requires: * Effects: * Modifies: */ void kadm_svc_run(void) { struct pollfd *rfd = 0; struct timeval timeout; int pollret; int nfds = 0; int i; while(signal_request_exit == 0) { timeout.tv_sec = TIMEOUT; timeout.tv_usec = 0; if (nfds != svc_max_pollfd) { rfd = realloc(rfd, sizeof (pollfd_t) * svc_max_pollfd); nfds = svc_max_pollfd; } (void) memcpy(rfd, svc_pollfd, sizeof (pollfd_t) * svc_max_pollfd); for (i = 0; i < nfds; i++) { if (rfd[i].fd == -1) { rfd[i].fd = schpw; rfd[i].events = POLLIN; break; } } switch(pollret = poll(rfd, nfds, __rpc_timeval_to_msec(&timeout))) { case -1: if(errno == EINTR) continue; perror("poll"); return; case 0: continue; default: for (i = 0; i < nfds; i++) { if (rfd[i].revents & POLLIN) { if (rfd[i].fd == schpw) handle_chpw(context, schpw, global_server_handle, &chgpw_params); else svc_getreq_poll(rfd, pollret); break; } else { if (i == (nfds - 1)) perror("poll"); } } break; } } } /* * Function: setup_signal_handlers * * Purpose: Setup signal handling functions with System V's signal(). */ void setup_signal_handlers(iprop_role iproprole) { signal(SIGINT, sig_exit); signal(SIGTERM, sig_exit); signal(SIGQUIT, sig_exit); signal(SIGPIPE, sig_pipe); /* * IProp will fork for a full-resync, we don't want to * wait on it and we don't want the living dead procs either. */ if (iproprole == IPROP_MASTER) (void) signal(SIGCHLD, SIG_IGN); return; } /* * Function: sig_exit * * Purpose: sets flags saying the server got a signal and that it * should exit when convenient. * * Effects: * Modifies signal_request_exit which ideally makes the server exit * at some point. * * Modifies: * Signal_request_exit */ void sig_exit(int signum) { krb5_klog_syslog(LOG_NOTICE, gettext("Got signal to request exit")); signal_request_exit = 1; return; } /* * Function: sig_pipe * * Purpose: SIGPIPE handler * * Effects: krb5_klog_syslog a message that a SIGPIPE occurred and returns, * thus causing the read() or write() to fail and, presumable, the RPC * to recover. Otherwise, the process aborts. */ void sig_pipe(int unused) { krb5_klog_syslog(LOG_NOTICE, gettext("Warning: Received a SIGPIPE; " "probably a client aborted. Continuing.")); } /* * Given a service name (s_name) determine if the keytab file exists * and if the keytab entry is present. Log missing keytab * at LOG_ERR and log missing keytab entries at LOG_WARNING. * If any of krb5_* (or strdup) fail it will return the failure. */ krb5_error_code log_kt_error(char *s_name, char *whoami) { krb5_keytab kt; krb5_principal princ; krb5_keytab_entry entry; krb5_error_code code = 0; char kt_name[MAX_KEYTAB_NAME_LEN]; char *service; char *host; service = strdup(s_name); if(!service) return ENOMEM; host = strchr(service, '@'); *host++ = '\0'; if (code = krb5_sname_to_principal(context, host, service, KRB5_NT_SRV_HST, &princ)) { krb5_klog_syslog(LOG_ERR, gettext("krb5_sname_to_principal failed: %s"), error_message(code)); fprintf(stderr, gettext("%s: krb5_sname_to_principal failed: %s"), whoami, error_message(code)); free(service); return code; } if (code = krb5_kt_default_name(context, kt_name, sizeof (kt_name))) { krb5_klog_syslog(LOG_ERR, gettext("krb5_kt_default_name failed: %s"), error_message(code)); fprintf(stderr, gettext("%s: krb5_kt_default_name failed: %s"), whoami, error_message(code)); krb5_free_principal(context, princ); free(service); return code; } if (code = krb5_kt_default(context, &kt)) { krb5_klog_syslog(LOG_ERR, gettext("krb5_kt_default failed: %s"), error_message(code)); fprintf(stderr, gettext("%s: krb5_kt_default failed: %s"), whoami, error_message(code)); krb5_free_principal(context, princ); free(service); return code; } code = krb5_kt_get_entry(context, kt, princ, 0, 0, &entry); switch (code) { case 0: krb5_kt_free_entry(context, &entry); break; case KRB5_KT_NOTFOUND: krb5_klog_syslog(LOG_WARNING, gettext("Keytab entry \"%s/%s\" is missing from \"%s\""), service, host, kt_name); fprintf(stderr, gettext("%s: Keytab entry \"%s/%s\" is missing from \"%s\".\n"), whoami, service, host, kt_name); break; case ENOENT: krb5_klog_syslog(LOG_ERR, gettext("Keytab file \"%s\" does not exist"), kt_name); fprintf(stderr, gettext("%s: Keytab file \"%s\" does not exist.\n"), whoami, kt_name); break; } krb5_kt_close(context,kt); krb5_free_principal(context, princ); free(service); return code; }