xref: /freebsd/crypto/heimdal/kpasswd/kpasswdd.c (revision 3ef51c5fb9163f2aafb1c14729e06a8bf0c4d113)
1 /*
2  * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
3  * (Royal Institute of Technology, Stockholm, Sweden).
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  *
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * 3. Neither the name of the Institute nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include "kpasswd_locl.h"
35 RCSID("$Id$");
36 
37 #include <kadm5/admin.h>
38 #ifdef HAVE_SYS_UN_H
39 #include <sys/un.h>
40 #endif
41 #include <hdb.h>
42 #include <kadm5/private.h>
43 
44 static krb5_context context;
45 static krb5_log_facility *log_facility;
46 
47 static struct getarg_strings addresses_str;
48 krb5_addresses explicit_addresses;
49 
50 static sig_atomic_t exit_flag = 0;
51 
52 static void
53 add_one_address (const char *str, int first)
54 {
55     krb5_error_code ret;
56     krb5_addresses tmp;
57 
58     ret = krb5_parse_address (context, str, &tmp);
59     if (ret)
60 	krb5_err (context, 1, ret, "parse_address `%s'", str);
61     if (first)
62 	krb5_copy_addresses(context, &tmp, &explicit_addresses);
63     else
64 	krb5_append_addresses(context, &explicit_addresses, &tmp);
65     krb5_free_addresses (context, &tmp);
66 }
67 
68 static void
69 send_reply (int s,
70 	    struct sockaddr *sa,
71 	    int sa_size,
72 	    krb5_data *ap_rep,
73 	    krb5_data *rest)
74 {
75     struct msghdr msghdr;
76     struct iovec iov[3];
77     uint16_t len, ap_rep_len;
78     u_char header[6];
79     u_char *p;
80 
81     if (ap_rep)
82 	ap_rep_len = ap_rep->length;
83     else
84 	ap_rep_len = 0;
85 
86     len = 6 + ap_rep_len + rest->length;
87     p = header;
88     *p++ = (len >> 8) & 0xFF;
89     *p++ = (len >> 0) & 0xFF;
90     *p++ = 0;
91     *p++ = 1;
92     *p++ = (ap_rep_len >> 8) & 0xFF;
93     *p++ = (ap_rep_len >> 0) & 0xFF;
94 
95     memset (&msghdr, 0, sizeof(msghdr));
96     msghdr.msg_name       = (void *)sa;
97     msghdr.msg_namelen    = sa_size;
98     msghdr.msg_iov        = iov;
99     msghdr.msg_iovlen     = sizeof(iov)/sizeof(*iov);
100 #if 0
101     msghdr.msg_control    = NULL;
102     msghdr.msg_controllen = 0;
103 #endif
104 
105     iov[0].iov_base       = (char *)header;
106     iov[0].iov_len        = 6;
107     if (ap_rep_len) {
108 	iov[1].iov_base   = ap_rep->data;
109 	iov[1].iov_len    = ap_rep->length;
110     } else {
111 	iov[1].iov_base   = NULL;
112 	iov[1].iov_len    = 0;
113     }
114     iov[2].iov_base       = rest->data;
115     iov[2].iov_len        = rest->length;
116 
117     if (sendmsg (s, &msghdr, 0) < 0)
118 	krb5_warn (context, errno, "sendmsg");
119 }
120 
121 static int
122 make_result (krb5_data *data,
123 	     uint16_t result_code,
124 	     const char *expl)
125 {
126     char *str;
127     krb5_data_zero (data);
128 
129     data->length = asprintf (&str,
130 			     "%c%c%s",
131 			     (result_code >> 8) & 0xFF,
132 			     result_code & 0xFF,
133 			     expl);
134 
135     if (str == NULL) {
136 	krb5_warnx (context, "Out of memory generating error reply");
137 	return 1;
138     }
139     data->data = str;
140     return 0;
141 }
142 
143 static void
144 reply_error (krb5_realm realm,
145 	     int s,
146 	     struct sockaddr *sa,
147 	     int sa_size,
148 	     krb5_error_code error_code,
149 	     uint16_t result_code,
150 	     const char *expl)
151 {
152     krb5_error_code ret;
153     krb5_data error_data;
154     krb5_data e_data;
155     krb5_principal server = NULL;
156 
157     if (make_result(&e_data, result_code, expl))
158 	return;
159 
160     if (realm) {
161 	ret = krb5_make_principal (context, &server, realm,
162 				   "kadmin", "changepw", NULL);
163 	if (ret) {
164 	    krb5_data_free (&e_data);
165 	    return;
166 	}
167     }
168 
169     ret = krb5_mk_error (context,
170 			 error_code,
171 			 NULL,
172 			 &e_data,
173 			 NULL,
174 			 server,
175 			 NULL,
176 			 NULL,
177 			 &error_data);
178     if (server)
179 	krb5_free_principal(context, server);
180     krb5_data_free (&e_data);
181     if (ret) {
182 	krb5_warn (context, ret, "Could not even generate error reply");
183 	return;
184     }
185     send_reply (s, sa, sa_size, NULL, &error_data);
186     krb5_data_free (&error_data);
187 }
188 
189 static void
190 reply_priv (krb5_auth_context auth_context,
191 	    int s,
192 	    struct sockaddr *sa,
193 	    int sa_size,
194 	    uint16_t result_code,
195 	    const char *expl)
196 {
197     krb5_error_code ret;
198     krb5_data krb_priv_data;
199     krb5_data ap_rep_data;
200     krb5_data e_data;
201 
202     ret = krb5_mk_rep (context,
203 		       auth_context,
204 		       &ap_rep_data);
205     if (ret) {
206 	krb5_warn (context, ret, "Could not even generate error reply");
207 	return;
208     }
209 
210     if (make_result(&e_data, result_code, expl))
211 	return;
212 
213     ret = krb5_mk_priv (context,
214 			auth_context,
215 			&e_data,
216 			&krb_priv_data,
217 			NULL);
218     krb5_data_free (&e_data);
219     if (ret) {
220 	krb5_warn (context, ret, "Could not even generate error reply");
221 	return;
222     }
223     send_reply (s, sa, sa_size, &ap_rep_data, &krb_priv_data);
224     krb5_data_free (&ap_rep_data);
225     krb5_data_free (&krb_priv_data);
226 }
227 
228 /*
229  * Change the password for `principal', sending the reply back on `s'
230  * (`sa', `sa_size') to `pwd_data'.
231  */
232 
233 static void
234 change (krb5_auth_context auth_context,
235 	krb5_principal admin_principal,
236 	uint16_t version,
237 	int s,
238 	struct sockaddr *sa,
239 	int sa_size,
240 	krb5_data *in_data)
241 {
242     krb5_error_code ret;
243     char *client = NULL, *admin = NULL;
244     const char *pwd_reason;
245     kadm5_config_params conf;
246     void *kadm5_handle = NULL;
247     krb5_principal principal = NULL;
248     krb5_data *pwd_data = NULL;
249     char *tmp;
250     ChangePasswdDataMS chpw;
251 
252     memset (&conf, 0, sizeof(conf));
253     memset(&chpw, 0, sizeof(chpw));
254 
255     if (version == KRB5_KPASSWD_VERS_CHANGEPW) {
256 	ret = krb5_copy_data(context, in_data, &pwd_data);
257 	if (ret) {
258 	    krb5_warn (context, ret, "krb5_copy_data");
259 	    reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
260 			"out out memory copying password");
261 	    return;
262 	}
263 	principal = admin_principal;
264     } else if (version == KRB5_KPASSWD_VERS_SETPW) {
265 	size_t len;
266 
267 	ret = decode_ChangePasswdDataMS(in_data->data, in_data->length,
268 					&chpw, &len);
269 	if (ret) {
270 	    krb5_warn (context, ret, "decode_ChangePasswdDataMS");
271 	    reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
272 			"malformed ChangePasswdData");
273 	    return;
274 	}
275 
276 
277 	ret = krb5_copy_data(context, &chpw.newpasswd, &pwd_data);
278 	if (ret) {
279 	    krb5_warn (context, ret, "krb5_copy_data");
280 	    reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_MALFORMED,
281 			"out out memory copying password");
282 	    goto out;
283 	}
284 
285 	if (chpw.targname == NULL && chpw.targrealm != NULL) {
286 	    krb5_warn (context, ret, "kadm5_init_with_password_ctx");
287 	    reply_priv (auth_context, s, sa, sa_size,
288 			KRB5_KPASSWD_MALFORMED,
289 			"targrealm but not targname");
290 	    goto out;
291 	}
292 
293 	if (chpw.targname) {
294 	    krb5_principal_data princ;
295 
296 	    princ.name = *chpw.targname;
297 	    princ.realm = *chpw.targrealm;
298 	    if (princ.realm == NULL) {
299 		ret = krb5_get_default_realm(context, &princ.realm);
300 
301 		if (ret) {
302 		    krb5_warnx (context,
303 				"kadm5_init_with_password_ctx: "
304 				"failed to allocate realm");
305 		    reply_priv (auth_context, s, sa, sa_size,
306 				KRB5_KPASSWD_SOFTERROR,
307 				"failed to allocate realm");
308 		    goto out;
309 		}
310 	    }
311 	    ret = krb5_copy_principal(context, &princ, &principal);
312 	    if (*chpw.targrealm == NULL)
313 		free(princ.realm);
314 	    if (ret) {
315 		krb5_warn(context, ret, "krb5_copy_principal");
316 		reply_priv(auth_context, s, sa, sa_size,
317 			   KRB5_KPASSWD_HARDERROR,
318 			   "failed to allocate principal");
319 		goto out;
320 	    }
321 	} else
322 	    principal = admin_principal;
323     } else {
324 	krb5_warnx (context, "kadm5_init_with_password_ctx: unknown proto");
325 	reply_priv (auth_context, s, sa, sa_size,
326 		    KRB5_KPASSWD_HARDERROR,
327 		    "Unknown protocol used");
328 	return;
329     }
330 
331     ret = krb5_unparse_name (context, admin_principal, &admin);
332     if (ret) {
333 	krb5_warn (context, ret, "unparse_name failed");
334 	reply_priv (auth_context, s, sa, sa_size,
335 		    KRB5_KPASSWD_HARDERROR, "out of memory error");
336 	goto out;
337     }
338 
339     conf.realm = principal->realm;
340     conf.mask |= KADM5_CONFIG_REALM;
341 
342     ret = kadm5_init_with_password_ctx(context,
343 				       admin,
344 				       NULL,
345 				       KADM5_ADMIN_SERVICE,
346 				       &conf, 0, 0,
347 				       &kadm5_handle);
348     if (ret) {
349 	krb5_warn (context, ret, "kadm5_init_with_password_ctx");
350 	reply_priv (auth_context, s, sa, sa_size, 2,
351 		    "Internal error");
352 	goto out;
353     }
354 
355     ret = krb5_unparse_name(context, principal, &client);
356     if (ret) {
357 	krb5_warn (context, ret, "unparse_name failed");
358 	reply_priv (auth_context, s, sa, sa_size,
359 		    KRB5_KPASSWD_HARDERROR, "out of memory error");
360 	goto out;
361     }
362 
363     /*
364      * Check password quality if not changing as administrator
365      */
366 
367     if (krb5_principal_compare(context, admin_principal, principal) == TRUE) {
368 
369 	pwd_reason = kadm5_check_password_quality (context, principal,
370 						   pwd_data);
371 	if (pwd_reason != NULL ) {
372 	    krb5_warnx (context,
373 			"%s didn't pass password quality check with error: %s",
374 			client, pwd_reason);
375 	    reply_priv (auth_context, s, sa, sa_size,
376 			KRB5_KPASSWD_SOFTERROR, pwd_reason);
377 	    goto out;
378 	}
379 	krb5_warnx (context, "Changing password for %s", client);
380     } else {
381 	ret = _kadm5_acl_check_permission(kadm5_handle, KADM5_PRIV_CPW,
382 					  principal);
383 	if (ret) {
384 	    krb5_warn (context, ret,
385 		       "Check ACL failed for %s for changing %s password",
386 		       admin, client);
387 	    reply_priv (auth_context, s, sa, sa_size,
388 			KRB5_KPASSWD_HARDERROR, "permission denied");
389 	    goto out;
390 	}
391 	krb5_warnx (context, "%s is changing password for %s", admin, client);
392     }
393 
394     ret = krb5_data_realloc(pwd_data, pwd_data->length + 1);
395     if (ret) {
396 	krb5_warn (context, ret, "malloc: out of memory");
397 	reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_HARDERROR,
398 		    "Internal error");
399 	goto out;
400     }
401     tmp = pwd_data->data;
402     tmp[pwd_data->length - 1] = '\0';
403 
404     ret = kadm5_s_chpass_principal_cond (kadm5_handle, principal, tmp);
405     krb5_free_data (context, pwd_data);
406     pwd_data = NULL;
407     if (ret) {
408 	const char *str = krb5_get_error_message(context, ret);
409 	krb5_warnx(context, "kadm5_s_chpass_principal_cond: %s", str);
410 	reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SOFTERROR,
411 		    str ? str : "Internal error");
412 	krb5_free_error_message(context, str);
413 	goto out;
414     }
415     reply_priv (auth_context, s, sa, sa_size, KRB5_KPASSWD_SUCCESS,
416 		"Password changed");
417 out:
418     free_ChangePasswdDataMS(&chpw);
419     if (principal != admin_principal)
420 	krb5_free_principal(context, principal);
421     if (admin)
422 	free(admin);
423     if (client)
424 	free(client);
425     if (pwd_data)
426 	krb5_free_data(context, pwd_data);
427     if (kadm5_handle)
428 	kadm5_destroy (kadm5_handle);
429 }
430 
431 static int
432 verify (krb5_auth_context *auth_context,
433 	krb5_realm *realms,
434 	krb5_keytab keytab,
435 	krb5_ticket **ticket,
436 	krb5_data *out_data,
437 	uint16_t *version,
438 	int s,
439 	struct sockaddr *sa,
440 	int sa_size,
441 	u_char *msg,
442 	size_t len)
443 {
444     krb5_error_code ret;
445     uint16_t pkt_len, pkt_ver, ap_req_len;
446     krb5_data ap_req_data;
447     krb5_data krb_priv_data;
448     krb5_realm *r;
449 
450     /*
451      * Only send an error reply if the request passes basic length
452      * verification.  Otherwise, kpasswdd would reply to every UDP packet,
453      * allowing an attacker to set up a ping-pong DoS attack via a spoofed UDP
454      * packet with a source address of another UDP service that also replies
455      * to every packet.
456      *
457      * Also suppress the error reply if ap_req_len is 0, which indicates
458      * either an invalid request or an error packet.  An error packet may be
459      * the result of a ping-pong attacker pointing us at another kpasswdd.
460      */
461     pkt_len = (msg[0] << 8) | (msg[1]);
462     pkt_ver = (msg[2] << 8) | (msg[3]);
463     ap_req_len = (msg[4] << 8) | (msg[5]);
464     if (pkt_len != len) {
465 	krb5_warnx (context, "Strange len: %ld != %ld",
466 		    (long)pkt_len, (long)len);
467 	return 1;
468     }
469     if (ap_req_len == 0) {
470 	krb5_warnx (context, "Request is error packet (ap_req_len == 0)");
471 	return 1;
472     }
473     if (pkt_ver != KRB5_KPASSWD_VERS_CHANGEPW &&
474 	pkt_ver != KRB5_KPASSWD_VERS_SETPW) {
475 	krb5_warnx (context, "Bad version (%d)", pkt_ver);
476 	reply_error (NULL, s, sa, sa_size, 0, 1, "Wrong program version");
477 	return 1;
478     }
479     *version = pkt_ver;
480 
481     ap_req_data.data   = msg + 6;
482     ap_req_data.length = ap_req_len;
483 
484     ret = krb5_rd_req (context,
485 		       auth_context,
486 		       &ap_req_data,
487 		       NULL,
488 		       keytab,
489 		       NULL,
490 		       ticket);
491     if (ret) {
492 	krb5_warn (context, ret, "krb5_rd_req");
493 	reply_error (NULL, s, sa, sa_size, ret, 3, "Authentication failed");
494 	return 1;
495     }
496 
497     /* verify realm and principal */
498     for (r = realms; *r != NULL; r++) {
499 	krb5_principal principal;
500 	krb5_boolean same;
501 
502 	ret = krb5_make_principal (context,
503 				   &principal,
504 				   *r,
505 				   "kadmin",
506 				   "changepw",
507 				   NULL);
508 	if (ret)
509 	    krb5_err (context, 1, ret, "krb5_make_principal");
510 
511 	same = krb5_principal_compare(context, principal, (*ticket)->server);
512 	krb5_free_principal(context, principal);
513 	if (same == TRUE)
514 	    break;
515     }
516     if (*r == NULL) {
517 	char *str;
518 	krb5_unparse_name(context, (*ticket)->server, &str);
519 	krb5_warnx (context, "client used not valid principal %s", str);
520 	free(str);
521 	reply_error (NULL, s, sa, sa_size, ret, 1,
522 		     "Bad request");
523 	goto out;
524     }
525 
526     if (strcmp((*ticket)->server->realm, (*ticket)->client->realm) != 0) {
527 	krb5_warnx (context, "server realm (%s) not same a client realm (%s)",
528 		    (*ticket)->server->realm, (*ticket)->client->realm);
529 	reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 1,
530 		     "Bad request");
531 	goto out;
532     }
533 
534     if (!(*ticket)->ticket.flags.initial) {
535 	krb5_warnx (context, "initial flag not set");
536 	reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 1,
537 		     "Bad request");
538 	goto out;
539     }
540     krb_priv_data.data   = msg + 6 + ap_req_len;
541     krb_priv_data.length = len - 6 - ap_req_len;
542 
543     ret = krb5_rd_priv (context,
544 			*auth_context,
545 			&krb_priv_data,
546 			out_data,
547 			NULL);
548 
549     if (ret) {
550 	krb5_warn (context, ret, "krb5_rd_priv");
551 	reply_error ((*ticket)->server->realm, s, sa, sa_size, ret, 3,
552 		     "Bad request");
553 	goto out;
554     }
555     return 0;
556 out:
557     krb5_free_ticket (context, *ticket);
558     ticket = NULL;
559     return 1;
560 }
561 
562 static void
563 process (krb5_realm *realms,
564 	 krb5_keytab keytab,
565 	 int s,
566 	 krb5_address *this_addr,
567 	 struct sockaddr *sa,
568 	 int sa_size,
569 	 u_char *msg,
570 	 int len)
571 {
572     krb5_error_code ret;
573     krb5_auth_context auth_context = NULL;
574     krb5_data out_data;
575     krb5_ticket *ticket;
576     krb5_address other_addr;
577     uint16_t version;
578 
579 
580     krb5_data_zero (&out_data);
581 
582     ret = krb5_auth_con_init (context, &auth_context);
583     if (ret) {
584 	krb5_warn (context, ret, "krb5_auth_con_init");
585 	return;
586     }
587 
588     krb5_auth_con_setflags (context, auth_context,
589 			    KRB5_AUTH_CONTEXT_DO_SEQUENCE);
590 
591     ret = krb5_sockaddr2address (context, sa, &other_addr);
592     if (ret) {
593 	krb5_warn (context, ret, "krb5_sockaddr2address");
594 	goto out;
595     }
596 
597     ret = krb5_auth_con_setaddrs (context,
598 				  auth_context,
599 				  this_addr,
600 				  &other_addr);
601     krb5_free_address (context, &other_addr);
602     if (ret) {
603 	krb5_warn (context, ret, "krb5_auth_con_setaddr");
604 	goto out;
605     }
606 
607     if (verify (&auth_context, realms, keytab, &ticket, &out_data,
608 		&version, s, sa, sa_size, msg, len) == 0) {
609 	change (auth_context,
610 		ticket->client,
611 		version,
612 		s,
613 		sa, sa_size,
614 		&out_data);
615 	memset (out_data.data, 0, out_data.length);
616 	krb5_free_ticket (context, ticket);
617     }
618 
619 out:
620     krb5_data_free (&out_data);
621     krb5_auth_con_free (context, auth_context);
622 }
623 
624 static int
625 doit (krb5_keytab keytab, int port)
626 {
627     krb5_error_code ret;
628     int *sockets;
629     int maxfd;
630     krb5_realm *realms;
631     krb5_addresses addrs;
632     unsigned n, i;
633     fd_set real_fdset;
634     struct sockaddr_storage __ss;
635     struct sockaddr *sa = (struct sockaddr *)&__ss;
636 
637     ret = krb5_get_default_realms(context, &realms);
638     if (ret)
639 	krb5_err (context, 1, ret, "krb5_get_default_realms");
640 
641     if (explicit_addresses.len) {
642 	addrs = explicit_addresses;
643     } else {
644 	ret = krb5_get_all_server_addrs (context, &addrs);
645 	if (ret)
646 	    krb5_err (context, 1, ret, "krb5_get_all_server_addrs");
647     }
648     n = addrs.len;
649 
650     sockets = malloc (n * sizeof(*sockets));
651     if (sockets == NULL)
652 	krb5_errx (context, 1, "out of memory");
653     maxfd = -1;
654     FD_ZERO(&real_fdset);
655     for (i = 0; i < n; ++i) {
656 	krb5_socklen_t sa_size = sizeof(__ss);
657 
658 	krb5_addr2sockaddr (context, &addrs.val[i], sa, &sa_size, port);
659 
660 	sockets[i] = socket (sa->sa_family, SOCK_DGRAM, 0);
661 	if (sockets[i] < 0)
662 	    krb5_err (context, 1, errno, "socket");
663 	if (bind (sockets[i], sa, sa_size) < 0) {
664 	    char str[128];
665 	    size_t len;
666 	    int save_errno = errno;
667 
668 	    ret = krb5_print_address (&addrs.val[i], str, sizeof(str), &len);
669 	    if (ret)
670 		strlcpy(str, "unknown address", sizeof(str));
671 	    krb5_warn (context, save_errno, "bind(%s)", str);
672 	    continue;
673 	}
674 	maxfd = max (maxfd, sockets[i]);
675 	if (maxfd >= FD_SETSIZE)
676 	    krb5_errx (context, 1, "fd too large");
677 	FD_SET(sockets[i], &real_fdset);
678     }
679     if (maxfd == -1)
680 	krb5_errx (context, 1, "No sockets!");
681 
682     while(exit_flag == 0) {
683 	krb5_ssize_t retx;
684 	fd_set fdset = real_fdset;
685 
686 	retx = select (maxfd + 1, &fdset, NULL, NULL, NULL);
687 	if (retx < 0) {
688 	    if (errno == EINTR)
689 		continue;
690 	    else
691 		krb5_err (context, 1, errno, "select");
692 	}
693 	for (i = 0; i < n; ++i)
694 	    if (FD_ISSET(sockets[i], &fdset)) {
695 		u_char buf[BUFSIZ];
696 		socklen_t addrlen = sizeof(__ss);
697 
698 		retx = recvfrom(sockets[i], buf, sizeof(buf), 0,
699 				sa, &addrlen);
700 		if (retx < 0) {
701 		    if(errno == EINTR)
702 			break;
703 		    else
704 			krb5_err (context, 1, errno, "recvfrom");
705 		}
706 
707 		process (realms, keytab, sockets[i],
708 			 &addrs.val[i],
709 			 sa, addrlen,
710 			 buf, retx);
711 	    }
712     }
713 
714     for (i = 0; i < n; ++i)
715 	close(sockets[i]);
716     free(sockets);
717 
718     krb5_free_addresses (context, &addrs);
719     krb5_free_host_realm (context, realms);
720     krb5_free_context (context);
721     return 0;
722 }
723 
724 static RETSIGTYPE
725 sigterm(int sig)
726 {
727     exit_flag = 1;
728 }
729 
730 static const char *check_library  = NULL;
731 static const char *check_function = NULL;
732 static getarg_strings policy_libraries = { 0, NULL };
733 static char sHDB[] = "HDB:";
734 static char *keytab_str = sHDB;
735 static char *realm_str;
736 static int version_flag;
737 static int help_flag;
738 static char *port_str;
739 static char *config_file;
740 
741 struct getargs args[] = {
742 #ifdef HAVE_DLOPEN
743     { "check-library", 0, arg_string, &check_library,
744       "library to load password check function from", "library" },
745     { "check-function", 0, arg_string, &check_function,
746       "password check function to load", "function" },
747     { "policy-libraries", 0, arg_strings, &policy_libraries,
748       "password check function to load", "function" },
749 #endif
750     { "addresses",	0,	arg_strings, &addresses_str,
751       "addresses to listen on", "list of addresses" },
752     { "keytab", 'k', arg_string, &keytab_str,
753       "keytab to get authentication key from", "kspec" },
754     { "config-file", 'c', arg_string, &config_file, NULL, NULL },
755     { "realm", 'r', arg_string, &realm_str, "default realm", "realm" },
756     { "port",  'p', arg_string, &port_str, "port", NULL },
757     { "version", 0, arg_flag, &version_flag, NULL, NULL },
758     { "help", 0, arg_flag, &help_flag, NULL, NULL }
759 };
760 int num_args = sizeof(args) / sizeof(args[0]);
761 
762 int
763 main (int argc, char **argv)
764 {
765     krb5_keytab keytab;
766     krb5_error_code ret;
767     char **files;
768     int port, i;
769 
770     krb5_program_setup(&context, argc, argv, args, num_args, NULL);
771 
772     if(help_flag)
773 	krb5_std_usage(0, args, num_args);
774     if(version_flag) {
775 	print_version(NULL);
776 	exit(0);
777     }
778 
779     if (config_file == NULL) {
780 	asprintf(&config_file, "%s/kdc.conf", hdb_db_dir(context));
781 	if (config_file == NULL)
782 	    errx(1, "out of memory");
783     }
784 
785     ret = krb5_prepend_config_files_default(config_file, &files);
786     if (ret)
787 	krb5_err(context, 1, ret, "getting configuration files");
788 
789     ret = krb5_set_config_files(context, files);
790     krb5_free_config_files(files);
791     if (ret)
792 	krb5_err(context, 1, ret, "reading configuration files");
793 
794     if(realm_str)
795 	krb5_set_default_realm(context, realm_str);
796 
797     krb5_openlog (context, "kpasswdd", &log_facility);
798     krb5_set_warn_dest(context, log_facility);
799 
800     if (port_str != NULL) {
801 	struct servent *s = roken_getservbyname (port_str, "udp");
802 
803 	if (s != NULL)
804 	    port = s->s_port;
805 	else {
806 	    char *ptr;
807 
808 	    port = strtol (port_str, &ptr, 10);
809 	    if (port == 0 && ptr == port_str)
810 		krb5_errx (context, 1, "bad port `%s'", port_str);
811 	    port = htons(port);
812 	}
813     } else
814 	port = krb5_getportbyname (context, "kpasswd", "udp", KPASSWD_PORT);
815 
816     ret = krb5_kt_register(context, &hdb_kt_ops);
817     if(ret)
818 	krb5_err(context, 1, ret, "krb5_kt_register");
819 
820     ret = krb5_kt_resolve(context, keytab_str, &keytab);
821     if(ret)
822 	krb5_err(context, 1, ret, "%s", keytab_str);
823 
824     kadm5_setup_passwd_quality_check (context, check_library, check_function);
825 
826     for (i = 0; i < policy_libraries.num_strings; i++) {
827 	ret = kadm5_add_passwd_quality_verifier(context,
828 						policy_libraries.strings[i]);
829 	if (ret)
830 	    krb5_err(context, 1, ret, "kadm5_add_passwd_quality_verifier");
831     }
832     ret = kadm5_add_passwd_quality_verifier(context, NULL);
833     if (ret)
834 	krb5_err(context, 1, ret, "kadm5_add_passwd_quality_verifier");
835 
836 
837     explicit_addresses.len = 0;
838 
839     if (addresses_str.num_strings) {
840 	int j;
841 
842 	for (j = 0; j < addresses_str.num_strings; ++j)
843 	    add_one_address (addresses_str.strings[j], j == 0);
844 	free_getarg_strings (&addresses_str);
845     } else {
846 	char **foo = krb5_config_get_strings (context, NULL,
847 					      "kdc", "addresses", NULL);
848 
849 	if (foo != NULL) {
850 	    add_one_address (*foo++, TRUE);
851 	    while (*foo)
852 		add_one_address (*foo++, FALSE);
853 	}
854     }
855 
856 #ifdef HAVE_SIGACTION
857     {
858 	struct sigaction sa;
859 
860 	sa.sa_flags = 0;
861 	sa.sa_handler = sigterm;
862 	sigemptyset(&sa.sa_mask);
863 
864 	sigaction(SIGINT,  &sa, NULL);
865 	sigaction(SIGTERM, &sa, NULL);
866     }
867 #else
868     signal(SIGINT,  sigterm);
869     signal(SIGTERM, sigterm);
870 #endif
871 
872     pidfile(NULL);
873 
874     return doit (keytab, port);
875 }
876